aicodeman 1.47.0 → 1.49.0

package/dist/web/routes/session-routes.js

@@ -4,7 +4,7 @@
  * auto-clear, auto-compact, image watcher, flicker filter, and logout.
  */
 import { claudeProjectDirName } from '../../case-rename.js';
-import { join, dirname, extname, basename, resolve as resolvePath } from 'node:path';
+import { join, dirname, extname, basename, isAbsolute, resolve as resolvePath } from 'node:path';
 import { homedir } from 'node:os';
 import { existsSync, statSync, mkdirSync, writeFileSync } from 'node:fs';
 import { execFile } from 'node:child_process';
@@ -14,13 +14,18 @@ import { randomBytes, randomUUID } from 'node:crypto';
 import { isUtf8 } from 'node:buffer';
 import { performance } from 'node:perf_hooks';
 import { ApiErrorCode, createErrorResponse, getErrorMessage, } from '../../types.js';
+import { AdoptForeignSessionSchema } from '../schemas.js';
+import { discoverForeignSessions, invalidateForeignCache, readAllDockerCases, readAllRemoteHosts, } from '../../foreign-tmux-discovery.js';
+import { adoptTargetIdentity, foreignTargetKey, foreignViewSessionName } from '../../foreign-tmux.js';
+import { requireAdmin } from '../route-helpers.js';
 import { GuardedInputBusyError, Session, cliTakesSessionModel, isAltScreenStripMode, isExternalCliMode, isMuxAltScreenOnlyStripMode, isMuxMouseStripMode, } from '../../session.js';
 import { SseEvent } from '../sse-events.js';
 import { webviewCapabilities } from '../../webview-capabilities.js';
 import { htmlViewCapabilities } from '../../html-view-capabilities.js';
 import { CreateSessionSchema, SessionNameSchema, SessionColorSchema, RunPromptSchema, SessionInputWithLimitSchema, ResizeSchema, AutoClearSchema, AutoCompactSchema, AutoResumeSchema, KeepWarmSchema, GitFetchSettingsSchema, PinSessionSchema, ImageWatcherSchema, FlickerFilterSchema, QuickRunSchema, QuickStartSchema, InteractiveStartSchema, SessionOrderUpdateSchema, SessionWaitQuerySchema, SessionWaitOutputQuerySchema, CustomModelSelectionSchema, } from '../schemas.js';
-import { readCustomModelHosts } from '../../custom-model-hosts.js';
+import { readCustomModelHosts, resolveCustomModelContextLength } from '../../custom-model-hosts.js';
 import { applyCustomModelInjection, removeConfigDir } from '../../custom-model-injection-apply.js';
+import { buildCustomModelInjection } from '../../custom-model-injection.js';
 import { getLlamaSwapStatus, triggerLlamaSwapLoad, exceedsSafeContextFloor, CLAUDE_MIN_SAFE_CONTEXT_TOKENS, } from './custom-model-routes.js';
 import { matchesPattern } from '../../config/cli-registry/patterns.js';
 import { ownerLayoutKey } from '../../tab-layout-persistence.js';
@@ -75,6 +80,41 @@ const CLAUDE_WORKTREE_PATH = /^(.*)\/\.claude\/worktrees\/([^/]+)\/?$/;
 function landedInGroup(layout, sessionId) {
     return !!layout?.groups.some((group) => group.refs.some((ref) => ref.kind === 'session' && ref.id === sessionId));
 }
+/**
+ * Guard a session-supplied configDir home BEFORE `applyCustomModelInjection` runs.
+ *
+ * The apply resolves the CLI's real home from this session's env override and then runs
+ * synchronous `existsSync`/`mkdirSync` on it (deepseek `DSH_HOME`, any future
+ * `linkFromRealHome` recipe, and claude's `CLAUDE_CONFIG_DIR` for `projects`). A path on an
+ * unreachable network mount makes a synchronous stat wait forever, and this runs INSIDE a
+ * request handler, so it would freeze the whole web server (CLAUDE.md, the #516 rule on
+ * user-chosen paths). A relative home is left to the apply, which already refuses to join
+ * non-absolute values.
+ *
+ * Probe the session's own home with `probePathKind(..., { pastCap: true })` first: on
+ * `'unknown'` (a dead mount that never answered) hand the apply a lookup that hides that
+ * one env var, so linking falls through to the server's own environment and the unresponsive
+ * path is never touched. Any other entry's lookup passes through untouched. Boot recovery
+ * passes `probeOptions` of `{}`: it walks every saved session, so it keeps the bulk cap.
