aicodeman 1.48.0 → 1.49.0

package/dist/web/server.js

@@ -34,6 +34,7 @@ import fastifyWebsocket from '@fastify/websocket';
 import fastifyMultipart from '@fastify/multipart';
 import { pasteImageDirInUseByOtherSession, startPasteImageGc, uploadDirs } from './paste-image-gc.js';
 import { CLEAN_EXIT_CLOSE_REASON, shouldCloseCleanlyExitedSession } from '../pane-exit-sweep.js';
+import { findLiveWorktree } from '../live-worktree.js';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { existsSync, mkdirSync, readFileSync, chmodSync, statSync } from 'node:fs';
@@ -80,6 +81,7 @@ import { createRequire } from 'node:module';
 import { RunSummaryTracker } from '../run-summary.js';
 import { OrchestratorLoop } from '../orchestrator-loop.js';
 import { getLifecycleLog } from '../session-lifecycle-log.js';
+import { clampEnvOverridesForOwner } from '../session-env-clamp.js';
 import { applyWorkspaceHooks, pruneAgentSessionPreambles, readGitFetchSettings, readKeepWarmSettingsOrThrow, readPlanUsageTelemetryEnabled, removeAgentSessionPreamble, } from '../hooks-config.js';
 import { PushSubscriptionStore } from '../push-store.js';
 import webpush from 'web-push';
@@ -99,11 +101,14 @@ import { fetchWorkspaceOnce } from '../git-fetch.js';
 import { GitFetchScheduler } from '../git-fetch-scheduler.js';
 import { probePathKind } from '../utils/bounded-path-probe.js';
 import { defaultDockerWorkspaces } from './routes/git-status-routes.js';
+import { guardSessionConfigDirHome } from './routes/session-routes.js';
 import { composerIsEmpty, plainFrame } from '../session-submit-verifier.js';
 import { detectUsageLimitPause } from '../usage-limit-patterns.js';
-import { EditHistorySync } from './edit-history-sync.js';
+import { EditHistorySync, remoteTranscriptIds } from './edit-history-sync.js';
 import { EditHistoryStore } from '../edit-history-store.js';
 import { probeLocalPaths, readClaudeEditSources, resolveClaudeTranscript } from '../edit-history-local-source.js';
+import { remoteLocateClaudeTranscript, remoteProbePaths, remoteReadClaudeEditSources } from '../remote-files.js';
+import { remoteTmuxLocation } from '../tmux-manager.js';
 import { stopDeepSeekWeb } from '../deepseek-web-server.js';
 import { wireRespawnListeners, setupTimedRespawn, restoreRespawnController, saveRespawnConfig, } from './respawn-event-wiring.js';
 import { reconcileUpdateOnBoot } from './self-update.js';
@@ -211,14 +216,21 @@ export class WebServer extends EventEmitter {
     app;
     sessions = new Map();
     /**
-     * The edit history panel's reader (edit-history-sync.ts). Reads only when the panel asks;
-     * the main transcript is the one the transcript watcher follows (hook-reported path), or,
-     * before the first hook after a restart, a lookup under the session's claude config dir.
+     * The edit history panel's reader (edit-history-sync.ts). Reads only when the panel asks.
+     * A local session's main transcript is the one the transcript watcher follows (hook-reported
+     * path), or, before the first hook after a restart, a lookup under the session's claude
+     * config dir. A remote session sends no hooks: its host is asked over ssh for the transcript
+     * the pane's claude writes, else the stored conversation's (`remoteTranscriptIds`), and is
+     * never woken for it (remote-files.ts).
      */
     editHistorySync = new EditHistorySync({
-        transcriptPath: (session) => resolveClaudeTranscript(this.transcriptWatchers.get(session.id)?.getPath(), [session.claudeSessionId || session.id, session.id], session.claudeConfigDir),
-        readSources: readClaudeEditSources,
-        probe: probeLocalPaths,
+        transcriptPath: (session, storedTranscriptId) => session.remote
+            ? remoteLocateClaudeTranscript(session.remote, remoteTranscriptIds(session, storedTranscriptId), remoteTmuxLocation(session.remote, session.id))
+            : resolveClaudeTranscript(this.transcriptWatchers.get(session.id)?.getPath(), [session.claudeSessionId || session.id, session.id], session.claudeConfigDir),
+        readSources: (session, mainPath, requests, budget, opts) => session.remote
+            ? remoteReadClaudeEditSources(session.remote, mainPath, requests, budget, opts)
+            : readClaudeEditSources(mainPath, requests, budget, opts),
+        probe: (session, paths) => (session.remote ? remoteProbePaths(session.remote, paths) : probeLocalPaths(paths)),
         loadStore: (sessionId) => EditHistoryStore.load(sessionId),
         deleteStore: (sessionId) => EditHistoryStore.delete(sessionId),
         sweepStores: (keep) => EditHistoryStore.sweep(keep),
@@ -387,9 +399,10 @@ export class WebServer extends EventEmitter {
         agentExited: (id) => !!this.sessions.get(id)?.paneExit,
         awaitingChoice: (id) => approvalInbox.listPending().some((item) => item.sessionId === id && item.kind !== 'idle'),
         // Remote (ssh) sessions keep their folder on another host, so received files have nowhere local to go.
