aiterm-mcp 0.21.3 → 0.21.4

package/README.ja.md

@@ -1,17 +1,18 @@
 > **Claude Code から Codex CLI の対話 TUI を操作する——スラッシュコマンドや [`$imagegen`](https://learn.chatgpt.com/docs/image-generation#generate-or-edit-an-image) のようなスキルまで、MCP越しに使える。**
 
 <p align="center">
-  <img src=".github/og.svg" alt="aiterm-mcp — AI が握る 1 本の永続 MCP 端末。その中へ他のコーディングエージェント（Claude/Codex/Grok/Composer）を起動する（tmux ベースの stdio MCP サーバ）" width="100%">
+  <img src=".github/og.png" alt="Aiterm — 異なる知性が一つの持続する実行現場を共有する森の観測拠点" width="100%">
+  <br>
+  <sub><em>この画像は、異なる知性がひとつの持続する実行現場を共有し、それぞれの視点から同じ仕事を前へ進める姿を表しています。</em></sub>
 </p>
 
-# aiterm-mcp
+# Aiterm
 
 [![CI](https://github.com/kitepon-rgb/aiterm-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/kitepon-rgb/aiterm-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/aiterm-mcp.svg)](https://www.npmjs.com/package/aiterm-mcp)
 [![週間ダウンロード](https://img.shields.io/npm/dw/aiterm-mcp.svg)](https://www.npmjs.com/package/aiterm-mcp)
 [![node](https://img.shields.io/node/v/aiterm-mcp)](https://nodejs.org)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![install size](https://packagephobia.com/badge?p=aiterm-mcp)](https://packagephobia.com/result?p=aiterm-mcp)
 
 > *(English: [README.md](README.md))*
 
@@ -95,6 +96,10 @@ host統合は、kitepon.devの製品開発を支える内部基盤
 
 13 ツール: 6 つの **PTY ツール**（`pty_open` / `pty_send` / `pty_read` / `pty_key` / `pty_close` / `pty_list`）で 1 本の永続端末を開き・操作し・読む。加えて 4 つの **エージェント起動ツール**（`claude_agent` / `codex_agent` / `grok_agent` / `composer_agent`）が別のコーディングエージェントの TUI を新しい端末の中に起動し、`claude_turn`がdurable caller向けの構造化issue／recoveryを、`claude_approval`がmanaged Claudeの相関済み承認UI中継を、`diagnostics`が安全なfactory readinessを返す。バックエンドは **tmux** なので、MCP サーバや AI クライアントが再起動してもセッションは生き残る。
 
+**v0.21.4ではfresh managed Claudeからuser scope MCPを復元。** 通常hook、plugin、permission、
+project／local MCPの隔離は維持し、`~/.claude.json`で既にuser scope登録された`mcpServers`だけを
+owner-onlyのlaunch設定へsnapshotする。破損したuser MCP設定は、toolなしで黙って起動せずsession作成前に失敗する。
+
 **v0.21.3ではCodexの完了経路からStop hookを撤去。** Codexの完了通知と最終回答の帰属は、
 root rollout transcriptへ永続化される`task_complete.turn_id`をdispatch byte境界以後から観測する。
 hookの実行ファイルが壊れたり消えたりしても`aiterm-wait`は座礁しない。v0.21.0では外部agent launcherへ
@@ -162,7 +167,7 @@ $ aiterm-wait --session codex1 --cursor <event_cursor>   # exit 0=done / 3=timeo
 | `grok_agent` | Grok Build（xAI、既定`grok-4.5`、`model?`で上書き） | `prompt?`, `model?`, `reasoning_effort?`は非対応（指定時は明示エラー）, `cwd?`, `session_name?`, `write_scope?` |
 | `composer_agent` | Grok Build（xAI、既定`grok-composer-2.5-fast`、`model?`で上書き） | `prompt?`, `model?`, `reasoning_effort?`は非対応（指定時は明示エラー）, `cwd?`, `session_name?`, `write_scope?` |
 
