104 Commits

Include renames

Author	SHA1	Message	Date
Michael GrundbergandClaude Opus 5.5	b80d47aff8	feat(session): close sessions whose agent exited cleanly (#486) ... * fix(cleanup): keep .claude-images while a sibling session uses the same dir cleanupSession() recursively removes {workingDir}/.claude-images. That directory belongs to the working directory rather than to the session, and several sessions routinely share one case directory, so closing one session deleted the pasted images a live sibling still referred to. The removal now runs only when no other live session has the same working directory. A session that is itself being cleaned up does not count as live, so two sessions of one case closed together still remove the dir. Split out ahead of the exited-agent sweep for Ark0N/Codeman#446, which closes sessions unattended and would otherwise make the loss routine. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * feat(session): close sessions whose agent exited cleanly (#446) Part 2 of Ark0N/Codeman#446. Part 1 records an exited agent as SessionState.paneExit. A session whose agent the user ended with /exit is now closed through cleanupSession(), the same path the X button takes, so finished sessions stop piling up on the board. The lifecycle log records the reason as "agent exited cleanly (status 0)", and the conversation stays resumable from the Resume list. shouldCloseCleanlyExitedSession() in the new pure module pane-exit-sweep.ts holds the rule. It closes a session only when all of these hold: - The exit status is an explicit numeric 0 with no signal. An absent status is how a SIGKILL presents on tmux 3.2a, so it counts as unknown and the row stays. A non-zero status or any signal also keeps the row, with the exit code on the tab. - Two authoritative pane reads agreed on that exit. TmuxManager.getPaneExitReadCount() counts them, and a failed, empty or skipped read neither confirms nor resets the count. - No start, attach or relaunch is running for the pane. Session.paneLifecycleInFlight covers _setupOrAttachMuxSession(), whose dead-pane branch revives an exited pane on purpose, and restartCli(). setPaneExit() already scopes paneExit to local mux-backed sessions, so remote, docker and direct-PTY sessions are never closed. planRebootRestore() now refuses a record whose persisted paneExit is a clean exit. That covers an agent that exited just before a reboot, before the sweep reached it. A crashed agent's record stays eligible, like its row. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(web): show "exited" on the phone overview and desktop home rail (#446) Part 1 of Ark0N/Codeman#446 taught the tab strip and the rich rail rows to say that a session's agent has exited. The phone overview and the desktop home rail still said "idle", beside a green or pulsing dot. _mobileOverviewExit() in mobile-overview.js is now the one rule for all three surfaces, and _sidebarRichRow() uses it as well. It changes what a row shows and leaves the row's state alone, because the state still picks the section and the sort order. An exited row gets an "exited" pill, a neutral dot and row accent, and a duration measured from when the server first saw the pane dead. A pending permission prompt or question still wins, as it does on the tab. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(cleanup): close the gaps review found in the #446 sweep and image guard Four fixes from a dual review of Ark0N/Codeman#446 part 2. - The .claude-images guard compares canonical paths, so a sibling that reaches the same directory through a symlink keeps it. Its comment used to say that case only missed a deletion; it caused one. - A detached session counts as a live sibling. DELETE ?killMux=false removes it from the server's map while its pane keeps running, so the guard now reads persisted records too, and exempts only sessions being killed rather than every session in cleaningUp. - A session being closed refuses startInteractive() and startShell(). The /interactive route awaits listener setup before the start, and a start that raced the close could launch a CLI in a tmux session whose record was then deleted. A failed close clears the mark again. - The clean-exit sweep tries each exit once, keyed by session id and the exit's at stamp, so a close that fails is not retried and logged every two seconds. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix(session): keep a clean exit that lands within 10 s of a pane start (#446) A CLI that prints a startup error ("not logged in", a bad profile, a config error) and exits 0 used to lose its tab, and the error with it, about 4 s after launch. The sweep now keeps any clean exit that lands within CLEAN_EXIT_MIN_PANE_LIFETIME_MS (10 s) of the last start, attach or relaunch finishing (Session.paneStartedAt, stamped when _withPaneLifecycle ends). The row stays as "exited (0)" for the user to read and close. Verified on an isolated instance: a shell that ran `exit 0` 2 s after start kept its row, one that exited after 13 s was closed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-24 22:18:07 +02:00
