aicodeman 1.45.0 → 1.47.0

package/dist/web/public/whats-new.json

@@ -1,13 +1,12 @@
 {
-  "version": "1.45.0",
+  "version": "1.47.0",
   "highlights": [
-    "Rename a case and its folder (#680)",
-    "A per-session agent inbox (#690)",
-    "Pick the agent from Cmd+K (#685)",
-    "A resizable header toolbar (#689)",
-    "GPU and CPU clock readings (#692, opt-in)",
-    "A tunnel no longer locks everyone out after ten typos (#684, multi-user mode)",
-    "The first wheel notch moves a Codex transcript (#699)",
-    "The wheel no longer moves a Codex menu's selection (#698)"
+    "The wrapped tab strip uses the room under the toolbar (#721)",
+    "Bodyless requests work through Cloudflare Tunnel (#725)",
+    "A desktop dead key is typed once, and Ctrl+V stays a paste after a replay (#726, #716)",
+    "Remote sessions no longer touch the local disk at their path (#722, #727, #728)",
+    "Rendered Markdown fills a resized File Viewer (#730)",
+    "A middle click on a file path opens the file (#731)",
+    "No more duplicate-key warning on build (#729)"
   ]
 }

package/dist/web/request-body-parser.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @fileoverview Accept empty, untyped API POSTs even when a reverse proxy frames them as chunked.
+ *
+ * Cloudflare Tunnel (cloudflared, Go's HTTP client) forwards a bodyless POST as an HTTP/1.1
+ * chunked request with no Content-Type and a zero-length body. Fastify only skips its
+ * content-type check for a `Content-Length: 0` request, so this framing was refused 415
+ * (`FST_ERR_CTP_INVALID_MEDIA_TYPE`) before the route ran, breaking actions such as opening a
+ * saved web tab. This parser lets such a request reach its route with `request.body === undefined`,
+ * exactly as a `Content-Length: 0` request does.
+ *
+ * Scope is POST under `/api/` only: Go frames an empty body of unknown length as chunked for
+ * POST, PUT and PATCH and drops it for DELETE, and every PUT/PATCH the frontend sends carries a
+ * JSON body. Anything else (another method, a non-API route, a Content-Type, a non-zero
+ * Content-Length, or a single body byte) is still the 415 Fastify would have answered.
+ *
+ * ⚠️ It owns the ROOT `'*'` content-type slot. The JSON, `text/plain` (kept RAW, see the CSRF
+ * note in CLAUDE.md) and multipart parsers match first; the web-tab proxy registers its own
+ * `'*'` in an encapsulated scope and is unaffected. Fastify refuses a second root `'*'` parser at
+ * boot (`FST_ERR_CTP_ALREADY_PRESENT`), so extend this function instead of adding one.
+ */
+import { type FastifyInstance } from 'fastify';
+export declare function installEmptyApiPostParser(app: FastifyInstance): void;
+//# sourceMappingURL=request-body-parser.d.ts.map

package/dist/web/request-body-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body-parser.d.ts","sourceRoot":"","sources":["../../src/web/request-body-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAc,KAAK,eAAe,EAAuB,MAAM,SAAS,CAAC;AAGhF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAmCpE"}

