create-walle 0.10.1 → 0.10.2

package/README.md

@@ -73,6 +73,10 @@ CTM can park an eligible inactive session to stop its process and free resources
 
 A shared MCP gateway lets eligible tool servers reuse one process across sessions; tools needing session-specific state keep separate instances.
 
+### Use more than one machine
+
+Pair another machine running CTM and its sessions join the same list, tagged by machine. Pick the machine when you start a session, open and type into it from the hub's browser, and sign that machine's coding agents in from the Machines page, on desktop or phone.
+
 ### Review changes in one place
 
 The Review page moves between rendered HTML or Markdown, source files and diffs, and new files appear before Git tracks them. Comments collect into one message for the session responsible for the change, keeping feedback beside the files that produced it.

package/lib/owner-write-safety.js

@@ -0,0 +1,135 @@
+'use strict';
+
+// Shared "no other account can write through this path" predicate for paths CTM and
+// Wall-E did not create themselves (a Codex sessions root, an enrolled provider root,
+// a data directory handed in by an installer, ~/.walle/data).
+//
+// The rule is Debian OpenSSH's `user-group-modes.patch` rule, adapted: world write is
+// never acceptable, and group write is acceptable ONLY when the owning group is the
+// current user's own one-member private group (the user-private-group scheme that
+// `pam_umask(8)` sets up as umask 002 on every Debian/Ubuntu/Fedora login). On a shared
+// group (`staff` on macOS, `users` on many hosts) the check is exactly as strict as
+// before.
+//
+// Accepted gap (same as the Debian patch): a group password held in `/etc/gshadow`
+// (usable through `newgrp`) and accounts that exist only in NSS (LDAP/SSSD) are invisible
+// to the `/etc/group` + `/etc/passwd` parse this module performs, so a gid that cannot be
+// proven from the local files is refused — the check always fails closed.
+
+const fs = require('node:fs');
+const os = require('node:os');
+
+const MAX_DB_BYTES = 1024 * 1024;
+const GROUP_PATH = '/etc/group';
+const PASSWD_PATH = '/etc/passwd';
+
+/** Default reader: one bounded read (≤ MAX_DB_BYTES), the fd always closed. */
+function _readBoundedFile(filePath) {
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const stat = fs.fstatSync(fd);
+    if (Number(stat.size) > MAX_DB_BYTES) {
+      throw new Error(`${filePath} is larger than ${MAX_DB_BYTES} bytes`);
+    }
+    return fs.readFileSync(fd, 'utf8');
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+// A seam explicitly passed as `null` means "this platform has no such call" (the Windows
+// shape); `undefined` means "use the process default".
+function _seam(deps, name, fallback) {
+  if (deps[name] === null) return null;
+  if (typeof deps[name] === 'function') return deps[name];
+  return typeof fallback === 'function' ? fallback : null;
+}
+
+// Split a local-database file into usable lines: blanks and `#` comments are skipped, and a
+// `+`/`-` NIS compat line makes the whole file unprovable (return null).
+function _usableLines(text) {
+  const lines = [];
+  for (const raw of String(text).split('\n')) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#')) continue;
+    if (line.startsWith('+') || line.startsWith('-')) return null;
+    lines.push(line);
+  }
+  return lines;
+}
+
+function _numericField(value) {
+  return /^\d+$/.test(value || '') ? Number(value) : null;
+}
+
+/** D-2: `gid` is the current user's one-member private group. Any doubt ⇒ false. */
+function isUserPrivateGroup(gid, deps = {}) {
+  try {
+    const getuid = _seam(deps, 'getuid', process.getuid);
+    const getgid = _seam(deps, 'getgid', process.getgid);
+    if (typeof getuid !== 'function' || typeof getgid !== 'function') return false;
+    const targetGid = _numericField(String(gid));
+    if (targetGid === null) return false;
+    if (Number(getgid()) !== targetGid) return false;
+    const uid = Number(getuid());
+    const usernameFn = _seam(deps, 'username', () => os.userInfo().username);
+    if (typeof usernameFn !== 'function') return false;
+    const username = String(usernameFn() || '');
+    if (!username) return false;
+    const readFile = _seam(deps, 'readFile', _readBoundedFile);
+    if (typeof readFile !== 'function') return false;
+
+    // (b) /etc/group: exactly one line with this gid, named after the login, members ⊆ {login}.
+    const groupLines = _usableLines(readFile(GROUP_PATH));
+    if (!groupLines) return false;
+    const groupEntries = [];
+    for (const line of groupLines) {
+      const fields = line.split(':');
+      const lineGid = fields.length >= 3 ? _numericField(fields[2]) : null;
+      if (lineGid === null || lineGid !== targetGid) continue;
+      if (fields.length !== 4) return false;
+      groupEntries.push({ name: fields[0], members: fields[3].split(',').map(m => m.trim()).filter(Boolean) });
+    }
+    if (groupEntries.length !== 1) return false;
+    const group = groupEntries[0];
+    if (group.name !== username) return false;
+    if (group.members.length > 1) return false;
+    if (group.members.length === 1 && group.members[0] !== username) return false;
+
+    // (c) /etc/passwd: every account whose primary gid is this gid is this uid, and one exists.
+    const passwdLines = _usableLines(readFile(PASSWD_PATH));
+    if (!passwdLines) return false;
+    let primaryAccounts = 0;
+    for (const line of passwdLines) {
+      const fields = line.split(':');
+      const lineGid = fields.length >= 4 ? _numericField(fields[3]) : null;
+      if (lineGid === null || lineGid !== targetGid) continue;
+      if (fields.length !== 7) return false;
+      primaryAccounts += 1;
+      const lineUid = _numericField(fields[2]);
+      if (lineUid === null || lineUid !== uid) return false;
+    }
+    if (primaryAccounts === 0) return false;
+    return true;
+  } catch {
+    /* expected: any unreadable or unparsable account database fails closed (D-3) */
+    return false;
+  }
+}
+
+/**
+ * True iff no account other than the current user can write through `stat`'s permission bits.
+ * Accepts fs.Stats (Number) and fs.BigIntStats (bigint) alike.
+ * @param {{ mode: number|bigint, gid: number|bigint }} stat
+ * @param {{ readFile?: (p: string) => string, getuid?: () => number, getgid?: () => number,
+ *           username?: () => string }} [deps]  test seams
+ * @returns {boolean}
+ */
+function isWritableOnlyByOwner(stat, deps = {}) {
+  const mode = Number(stat.mode);
+  if ((mode & 0o002) !== 0) return false; // world write is never acceptable
+  if ((mode & 0o020) === 0) return true; // no group write: no file is read
+  return isUserPrivateGroup(Number(stat.gid), deps);
+}
+
+module.exports = { isWritableOnlyByOwner, isUserPrivateGroup, MAX_DB_BYTES, _readBoundedFile };