+ */
+export async function guardSessionConfigDirHome(entry, baseLookup, probeOptions = { pastCap: true }) {
+    const recipe = entry.capabilities.customModelInjection;
+    const dirEnvVar = recipe?.kind === 'env'
+        ? recipe.configDirVar
+        : recipe?.kind === 'configDir' && recipe.linkFromRealHome?.length
+            ? recipe.dirEnvVar
+            : undefined;
+    if (!dirEnvVar)
+        return baseLookup;
+    const supplied = baseLookup(dirEnvVar)?.trim();
+    if (!supplied || !isAbsolute(supplied))
+        return baseLookup;
+    if ((await probePathKind(supplied, probeOptions)) === 'unknown') {
+        console.warn(`[custom-model] ${dirEnvVar} (${supplied}) did not answer; linking from the server's own home instead`);
+        return (envVar) => (envVar === dirEnvVar ? undefined : baseLookup(envVar));
+    }
+    return baseLookup;
+}
 /**
  * The case a POST /api/sessions `workingDir` belongs to, for its default session
  * group: a direct child of the caller's case space, or (admin / single-user, as
@@ -143,7 +183,7 @@ const MOUSE_TRACKING_PATTERN = /\x1b\[\?(?:1000|1001|1002|1003|1005|1006|1007)[h
  * - `strip-full` (claude/codex/gemini): alt-screen toggles, `3J` and mouse DECSETs.
  *   xterm obeys the toggles by switching to its scrollback-less alt buffer and wiping
  *   saved lines, so history disappeared on tab switch.
- * - `strip-mux-and-mouse` (opencode, tmux-backed): alt-screen toggles and mouse DECSETs.
+ * - `strip-mux-and-mouse` (tmux-backed): alt-screen toggles and mouse DECSETs.
  *   A replayed tracking enable parks xterm in report mode, where a drag goes to the CLI
  *   instead of selecting text (and Ctrl+C without a selection is opencode's app_exit).
  *   `3J` stays: a TUI is not a `clear` consumer.
@@ -1088,8 +1128,9 @@ options = {}) {
         const globalNice = await ctx.getGlobalNiceConfig();
         const modelConfig = await ctx.getModelConfig();
         const mode = body.mode || 'claude';
-        // Synced App Settings launch defaults (capabilities.launchDefaults, codex's model and
-        // effort today) fill the CLI's own config object where the caller left it unset.
+        // Synced App Settings launch defaults (capabilities.launchDefaults, codex's model,
+        // effort and network access today) fill the CLI's own config object where the caller
+        // left it unset.
         // Local launches only: a remote attach runs whatever the remote pane already runs.
         const launchBody = remote ? body : await applyLaunchDefaults(mode, body);
         // Where a model override comes from is a capability, and the three answers are
@@ -1172,6 +1213,169 @@ options = {}) {
             ...(body.tabGroupId || landedInGroup(tabLayout, session.id) ? { tabLayout } : {}),
         };
     });
+    // ========== Adopt a foreign tmux session ==========
+    /**
+     * The wrapper pane for an adopted session runs `tmux attach`, never the agent,
+     * so it needs no workspace, and must not borrow the foreign one. Same value
+     * `resolveMuxAttachCwd()` gives remote and docker panes.
+     */
+    const ADOPTED_WRAPPER_WORKING_DIR = '/tmp';
+    /**
+     * Targets with a wrapper being created right now. The live-session check alone
+     * leaves a gap: between it and `addSession` the route awaits the host registries,
+     * the history config and the owner's layout lock, so two devices opening one row
+     * could each pass it.
+     */
+    const adoptsInFlight = new Set();
+    /**
+     * Wrap a tmux session a HUMAN started (local, in a container, or over ssh) in a
+     * Codeman session, so it appears as a tab and can be driven from the browser.
+     *
+     * Four things make this safe, and each is load-bearing:
+     *
+     * 1. **The body carries only an opaque id.** The socket path, session name and
+     *    host are re-resolved by re-running discovery here. A browser therefore
+     *    never supplies a fragment of the command we are about to run, which is the
+     *    same rule that keeps docker-adopt and remote-attach injection-free.
+     * 2. **The candidate must still exist.** Discovery is re-run rather than cached,
+     *    so a session that died between the listing and the click fails with a 404
+     *    instead of producing a wrapper attached to nothing.
+     * 3. **One wrapper per target.** Two wrappers on one foreign session would each
+     *    create their own grouped view and each think they own the tab; the guard
+     *    is here rather than in the button's in-flight lock, which only stops a
+     *    double-click on one device.
+     * 4. **Admin-only under multi-user.** Discovery already is (it exposes other
+     *    users' processes), and adopting someone's `shell` is arbitrary execution
+     *    as the server account, which is exactly what the `can-bypass-permissions`
+     *    grant gates elsewhere. The admin gate subsumes it, so there is deliberately
+     *    no second grant check here.