-各ベンダーの CLI が導入・認証済みであること（`claude_agent` は `claude`、`codex_agent` は `codex`、Grok 系は `grok`）。バイナリは `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN`、各既定path、`PATH` の順で解決する。CLI不在・不正なmodel/effort・実在しない`cwd`はsession作成前に失敗し、残骸を残さない。Claudeはさらに、PTY作成前に同じCLIの`auth status --json`が`loggedIn:true`を返すことを要求する。未認証・malformed・失敗exit・timeoutは残骸ゼロで失敗し、正常なvendor所有の共有認証は複数sessionから利用する。managed Claudeへのexact `/login`・`/logout`は通常dispatchとforce送信の双方で副作用前に拒否するため、認証は通常端末で一度だけ修理する。Claudeは通常settingsを継承しないlaunch専用settingsとStop hookを使い、本文なしeventとowner-only bounded resultを分離する。`pty_read({ agent_transcript:true })`はdigestとbyte数を検証したresultだけを返し、Claude private transcriptを読まない。後着resultは同じsessionからprompt再送なしで回収できる。managed Claudeのactive turn中はC-c以外の`pty_key`と素送信を拒否する。Claudeが`Do you want to proceed?`を表示したら、`claude_approval(action:"inspect", ...)`で画面digestを取得し、表示内容を判断してから、そのdigestと`approve_once`または`deny`を`respond`へ渡す。同じoperation・同じ画面が維持されている時だけ入力し、任意文字列や恒久許可選択肢は中継しない。中断は`C-c`、解除は`pty_close`。
+各ベンダーの CLI が導入・認証済みであること（`claude_agent` は `claude`、`codex_agent` は `codex`、Grok 系は `grok`）。バイナリは `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN`、各既定path、`PATH` の順で解決する。CLI不在・不正なmodel/effort・実在しない`cwd`はsession作成前に失敗し、残骸を残さない。Claudeはさらに、PTY作成前に同じCLIの`auth status --json`が`loggedIn:true`を返すことを要求する。未認証・malformed・失敗exit・timeoutは残骸ゼロで失敗し、正常なvendor所有の共有認証は複数sessionから利用する。managed Claudeへのexact `/login`・`/logout`は通常dispatchとforce送信の双方で副作用前に拒否するため、認証は通常端末で一度だけ修理する。Claudeは通常settingsを継承しないlaunch専用settingsとStop hookを使う一方、user scopeの`mcpServers`だけは`~/.claude.json`から別のowner-only launch configへsnapshotし`--mcp-config`で渡す。project／local MCPは継承しない。本文なしeventとowner-only bounded resultを分離し、`pty_read({ agent_transcript:true })`はdigestとbyte数を検証したresultだけを返してClaude private transcriptを読まない。後着resultは同じsessionからprompt再送なしで回収できる。managed Claudeのactive turn中はC-c以外の`pty_key`と素送信を拒否する。Claudeが`Do you want to proceed?`を表示したら、`claude_approval(action:"inspect", ...)`で画面digestを取得し、表示内容を判断してから、そのdigestと`approve_once`または`deny`を`respond`へ渡す。同じoperation・同じ画面が維持されている時だけ入力し、任意文字列や恒久許可選択肢は中継しない。中断は`C-c`、解除は`pty_close`。
 
 エージェント間の隠れたプロトコルは無い。起動したClaude/Codex/Grok/Composerは利用者がattachできるもう1本の永続sessionであり、MCPクライアントが通常のPTY操作で駆動する。
 

package/README.md

@@ -1,17 +1,18 @@
 > **Drive Codex CLI's interactive TUI from Claude Code — including slash commands and skills such as [`$imagegen`](https://learn.chatgpt.com/docs/image-generation#generate-or-edit-an-image) — through MCP.**
 
 <p align="center">
-  <img src=".github/og.svg" alt="aiterm-mcp — one persistent MCP terminal your AI drives, and launches other coding agents (Claude/Codex/Grok/Composer) into (tmux-backed stdio MCP server)" width="100%">
+  <img src=".github/og.png" alt="Aiterm — a shared forest observatory where different intelligences work in one persistent execution space" width="100%">
+  <br>
+  <sub><em>This image represents different intelligences sharing one persistent workspace and advancing the same work from their own perspectives.</em></sub>
 </p>
 
