Merge pull request #361 from timkjr/fix/statusline-injection-opt-out

fix(statusline): inject plan-usage telemetry via ephemeral CLI flag, never disk

src/hooks-config.ts

@@ -31,7 +31,7 @@
 
 import { randomBytes } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { readFile, writeFile, mkdir, lstat, readdir, realpath, rename, unlink, rmdir } from 'node:fs/promises';
+import { readFile, writeFile, mkdir, lstat, readdir, realpath, rename, unlink, rmdir, chmod } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -39,6 +39,7 @@ import { fileURLToPath } from 'node:url';
 import type { HookEventType } from './types.js';
 import { HOOK_TIMEOUT_SECONDS } from './config/auth-config.js';
 import { dataPath } from './config/instance.js';
+import { readJsonConfig, SETTINGS_PATH } from './web/route-helpers.js';
 
 /**
  * Serializes read-modify-write access to a `settings.local.json` path. Every
@@ -906,6 +907,196 @@ export async function applyStatusLineConfig(casePath: string, enabled: boolean):
   });
 }
 
+/**
+ * Version-agnostic marker embedded as a comment in the generated exporter
+ * SCRIPT (see ensureStatusLineExporterScript) — bump the numeric suffix
+ * whenever the script content changes so `ensureStatusLineExporterScript`'s
+ * content comparison rewrites stale copies on next use.
+ */
+const STATUSLINE_EXPORTER_SCRIPT_MARKER = 'CODEMAN_STATUSLINE_EXPORTER_V3';
+
+function statusLineExporterScriptContent(): string {
+  // Where the telemetry POST runs depends on who owns the footer. When the pane's
+  // env carries CODEMAN_USER_STATUSLINE_CMD (set via tmux setenv by TmuxManager
+  // when findEffectiveUserStatusLineCommand found the user's own REAL statusLine —
+  // see that function's doc comment), the user's command owns the footer, so the
+  // POST runs in a BACKGROUND subshell with stdin/stdout/stderr all closed
+  // (`>/dev/null 2>&1 </dev/null &`) — closing stdout/stderr keeps it from adding
+  // latency or leaking into the visible statusline, and closing stdin too is what
+  // lets a host reading this script's own stdout to EOF (`sh script | cat`) see
+  // that EOF promptly: without it the backgrounded curl keeps the pipe's write end
+  // open until IT exits, so the reader blocks for however long curl takes (measured
+  // ~5s with a stand-in) instead of the ~9ms it takes once stdin is closed too.
+  // Absent a user statusline, NOTHING else will print the footer, so the POST runs
+  // in the FOREGROUND and ITS OWN stdout becomes the footer — `/api/status-telemetry`
+  // returns formatSessionStatusText(...) (model/tokens/context %) precisely so this
+  // can happen — falling back to the plain "codeman" marker only if curl itself
+  // fails (`|| echo codeman`, refused/unreachable Codeman). `--max-time` bounds a
+  // HUNG (not just refused) Codeman so it cannot wedge the render indefinitely.
+  const post =
+    `printf '{"sessionId":"%s","data":%s}' "$CODEMAN_SESSION_ID" "$INPUT" | ` +
+    `curl -sk --max-time 5 -X POST "$CODEMAN_API_URL${STATUSLINE_MARKER}" ` +
+    `-H 'Content-Type: application/json' ` +
+    `-H "X-Codeman-Hook-Secret: $(cat "$CODEMAN_HOOK_SECRET_FILE" 2>/dev/null)" ` +
+    `--data @-`;
+  return (
+    `#!/bin/sh\n` +
+    `# ${STATUSLINE_EXPORTER_SCRIPT_MARKER} — auto-generated by Codeman; safe to delete, regenerated on demand.\n` +
+    `INPUT=$(cat 2>/dev/null || echo '{}')\n` +
+    `if [ -n "$CODEMAN_USER_STATUSLINE_CMD" ]; then\n` +
+    `  ( ${post} ) >/dev/null 2>&1 </dev/null &\n` +
+    `  printf '%s' "$INPUT" | sh -c "$CODEMAN_USER_STATUSLINE_CMD"\n` +
+    `else\n` +
+    `  ${post} 2>/dev/null || echo codeman\n` +
+    `fi\n`
+  );
+}
+
+async function readStatusLineCommandFromFile(settingsPath: string): Promise<string | undefined> {
+  if (!existsSync(settingsPath)) return undefined;
+  try {
+    const parsed = JSON.parse(await readFile(settingsPath, 'utf-8'));
+    const current = parsed.statusLine as { command?: unknown } | undefined;
+    return current && typeof current.command === 'string' ? current.command : undefined;
+  } catch {
+    return undefined; // Malformed — treat as absent, same posture as applyStatusLineConfig.
+  }
+}
+
+/**
+ * Walk Claude Code's OWN settings precedence for `workingDir` to find whatever
+ * statusLine command is ACTUALLY effective there right now: project-local
+ * `.claude/settings.local.json` > project-shared `.claude/settings.json` >
+ * the user's global `~/.claude/settings.json`. Returns undefined when none of
+ * the three configures one.
+ *
+ * A legacy Codeman-marked entry in the project's OWN settings.local.json
+ * (written by an older build's disk-based mechanism) is never treated as a
+ * real user command — resolveStatusLineCliCommand strips it before this ever
+ * runs, so ordinarily this function never even sees one; the marker check
+ * here is a second, defensive guard in case something else wrote a copy in
+ * between, and precedence simply continues to the next layer instead of
+ * stopping on it.
+ */
+export async function findEffectiveUserStatusLineCommand(workingDir: string): Promise<string | undefined> {
+  const projectLocal = await readStatusLineCommandFromFile(join(workingDir, '.claude', 'settings.local.json'));
+  if (projectLocal && !projectLocal.includes(STATUSLINE_MARKER)) return projectLocal;
+
+  const projectShared = await readStatusLineCommandFromFile(join(workingDir, '.claude', 'settings.json'));
+  if (projectShared) return projectShared;
+
+  return readStatusLineCommandFromFile(join(homedir(), '.claude', 'settings.json'));
+}
+
+/**