+     */
+    app.post('/api/sessions/adopt', async (req, reply) => {
+        if (isMultiUserMode() && !requireAdmin(req, reply))
+            return;
+        const owner = ownerFor(req);
+        const body = parseBody(AdoptForeignSessionSchema, req.body, 'Invalid request body');
+        // Re-resolve rather than trust: point 1 and 2 above.
+        const found = await discoverForeignSessions({
+            local: true,
+            force: true,
+            dockerCases: body.docker ? await readAllDockerCases() : undefined,
+            remoteHosts: body.remote ? await readAllRemoteHosts() : undefined,
+        });
+        const target = found.sessions.find((f) => f.id === body.id);
+        if (!target) {
+            // ⚠️ "Not in the re-resolve" has two very different causes and they must not
+            // be reported as one. The session really being gone is the ordinary case;
+            // the OTHER case is a location we could not reach this time, which on a
+            // flaky link makes a perfectly live remote session read as deleted. Measured
+            // against a real VM whose ssh path dropped ~10% of connections: clicking
+            // Open failed with "no longer there" while the session was sitting right
+            // there. Discovery already knows which it was: it wrote a note, so say so.
+            const reach = found.notes.filter((n) => !/skipped/.test(n));
+            return createErrorResponse(ApiErrorCode.NOT_FOUND, reach.length
+                ? `Could not reach it just now (${reach.join('; ')}). It may still be running, try again.`
+                : 'That tmux session is no longer there. Refresh the list and try again.');
+        }
+        // Point 3: one wrapper per target. Live sessions and not mux records, which
+        // only exist once the first attach starts the pane, so reading those let a
+        // second adopt through before the first tab had started.
+        const targetKey = foreignTargetKey(target);
+        for (const session of ctx.sessions.values()) {
+            if (session.adopt && foreignTargetKey(adoptTargetIdentity(session.adopt)) === targetKey) {
+                return { session: ctx.getSessionStateWithRespawn(session), alreadyAdopted: true };
+            }
+        }
+        if (adoptsInFlight.has(targetKey)) {
+            return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'That tmux session is already being opened');
+        }
+        // After the reuse above, which creates nothing and so must not be refused at capacity.
+        const capMsg = sessionCapacityMessage(ctx.sessions, owner);
+        if (capMsg)
+            return createErrorResponse(ApiErrorCode.SESSION_BUSY, capMsg);
+        adoptsInFlight.add(targetKey);
+        try {
+            return await createAdoptedSession(req, target, owner, body);
+        }
+        finally {
+            adoptsInFlight.delete(targetKey);
+        }
+    });
+    /** Everything past the guards in `POST /api/sessions/adopt`, held under its in-flight mark. */
+    async function createAdoptedSession(req, target, owner, body) {
+        // Connection facts are copied onto the session rather than referenced by id:
+        // a wrapper restored after a server restart must be able to rebuild its
+        // command even if the host registry was edited in the meantime.
+        const adopt = {
+            location: target.location,
+            socketPath: target.socketPath,
+            targetSession: target.sessionName,
+            viewSession: '',
+            paneCurrentPath: target.workingDir,
+        };
+        if (target.location === 'docker') {
+            const hosts = await readDockerHosts(CODEMAN_CONFIG_DIR);
+            const host = hosts.find((h) => h.id === target.hostId);
+            if (!target.containerName) {
+                return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Container name missing for a docker candidate');
+            }
+            adopt.docker = {
+                hostId: target.hostId ?? '',
+                label: target.hostLabel ?? target.containerName,
+                engine: host?.engine ?? 'docker',
+                containerName: target.containerName,
+                daemonHost: host?.daemonHost,
+                context: host?.context,
+            };
+        }
+        else if (target.location === 'remote') {
+            const host = (await readRemoteHosts(CODEMAN_CONFIG_DIR)).find((h) => h.id === target.hostId);
+            if (!host)
+                return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Remote host not found');
+            adopt.remote = {
+                hostId: host.id,
+                label: host.label,
+                host: host.host,
+                username: host.username,
+                port: host.port,
+                identityFile: host.identityFile,
+                socksProxy: host.socksProxy,
+                jumpHost: host.jumpHost,
+                extraSshOptions: host.extraSshOptions,
+            };
+        }
+        const adoptHistoryConfig = await ctx.getTerminalHistoryConfig();
+        // ⚠️ The wrapper's `workingDir` is a NEUTRAL LOCAL path, never the foreign
+        // pane's cwd. That cwd is an observation about another machine: it can carry
+        // characters outside SAFE_PATH_PATTERN (`~/c++`, `Program Files (x86)`), which
+        // makes `createSession` throw so the tab never starts at all, and when it is a
+        // container or ssh path every local consumer of `workingDir` (the Files panel,
+        // the boot hook sweep, the fs watchers) reads it as a path on THIS host. The
+        // foreign cwd stays on `adopt.paneCurrentPath`, which is for display only.
