3 Commits

Include renames

Author	SHA1	Message	Date
DevvynandClaude Sonnet 5	5fc391a47c	fix(custom-model): address fourth pre-merge review + merge upstream master (Ark0N) ... Merged upstream/master (22 commits: reboot-restore recovery feature, terminal keycode229 recovery work, install.sh/CLI-catalog generator changes, CHANGELOG/version bump to 1.30.0) into this branch. No conflicts; git auto-merged every overlapping file (CLAUDE.md, docs/api-reference.md, app.js, index.html, styles.css, routes/index.ts, session-routes.ts, schemas.ts, server.ts). Two required fixes from the latest review: 1. privilegedEnvKeys widening (stock.ts) changes behaviour outside this feature. The reviewer decided to keep both CLAUDE_CODE_MAX_CONTEXT_TOKENS and CLAUDE_CONFIG_DIR listed (types.ts's rule that every traffic- redirecting var this feature introduces must appear there stays literally true), and asked for the real consequences documented instead of hidden: - Corrected session-env-clamp.ts's fileoverview, which stated the opposite of what the code now does (reboot-restore's clamp call used to be able to strip nothing for claude; it now strips a persisted CLAUDE_CONFIG_DIR for a non-granted owner). - Corrected the rationale comments in stock.ts: privilegedEnvKeys has exactly one consumer (ownerClampedEnvKeys, feeding the generic envOverrides clamp on create/quick-start/reboot-restore), not the custom-model routes. - Added a CLAUDE.md line to the CLAUDE_CONFIG_DIR gotcha covering the admin-only-in-multi-user-mode and reboot-restore-strips-it consequences. - Added a "Claude multi-user clamp" test next to the existing DeepSeek/OMP ones, pinning the new stripping behaviour. 2. GET .../running-status (custom-model-routes.ts) no longer passes the raw llama-swap `cmd` field (the literal launch line, which can carry model paths and --api-key) to the browser -- the frontend only ever reads model/state, cmd exists solely for server-side parseCtxFromCmd() during discovery. Added a test asserting the response never contains cmd or a planted secret. Also regenerated config/clis.stock.json and install.sh's catalogue block (npm run generate:cli-catalog) to clear drift introduced by the upstream merge, since it was failing the sync check. Left to the reviewer, as they said they'd take at merge: the two "comments pointing at removed code" cleanups, the two stale CLAUDE.md counts, and the small items list (mode==='claude' frontend branch, isCliAvailable() unknown-id gap, shared confirmed flag ordering, one-shot cancel toast severity, pumpLlamaSwapLogTail buffer cap). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ea59JhUmHBm1gRCsiYF33R	2026-09-19 18:05:51 +08:00
Michael GrundbergandClaude Opus 5	fbede5cd2a	fix(sessions): act on the dual review of the reboot-restore route ... Fifteen findings from two independent reviews of #442, three of them blocking. Every one is addressed here. The three blockers all sat in the restore route. A rebuild that threw after addSession left a registered session with no pane behind it, visible on the board, holding a layout slot and written to state.json, with its plan entry already spent; the catch now cleans the session up and puts the entry back. The loop checked neither the global nor the per-user session cap, so one click could take a board past a documented limit; capacity is now re-checked per iteration, because the loop is itself creating the sessions it counts. Worst of the three, a rebuilt session carried none of the state its constructor has no parameter for and then persisted itself over the record that held it, zeroing token and cost totals and dropping the pin. The pin matters most: pruning keeps a record only while it is pinned, so discarding it handed the record to the next stale sweep. A new reapplyPersistedSessionState() on the session port restores the pin, the token totals, auto-compact, auto-clear, auto-resume, nice priority, the flicker filter and the custom-model selection, and it runs before both startInteractive and the first persist. The rest, in the order they bite a user. Every rebuild failure was reported as workspace-missing, so the banner told users their repo was gone when the agent had simply failed to start; there are now distinct reasons, and the toast names each one. The client read restored and skipped off the outer response object rather than through the uniform envelope, so every count came back zero and neither toast ever fired. A board left open across the reboot never learned an offer existed, because the banner was seeded only on the page-load path; it now re-reads on every SSE init. The workspace check was existence-only, skipping the multi-user confinement that the create route applies, so