+ * Write (or refresh) the SHARED, single exporter script every claude session
+ * points its ephemeral --settings statusLine flag at, and return its absolute
+ * path. Idempotent: only rewrites when the marker-versioned content differs.
+ *
+ * This is the fix for a real bug found live 2026-08-31: the exporter's
+ * command string legitimately depends on `$CODEMAN_SESSION_ID`,
+ * `$CODEMAN_API_URL`, `$CODEMAN_HOOK_SECRET_FILE`, and its own internal
+ * `$INPUT` — all meant to be expanded ONLY when Claude Code itself finally
+ * executes the statusLine command, using the PANE's tmux-setenv'd
+ * environment. Passing that command as literal TEXT through
+ * `--settings '...'` routes it through this server's OWN spawn-time shell
+ * layers first (tmux respawn-pane's `bash -c "..."`, itself invoked via
+ * execSync's implicit `/bin/sh -c`) — and POSIX double quotes do NOT
+ * suppress `$` expansion, so those vars got expanded there and then, against
+ * the SERVER process's environment (where they are unset), producing a
+ * mangled curl call that posted malformed JSON and printed the server's raw
+ * error response as the statusline text itself. A bare file PATH has no `$`,
+ * quotes, or pipes for any of those intermediate shells to mangle — the
+ * script's own content (containing the real `$VAR`s) is never touched by a
+ * shell until Claude Code executes the file itself, at which point the
+ * pane's real environment is in scope. This mirrors the existing #208 fix in
+ * tmux-manager.ts (never embed a literal `$SHELL` meant for later
+ * expansion — resolve it, or in this case reference a file, instead).
+ */
+export async function ensureStatusLineExporterScript(): Promise<string> {
+  const scriptPath = dataPath('statusline-exporter.sh');
+  const desired = statusLineExporterScriptContent();
+  let current: string | null = null;
+  try {
+    current = await readFile(scriptPath, 'utf-8');
+  } catch {
+    // Doesn't exist yet.
+  }
+  if (current !== desired) {
+    await writeFile(scriptPath, desired);
+    await chmod(scriptPath, 0o755);
+  }
+  return scriptPath;
+}
+
+/**
+ * Whether plan-usage telemetry collection is CURRENTLY wanted — read FRESH
+ * from the persisted `showPlanUsageLimits` setting on every call, never
+ * cached and never per-session. Reusing that setting rather than inventing a
+ * second persisted flag: it's the SAME boolean the App Settings chip checkbox
+ * already writes (see `planUsageChipEnabled()` in settings-ui.js).
+ *
+ * This is what lets the on/off decision survive a Codeman restart (there is
+ * no per-session state to lose — see the now-removed `Session._statusLineTelemetry`,
+ * which WAS such a per-session field and went stale on every restart) and
+ * apply uniformly across every claude session-creation path — interactive
+ * create, cron, the Ralph Loop API, quick-start — with none of them needing
+ * to thread a request-time flag through: they all already construct a
+ * session via TmuxManager.createSession/respawnPane, which reads this at
+ * spawn time.
+ */
+export async function readPlanUsageTelemetryEnabled(): Promise<boolean> {
+  const settings = await readJsonConfig<Record<string, unknown>>(SETTINGS_PATH, 'settings.json', {});
+  return settings.showPlanUsageLimits === true;
+}
+
+/**
+ * Resolve the statusLine command to pass as an EPHEMERAL `claude --settings`
+ * CLI flag for this one process (see buildSpawnCommandFromRegistry in
+ * session-cli-registry-bridge.ts) — never written to disk. This supersedes
+ * the old applyStatusLineConfig(path, true) disk-write: a file-based
+ * statusLine leaked into any plain `claude` run in that directory outside
+ * Codeman entirely (it took precedence over the user's own global/project
+ * statusline with no disclosure and no way to remove it — found live
+ * 2026-08-31).
+ *
+ * Also self-heals: if an OLDER Codeman build already wrote its marked
+ * exporter into this workspace's settings.local.json, it is stripped here
+ * (isOurs-guarded, same as applyStatusLineConfig's removal branch) so every
+ * workspace migrates off the disk-based mechanism the first time a session
+ * starts there again — no manual cleanup required. This self-heal runs
+ * regardless of `telemetryEnabled`, so a legacy leftover is cleaned up even
+ * while the setting is currently off.
+ *
+ * Returns undefined when telemetry isn't currently enabled (see
+ * readPlanUsageTelemetryEnabled), or when the workspace already has its OWN
+ * hand-configured statusLine (never override a real one).
+ */
+export async function resolveStatusLineCliCommand(
+  casePath: string,
+  telemetryEnabled: boolean
+): Promise<string | undefined> {
+  const settingsPath = join(casePath, '.claude', 'settings.local.json');
+  let userHasOwnStatusLine = false;
+  if (existsSync(settingsPath)) {
+    try {
+      const existing = JSON.parse(await readFile(settingsPath, 'utf-8'));
+      const current = existing.statusLine as { command?: unknown } | undefined;
+      if (current && typeof current.command === 'string') {
+        if (current.command.includes(STATUSLINE_MARKER)) {
+          await applyStatusLineConfig(casePath, false); // strip legacy disk-written exporter
+        } else {
+          userHasOwnStatusLine = true;
+        }
+      }
+    } catch {
+      // Malformed — leave it alone, same guard applyStatusLineConfig itself uses.
+    }
+  }
+  if (!telemetryEnabled || userHasOwnStatusLine) return undefined;
+  return ensureStatusLineExporterScript();
+}
+
 // ─── Agent skill injection ───────────────────────────────────────────────────
 