package/lib/public-runtime.js

@@ -36,6 +36,11 @@ const os = require('node:os');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 
+// The ONE "no other account can write through this path" predicate, shared with CTM and Wall-E. It
+// is a relative SIBLING require on purpose: the mirror is byte-identical, so the same bytes resolve it
+// from `shared/` and from `create-walle/lib/`.
+const { isWritableOnlyByOwner } = require('./owner-write-safety');
+
 const {
   parseReleaseRuntimePolicy,
   releaseRuntimeArchive,
@@ -187,10 +192,13 @@ function publicRuntimeNpmEnv(nodeBin) {
 
 // ── the one cache-directory admission ───────────────────────────────────────────────────────────
 /**
- * Assert that `dir` is a REAL directory (never a link), owned by the current user, and not
- * group/other writable. Ancestors ABOVE the owned cache boundary are deliberately not inspected: a
- * system path or a sticky ancestor is not this installer's ownership requirement, and pretending
- * otherwise would refuse every legitimate `~/.walle` under a shared parent.
+ * Assert that `dir` is a REAL directory (never a link), owned by the current user, and writable only
+ * by its owner (a user-private group counts as the owner: world write is never acceptable, and group
+ * write is acceptable only when the owning group is the user's own one-member private group, the
+ * umask-002 scheme of a Debian/Ubuntu/Fedora login). Ancestors ABOVE the owned cache boundary are
+ * deliberately not inspected: a system path or a sticky ancestor is not this installer's ownership
+ * requirement, and pretending otherwise would refuse every legitimate `~/.walle` under a shared
+ * parent.
  */
 function assertOwnedCacheDirectory(fsOps, dir, phase) {
   let stat;
@@ -202,7 +210,7 @@ function assertOwnedCacheDirectory(fsOps, dir, phase) {
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     throw refuse(phase, 'public runtime cache directory is not a real directory');
   }
-  if ((Number(stat.mode) & 0o022) !== 0) {
+  if (!isWritableOnlyByOwner(stat)) {
     throw refuse(phase, 'public runtime cache directory is group or other writable');
   }
   if (typeof process.getuid === 'function' && Number(stat.uid) !== process.getuid()) {

