aicodeman 1.45.0 → 1.47.0

package/dist/web/server.js

@@ -78,7 +78,7 @@ import { createRequire } from 'node:module';
 import { RunSummaryTracker } from '../run-summary.js';
 import { OrchestratorLoop } from '../orchestrator-loop.js';
 import { getLifecycleLog } from '../session-lifecycle-log.js';
-import { applyWorkspaceHooks, pruneAgentSessionPreambles, readKeepWarmSettingsOrThrow, readPlanUsageTelemetryEnabled, removeAgentSessionPreamble, } from '../hooks-config.js';
+import { applyWorkspaceHooks, pruneAgentSessionPreambles, readGitFetchSettings, readKeepWarmSettingsOrThrow, readPlanUsageTelemetryEnabled, removeAgentSessionPreamble, } from '../hooks-config.js';
 import { PushSubscriptionStore } from '../push-store.js';
 import webpush from 'web-push';
 import { SseStreamManager } from './sse-stream-manager.js';
@@ -93,6 +93,10 @@ import { AI_CHECK_MODEL } from '../config/ai-defaults.js';
 import { approvalInbox } from './approval-inbox.js';
 import { SCREEN_BLOCKED_SOURCE } from './screen-blocked.js';
 import { PromptCacheKeepWarmService } from '../prompt-cache-keepwarm.js';
+import { fetchWorkspaceOnce } from '../git-fetch.js';
+import { GitFetchScheduler } from '../git-fetch-scheduler.js';
+import { probePathKind } from '../utils/bounded-path-probe.js';
+import { defaultDockerWorkspaces } from './routes/git-status-routes.js';
 import { composerIsEmpty, plainFrame } from '../session-submit-verifier.js';
 import { detectUsageLimitPause } from '../usage-limit-patterns.js';
 import { stopDeepSeekWeb } from '../deepseek-web-server.js';
@@ -120,6 +124,7 @@ import { MAX_PASTE_IMAGE_BYTES } from '../config/buffer-limits.js';
 import { resolveTerminalHistoryConfig } from '../config/terminal-history.js';
 import { SseEvent } from './sse-events.js';
 import { MAX_ROUTE_PARAM_LENGTH } from './route-helpers.js';
+import { mutateSettingsFile } from './settings-writer.js';
 import { getLatestPlanUsage, setLatestCodexPlanUsage, setLatestCopilotPlanUsage } from './plan-usage-latest.js';
 import { telemetrySignature } from '../usage-telemetry.js';
 import { readCodexPlanUsage, resolveCodexBinaryPath } from '../utils/codex-cli-resolver.js';
@@ -129,8 +134,9 @@ import { registerAuthMiddleware, registerSecurityHeaders, registerHostGuard, isL
 import { isMultiUserMode } from '../config/multiuser.js';
 import { bootstrapInitialAdmin, hasUsers, resolveClaudeModeForUsername } from '../user-store.js';
 import { installRouteErrorHandler } from './route-error-handler.js';
+import { installEmptyApiPostParser } from './request-body-parser.js';
 import { isExplicitlyEnabled, isLoopbackBindHost, buildHostPolicy } from './network-auth-policy.js';
-import { registerPushRoutes, registerTeamRoutes, registerMuxRoutes, registerFileRoutes, registerHtmlViewRoutes, registerScheduledRoutes, registerHookEventRoutes, registerApprovalRoutes, registerInboxRoutes, registerRebootRestoreRoutes, registerReadMyMindRoutes, registerGitStatusRoutes, registerStatusTelemetryRoutes, registerSystemRoutes, registerCaseRoutes, registerWorktreeRoutes, registerSessionRoutes, registerRespawnRoutes, registerRalphRoutes, registerPlanRoutes, registerClipboardRoutes, registerSearchRoutes, registerOrchestratorRoutes, registerCronRoutes, registerMeRoutes, registerAdminRoutes, registerWsRoutes, registerVoiceRoutes, registerWebviewRoutes, registerTabLayoutRoutes, registerMcpSyncRoutes, registerConfigBackupRoutes, runConfigBackup, registerWebhookRoutes, registerDoctorRoutes, registerCustomModelRoutes, refreshAllCustomModelHosts, readCustomModelEndpointsEnabled, closeAllLlamaSwapLogTails, detectCustomModelSwapDisplacements, pruneIdleLlamaSwapLogTails, tryWebviewRefererFallback, registerCliRegistryRoutes, } from './routes/index.js';