package/dist/web/request-body-parser.js

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Accept empty, untyped API POSTs even when a reverse proxy frames them as chunked.
+ *
+ * Cloudflare Tunnel (cloudflared, Go's HTTP client) forwards a bodyless POST as an HTTP/1.1
+ * chunked request with no Content-Type and a zero-length body. Fastify only skips its
+ * content-type check for a `Content-Length: 0` request, so this framing was refused 415
+ * (`FST_ERR_CTP_INVALID_MEDIA_TYPE`) before the route ran, breaking actions such as opening a
+ * saved web tab. This parser lets such a request reach its route with `request.body === undefined`,
+ * exactly as a `Content-Length: 0` request does.
+ *
+ * Scope is POST under `/api/` only: Go frames an empty body of unknown length as chunked for
+ * POST, PUT and PATCH and drops it for DELETE, and every PUT/PATCH the frontend sends carries a
+ * JSON body. Anything else (another method, a non-API route, a Content-Type, a non-zero
+ * Content-Length, or a single body byte) is still the 415 Fastify would have answered.
+ *
+ * ⚠️ It owns the ROOT `'*'` content-type slot. The JSON, `text/plain` (kept RAW, see the CSRF
+ * note in CLAUDE.md) and multipart parsers match first; the web-tab proxy registers its own
+ * `'*'` in an encapsulated scope and is unaffected. Fastify refuses a second root `'*'` parser at
+ * boot (`FST_ERR_CTP_ALREADY_PRESENT`), so extend this function instead of adding one.
+ */
+import { errorCodes } from 'fastify';
+export function installEmptyApiPostParser(app) {
+    // Existing JSON, text and multipart parsers take precedence. The webview
+    // proxy installs its own parser in an encapsulated scope.
+    app.addContentTypeParser('*', async (req, payload) => {
+        // Fastify normally skips an unsupported parser on its 404 path. Preserve
+        // that behavior, including the unread stream used by referer fallbacks.
+        if (req.is404)
+            return undefined;
+        if (req.method !== 'POST' ||
+            !req.routeOptions.url?.startsWith('/api/') ||
+            req.headers['content-type'] !== undefined ||
+            (req.headers['content-length'] !== undefined && req.headers['content-length'] !== '0')) {
+            throw new errorCodes.FST_ERR_CTP_INVALID_MEDIA_TYPE();
+        }
+        // Wait for the terminating chunk to prove the body is empty. Reject on the
+        // first byte instead of buffering an unsupported body. Leave the socket
+        // alive so Fastify can send its 415 and close the connection on parser errors.
+        try {
+            for await (const chunk of payload.iterator({ destroyOnReturn: false })) {
+                if (Buffer.byteLength(chunk) > 0)
+                    throw new errorCodes.FST_ERR_CTP_INVALID_MEDIA_TYPE();
+            }
+        }
+        catch (error) {
+            // Match Fastify's body reader: an interrupted request is a client error.
+            const err = error;
+            if (typeof err.statusCode !== 'number' || err.statusCode < 400)
+                err.statusCode = 400;
+            throw err;
+        }
+        // No synthetic JSON or header rewriting: required-body validation still
+        // sees the same undefined value as a direct Content-Length: 0 request.
+        return undefined;
+    });
+}
+//# sourceMappingURL=request-body-parser.js.map

package/dist/web/request-body-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body-parser.js","sourceRoot":"","sources":["../../src/web/request-body-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAA6C,MAAM,SAAS,CAAC;AAGhF,MAAM,UAAU,yBAAyB,CAAC,GAAoB;IAC5D,yEAAyE;IACzE,0DAA0D;IAC1D,GAAG,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAmB,EAAE,OAAiB,EAAE,EAAE;QAC7E,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,GAAG,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAEhC,IACE,GAAG,CAAC,MAAM,KAAK,MAAM;YACrB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,SAAS;YACzC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC,EACtF,CAAC;YACD,MAAM,IAAI,UAAU,CAAC,8BAA8B,EAAE,CAAC;QACxD,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,+EAA+E;QAC/E,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACvE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,UAAU,CAAC,8BAA8B,EAAE,CAAC;YAC1F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,MAAM,GAAG,GAAG,KAAwC,CAAC;YACrD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/routes/agent-session-routes.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @fileoverview Agent-facing bounded inspection and guarded stage/submit endpoints.
+ * Ownership is checked before any disk or pane read. Native evidence comes only
+ * from strict conversation attribution; all other modes get labeled snapshots.
+ *
+ * Experimental and opt-in: all three routes answer `403 FORBIDDEN`, naming the
+ * setting, until the synced `agentCoordinationEnabled` is on (default OFF), the
+ * same shape as `cliManagementEnabled` and `mcpSyncEnabled`. The gate runs first,
+ * before session lookup, so a disabled install reveals nothing about its sessions.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { SessionPort, InfraPort } from '../ports/index.js';
+/** Default OFF, same shape as `readMcpSyncEnabled`: read fresh so a toggle applies at once. */
+export declare function readAgentCoordinationEnabled(): Promise<boolean>;
+/** The refusal every route sends while the setting is off. Exported for the tests. */
+export declare const AGENT_COORDINATION_DISABLED_MESSAGE = "Experimental agent coordination (inspect, stage, submit) is disabled. Turn on \"Experimental agent coordination\" in Settings (agentCoordinationEnabled) and save first.";
+/** A Node error code (`EACCES`, `EIO`, ...) or the error's class name; never its message. */
+export declare function errorCode(error: unknown): string;
+export declare function registerAgentSessionRoutes(app: FastifyInstance, ctx: SessionPort & InfraPort): void;
+//# sourceMappingURL=agent-session-routes.d.ts.map

