crewly 1.20.168 → 1.20.170

package/dist/backend/backend/src/middleware/agent-origin.middleware.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Agent Origin Middleware
+ *
+ * Checks a local skill request's claimed identity (`X-Agent-Session`) against
+ * the agent PTY its process actually runs under (`X-Agent-Pid`, walked up the
+ * process tree). When the process provably belongs to a different agent, the
+ * request is treated as that agent: `X-Agent-Session` is rewritten and the
+ * claim is kept in `X-Agent-Session-Claimed`. Either way it WARNs, because a
+ * wrong CREWLY_SESSION_NAME means the runtime leaked another agent's
+ * environment (Codex's shared app-server daemon did, 2026-09-30).
+ *
+ * It only ever corrects a header that is already there — it never gives an
+ * anonymous request an agent identity — and only on loopback, where the pid
+ * means something. A slow or failed lookup leaves the request as it came.
+ *
+ * @module agent-origin.middleware
+ */
+import type { Request, Response, NextFunction } from 'express';
+import { AgentProcessOriginService, type ProcessOrigin } from '../services/agent/agent-process-origin.service.js';
+/**
+ * Apply a resolved origin to the request: rewrite a contradicted header and
+ * warn about it, or warn that the command ran in a shared daemon.
+ *
+ * @param req - Request (headers are mutated when corrected)
+ * @param claimed - The X-Agent-Session the shell sent
+ * @param origin - Where its process really runs
+ */
+export declare function applyAgentOrigin(req: Request, claimed: string, origin: ProcessOrigin): void;
+/**
+ * Express middleware; see the module doc. Runs after the API-token gate and
+ * before the heartbeat middleware, so the heartbeat and every controller see
+ * the corrected identity.
+ *
+ * @param req - Express request
+ * @param _res - Express response
+ * @param next - Next handler
+ */
+export declare function agentOriginMiddleware(req: Request, _res: Response, next: NextFunction): void;
+/**
+ * Replace the origin service (tests).
+ *
+ * @param service - Service to use, or null to rebuild the default lazily
+ */
+export declare function setAgentOriginServiceForTesting(service: AgentProcessOriginService | null): void;
+//# sourceMappingURL=agent-origin.middleware.d.ts.map

package/dist/backend/backend/src/middleware/agent-origin.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-origin.middleware.d.ts","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAAE,yBAAyB,EAAE,KAAK,aAAa,EAAE,MAAM,mDAAmD,CAAC;AA8DlH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAkB3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAuB5F;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAG/F"}