+        // An adopted session's folder is the neutral wrapper folder, which its agent need not be able to read.
         sessionDir: (sessionId) => {
             const session = this.sessions.get(sessionId);
-            return session && !session.remote ? session.workingDir : undefined;
+            return session && !session.remote && !session.isAdopted ? session.workingDir : undefined;
         },
     });
     teamWatcher = new TeamWatcher();
@@ -1286,7 +1299,7 @@ export class WebServer extends EventEmitter {
      * endpoint is gone or the CLI is unregistered: the bookkeeping is still restored so
      * the selection can be cleared, and the pane keeps running on tmux's retained env.
      */
-    async _rebuildCustomModelEnv(session, saved) {
+    async _rebuildCustomModelEnv(session, saved, ownEnv = {}) {
         const entry = getCli(session.mode);
         if (!entry)
             return undefined;
@@ -1296,14 +1309,14 @@ export class WebServer extends EventEmitter {
             return undefined;
         }
         try {
-            // Boot recovery omits both `workingDir` (no reason to re-answer a trust dialog that
-            // already fired once) and the session-env real-home lookup: the injected VALUES are
-            // never persisted, so after a real restart the session can no longer carry its
-            // allowlisted `DSH_HOME` either (`getEnvOverridesForPersist()` keeps only
-            // `CLAUDE_CODE_*`/`CLAUDE_CONFIG_DIR`): the lookup could only ever hit on the first
-            // apply in-process. Real-home resolution therefore falls back to the SERVER's
-            // `DSH_HOME` or the recipe's `realHomeFallback` (~/.dsh).
-            return applyCustomModelInjection(entry, endpoint, saved.modelId, session.id, resolveCustomModelContextLength(endpoint, saved.modelId));
+            // Boot recovery omits `workingDir` (no reason to re-answer a trust dialog that already
+            // fired once). The real-home lookup reads the record's own values, since the session's
+            // overrides hold what the previous run injected. `linkRealHomeEntry()` keeps what is
+            // there, so this only decides an entry that is missing, which an own home skips when it
+            // does not hold one. With no own home, or one that does not answer (probed under the
+            // bulk cap, this walks every saved session), a missing entry links from the SERVER's
+            // `DSH_HOME` or `CLAUDE_CONFIG_DIR`, or their defaults (~/.dsh, ~/.claude).
+            return applyCustomModelInjection(entry, endpoint, saved.modelId, session.id, resolveCustomModelContextLength(endpoint, saved.modelId), undefined, await guardSessionConfigDirHome(entry, (envVar) => ownEnv[envVar], {}));
         }
         catch (err) {
             console.warn('[WebServer] Failed to rebuild custom-model env on recovery:', err);
@@ -1318,17 +1331,24 @@ export class WebServer extends EventEmitter {
      * while the new recipe writes one, and clearing it later could then never delete the
      * generated dir. `envKeys` is the UNION of saved and applied keys: the tmux session may
      * still carry `setenv`s from both, and a clear has to unset every one.
+     *
+     * `ownEnv` is always passed, empty for a record saved before it existed: `_envOverrides`
+     * holds what the previous run injected, and only this record says what was the session's
+     * own. It meets the owner's grant again, like every other env override rebuilt from disk.
      */
     async _restoreCustomModel(session, saved) {
-        const applied = await this._rebuildCustomModelEnv(session, saved);
+        const ownEnv = (await clampEnvOverridesForOwner(session.owner, saved.ownEnv)) ?? {};
+        const applied = await this._rebuildCustomModelEnv(session, saved, ownEnv);
         if (!applied) {
             // Endpoint gone or CLI unregistered: restore the bookkeeping exactly as saved, which
             // is what a later clear needs.
-            session.setCustomModel(saved);
+            session.setCustomModel({ ...saved, ownEnv });
             return;
         }
         session.setCustomModel({
             ...saved,
+            ownEnv,
+            homeEnvVar: applied.homeEnvVar ?? saved.homeEnvVar,
             // Prefer the current recipe's dir; keep the saved one when the recipe writes none,
             // so a clear can still delete a directory an older recipe created.
             configDir: applied.configDir ?? saved.configDir,
@@ -1345,8 +1365,9 @@ export class WebServer extends EventEmitter {
         // __attachmentHistory keeps the private (externalPath-bearing) history on disk,
         // separate from the sanitized public attachmentHistory in toState().
         const attachmentHistory = session.getAttachmentHistoryForPersist();
-        // __customModel keeps the selection's bookkeeping (injected env KEYS, config dir,
-        // launch model; never the values) so recovery can restore and later clear it.
+        // __customModel keeps the selection's bookkeeping (injected env KEYS, config dir, launch
+        // model, the session's own home path; never an injected value or any other own value)
+        // so recovery can restore and later clear it.
         const customModel = session.getCustomModelForPersist();
         const state = {
             ...base,
@@ -1879,7 +1900,9 @@ export class WebServer extends EventEmitter {
         // fs.watch()es it on the LOCAL disk, so a remote session only records the path: the fix plan stays
         // authoritative as for a local session (keeping the output-based completion guessers off), and its
         // file is read over ssh only on an explicit import (fix-plan/read).
