botmux 3.0.0 → 3.1.0

package/dist/worker.js

@@ -72,7 +72,7 @@ import { createCliAdapterSync, locateOnPath } from './adapters/cli/registry.js';
 import { buildWrappedLaunch, parseWrapperCli, isTtadkWrapper } from './setup/cli-selection.js';
 import { cliUnavailableMessage } from './setup/cli-availability.js';
 import { findLaunchedCliPid, scheduleWrapperRealCliPid, readComm, isBareShellComm, bareShellLaunchKind } from './core/session-discovery.js';
-import { claudeJsonlPathForSession, resolveJsonlFromPid, findOpenClaudeSessionIds, DEFAULT_CLAUDE_DATA_DIR } from './adapters/cli/claude-code.js';
+import { claudeJsonlPathForSession, resolveJsonlFromPid, findOpenClaudeSessionIds, syncClaudeResumeTargetToCwd, DEFAULT_CLAUDE_DATA_DIR } from './adapters/cli/claude-code.js';
 import { sessionReadyHookCommand } from './adapters/hook-command.js';
 import { mtrSessionIdForBotmuxSession } from './adapters/cli/mtr.js';
 import { HerdrBackend } from './adapters/backend/herdr-backend.js';
@@ -83,7 +83,7 @@ import { ZellijObserveBackend } from './adapters/backend/zellij-observe-backend.
 import { zellijEnv } from './setup/ensure-zellij.js';
 import { isObserveBackend } from './adapters/backend/types.js';
 import { selectSessionBackend, decideBackendGate, backendGateUserMessage } from './adapters/backend/session-backend-selector.js';
-import { deriveRiffReposFromDirs, deriveRiffRepoFromWorkingDir, isValidRiffBaseUrl } from './adapters/backend/riff-backend.js';
+import { deriveRiffReposFromDirs, deriveRiffRepoFromWorkingDir, isValidRiffBaseUrl, isValidRiffSandboxCluster, } from './adapters/backend/riff-backend.js';
 import { prepareSandbox, attachSandboxOutbox, startOutboxWatcher, sandboxEnabled, sandboxedClaudeDataDir, localSandboxApplies } from './adapters/backend/sandbox.js';
 import { tmuxEnv, probeTmuxFunctionalWithRetry } from './setup/ensure-tmux.js';
 import { tmuxRestartJitterMs } from './core/tmux-recovery.js';
@@ -102,12 +102,13 @@ import { config, resolveChatBotDiscoveryConfig } from './config.js';
 import * as sessionStore from './services/session-store.js';
 import * as pty from 'node-pty';
 import { createHash } from 'node:crypto';
-import { installHook } from './adapters/hook-installer.js';
+import { hasInstalledSessionReadyHook, installHook, } from './adapters/hook-installer.js';
 import { hookCommandFor } from './adapters/hook-command.js';
+import { parseDaemonIpcPort } from './utils/daemon-discovery.js';
 import { withCodexAppContext } from './utils/codex-app-context.js';
 import { resolveCodexAppFinalTurnIdentity } from './adapters/cli/codex-app-turn.js';
 import { RunnerControlDecoder } from './adapters/cli/runner-control-channel.js';
-import { managedOriginCapabilityPath, RELAY_ORIGIN_CAPABILITY_BASENAME, replaceManagedOriginCapabilityFile, } from './core/managed-origin-capability.js';
+import { hasMatchingManagedOriginCapability, managedOriginCapabilityPath, RELAY_ORIGIN_CAPABILITY_BASENAME, replaceManagedOriginCapabilityFile, } from './core/managed-origin-capability.js';
 // ─── State ───────────────────────────────────────────────────────────────────
 let cliAdapter = null;
 let backend = null;
@@ -186,6 +187,24 @@ function provisionIsolatedBotHome(botHome, workingDir, isClaude, cliId, hookInst
         if (isClaude) {
             const cdir = join(botHome, 'claude');
             mkdirSync(cdir, { recursive: true });
+            // Settings: read-isolated Claude uses a fresh CLAUDE_CONFIG_DIR, so it
+            // otherwise loses provider auth/model/proxy values held in the shared
+            // ~/.claude/settings.json `env` map. Merge that map on EVERY cold spawn,
+            // then install botmux hooks into the same per-bot file. Global hooks and
+            // unrelated top-level settings are not inherited.