+        // `/tmp` is the same neutral cwd `resolveMuxAttachCwd` already gives the pane.
+        const session = new Session({
+            workingDir: ADOPTED_WRAPPER_WORKING_DIR,
+            mode: target.mode,
+            name: body.name || target.sessionName,
+            mux: ctx.mux,
+            useMux: true,
+            tmuxHistoryLimit: adoptHistoryConfig.tmuxHistoryLimit,
+            adopt,
+            owner,
+            parentSessionId: resolveParentSessionId(ctx, req, body.parentSessionId, owner),
+        });
+        // The view session name is derived from the Codeman session id, so it can only
+        // be filled once the Session exists.
+        adopt.viewSession = foreignViewSessionName(session.id);
+        await ctx.addSession(session);
+        ctx.store.incrementSessionsCreated();
+        ctx.persistSessionState(session);
+        await ctx.setupSessionListeners(session);
+        getLifecycleLog().log({ event: 'created', sessionId: session.id, name: session.name });
+        invalidateForeignCache();
+        const lightState = ctx.getSessionStateWithRespawn(session);
+        ctx.broadcast(SseEvent.SessionCreated, lightState);
+        return { session: lightState, adopted: true };
+    }
     // ========== Rename Session ==========
     app.put('/api/sessions/:id/name', async (req) => {
         const { id } = req.params;
@@ -1225,6 +1429,10 @@ options = {}) {
         if (session.remote || session.docker) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Custom model endpoints are not supported for remote (SSH) or Docker sessions yet');
         }
+        // Its own check: this restarts the CLI in the pane, and an adopted pane's CLI is not ours to restart.
+        if (session.isAdopted) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Custom model endpoints are not available for adopted sessions: Codeman did not start this agent');
+        }
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -1247,8 +1455,29 @@ options = {}) {
         if (!endpoint) {
             return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Model endpoint not found');
         }
-        const contextLength = endpoint.modelContextLengths?.[body.modelId];
+        // Discovery's per-model figure wins; the endpoint's user-set default covers models
+        // whose size discovery could not determine (a gateway that states none, say). With
+        // neither, the existing "no override, CLI assumes its own default" behaviour stands.
+        const contextLength = resolveCustomModelContextLength(endpoint, body.modelId);
         const slotCount = endpoint.modelSlotCounts?.[body.modelId];
+        // A CLI whose config alone cannot select the model also gets its `model` launch param
+        // forced (pi/omp `custom/<id>`, grok's block name, and codex now carries its bare
+        // selected id too). The argv engine DROPS a token that
+        // fails its pattern rather than quoting it, which would silently launch the CLI on its
+        // own default provider again, so refuse an id the pattern cannot carry up front.
+        // The check runs on the PURE build result, before applyCustomModelInjection below:
+        // the forced launch id only comes out of that build, and writing first would mean a
+        // refused id already replaced the config dir a live codex session uses as CODEX_HOME.
+        // It also runs before the two confirmations, so nobody agrees to evict a model only
+        // to be told the id was never usable.
+        const modelSpec = entry.launch.params.model;
+        const injection = buildCustomModelInjection(entry, endpoint, body.modelId, contextLength);
+        const forcedLaunchModel = injection.kind === 'unsupported' ? undefined : injection.launchModel;
+        if (forcedLaunchModel !== undefined &&
+            modelSpec?.type === 'token' &&
+            !matchesPattern(modelSpec.pattern, forcedLaunchModel)) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Model id ${JSON.stringify(body.modelId)} cannot be passed to ${session.mode} on its command line`);
+        }
         // Some CLIs (today: only claude) carry enough of their own fixed system-prompt/tool-
         // schema overhead that a small enough real context guarantees a first-message failure
         // no matter what CLAUDE_CODE_MAX_CONTEXT_TOKENS says — confirmed live at ~36.4K tokens
@@ -1306,21 +1535,10 @@ options = {}) {
                 return { requiresConfirmation: true, currentlyLoadedModel: currentlyLoaded, affectedSessions };
             }
         }
-        // A CLI whose config alone cannot select the model also gets its `model` launch param
-        // forced (pi/omp `custom/<id>`, grok's block name). The argv engine DROPS a token that
-        // fails its pattern rather than quoting it, which would silently launch the CLI on its
-        // own default provider again, so refuse an id the pattern cannot carry up front.