-# aiterm-mcp
+# Aiterm
 
 [![CI](https://github.com/kitepon-rgb/aiterm-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/kitepon-rgb/aiterm-mcp/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/aiterm-mcp.svg)](https://www.npmjs.com/package/aiterm-mcp)
 [![weekly downloads](https://img.shields.io/npm/dw/aiterm-mcp.svg)](https://www.npmjs.com/package/aiterm-mcp)
 [![node](https://img.shields.io/node/v/aiterm-mcp)](https://nodejs.org)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
-[![install size](https://packagephobia.com/badge?p=aiterm-mcp)](https://packagephobia.com/result?p=aiterm-mcp)
 
 > *(日本語: [README.ja.md](README.ja.md))*
 
@@ -95,6 +96,12 @@ toolchain behind kitepon.dev's products.
 
 Thirteen tools: six **PTY tools** — `pty_open` / `pty_send` / `pty_read` / `pty_key` / `pty_close` / `pty_list` — to open, drive, and read one persistent terminal, four **agent launchers** — `claude_agent` / `codex_agent` / `grok_agent` / `composer_agent` — that each start another coding agent's TUI inside a fresh one, `claude_turn` for durable structured issue/recovery, `claude_approval` for correlated managed-Claude approval prompts, and `diagnostics` for safe factory readiness. The backend is **tmux**, so sessions survive even if the MCP server or the AI client restarts.
 
+**v0.21.4 restores user-scoped MCPs in fresh managed Claude sessions.** Aiterm keeps
+normal hooks, plugins, permissions, and project/local MCPs isolated, while snapshotting only
+the already user-scoped `mcpServers` from `~/.claude.json` into an owner-only launch config.
+Malformed user MCP config fails before a session is created instead of silently launching
+Claude without its tools.
+
 **v0.21.3 removes Codex Stop hooks from the completion path.** Codex completion and
 final-message attribution now come from the root rollout transcript's durable
 `task_complete.turn_id`, observed after the dispatch byte boundary. A broken or stale
@@ -178,7 +185,7 @@ One call per model, so the tool name itself tells you which model you get:
 | `grok_agent` | Grok Build, model `grok-4.5` by default (`model?` overrides) (xAI) | `prompt?`, `model?`, `reasoning_effort?` unsupported (an explicit value is an error; Grok CLI `--effort` is headless-only), `cwd?`, `session_name?`, `write_scope?` |
 | `composer_agent` | Grok Build, model `grok-composer-2.5-fast` by default (`model?` overrides) (xAI) | `prompt?`, `model?`, `reasoning_effort?` unsupported (an explicit value is an error), `cwd?`, `session_name?`, `write_scope?` |
 