Michael GrundbergandClaude Opus 5	90fd0a5a15	fix(tmux): gate the pane-exit read, and mute the dot on the rich rail too ... Four changes the maintainer asked for on Ark0N/Codeman#446 before merging. The pane-exit watcher stays always-on, but a tick now costs nothing when there is nothing to observe. `hasObservablePaneSession()` skips the tmux exec while every session on the manager is one of the shapes `Session.paneExitApplies` already forces to UNKNOWN: a remote SSH session (its local pane holds the ssh client), a docker case (a `docker exec` into the container's own tmux), and a record rebuilt from the socket (no provenance at all). The timer is untouched. Skipping retracts nothing, for the same reason a failed read does not: the map still holds the last real reading, and every path that puts a new command in a pane calls `clearPaneExit()` itself. The two copies of that rule are pinned against each other in `test/session-pane-exit.test.ts`, because drift between them is silent in both directions. `DEFAULT_PANE_EXIT_INTERVAL_MS` was already a constant beside the stats and remote-reconnect intervals; its comment now says why the watcher owns its own cadence and why the number is what it is. The never-default-an-absent-status rule is written where `PaneExit` is declared. It names `status ?? 0` as the thing never to write, and says that an agent the OOM killer took would otherwise read as a user typing `/exit` — which is what absent-stays-absent keeps a later clean-exit sweep away from. Nothing fails when somebody adds that `??`, which is why the sentence is there rather than a test. Checking the dot's specificity found a second fight, and it was losing. On the tab strip the alert rules win as intended: a session that exits with a permission dialog pending still renders red, and yellow for an idle alert. On the rich vertical tab rail they did not — that rail's own `tab-state-*` dot rules are (0,9,1) against the strip's mute at (0,5,0), so an exited session there kept a full green dot AND the working halo beside a badge reading "exited". The rail twin matches that specificity exactly and therefore must stay below those rules in source order; it clears the halo as well, which the strip's rule never had to think about. `test/session-pane-exit-ui.test.ts` now resolves the real stylesheet in jsdom rather than matching selector text: postcss collects every rule that paints `.tab-status`, a real engine decides, and the tests read back the answer. Two mutations were run against it to prove it has teeth — dropping the hand-written alert exclusions fails three cases, and moving the rail twin above the state rules fails one. Refs Ark0N/Codeman#446. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-22 09:19:55 +02:00
Michael GrundbergandClaude Opus 5	02dc46dcd7	feat(tmux): report a dead pane's exit from the batched pane list ... Codeman creates every tmux pane with `remain-on-exit on`. When the agent exits, tmux keeps the pane, the tmux session, and the `tmux attach-session` process Codeman records as the session's pid, so no PTY exit handler fires and nothing writes the exit down. tmux itself knows: it marks the pane dead and reports the exit status. This reads that. `PANE_LIST_FORMAT` gains `#{pane_dead}`, `#{pane_dead_status}` and `#{pane_dead_signal}`, and `startPaneExitWatcher()` refreshes a muxName-to-observation map from ONE batched `tmux list-panes -a` per tick. Boot reconciliation already ran that same call, so it now fills the map too and recovery starts with a reading. The watcher owns its own interval rather than riding `startStatsCollection()`, which the issue suggested. That collector is armed when a browser opens the Monitor panel and DISARMED when it closes it, and boot skips it entirely unless recovery found a live session, so a session created on a freshly booted server would publish nothing and one browser could turn detection off for every other. Measured on an isolated instance: a dead pane with status 0 reported nothing until `POST /api/mux-sessions/stats/start` was called by hand. It is still one batched read per tick; only the timer changed. Three rules keep a positive answer trustworthy. A session answers only when tmux listed exactly one pane