+            const isolatedSettingsPath = join(cdir, 'settings.json');
+            if (hookInstall) {
+                try {
+                    installHook(cliId, {
+                        ...hookInstall,
+                        configPath: isolatedSettingsPath,
+                        inheritClaudeEnvFrom: join(homedir(), '.claude', 'settings.json'),
+                    }, hookCommandFor(cliId));
+                }
+                catch (e) {
+                    log(`[read-isolation] WARN per-bot settings/hook install failed: ${e.message}`);
+                }
+            }
             // Auth: a fresh CLAUDE_CONFIG_DIR does NOT inherit the shared account's OAuth
             // token → keep <cdir>/.credentials.json synced to the FRESHEST valid credential
             // on EVERY spawn (verified: Claude logs in from that file). Refreshing here (not
@@ -194,24 +213,14 @@ function provisionIsolatedBotHome(botHome, workingDir, isClaude, cliId, hookInst
             const fresh = freshestClaudeCred();
             if (fresh)
                 writeCredIfChanged(join(cdir, '.credentials.json'), fresh);
-            else if (!existsSync(join(cdir, '.credentials.json'))) {
-                log(`[read-isolation] WARN no Claude credential found (keychain or ~/.claude/.credentials.json) — bot may hit login screen`);
+            else if (!existsSync(join(cdir, '.credentials.json'))
+                && !claudeSettingsHasProviderAuth(isolatedSettingsPath)) {
+                log(`[read-isolation] WARN no Claude provider auth found (global settings env, keychain, or ~/.claude/.credentials.json) — bot may hit login screen`);
             }
             // State: seed <cdir>/.claude.json from the GLOBAL one MINUS `projects` (keeps the
             // onboarding/promo "seen" flags + account so no dialogs appear, without leaking
             // other projects' data), then trust this bot's cwd. Merge-safe on resume.
             seedAndTrustClaudeState(join(cdir, '.claude.json'), workingDir, log);
-            // Hooks: install the SessionStart-ready + askUserQuestion hooks into the PER-BOT
-            // settings.json (global ~/.claude/settings.json is Seatbelt-denied), else the
-            // worker's ready gate falls back to a slow timeout and AskUserQuestion won't relay.
-            if (hookInstall) {
-                try {
-                    installHook(cliId, { ...hookInstall, configPath: join(cdir, 'settings.json') }, hookCommandFor(cliId));
-                }
-                catch (e) {
-                    log(`[read-isolation] WARN per-bot hook install failed: ${e.message}`);
-                }
-            }
         }
         else {
             const cdir = join(botHome, 'codex');
@@ -232,6 +241,22 @@ function provisionIsolatedBotHome(botHome, workingDir, isClaude, cliId, hookInst
         log(`[read-isolation] WARN provisioning bot home failed: ${e.message}`);
     }
 }
+function claudeSettingsHasProviderAuth(settingsPath) {
+    try {
+        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+        const env = settings.env;
+        if (!env || typeof env !== 'object' || Array.isArray(env))
+            return false;
+        const record = env;
+        return ((typeof record.ANTHROPIC_AUTH_TOKEN === 'string' && record.ANTHROPIC_AUTH_TOKEN.length > 0)
+            || (typeof record.ANTHROPIC_API_KEY === 'string' && record.ANTHROPIC_API_KEY.length > 0)
+            || record.CLAUDE_CODE_USE_BEDROCK === '1'
+            || record.CLAUDE_CODE_USE_VERTEX === '1');
+    }
+    catch {
+        return false;
+    }
+}
 /** Pick the FRESHEST valid Claude OAuth credential: macOS keychain vs the global
  *  `~/.claude/.credentials.json`, by `claudeAiOauth.expiresAt` (longest runway
  *  wins — a re-login updates one of the two, and this picks whichever is newer).