package/dist/backend/backend/src/middleware/agent-origin.middleware.js

@@ -0,0 +1,148 @@
+/**
+ * Agent Origin Middleware
+ *
+ * Checks a local skill request's claimed identity (`X-Agent-Session`) against
+ * the agent PTY its process actually runs under (`X-Agent-Pid`, walked up the
+ * process tree). When the process provably belongs to a different agent, the
+ * request is treated as that agent: `X-Agent-Session` is rewritten and the
+ * claim is kept in `X-Agent-Session-Claimed`. Either way it WARNs, because a
+ * wrong CREWLY_SESSION_NAME means the runtime leaked another agent's
+ * environment (Codex's shared app-server daemon did, 2026-09-30).
+ *
+ * It only ever corrects a header that is already there — it never gives an
+ * anonymous request an agent identity — and only on loopback, where the pid
+ * means something. A slow or failed lookup leaves the request as it came.
+ *
+ * @module agent-origin.middleware
+ */
+import { AGENT_ORIGIN_CONSTANTS } from '../constants.js';
+import { LoggerService } from '../services/core/logger.service.js';
+import { getSessionBackendSync } from '../services/session/session-backend.factory.js';
+import { AgentProcessOriginService } from '../services/agent/agent-process-origin.service.js';
+import { isLoopbackAddress, isLoopbackRequest } from './api-token.middleware.js';
+const logger = LoggerService.getInstance().createComponentLogger('AgentOriginMiddleware');
+/**
+ * PTY shell pid → session name for the live sessions.
+ *
+ * @returns Map (empty when no session backend is up)
+ */
+function liveSessionPids() {
+    const out = new Map();
+    const backend = getSessionBackendSync();
+    if (!backend)
+        return out;
+    for (const name of backend.listSessions()) {
+        const pid = backend.getSession(name)?.pid;
+        if (typeof pid === 'number' && pid > 1)
+            out.set(pid, name);
+    }
+    return out;
+}
+let originService = null;
+const lastWarned = new Map();
+/**
+ * Log at most once per WARN_THROTTLE_MS per key.
+ *
+ * @param key - Throttle key
+ * @param message - Log message
+ * @param meta - Log fields
+ */
+function warnThrottled(key, message, meta) {
+    const now = Date.now();
+    const last = lastWarned.get(key);
+    if (last !== undefined && now - last < AGENT_ORIGIN_CONSTANTS.WARN_THROTTLE_MS)
+        return;
+    lastWarned.set(key, now);
+    logger.warn(message, meta);
+}
+/**
+ * Resolve with `null` if the lookup takes longer than `ms`.
+ *
+ * @param promise - Lookup
+ * @param ms - Timeout
+ * @returns The lookup's result or null
+ */
+function withTimeout(promise, ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(null), ms);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, () => {
+            clearTimeout(timer);
+            resolve(null);
+        });
+    });
+}
+/**
+ * Apply a resolved origin to the request: rewrite a contradicted header and
+ * warn about it, or warn that the command ran in a shared daemon.
+ *
+ * @param req - Request (headers are mutated when corrected)
+ * @param claimed - The X-Agent-Session the shell sent
+ * @param origin - Where its process really runs
+ */
+export function applyAgentOrigin(req, claimed, origin) {
+    if (origin.session && origin.session !== claimed) {
+        req.headers[AGENT_ORIGIN_CONSTANTS.CLAIMED_SESSION_HEADER] = claimed;
+        req.headers[AGENT_ORIGIN_CONSTANTS.SESSION_HEADER] = origin.session;
+        warnThrottled(`mismatch:${claimed}:${origin.session}`, 'Skill request claimed another agent\'s identity — its process runs under a different agent PTY; treating it as that agent. The runtime leaked the wrong CREWLY_SESSION_NAME into the agent\'s shell.', {
+            claimedSession: claimed,
+            actualSession: origin.session,
+            viaSharedDaemon: origin.viaSharedDaemon,
+            path: req.path,
+        });
+        return;
+    }
+    if (!origin.session && origin.viaSharedDaemon) {
+        warnThrottled(`daemon:${claimed}`, 'Skill request came from a shared Codex app-server daemon, not an agent PTY — its X-Agent-Session may belong to whichever agent started the daemon. Restart the agent so Codex launches with --no-daemon.', {
+            claimedSession: claimed,
+            path: req.path,
+        });
+    }
+}
+/**
+ * Express middleware; see the module doc. Runs after the API-token gate and
+ * before the heartbeat middleware, so the heartbeat and every controller see
+ * the corrected identity.
+ *
+ * @param req - Express request
+ * @param _res - Express response
+ * @param next - Next handler
+ */
+export function agentOriginMiddleware(req, _res, next) {
+    const claimed = req.headers[AGENT_ORIGIN_CONSTANTS.SESSION_HEADER];
+    const rawPid = req.headers[AGENT_ORIGIN_CONSTANTS.PID_HEADER];
+    if (typeof claimed !== 'string' || !claimed || typeof rawPid !== 'string' || !/^\d+$/.test(rawPid)) {
+        next();
+        return;
+    }
+    const pid = Number(rawPid);
+    if (pid <= 1 || !isLoopbackAddress(req.socket?.remoteAddress ?? '') || !isLoopbackRequest(req)) {
+        next();
+        return;
+    }
+    originService ??= new AgentProcessOriginService({ listSessionPids: liveSessionPids });
+    void withTimeout(originService.resolve(pid), AGENT_ORIGIN_CONSTANTS.LOOKUP_TIMEOUT_MS).then((origin) => {
+        try {
+            if (origin)
+                applyAgentOrigin(req, claimed, origin);
+        }
+        catch (error) {
+            logger.debug('Agent origin check failed (request left as sent)', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+        next();
+    });
+}
+/**
+ * Replace the origin service (tests).
+ *
+ * @param service - Service to use, or null to rebuild the default lazily
+ */
+export function setAgentOriginServiceForTesting(service) {
+    originService = service;
+    lastWarned.clear();
+}
+//# sourceMappingURL=agent-origin.middleware.js.map