a withdrawn grant would not be noticed. The banner had no phone breakpoint while its text was nowrap and its buttons could not shrink. Smaller: a missing workspace is now re-offered rather than dropped, while an already-open conversation is dropped rather than re-offered forever; a throw anywhere in the route returns the unspent entries instead of discarding the plan; the single flight is keyed by owner, since take() already stops two callers receiving one entry; the env clamp's header no longer claims a protection it cannot provide on this path today, and names the check that does bite; the three endpoints are documented in docs/api-reference.md; and the module header now says that os.uptime() reads the host's clock, so the feature is effectively off inside a container. The review also explained why the tests missed all of this: they proved the construction claim through their own copy of the construction rather than through the route, and the route tests used workspaces that did not exist, so no Session was ever built. test/routes/reboot-restore-rebuild-failure.ts mocks the Session module to drive the route's real path, and covers the cleanup, the reason reported, the re-application ordering, the broadcast and the caps. The mock route context gains the port method and the mux call the route needs. Refs #411 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-16 11:44:37 +02:00
Michael GrundbergandClaude Opus 5	da933d70be	feat(sessions): offer to rebuild the sessions a host reboot destroyed ... A host reboot takes the tmux server down with it, so every pane dies, reconciliation finds nothing to attach to, and the board comes up empty. Picking yesterday's work back up meant finding each conversation in history and resuming it by hand, one at a time. The boot pass now works out what the reboot killed and leaves it on offer. It runs inside restoreMuxSessions(), in the window where reconciliation has reported the dead sessions and cleanupStaleSessions() has not pruned their records yet, which is the only place the records can still be read. The board shows a banner, and nothing is created until the user clicks it. A click rather than an automatic restore is what makes the reboot heuristic acceptable. The heuristic cannot tell a reboot from a crash that took tmux down inside the same window, so it decides whether to ASK, never whether to act: a wrong yes costs a line of text the user dismisses instead of N CLI processes nobody asked for. Four things are re-checked when the click arrives rather than trusted from boot, because hours can pass and the board moves on. The owner's privilege grant re-resolves through the env clamp. The workspace must still be on disk. A conversation the user already resumed by hand from the Resume list is skipped, since two panes running --resume on one conversation would fight over the same transcript. Entries leave the plan synchronously before the first await, and the route is single-flighted, so a double-click or two devices cannot both reach the same entry. A restored session comes back attached, idle and disarmed. Respawn controllers and Ralph loops are deliberately not re-armed: a machine that just came up is the worst moment to turn an autonomous run loose. Its workspace hooks are installed by the restore route itself, because the boot-time sweep sits behind a gate that is false after a reboot and has finished long before the click; without them a session goes silently blind, with no stop or idle events for respawn, no Approvals Inbox item and no red tab on a blocking dialog. Stats collection starts the same way. The pane is new, so the conversation continues and the terminal scrollback does not. The banner says so rather than letting an empty pane read as a broken restore. The plan lives in memory only. A server restart drops it, which costs the convenience this adds and never the conversation: the conversation is the transcript under ~/.claude/projects, which the Welcome screen's Resume list and the Session Manager already read, so a dropped plan returns the user to resuming by hand. clampEnvOverridesForOwner moves to src/session-env-clamp.ts, since the question it answers is about session privilege rather than about HTTP and it now has a caller outside the route layer. Its test hook stays re-exported from session-routes.ts. Claude sessions only for this pass. The other CLIs name their thread in their own config object, which this does not thread through yet. Remote and docker sessions are skipped on purpose, because both need another host or a container to be up and a freshly booted machine cannot promise either. Refs #411 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-16 08:05:55 +02:00