package/lib/release-schema.json

@@ -9,7 +9,7 @@
         21, 22, 23, 24, 25, 26, 27, 28, 29, 30,
         31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
         41, 42, 43, 44, 45, 46, 47, 48, 49, 50,
-        51, 52, 53, 54, 55
+        51, 52, 53, 54, 55, 56
       ]
     },
     "walle": {
@@ -24,7 +24,8 @@
         61, 62, 63, 64, 65, 66, 67, 68, 69, 70,
         71, 72, 73, 74, 75, 76, 77, 78, 79, 80,
         81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96,
-        97, 98, 99
+        97, 98, 99, 100,
+        101
       ]
     }
   }

package/lib/runtime-closure-policy.json

@@ -39,7 +39,9 @@
     "coding-task-manager/bin/seam-replay.js",
     "coding-task-manager/bin/session-access-lint.js",
     "coding-task-manager/bin/session-create-fanout-lint.js",
+    "coding-task-manager/bin/session-host-kill-lint.js",
     "coding-task-manager/bin/session-runtime-evidence-lint.js",
+    "coding-task-manager/bin/startup-pointer-writer-lint.js",
     "coding-task-manager/bin/status-verdict-lint.js",
     "coding-task-manager/bin/term-container-band-lint.js",
     "coding-task-manager/bin/terminal-write-lint.js",
@@ -1785,12 +1787,12 @@
     "coding-task-manager/lib/walle-deps-repair.js": "be85620d08795ea0fe9539820416d5cc50b654519abddab0811907fa3fe93a7f",
     "coding-task-manager/lib/walle-mcp-auto-config.js": "b978e9b15d9dac8179dde0feb5357c14957f7b4e36dab7e6779587bcde8faeff",
     "coding-task-manager/lib/walle-native-health.js": "9fdf7f17eb77837aac4ea16140a6f4e5a97d7a568945da30f29b9a7541c3d967",
-    "coding-task-manager/lib/walle-supervisor.js": "04b924f16c9bd001ed505347202dbec2876b57fc427a32c93d23586530181f83",
+    "coding-task-manager/lib/walle-supervisor.js": "1eb9971a2ede9735e595952404f467f6775ad9f99545137faad86e3c6fb38af9",
     "coding-task-manager/public/js/client-health-worker.js": "07e300113ee749ac7a6adaaa1461502d1562087af395b6c89cf1b885f1f5e00e",
     "coding-task-manager/public/js/image-normalize-worker.js": "37cb0758bddcf10c66060fae52088c1a842409f30e919988e789cfea7d05e2be",
-    "coding-task-manager/public/m/app.js": "483f777f57efd28d7796713c33df48ffba47e5bfb50597b446a37b961f53d585",
-    "coding-task-manager/server.js": "927a036ed5143c02b2c021e5b5c0a80def7f87d01524514108f90f438e48b776",
-    "scripts/conversation-storage-v2-migration.js": "80c66e41c9fb9b1d756fe21be17f3b07c6a65389712887043a86341fbf6a6879",
+    "coding-task-manager/public/m/app.js": "8e4662e21c409003a2d61de3c044410055176b574d787b34f7ede776b62a7003",
+    "coding-task-manager/server.js": "347578d2cab77abedb122df048f60415d8d392ed4caf4bd32fc92e91a9aa3f9a",
+    "scripts/conversation-storage-v2-migration.js": "f2620ba24893c4d2ec6c594428ddb41dc098da38b4066f1df25fb87abbfaebfa",
     "shared/storage/schema-port.js": "e41cec8c075a6167fba2efd0177d9e20a11c0cd49ae176aaf36d5b9257409e67",
     "shared/storage/schema-sync.js": "7ca080e44e35e8178a0f74317023881f920ae75bde4f7431702ce1f9fa4a1d03",
     "wall-e/adapters/chatgpt.js": "8c0fa31ae65ed5c10776e50a1a26c131bc62cb1aa3d88eb4617e7b83b43789d9",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-walle",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "CTM + Wall-E: one workspace for coding agents, worktrees and review, with shared session context and a personal agent.",
   "homepage": "https://walle.sh",
   "bin": {

package/template/bin/deps-doctor.js

@@ -248,7 +248,7 @@ function checkDeps(pkgDir, opts = {}) {
 }
 
 // The package dirs a gate depends on, relative to a checkout root.
-const TREE_SUBS = ['', 'coding-task-manager', 'wall-e', 'shared', 'create-walle'];
+const TREE_SUBS = ['', 'coding-task-manager', 'wall-e', 'shared', 'create-walle', 'ctm-relay'];
 