-The vendor CLI must be installed and authenticated (`claude` for `claude_agent`; `codex` for `codex_agent`; `grok` for both Grok tools). aiterm resolves the binary via `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN`, then `~/.local/bin/claude` / `~/.local/bin/codex` / `~/.grok/bin/grok`, then `PATH`. Prerequisites are checked **before** a session exists: empty `model` values and unsupported effort values are rejected up front; a missing CLI binary or a nonexistent `cwd` fails for all four. Before creating a Claude session, aiterm also requires a successful structured `claude auth status --json` result with `loggedIn: true`; unavailable, malformed, or failed authentication leaves **zero leftover session**. Claude sessions share the vendor-owned credential store rather than copying credentials per launch, so multiple sessions can reuse one healthy login. Managed Claude rejects exact `/login` and `/logout` dispatches, including forced sends: repair authentication once in a normal terminal, then relaunch any stale unauthenticated sessions. Claude and Codex launchers forward `model` and `reasoning_effort` through their vendor CLI's public flags; Grok/Composer reject `reasoning_effort` because it is headless-only. Pass an absolute path for `cwd` — `~` is not expanded. Durable callers can make a promptless Claude launch exactly replayable by passing an explicit `session_name` and a `launch_operation_id` formatted as `sha256:<64 lowercase hex>`. Repeating the identical launch returns the same structured session receipt without starting the CLI twice; a different correlation ID or launch argument for that session fails explicitly. Claude uses launch-local managed settings containing only aiterm's Stop hook: normal user/project/local hooks are not inherited, the hook event contains no answer body, and the bounded owner-only result is returned by `pty_read({ agent_transcript:true })` without reading Claude's private transcript. A late result remains recoverable from the same session without re-sending the prompt. While a managed Claude turn is active, raw sends and non-interrupt keys are rejected. If Claude displays `Do you want to proceed?`, call `claude_approval(action:"inspect", ...)`, decide from the visible prompt, then call `respond` with the returned digest and either `approve_once` or `deny`. The response is accepted only while the same operation and screen digest remain current; arbitrary text and persistent-allow choices are never relayed. Use `pty_key("C-c")` to interrupt and `pty_close` to abandon the session. For unconstrained manual key-by-key driving, open a plain `pty_open` session and start the vendor CLI yourself. Codex uses a managed `CODEX_HOME`; Grok/Composer isolate their managed homes and pass validated OAuth state through `GROK_AUTH_PATH`. Before the first unbound dispatch, aiterm waits for the vendor TUI's input prompt and fails before sending if it is not ready. Managed completion requires POSIX filesystem semantics (Linux, WSL2, macOS).
+The vendor CLI must be installed and authenticated (`claude` for `claude_agent`; `codex` for `codex_agent`; `grok` for both Grok tools). aiterm resolves the binary via `CLAUDE_BIN` / `CODEX_BIN` / `GROK_BIN`, then `~/.local/bin/claude` / `~/.local/bin/codex` / `~/.grok/bin/grok`, then `PATH`. Prerequisites are checked **before** a session exists: empty `model` values and unsupported effort values are rejected up front; a missing CLI binary or a nonexistent `cwd` fails for all four. Before creating a Claude session, aiterm also requires a successful structured `claude auth status --json` result with `loggedIn: true`; unavailable, malformed, or failed authentication leaves **zero leftover session**. Claude sessions share the vendor-owned credential store rather than copying credentials per launch, so multiple sessions can reuse one healthy login. Managed Claude rejects exact `/login` and `/logout` dispatches, including forced sends: repair authentication once in a normal terminal, then relaunch any stale unauthenticated sessions. Claude and Codex launchers forward `model` and `reasoning_effort` through their vendor CLI's public flags; Grok/Composer reject `reasoning_effort` because it is headless-only. Pass an absolute path for `cwd` — `~` is not expanded. Durable callers can make a promptless Claude launch exactly replayable by passing an explicit `session_name` and a `launch_operation_id` formatted as `sha256:<64 lowercase hex>`. Repeating the identical launch returns the same structured session receipt without starting the CLI twice; a different correlation ID or launch argument for that session fails explicitly. Claude uses launch-local managed settings containing only aiterm's Stop hook: normal user/project/local hooks are not inherited. User-scoped `mcpServers` are copied separately from `~/.claude.json` into a launch-local owner-only config and passed through `--mcp-config`; project/local MCPs remain isolated. The hook event contains no answer body, and the bounded owner-only result is returned by `pty_read({ agent_transcript:true })` without reading Claude's private transcript. A late result remains recoverable from the same session without re-sending the prompt. While a managed Claude turn is active, raw sends and non-interrupt keys are rejected. If Claude displays `Do you want to proceed?`, call `claude_approval(action:"inspect", ...)`, decide from the visible prompt, then call `respond` with the returned digest and either `approve_once` or `deny`. The response is accepted only while the same operation and screen digest remain current; arbitrary text and persistent-allow choices are never relayed. Use `pty_key("C-c")` to interrupt and `pty_close` to abandon the session. For unconstrained manual key-by-key driving, open a plain `pty_open` session and start the vendor CLI yourself. Codex uses a managed `CODEX_HOME`; Grok/Composer isolate their managed homes and pass validated OAuth state through `GROK_AUTH_PATH`. Before the first unbound dispatch, aiterm waits for the vendor TUI's input prompt and fails before sending if it is not ready. Managed completion requires POSIX filesystem semantics (Linux, WSL2, macOS).
 
