create-walle 0.10.1 → 0.10.3

package/README.md

@@ -26,7 +26,7 @@ Screenshots show the real application with fictional `acme-ledger` data and scri
 
 ### Choose the agent for the task
 
-Every session has its own agent choice. Run Claude Code, Codex, Gemini CLI, OpenCode, Cursor Agent, Wall-E or a shell side by side and move between them from the same workspace.
+Every session has its own agent choice. Run Claude Code, Codex, Gemini CLI, OpenCode, Cursor Agent, DeepSeek Harness, Wall-E or a shell side by side and move between them from the same workspace.
 
 The CLI, the model and the connection serving that model are separate decisions: the AI Providers area brings native agent options, direct provider connections and configured routers into one place, using your own accounts and credentials. Agents differ in what they support, so the available model-switching controls depend on the CLI you pick.
 
@@ -73,6 +73,12 @@ CTM can park an eligible inactive session to stop its process and free resources
 
 A shared MCP gateway lets eligible tool servers reuse one process across sessions; tools needing session-specific state keep separate instances.
 
+### Use more than one machine
+
+Pair another machine running CTM and its sessions join the same list, tagged by machine. Pick the machine when you start a session, open and type into it from the hub's browser, and sign that machine's coding agents in from the Machines page, on desktop or phone.
+
+Recent Sessions and search cover every paired machine, and a session link from any of them opens wherever that session lives. Paired machines share Wall-E memory, receive the hub's skills, and can be kept up to date from the hub. A session on another machine can ask to use the hub's files, commands or browser, and it waits for your approval first.
+
 ### Review changes in one place
 
 The Review page moves between rendered HTML or Markdown, source files and diffs, and new files appear before Git tracks them. Comments collect into one message for the session responsible for the change, keeping feedback beside the files that produced it.

package/lib/owner-write-safety.js

@@ -0,0 +1,135 @@
+'use strict';
+
+// Shared "no other account can write through this path" predicate for paths CTM and
+// Wall-E did not create themselves (a Codex sessions root, an enrolled provider root,
+// a data directory handed in by an installer, ~/.walle/data).
+//
+// The rule is Debian OpenSSH's `user-group-modes.patch` rule, adapted: world write is
+// never acceptable, and group write is acceptable ONLY when the owning group is the
+// current user's own one-member private group (the user-private-group scheme that
+// `pam_umask(8)` sets up as umask 002 on every Debian/Ubuntu/Fedora login). On a shared
+// group (`staff` on macOS, `users` on many hosts) the check is exactly as strict as
+// before.
+//
+// Accepted gap (same as the Debian patch): a group password held in `/etc/gshadow`
+// (usable through `newgrp`) and accounts that exist only in NSS (LDAP/SSSD) are invisible
+// to the `/etc/group` + `/etc/passwd` parse this module performs, so a gid that cannot be
+// proven from the local files is refused — the check always fails closed.
+
+const fs = require('node:fs');
+const os = require('node:os');
+
+const MAX_DB_BYTES = 1024 * 1024;
+const GROUP_PATH = '/etc/group';
+const PASSWD_PATH = '/etc/passwd';
+
+/** Default reader: one bounded read (≤ MAX_DB_BYTES), the fd always closed. */
+function _readBoundedFile(filePath) {
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const stat = fs.fstatSync(fd);
+    if (Number(stat.size) > MAX_DB_BYTES) {
+      throw new Error(`${filePath} is larger than ${MAX_DB_BYTES} bytes`);
+    }
+    return fs.readFileSync(fd, 'utf8');
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+// A seam explicitly passed as `null` means "this platform has no such call" (the Windows
+// shape); `undefined` means "use the process default".
+function _seam(deps, name, fallback) {
+  if (deps[name] === null) return null;
+  if (typeof deps[name] === 'function') return deps[name];
+  return typeof fallback === 'function' ? fallback : null;
+}
+
+// Split a local-database file into usable lines: blanks and `#` comments are skipped, and a
+// `+`/`-` NIS compat line makes the whole file unprovable (return null).
+function _usableLines(text) {
+  const lines = [];
+  for (const raw of String(text).split('\n')) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#')) continue;
+    if (line.startsWith('+') || line.startsWith('-')) return null;
+    lines.push(line);
+  }
+  return lines;
+}
+
+function _numericField(value) {
+  return /^\d+$/.test(value || '') ? Number(value) : null;
+}
+
+/** D-2: `gid` is the current user's one-member private group. Any doubt ⇒ false. */
+function isUserPrivateGroup(gid, deps = {}) {
+  try {
+    const getuid = _seam(deps, 'getuid', process.getuid);
+    const getgid = _seam(deps, 'getgid', process.getgid);
+    if (typeof getuid !== 'function' || typeof getgid !== 'function') return false;
+    const targetGid = _numericField(String(gid));
+    if (targetGid === null) return false;
+    if (Number(getgid()) !== targetGid) return false;
+    const uid = Number(getuid());
+    const usernameFn = _seam(deps, 'username', () => os.userInfo().username);
+    if (typeof usernameFn !== 'function') return false;
+    const username = String(usernameFn() || '');
+    if (!username) return false;
+    const readFile = _seam(deps, 'readFile', _readBoundedFile);
+    if (typeof readFile !== 'function') return false;
+
+    // (b) /etc/group: exactly one line with this gid, named after the login, members ⊆ {login}.
+    const groupLines = _usableLines(readFile(GROUP_PATH));
+    if (!groupLines) return false;
+    const groupEntries = [];
+    for (const line of groupLines) {
+      const fields = line.split(':');
+      const lineGid = fields.length >= 3 ? _numericField(fields[2]) : null;
+      if (lineGid === null || lineGid !== targetGid) continue;
+      if (fields.length !== 4) return false;
+      groupEntries.push({ name: fields[0], members: fields[3].split(',').map(m => m.trim()).filter(Boolean) });
+    }
+    if (groupEntries.length !== 1) return false;
+    const group = groupEntries[0];
+    if (group.name !== username) return false;
+    if (group.members.length > 1) return false;
+    if (group.members.length === 1 && group.members[0] !== username) return false;
+
+    // (c) /etc/passwd: every account whose primary gid is this gid is this uid, and one exists.
+    const passwdLines = _usableLines(readFile(PASSWD_PATH));
+    if (!passwdLines) return false;
+    let primaryAccounts = 0;
+    for (const line of passwdLines) {
+      const fields = line.split(':');
+      const lineGid = fields.length >= 4 ? _numericField(fields[3]) : null;
+      if (lineGid === null || lineGid !== targetGid) continue;
+      if (fields.length !== 7) return false;
+      primaryAccounts += 1;
+      const lineUid = _numericField(fields[2]);
+      if (lineUid === null || lineUid !== uid) return false;
+    }
+    if (primaryAccounts === 0) return false;
+    return true;
+  } catch {
+    /* expected: any unreadable or unparsable account database fails closed (D-3) */
+    return false;
+  }
+}
+
+/**
+ * True iff no account other than the current user can write through `stat`'s permission bits.
+ * Accepts fs.Stats (Number) and fs.BigIntStats (bigint) alike.
+ * @param {{ mode: number|bigint, gid: number|bigint }} stat
+ * @param {{ readFile?: (p: string) => string, getuid?: () => number, getgid?: () => number,
+ *           username?: () => string }} [deps]  test seams
+ * @returns {boolean}
+ */
+function isWritableOnlyByOwner(stat, deps = {}) {
+  const mode = Number(stat.mode);
+  if ((mode & 0o002) !== 0) return false; // world write is never acceptable
+  if ((mode & 0o020) === 0) return true; // no group write: no file is read
+  return isUserPrivateGroup(Number(stat.gid), deps);
+}
+
+module.exports = { isWritableOnlyByOwner, isUserPrivateGroup, MAX_DB_BYTES, _readBoundedFile };