@@ -789,18 +814,28 @@ function publishSandboxRelayCapability(opts = {}) {
                 }]
             : []),
     ];
+    let publishError;
     for (const file of files) {
         try {
             replaceManagedOriginCapabilityFile(file.path, file.body);
         }
         catch (err) {
             log(`Failed to publish managed origin capability: ${err?.message ?? err}`);
-            if (opts.failClosed) {
-                unlinkManagedOriginCapabilityFiles();
-                throw err;
-            }
+            publishError = err;
+            break;
         }
     }
+    if (publishError) {
+        // The disk/daemon/worker views must rotate as one authority generation. If
+        // the child-visible transport cannot publish the new token, revoke the old
+        // generation and leave no in-memory authority for ready/send preflights to
+        // mistake as usable. Any files written before a later failure are removed
+        // by the revocation helper as well.
+        completeManagedTurnOriginRevocation(sandboxRelayCapability, currentBotmuxTurnId, currentBotmuxDispatchAttempt);
+        if (opts.failClosed)
+            throw publishError;
+        return false;
+    }
     sandboxRelayCapability = capability;
     if (sessionId) {
         send({
@@ -813,6 +848,7 @@ function publishSandboxRelayCapability(opts = {}) {
                 : {}),
         });
     }
+    return true;
 }
 function unlinkManagedOriginCapabilityFiles() {
     const files = [
@@ -4381,8 +4417,14 @@ function detectBareShellLaunch() {
     else {
         message =
             `⚠️ 会话没能启动：pane 里还停在 \`${comm}\`，${cli} 没真正跑起来——我没把消息打进去（否则会被当 shell 命令执行）。\n\n` +
-                `可能原因：rc 文件启动过慢/报错，或 \`${cli}\` 的可执行文件不在 PATH 上（CLI 没找到）。\n` +
-                `建议：在 web 终端里手动敲一下启动命令看报什么错；确认 CLI 二进制能在 PATH 上找到；或精简 rc 启动逻辑后重启 daemon 再试。`;
+                `最常见原因：rc 文件里有交互式提示卡住了 shell 启动，例如：\n` +
+                `① Oh My Zsh 升级提示（"Would you like to update Oh My Zsh? [Y/n]"）——${comm} source ~/.zshrc 时弹出，等你按 Y/n，CLI 的启动命令没机会跑\n` +
+                `② git 凭据弹窗（GIT_TERMINAL_PROMPT）或其它需要交互输入的启动脚本\n` +
+                `③ ${cli} 的可执行文件不在 PATH 上（CLI 没找到）\n\n` +
+                `修法（任选其一，改完重启 daemon 再发一条消息）：\n` +
+                `• 最省事：升级 botmux 到含自动注入 DISABLE_AUTO_UPDATE=true 的版本（仅 botmux 托管 shell 启动时跳过 oh-my-zsh 升级检查，不影响你自己的终端）\n` +
+                `• 手动修：在 ~/.zshrc 的 source $ZSH/oh-my-zsh.sh 之前加一行 DISABLE_UPDATE_PROMPT="true"（自动升级不弹提示）；或加 DISABLE_AUTO_UPDATE="true"（完全跳过升级检查）\n` +
+                `• 在 web 终端里手动敲一下启动命令看报什么错；确认 CLI 二进制能在 PATH 上找到；或精简 rc 启动逻辑后重启 daemon 再试`;
     }
     send({ type: 'user_notify', turnId: currentBotmuxTurnId, dispatchAttempt: currentBotmuxDispatchAttempt, message });
     return true;
@@ -5300,6 +5342,9 @@ function spawnCli(cfg) {
         if (!isValidRiffBaseUrl(cfg.backendConfig.baseUrl)) {
             throw new Error(`riff baseUrl 未配置或非法（需 http(s) URL，当前: ${JSON.stringify(cfg.backendConfig.baseUrl ?? null)}）——请在 dashboard 的 Riff 配置中填写`);
         }
+        if (cfg.backendConfig.sandboxCluster !== undefined && !isValidRiffSandboxCluster(cfg.backendConfig.sandboxCluster)) {
+            throw new Error(`riff sandboxCluster 非法（仅支持 boe/cn，当前: ${JSON.stringify(cfg.backendConfig.sandboxCluster)}）——请在 dashboard 的 Riff 配置中重新选择`);
+        }
         const sessionEnv = {
             BOTMUX_SESSION_ID: cfg.sessionId,
             BOTMUX_CHAT_ID: cfg.chatId,
@@ -5372,6 +5417,7 @@ function spawnCli(cfg) {
     // JSONL/pid/bridge gate below keys off it instead of `cliId === 'claude-code'`,
     // so a fork inherits the whole submit-confirm + bridge-fallback machinery.