 /**

src/session-cli-registry-bridge.ts

@@ -56,6 +56,14 @@ export interface SpawnBridgeOptions {
   effort?: EffortLevel;
   sessionName?: string;
   claudeCliVersion?: string | null;
+  /**
+   * Resolved by resolveStatusLineCliCommand (hooks-config.ts) — undefined skips the
+   * exporter. Claude only. Rides the SAME `--settings` JSON object as `effortSettingsJson`
+   * (see buildSpawnCommandFromRegistry): Claude Code accepts only one `--settings` flag
+   * per invocation, so the two must be merged before reaching the argv engine rather than
+   * rendered as two independent params.
+   */
+  statusLineCommand?: string;
 }
 
 /**
@@ -186,8 +194,23 @@ export function buildSpawnCommandFromRegistry(entry: CliEntry, options: SpawnBri
   // than re-deriving the ultracode special case) keeps the EFFORT_LEVELS allowlist and the
   // settings-JSON shape single-sourced in session-cli-builder.ts.
   const [effortFlag, effortValue] = buildEffortCliArgs(options.effort);
-  if (effortFlag === '--settings') engineValues.effortSettingsJson = effortValue;
-  else if (effortFlag === '--effort') engineValues.effortLevel = effortValue;
+  if (effortFlag === '--effort') {
+    engineValues.effortLevel = effortValue;
+  }
+
+  // Fold the ephemeral plan-usage statusLine exporter (see resolveStatusLineCliCommand in
+  // hooks-config.ts) into the SAME `--settings` JSON object as ultracode/ effort, since Claude
+  // Code accepts only one `--settings` flag per invocation — rendering them as two independent
+  // params would let the second one silently win. Claude-only in practice (statusLineCommand
+  // is resolved claude-mode-only upstream), but this merge is mode-agnostic.
+  if ((effortFlag === '--settings' && effortValue) || options.statusLineCommand) {
+    const settingsObj: Record<string, unknown> =
+      effortFlag === '--settings' && effortValue ? JSON.parse(effortValue) : {};
+    if (options.statusLineCommand) {
+      settingsObj.statusLine = { type: 'command', command: options.statusLineCommand };
+    }
+    engineValues.effortSettingsJson = JSON.stringify(settingsObj);
+  }
 