package/lib/public-runtime.js

@@ -36,6 +36,11 @@ const os = require('node:os');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 
+// The ONE "no other account can write through this path" predicate, shared with CTM and Wall-E. It
+// is a relative SIBLING require on purpose: the mirror is byte-identical, so the same bytes resolve it
+// from `shared/` and from `create-walle/lib/`.
+const { isWritableOnlyByOwner } = require('./owner-write-safety');
+
 const {
   parseReleaseRuntimePolicy,
   releaseRuntimeArchive,
@@ -187,10 +192,13 @@ function publicRuntimeNpmEnv(nodeBin) {
 
 // ── the one cache-directory admission ───────────────────────────────────────────────────────────
 /**
- * Assert that `dir` is a REAL directory (never a link), owned by the current user, and not
- * group/other writable. Ancestors ABOVE the owned cache boundary are deliberately not inspected: a
- * system path or a sticky ancestor is not this installer's ownership requirement, and pretending
- * otherwise would refuse every legitimate `~/.walle` under a shared parent.
+ * Assert that `dir` is a REAL directory (never a link), owned by the current user, and writable only
+ * by its owner (a user-private group counts as the owner: world write is never acceptable, and group
+ * write is acceptable only when the owning group is the user's own one-member private group, the
+ * umask-002 scheme of a Debian/Ubuntu/Fedora login). Ancestors ABOVE the owned cache boundary are
+ * deliberately not inspected: a system path or a sticky ancestor is not this installer's ownership
+ * requirement, and pretending otherwise would refuse every legitimate `~/.walle` under a shared
+ * parent.
  */
 function assertOwnedCacheDirectory(fsOps, dir, phase) {
   let stat;
@@ -202,7 +210,7 @@ function assertOwnedCacheDirectory(fsOps, dir, phase) {
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     throw refuse(phase, 'public runtime cache directory is not a real directory');
   }
-  if ((Number(stat.mode) & 0o022) !== 0) {
+  if (!isWritableOnlyByOwner(stat)) {
     throw refuse(phase, 'public runtime cache directory is group or other writable');
   }
   if (typeof process.getuid === 'function' && Number(stat.uid) !== process.getuid()) {