package/dist/web/routes/agent-session-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-session-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/agent-session-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAehE,+FAA+F;AAC/F,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAGrE;AAED,sFAAsF;AACtF,eAAO,MAAM,mCAAmC,6KAC0H,CAAC;AAO3K,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIhD;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,CA+InG"}

package/dist/web/routes/agent-session-routes.js

@@ -0,0 +1,160 @@
+import { getCli } from '../../config/cli-registry/registry.js';
+import { findExactCodexConversation, resolveEffectiveCodexHome } from '../../agent-codex-identity.js';
+import { InspectionReader, InspectionConflict, boundedUtf8Tail } from '../../agent-inspection.js';
+import { GuardedStageStore, GuardedInputConflict, guardedComposerChrome, MAY_BE_TYPED, } from '../../agent-staging.js';
+import { ApiErrorCode, createErrorResponse } from '../../types.js';
+import { findSessionOrFail, getAuthUser, parseBody, readJsonConfig, SETTINGS_PATH } from '../route-helpers.js';
+import { AgentInspectQuerySchema, AgentStageSchema, AgentSubmitSchema } from '../schemas.js';
+/** Default OFF, same shape as `readMcpSyncEnabled`: read fresh so a toggle applies at once. */
+export async function readAgentCoordinationEnabled() {
+    const settings = await readJsonConfig(SETTINGS_PATH, 'settings.json', {});
+    return settings.agentCoordinationEnabled === true;
+}
+/** The refusal every route sends while the setting is off. Exported for the tests. */
+export const AGENT_COORDINATION_DISABLED_MESSAGE = 'Experimental agent coordination (inspect, stage, submit) is disabled. Turn on "Experimental agent coordination" in Settings (agentCoordinationEnabled) and save first.';
+async function gate() {
+    if (await readAgentCoordinationEnabled())
+        return null;
+    return createErrorResponse(ApiErrorCode.FORBIDDEN, AGENT_COORDINATION_DISABLED_MESSAGE);
+}
+/** A Node error code (`EACCES`, `EIO`, ...) or the error's class name; never its message. */
+export function errorCode(error) {
+    const code = error?.code;
+    if (typeof code === 'string' && /^[A-Z0-9_]{1,40}$/.test(code))
+        return code;
+    return error instanceof Error ? error.constructor.name : 'unknown';
+}
+export function registerAgentSessionRoutes(app, ctx) {
+    const reader = new InspectionReader();
+    const stages = new GuardedStageStore();
+    app.addHook('onClose', async () => {
+        reader.clear();
+        stages.clear();
+    });
+    const generation = (session) => session.inspectionGeneration;
+    const target = (session) => ({
+        id: session.id,
+        chrome: () => guardedComposerChrome(getCli(session.mode)),
+        snapshot: () => {
+            if (ctx.sessions.get(session.id) !== session)
+                return null;
+            const snapshot = session.guardedInputSnapshot?.();
+            return snapshot ?? null;
+        },
+        write: (text) => session.stageGuardedInput(text),
+        submit: (expected) => session.submitGuardedInput(expected),
+    });
+    app.get('/api/sessions/:id/inspect', async (req, reply) => {
+        const refused = await gate();
+        if (refused)
+            return reply.code(403).send(refused);
+        const { id } = req.params;
+        const session = findSessionOrFail(ctx, id, req);
+        const { maxBytes, since } = parseBody(AgentInspectQuerySchema, req.query);
+        const initialGeneration = generation(session);
+        const identity = { sessionId: session.id, mode: session.mode };
+        const activity = { status: session.status, lastSubmitAt: session.lastSubmitAt || null, observedAt: Date.now() };
+        try {
+            if (getCli(session.mode)?.capabilities.transcript === 'codex-rollout' && !session.remote && !session.docker) {
+                const conversation = await findExactCodexConversation({
+                    codexHome: resolveEffectiveCodexHome(session.getCodexHomeOverride(), session.workingDir),
+                    sessionId: session.id,
+                    workingDir: session.workingDir,
+                    resumeSessionId: session.codexConfig?.resumeSessionId,
+                }, { maxEntries: 8192, maxBytes: 1048576 });
+                if (generation(session) !== initialGeneration || ctx.sessions.get(id) !== session)
+                    throw new InspectionConflict('Session changed during inspection');
+                if (conversation) {
+                    const result = await reader.read(conversation.path, {