package/dist/backend/backend/src/middleware/agent-origin.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-origin.middleware.js","sourceRoot":"","sources":["../../../../../backend/src/middleware/agent-origin.middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAsB,MAAM,mDAAmD,CAAC;AAClH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEjF,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;AAE1F;;;;GAIG;AACH,SAAS,eAAe;IACvB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC;QAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,IAAI,aAAa,GAAqC,IAAI,CAAC;AAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,IAA6B;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,sBAAsB,CAAC,gBAAgB;QAAE,OAAO;IACvF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,EACD,GAAG,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,OAAe,EAAE,MAAqB;IACpF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACpE,aAAa,CAAC,YAAY,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,sMAAsM,EAAE;YAC9P,cAAc,EAAE,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,OAAO;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC/C,aAAa,CAAC,UAAU,OAAO,EAAE,EAAE,0MAA0M,EAAE;YAC9O,cAAc,EAAE,OAAO;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACrF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpG,IAAI,EAAE,CAAC;QACP,OAAO;IACR,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChG,IAAI,EAAE,CAAC;QACP,OAAO;IACR,CAAC;IACD,aAAa,KAAK,IAAI,yBAAyB,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,KAAK,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACtG,IAAI,CAAC;YACJ,IAAI,MAAM;gBAAE,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;gBAChE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC7D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC;IACR,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACxF,aAAa,GAAG,OAAO,CAAC;IACxB,UAAU,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC"}

package/dist/backend/backend/src/routes/modules/system.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.routes.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/routes/modules/system.routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAGpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,GAAG,IAAI,CA0BvF"}
+{"version":3,"file":"system.routes.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/routes/modules/system.routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAIpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,GAAG,IAAI,CAgCvF"}

package/dist/backend/backend/src/routes/modules/system.routes.js

@@ -1,4 +1,5 @@
 import * as systemHandlers from '../../controllers/system/system.controller.js';
+import { getOwnerMessageWatchdog } from '../../services/messaging/owner-message-watchdog.service.js';
 export function registerSystemRoutes(router, apiController) {
     // System Administration Routes
     router.get('/system/health', (req, res) => systemHandlers.getSystemHealth.call(apiController, req, res));
@@ -10,6 +11,11 @@ export function registerSystemRoutes(router, apiController) {
     router.get('/system/logs', (req, res) => systemHandlers.getSystemLogs.call(apiController, req, res));
     router.get('/system/alerts', (req, res) => systemHandlers.getAlerts.call(apiController, req, res));
     router.patch('/system/alerts/:conditionId', (req, res) => systemHandlers.updateAlertCondition.call(apiController, req, res));
+    // Owner messages still waiting for an answer (debug; specs/2026-09-30-owner-message-guarantee.md)
+    router.get('/system/unanswered-owner-messages', (_req, res) => {
+        const watchdog = getOwnerMessageWatchdog();
+        res.json({ success: true, data: { running: !!watchdog, messages: watchdog?.list() ?? [] } });
+    });
     // Server restart
     router.post('/system/restart', (req, res) => systemHandlers.restartServer.call(apiController, req, res));
     // API Health within /api scope

package/dist/backend/backend/src/routes/modules/system.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"system.routes.js","sourceRoot":"","sources":["../../../../../../backend/src/routes/modules/system.routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,cAAc,MAAM,+CAA+C,CAAC;AAEhF,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,aAA4B;IAC/E,+BAA+B;IAC/B,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3G,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,sBAAsB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACtH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE7H,iBAAiB;IACjB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzG,+BAA+B;IAC/B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9F,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE7G,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzG,gEAAgE;IAChE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1G,CAAC"}
+{"version":3,"file":"system.routes.js","sourceRoot":"","sources":["../../../../../../backend/src/routes/modules/system.routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,cAAc,MAAM,+CAA+C,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4DAA4D,CAAC;AAErG,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,aAA4B;IAC/E,+BAA+B;IAC/B,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3G,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,sBAAsB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,yBAAyB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACtH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE7H,kGAAkG;IAClG,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,iBAAiB;IACjB,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzG,+BAA+B;IAC/B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9F,0DAA0D;IAC1D,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAE7G,oEAAoE;IACpE,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAEzG,gEAAgE;IAChE,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1G,CAAC"}