-        const modelSpec = entry.launch.params.model;
-        const applied = applyCustomModelInjection(entry, endpoint, body.modelId, session.id, contextLength, session.workingDir);
+        const applied = applyCustomModelInjection(entry, endpoint, body.modelId, session.id, contextLength, session.workingDir, await guardSessionConfigDirHome(entry, (envVar) => session.ownEnvValue(envVar)));
         if (!applied) {
             return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${session.mode} has no known custom-model mechanism`);
         }
-        if (applied.launchModel !== undefined &&
-            modelSpec?.type === 'token' &&
-            !matchesPattern(modelSpec.pattern, applied.launchModel)) {
-            removeConfigDir(applied.configDir);
-            return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Model id ${JSON.stringify(body.modelId)} cannot be passed to ${session.mode} on its command line`);
-        }
         const { previousConfigDir } = session.setCustomModel({
             endpointId: endpoint.id,
             modelId: body.modelId,
@@ -1328,6 +1546,7 @@ options = {}) {
             envKeys: applied.envKeys,
             configDir: applied.configDir,
             launchModel: applied.launchModel,
+            homeEnvVar: applied.homeEnvVar,
         }, applied.envOverrides);
         // Clean up the OLD config dir on disk, unless the new one happens to reuse the same
         // path (same session, configDir kind again) — never delete the dir we just wrote.
@@ -1361,7 +1580,9 @@ options = {}) {
             // Called for its existence/ownership 404 side effect only — demoteOrRemoveSession
             // below re-looks-up the record by id, so the returned SessionState is unused here.
             findPersistedSessionOrFail(ctx.store, id, req);
-            ctx.store.demoteOrRemoveSession(id);
+            // The edit history goes with the record (same rule as `cleanupSession`).
+            if (ctx.store.demoteOrRemoveSession(id) === 'removed')
+                ctx.forgetEditHistory(id);
             // A detached session kept its agent inbox (server.ts _doCleanupSession drops it
             // only on killMux); retiring the row is the delete, so the mail goes now.
             agentInbox.drop(id);
@@ -1465,6 +1686,11 @@ options = {}) {
         const { id } = req.params;
         const { prompt } = parseBody(RunPromptSchema, req.body);
         const session = findSessionOrFail(ctx, id, req);
+        // Its own check: `runPrompt` starts a new local claude, and the answer has to say so
+        // here rather than as a `session:error` after a success.
+        if (session.isAdopted) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'One-shot prompts are not available for adopted sessions: Codeman did not start this agent');
+        }
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -1505,6 +1731,10 @@ options = {}) {
             // about shell, and they disagree upstream too — reconciling them is a behaviour change
             // and belongs in its own PR, not in a refactor that is meant to change nothing.
             if (!isExternalCliMode(session.mode) &&
+                // ⚠️ And never for an adopted session, whose mode can be claude while the
+                // agent in that pane belongs to someone else. Kept as its own clause for
+                // the same reason the respawn and Ralph routes keep theirs separate.
+                !session.isAdopted &&
                 ctx.store.getConfig().ralphEnabled &&
                 !session.ralphTracker.autoEnableDisabled) {
                 autoConfigureRalph(session, session.workingDir, ctx);
@@ -2372,7 +2602,10 @@ options = {}) {
      * effort: the tab rename has already happened and must not fail on this.
      */
     async function syncClaudeTitle(session) {
-        if (getCli(session.mode)?.capabilities.transcript !== 'claude-jsonl' || session.remote || session.docker)
+        if (getCli(session.mode)?.capabilities.transcript !== 'claude-jsonl' ||
+            session.remote ||
+            session.docker ||
+            session.isAdopted)
             return;
         try {
             const projectsDir = join(process.env.HOME || '/tmp', '.claude', 'projects');
@@ -2451,15 +2684,24 @@ options = {}) {
         candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
         return candidates[0] ?? null;
     }
-    app.get('/api/sessions/:id/last-response', async (req) => {
-        const { id } = req.params;
-        const session = findSessionOrFail(ctx, id, req);
+    // The body of GET /api/sessions/:id/last-response, so the Discord bridge reads the same transcript
+    // the response viewer does (per-CLI reader, pane fallback) without a second copy of this logic.
+    const lastResponseFor = async (session, context) => {
+        // ⚠️ An adopted session has no transcript Codeman can name. Every reader below pairs one by
+        // the id Codeman launched the CLI with or by the session's folder, and neither means anything
+        // here: the CLI chose its own id, and the folder is the neutral `/tmp`, so the newest file for
+        // that folder would be another conversation's answer shown as this one's. Nothing said yet is
+        // the honest answer.