+                        owner: getAuthUser(req).username,
+                        sessionId: id,
+                        generation: initialGeneration,
+                        conversationId: conversation.id,
+                    }, maxBytes, since);
+                    if (generation(session) !== initialGeneration || ctx.sessions.get(id) !== session)
+                        throw new InspectionConflict('Session changed during inspection');
+                    return {
+                        success: true,
+                        data: {
+                            source: 'codex-jsonl',
+                            identity: { ...identity, conversationId: conversation.id },
+                            activity,
+                            incremental: true,
+                            maxBytes,
+                            ...result,
+                        },
+                    };
+                }
+            }
+            if (since)
+                throw new InspectionConflict('Attributed transcript unavailable; this cursor cannot resume a pane snapshot');
+            const frame = session.muxName ? ctx.mux.capturePaneText?.(session.muxName) : null;
+            const evidence = frame ?? session.terminalBuffer;
+            return {
+                success: true,
+                data: {
+                    source: 'pane-snapshot',
+                    identity,
+                    activity,
+                    incremental: false,
+                    cursor: null,
+                    maxBytes,
+                    evidence: boundedUtf8Tail(evidence, maxBytes),
+                    truncated: evidence.length > maxBytes || Buffer.byteLength(evidence) > maxBytes,
+                },
+            };
+        }
+        catch (error) {
+            if (error instanceof InspectionConflict)
+                return reply.code(409).send(createErrorResponse(ApiErrorCode.CONFLICT, error.message));
+            // Anything else (an unreadable rollout, an IO error) is not a retryable cursor
+            // conflict. Log the session and the error code only: the message can carry the
+            // native transcript path, which must never reach the log or the response.
+            console.warn(`[agent-inspect] session ${session.id}: inspection failed (${errorCode(error)})`);
+            return reply.code(422).send(createErrorResponse(ApiErrorCode.OPERATION_FAILED, 'Inspection source unavailable'));
+        }
+    });
+    app.post('/api/sessions/:id/stage', async (req, reply) => {
+        const refused = await gate();
+        if (refused)
+            return reply.code(403).send(refused);
+        const session = findSessionOrFail(ctx, req.params.id, req);
+        const { message } = parseBody(AgentStageSchema, req.body);
+        try {
+            const receipt = await stages.stage(target(session), getAuthUser(req).username, message);
+            return { success: true, data: receipt };
+        }
+        catch (error) {
+            if (!(error instanceof GuardedInputConflict))
+                console.warn(`[agent-stage] session ${session.id}: delivery failed (${errorCode(error)})`);
+            return reply
+                .code(409)
+                .send(createErrorResponse(ApiErrorCode.CONFLICT, error instanceof GuardedInputConflict
+                ? error.message
+                : `Stage delivery failed or ambiguous; ${MAY_BE_TYPED}`));
+        }
+    });
+    app.post('/api/sessions/:id/submit', async (req, reply) => {
+        const refused = await gate();
+        if (refused)
+            return reply.code(403).send(refused);
+        const session = findSessionOrFail(ctx, req.params.id, req);
+        const { stageId, confirmSha } = parseBody(AgentSubmitSchema, req.body);
+        try {
+            return {
+                success: true,
+                data: await stages.submit(target(session), getAuthUser(req).username, stageId, confirmSha),
+            };
+        }
+        catch (error) {
+            if (!(error instanceof GuardedInputConflict))
+                console.warn(`[agent-submit] session ${session.id}: delivery failed (${errorCode(error)})`);
+            return reply
+                .code(409)
+                .send(createErrorResponse(ApiErrorCode.CONFLICT, error instanceof GuardedInputConflict
+                ? error.message
+                : 'Submit delivery failed or ambiguous; receipt consumed, inspect the pane'));
+        }
+    });
+}
+//# sourceMappingURL=agent-session-routes.js.map