     let claudeDataDir = cliAdapter.claudeDataDir;
+    let effectiveReadyHookInstall = cliAdapter.hookInstall;
     // When this session will be file-sandboxed, the CLI's session jsonl is written
     // into the overlay's EPHEMERAL home upper (CLAUDE_CONFIG_DIR lives under $HOME),
     // invisible at the real path the bridge normally watches → "Bridge mark expired"
@@ -5382,7 +5428,10 @@ function spawnCli(cfg) {
         (effectiveBackendType === 'pty' || effectiveBackendType === 'tmux') &&
         !!process.env.SESSION_DATA_DIR;
     if (claudeDataDir && willFileSandbox) {
-        const redirected = sandboxedClaudeDataDir(cfg.sessionId, claudeDataDir);
+        const redirected = sandboxedClaudeDataDir(cfg.sessionId, claudeDataDir, {
+            sourceWorkingDir: cfg.workingDir,
+            dataDir: process.env.SESSION_DATA_DIR,
+        });
         log(`[sandbox] redirecting Claude bridge dataDir → overlay upper: ${redirected}`);
         claudeDataDir = redirected;
     }
@@ -5465,6 +5514,12 @@ function spawnCli(cfg) {
         // Provision the per-bot config dir (auth + onboarding/trust seed + hooks for claude;
         // auth/config copy for codex) so the CLI starts fully set up under the Seatbelt wrapper.
         provisionIsolatedBotHome(isolationBotHome, cfg.workingDir, isClaudeFam, cfg.cliId, cliAdapter.hookInstall, log);
+        if (isClaudeFam && effectiveReadyHookInstall) {
+            effectiveReadyHookInstall = {
+                ...effectiveReadyHookInstall,
+                configPath: join(claudeDataDir, 'settings.json'),
+            };
+        }
         if (cliAdapter.mcpGateway) {
             const isolatedConfigPath = isClaudeFam
                 ? join(claudeDataDir, '.claude.json')
@@ -5586,6 +5641,26 @@ function spawnCli(cfg) {
     let effectiveResume = cfg.resume ?? false;
     let effectiveCliSessionId = cfg.cliSessionId;
     let effectiveAdapterSessionId = adapterSessionId;
+    // Claude-family transcripts are scoped by cwd. `/cd` keeps the same Botmux /
+    // CLI session id, so mirror the newest native transcript into the new cwd's
+    // project directory before the adapter probes or launches `--resume`.
+    // `claudeDataDir` is already the effective root here (global, per-bot read
+    // isolation root, or a preserved sandbox upper), so this never crosses bot
+    // isolation boundaries.
+    if (effectiveResume && !willReattachPersistent && claudeDataDir) {
+        const resumeSessionId = effectiveCliSessionId ?? effectiveAdapterSessionId;
+        try {
+            const synced = syncClaudeResumeTargetToCwd(resumeSessionId, cfg.workingDir, claudeDataDir);
+            if (synced.copied && synced.sourcePath) {
+                log(`Claude resume transcript synced for cwd change: ${synced.sourcePath} → ${synced.targetPath}`);
+            }
+        }
+        catch (err) {
+            // Preserve the existing fail-safe: the adapter probe / two-tier fallback
+            // below still decides whether resume is possible.