 // `npm --prefix <owner> install --no-save`: <owner> is the checkout that really
 // holds node_modules (a gate tree borrows it through a symlink). Never

package/template/bin/node-bin.sh

@@ -56,6 +56,17 @@ bootstrap_candidates() {
   for cache_node in "$HOME"/.walle/runtimes/*/*/runtime/bin/node; do
     if [ -e "$cache_node" ]; then printf '%s\n' "$cache_node"; fi
   done
+  # Linux boxes (e.g. DGX Spark) install Node via nvm/fnm, so with a non-interactive ssh session
+  # that never sources the manager there is no `node` on PATH and none of the macOS Wall-E paths
+  # above exist. Any version found here only RUNS the fixed helper; the pin is still enforced by the
+  # candidate ladder below, so a version-globbed bootstrap can never select a mismatched ABI.
+  local manager_node
+  for manager_node in \
+    "$HOME"/.nvm/versions/node/*/bin/node \
+    "$HOME"/.local/share/fnm/node-versions/*/installation/bin/node \
+    "$HOME"/.fnm/node-versions/*/installation/bin/node; do
+    if [ -e "$manager_node" ]; then printf '%s\n' "$manager_node"; fi
+  done
   return 0
 }
 

package/template/coding-task-manager/api-prompts.js

@@ -5,8 +5,11 @@ const os = require('os');
 const { isMainThread } = require('node:worker_threads');
 const { classifySqliteError } = require('./lib/sqlite-driver');
 const { reportRouteError, routeError, tagRouteValidationError } = require('./lib/route-error');
+const { terminalDraftHttpStatus: _terminalDraftStatus } = require('./lib/terminal-draft-http-status');
 // WP-2 (§9): the delivery-completion request projection lives with the image-protocol owners.
 const { buildDraftDeliveryCompletionRequest } = require('./lib/terminal-draft-publication-api');
+const remoteSessionForward = require('./lib/remote-session-forward'); // WP-3 (§6/D-1..D-3): an image-draft request for a MIRROR id is answered by the owning box
+const { overlayQueueDraftStatuses } = require('./lib/queue-draft-status-overlay'); // R-1 (§5): the queue-draft GET overlays durable engine status, never writes
 const db = require('./db-owner-client');
 const queueEngine = require('./queue-engine');
 const harvest = require('./prompt-harvest');
@@ -820,7 +823,10 @@ function handlePromptApi(req, res, url, deps = {}) {
   // --- Images ---
   if (p === '/api/images/upload' && m === 'POST') return handleUploadImage(req, res, url);
   if (/^\/api\/sessions\/[^/]+\/image-drafts(?:\/[^/]+(?:\/content|\/delivery|\/freeze|\/submit|\/retry)?)?$/.test(p)) {
-    return handleTerminalImageDraft(req, res, url);
+    const route = _terminalDraftRoute(url); // WP-3: a MIRROR id is answered by the box; a local id takes the same-tick path
+    if (!route || !remoteSessionForward.isMirrorSessionRequest(req, url, route.sessionId)) return handleTerminalImageDraft(req, res, url);
+    return remoteSessionForward.maybeForwardSessionRequest(req, res, url, route.sessionId)
+      .then((forwarded) => (forwarded ? undefined : handleTerminalImageDraft(req, res, url)));
   }
   if (p === '/api/images/ingest-path' && m === 'POST') return handleIngestImagePath(req, res);
   if (p === '/api/mobile/attachments/upload' && m === 'POST') return handleUploadMobileAttachment(req, res, url);
@@ -1466,26 +1472,6 @@ function _terminalDraftRoute(url) {
   } catch { return null; }
 }
 
