claude-code-session-manager 0.123.1 → 0.124.1

package/src/main/lib/feedback-remote/remoteIpcDispatch.cjs

@@ -0,0 +1,216 @@
+'use strict'
+
+/**
+ * remoteIpcDispatch.cjs — run a remote call through the SAME ipcMain handler the
+ * renderer uses (no re-implementation), gated by the apiSurface remote policy and
+ * the web-remote tiers; plus a chunker keeping relay frames under the 256 KB cap.
+ *
+ * Pure — no Electron import. Lives in feedback-remote/ beside the other web-remote
+ * conduit modules (remoteClientSessions.cjs); no other lib domain fits.
+ * Gate order mirrors webRemote.dispatchEnvelope: kill switch → surface/allowlist →
+ * MUTATE tier → E2E auth.
+ */
+
+const MAX_VALUE_BYTES = 50 * 1024 * 1024
+const DEFAULT_FRAME_BYTES = 180000
+
+/**
+ * Wrap ipcMain.handle so every registration is also stored channel -> handler.
+ * Original behavior is unchanged.
+ * @param {{ handle: (channel: string, fn: Function) => any }} ipcMain
+ * @returns {Map<string, Function>}
+ */
+function captureIpcHandlers(ipcMain) {
+  const handlers = new Map()
+  const original = ipcMain.handle.bind(ipcMain)
+  ipcMain.handle = (channel, fn) => {
+    handlers.set(channel, fn)
+    return original(channel, fn)
+  }
+  return handlers
+}
+
+
+const { isContainedIn } = require('../insideHome.cjs')
+
+/**
+ * Path-taking remote-readable channels. mode 'root': realpath must sit inside a
+ * registered project root. mode 'secret': only the secret refusal applies (the
+ * handler enforces its own root, e.g. the transcripts dir). `field` is the key
+ * of the payload object (args[0]) that carries the filesystem path.
+ */
+const PATH_FENCED_CHANNELS = Object.freeze({
+  'files:read': { field: 'path', mode: 'root' },
+  'files:list': { field: 'path', mode: 'root', allowHomeListing: true },
+  'transcript:readRef': { field: 'filePath', mode: 'secret' },
+  'transcript:path': { field: 'cwd', mode: 'secret' },
+  'memory:read': { field: 'cwd', mode: 'secret' },
+})
+
+const SECRET_DIRS = new Set(['.ssh', '.gnupg', '.aws', '.kube', '.docker', '.password-store', '.azure', '.terraform.d'])
+const SECRET_BASENAMES = new Set(['.credentials.json', '.netrc', '.npmrc', '.env', '.claude.json', '.git-credentials', '.pypirc'])
+const SECRET_BASENAME_RES = [/^\.env\..*/, /\.pem$/, /^id_rsa/, /^id_ed25519/, /^id_ecdsa/]
+/** Multi-segment secrets: match as consecutive path segments at any depth. */
+const SECRET_SEQUENCES = [
+  ['.config', 'gcloud'],
+  ['.claude', 'session-manager'],
+  ['.config', 'gh'],
+  ['.config', 'git', 'credentials'],
+  ['.cargo', 'credentials'],
+  ['.cargo', 'credentials.toml'],
+  ['.local', 'share', 'keyrings'],
+  ['Library', 'Keychains'],
+  ['AppData', 'Roaming', 'Microsoft', 'Credentials'],
+  ['AppData', 'Local', 'Microsoft', 'Credentials'],
+]
+
+/** True when the path has a secret segment, segment sequence or basename. */
+function isSecretPath(p, platform) {
+  const win = platform === 'win32'
+  const norm = win ? String(p).toLowerCase() : String(p)
+  const segs = norm.split(/[\\/]+/).map((x) => (win ? x.replace(/[. ]+$/, '') : x)).filter(Boolean)
+  const seqs = win ? SECRET_SEQUENCES.map((q) => q.map((x) => x.toLowerCase())) : SECRET_SEQUENCES
+  for (let i = 0; i < segs.length; i++) {
+    if (SECRET_DIRS.has(segs[i])) return true
+    for (const q of seqs) {
+      if (q.every((part, k) => segs[i + k] === part)) return true
+    }
+  }
+  const base = segs[segs.length - 1] || ''
+  return SECRET_BASENAMES.has(base) || SECRET_BASENAME_RES.some((re) => re.test(base))
+}
+
+/**
+ * Remote-only argument fence. Returns { ok: true } or { ok: false, reason: 'path_fenced' }.
+ * @param {string} channel
+ * @param {any[]} args
+ * @param {{ homeDir: string, projectRoots: () => string[], realpath: (p:string)=>string, platform?: string }} ctx
+ */
+function remoteArgFence(channel, args, ctx) {
+  const spec = Object.prototype.hasOwnProperty.call(PATH_FENCED_CHANNELS, channel) ? PATH_FENCED_CHANNELS[channel] : null
+  if (!spec) return { ok: true }
+  const refuse = { ok: false, reason: 'path_fenced' }
+  const platform = (ctx && ctx.platform) || process.platform
+  try {
+    const a0 = Array.isArray(args) ? args[0] : undefined
+    const raw = a0 && typeof a0 === 'object' ? a0[spec.field] : a0
+    if (typeof raw !== 'string' || !raw) return refuse
+    const real = ctx.realpath(raw)
+    if (isSecretPath(raw, platform) || isSecretPath(real, platform)) return refuse
+    if (spec.mode === 'secret') return { ok: true }
+    const home = ctx.realpath(ctx.homeDir)
+    if (spec.allowHomeListing && isContainedIn(real, home, platform) && isContainedIn(home, real, platform)) {
+      return { ok: true }
+    }
+    for (const root of ctx.projectRoots() || []) {
+      if (typeof root !== 'string' || !root) continue