+            log(`WARN Claude resume transcript sync failed: ${err.message}`);
+        }
+    }
     const tier2ForceFresh = effectiveResume && consecutiveInWorkerRestarts >= 2;
     let tier1ProbeFalse = false;
     if (effectiveResume && !tier2ForceFresh && !willReattachPersistent) {
@@ -6461,15 +6536,22 @@ function spawnCli(cfg) {
             codexBridgeStartTimer();
         }
     }
-    // Arm the ready-gate for FRESH Claude-family spawns (which inject the
-    // SessionStart hook via --settings; see claude-code.ts buildArgs). Until
+    // Arm the ready-gate for FRESH ready-integrated spawns. Until
     // `botmux session-ready` fires (daemon → 'session_ready' IPC → releaseReadyGate)
     // we hold the first prompt so a cjadk-style startup selector's ❯ can't eat it.
-    // shouldArmReadyGate() excludes adopt (pre-existing pane, no --settings) AND
+    // shouldArmReadyGate() excludes adopt (pre-existing pane, no fresh hook) AND
     // persistent-backend reattach (daemon restart re-attaches an already-running
     // tmux/zellij/herdr Claude WITHOUT re-running its bin/args → no new
     // SessionStart hook → arming would hold the first post-recovery message until
-    // the timeout). Fallback: release after READY_SIGNAL_TIMEOUT_MS → readyPattern.
+    // the timeout).
+    //
+    // Installation is best-effort, so verify the hook in the EFFECTIVE config
+    // (global for ordinary sessions, per-bot CLAUDE_CONFIG_DIR under read
+    // isolation) before arming. Isolated children also need the injected loopback
+    // port plus a published rotating capability; without either the hook could
+    // run but never reach the daemon. A failed preflight leaves the gate open and
+    // immediately falls back to the adapter's normal readyPattern/quiescence path
+    // instead of blindly waiting READY_SIGNAL_TIMEOUT_MS.
     readyGate = new ReadyGate();
     if (readySignalTimer) {
         clearTimeout(readySignalTimer);
@@ -6483,8 +6565,29 @@ function spawnCli(cfg) {
     promptReadyDetectedDuringSettle = false;
     // Reset quiescence baseline so the settle measures silence from THIS spawn.
     lastPtyOutputAtMs = Date.now();
+    const readyHookAvailable = effectiveReadyHookInstall
+        ? hasInstalledSessionReadyHook(effectiveReadyHookInstall)
+        : true; // Hermes emits BOTMUX_READY_COMMAND directly instead of a config hook.
+    const isolatedReadyTransportRequired = sandboxOn || willReadIsolate;
+    const readyPortAvailable = !isolatedReadyTransportRequired
+        || parseDaemonIpcPort(childEnv.BOTMUX_DAEMON_IPC_PORT) !== undefined;
+    const readyCapabilityAvailable = !isolatedReadyTransportRequired
+        || hasMatchingManagedOriginCapability(process.env.SESSION_DATA_DIR ?? '', cfg.sessionId, sandboxRelayCapability?.token, sandboxRelayOutbox ?? undefined);
+    const readySignalAvailable = readyHookAvailable && readyPortAvailable && readyCapabilityAvailable;
+    const freshReadyGateCandidate = cliAdapter.injectsReadyHook === true
+        && cfg.adoptMode !== true
+        && !willReattachPersistent;
+    if (freshReadyGateCandidate && !readySignalAvailable) {
+        const reasons = [
+            ...(!readyHookAvailable ? ['SessionStart hook missing from effective config'] : []),
+            ...(!readyPortAvailable ? ['BOTMUX_DAEMON_IPC_PORT missing/invalid'] : []),
+            ...(!readyCapabilityAvailable ? ['ready capability transport missing, unreadable, or stale'] : []),
+        ];
+        log(`Ready gate skipped — preflight failed: ${reasons.join('; ')}`);
+    }
     if (shouldArmReadyGate({
         injectsReadyHook: cliAdapter.injectsReadyHook === true,
+        readySignalAvailable,
         adoptMode: cfg.adoptMode === true,
         willReattachPersistent,
     })) {