package/dist/backend/backend/src/services/agent/agent-process-origin.service.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Which agent PTY a local skill process really belongs to.
+ *
+ * Skills name their caller with `X-Agent-Session`, read from
+ * CREWLY_SESSION_NAME in the shell that ran them. That variable is only as
+ * good as the process tree it came from: Codex's shared app-server daemon ran
+ * every Codex agent's commands with the orchestrator's environment
+ * (2026-09-30), so each of them claimed to be `crewly-orc`.
+ *
+ * Skills also send `X-Agent-Pid` (the skill shell's own pid). On this machine
+ * that pid's parent chain leads to exactly one agent PTY shell — the process
+ * Crewly spawned for the session — unless it runs under a shared daemon, in
+ * which case it leads to no PTY at all. This service walks that chain.
+ *
+ * @module services/agent/agent-process-origin.service
+ */
+/** One row of the process table. */
+export interface ProcessEntry {
+    ppid: number;
+    /** Full command line (only matched against, never logged) */
+    args: string;
+}
+/** Where a skill process came from. */
+export interface ProcessOrigin {
+    /** The agent session whose PTY is an ancestor, or null when none is */
+    session: string | null;
+    /** True when the chain reaches Codex's shared app-server daemon (session is then null) */
+    viaSharedDaemon: boolean;
+}
+/**
+ * Walk from `pid` up through its parents until an agent PTY shell is found.
+ *
+ * A shared Codex daemon ends the walk: it is often still the child of the
+ * TUI that started it (the orchestrator's), so walking on would "prove" the
+ * very identity that leaked.
+ *
+ * @param pid - Starting process (the skill shell)
+ * @param table - pid → {ppid, args}
+ * @param sessionPids - PTY shell pid → session name
+ * @returns The owning session (or null) and whether a shared Codex daemon sits in between
+ */
+export declare function resolveProcessOrigin(pid: number, table: ReadonlyMap<number, ProcessEntry>, sessionPids: ReadonlyMap<number, string>): ProcessOrigin;
+/**
+ * Parse `ps -Ao pid=,ppid=,args=` output.
+ *
+ * @param output - Raw ps output
+ * @returns pid → entry
+ */
+export declare function parseProcessTable(output: string): Map<number, ProcessEntry>;
+/**
+ * Read the process table with one `ps` call (same flags on Linux and macOS).
+ *
+ * @returns pid → entry
+ */
+export declare function readProcessTable(): Promise<Map<number, ProcessEntry>>;
+/** Injectable pieces (tests). */
+export interface AgentProcessOriginDeps {
+    readTable?: () => Promise<Map<number, ProcessEntry>>;
+    /** PTY shell pid → session name for the live agent sessions */
+    listSessionPids?: () => Map<number, string>;
+    now?: () => number;
+}
+/**
+ * Resolves skill pids to agent sessions, caching per pid for a short while
+ * (one skill run makes several API calls from the same shell).
+ */
+export declare class AgentProcessOriginService {
+    private readonly cache;
+    private readonly readTable;
+    private readonly listSessionPids;
+    private readonly now;
+    /**
+     * @param deps - Injectable dependencies
+     */
+    constructor(deps: AgentProcessOriginDeps & {
+        listSessionPids: () => Map<number, string>;
+    });
+    /**
+     * Where a local skill process came from.
+     *
+     * @param pid - The skill shell's pid (from X-Agent-Pid)
+     * @returns The origin; `{session: null}` when there are no agent sessions
+     */
+    resolve(pid: number): Promise<ProcessOrigin>;
+}
+//# sourceMappingURL=agent-process-origin.service.d.ts.map

package/dist/backend/backend/src/services/agent/agent-process-origin.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-process-origin.service.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/agent/agent-process-origin.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;CACb;AAED,uCAAuC;AACvC,MAAM,WAAW,aAAa;IAC7B,uEAAuE;IACvE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0FAA0F;IAC1F,eAAe,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CACnC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EACxC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACtC,aAAa,CAaf;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CASrE;AAED,iCAAiC;AACjC,MAAM,WAAW,sBAAsB;IACtC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACrD,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,yBAAyB;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4D;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA2C;IACrE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC;;OAEG;gBACS,IAAI,EAAE,sBAAsB,GAAG;QAAE,eAAe,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAMzF;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAclD"}