+        if (session.isAdopted) {
+            return context === 'full' || context === 'turn'
+                ? { text: '', timestamp: '', messages: [] }
+                : { text: '', timestamp: '' };
+        }
         // Codex sessions don't write to ~/.claude/projects — their transcripts
         // live in ~/.codex/sessions/**. Branch to a Codex-specific reader so the
         // response-viewer works for Codex panes too.
         if (getCli(session.mode)?.capabilities.transcript === 'codex-rollout') {
-            const codexQuery = req.query;
-            return await readCodexLastResponse(session, codexQuery.context === 'full');
+            return await readCodexLastResponse(session, context === 'full');
         }
         // DeepSeek Harness writes a real structured transcript under
         // `$DSH_HOME/sessions/**`, so read that rather than segmenting the pane.
@@ -2477,8 +2719,7 @@ options = {}) {
         // would starve on an answer that exists. Those configurations keep the
         // pane segmenter below: coarse, but the real conversation.
         if (getCli(session.mode)?.capabilities.transcript === 'deepseek-zstd' && !session.docker && !session.remote) {
-            const deepSeekQuery = req.query;
-            const full = deepSeekQuery.context === 'full';
+            const full = context === 'full';
             const transcript = await readDeepSeekLastResponse(session, { blocks: full });
             if (transcript) {
                 return {
@@ -2495,7 +2736,6 @@ options = {}) {
         // the pane IS the transcript for these CLIs. Codex is already handled above,
         // where a real rollout file is the better source.
         if (isExternalCliTranscriptMode(session.mode)) {
-            const externalQuery = req.query;
             // A repainting full-screen TUI (copilot) streams absolute cursor moves, not lines, so the
             // buffer cannot be segmented; read the pane's visible screen instead, and fall back to the
             // buffer when there is no tmux pane to ask (direct PTY, tests).
@@ -2507,7 +2747,7 @@ options = {}) {
                 text: getLastTranscriptResponse(blocks),
                 timestamp: '',
                 hasContext: blocks.length > 0,
-                messages: externalQuery.context === 'full' ? blocks : undefined,
+                messages: context === 'full' ? blocks : undefined,
             };
         }
         // Scan ~/.claude/projects/*/ for the transcript file
@@ -2528,11 +2768,10 @@ options = {}) {
                 void persistDockerCaseClaudeSessionId(CODEMAN_CONFIG_DIR, session.docker.containerName, activeId).catch(() => { });
             }
         }
-        const query = req.query;
         // `turn` is the brief view's context: the last ANSWERED turn's assistant
         // messages, so a multi-row answer is not reduced to its final row. `text`
         // stays the last assistant row in every mode (agent pollers hash it).
-        const wantsMessages = query.context === 'full' || query.context === 'turn';
+        const wantsMessages = context === 'full' || context === 'turn';
         const claudeSessionId = session.claudeSessionId || session.id;
         const transcript = await findClaudeTranscript(projectsDir, claudeSessionId, session.id);
         if (!transcript) {
@@ -2547,7 +2786,7 @@ options = {}) {
         try {
             const content = await fs.readFile(transcript.path, 'utf8');
             const parsed = parseClaudeResponseTranscript(content, wantsMessages);
-            if (query.context === 'turn') {
+            if (context === 'turn') {
                 return {
                     text: parsed.text,
                     timestamp: parsed.timestamp,
@@ -2559,6 +2798,12 @@ options = {}) {
         catch {
             return wantsMessages ? { text: '', timestamp: '', messages: [] } : { text: '', timestamp: '' };
         }
+    };
+    ctx.lastResponseFor = lastResponseFor;
+    app.get('/api/sessions/:id/last-response', async (req) => {
+        const { id } = req.params;
+        const session = findSessionOrFail(ctx, id, req);
+        return lastResponseFor(session, req.query.context);
     });
     function isCodexInjectedContext(text) {
         return (/^# AGENTS\.md instructions\b/i.test(text) ||
@@ -3120,6 +3365,13 @@ options = {}) {
         const { id } = req.params;
         const body = parseBody(AutoClearSchema, req.body, 'Invalid request body');
         const session = findSessionOrFail(ctx, id, req);
+        // ⚠️ Separate from the external-CLI gate on purpose: an adopted session's mode
+        // can perfectly well BE claude, and this drives the pane of a session someone
+        // else is using. Merging the two checks means a future change to the
+        // external-CLI rule silently reopens this one.