+      let realRoot
+      try { realRoot = ctx.realpath(root) } catch { realRoot = root }
+      // A root equal to home or an ancestor of it (incl. `/` or a drive root)
+      // would expose every non-secret file under home — never honour it.
+      if (isContainedIn(home, realRoot, platform)) continue
+      if (isContainedIn(real, realRoot, platform)) return { ok: true }
+    }
+    return refuse
+  } catch {
+    return refuse
+  }
+}
+
+const STRICTNESS = { read: 0, mutate: 1, deny: 2 }
+
+/** Strictest remote policy among the invokable (invoke|send) rows for a channel, or null. */
+function policyFor(surface, channel) {
+  let policy = null
+  for (const row of surface) {
+    if (row.channel !== channel) continue
+    if (row.kind !== 'invoke' && row.kind !== 'send') continue
+    const p = STRICTNESS[row.remote] === undefined ? 'deny' : row.remote
+    if (policy === null || STRICTNESS[p] > STRICTNESS[policy]) policy = p
+  }
+  return policy
+}
+
+/**
+ * @param {{ surface: ReadonlyArray<{channel:string,kind:string,remote:string}>,
+ *           handlers: Map<string, Function> | Record<string, Function>,
+ *           getConfig: () => ({remoteEnabled?:boolean, remoteControlEnabled?:boolean} | Promise<any>),
+ *           fenceCtx?: Parameters<typeof remoteArgFence>[2] }} deps
+ */
+function createRemoteIpcDispatcher({ surface, handlers, getConfig, fenceCtx }) {
+  const lookup = (channel) =>
+    handlers instanceof Map ? handlers.get(channel) : handlers && Object.prototype.hasOwnProperty.call(handlers, channel) ? handlers[channel] : undefined
+
+  async function invoke(client, channel, args) {
+    const cfg = (await getConfig()) || {}
+    if (!cfg.remoteEnabled) return { ok: false, reason: 'disabled' }
+
+    const policy = typeof channel === 'string' ? policyFor(surface, channel) : null
+    if (policy === null) return { ok: false, reason: 'not_in_surface' }
+    if (policy === 'deny') return { ok: false, reason: 'denied' }
+
+    if (!client || !client.e2e || client.e2e.state !== 'authenticated') {
+      return { ok: false, reason: 'e2e_not_authenticated' }
+    }
+    if (policy === 'mutate' && !(cfg.remoteEnabled === true && cfg.remoteControlEnabled === true)) {
+      return { ok: false, reason: 'mutate_not_allowed' }
+    }
+
+    const handler = lookup(channel)
+    if (typeof handler !== 'function') return { ok: false, reason: 'no_handler' }
+
+    // Remote-only fence: fail closed when path-taking channels have no ctx.
+    const fence = fenceCtx || !Object.prototype.hasOwnProperty.call(PATH_FENCED_CHANNELS, channel)
+      ? remoteArgFence(channel, args, fenceCtx)
+      : { ok: false, reason: 'path_fenced' }
+    if (!fence.ok) return { ok: false, reason: 'path_fenced' }
+
+    try {
+      const event = { sender: null, remoteClientId: client.key }
+      const result = await handler(event, ...(Array.isArray(args) ? args : []))
+      return { ok: true, result }
+    } catch (e) {
+      return { ok: false, reason: 'handler_error', message: e && e.message ? String(e.message) : String(e) }
+    }
+  }
+
+  return { invoke }
+}
+
+/**
+ * Serialize once and split into ordered frames, each strictly under maxBytes (UTF-8).
+ * @returns {{ ok: true, frames: Array<{seq:number,total:number,data:string}> } | { ok: false, reason: string }}
+ */
+function chunkFrames(value, maxBytes = DEFAULT_FRAME_BYTES) {
+  const json = JSON.stringify(value === undefined ? null : value)
+  const buf = Buffer.from(json, 'utf8')
+  if (buf.length > MAX_VALUE_BYTES) return { ok: false, reason: 'too_large' }
+  const limit = Math.max(4, maxBytes - 1)
+  const slices = []
+  let start = 0
+  while (start < buf.length) {
+    let end = Math.min(start + limit, buf.length)
+    if (end < buf.length) {
+      while (end > start && (buf[end] & 0xc0) === 0x80) end--
+    }
+    slices.push(buf.subarray(start, end).toString('utf8'))
+    start = end
+  }
+  if (slices.length === 0) slices.push('')
+  const total = slices.length
+  return { ok: true, frames: slices.map((data, seq) => ({ seq, total, data })) }
+}
+
+/** Reverse chunkFrames. Throws on missing/duplicate frames. */
+function joinFrames(frames) {
+  if (!Array.isArray(frames) || frames.length === 0) throw new Error('no frames')
+  const sorted = [...frames].sort((a, b) => a.seq - b.seq)
+  const total = sorted[0].total
+  if (sorted.length !== total) throw new Error('incomplete frames')
+  sorted.forEach((f, i) => {
+    if (f.seq !== i || f.total !== total) throw new Error('bad frame sequence')
+  })
+  return JSON.parse(sorted.map((f) => f.data).join(''))
+}
+
+module.exports = { remoteArgFence, PATH_FENCED_CHANNELS, captureIpcHandlers, createRemoteIpcDispatcher, chunkFrames, joinFrames, MAX_VALUE_BYTES }