-        if (!isExternalCliMode(session.mode)) {
+        // ⚠️ An ADOPTED session is skipped outright: Ralph is refused for one anyway, and its
+        // `workingDir` is the neutral wrapper folder, not the foreign pane's work.
+        if (!isExternalCliMode(session.mode) && !session.isAdopted) {
             if (session.remote) {
                 session.ralphTracker.setRemoteWorkingDir(session.workingDir);
             }
@@ -1889,8 +1912,10 @@ export class WebServer extends EventEmitter {
         }
         // Start watching for new images in this session's working directory (if enabled globally and per-session).
         // A remote session's workingDir is a path on the remote host, and the watcher watches it on the LOCAL
-        // disk, so it is skipped there (the per-session and app-wide toggles skip it too).
-        if ((await this.isImageWatcherEnabled()) && session.imageWatcherEnabled && !session.remote) {
+        // disk, so it is skipped there (the per-session and app-wide toggles skip it too). An ADOPTED session
+        // is skipped for the same reason as the Ralph watcher above: nothing in its wrapper folder is the
+        // foreign pane's work.
+        if ((await this.isImageWatcherEnabled()) && session.imageWatcherEnabled && !session.remote && !session.isAdopted) {
             imageWatcher.watchSession(session.id, session.workingDir);
         }
         // Create and attach all listener handlers via dependency injection
@@ -1970,6 +1995,10 @@ export class WebServer extends EventEmitter {
         const session = this.sessions.get(sessionId);
         if (!session)
             return;
+        // ⚠️ A link scanned from an adopted pane was printed by a process on another host or in a
+        // container, while confinement here would be to this host's `/tmp`, the wrapper's folder.
+        if (session.isAdopted)
+            return;
         const event = source === 'codex-generated'
             ? await registerGeneratedArtifactAttachment({
                 sessionId,
@@ -2588,6 +2617,8 @@ export class WebServer extends EventEmitter {
             // `undefined` here means an authoritative read listed no single directory
             // for the session (split into several panes, or gone from the socket).
             const paneCwdChanged = getPaneCurrentPath ? session.setPaneCwd(getPaneCurrentPath(muxName)) : false;
+            if (paneCwdChanged)
+                void this.refreshLiveWorktree(session);
             if (session.setPaneExit(getPaneExit(muxName))) {
                 this.persistSessionState(session);
             }
@@ -2598,6 +2629,19 @@ export class WebServer extends EventEmitter {
         }
         this.closeCleanlyExitedSessions();
     }
+    /**
+     * Work out which linked worktree a session's pane moved into (#765). In the background, since
+     * it reads the folder, and only after the directory changed, so an idle pane costs nothing.
+     * A reading newer than the one this lookup started from owns the answer.
+     */
+    async refreshLiveWorktree(session) {
+        const cwd = session.paneCwd;
+        const worktree = await findLiveWorktree(session.workingDir, cwd);
+        if (session.paneCwd !== cwd)
+            return;
+        if (session.setLiveWorktree(worktree))
+            this.broadcastSessionStateDebounced(session.id);
+    }
     /**
      * Close every session whose agent exited cleanly, through the same
      * `cleanupSession()` the X button uses (Ark0N/Codeman#446). A pinned session
@@ -3641,6 +3685,14 @@ export class WebServer extends EventEmitter {
                             // MuxSession.docker; state.json carries SessionState.docker), so recovery
                             // rebuilds the `docker exec` launch instead of a broken local command.
                             docker: muxSession.docker ?? savedState?.docker,
+                            // Adoption metadata round-trips for the same reason remote/docker do,
+                            // and one more: it is the ONLY thing that marks this session as
+                            // wrapping a process Codeman never launched. Dropping it on recovery
+                            // silently re-enabled respawn, Ralph and hook-backed waits against
+                            // someone else's live tmux session after every server restart:
+                            // measured, not hypothetical. The mux record is preferred because it
+                            // is what `killSession`'s detach-not-kill guard already reads.
+                            adopt: muxSession.adopt ?? savedState?.adopt,
                             owner: recoveredOwner,
                             // Tab lineage survives a restart. It is only decoration, so a parent
                             // that did NOT come back is harmless: the frontend draws an edge only
@@ -3895,6 +3947,14 @@ export class WebServer extends EventEmitter {
         for (const session of this.sessions.values()) {
             if (session.mode !== 'claude' || session.remote)
                 continue;
+            // ⚠️ An ADOPTED session is not caught by the `remote` check above: its
+            // connection facts live on `adopt.remote` / `adopt.docker`, so a session
+            // wrapping someone's in-container or over-ssh claude looks local here.
+            // Its workspace was never Codeman's to begin with, so installing hooks
+            // there writes `.claude/settings.local.json` into the human's own repo,
+            // on EVERY restart, since this sweep runs from boot recovery.
+            if (session.isAdopted)
+                continue;
             if (session.docker && !session.docker.hooksEnabled)
                 continue;
             if (session.workingDir)