   // Preserves buildSpawnCommand's original fallback exactly: an EXPLICIT `undefined` probes
   // the local claude CLI (getClaudeCliVersion, null under vitest); an explicit `null` means

src/tmux-manager.ts

@@ -67,6 +67,11 @@ import {
   legacyConfigForMode,
 } from './session-cli-registry-bridge.js';
 import type { CliEntry } from './config/cli-registry/types.js';
+import {
+  resolveStatusLineCliCommand,
+  readPlanUsageTelemetryEnabled,
+  findEffectiveUserStatusLineCommand,
+} from './hooks-config.js';
 import {
   buildSshConnectionArgs,
   defaultRemoteCommandForMode,
@@ -728,6 +733,8 @@ export function buildSpawnCommand(options: {
   ompConfig?: OmpConfig;
   resumeSessionId?: string;
   effort?: EffortLevel;
+  /** Resolved by resolveStatusLineCliCommand (hooks-config.ts) — undefined skips the exporter. Claude only. */
+  statusLineCommand?: string;
   /** Codeman session name, passed to claude as `--name` (version-gated, sanitized; local spawns only). */
   sessionName?: string;
   /**
@@ -1832,6 +1839,30 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
     }
   }
 
+  /**
+   * Export the user's own REAL statusLine command (found by
+   * findEffectiveUserStatusLineCommand) via tmux setenv, so the shared
+   * exporter script (statusLineExporterScriptContent in hooks-config.ts) can
+   * wrap it. Via setenv rather than embedding it in the spawn command line:
+   * tmux stores a setenv value verbatim and never re-parses it as shell
+   * syntax, so once safely escaped for THIS one command, the command's own
+   * `$`/quotes survive untouched into the claude process's environment — the
+   * same reasoning that made the exporter script itself necessary (see
+   * ensureStatusLineExporterScript's doc comment). Only this ONE line needs
+   * shellescape(); the stored value itself is opaque to tmux from then on.
+   */
+  private _configureStatusLineUserCommand(muxName: string, command: string | undefined): void {
+    if (!command) return;
+    try {
+      execSync(`${this.tmux()} setenv -t ${shellescape(muxName)} CODEMAN_USER_STATUSLINE_CMD ${shellescape(command)}`, {
+        timeout: EXEC_TIMEOUT_MS,
+        stdio: 'ignore',
+      });
+    } catch {
+      // Non-critical — the exporter just falls back to the plain "codeman" marker.
+    }
+  }
+
   /**
    * Creates a new tmux session wrapping Claude CLI or a shell.
    * In test mode: creates an in-memory session only (no real tmux session).
@@ -1915,6 +1946,19 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
 
     const envExportsStr = this.buildEnvExports(sessionId, muxName, mode).join(' && ');
 
+    // Registry-gated (capabilities.statusLineTelemetry — claude only today), local
+    // spawns only (remote/docker have their own separate command builders — out of
+    // scope here). Also self-heals: strips any legacy disk-written exporter from an
+    // older Codeman build the first time a session starts in that workspace again.
+    const statusLineCommand =
+      getCli(mode)?.capabilities.statusLineTelemetry && !remote && !docker
+        ? await resolveStatusLineCliCommand(workingDir, await readPlanUsageTelemetryEnabled())
+        : undefined;
+    // The user's own REAL statusLine, if any (walked via Claude Code's own
+    // settings precedence) — exported below so the shared exporter script
+    // can wrap it. Only worth discovering when we're actually injecting.
+    const userStatusLineCommand = statusLineCommand ? await findEffectiveUserStatusLineCommand(workingDir) : undefined;
+
     const baseCmd = buildSpawnCommand({
       mode,
       sessionId,
@@ -1931,6 +1975,7 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       ompConfig,
       resumeSessionId,
       effort,
+      statusLineCommand,
       sessionName: name,
     });
 
@@ -1993,6 +2038,7 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
         mode,
         legacyConfigForMode(mode, options as unknown as Record<string, unknown>)
       );
+      this._configureStatusLineUserCommand(muxName, userStatusLineCommand);
 
       // Apply user-supplied env overrides (e.g., CLAUDE_CODE_EFFORT_LEVEL) via tmux setenv
       // so secret values stay off the bash command line. Must run before respawn-pane.
@@ -2170,6 +2216,13 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
 
     const envExportsStr = this.buildEnvExports(sessionId, muxName, mode).join(' && ');
 