+        if (session.isAdopted) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Auto-clear is not available for adopted sessions: Codeman did not start this agent and must not drive it');
+        }
         session.setAutoClear(body.enabled, body.threshold);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -3137,6 +3389,13 @@ options = {}) {
         const { id } = req.params;
         const body = parseBody(AutoCompactSchema, req.body, 'Invalid request body');
         const session = findSessionOrFail(ctx, id, req);
+        // ⚠️ Separate from the external-CLI gate on purpose: an adopted session's mode
+        // can perfectly well BE claude, and this drives the pane of a session someone
+        // else is using. Merging the two checks means a future change to the
+        // external-CLI rule silently reopens this one.
+        if (session.isAdopted) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Auto-compact is not available for adopted sessions: Codeman did not start this agent and must not drive it');
+        }
         session.setAutoCompact(body.enabled, body.threshold, body.prompt);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -3188,8 +3447,8 @@ options = {}) {
         const { id } = req.params;
         const body = parseBody(GitFetchSettingsSchema, req.body, 'Invalid request body');
         const session = findSessionOrFail(ctx, id, req);
-        if (session.remote || session.docker) {
-            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Git fetch does not run for remote or Docker sessions');
+        if (session.remote || session.docker || session.isAdopted) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Git fetch does not run for remote, Docker or adopted sessions');
         }
         const enabled = 'enabled' in body ? (body.enabled ?? undefined) : session.gitFetchEnabled;
         const intervalSeconds = 'intervalSeconds' in body ? (body.intervalSeconds ?? undefined) : session.gitFetchIntervalSeconds;
@@ -3210,6 +3469,13 @@ options = {}) {
         const { id } = req.params;
         const body = parseBody(AutoResumeSchema, req.body, 'Invalid request body');
         const session = findSessionOrFail(ctx, id, req);
+        // ⚠️ Separate from the external-CLI gate on purpose: an adopted session's mode
+        // can perfectly well BE claude, and this drives the pane of a session someone
+        // else is using. Merging the two checks means a future change to the
+        // external-CLI rule silently reopens this one.
+        if (session.isAdopted) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Auto-resume is not available for adopted sessions: Codeman did not start this agent and must not drive it');
+        }
         session.setAutoResume(body.enabled);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -3271,6 +3537,10 @@ options = {}) {
         if (body.enabled && session.remote) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Image watching does not run for remote sessions');
         }
+        // An adopted session's folder is the neutral wrapper folder, not the foreign pane's work.
+        if (body.enabled && session.isAdopted) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Image watching does not run for adopted sessions');
+        }
         if (body.enabled) {
             imageWatcher.watchSession(session.id, session.workingDir);
         }
@@ -3786,12 +4056,12 @@ options = {}) {
         // unknown endpoint, a model id the CLI's argv pattern can't carry) rather than trusting
         // a lighter version of them, since this is the same server-side authority reached a
         // different way, not a separate, less-checked path.
-        let qsCustomModelEnvOverrides = qsGatedEnvOverrides;
-        // Only the INJECTED keys (never the caller's envOverrides merged in) — this is what
-        // setCustomModel() bookkeeping must be given below. The Session constructor already
-        // applies qsCustomModelEnvOverrides (the full merged set) directly; re-merging that
-        // full set into setCustomModel() would put CLAUDE_CODE_EFFORT_LEVEL back after the
-        // constructor stripped it (see setCustomModel()'s own doc comment in session.ts).
+        //
+        // Only the INJECTED keys (never the caller's envOverrides merged in): setCustomModel()
+        // merges these over what the Session constructor took, which is how it learns which of
+        // the caller's values the selection replaced. Handing the constructor the merged set
+        // would hide them, and giving setCustomModel() that set would put
+        // CLAUDE_CODE_EFFORT_LEVEL back after the constructor stripped it.
         let qsCustomModelAppliedEnvOverrides;
         let qsCustomModelLaunchModel;
         let qsCustomModelSessionId;
@@ -3808,8 +4078,21 @@ options = {}) {
             const cmEndpoint = cmHosts.find((h) => h.id === customModel.endpointId);
             if (!cmEndpoint)
                 return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Model endpoint not found');
-            const cmContextLength = cmEndpoint.modelContextLengths?.[customModel.modelId];
+            // Per-model discovery figure first, user-set endpoint default second, nothing third
+            // (see the dedicated route's own comment above).
+            const cmContextLength = resolveCustomModelContextLength(cmEndpoint, customModel.modelId);
             const cmSlotCount = cmEndpoint.modelSlotCounts?.[customModel.modelId];
+            // See the dedicated route: refused on the pure build, before either confirmation, so
+            // nobody agrees to evict a model for an id that could never launch, and before anything
+            // is written.