package/dist/web/routes/agent-session-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-session-routes.js","sourceRoot":"","sources":["../../../src/web/routes/agent-session-routes.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AACtG,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAClG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,GAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAoB,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE7F,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAA0B,aAAa,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACnG,OAAO,QAAQ,CAAC,wBAAwB,KAAK,IAAI,CAAC;AACpD,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,mCAAmC,GAC9C,wKAAwK,CAAC;AAE3K,KAAK,UAAU,IAAI;IACjB,IAAI,MAAM,4BAA4B,EAAE;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,mBAAmB,CAAC,YAAY,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;AAC1F,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAoB,EAAE,GAA4B;IAC3F,MAAM,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACvC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAsB,EAAE,CAAC,CAAC;QACxD,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,MAAM,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,QAAQ,EAAE,GAAG,EAAE;YACb,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAClD,OAAO,QAAQ,IAAI,IAAI,CAAC;QAC1B,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAChD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC;KAC3D,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAwB,CAAC;QAC5C,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,uBAAuB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChH,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,UAAU,KAAK,eAAe,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC5G,MAAM,YAAY,GAAG,MAAM,0BAA0B,CACnD;oBACE,SAAS,EAAE,yBAAyB,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC;oBACxF,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,eAAe,EAAE,OAAO,CAAC,WAAW,EAAE,eAAe;iBACtD,EACD,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CACxC,CAAC;gBACF,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,iBAAiB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,OAAO;oBAC/E,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,CAAC,CAAC;gBACpE,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,YAAY,CAAC,IAAI,EACjB;wBACE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ;wBAChC,SAAS,EAAE,EAAE;wBACb,UAAU,EAAE,iBAAiB;wBAC7B,cAAc,EAAE,YAAY,CAAC,EAAE;qBAChC,EACD,QAAQ,EACR,KAAK,CACN,CAAC;oBACF,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,iBAAiB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,OAAO;wBAC/E,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,CAAC,CAAC;oBACpE,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,MAAM,EAAE,aAAa;4BACrB,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE;4BAC1D,QAAQ;4BACR,WAAW,EAAE,IAAI;4BACjB,QAAQ;4BACR,GAAG,MAAM;yBACV;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,KAAK;gBACP,MAAM,IAAI,kBAAkB,CAAC,8EAA8E,CAAC,CAAC;YAC/G,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClF,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,cAAc,CAAC;YACjD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,eAAe;oBACvB,QAAQ;oBACR,QAAQ;oBACR,WAAW,EAAE,KAAK;oBAClB,MAAM,EAAE,IAAI;oBACZ,QAAQ;oBACR,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;oBAC7C,SAAS,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,QAAQ;iBAChF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB;gBACrC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YACzF,+EAA+E;YAC/E,+EAA+E;YAC/E,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,EAAE,wBAAwB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACnH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAG,GAAG,CAAC,MAAyB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,EAAE,sBAAsB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7F,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CACH,mBAAmB,CACjB,YAAY,CAAC,QAAQ,EACrB,KAAK,YAAY,oBAAoB;gBACnC,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,uCAAuC,YAAY,EAAE,CAC1D,CACF,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAG,GAAG,CAAC,MAAyB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC;aAC3F,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,CAAC,EAAE,sBAAsB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9F,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CACH,mBAAmB,CACjB,YAAY,CAAC,QAAQ,EACrB,KAAK,YAAY,oBAAoB;gBACnC,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,yEAAyE,CAC9E,CACF,CAAC;QACN,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/routes/case-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"case-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/case-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AA2E1C,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA4D9C;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAE1E;AAgID,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GACxD,IAAI,CAo+DN"}
+{"version":3,"file":"case-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/case-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAiF1C,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA4D9C;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAE1E;AAgID,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GACxD,IAAI,CA+9DN"}