+    // See createSession()'s identical resolution for rationale.
+    const statusLineCommand =
+      getCli(mode)?.capabilities.statusLineTelemetry && !remote && !docker
+        ? await resolveStatusLineCliCommand(workingDir, await readPlanUsageTelemetryEnabled())
+        : undefined;
+    const userStatusLineCommand = statusLineCommand ? await findEffectiveUserStatusLineCommand(workingDir) : undefined;
+
     const baseCmd = buildSpawnCommand({
       mode,
       sessionId,
@@ -2186,6 +2239,7 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
       ompConfig,
       resumeSessionId,
       effort,
+      statusLineCommand,
       sessionName: name,
     });
     const config = niceConfig || DEFAULT_NICE_CONFIG;
@@ -2205,6 +2259,7 @@ export class TmuxManager extends EventEmitter implements TerminalMultiplexer {
         mode,
         legacyConfigForMode(mode, options as unknown as Record<string, unknown>)
       );
+      this._configureStatusLineUserCommand(muxName, userStatusLineCommand);
 
       // Re-apply user env overrides before respawn so the new shell inherits them.
       this.applyEnvOverrides(muxName, envOverrides);

src/web/public/session-ui.js

@@ -1062,13 +1062,6 @@ Object.assign(CodemanApp.prototype, {
             ...(hasEnvOverrides ? { envOverrides } : {}),
             ...(effort ? { effort } : {}),
             ...(modelOverride !== undefined ? { modelOverride } : {}),
-            // Plan-usage statusLine exporter (App Settings → Display). The server
-            // ADDS our exporter on create when true; when false it intentionally
-            // leaves any existing exporter in place (a per-repo settings.local.json
-            // is shared by sibling sessions, so create-with-false must not yank it
-            // — see the comment in session-routes create). Disabling the setting
-            // removes it via the App Settings toggle path (system-routes), not here.
-            statusLineTelemetry: this.planUsageChipEnabled(globalSettings),
           })
         }).then(r => r.json())
       );

src/web/public/settings-ui.js

@@ -2310,22 +2310,26 @@ Object.assign(CodemanApp.prototype, {
 
     // Save to server (includes notification prefs for cross-browser persistence).
     // Strip device-specific DISPLAY keys so they never sync across devices —
-    // localEcho/cjk/extendedKeyboard/skin are per-platform, and showPlanUsageLimits
-    // is per-device too (desktop can show the usage chip while mobile stays hidden).
+    // localEcho/cjk/extendedKeyboard/skin are per-platform.
     // webglRendererEnabled is per-device as well (renderer choice is GPU-specific,
     // and syncing would leak mobile's hidden-checkbox false onto desktop); it's
     // also absent from SettingsUpdateSchema, which is .strict() — sending it
     // would 400 the whole settings PUT.
-    // Telemetry COLLECTION is requested out-of-band via statusLineTelemetry (sent on
-    // ENABLE only, so a device with the chip OFF never strips the exporter that
-    // another device's chip depends on — see system-routes settings handler).
+    // showPlanUsageLimits is the ONE exception to "per-device keys never sync":
+    // its DISPLAY stays per-device (loadAppSettingsFromServer only seeds it into
+    // localStorage when a device has no value yet — same as every other display
+    // key), but it ALSO doubles as the server-side plan-usage telemetry
+    // COLLECTION switch (readPlanUsageTelemetryEnabled in hooks-config.ts, read
+    // fresh at every claude session create/respawn), so unlike the others it
+    // MUST flow through in `serverSettings` below on every save — including
+    // OFF, which used to be un-sendable under the old one-way "ENABLE only"
+    // action field this replaces.
     const {
       localEchoEnabled: _leo,
       cjkInputEnabled: _cjk,
       extendedKeyboardBar: _ekb,
       skin: _skin,
       language: _language,
-      showPlanUsageLimits: _pul,
       showAttachmentsButton: _ahb,
       showFileViewerButton: _fvb,
       webglRendererEnabled: _wgl,
@@ -2360,7 +2364,6 @@ Object.assign(CodemanApp.prototype, {
     try {
       const res = await this._apiPut('/api/settings', {
         ...serverSettings,
-        ...(settings.showPlanUsageLimits ? { statusLineTelemetry: true } : {}),
         notificationPreferences: notifPrefsToSave,
         voiceSettings,
       });
@@ -2624,10 +2627,11 @@ Object.assign(CodemanApp.prototype, {
   // Resolved per-device state of the plan-usage chip. Desktop defaults ON,
   // handhelds default OFF (the mobile block in getDefaultSettings() sets false,
   // and the mobile-header-buttons-policy guard depends on that staying false).
-  // Single source of truth for THREE call sites that must never disagree: the
-  // App Settings checkbox, the chip's visibility, and the statusLineTelemetry
-  // flag sent on session create. A chip shown without telemetry renders "—"
-  // forever, which is exactly the drift this helper prevents.
+  // Single source of truth for the two call sites that must never disagree:
+  // the App Settings checkbox and the chip's visibility. Telemetry COLLECTION
+  // no longer has a THIRD client-side call site here at all — the server reads
+  // this same persisted setting directly (readPlanUsageTelemetryEnabled in
+  // hooks-config.ts), fresh, at every claude session create/respawn.
   planUsageChipEnabled(settings = null) {
     const s = settings ?? this.loadAppSettingsFromStorage();
     return s.showPlanUsageLimits ?? this.getDefaultSettings().showPlanUsageLimits ?? true;
@@ -3127,11 +3131,13 @@ Object.assign(CodemanApp.prototype, {
           'sessionLineageLines',
         ]);
         // The plan-usage chip is a PER-DEVICE display setting (desktop default ON,
-        // handheld default OFF): desktop can show it while mobile stays hidden. It
-        // used to sync, so an older server.json may still carry a value — drop it
-        // so the server value is NEVER
-        // seeded into a device that didn't explicitly enable it (collection is handled
-        // separately via the statusLineTelemetry action, not this display flag).
+        // handheld default OFF): desktop can show it while mobile stays hidden. Drop
+        // the server's stored value here so it is NEVER seeded into a device that
+        // didn't explicitly enable it — even though this SAME setting also drives
+        // server-side telemetry collection now (readPlanUsageTelemetryEnabled in
+        // hooks-config.ts), that's a read the server does directly from settings.json
+        // at spawn time; it has nothing to do with what gets merged into THIS
+        // device's local display preference.
         delete appSettings.showPlanUsageLimits;
         // Merge settings: non-display keys always sync from server,
         // display keys only seed from server when localStorage has no value