package/src/main/lib/insideHome.cjs

@@ -28,43 +28,74 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 
+/**
+ * Canonicalize a path: native realpath (resolves 8.3 short names and subst
+ * drives on Windows; falls back to the JS realpath), and a not-yet-existing
+ * path resolves through its nearest existing ancestor with the missing tail
+ * joined back on. deps: { fs, platform } injectable for tests.
+ */
+function realpath(p, deps = {}) {
+  const fsx = deps.fs || fs;
+  const pm = (deps.platform || process.platform) === 'win32' ? path.win32 : path;
+  const rp = typeof fsx.realpathSync.native === 'function' ? fsx.realpathSync.native : fsx.realpathSync;
+  const lex = pm.resolve(p);
+  try {
+    return rp(lex);
+  } catch (e) {
+    if (!e || e.code !== 'ENOENT') throw e;
+  }
+  const tail = [pm.basename(lex)];
+  let dir = pm.dirname(lex);
+  for (;;) {
+    try {
+      return pm.join(rp(dir), ...tail.reverse());
+    } catch (e) {
+      if (!e || e.code !== 'ENOENT') throw e;
+      const parent = pm.dirname(dir);
+      if (parent === dir) return lex; // filesystem root; give up safely
+      tail.push(pm.basename(dir));
+      dir = parent;
+    }
+  }
+}
+
 // Resolve home once. Falls back to literal homedir if realpath fails
 // (which would be a misconfigured system; boot self-check in index.cjs
-// surfaces it). Cached for the lifetime of the process — home doesn't
-// move under us at runtime.
+// surfaces it). Cached for the lifetime of the process.
 const HOME_LITERAL = os.homedir();
 let HOME_REAL;
 try {
-  HOME_REAL = fs.realpathSync(HOME_LITERAL);
+  HOME_REAL = realpath(HOME_LITERAL);
 } catch {
   HOME_REAL = HOME_LITERAL;
 }
 