 The managed Codex home links authentication, privately snapshots `config.toml` and `agents/*.toml` custom-role definitions, and keeps sessions/caches isolated. A symlinked role definition is resolved into a regular-file snapshot rather than shared with the source home. aiterm does not install a Codex Stop hook: the root rollout transcript is the completion source, so a missing hook executable cannot strand `aiterm-wait`.
 

package/dist/core.js

@@ -412,6 +412,12 @@ function agentManagedClaudeSettingsPath(name, launchId) {
         throw new AitermError(`launch_id が不正です: ${launchId}`, 2);
     return path.join(agentsDir(), `${name}.${launchId}.claude-settings.json`);
 }
+function agentManagedClaudeMcpConfigPath(name, launchId) {
+    assertSessionName(name);
+    if (!LAUNCH_ID_RE.test(launchId))
+        throw new AitermError(`launch_id が不正です: ${launchId}`, 2);
+    return path.join(agentsDir(), `${name}.${launchId}.claude-mcp.json`);
+}
 function agentClaudeResultPath(name, launchId) {
     assertSessionName(name);
     if (!LAUNCH_ID_RE.test(launchId))
@@ -494,6 +500,7 @@ function cleanupAgentState(name) {
                     f.endsWith(".events.jsonl") ||
                     f.endsWith(".wait.lock") ||
                     f.endsWith(".claude-settings.json") ||
+                    f.endsWith(".claude-mcp.json") ||
                     f.endsWith(".claude-result.json") ||
                     f.endsWith(".claude-operation.json") ||
                     f.endsWith(".claude-approval.json") ||
@@ -1354,6 +1361,7 @@ export function killAll() {
                     f.endsWith(".events.jsonl") ||
                     f.endsWith(".wait.lock") ||
                     f.endsWith(".claude-settings.json") ||
+                    f.endsWith(".claude-mcp.json") ||
                     f.endsWith(".claude-result.json") ||
                     f.endsWith(".claude-operation.json") ||
                     f.endsWith(".claude-dispatch") ||
@@ -1656,6 +1664,52 @@ function createManagedClaudeSettings(name, launchId) {
     });
     return settings;
 }
+function createManagedClaudeMcpConfig(name, launchId) {
+    const home = process.env.HOME?.trim() || os.homedir();
+    const source = path.join(home, ".claude.json");
+    let canonical;
+    try {
+        canonical = fs.realpathSync(source);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new AitermError(`Claude user MCP設定を読めません: ${error.message}`, 2);
+    }
+    let fd;
+    let parsed;
+    try {
+        fd = fs.openSync(canonical, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+        const st = fs.fstatSync(fd);
+        if (!st.isFile() || st.uid !== currentUid() || st.size > 16 * 1024 * 1024) {
+            throw new AitermError("Claude user MCP設定の安全検証に失敗しました", 2);
+        }
+        parsed = JSON.parse(fs.readFileSync(fd, "utf8"));
+    }
+    catch (error) {
+        if (error instanceof AitermError)
+            throw error;
+        throw new AitermError(`Claude user MCP設定を読めません: ${error.message}`, 2);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new AitermError("Claude user MCP設定のtop-level JSONはobjectである必要があります", 2);
+    }
+    const servers = parsed.mcpServers;
+    if (servers === undefined)
+        return null;
+    if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+        throw new AitermError("Claude user MCP設定のmcpServersはobjectである必要があります", 2);
+    }
+    if (Object.keys(servers).length === 0)
+        return null;
+    const destination = agentManagedClaudeMcpConfigPath(name, launchId);
+    writeJson0600(destination, { mcpServers: servers });
+    return destination;
+}
 function realGrokHome() {
     return path.resolve(process.env.GROK_HOME || path.join(process.env.HOME ?? os.homedir(), ".grok"));