src/web/routes/session-routes.ts

@@ -94,7 +94,6 @@ import {
   writeHooksConfig,
   updateCaseModel,
   stripCaseEnvKeys,
-  applyStatusLineConfig,
   applyAgentSkill,
   refreshUserAgentSkill,
   seedAgentSessionPreamble,
@@ -949,27 +948,19 @@ export function registerSessionRoutes(
       await updateCaseModel(workingDir, body.modelOverride || null);
     }
 
-    // Plan-usage statusLine exporter (App Settings → Display → "Plan Usage
-    // Limits"). Claude-only; runs for ANY working dir (linked cases / real repos,
-    // where most sessions live), mirroring updateCaseModel above.
-    //
-    // ADD-ONLY: we never remove on create. Sessions in a repo share one
-    // settings.local.json, so a single create-with-false (e.g. a client whose
-    // synced setting hadn't loaded yet) must NOT yank the statusLine out from
-    // under other live sessions in that repo — that breaks their footer + the
-    // chip's data feed for everyone. The exporter is benign when the chip is off
-    // (the footer just shows session status). isOurs-guarded so a user's own
-    // statusLine is never touched.
-    //
-    // Same guard as the hooks call below (499d355): never for a remote attach
-    // (workingDir is a user@host:session pseudo-path — the mkdir inside
-    // applyStatusLineConfig would create it as a junk local dir), and only when
-    // the caller named a workingDir — the process-cwd fallback is $HOME under
-    // installer-created services, and a statusLine materializing in
-    // ~/.claude/settings.local.json was never asked for.
-    if (!remote && body.workingDir && (body.mode ?? 'claude') === 'claude' && body.statusLineTelemetry === true) {
-      await applyStatusLineConfig(workingDir, true);
-    }
+    // Plan-usage telemetry (App Settings → header chip): no request-time field
+    // here anymore, and NO disk write — a settings.local.json statusLine used
+    // to take precedence over the user's own global/project statusLine for ANY
+    // `claude` run in that directory, including entirely outside Codeman, with
+    // no disclosure and no way to undo it (real bug, found 2026-08-31).
+    // TmuxManager.createSession reads the persisted `showPlanUsageLimits`
+    // setting FRESH at spawn (readPlanUsageTelemetryEnabled in hooks-config.ts)
+    // and resolves it into an EPHEMERAL `claude --settings` CLI flag — never
+    // written to disk, so a plain `claude` run outside Codeman is untouched —
+    // and applies uniformly to every claude creation path (this route, cron,
+    // the Ralph Loop API, quick-start), not just this one. That resolution
+    // also self-heals: it strips any legacy disk-written exporter an older
+    // Codeman build left behind.
 