for it, because Codeman never splits a pane and a session the user split by hand has none that speaks for the agent. A pane answers only when `#{pane_dead}` said 1 or 0, because an empty field is a tmux that did not answer. An absent status stays absent rather than becoming 0: measured on tmux 3.2a, a SIGKILLed pane reports neither a status nor a signal, and calling that a clean exit would be wrong in the direction that matters. Two guards stop a slow read undoing a fast one. `EXEC_TIMEOUT_MS` is 5000 ms against a 2000 ms interval, so a read can outlive two ticks: one already in flight suppresses the next, and a generation counter that every `clearPaneExit()` bumps discards a read that started before a respawn or a kill. An observation also carries its pane pid, so a second command in the same pane that exits the same way starts a new timestamp rather than inheriting the first death's. A non-empty read of `list-panes -a` is authoritative for the whole socket, so sessions missing from it are pruned, which also bounds the map as tmux sessions come and go outside `killSession()`. A failed or empty read retracts nothing. The manager reports the raw pane reading and applies no session-shape scoping, because the remote-reconnect watcher beside it needs exactly that raw reading. `parsePaneList` becomes `parsePaneRows`, returning one row per pane instead of a name-to-pid map; reconciliation builds its map from the rows. The parser's existing cases carry over unchanged, including the launchd/systemd literal-tab regression from PR #71. Refs Ark0N/Codeman#446. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-21 10:00:54 +02:00
RandalixandClaude Opus 5	e271a65e79	Merge origin/master into feat/remote-host-wake ... Resolves CLAUDE.md count tables (route counts recounted on the merged tree: 235 handlers, sessions 37) and keeps both the host-wake and the reboot-restore banner in index.html. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdGP4jUTjc9J2RYYykDrCG	2026-09-18 22:20:41 +02:00
Codeman maintainer	5b920cb43d	feat(sessions): land auto-naming opt-in, in the prefix form, from the first user prompt only ... Finishes #376. The contributed keystroke tracker sat on the raw byte stream and named tabs wrong five ways (every prompt, every write path, a bare Esc eating the next prompt's first character, pasted newlines as Enter, any CSI clearing the draft) and replaced the whole name, which dropped the case from the tab and reset the w<n> counter. This lands the feature with each of those closed: - First prompt means the first: applyAutoName() flips a placeholder to `auto` whether or not the string changed. nameSource is now the tri-state placeholder | auto | manual; the name setter is the only manual path. - Only user-originated input counts: write()/writeViaMux() take SessionWriteOptions.fromUser, set by the browser WS path and POST /input only, so Ralph, respawn, cron, approvals and the trust-dialog keys can never name a tab. A startMode 'shell' CLI never feeds the tracker (a capability, not an id check); the send-key route feeds trackUserInput() because its line feed bypasses the session. - Prefix form `w3-case: title`: parseSessionPrefix() already renders it as the title with the prefix in the tooltip and the next-session counter still matches it. Composed within MAX_SESSION_NAME_LENGTH. - Tracker rules per key: bare Esc resolves at chunk end; mouse/focus reports, Tab, cursor keys, Shift+Tab are no-ops; Up/Down and Ctrl+P/N/R taint the draft so Enter submits nothing rather than a fragment; bracketed-paste newlines and Ctrl+J / Shift+Enter join with one space; the draft keeps its head past 8192 code points; an escape past 64 bytes is abandoned. - Title: slash commands by shape (a path is a prompt), `!` escapes refused, first sentence only past 8 code points ("e.g." is not a title), 72 code points on a word boundary. - Synced `autoNameSessions` setting, default OFF (the prompt reaches mux-sessions.json, session:updated and /api/search), App Settings -> Appearance -> Tabs, read fresh per prompt after the eligibility check. Tests: test/session-auto-name.test.ts (tracker, title, composition, ownership, emit gating), the wiring test (once, prefix, setting off, manual protected), test/routes/session-name-routes.test.ts (PUT /name flips to manual and persists). Verified live on an isolated instance: API and browser-typed prompts name the tab, a second prompt does not, shells and renamed tabs are untouched, nameSource survives a restart. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-15 17:59:16 +02:00
Codeman maintainer	c4322513d9	Merge pull request #376 from shenlvkang-collab/feat/auto-session-names-upstream	2026-09-15 17:19:57 +02:00