package/dist/backend/backend/src/services/agent/agent-process-origin.service.js

@@ -0,0 +1,114 @@
+/**
+ * Which agent PTY a local skill process really belongs to.
+ *
+ * Skills name their caller with `X-Agent-Session`, read from
+ * CREWLY_SESSION_NAME in the shell that ran them. That variable is only as
+ * good as the process tree it came from: Codex's shared app-server daemon ran
+ * every Codex agent's commands with the orchestrator's environment
+ * (2026-09-30), so each of them claimed to be `crewly-orc`.
+ *
+ * Skills also send `X-Agent-Pid` (the skill shell's own pid). On this machine
+ * that pid's parent chain leads to exactly one agent PTY shell — the process
+ * Crewly spawned for the session — unless it runs under a shared daemon, in
+ * which case it leads to no PTY at all. This service walks that chain.
+ *
+ * @module services/agent/agent-process-origin.service
+ */
+import { execFile } from 'child_process';
+import { AGENT_ORIGIN_CONSTANTS } from '../../constants.js';
+/**
+ * Walk from `pid` up through its parents until an agent PTY shell is found.
+ *
+ * A shared Codex daemon ends the walk: it is often still the child of the
+ * TUI that started it (the orchestrator's), so walking on would "prove" the
+ * very identity that leaked.
+ *
+ * @param pid - Starting process (the skill shell)
+ * @param table - pid → {ppid, args}
+ * @param sessionPids - PTY shell pid → session name
+ * @returns The owning session (or null) and whether a shared Codex daemon sits in between
+ */
+export function resolveProcessOrigin(pid, table, sessionPids) {
+    let current = pid;
+    const seen = new Set();
+    for (let depth = 0; depth < AGENT_ORIGIN_CONSTANTS.MAX_ANCESTRY_DEPTH && current > 1 && !seen.has(current); depth++) {
+        seen.add(current);
+        const session = sessionPids.get(current);
+        if (session)
+            return { session, viaSharedDaemon: false };
+        const entry = table.get(current);
+        if (!entry)
+            break;
+        if (AGENT_ORIGIN_CONSTANTS.SHARED_DAEMON_ARGS_RE.test(entry.args))
+            return { session: null, viaSharedDaemon: true };
+        current = entry.ppid;
+    }
+    return { session: null, viaSharedDaemon: false };
+}
+/**
+ * Parse `ps -Ao pid=,ppid=,args=` output.
+ *
+ * @param output - Raw ps output
+ * @returns pid → entry
+ */
+export function parseProcessTable(output) {
+    const table = new Map();
+    for (const line of output.split('\n')) {
+        const match = /^\s*(\d+)\s+(\d+)\s?(.*)$/.exec(line);
+        if (!match)
+            continue;
+        table.set(Number(match[1]), { ppid: Number(match[2]), args: match[3] ?? '' });
+    }
+    return table;
+}
+/**
+ * Read the process table with one `ps` call (same flags on Linux and macOS).
+ *
+ * @returns pid → entry
+ */
+export function readProcessTable() {
+    return new Promise((resolve, reject) => {
+        execFile('ps', ['-Ao', 'pid=,ppid=,args='], { timeout: AGENT_ORIGIN_CONSTANTS.LOOKUP_TIMEOUT_MS, maxBuffer: AGENT_ORIGIN_CONSTANTS.PS_MAX_BUFFER_BYTES }, (error, stdout) => (error ? reject(error) : resolve(parseProcessTable(stdout))));
+    });
+}
+/**
+ * Resolves skill pids to agent sessions, caching per pid for a short while
+ * (one skill run makes several API calls from the same shell).
+ */
+export class AgentProcessOriginService {
+    cache = new Map();
+    readTable;
+    listSessionPids;
+    now;
+    /**
+     * @param deps - Injectable dependencies
+     */
+    constructor(deps) {
+        this.readTable = deps.readTable ?? readProcessTable;
+        this.listSessionPids = deps.listSessionPids;
+        this.now = deps.now ?? Date.now;
+    }
+    /**
+     * Where a local skill process came from.
+     *
+     * @param pid - The skill shell's pid (from X-Agent-Pid)
+     * @returns The origin; `{session: null}` when there are no agent sessions
+     */
+    async resolve(pid) {
+        const hit = this.cache.get(pid);
+        if (hit && this.now() - hit.at < AGENT_ORIGIN_CONSTANTS.RESULT_CACHE_TTL_MS)
+            return hit.origin;
+        const sessionPids = this.listSessionPids();
+        const origin = sessionPids.size === 0
+            ? { session: null, viaSharedDaemon: false }
+            : resolveProcessOrigin(pid, await this.readTable(), sessionPids);
+        if (this.cache.size >= AGENT_ORIGIN_CONSTANTS.RESULT_CACHE_MAX_ENTRIES) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
+                this.cache.delete(oldest);
+        }
+        this.cache.set(pid, { origin, at: this.now() });
+        return origin;
+    }
+}
+//# sourceMappingURL=agent-process-origin.service.js.map