package/dist/web/routes/case-routes.js

@@ -22,6 +22,7 @@ import { boundedPathExists, describeUnknownPath, probePath, probePathKind } from
 import { readAgentCaseMarker } from '../../agent-case-marker.js';
 import { settingsWriteBlocker, writeHooksConfig } from '../../hooks-config.js';
 import { canAccessOwned, getAuthUser, isAdmin, isWorkingDirAllowed, ownerFor, requireAdmin, resolveCasesDir, SETTINGS_PATH, validatePathWithinBase, parseBody, readJsonConfig, } from '../route-helpers.js';
+import { assertSettingsWritable, mutateSettingsFile, SettingsWriteRefusedError, settingsWriteErrorResponse, } from '../settings-writer.js';
 import { isMultiUserMode } from '../../config/multiuser.js';
 import { SseEvent } from '../sse-events.js';
 import { ownerLayoutKey } from '../../tab-layout-persistence.js';
@@ -1529,6 +1530,19 @@ export function registerCaseRoutes(app, ctx) {
         if (open.some((s) => !canAccessOwned(user, s.owner))) {
             return fail(403, ApiErrorCode.FORBIDDEN, "Another user's session has this case open");
         }
+        // The admin's rename writes settings.json only after the sessions are ended and the folder moved, and
+        // the writer refuses a file that is not a JSON object: check it by the writer's own rule now, so no
+        // session is ended for a rename that cannot complete. Not between the starting check and the lock below.
+        if (isAdmin(req)) {
+            try {
+                await assertSettingsWritable();
+            }
+            catch (err) {
+                if (err instanceof SettingsWriteRefusedError)
+                    return fail(409, ApiErrorCode.CONFLICT, err.message);
+                throw err;
+            }
+        }
         // A session being created in the folder is not in ctx.sessions yet, so it could be neither listed nor
         // stopped: it would start in the old path after the move. Checked in the same tick that takes the lock
         // below (nothing is awaited in between), and the Session constructor refuses the folder from then on.
@@ -1551,20 +1565,24 @@ export function registerCaseRoutes(app, ctx) {
                 if (moveFolder)
                     await moveCaseFolder(oldPath, newPath);
                 const originalLinks = isLinked ? await readLinkedCases() : undefined;
-                // The settings.json content before this rename wrote it, set only once a write is attempted (an
-                // absent file reads as {}, which must not be written back as a file that never existed).
-                let originalSettings;
+                // The settings.json values this rename replaced, set only once it wrote them. A failure puts back
+                // these keys alone, so a settings save that landed in between is kept.
+                let settingsUndo;
                 try {
                     // settings.json is server-wide and caseOrder/lastUsedCase name the admin's cases, so only the
                     // admin's rename touches it (a non-admin's own rename must not rewrite someone else's list).
                     // Written before linked-cases.json so a failure here leaves the registry untouched.
                     if (isAdmin(req)) {
-                        const existing = await readJsonConfig(SETTINGS_PATH, 'settings.json', {});
-                        const order = renameInOrder(existing.caseOrder, name, newName);
-                        const last = existing.lastUsedCase === name ? newName : undefined;
-                        if (order || last) {
-                            originalSettings = existing;
-                            await fs.writeFile(SETTINGS_PATH, JSON.stringify({ ...existing, ...(order ? { caseOrder: order } : {}), ...(last ? { lastUsedCase: last } : {}) }, null, 2));
+                        const { before, after } = await mutateSettingsFile((existing) => {
+                            const order = renameInOrder(existing.caseOrder, name, newName);
+                            const last = existing.lastUsedCase === name ? newName : undefined;
+                            if (!order && !last)
+                                return undefined;
+                            return { ...existing, ...(order ? { caseOrder: order } : {}), ...(last ? { lastUsedCase: last } : {}) };
+                        });
+                        if (after) {
+                            const keys = ['caseOrder', 'lastUsedCase'].filter((k) => after[k] !== before[k]);
+                            settingsUndo = Object.fromEntries(keys.map((k) => [k, before[k]]));
                         }
                     }
                     if (originalLinks) {
@@ -1583,9 +1601,9 @@ export function registerCaseRoutes(app, ctx) {
                 catch (err) {
                     // The folder moved but the registries did not follow: put settings.json and the folder back
                     // rather than leave a case whose name and folder disagree.
-                    if (originalSettings) {
-                        await fs.writeFile(SETTINGS_PATH, JSON.stringify(originalSettings, null, 2)).catch(() => { });
-                    }
+                    const undo = settingsUndo;
+                    if (undo)
+                        await mutateSettingsFile((current) => ({ ...current, ...undo })).catch(() => { });
                     if (moveFolder) {
                         const movedBack = await fs.rename(newPath, oldPath).then(() => true, () => false);
                         if (!movedBack) {
@@ -1638,24 +1656,12 @@ export function registerCaseRoutes(app, ctx) {
             return;
         const { order } = parseBody(CaseOrderSchema, req.body, 'Invalid order data');
         try {
-            const dir = getDataDir();
-            if (!existsSync(dir)) {
-                mkdirSync(dir, { recursive: true });
-            }
-            let existing = {};
-            try {
-                existing = JSON.parse(await fs.readFile(SETTINGS_PATH, 'utf-8'));
-            }
-            catch {
-                /* ignore */
-            }
-            const merged = { ...existing, caseOrder: order };
-            await fs.writeFile(SETTINGS_PATH, JSON.stringify(merged, null, 2));
+            await mutateSettingsFile((current) => ({ ...current, caseOrder: order }));
             ctx.broadcast(SseEvent.CaseOrderChanged, { order });
             return { success: true, data: { order } };
         }
         catch (err) {
-            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, getErrorMessage(err));
+            return settingsWriteErrorResponse(err);
         }
     });
     app.get('/api/cases/:name', async (req) => {