 function resolveTarget(p) {
-  // realpath fails with ENOENT for paths that don't exist yet (writes,
-  // mkdir destinations). Fall through to lexical resolve so the containment
-  // check still applies — prevents info-disclosure via stat probes on
-  // /etc/secrets/... that would be rejected later but reveal existence first.
-  try {
-    return fs.realpathSync(p);
-  } catch (err) {
-    if (err && err.code === 'ENOENT') return path.resolve(p);
-    throw err;
-  }
+  // Missing paths are validated via their nearest existing ancestor so the
+  // containment check still applies (no stat-probe info disclosure).
+  return realpath(p);
+}
+
+function isContainedWin32(target, root) {
+  const norm = (v) => path.win32.normalize(v).toLowerCase().replace(/[\\/]+$/, '');
+  const t = norm(target);
+  const r = norm(root);
+  // \\?\ and \\.\ prefixes can alias any location — never contained.
+  if (/^[\\/]{2}[?.][\\/]/.test(t) || /^[\\/]{2}[?.][\\/]/.test(r)) return false;
+  const tUnc = /^[\\/]{2}/.test(t);
+  const rUnc = /^[\\/]{2}/.test(r);
+  if (tUnc !== rUnc) return false;
+  return t === r || t.startsWith(r + '\\');
 }
 
-function isContainedWin32(target, home) {
-  // UNC and \\?\ / \\.\ prefixes can alias any location — never inside home.
-  if (/^[\\/]{2}/.test(target)) return false;
-  const strip = (v) => path.win32.normalize(v).toLowerCase().replace(/[\\/]+$/, '');
-  const t = strip(target);
-  const h = strip(home);
-  return t === h || t.startsWith(h + '\\');
+/** Is realPath equal to, or beneath, root? Equality-or-separator boundary. */
+function isContainedIn(realPath, root, platform = process.platform) {
+  if (platform === 'win32') return isContainedWin32(realPath, root);
+  return realPath === root || realPath.startsWith(root + path.posix.sep);
 }
 
 function isContained(realPath, home = HOME_REAL, platform = process.platform) {
-  if (platform === 'win32') return isContainedWin32(realPath, home);
-  return realPath === home || realPath.startsWith(home + path.posix.sep);
+  return isContainedIn(realPath, home, platform);
 }
 
 function assertInsideHome(p) {
@@ -99,4 +130,52 @@ function checkInsideHome(p) {
   return { ok: true, realPath };
 }
 
-module.exports = { assertInsideHome, checkInsideHome, isContained };
+/**
+ * Home OR a main-process-registered project root. `roots` must come from
+ * config.cjs's allowed-roots registry — never from a renderer request.
+ * deps: { platform, home, fs } injectable for tests.
+ */
+function checkInsideHomeOrRoots(p, roots = [], deps = {}) {
+  const platform = deps.platform || process.platform;
+  const home = deps.home || HOME_REAL;
+  const list = [...roots];
+  const fail = () => ({
+    ok: false,
+    error: `path outside home and project roots: ${typeof p === 'string' ? p : String(p)}`,
+  });
+  if (typeof p !== 'string' || !p) return fail();
+  let realPath;
+  try {
+    realPath = realpath(p, deps);
+  } catch {
+    return fail();
+  }
+  if (isContainedIn(realPath, home, platform)) return { ok: true, realPath };
+  for (const root of list) {
+    if (typeof root !== 'string' || !root) continue;
+    let realRoot;
+    try {
+      realRoot = realpath(root, deps);
+    } catch {
+      realRoot = root;
+    }
+    if (isContainedIn(realPath, realRoot, platform)) return { ok: true, realPath };
+  }
+  return fail();
+}
+
+function assertInsideHomeOrRoots(p, roots = [], deps = {}) {
+  const r = checkInsideHomeOrRoots(p, roots, deps);
+  if (!r.ok) throw new Error(r.error);
+  return { realPath: r.realPath };
+}
+
+module.exports = {
+  assertInsideHome,
+  checkInsideHome,
+  assertInsideHomeOrRoots,
+  checkInsideHomeOrRoots,
+  isContained,
+  isContainedIn,
+  realpath,
+};