package/dist/backend/backend/src/services/agent/agent-process-origin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-process-origin.service.js","sourceRoot":"","sources":["../../../../../../backend/src/services/agent/agent-process-origin.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAiB5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CACnC,GAAW,EACX,KAAwC,EACxC,WAAwC;IAExC,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,sBAAsB,CAAC,kBAAkB,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACrH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,IAAI,sBAAsB,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACnH,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,QAAQ,CACP,IAAI,EACJ,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAC3B,EAAE,OAAO,EAAE,sBAAsB,CAAC,iBAAiB,EAAE,SAAS,EAAE,sBAAsB,CAAC,mBAAmB,EAAE,EAC5G,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAC/E,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAUD;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IACpB,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACjE,SAAS,CAA2C;IACpD,eAAe,CAA4B;IAC3C,GAAG,CAAe;IAEnC;;OAEG;IACH,YAAY,IAA6E;QACxF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,sBAAsB,CAAC,mBAAmB;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC;QAC/F,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,KAAK,CAAC;YACpC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;YAC3C,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAsB,CAAC,wBAAwB,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IACf,CAAC;CACD"}

package/dist/backend/backend/src/services/agent/codex-daemon.utils.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Keep each Codex agent's shell commands in that agent's own process.
+ *
+ * Codex 0.157+ runs the TUI against one shared background app server
+ * (`codex app-server --listen unix:// --managed-daemon`), started by whichever
+ * Codex session on the machine starts first — usually the orchestrator. Tool
+ * and shell commands run inside that daemon, so they inherit ITS environment:
+ * every Codex agent's skills sent `X-Agent-Session: crewly-orc` and acted as
+ * the orchestrator (steamfun-ops, 2026-09-30: Avery's reply-channel 404'd
+ * because the orc was not in the room, and her answer was lost).
+ *
+ * `codex --no-daemon` runs the app server inside the TUI process instead, so
+ * commands inherit the PTY's spawn env (CREWLY_SESSION_NAME, CREWLY_ROLE, the
+ * API keys …). Login is untouched: every session still reads the same
+ * `$CODEX_HOME/auth.json`.
+ *
+ * @module services/agent/codex-daemon.utils
+ */
+import type { RunCommand } from '../harness/harness.types.js';
+/**
+ * Add `--no-daemon` to a Codex launch command (`codex …` or `codex resume …`).
+ * A command that does not run codex, or already picks its app server
+ * (`--no-daemon`, `--remote`), is returned unchanged.
+ *
+ * @param command - One launch command line
+ * @returns The command with the flag right after `codex` / `codex resume`
+ *
+ * @example
+ * withCodexNoDaemon('codex -a never -s danger-full-access')
+ * // => 'codex --no-daemon -a never -s danger-full-access'
+ */
+export declare function withCodexNoDaemon(command: string): string;
+/** Injectable pieces of the capability check (tests). */
+export interface CodexNoDaemonProbeDeps {
+    run?: RunCommand;
+    /** Finds the codex binary the agent shell would run */
+    resolveCodex?: () => string | null;
+    env?: NodeJS.ProcessEnv;
+    now?: () => number;
+}
+/**
+ * Whether the installed Codex has `--no-daemon`. Passing the flag to a Codex
+ * that lacks it would stop the agent from starting (clap rejects unknown
+ * arguments), so the flag is only added once `codex --help` lists it. A yes is
+ * kept for the life of the process; a no is re-checked after
+ * NO_DAEMON_PROBE_RETRY_MS in case Codex was upgraded meanwhile.
+ *
+ * Never throws: a missing or broken codex counts as "no".
+ *
+ * @param deps - Injectable dependencies
+ * @returns True when `codex --help` mentions `--no-daemon`
+ */
+export declare function codexSupportsNoDaemon(deps?: CodexNoDaemonProbeDeps): Promise<boolean>;
+/** Forget the cached capability check (tests). */
+export declare function resetCodexNoDaemonProbe(): void;
+//# sourceMappingURL=codex-daemon.utils.d.ts.map