Randalix	8b5a13435a	feat(remote): host-unreachable banner, manual wake, and native MAC wake-on-LAN ... The reactive wake (typing into a session whose host slept) left the state invisible: nothing told the user the machine was asleep, and with no wake target configured there was nothing to do about it. Adds: - RemoteHost.wakeMac (comma-separated) - Codeman builds and broadcasts the magic packet itself (UDP port 9), so the common case needs no external script. The existing wakeCommand stays as the explicit override. - GET /api/sessions/:id/reachability - probes (throttled, cached, and it never wakes) and reports HOW the host can be woken, or that nothing is configured. - POST /api/sessions/:id/wake - wakes, waits, reattaches the pane and flushes buffered input; 400 with a routable message when no target is configured. - The amber host-unreachable banner + its 'Wake' / 'Configure WoL' action, and a small config dialog that saves via PUT /api/remote-hosts/:id. - RemoteWakeDeps.resolveRemote: host config is re-resolved for LIVE sessions (throttled + cached), so saving the dialog takes effect without a restart.	2026-09-15 14:20:31 +02:00
Randalix	a81f430e41	feat(remote): wake a sleeping host from user input (Wake-on-LAN) ... A durable remote session survives SSH drops (COD-104/108), but nothing brought the HOST back: after the remote machine suspended, the local tmux pane's ssh child stalled silently and `send-keys` SUCCEEDS against it, so typed input vanished with no error anywhere. Add an optional per-host `wakeCommand` (Wake-on-LAN wrapper, e.g. whuff) that the input route runs when a wake-enabled host is unreachable: input is buffered, the host is woken, the pane is reattached, and the buffer is flushed in order. Detection is a throttled bare TCP probe on wake-enabled hosts only, and only REAL user input may wake a host - the auto-reconnect watcher and boot recovery deliberately cannot, or the host would be re-woken seconds after every suspend and could never stay asleep.	2026-09-15 10:25:52 +02:00
Codeman maintainer	9591b973cf	fix(docker): carry the owned flag on the wire the way master already does ... The cherry-picked "copy an existing case" commit declared a second `CaseInfo.docker.owned` and emitted `owned: true|false` on every docker case, while master had meanwhile shipped the same field from the adopted-container work with a narrower wire shape: `owned` is present only when false, absent means owned. Two declarations failed typecheck, and two emit styles on one response would have made the picker's answer depend on which read path filled it. Keep master's shape at both response sites (the case list and the single-case lookup, which lacked the field entirely), fold the picker's reason for the field into the existing doc comment, and repoint the test that pinned "set on exactly two sites" at the surviving form, adding a negative pin so the duplicate style cannot come back. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-14 23:56:19 +02:00
d fei	7a5543da09	feat(docker): add "copy an existing case" to the adopt panel ... The backend already lets one adopted container back several cases pointing at different in-container directories, but using it meant retyping the container name, host and workspace one by one — exactly the friction that leaves a capability unused. Picking an existing case from a dropdown now carries those three over, leaving only the two fields that must differ: the case name and the in-container directory. Clearing those two is the point of the feature, not a convenience: keeping the old name is refused by the server as "case already exists", and keeping the old directory is refused as "a twin case on the same container and directory". Both errors are clear, but a form pre-filled with values that are guaranteed to be rejected is a trap. Focus lands on the in-container directory — the thing the user came here to change. ⚠️ Only adopted containers are listed (docker.owned === false). A Codeman-built container's lifecycle belongs to its one case — a second case would be torn out by that case's recreate or delete — so the server refuses it anyway, and listing it here would only manufacture a baffling error. `owned` may be absent and absent means owned, so the test is `!== false`, not truthiness. CaseInfo.docker gains containerWorkdir and owned for this: the former is the "which directory does this case use" half of the picker, without which the user cannot tell what to change it to; the latter backs the filter above. ⚠️ Both places that build a docker CaseInfo (the list endpoint and the single-case query) must set them — filling in only one makes the picker work or not depending on which read path was taken, and a test pins "exactly two". (cherry picked from commit f1ed3a58e1)	2026-09-14 23:56:19 +02:00