package/lib/release-schema.json

@@ -9,7 +9,7 @@
         21, 22, 23, 24, 25, 26, 27, 28, 29, 30,
         31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
         41, 42, 43, 44, 45, 46, 47, 48, 49, 50,
-        51, 52, 53, 54, 55
+        51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61
       ]
     },
     "walle": {
@@ -24,7 +24,8 @@
         61, 62, 63, 64, 65, 66, 67, 68, 69, 70,
         71, 72, 73, 74, 75, 76, 77, 78, 79, 80,
         81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96,
-        97, 98, 99
+        97, 98, 99, 100,
+        101, 102, 103, 104, 105
       ]
     }
   }

package/lib/runtime-closure-policy.json

@@ -9,6 +9,7 @@
     "coding-task-manager/bin/client-server-boundary-lint.js",
     "coding-task-manager/bin/conv-order-write-lint.js",
     "coding-task-manager/bin/conversation-provenance-lint.js",
+    "coding-task-manager/bin/credential-dir-fixture-lint.js",
     "coding-task-manager/bin/dashboard-client-source.js",
     "coding-task-manager/bin/deadline-lint.js",
     "coding-task-manager/bin/delivery-contract-lint.js",
@@ -39,7 +40,9 @@
     "coding-task-manager/bin/seam-replay.js",
     "coding-task-manager/bin/session-access-lint.js",
     "coding-task-manager/bin/session-create-fanout-lint.js",
+    "coding-task-manager/bin/session-host-kill-lint.js",
     "coding-task-manager/bin/session-runtime-evidence-lint.js",
+    "coding-task-manager/bin/startup-pointer-writer-lint.js",
     "coding-task-manager/bin/status-verdict-lint.js",
     "coding-task-manager/bin/term-container-band-lint.js",
     "coding-task-manager/bin/terminal-write-lint.js",
@@ -1783,14 +1786,14 @@
     "coding-task-manager/lib/runtime-interaction-action-resolver.js": "178eebe1294c3b761da0085e0dcccef36c027bd8c08e4c7779efda2f3984aa04",
     "coding-task-manager/lib/sqlite-driver.js": "78a1cd2a604748cf895dc44547b4cf1e4a3bdec6f02d77965f4b7b21a2b8a31b",
     "coding-task-manager/lib/walle-deps-repair.js": "be85620d08795ea0fe9539820416d5cc50b654519abddab0811907fa3fe93a7f",
-    "coding-task-manager/lib/walle-mcp-auto-config.js": "b978e9b15d9dac8179dde0feb5357c14957f7b4e36dab7e6779587bcde8faeff",
+    "coding-task-manager/lib/walle-mcp-auto-config.js": "369c4d1c7d91d822510e74cfe2b6b2a85a2543e32e52e34590b4b329f6d9f64b",
     "coding-task-manager/lib/walle-native-health.js": "9fdf7f17eb77837aac4ea16140a6f4e5a97d7a568945da30f29b9a7541c3d967",
-    "coding-task-manager/lib/walle-supervisor.js": "04b924f16c9bd001ed505347202dbec2876b57fc427a32c93d23586530181f83",
+    "coding-task-manager/lib/walle-supervisor.js": "f7597199724270f8fe0fabf0840606d52a568bb7e97421cf8079fd0d5cb4eded",
     "coding-task-manager/public/js/client-health-worker.js": "07e300113ee749ac7a6adaaa1461502d1562087af395b6c89cf1b885f1f5e00e",
     "coding-task-manager/public/js/image-normalize-worker.js": "37cb0758bddcf10c66060fae52088c1a842409f30e919988e789cfea7d05e2be",
-    "coding-task-manager/public/m/app.js": "483f777f57efd28d7796713c33df48ffba47e5bfb50597b446a37b961f53d585",
-    "coding-task-manager/server.js": "927a036ed5143c02b2c021e5b5c0a80def7f87d01524514108f90f438e48b776",
-    "scripts/conversation-storage-v2-migration.js": "80c66e41c9fb9b1d756fe21be17f3b07c6a65389712887043a86341fbf6a6879",