     // Hooks for the workspace this session runs in (install vs refresh-only is the
     // `workspaceHooksEnabled` setting; see applyWorkspaceHooks). Never for a remote

src/web/routes/system-routes.ts

@@ -5,7 +5,6 @@
  */
 
 import { FastifyInstance } from 'fastify';
-import { getCli } from '../../config/cli-registry/registry.js';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { existsSync, mkdirSync, readdirSync } from 'node:fs';
@@ -33,7 +32,6 @@ import {
 import { subagentWatcher } from '../../subagent-watcher.js';
 import { imageWatcher } from '../../image-watcher.js';
 import { workflowRunWatcher } from '../../workflow-run-watcher.js';
-import { applyStatusLineConfig } from '../../hooks-config.js';
 import { getLifecycleLog } from '../../session-lifecycle-log.js';
 import {
   buildAwayDigest,
@@ -938,7 +936,47 @@ export function registerSystemRoutes(
   // ========== Settings ==========
 
   app.get('/api/settings', async () => {
-    return readJsonConfig(SETTINGS_PATH, 'settings', {});
+    const settings = await readJsonConfig<Record<string, unknown>>(SETTINGS_PATH, 'settings', {});
+
+    // Plan-usage chip default reconciliation (PR #361 follow-up): the client's
+    // own default resolution (planUsageChipEnabled() in settings-ui.js) shows
+    // the header chip and the App Settings checkbox as already ON whenever this
+    // key has never been set — a discoverability default from 1.9.3, unrelated
+    // to consent. Meanwhile readPlanUsageTelemetryEnabled() (hooks-config.ts)
+    // deliberately treats an absent key as "no telemetry" (privacy: never POST
+    // usage data without an explicit persisted yes, pinned by its own unit
+    // tests). Nothing ever reconciled those two independent guesses, so a
+    // fresh install showed a checked box that silently did nothing until the
+    // user opened Settings and hit Save at least once — verified live: an
+    // install that had never touched this setting had NO showPlanUsageLimits
+    // key in settings.json, and its running Claude process's argv carried no
+    // --settings flag at all, i.e. zero telemetry ever collected.
+    //
+    // Resolve it ONCE, here, the first time anything reads settings: if the
+    // key is truly ABSENT (never explicit true or false), persist the same
+    // desktop-default-ON resolution the client already shows, so "chip visible"
+    // and "telemetry collected" become the same fact instead of two defaults
+    // that happen to disagree. readPlanUsageTelemetryEnabled()'s own
+    // absent-means-false contract is untouched — after this runs once the key
+    // is never absent again, so that branch stays correct in isolation (its
+    // unit tests keep passing unmodified) while being unreachable in practice
+    // for any install that has ever called this route. An explicit false the
+    // user sets afterward is respected forever; this only fires on true absence.
+    if (!('showPlanUsageLimits' in settings)) {
+      settings.showPlanUsageLimits = true;
+      try {
+        const dir = dirname(SETTINGS_PATH);
+        if (!existsSync(dir)) {
+          mkdirSync(dir, { recursive: true });
+        }
+        await fs.writeFile(SETTINGS_PATH, JSON.stringify(settings, null, 2));
+      } catch {
+        // Best-effort: the resolved default still reaches this response even
+        // if the write fails, so the caller sees consistent data either way.
+      }
+    }
+
+    return settings;
   });
 
   app.put('/api/settings', async (req) => {
@@ -992,9 +1030,9 @@ export function registerSystemRoutes(
       } catch {
         /* ignore */
       }
-      // statusLineTelemetry and acknowledgeUnauthTunnel are ACTION fields (not stored
-      // settings) — strip them before persisting so settings.json stays clean.
-      const { statusLineTelemetry, acknowledgeUnauthTunnel, ...settingsToStore } = settings;
+      // acknowledgeUnauthTunnel is an ACTION field (not a stored setting) — strip
+      // it before persisting so settings.json stays clean.
+      const { acknowledgeUnauthTunnel, ...settingsToStore } = settings;
       const merged = { ...existing, ...settingsToStore };
       await fs.writeFile(SETTINGS_PATH, JSON.stringify(merged, null, 2));
 
@@ -1007,7 +1045,7 @@ export function registerSystemRoutes(
       // Service toggles resolve from `merged` (existing + incoming), NEVER from the
       // raw request body. A PARTIAL PUT omits keys it does not intend to change, and
       // reading the body directly turned every omission into "apply the default":
-      // a body of just `{statusLineTelemetry:true}` would START the subagent watcher
+      // a body of just `{showPlanUsageLimits:true}` would START the subagent watcher
       // (`?? true`) and STOP the workflow + image watchers (`?? false`), silently
       // undoing the user's persisted config. Reading `merged` makes any PUT reconcile
       // services to the effective stored settings instead, which also self-heals
@@ -1033,22 +1071,23 @@ export function registerSystemRoutes(
         }
       });
 