-function _terminalDraftStatus(error) {
-  if (!error) return 500;
-  if (error.code === 'CTM_MAIN_DB_REQUEST_FORBIDDEN') return 501;
-  if (error.code === 'CTM_OWNERSHIP_UNAVAILABLE' || error.code === 'CTM_DB_OWNER_UNAVAILABLE' ||
-      error.code === 'CTM_MEDIA_JOURNAL_UNAVAILABLE') return 503;
-  if (error.code === 'CTM_DRAFT_NOT_FOUND' || error.code === 'CTM_DRAFT_SESSION_NOT_FOUND') return 404;
-  if (error.code === 'CTM_SESSION_OWNER_MISMATCH') return 409;
-  if (error.code === 'CTM_DRAFT_REVISION_CONFLICT') return 412;
-  // CTM_IMAGE_IDEMPOTENCY_CONFLICT is the legacy/mobile lanes' equivalent of the draft
-  // lane's idempotency conflict (media-store requestId dedupe) — same 409 semantic
-  // (WP-9 lane-parity: distinguishable from a malformed 400 without inspecting `code`).
-  if (error.code === 'CTM_DRAFT_IDEMPOTENCY_CONFLICT' || error.code === 'CTM_IMAGE_IDEMPOTENCY_CONFLICT' ||
-      error.code === 'CTM_DRAFT_DELIVERY_SUPERSEDED' ||
-      error.code === 'CTM_DRAFT_DELIVERY_STATE') return 409;
-  if (error.code === 'CTM_DRAFT_FROZEN' || error.code === 'CTM_DRAFT_REQUEST_CANCELLED') return 409;
-  if (error.code === 'CTM_DRAFT_IMAGE_INVALID' || error.code === 'CTM_DRAFT_SESSION_REQUIRED' ||
-      error.code === 'CTM_DRAFT_IDENTITY_INVALID' || error.code === 'CTM_DRAFT_DELIVERY_OUTCOME_INVALID') return 400;
-  return 500;
-}
-
 function _imageFailureStatus(error, fallbackStatus = 500) {
   const terminalStatus = _terminalDraftStatus(error);
   if (terminalStatus !== 500 || fallbackStatus === 500) return terminalStatus;
@@ -6891,7 +6877,9 @@ function mergeQueueDraftItemsByStatusTimestamp(existingItems, incomingItems) {
 function handleGetQueueDraft(req, res, sessionId) {
   const key = 'queue_draft_' + sessionId;
   const draft = _getPublishedSetting(key, { items: [], mode: 'manual' });
-  jsonResponse(res, 200, draft);
+  // R-1 (§5): read-only projection. The engine is the authority for an item's
+  // durable status; the stored snapshot is never rewritten on this route.
+  jsonResponse(res, 200, overlayQueueDraftStatuses(draft, queueEngine.getItemStatusMap(sessionId)));
 }
 
 async function handleSaveQueueDraft(req, res, sessionId) {

package/template/coding-task-manager/bin/claude-hook.js

@@ -15,16 +15,20 @@ const http = require('http');
 const crypto = require('crypto');
 const modelGeneration = require('../lib/env-flags').strFlag('CTM_MODEL_PROCESS_GENERATION', '');
 
-// Only these routes can carry a notice back to the model (Claude hook stdout JSON).
-const NOTICE_ROUTES = new Set(['PostToolUse', 'start']);
+// Only these routes can carry a notice back to the model (Claude hook stdout JSON). `stop` is
+// here for RC-1 (docs/session-stops-mid-job-2026-10-24.html D-1): the Stop hook is answered
+// synchronously so a lead that still owns a live worker is told to keep waiting.
+const NOTICE_ROUTES = new Set(['PostToolUse', 'start', 'stop']);
 
 // The hook stdout for a CTM response body: one JSON object when it carries notices, else ''.
+// Against an OLD server that answers {"matched":true} there is no `notices` array, so nothing is
+// printed (D-8, safe in either rollout order).
 function formatHookOutput(responseText, hookEventName) {
   let parsed;
   try { parsed = JSON.parse(responseText); } catch { return ''; }
   const notices = parsed && Array.isArray(parsed.notices) ? parsed.notices : [];
   const texts = notices.map((n) => (n && typeof n.text === 'string' ? n.text : '')).filter(Boolean);
-  if (!texts.length || (hookEventName !== 'PostToolUse' && hookEventName !== 'UserPromptSubmit')) return '';
+  if (!texts.length || !['PostToolUse', 'UserPromptSubmit', 'Stop'].includes(hookEventName)) return '';
   return JSON.stringify({ hookSpecificOutput: { hookEventName, additionalContext: texts.join('\n') } });
 }