+    "coding-task-manager/public/m/app.js": "982f3a1b5910b4fb2843cf3028afaeabde8f1cd5ad37fb6cb52511fdbf7cfcb3",
+    "coding-task-manager/server.js": "a329e948c2f8f2aefa8753a69169c826ccb5e884d6132c1f785080a1386c2d56",
+    "scripts/conversation-storage-v2-migration.js": "f2620ba24893c4d2ec6c594428ddb41dc098da38b4066f1df25fb87abbfaebfa",
     "shared/storage/schema-port.js": "e41cec8c075a6167fba2efd0177d9e20a11c0cd49ae176aaf36d5b9257409e67",
     "shared/storage/schema-sync.js": "7ca080e44e35e8178a0f74317023881f920ae75bde4f7431702ce1f9fa4a1d03",
     "wall-e/adapters/chatgpt.js": "8c0fa31ae65ed5c10776e50a1a26c131bc62cb1aa3d88eb4617e7b83b43789d9",
@@ -1801,7 +1804,7 @@
     "wall-e/adapters/claude-web.plugin.json": "29945817a251b14c0789ae527f7ecd345cb0097c654f851fe062b208c30a0a6b",
     "wall-e/adapters/codex-memory.js": "18d6d0af08d9d48d5c92621a16b2b9a597d30b3993c534f88a4bc8b3d60c0d71",
     "wall-e/adapters/codex-memory.plugin.json": "4cbc6a0f2023264a59ec703ec7553ed9997b1e55626831342bf3ee60f3828663",
-    "wall-e/adapters/imessage.js": "fea412e60c8f69fa034d0b95f1bce703ef6f20a0f4492504c104dd94778ecd7d",
+    "wall-e/adapters/imessage.js": "b689b538abb809df08c3f6f2a08673d6c38a6cb50d2f1d49aa693de28e0b11bd",
     "wall-e/adapters/imessage.plugin.json": "28dc369a489ea44bd2063d6f9eae998099134b9de5db76118808f5def8534bb1",
     "wall-e/adapters/plaintext.js": "3a834c50ef76b746987819c8fd453f0161ffb70a1c588e5c4161b1f102190599",
     "wall-e/adapters/plaintext.plugin.json": "de4b6c6d151fdabf897be9856f6357cbb83cdff14a62186096de55e495cd4352",
@@ -1844,7 +1847,7 @@
     "wall-e/llm/typesafe.plugin.json": "93109b5f27dcf0fb25cb18d461eda3bc6b294ebdd1614740da0bc2cee715948e",
     "wall-e/llm/zai.js": "f94c77663cd450b2e54dc7450f0c24666b1fd5ced795e685c6d94d6f09d3931d",
     "wall-e/llm/zai.plugin.json": "d9c6408fca68fed17a3a94f27d9119b947eadeb01f4a40a00e27e59faa942e00",
-    "wall-e/memory/ctm-session-context.js": "77beef286d87439141160ecfc95f279d7f5fd2f5c909d8133e3ff76f26ab1a2c",
+    "wall-e/memory/ctm-session-context.js": "635225f1070ea7bc95a057090122720450000aac52257f0b46a5ba089b5a3ed6",
     "wall-e/plugins/discovery.js": "44dfc422e9cf570d1d300c4ebfe4be63ab8f2709d38da1d35f30f6a7e65b20bb",
     "wall-e/plugins/manifest-loader.js": "501d3098c2356c35a0650def273e7c65cb076d986fe4bb0d4eba3189a08c5c52",
     "wall-e/plugins/manifest-schema.js": "59b5dd76f0f85cc136a6511e2f4945a9d1fc16133495c9b5c64df097b47a6571",
@@ -1866,7 +1869,7 @@
     "wall-e/skills/_bundled/model-trainer/index.js": "1c0e5f039dc7b06624c14631ea8427af956b243354da2ebd9930f6d382eee5bc",
     "wall-e/skills/_bundled/morning-briefing/run.js": "e09ca88ed0a65570b11c8007d27a4cd42990a35df3343443fc560df90564f50d",
     "wall-e/skills/skill-loader.js": "8572c97cb88bcc9fc78a89ed10bf5134b57cbc838dd06dd5cf46509bfcfd54be",
-    "wall-e/workers/mcp-gateway-process.js": "f49701ef19cc892ed5b23a498c88b86f98acdc78f0821cabdeec6090a1b15ae1"
+    "wall-e/workers/mcp-gateway-process.js": "3a5a22e2c620911510d452c7ce4714a6908682a1c0fa303f0e24f2eb31e20380"
   },
   "discoveryInventories": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-walle",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "CTM + Wall-E: one workspace for coding agents, worktrees and review, with shared session context and a personal agent.",
   "homepage": "https://walle.sh",
   "bin": {