package/src/main/lib/persona-macro/shippedPersonaSeeds.cjs

@@ -51,6 +51,18 @@ const SHIPPED_PERSONA_SEEDS = deepFreeze({
         tools: "Read, Grep, Glob, Bash, Edit, Write",
       },
     },
+    {
+      commit: "0c6e625f",
+      bodySha256: "40a4d41445e7fdb128f4f1d8d3eef88b857ca466726b3719b36cb69933f09168",
+      fm: {
+        description: "The primary Actor for an Epic's whole interactive conversation — owns overall plan and decomposition, clarifies scope, searches before building, decomposes work into scheduled PRDs via /develop, tracks them to completion, and verifies before calling anything done. Never implements a PRD itself — that's dev-lead's job, one PRD at a time, headless. Task-type framing is the Epic's Mission tag's job, not this persona's.",
+        model: "opus",
+        effort: "medium",
+        tags: "feature, bug, discussion, art",
+        title: "Engineering — Architect",
+        tools: "Read, Grep, Glob, Bash, Edit, Write",
+      },
+    },
   ],
   "dev-lead": [
     {
@@ -331,6 +343,21 @@ const SHIPPED_PERSONA_SEEDS = deepFreeze({
       },
     },
   ],
+  "blender-artist": [
+    {
+      commit: "0c6e625f",
+      bodySha256: "9cc52c7a1e35f81a158cccfd6b05974ed7a95e23cb98666c8f68dab54c9a6b5a",
+      fm: {
+        description: "Expert 3D character artist for games — modeling, rigging, skinning, shape keys and keyframe animation in Blender, driven headlessly through Blender's Python API and the Blender MCP, verified in-engine with the Godot CLI. Executes exactly one already-scoped art PRD at a time (the dev-lead equivalent for 3D assets). Use for any change whose source of truth is a .blend file.",
+        tools: "Read, Grep, Glob, Bash, Edit, Write, mcp__blender__execute_blender_code_for_cli, mcp__blender__get_blendfile_summary_datablocks_for_cli, mcp__blender__get_blendfile_summary_usage_guess_for_cli, mcp__blender__get_blendfile_summary_missing_files_for_cli, mcp__blender__get_python_api_docs, mcp__blender__search_api_docs, mcp__blender__search_manual_docs, mcp__blender__render_thumbnail_to_path, mcp__blender__render_viewport_to_path, mcp__blender__execute_blender_code, mcp__blender__get_objects_summary, mcp__blender__get_object_detail_summary, mcp__blender__get_screenshot_of_area_as_image",
+        title: "Games — 3D Character Artist (Blender)",
+        model: "opus",
+        effort: "high",
+        tags: "art",
+        executorOnly: "true",
+      },
+    },
+  ],
 });
 
 module.exports = { SHIPPED_PERSONA_SEEDS };

package/src/main/lib/prd/prdWorktreeReach.cjs

@@ -22,6 +22,9 @@ const MAX_NAMED_PATHS = 5;
 const LEADING_JUNK_RE = /^[`'"([<]+/;
 const TRAILING_JUNK_RE = /[`'")\]>.,:;]+$/;
 
+const FRAGMENT_RE = /#[^/#]*$/;
+const LINE_SUFFIX_RE = /:\d+(?:-\d+)?$/;
+
 function isCandidate(token) {
   if (!token.includes('/')) return false;
   if (/^[/~$-]/.test(token)) return false;
@@ -35,7 +38,12 @@ function extractRepoPathCandidates(text) {
   const seen = new Set();
   for (const raw of String(text == null ? '' : text).split(/\s+/)) {
     if (!raw) continue;
-    const token = raw.replace(LEADING_JUNK_RE, '').replace(TRAILING_JUNK_RE, '');
+    const token = raw
+      .replace(LEADING_JUNK_RE, '')
+      .replace(TRAILING_JUNK_RE, '')
+      .replace(FRAGMENT_RE, '')
+      .replace(LINE_SUFFIX_RE, '')
+      .replace(TRAILING_JUNK_RE, '');
     if (!token || !isCandidate(token)) continue;
     seen.add(token);
     if (seen.size >= MAX_CANDIDATES) break;