 }
@@ -2227,6 +2281,7 @@ function createClaudeAgentMetadata(name, cwd, initialPrompt, launchOperationId,
     createEmpty0600NoFollow(eventFile);
     createEmpty0600NoFollow(resultFile);
     const claudeSettings = createManagedClaudeSettings(name, launchId);
+    const claudeMcpConfig = createManagedClaudeMcpConfig(name, launchId);
     const meta = {
         kind: "claude",
         aiterm_session: name,
@@ -2241,6 +2296,7 @@ function createClaudeAgentMetadata(name, cwd, initialPrompt, launchOperationId,
         hook_route: "managed_claude_settings",
         node_platform: process.platform,
         claude_settings: claudeSettings,
+        claude_mcp_config: claudeMcpConfig,
         result_file: resultFile,
     };
     writeAgentMetadata(meta);
@@ -2325,11 +2381,14 @@ function loadAgentMetadata(name) {
     }
     if (m.kind === "claude") {
         const expectedSettings = agentManagedClaudeSettingsPath(name, m.launch_id);
+        const expectedMcpConfig = agentManagedClaudeMcpConfigPath(name, m.launch_id);
         const expectedResult = agentClaudeResultPath(name, m.launch_id);
+        const claudeMcpConfig = m.claude_mcp_config ?? null;
         const launchOperationId = m.launch_operation_id ?? null;
         const launchRequestDigest = m.launch_request_digest ?? null;
         if (m.hook_route !== "managed_claude_settings" ||
             m.claude_settings !== expectedSettings ||
+            (claudeMcpConfig !== null && claudeMcpConfig !== expectedMcpConfig) ||
             m.result_file !== expectedResult ||
             ((launchOperationId === null) !== (launchRequestDigest === null)) ||
             (launchOperationId !== null && !OPERATION_ID_RE.test(launchOperationId)) ||
@@ -2351,6 +2410,7 @@ function loadAgentMetadata(name) {
             hook_route: "managed_claude_settings",
             node_platform: process.platform,
             claude_settings: expectedSettings,
+            claude_mcp_config: claudeMcpConfig === expectedMcpConfig ? expectedMcpConfig : null,
             result_file: expectedResult,
         };
     }
@@ -3639,6 +3699,8 @@ function buildAgentCmd(kind, bin, model, effort, prompt, meta = null) {
     if (kind === "claude") {
         if (meta?.kind === "claude") {
             parts.push("--setting-sources", shq(""), "--settings", shq(meta.claude_settings ?? ""));
+            if (meta.claude_mcp_config)
+                parts.push("--mcp-config", shq(meta.claude_mcp_config));
         }
         if (model)
             parts.push("--model", shq(model));

package/dist/runtime-error-store.js

@@ -825,13 +825,17 @@ function forceKill(child) {
         catch { /* already exited */ }
         return;
     }
+    // taskkill 自体の起動が混雑した Windows runner で遅れても、deadline を越えた
+    // worker 本体の副作用を許さない。まず Node のハンドルから即時停止し、その後に
+    // taskkill /T で worker が残した子孫だけを回収する。
+    try {
+        child.kill("SIGKILL");
+    }
+    catch { /* already exited */ }
     const killer = spawn("taskkill.exe", ["/pid", String(child.pid), "/T", "/F"], {
         stdio: "ignore", windowsHide: true,
     });
-    killer.once("error", () => { try {
-        child.kill("SIGKILL");
-    }
-    catch { /* already exited */ } });
+    killer.once("error", () => { });
     killer.unref();
 }
 function processExists(pid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.21.3",
+  "version": "0.21.4",
   "mcpName": "io.github.kitepon-rgb/aiterm-mcp",
   "description": "Persistent tmux terminal MCP that lets Claude Code drive Codex CLI's interactive TUI, including slash commands and $imagegen. Also runs durable PTY sessions for SSH, containers, REPLs, and coding agents.",
   "keywords": [