package/template/bin/deps-doctor.js

@@ -248,7 +248,7 @@ function checkDeps(pkgDir, opts = {}) {
 }
 
 // The package dirs a gate depends on, relative to a checkout root.
-const TREE_SUBS = ['', 'coding-task-manager', 'wall-e', 'shared', 'create-walle'];
+const TREE_SUBS = ['', 'coding-task-manager', 'wall-e', 'shared', 'create-walle', 'ctm-relay'];
 
 // `npm --prefix <owner> install --no-save`: <owner> is the checkout that really
 // holds node_modules (a gate tree borrows it through a symlink). Never

package/template/bin/node-bin.sh

@@ -56,6 +56,17 @@ bootstrap_candidates() {
   for cache_node in "$HOME"/.walle/runtimes/*/*/runtime/bin/node; do
     if [ -e "$cache_node" ]; then printf '%s\n' "$cache_node"; fi
   done
+  # Linux boxes (e.g. DGX Spark) install Node via nvm/fnm, so with a non-interactive ssh session
+  # that never sources the manager there is no `node` on PATH and none of the macOS Wall-E paths
+  # above exist. Any version found here only RUNS the fixed helper; the pin is still enforced by the
+  # candidate ladder below, so a version-globbed bootstrap can never select a mismatched ABI.
+  local manager_node
+  for manager_node in \
+    "$HOME"/.nvm/versions/node/*/bin/node \
+    "$HOME"/.local/share/fnm/node-versions/*/installation/bin/node \
+    "$HOME"/.fnm/node-versions/*/installation/bin/node; do
+    if [ -e "$manager_node" ]; then printf '%s\n' "$manager_node"; fi
+  done
   return 0
 }
 

package/template/coding-task-manager/api-prompts.js

@@ -5,8 +5,11 @@ const os = require('os');
 const { isMainThread } = require('node:worker_threads');
 const { classifySqliteError } = require('./lib/sqlite-driver');
 const { reportRouteError, routeError, tagRouteValidationError } = require('./lib/route-error');
+const { terminalDraftHttpStatus: _terminalDraftStatus } = require('./lib/terminal-draft-http-status');
 // WP-2 (§9): the delivery-completion request projection lives with the image-protocol owners.
 const { buildDraftDeliveryCompletionRequest } = require('./lib/terminal-draft-publication-api');
+const remoteSessionForward = require('./lib/remote-session-forward'); // WP-3 (§6/D-1..D-3): an image-draft request for a MIRROR id is answered by the owning box
+const { overlayQueueDraftStatuses } = require('./lib/queue-draft-status-overlay'); // R-1 (§5): the queue-draft GET overlays durable engine status, never writes
 const db = require('./db-owner-client');
 const queueEngine = require('./queue-engine');
 const harvest = require('./prompt-harvest');
@@ -21,6 +24,9 @@ const { resolveWallePermissionV2 } = require('./lib/walle-permission-reply');
 const claudeDesktopSessions = require('./lib/claude-desktop-sessions');
 const desktopFork = require('./lib/desktop-fork');
 const skillAutocomplete = require('./lib/skill-autocomplete');
+// WP-9 (§9 S-9, AC-9d): the machine filter is applied HERE, on the main thread — the read pool runs
+// the query in another process and holds none of the registry's in-memory machine state.
+const skillAutocompleteQuery = require('./lib/skill-autocomplete-query');
 const storageMigration = require('./lib/storage-migration');
 const perfTracker = require('./lib/perf-tracker');
 const { runSync } = perfTracker;
@@ -92,7 +98,16 @@ function _shouldLogWalleMigrationStep(sessionId, result = {}, nowMs = Date.now()
     Number(result.sourceSize || 0),
   ]);
   const prior = walleMigrationLogState.get(id);
-  if (prior?.signature === signature
+  // D-10 (docs/temp-file-leaks-disk-full-2026-10-25.html §5): a step that made no progress and whose
+  // disposition is already `complete` is a settled fact about the session, not a clock-driven event.
+  // Re-logging it every 5 minutes per session was 64% of ctm.log (605k lines in 26.8 d). Log it once
+  // per session per process: only when this session has no prior state, or the signature changed.
+  // Every other step keeps the 5-minute deferred repeat below.
+  if (!_walleMigrationMadeProgress(result)
+      && String(result.action || '') === 'noop'
+      && resolveMigrationDisposition(result) === MIGRATION_DISPOSITIONS.complete) {
+    if (prior?.signature === signature) return false;
+  } else if (prior?.signature === signature
       && nowMs - prior.loggedAtMs < WALLE_MIGRATION_DEFERRED_LOG_INTERVAL_MS) return false;
   if (!prior && walleMigrationLogState.size >= WALLE_MIGRATION_LOG_STATE_LIMIT) {
     walleMigrationLogState.delete(walleMigrationLogState.keys().next().value);
@@ -820,11 +835,22 @@ function handlePromptApi(req, res, url, deps = {}) {
   // --- Images ---
   if (p === '/api/images/upload' && m === 'POST') return handleUploadImage(req, res, url);
   if (/^\/api\/sessions\/[^/]+\/image-drafts(?:\/[^/]+(?:\/content|\/delivery|\/freeze|\/submit|\/retry)?)?$/.test(p)) {
-    return handleTerminalImageDraft(req, res, url);
+    const route = _terminalDraftRoute(url); // WP-3: a MIRROR id is answered by the box; a local id takes the same-tick path
+    if (!route || !remoteSessionForward.isMirrorSessionRequest(req, url, route.sessionId)) return handleTerminalImageDraft(req, res, url);
+    return remoteSessionForward.maybeForwardSessionRequest(req, res, url, route.sessionId)
+      .then((forwarded) => (forwarded ? undefined : handleTerminalImageDraft(req, res, url)));
   }
   if (p === '/api/images/ingest-path' && m === 'POST') return handleIngestImagePath(req, res);
   if (p === '/api/mobile/attachments/upload' && m === 'POST') return handleUploadMobileAttachment(req, res, url);
-  if (p === '/api/session/image-refs' && m === 'POST') return handleSessionImageRefs(req, res);
+  // R-1 (docs/composer-image-chip-stuck-submission-recovery-2026-10-30.html): session-scoped so a MIRROR id is answered by the box.
+  const imageRefsMatch = /^\/api\/sessions\/([^/]+)\/image-refs$/.exec(p);
+  if (imageRefsMatch && m === 'POST') {
+    let sessionId = '';
+    try { sessionId = decodeURIComponent(imageRefsMatch[1]); } catch { return jsonResponse(res, 400, { error: 'Invalid session id' }); }
+    if (!remoteSessionForward.isMirrorSessionRequest(req, url, sessionId)) return handleSessionImageRefs(req, res, sessionId);
+    return remoteSessionForward.maybeForwardSessionRequest(req, res, url, sessionId)
+      .then((forwarded) => (forwarded ? undefined : handleSessionImageRefs(req, res, sessionId)));
+  }
   if (p.match(/^\/api\/images\/\d+$/) && m === 'GET') return handleGetImage(req, res, url);
   if (p.match(/^\/api\/images\/\d+\/annotations$/) && m === 'PUT') return handleUpdateAnnotations(req, res, url);
   if (p.match(/^\/api\/images\/\d+$/) && m === 'DELETE') return handleDeleteImage(req, res, url);
@@ -844,9 +870,9 @@ function handlePromptApi(req, res, url, deps = {}) {
   if (p === '/api/permissions/log' && m === 'GET') return handleListPermLog(req, res, url);
 