Codeman maintainer	942bf37e48	fix(custom-model): unset injected env on clear, resume on restart, select the model for pi/omp/grok ... Custom Model Endpoint Profiles (#393) let a session point its CLI at a custom OpenAI-compatible endpoint by injecting env vars or a config file and restarting the CLI in place. Review of the apply path found four things, two of them destructive. This lands all four plus the smaller items from the same review. 1. Clearing a selection did not clear it. The injected vars reach the CLI via `tmux setenv`, which persists at the tmux-session level and is inherited by `respawn-pane` (measured: `setenv FOO bar` survived two successive `respawn-pane -k`), so deleting the keys from the session's envOverrides relaunched the CLI still pointed at the old endpoint, and for the configDir kinds at a HOME/CODEX_HOME/GROK_HOME that had just been deleted. `Session.setCustomModel()` now reports the removed keys, queues them (`_pendingEnvUnsets`), and `RespawnPaneOptions.unsetEnvKeys` carries them into `applyEnvOverrides()`, which `setenv -u`s them before re-applying the live overrides, on the same path that already unsets the legacy CLAUDE_CODE_EFFORT_LEVEL. Verified on a private tmux socket that `setenv -u HOME` hands the next respawn the global HOME back. 2. Applying a model to a local claude session killed the pane. The relaunch was `claude --session-id <id>` and Claude refuses an id that already has a transcript, and unlike the dead-pane respawn this one kills a working pane first. `restartCli()` now pins the live conversation id as the resume id for that respawn when the CLI's launch declares a `fallback` chain, which renders the same `--resume <id> || --session-id <id>` shape the docker and remote pane commands use. Gated on the registry shape, not the CLI id: an entry whose resume id is minted by the CLI itself never declares that chain. 3. pi, omp and grok wrote their config file and then launched without the `--model` that selects it, so the file was ignored. The registry entry now declares `customModelInjection.launchModel` (`custom/{modelId}` for pi and omp, grok's `[model.codeman-custom]` block name), the builder renders it, and `_withCustomModelLaunchModel()` applies it onto the respawn options through `legacyConfigField`, leaving the stored <Mode>Config untouched so a clear falls back to the user's own model. A model id the CLI's `model` token pattern cannot carry is refused with a 400 rather than silently dropped by the argv engine. 4. Remote (SSH) and Docker sessions reported `restarted: true` and changed nothing: their `restartCli()` reattaches the durable tmux rather than relaunching the agent, and the env lands on the local pane. Both are refused with a 400 until those paths are plumbed. Smaller items from the same review: - The selection survives a Codeman restart as the disk-only `__customModel` bookkeeping (endpoint, model, injected key NAMES, config dir, launch model; never the values, which carry the API key). Recovery re-derives the values from the endpoint store through the same apply path the route uses and keeps the bookkeeping even when the endpoint is gone, so a later clear still has keys to unset. - Discovery goes through `webviewFetch()`, so the RESOLVED address is judged by the same egress guard the web-tab proxy uses, and `baseUrl` reuses `webviewUrlSchema` (http(s) only, no embedded credentials, link-local and cloud-metadata addresses refused). undici's `fetch failed` wrapper is unwrapped so the user sees the ECONNREFUSED underneath. - `custom-model-hosts.json` is written 0600 via tmp+rename, the per-session config dir 0700/0600 (pi and omp embed the key literally), and that dir is removed with the session. - `PR.md` is gone from the repo root and the design doc moved to `docs/custom-model-endpoints-plan.md` with the LAN address and the personal name scrubbed; every reference follows. The guide's `authStyle` text matches the shipped schema (`bearer | api-key`, default `bearer`) and says that `customModelEndpointsEnabled` is read by nothing until the picker lands. - `config/tsconfig.scripts.json` typechecks `scripts/test-local-llm-harnesses.ts` (four real type errors fixed). It is not yet wired into `npm run typecheck` because that line differs on master; adding `&& tsc -p config/tsconfig.scripts.json` there is the one-line follow-up. Tests: `test/session-custom-model-restart.test.ts` drives a real Session and fails on the unfixed code for items 1 to 3; the route suite covers item 4 and the pattern refusal; `test/tmux-manager.test.ts` pins that the unsets run before the overrides and that a shell-metachar key never reaches tmux. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-14 23:46:28 +02:00