+import { registerPushRoutes, registerTeamRoutes, registerMuxRoutes, registerFileRoutes, registerHtmlViewRoutes, registerScheduledRoutes, registerHookEventRoutes, registerApprovalRoutes, registerInboxRoutes, registerRebootRestoreRoutes, registerReadMyMindRoutes, registerGitStatusRoutes, registerStatusTelemetryRoutes, registerSystemRoutes, registerCaseRoutes, registerWorktreeRoutes, registerSessionRoutes, registerAgentSessionRoutes, registerRespawnRoutes, registerRalphRoutes, registerPlanRoutes, registerClipboardRoutes, registerSearchRoutes, registerOrchestratorRoutes, registerCronRoutes, registerMeRoutes, registerAdminRoutes, registerWsRoutes, registerVoiceRoutes, registerWebviewRoutes, registerTabLayoutRoutes, registerMcpSyncRoutes, registerConfigBackupRoutes, runConfigBackup, registerWebhookRoutes, registerDoctorRoutes, registerCustomModelRoutes, refreshAllCustomModelHosts, readCustomModelEndpointsEnabled, closeAllLlamaSwapLogTails, detectCustomModelSwapDisplacements, pruneIdleLlamaSwapLogTails, tryWebviewRefererFallback, registerCliRegistryRoutes, } from './routes/index.js';
 import { isLostWebviewFrameNavigation } from './webview-proxy.js';
 import { CronService } from '../cron/cron-service.js';
 import { caseSessionSettled } from '../case-rename.js';
@@ -168,7 +174,7 @@ function escapeHtmlText(value) {
 export function escapeScriptJson(json) {
     return json.replace(/</g, '\\u003c');
 }
-import { SESSIONS_LIST_CACHE_TTL, SCHEDULED_CLEANUP_INTERVAL, SCHEDULED_RUN_MAX_AGE, SSE_HEARTBEAT_INTERVAL, SESSION_LIMIT_WAIT_MS, ITERATION_PAUSE_MS, STATS_COLLECTION_INTERVAL_MS, INACTIVITY_TIMEOUT_MS, CRON_TICK_INTERVAL, } from '../config/server-timing.js';
+import { SESSIONS_LIST_CACHE_TTL, SCHEDULED_CLEANUP_INTERVAL, SCHEDULED_RUN_MAX_AGE, SSE_HEARTBEAT_INTERVAL, SESSION_LIMIT_WAIT_MS, ITERATION_PAUSE_MS, STATS_COLLECTION_INTERVAL_MS, INACTIVITY_TIMEOUT_MS, CRON_TICK_INTERVAL, GIT_FETCH_TICK_INTERVAL_MS, } from '../config/server-timing.js';
 /**
  * Get or generate a self-signed TLS certificate for HTTPS.
  * Certs are stored in ~/.codeman/certs/ and reused across restarts.
@@ -254,6 +260,38 @@ export class WebServer extends EventEmitter {
         },
         log: (message) => console.log(message),
     });
+    // Git fetch on an interval (git-fetch-scheduler.ts): the due-tracking lives in the service; the server
+    // lends it the facts a decision needs and stores what it reports on the session. A field initializer for
+    // the same reason as the keep-warm one above, and the scheduler reads the app setting FRESH on every tick:
+    // that is what makes a live toggle take effect on the next tick, and what makes turning it off actually
+    // stop the fetching. Default OFF, so an install that never enabled it spawns nothing at all.
+    gitFetchScheduler = new GitFetchScheduler({
+        sessionIds: () => this.sessions.keys(),
+        getSession: (id) => this.sessions.get(id),
+        readSettings: readGitFetchSettings,
+        // The same Docker list the panel's Fetch button uses: the rule has to be one rule. It rejects on a list
+        // that cannot be read, and the tick then fetches nothing (fail closed).
+        dockerWorkspaces: defaultDockerWorkspaces,
+        // Bounded probe, DEFAULT options (rule #516): a tick is a bulk scan, so it keeps the stall cap and must
+        // never be handed `pastCap`. A folder on a mount that stopped answering is skipped, not fetched.
+        probePath: (path) => probePathKind(path),
+        // Through the join, so the tick and the panel's Fetch button are the same run: a click on a folder the
+        // tick is already fetching joins it rather than starting a second `git fetch` in the same clone, and the
+        // run that gets published is the one that ran, with its own trigger.