+            const cmModelSpec = cmEntry.launch.params.model;
+            const cmInjection = buildCustomModelInjection(cmEntry, cmEndpoint, customModel.modelId, cmContextLength);
+            const cmForcedLaunchModel = cmInjection.kind === 'unsupported' ? undefined : cmInjection.launchModel;
+            if (cmForcedLaunchModel !== undefined &&
+                cmModelSpec?.type === 'token' &&
+                !matchesPattern(cmModelSpec.pattern, cmForcedLaunchModel)) {
+                return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Model id ${JSON.stringify(customModel.modelId)} cannot be passed to ${mode} on its command line`);
+            }
             // See the dedicated route's own comment for the full reasoning: some CLIs' own fixed
             // overhead can exceed a small enough real context on the very first message,
             // regardless of contextLengthVar. Warn before creating a session that's certain to
@@ -3861,18 +4144,10 @@ options = {}) {
             // with, not a placeholder: `new Session({ id: ... })` accepts an explicit id for
             // exactly this reason.
             qsCustomModelSessionId = randomUUID();
-            const cmApplied = applyCustomModelInjection(cmEntry, cmEndpoint, customModel.modelId, qsCustomModelSessionId, cmContextLength, workspacePath);
+            const cmApplied = applyCustomModelInjection(cmEntry, cmEndpoint, customModel.modelId, qsCustomModelSessionId, cmContextLength, workspacePath, await guardSessionConfigDirHome(cmEntry, (envVar) => qsGatedEnvOverrides?.[envVar]));
             if (!cmApplied) {
                 return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${mode} has no known custom-model mechanism`);
             }
-            const cmModelSpec = cmEntry.launch.params.model;
-            if (cmApplied.launchModel !== undefined &&
-                cmModelSpec?.type === 'token' &&
-                !matchesPattern(cmModelSpec.pattern, cmApplied.launchModel)) {
-                removeConfigDir(cmApplied.configDir);
-                return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Model id ${JSON.stringify(customModel.modelId)} cannot be passed to ${mode} on its command line`);
-            }
-            qsCustomModelEnvOverrides = { ...qsGatedEnvOverrides, ...cmApplied.envOverrides };
             qsCustomModelAppliedEnvOverrides = cmApplied.envOverrides;
             qsCustomModelLaunchModel = cmApplied.launchModel;
             qsCustomModelBookkeeping = {
@@ -3882,6 +4157,7 @@ options = {}) {
                 envKeys: cmApplied.envKeys,
                 configDir: cmApplied.configDir,
                 launchModel: cmApplied.launchModel,
+                homeEnvVar: cmApplied.homeEnvVar,
             };
             // Actually kick off llama-swap's load now — see the dedicated apply route's own
             // comment on triggerLlamaSwapLoad for why this can't just wait on the launched CLI's
@@ -3912,7 +4188,7 @@ options = {}) {
             copilotConfig: mode === 'copilot' ? qsGatedCopilotConfig : undefined,
             deepSeekConfig: mode === 'deepseek' ? qsGatedDeepSeekConfig : undefined,
             ompConfig: qsResolvedOmpConfig,
-            envOverrides: qsCustomModelEnvOverrides,
+            envOverrides: qsGatedEnvOverrides,
             effort,
             advisorModel,
             remote,
@@ -3941,10 +4217,10 @@ options = {}) {
         }
         const session = new Session(qsSessionOptions);
         // Records the selection for session.customModel/getCustomModelForPersist() and future
-        // clear/switch calls — the actual env vars and launch-model config are already part of
-        // the launch above (constructor envOverrides, piConfig/grokConfig/ompConfig.model), so
-        // this is bookkeeping only, never a restart: setCustomModel() is synchronous state, no
-        // tmux IO of its own (see its own doc comment in session.ts).
+        // clear/switch calls, and merges the injected env, which the launch below reads along
+        // with the launch-model config set above (piConfig/grokConfig/ompConfig.model). Nothing
+        // has started yet, so this is never a restart: setCustomModel() is synchronous state,
+        // no tmux IO of its own (see its own doc comment in session.ts).
         if (qsCustomModelBookkeeping) {
             session.setCustomModel(qsCustomModelBookkeeping, qsCustomModelAppliedEnvOverrides);
         }
@@ -5016,6 +5292,13 @@ options = {}) {
             reply.code(400);
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Prompt uploads are not supported for remote (SSH) sessions');
         }
+        // An adopted session has no workspace of ours: its folder is the neutral `/tmp`, shared with
+        // whatever else runs there, and an agent in a container or on an ssh host could not read it.
+        // The foreign pane's own folder is not ours to write into either.
+        if (session.isAdopted) {
+            reply.code(400);
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Prompt uploads are not supported for adopted sessions');
+        }
         // The upload is written under session.workingDir (ensureUploadDir below), and
         // a live session's workspace can sit on a network mount that stopped answering.
         // Probe it bounded before the first disk touch, as #516 requires for a path the