Codeman maintainer	1e42cb4e2d	Merge pull request #393 from opticon454/feature-custom-llm-server-support ... feat: Custom Model Endpoint Profiles (local or cloud, all harnesses)	2026-09-14 23:46:27 +02:00
DevvynandClaude Sonnet 5	41416566aa	feat(custom-model): Custom Model Endpoint Profiles (local or cloud, all harnesses) ... Point any Codeman-supported harness (Claude, opencode, Codex, Gemini, Pi, Grok, DeepSeek, OMP) at a custom OpenAI-compatible endpoint instead of its native cloud backend, for a given session. Covers local hardware (llama.cpp, Ollama, vLLM, DGX Spark, Strix Halo) and cloud (Azure AI Foundry, OpenRouter). Off by default (customModelEndpointsEnabled, synced, default OFF). - Registry: capabilities.customModelInjection per CLI entry (env / configContentEnv / configDir / unsupported kinds) - Pure injection builder (custom-model-injection.ts) turning an endpoint + model id into the real env vars / config content per CLI - Endpoint store + CRUD routes (custom-model-hosts.ts, custom-model-routes.ts), discovery via GET /v1/models, SSRF-guarded - Session integration: Session.setCustomModel()/restartCli() (POST /api/sessions/:id/custom-model), reusing the existing respawn-pane -k primitive to restart the CLI process with new env - Multi-user hardening: every new redirect-capable env var added to its CLI's privilegedEnvKeys, closing a pre-existing gap where several were already reachable via the generic envOverrides field's prefix allowlist - Standalone scripts/test-local-llm-harnesses.mjs: spawns real CLI binaries against a real endpoint outside the web UI, independent of tmux/sessions - Mock-server contract tests (test/fixtures/mock-openai-server.ts) replaying every CLI's injected values through a real HTTP shape Real end-to-end validation against a live llama-swap server (inside a codeman/agent:llm-test Docker image with all 9 CLI binaries) found and fixed three real bugs before they shipped: - Codex's config.toml schema was wrong ([model].default table instead of a top-level model string + [model_providers.custom]); fixing it then surfaced a genuine, documented protocol incompatibility (Codex only speaks the Responses API since Feb 2026, which llama.cpp/llama-swap don't implement) - Claude Code's async session-title-generation call validates ANTHROPIC_DEFAULT_HAIKU_MODEL against its own internal model list and hangs the whole -p invocation on an unrecognized name; documented for chunk 6, worked around in the standalone script only (--bare is NOT safe for a real interactive session, which needs hooks) - The discovery route's authStyle: 'both' option (send both Authorization and api-key headers) reliably hung a real server; removed the option entirely rather than just changing the default Status: draft. Chunk 6 (frontend toolbar/settings UI) not yet built — see PR.md and deployment_plan.md for the full chunk breakdown and confidence table. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017HqNWfmtBU2KN29SvSVWB3	2026-09-13 17:42:35 +08:00
shenlvkang-collabandClaude Fable 5.1	58b4cb06d8	feat(files): let the path picker jump to a typed path and sort by name or date ... The picker's current-folder line was a read-only breadcrumb, so reaching a deep folder meant tapping through every level, and the listing was fixed to name order, so the file an agent had just written was somewhere in a 500-entry list. The current folder is now an editable field: Enter or Go jumps there, a full file path lands in its folder with that file selected, and a path that does not resolve keeps the listing you had and says so, instead of the reset to the root that a stale initialPath gets. A Sort control orders the listing by name or modified time in either direction, folders always first, and the choice is remembered per device like the hidden toggle. Each entry shows a compact modified time (time of day today, month-day this year, else the date). GET /api/filesystem/browse stamps every entry with mtimeMs to make that possible; the stat that already fetched a file's size now serves both, so it is still one stat per entry. Entries without an mtime (an older server, the in-container listing) sort after dated ones and then by name. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01McLWqCWBuQYGuPMScb4Aou	2026-09-10 12:42:33 +08:00