+        fetch: (cwd, opts, trigger) => fetchWorkspaceOnce(cwd, opts, trigger),
+        publish: (id, status) => {
+            const session = this.sessions.get(id);
+            if (!session?.setGitFetchStatus(status))
+                return;
+            // No new SSE event: the status rides the session state the page already listens for, and the Git
+            // panel polls on its own clock. It is written to disk with the rest of the record, but the restore
+            // copies only the fields its own config lists and this is not one of them (src/types/session.ts), so
+            // what a run found is the panel's truth for the life of the session, not across a restart.
+            this.persistSessionState(session);
+            this.broadcast(SseEvent.SessionUpdated, this.getSessionStateWithRespawn(session));
+        },
+        log: (message) => console.log(message),
+    });
     /**
      * Wake-on-LAN registry, returned by `registerSessionRoutes`. Held for its LIFETIME
      * only — `drop()` on session cleanup, `stop()` on shutdown. Waking from here would
@@ -319,12 +357,14 @@ export class WebServer extends EventEmitter {
     windowTitle;
     indexHtmlTemplate;
     allowUnauthenticatedNetwork;
+    /** `--allow-unauthenticated-tunnel`; the tunnel guard reads it through the route context (#706). */
+    allowUnauthenticatedTunnel;
     _pasteImageGcStop = null;
     _eventLoopMonitor = null;
     /** Opt-in hooks-only listener on the docker bridge gateway (CODEMAN_DOCKER_BRIDGE_HOOKS). */
     _dockerBridgeServer = null;
     teamWatcherHandlers = null;
-    constructor(port = 3000, https = false, testMode = false, host = '127.0.0.1', titleHostname, allowUnauthenticatedNetwork = false, basePath = '') {
+    constructor(port = 3000, https = false, testMode = false, host = '127.0.0.1', titleHostname, allowUnauthenticatedNetwork = false, basePath = '', allowUnauthenticatedTunnel = false) {
         super();
         this.setMaxListeners(0);
         this.host = host;
@@ -335,6 +375,7 @@ export class WebServer extends EventEmitter {
         this.testMode = testMode;
         this.allowUnauthenticatedNetwork =
             allowUnauthenticatedNetwork || isExplicitlyEnabled(process.env.CODEMAN_ALLOW_UNAUTHENTICATED_NETWORK);
+        this.allowUnauthenticatedTunnel = allowUnauthenticatedTunnel;
         this.titleHostname = titleHostname || getHostname();
         this.windowTitle = `codeman:${this.titleHostname}`;
         this.indexHtmlTemplate = readFileSync(join(__dirname, 'public', 'index.html'), 'utf-8');
@@ -692,6 +733,7 @@ export class WebServer extends EventEmitter {
             scheduledRuns: this.scheduledRuns,
             teamWatcher: this.teamWatcher,
             tunnelManager: this.tunnelManager,
+            allowUnauthenticatedTunnel: this.allowUnauthenticatedTunnel,
             pushStore: this.pushStore,
             startScheduledRun: this.startScheduledRun.bind(this),
             stopScheduledRun: this.stopScheduledRun.bind(this),
@@ -776,6 +818,8 @@ export class WebServer extends EventEmitter {
             this.userFailures = authState.userFailures;
             this.userIpFailures = authState.userIpFailures;
         }
+        // Bodyless API POSTs may arrive as empty chunked streams through a proxy.
+        installEmptyApiPostParser(this.app);
         // WebSocket support (terminal I/O — low-latency bidirectional channel)
         await this.app.register(fastifyWebsocket);
         // Multipart parsing (used by paste-image). Replaces a hand-rolled
@@ -1042,6 +1086,17 @@ export class WebServer extends EventEmitter {
         registerRebootRestoreRoutes(this.app, ctx);
         registerReadMyMindRoutes(this.app, ctx);
         registerGitStatusRoutes(this.app, ctx);
+        // Git fetch on an interval: this is only the wake-up, the scheduler itself decides what is due. Off in
+        // tests for the same reason as the polls below: a test drives `tick()` directly instead of waiting on
+        // a timer the harness would have to keep alive. The setting is read FRESH inside `tick()`, so turning
+        // it on takes effect on the next tick and turning it off actually stops the fetching.