package/dist/backend/backend/src/services/agent/codex-daemon.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-daemon.utils.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/services/agent/codex-daemon.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAO9D;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASzD;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,GAAE,sBAA2B,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB/F;AAED,kDAAkD;AAClD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/dist/backend/backend/src/services/agent/codex-daemon.utils.js

@@ -0,0 +1,100 @@
+/**
+ * Keep each Codex agent's shell commands in that agent's own process.
+ *
+ * Codex 0.157+ runs the TUI against one shared background app server
+ * (`codex app-server --listen unix:// --managed-daemon`), started by whichever
+ * Codex session on the machine starts first — usually the orchestrator. Tool
+ * and shell commands run inside that daemon, so they inherit ITS environment:
+ * every Codex agent's skills sent `X-Agent-Session: crewly-orc` and acted as
+ * the orchestrator (steamfun-ops, 2026-09-30: Avery's reply-channel 404'd
+ * because the orc was not in the room, and her answer was lost).
+ *
+ * `codex --no-daemon` runs the app server inside the TUI process instead, so
+ * commands inherit the PTY's spawn env (CREWLY_SESSION_NAME, CREWLY_ROLE, the
+ * API keys …). Login is untouched: every session still reads the same
+ * `$CODEX_HOME/auth.json`.
+ *
+ * @module services/agent/codex-daemon.utils
+ */
+import * as path from 'path';
+import { HARNESS_CONSTANTS } from '../../constants.js';
+import { buildHarnessPath, getUserNpmBinDir, resolveExecutable, runCommand } from '../harness/harness-exec.utils.js';
+const CODEX = HARNESS_CONSTANTS.CODEX;
+/** The codex binary as a command word, plus `resume` when present. */
+const CODEX_COMMAND_RE = /(?<=^|[\s;&|(])(?:[^\s;&|()=]*\/)?codex(?:\s+resume)?(?=\s|$)/;
+/**
+ * Add `--no-daemon` to a Codex launch command (`codex …` or `codex resume …`).
+ * A command that does not run codex, or already picks its app server
+ * (`--no-daemon`, `--remote`), is returned unchanged.
+ *
+ * @param command - One launch command line
+ * @returns The command with the flag right after `codex` / `codex resume`
+ *
+ * @example
+ * withCodexNoDaemon('codex -a never -s danger-full-access')
+ * // => 'codex --no-daemon -a never -s danger-full-access'
+ */
+export function withCodexNoDaemon(command) {
+    const tokens = command.split(/\s+/);
+    const picksServer = tokens.some((tok) => CODEX.APP_SERVER_SELECT_FLAGS.some((flag) => tok === flag || tok.startsWith(`${flag}=`)));
+    if (picksServer)
+        return command;
+    // `codex` / `/path/to/codex` as a command word (not `CODEX_HOME=~/.codex`),
+    // optionally followed by the `resume` subcommand.
+    return command.replace(CODEX_COMMAND_RE, (m) => `${m} ${CODEX.NO_DAEMON_FLAG}`);
+}
+/**
+ * The PATH an agent shell ends up with: the backend's node first (the
+ * runtime re-export in the PTY), the user npm prefix, then the harness PATH.
+ * The `codex` npm shim is `#!/usr/bin/env node`, so the node on PATH matters.
+ *
+ * @param env - Base environment
+ * @returns PATH string
+ */
+function agentShellPath(env) {
+    const dirs = [path.dirname(process.execPath), getUserNpmBinDir(), buildHarnessPath(env.PATH)];
+    return dirs.filter((d, i, a) => d && a.indexOf(d) === i).join(path.delimiter);
+}
+let cached = null;
+/**
+ * Whether the installed Codex has `--no-daemon`. Passing the flag to a Codex
+ * that lacks it would stop the agent from starting (clap rejects unknown
+ * arguments), so the flag is only added once `codex --help` lists it. A yes is
+ * kept for the life of the process; a no is re-checked after
+ * NO_DAEMON_PROBE_RETRY_MS in case Codex was upgraded meanwhile.
+ *
+ * Never throws: a missing or broken codex counts as "no".
+ *
+ * @param deps - Injectable dependencies
+ * @returns True when `codex --help` mentions `--no-daemon`
+ */
+export async function codexSupportsNoDaemon(deps = {}) {
+    const now = deps.now ?? Date.now;
+    if (cached && (cached.supported || now() - cached.checkedAt < CODEX.NO_DAEMON_PROBE_RETRY_MS)) {
+        return cached.supported;
+    }
+    const env = deps.env ?? process.env;
+    const shellPath = agentShellPath(env);
+    const resolveCodex = deps.resolveCodex ?? (() => resolveExecutable('codex', shellPath));
+    let supported = false;
+    try {
+        const binary = resolveCodex();
+        if (binary) {
+            const result = await (deps.run ?? runCommand)(binary, ['--help'], {
+                env: { ...env, PATH: shellPath },
+                timeoutMs: CODEX.HELP_PROBE_TIMEOUT_MS,
+            });
+            supported = result.code === 0 && `${result.stdout}\n${result.stderr}`.includes(CODEX.NO_DAEMON_FLAG);
+        }
+    }
+    catch {
+        supported = false;
+    }
+    cached = { supported, checkedAt: now() };
+    return supported;
+}
+/** Forget the cached capability check (tests). */
+export function resetCodexNoDaemonProbe() {
+    cached = null;
+}
+//# sourceMappingURL=codex-daemon.utils.js.map