package/src/main/lib/scheduler/rcaReport.cjs

@@ -73,7 +73,6 @@ const FAILURE_CLASSES = {
   TRANSCRIPT_ERRORS: 'transcript-errors',
   ABANDONED_BACKGROUND_TASK: 'abandoned-background-task',
   BLOCKED_BY_FOREIGN_WIP: 'blocked-by-foreign-wip',
-  NEEDS_HUMAN: 'needs-human',
   UNKNOWN: 'unknown',
 };
 
@@ -83,10 +82,7 @@ const FAILURE_CLASSES = {
 // nothing to investigate, and re-queuing is already owned by
 // reconcile()'s requeueForeignWipBlockedJobs, not this action), 'resume-and-commit'
 // (PRD 1111's --resume dispatch owns this), 'verify-and-close' (the work
-// likely landed, just missing its sentinel), 'ask-human' (the executor
-// correctly stopped on a step only a person can do — answer the job's
-// humanQuestion, then update + reset the PRD; never a fix-plan, and the review
-// ladder never auto-fixes it), 'investigate' (the only class that still buys a
+// likely landed, just missing its sentinel), 'investigate' (the only class that still buys a
 // fix-plan investigation).
 const RECOVERY_ACTIONS = {
   [FAILURE_CLASSES.ALREADY_SHIPPED]: 'archive',
@@ -108,7 +104,6 @@ const RECOVERY_ACTIONS = {
   // guidance into that cold-read investigation.
   [FAILURE_CLASSES.ABANDONED_BACKGROUND_TASK]: 'investigate',
   [FAILURE_CLASSES.BLOCKED_BY_FOREIGN_WIP]: 'archive',
-  [FAILURE_CLASSES.NEEDS_HUMAN]: 'ask-human',
   [FAILURE_CLASSES.UNKNOWN]: 'investigate',
 };
 
@@ -136,8 +131,6 @@ const PREVENTION_HINTS = {
     'A headless run cannot receive a background-task completion notification — never let a long Bash command auto-background past its foreground timeout and then wait for it. Run long commands with an explicit bound (`timeout <N> <cmd>`) so they finish in the foreground, or poll their output file directly instead of waiting on Monitor/notification.',
   [FAILURE_CLASSES.BLOCKED_BY_FOREIGN_WIP]:
     'This job correctly reported `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP` against a sibling job\'s in-flight, uncommitted files three times in a row — auto-requeue is exhausted (reconcile() only clears this once the blocked paths go clean). This is not a defect in this PRD\'s own work: check on the sibling job/human that owns the still-dirty path(s) named on the job row, and either wait for them to commit or manually reset this job to `pending` once the tree is clear. Do not author a fix-plan PRD against it.',
-  [FAILURE_CLASSES.NEEDS_HUMAN]:
-    'The run stopped on a step that needs a person or live runtime state — the executor was right to stop, so this is not a defect to fix-plan. Answer the job\'s humanQuestion, then update and reset the PRD. If the reason is that the job worktree lacks gitignored runtime state (databases, browser profile, downloads/, crontab paths), re-author the step as an artifact-only PRD that addresses the main checkout by absolute path, per PRD_AUTHORING.md section 7.',
   [FAILURE_CLASSES.UNKNOWN]:
     'Re-run the acceptance criteria gate locally against the failure log to pin down the specific break before re-queuing.',
 };
@@ -199,11 +192,6 @@ function classifyFailure({ verdict, logTail: rawLogTail }) {
   const logTail = stripHarnessInitEvents(rawLogTail);
   const lines = logTail.split('\n');
 
-  // Checked before every other rule, log-tail heuristics included: the
-  // executor deliberately stopped on a human-only step, so words like
-  // "sleep"/"until" in its tail say nothing about the cause.
-  if (verdict === 'needs_human') return FAILURE_CLASSES.NEEDS_HUMAN;
-
   // Checked before every other rule: an unambiguous, materially-checked
   // verdict (the scheduler itself validated the executor's claimed paths
   // against the job's disclosed foreign-WIP manifest before ever landing