+        if (!this.testMode) {
+            this.cleanup.setInterval(() => {
+                this.gitFetchScheduler.tick().catch((err) => {
+                    console.error('[git fetch] interval tick failed:', getErrorMessage(err));
+                });
+            }, GIT_FETCH_TICK_INTERVAL_MS, { description: 'git fetch interval checker' });
+        }
         registerStatusTelemetryRoutes(this.app, ctx);
         registerSystemRoutes(this.app, ctx);
         registerCaseRoutes(this.app, ctx);
@@ -1049,6 +1104,7 @@ export class WebServer extends EventEmitter {
         // The registry's lifetime is the server's: it drops per-session wake state on every
         // cleanup path and resolves in-flight wakes on shutdown.
         this.remoteWake = registerSessionRoutes(this.app, ctx);
+        registerAgentSessionRoutes(this.app, ctx);
         registerRespawnRoutes(this.app, ctx);
         registerRalphRoutes(this.app, ctx);
         registerPlanRoutes(this.app, ctx);
@@ -1272,6 +1328,9 @@ export class WebServer extends EventEmitter {
     async _doCleanupSession(sessionId, killMux, reason, coordinateLayout = true) {
         const session = this.sessions.get(sessionId);
         this.keepWarmService.remove(sessionId);
+        // A closed session takes its place in the fetch schedule with it: otherwise a detached-and-forgotten id
+        // would still count as tracked, and its next run would land on a session that no longer exists.
+        this.gitFetchScheduler.remove(sessionId);
         const pinned = session?.pinned === true || this.store.getSession(sessionId)?.pinned === true;
         if (coordinateLayout && session && killMux && !pinned) {
             return this.tabLayouts.runSessionDeletion([{ id: sessionId, owner: session.owner }], () => this._doCleanupSession(sessionId, killMux, reason, false));
@@ -1645,6 +1704,13 @@ export class WebServer extends EventEmitter {
             .filter((entry) => entry.capabilities.transcriptPageKeys === true)
             .map((entry) => entry.id);
         html = html.replace('</head>', () => `<script>window.__codemanTranscriptPageKeys=${JSON.stringify(pageKeyClis)};</script>\n</head>`);
+        // Which run modes keep their PTY rows under a phone keyboard (inline renderers,
+        // the `keyboardHold` capability; `_keyboardHoldEligible` in terminal-ui.js). Same
+        // shape and reasoning as the page-key list above.
+        const keyboardHoldClis = enabledClis()
+            .filter((entry) => entry.capabilities.keyboardHold === 'inline')
+            .map((entry) => entry.id);
+        html = html.replace('</head>', () => `<script>window.__codemanKeyboardHoldModes=${JSON.stringify(keyboardHoldClis)};</script>\n</head>`);
         if (!soloSessionId && process.env.CODEMAN_GESTURE === '1') {
             html = html.replace('</head>', () => `<script>window.__codemanGestureAvailable=true;</script>\n</head>`);
             if (settings.gestureControlEnabled === true) {
@@ -1714,12 +1780,23 @@ export class WebServer extends EventEmitter {
         const summaryTracker = new RunSummaryTracker(session.id, session.name);
         this.runSummaryTrackers.set(session.id, summaryTracker);
         summaryTracker.recordSessionStarted(session.mode, session.workingDir);
-        // Set working directory for Ralph tracker to auto-load @fix_plan.md (not supported for external CLIs)
+        // Set working directory for Ralph tracker to auto-load @fix_plan.md (not supported for external CLIs).
+        // A remote session's workingDir is a path on the remote host, and the watcher reads and
+        // fs.watch()es it on the LOCAL disk, so a remote session only records the path: the fix plan stays
+        // authoritative as for a local session (keeping the output-based completion guessers off), and its
+        // file is read over ssh only on an explicit import (fix-plan/read).
         if (!isExternalCliMode(session.mode)) {
-            session.ralphTracker.setWorkingDir(session.workingDir);
+            if (session.remote) {
+                session.ralphTracker.setRemoteWorkingDir(session.workingDir);
+            }
+            else {
+                session.ralphTracker.setWorkingDir(session.workingDir);
+            }
         }
-        // Start watching for new images in this session's working directory (if enabled globally and per-session)
-        if ((await this.isImageWatcherEnabled()) && session.imageWatcherEnabled) {
+        // Start watching for new images in this session's working directory (if enabled globally and per-session).
+        // A remote session's workingDir is a path on the remote host, and the watcher watches it on the LOCAL
+        // disk, so it is skipped there (the per-session and app-wide toggles skip it too).