   // --- Session Conversations ---
-  if (p === '/api/conversations' && m === 'GET') return handleListConversations(req, res, url);
+  if (p === '/api/conversations' && m === 'GET') return (handleListConversations.fleet ||= require('./lib/fleet-session-lists').fleetRouted('GET /api/conversations', handleListConversations, require('./lib/fleet-conversation-route').conversationsFleetSpec))(req, res, url); // fleet WP-4, wrapped once
   if (p === '/api/conversations/import' && m === 'POST') return handleImportConversations(req, res);
-  if (p.match(/^\/api\/conversations\/[a-f0-9-]+$/) && m === 'GET') return handleGetConversation(req, res, url);
+  if (p.match(/^\/api\/conversations\/[a-f0-9-]+$/) && m === 'GET') return (handleGetConversation.byMachine ||= require('./lib/remote-machine-proxy').machineRouted('GET /api/conversations/:id', handleGetConversation))(req, res, url); // fleet WP-4: ?machine= -> owner box
 
   // --- Templates ---
   if (p === '/api/templates' && m === 'GET') return handleListTemplates(req, res);
@@ -1466,26 +1492,6 @@ function _terminalDraftRoute(url) {
   } catch { return null; }
 }
 
-function _terminalDraftStatus(error) {
-  if (!error) return 500;
-  if (error.code === 'CTM_MAIN_DB_REQUEST_FORBIDDEN') return 501;
-  if (error.code === 'CTM_OWNERSHIP_UNAVAILABLE' || error.code === 'CTM_DB_OWNER_UNAVAILABLE' ||
-      error.code === 'CTM_MEDIA_JOURNAL_UNAVAILABLE') return 503;
-  if (error.code === 'CTM_DRAFT_NOT_FOUND' || error.code === 'CTM_DRAFT_SESSION_NOT_FOUND') return 404;
-  if (error.code === 'CTM_SESSION_OWNER_MISMATCH') return 409;
-  if (error.code === 'CTM_DRAFT_REVISION_CONFLICT') return 412;
-  // CTM_IMAGE_IDEMPOTENCY_CONFLICT is the legacy/mobile lanes' equivalent of the draft
-  // lane's idempotency conflict (media-store requestId dedupe) — same 409 semantic
-  // (WP-9 lane-parity: distinguishable from a malformed 400 without inspecting `code`).
-  if (error.code === 'CTM_DRAFT_IDEMPOTENCY_CONFLICT' || error.code === 'CTM_IMAGE_IDEMPOTENCY_CONFLICT' ||
-      error.code === 'CTM_DRAFT_DELIVERY_SUPERSEDED' ||
-      error.code === 'CTM_DRAFT_DELIVERY_STATE') return 409;
-  if (error.code === 'CTM_DRAFT_FROZEN' || error.code === 'CTM_DRAFT_REQUEST_CANCELLED') return 409;
-  if (error.code === 'CTM_DRAFT_IMAGE_INVALID' || error.code === 'CTM_DRAFT_SESSION_REQUIRED' ||
-      error.code === 'CTM_DRAFT_IDENTITY_INVALID' || error.code === 'CTM_DRAFT_DELIVERY_OUTCOME_INVALID') return 400;
-  return 500;
-}
-
 function _imageFailureStatus(error, fallbackStatus = 500) {
   const terminalStatus = _terminalDraftStatus(error);
   if (terminalStatus !== 500 || fallbackStatus === 500) return terminalStatus;
@@ -1836,7 +1842,7 @@ async function handleUploadMobileAttachment(req, res, url) {
   }
 }
 