-      // Plan-usage chip: its DISPLAY is per-device (client-side, see settings-ui.js).
-      // Telemetry COLLECTION is server-side and enable-sticky — when a client turns
-      // the chip ON it sends statusLineTelemetry:true and we (re)inject our exporter
-      // into every ACTIVE Claude session's working dir so the live % starts flowing
-      // immediately (no new session needed). We deliberately never auto-REMOVE here:
-      // the exporter is benign/print-through and a per-repo settings.local.json is
-      // shared by sibling sessions, so one device's "off" must not yank the exporter
-      // another device's chip depends on. Each dir handled once.
-      if (statusLineTelemetry === true) {
-        const dirs = new Set<string>();
-        for (const session of ctx.sessions.values()) {
-          if (getCli(session.mode)?.capabilities.statusLineTelemetry && session.workingDir)
-            dirs.add(session.workingDir);
-        }
-        await Promise.all([...dirs].map((dir) => applyStatusLineConfig(dir, true).catch(() => {})));
-      }
+      // Plan-usage chip: its DISPLAY is per-device (client-side, see settings-ui.js),
+      // but `showPlanUsageLimits` ALSO doubles as the telemetry COLLECTION switch,
+      // persisted here in settingsToStore like any other setting (no special-casing
+      // needed — see readPlanUsageTelemetryEnabled's doc comment in hooks-config.ts).
+      // Telemetry COLLECTION used to be a SEPARATE, action-only, sticky mechanism
+      // here: toggling the chip ON re-injected a statusLine.command into every
+      // ACTIVE Claude session's settings.local.json so live % started flowing
+      // without a new session. That disk write was the bug fixed 2026-08-31 (it
+      // took precedence over the user's own statusline for ANY `claude` run in
+      // that directory, including outside Codeman, with no way to undo it).
+      // Collection is now decided by TmuxManager.createSession/respawnPane reading
+      // `showPlanUsageLimits` FRESH from settings.json at spawn time — no
+      // per-session field, no per-request threading through cron/Ralph-loop/
+      // quick-start/interactive-create (they all reach the same read), and no
+      // (re)injection into an already-running session needed here: the NEXT
+      // respawn (a Ralph cycle, `/clear`, a PTY-exit restart) already picks up
+      // whatever this PUT just persisted.
 
       // Handle tunnel toggle dynamically
       if ('tunnelEnabled' in settings) {

src/web/schemas.ts

@@ -524,8 +524,6 @@ export const CreateSessionSchema = z.object({
   effort: effortLevelSchema,
   /** Model override to write to .claude/settings.local.json (e.g., "opus[1m]"). Empty string clears. */
   modelOverride: z.string().max(50).optional(),
-  /** Inject the Claude statusLine source for the shared plan-usage chip. Claude sessions only; Codex is host-polled. */
-  statusLineTelemetry: z.boolean().optional(),
   openCodeConfig: OpenCodeConfigSchema,
   codexConfig: CodexConfigSchema,
   geminiConfig: GeminiConfigSchema,
@@ -1298,13 +1296,11 @@ export const SettingsUpdateSchema = z
     showFileBrowser: z.boolean().optional(),
     showSubagents: z.boolean().optional(),
     showMultiMonitorButton: z.boolean().optional(),
+    // Doubles as the plan-usage telemetry COLLECTION switch, read fresh from
+    // disk by readPlanUsageTelemetryEnabled() (hooks-config.ts) at every claude
+    // session create/respawn — not just the chip's DISPLAY preference. See that
+    // function's doc comment for why one persisted field serves both.
     showPlanUsageLimits: z.boolean().optional(),
-    // Action field (NOT persisted as a setting): when true, (re)injects the
-    // plan-usage statusLine exporter into active Claude sessions so live usage %
-    // starts flowing. Sent on ENABLE only — the chip's DISPLAY is per-device
-    // (client-side), but telemetry COLLECTION is server-side, so the per-device
-    // toggle signals it out-of-band here rather than via showPlanUsageLimits.
-    statusLineTelemetry: z.boolean().optional(),
     showRedrawButton: z.boolean().optional(),
     // Input
     gestureControlEnabled: z.boolean().optional(),

src/web/server.ts

@@ -1450,7 +1450,10 @@ export class WebServer extends EventEmitter {
     // PER-DEVICE by the client (settings-ui.js applyHeaderVisibilitySettings). It
     // used to be server-revealed from a synced setting, but that leaked the desktop
     // choice onto mobile — display is now per-device only (like the response viewer).
-    // Telemetry collection stays server-side via the statusLineTelemetry action.
+    // Telemetry collection stays server-side, reading `showPlanUsageLimits` fresh
+    // from settings.json at every claude session create/respawn (see
+    // readPlanUsageTelemetryEnabled in hooks-config.ts) — the same setting this
+    // display-visibility check reads, doing double duty.
     // Detached single-session ("solo") window: inject the target session id so
     // the client can enter solo mode even if a (network-first) service worker
     // later serves a cached shell. The client primarily detects solo mode from