package/dist/backend/backend/src/services/agent/codex-daemon.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-daemon.utils.js","sourceRoot":"","sources":["../../../../../../backend/src/services/agent/codex-daemon.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAGrH,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC;AAEtC,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,+DAA+D,CAAC;AAEzF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CACxF,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,OAAO,CAAC;IAChC,4EAA4E;IAC5E,kDAAkD;IAClD,OAAO,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,GAAsB;IAC7C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED,IAAI,MAAM,GAAqD,IAAI,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA+B,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC/F,OAAO,MAAM,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACxF,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;gBACjE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE;gBAChC,SAAS,EAAE,KAAK,CAAC,qBAAqB;aACtC,CAAC,CAAC;YACH,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtG,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,SAAS,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;IACzC,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,uBAAuB;IACtC,MAAM,GAAG,IAAI,CAAC;AACf,CAAC"}

package/dist/backend/backend/src/services/agent/runtime-agent.service.abstract.d.ts

@@ -69,6 +69,21 @@ export declare abstract class RuntimeAgentService {
      * @returns The commands, with `--settings` appended when the guard applies
      */
     protected applyControlPlaneGuard(sessionName: string, commands: string[], targetPath?: string): Promise<string[]>;
+    /**
+     * Launch Codex with `--no-daemon` so its shell commands run in this
+     * agent's own process and carry this agent's identity env.
+     *
+     * Without it every Codex TUI on the machine attaches to one shared
+     * `codex app-server` daemon, started by whichever Codex session came
+     * first (usually the orchestrator), and every agent's skills then ran as
+     * that session (see codex-daemon.utils). A Codex too old to know the flag
+     * launches as before, with a WARN, rather than failing to start.
+     *
+     * @param sessionName - PTY session name
+     * @param commands - Codex launch commands built so far
+     * @returns The commands, with `--no-daemon` added when supported
+     */
+    protected keepCodexOffSharedDaemon(sessionName: string, commands: string[]): Promise<string[]>;
     /**
      * Template method for executing runtime initialization script.
      * Most logic is shared, only runtime-specific parts are delegated to abstract methods.