-async function handleSessionImageRefs(req, res) {
+async function handleSessionImageRefs(req, res, pathSessionId) {
   try {
     const body = await readBody(req, 256 * 1024);
     // The media-write-behind draft store keeps terminal image drafts in its own
@@ -1847,7 +1853,13 @@ async function handleSessionImageRefs(req, res) {
     // survive) and hand over a plain, pre-resolved Map so the resolver can bridge to it.
     // Best-effort: falls through to the legacy SQL path unchanged when the draft service
     // is unavailable (e.g. write-behind off) or a given attachment isn't a terminal draft.
-    const sessionId = String((body && (body.sessionId || body.session_id)) || '').trim();
+    // R-1: the PATH is the routing key; a body naming a different session is refused.
+    const bodySessionId = String((body && (body.sessionId || body.session_id)) || '').trim();
+    const routeSessionId = String(pathSessionId || '').trim();
+    if (routeSessionId && bodySessionId && bodySessionId !== routeSessionId) {
+      throw tagRouteValidationError(new Error('Session id in body does not match the route'), { status: 400, code: 'CTM_SESSION_IMAGE_REF_SESSION_MISMATCH' });
+    }
+    const sessionId = bodySessionId || routeSessionId;
     const images = Array.isArray(body && body.images) ? body.images
       : Array.isArray(body && body.attachments) ? body.attachments : [];
     const mediaDrafts = new Map();
@@ -6891,7 +6903,9 @@ function mergeQueueDraftItemsByStatusTimestamp(existingItems, incomingItems) {
 function handleGetQueueDraft(req, res, sessionId) {
   const key = 'queue_draft_' + sessionId;
   const draft = _getPublishedSetting(key, { items: [], mode: 'manual' });
-  jsonResponse(res, 200, draft);
+  // R-1 (§5): read-only projection. The engine is the authority for an item's
+  // durable status; the stored snapshot is never rewritten on this route.
+  jsonResponse(res, 200, overlayQueueDraftStatuses(draft, queueEngine.getItemStatusMap(sessionId)));
 }
 
 async function handleSaveQueueDraft(req, res, sessionId) {
@@ -8064,7 +8078,19 @@ async function handleSkillAutocomplete(req, res, url) {
     const { rows } = await _readRequestControl('skillAutocomplete', {
       cwd, agent, includeSessionSeen, query,
     });
-    jsonResponse(res, 200, rows);
+    // WP-9 (§9 S-9, AC-9d): a session that runs on a REMOTE machine has its own skill list — the hub
+    // drops what that box held back and adds what only that box has. A local/absent session reads a
+    // null view and the rows cross untouched.
+    // The box-only names it adds go back through the SAME query match and ranking a local request
+    // gets, and the same 20-row cap, so a box name never appears for a query it does not match.
+    const sessionId = url.searchParams.get('sessionId') || url.searchParams.get('session') || '';
+    const view = skillAutocompleteQuery.machineSkillViewFor(sessionId);
+    const list = Array.isArray(rows) ? rows : [];
+    jsonResponse(res, 200, view
+      ? skillAutocomplete.filterAndSortSkillAutocompleteItems(
+        skillAutocompleteQuery.applyMachineSkillView(list, view), query, agent || 'all',
+      ).slice(0, 20)
+      : list);
   } catch (e) { promptRouteError(res, e); }
 }
 

package/template/coding-task-manager/bin/claude-hook.js

@@ -13,21 +13,63 @@
 
 const http = require('http');
 const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
 const modelGeneration = require('../lib/env-flags').strFlag('CTM_MODEL_PROCESS_GENERATION', '');
 
-// Only these routes can carry a notice back to the model (Claude hook stdout JSON).
-const NOTICE_ROUTES = new Set(['PostToolUse', 'start']);
+// Only these routes can carry a notice back to the model (Claude hook stdout JSON). `stop` is
+// here for RC-1 (docs/session-stops-mid-job-2026-10-24.html D-1): the Stop hook is answered
+// synchronously so a lead that still owns a live worker is told to keep waiting.
+const NOTICE_ROUTES = new Set(['PostToolUse', 'start', 'stop']);
 
 // The hook stdout for a CTM response body: one JSON object when it carries notices, else ''.
+// Against an OLD server that answers {"matched":true} there is no `notices` array, so nothing is
+// printed (D-8, safe in either rollout order).
 function formatHookOutput(responseText, hookEventName) {
   let parsed;
   try { parsed = JSON.parse(responseText); } catch { return ''; }
   const notices = parsed && Array.isArray(parsed.notices) ? parsed.notices : [];
   const texts = notices.map((n) => (n && typeof n.text === 'string' ? n.text : '')).filter(Boolean);
-  if (!texts.length || (hookEventName !== 'PostToolUse' && hookEventName !== 'UserPromptSubmit')) return '';
+  if (!texts.length || !['PostToolUse', 'UserPromptSubmit', 'Stop'].includes(hookEventName)) return '';
   return JSON.stringify({ hookSpecificOutput: { hookEventName, additionalContext: texts.join('\n') } });
 }
 