+        if ((await this.isImageWatcherEnabled()) && session.imageWatcherEnabled && !session.remote) {
             imageWatcher.watchSession(session.id, session.workingDir);
         }
         // Create and attach all listener handlers via dependency injection
@@ -2917,17 +2994,13 @@ export class WebServer extends EventEmitter {
         // Tunnel only starts when user clicks the toggle in the UI — never on boot.
         // Reset persisted tunnelEnabled so the UI toggle reflects actual state.
         if (await this.isTunnelEnabled()) {
-            const settingsPath = dataPath('settings.json');
             try {
-                const content = await fs.readFile(settingsPath, 'utf-8');
-                const settings = JSON.parse(content);
-                settings.tunnelEnabled = false;
-                await fs.writeFile(settingsPath, JSON.stringify(settings, null, 2));
+                await mutateSettingsFile((settings) => ({ ...settings, tunnelEnabled: false }));
+                console.log('Cloudflare tunnel setting reset (tunnel only starts on explicit UI toggle)');
             }
-            catch {
-                /* ignore */
+            catch (err) {
+                console.warn('Could not reset the Cloudflare tunnel setting:', getErrorMessage(err));
             }
-            console.log('Cloudflare tunnel setting reset (tunnel only starts on explicit UI toggle)');
         }
         // Start team watcher for agent team awareness (always on — lightweight polling)
         this.teamWatcher.start();
@@ -3102,6 +3175,9 @@ export class WebServer extends EventEmitter {
         if (saved.autoClearEnabled !== undefined || saved.autoClearThreshold !== undefined) {
             session.setAutoClear(saved.autoClearEnabled ?? false, saved.autoClearThreshold);
         }
+        if (saved.gitFetchEnabled !== undefined || saved.gitFetchIntervalSeconds !== undefined) {
+            session.setGitFetchSettings(saved.gitFetchEnabled, saved.gitFetchIntervalSeconds);
+        }
         if (saved.autoResumeEnabled) {
             // The stamp is re-armed by default, because a Codeman restart leaves the
             // limit footer un-reprinted and dropping it there would strand the pause.
@@ -3318,6 +3394,11 @@ export class WebServer extends EventEmitter {
                             // below, a future `expiresAt` re-arms the timer once the pane is attached.
                             lastRealPromptAt: savedState?.lastRealPromptAt,
                             keepWarmEnabled: savedState?.keepWarmEnabled,
+                            // The session's own fetch switch and interval, carried over rather than reset to the app default:
+                            // the choice is the user's and outlives the run that made it. The scheduler reads them fresh
+                            // on its next tick, so a restored session is back on its own schedule without a restart.
+                            gitFetchEnabled: savedState?.gitFetchEnabled,
+                            gitFetchIntervalSeconds: savedState?.gitFetchIntervalSeconds,
                             // Conversations this pane provably owned, oldest first. Its tail is
                             // the conversation the CLI was on when the server stopped, which is
                             // what a re-attach must point the viewer at instead of the launch id.
@@ -3749,6 +3830,9 @@ export class WebServer extends EventEmitter {
         sessionWaits.cancelEverything();
         approvalInbox.stop();
         this.keepWarmService.stop();
+        // Stops the fetch sweep from starting another run while the server is closing; a git process already
+        // running is left to finish, which is what a fetch does to a repository nothing else is touching.
+        this.gitFetchScheduler.stop();
         // A post within the debounce window before shutdown would otherwise not reach disk.
         // Flushed again after `app.close()` below, for a post that lands in between.
         agentInboxPersistence.flush();
@@ -3887,8 +3971,8 @@ export class WebServer extends EventEmitter {
         }
     }
 }
-export async function startWebServer(port = 3000, https = false, testMode = false, host = '127.0.0.1', titleHostname, allowUnauthenticatedNetwork = false, basePath = '') {
-    const server = new WebServer(port, https, testMode, host, titleHostname, allowUnauthenticatedNetwork, basePath);
+export async function startWebServer(port = 3000, https = false, testMode = false, host = '127.0.0.1', titleHostname, allowUnauthenticatedNetwork = false, basePath = '', allowUnauthenticatedTunnel = false) {
+    const server = new WebServer(port, https, testMode, host, titleHostname, allowUnauthenticatedNetwork, basePath, allowUnauthenticatedTunnel);
     await server.start();
     return server;
 }