+// A command that already declares its own lifetime somewhere on the line: an absolute, relative or
+// quoted path to bounded.js followed by `--deadline-ms N` (whitespace or `=`). This is guidance for
+// honest agents, not a security boundary — a command can always spell its way around a regex.
+const BOUNDED_DEADLINE_RE = /bounded\.js['"]?\s+--deadline-ms(?:\s+|=)\d+/;
+// Session-host/durable-jobs design D-8 (§6.4): bounded.js dies with the agent session, so a declared lifetime past
+// 2 h belongs to bin/durable-job.js instead (its job is owned by the service manager, not by this session).
+const DURABLE_THRESHOLD_MS = 7_200_000;
+const BOUNDED_DEADLINE_VALUE_RE = /bounded\.js['"]?\s+--deadline-ms(?:\s+|=)(\d+)/;
+
+// L1 declare (docs/background-gate-watchers-bounded-observation-2026-10-26.html §5 R1-R2, §6.3, §8
+// WP-2): a Bash command launched with `run_in_background: true` must name its own lifetime, so there is
+// always a clock its launcher chose. The decision is made here in the bridge rather than in CTM: it
+// takes effect on the next hook invocation (no restart), it can name the absolute path of bounded.js
+// for an agent whose cwd is another repo, and it fails open when bounded.js was never installed.
+// Returns the deny reason, or null to allow (and print nothing).
+function backgroundDeadlineDenial(hook, { boundedPath, boundedExists, durablePath, durableExists } = {}) {
+  if (!hook || typeof hook !== 'object' || Array.isArray(hook)) return null;
+  if (hook.hook_event_name !== 'PreToolUse' || hook.tool_name !== 'Bash') return null;
+  const input = hook.tool_input;
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return null;
+  if (input.run_in_background !== true) return null;
+  if (boundedExists !== true) return null;
+  if (BOUNDED_DEADLINE_RE.test(String(input.command || ''))) {
+    const long = BOUNDED_DEADLINE_VALUE_RE.exec(String(input.command || ''));
+    if (long && Number(long[1]) > DURABLE_THRESHOLD_MS && durableExists === true && durablePath) {
+      const durableShown = /\s/.test(String(durablePath)) ? `'${durablePath}'` : String(durablePath);
+      return 'A background job longer than 2 h must not live inside this agent session (a CTM restart or the agent process exiting kills it). '
+        + `Launch it with: node ${durableShown} start --name <slug> --deadline-ms ${long[1]} -- <command>   `
+        + 'then wait with Monitor until the printed receipt= file exists.';
+    }
+    return null;
+  }
+  const shown = /\s/.test(String(boundedPath)) ? `'${boundedPath}'` : String(boundedPath);
+  return `Background Bash commands must declare their own lifetime. Re-run it as: node ${shown} --deadline-ms <N> -- <command>   (N = its honest worst case in ms, at most 86400000 = 24 h; e.g. 5400000 for a commit gate; use -- sh -c '<…>' for a compound command). Foreground commands are not affected.`;
+}
+
 function post(port, route, body, onResponse) {
   const req = http.request({
     hostname: 'localhost',
@@ -52,7 +94,7 @@ function post(port, route, body, onResponse) {
   return req;
 }
 
-module.exports = { post, formatHookOutput };
+module.exports = { post, formatHookOutput, backgroundDeadlineDenial };
 
 if (require.main === module) {
   const port = parseInt(process.argv[2], 10) || parseInt(process.env.CTM_PORT, 10);
@@ -128,6 +170,22 @@ if (require.main === module) {
       prompt_head: hook.prompt == null ? undefined : String(hook.prompt).slice(0, 1024),
       payload: parsed ? forwardedPayload(hook, stdin) : (stdin.trim() || undefined),
     });
+    // The menu route (the `.*` PreToolUse matcher) refuses an explicit background Bash launch with no
+    // declared lifetime. The POST below is unchanged — still sent, its response still ignored.
+    if (route === 'menu') {
+      const boundedPath = path.resolve(__dirname, '..', '..', 'bin', 'bounded.js');
+      let boundedExists = false;
+      try { boundedExists = fs.existsSync(boundedPath); } catch { /* expected: a path we cannot stat means no wrapper to name, so the gate stays open */ }
+      const durablePath = path.resolve(__dirname, '..', '..', 'bin', 'durable-job.js');
+      let durableExists = false;
+      try { durableExists = fs.existsSync(durablePath); } catch { /* expected: an unstat-able durable-job.js means nothing to name, so the long-deadline gate stays open */ }
+      const reason = parsed ? backgroundDeadlineDenial(hook, { boundedPath, boundedExists, durablePath, durableExists }) : null;
+      if (reason) {
+        process.stdout.write(JSON.stringify({
+          hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason },
+        }) + '\n');
+      }
+    }
     if (!NOTICE_ROUTES.has(route)) { post(port, route, body); return; }
     post(port, route, body, (text) => {
       const out = formatHookOutput(text, str(hook.hook_event_name));