Codeman maintainer	8ee7926e27	feat(agent-cases): tag agent-spawned case dirs and sweep their leftovers ... A long orchestration creates one case directory per worker and deleting the sessions never removed them, so ~/codeman-cases accumulated scratch folders that were indistinguishable from real projects. They are now labelled and have a cleanup path. - src/agent-case-marker.ts: a case dir quick-start CREATES for an agent-driven spawn gets a .codeman-agent-case.json marker (when, by whom, parent session, mode). Only the create branch writes it, so a linked case, a cloned repo or any pre-existing path is never labelled; reading is total, so a malformed marker means "not agent-created" rather than a half-trusted entry. - The signal is the new X-Codeman-Agent-Origin header the skill preamble sets on its shared curl (preamble bumped to 1.22.0), or an agentOrigin body field, falling back to a resolved parentSessionId so a worker spawned by a stale skill copy is still labelled. - GET /api/cases publishes it as agentCreated; GET /api/cases/agent-created is a read-only cleanup listing adding inUse and modifiedAt; Add Case -> Manage badges each case and offers a review-then-delete sweep that names every directory in its confirm and skips any case a live session is working in. Removal stays on the existing DELETE /api/cases/:name. - Agent preamble caches are collected too: ~/.cache/codeman-agent-<id>.sh was written per claude session and never removed (236 leftovers measured on a working machine). Now deleted with the session and swept at boot, guarded by a live-session keep set plus a 7-day age floor. Verified end to end on an isolated instance: marker written for header, body and lineage-only spawns, absent with no agent signal and for a pre-existing directory; inUse flipping on session end; badge, sticky bar, confirm and sweep driven in a browser; preamble seeded on create, removed on delete, boot sweep taking only the aged orphans. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-07 19:09:24 +02:00
Ark0N	bca1b764cc	Merge pull request #367 from shenlvkang-collab/pr/claude-conversation-first-hand ... fix(session): learn the live Claude conversation from the CLI's own hook	2026-09-06 23:02:33 +02:00
Codeman maintainer	8ad2215118	fix(docker): close the three adoption gaps the negative guarantee missed ... Review follow-ups to #357. Each is a path that still touched, or still hid, a container Codeman does not own. **Export still mutated it.** The four fail-closed layers cover create/start/ stop/remove, but `POST /api/docker-cases/:name/export` reaches the container twice through neither: a full export `docker commit`s it, and even a workspace-only export `docker pause`s it first for snapshot consistency. Pause freezes the owner's processes for as long as the tar takes, on a container we promised not to touch. Full export is refused for an adopted case (it packages someone else's container, with their logins, into a bundle Codeman hands out); workspace-only keeps working and no longer pauses, accepting a live filesystem the way `tar` does on any running host directory. **A freshly linked OWNED case became unusable.** The run menu now probes the container for its CLIs, and a failed probe hides every agent mode behind the reason. For an adopted case that is right. For an owned one the container does not exist until the first session launches it, so every newly linked Docker case answered `container "codeman-case-x" not found (adoption never creates a container — start it yourself first)` and offered nothing but Shell, for a container the launch chain was about to create itself. A failed probe is recorded only when the case is adopted; `CaseInfo.docker.owned` is on the wire so the frontend can tell them apart. Verified in a browser: owned-with-no- container offers all ten modes and no notice, adopted-but-stopped offers Shell and says why. **Multi-user gating.** Adoption is admin-only, unlike `docker-link` beside it. Linking creates OUR container, whose sole bind mount `isWorkingDirAllowed` has already confined to the caller's space; an adopted container's mounts are whatever its owner gave it, so one mounting `/` hands the adopter a shell over the whole host — exactly the workspace scoping multi-user mode exists to enforce. Listing the engine's containers and browsing directories inside an arbitrary one are machine-level reads and follow the docker-HOST policy for the same reason. The preflight is deliberately not admin-only: the run menu fires it for every docker case, so it admits a non-admin for a container already linked to a case they can access, and nothing else. Verified end to end against a real pre-existing root container (alpine + tmux, no bind mounts): adopt, claude session inside it, workspace export, session close and case unlink all left `StartedAt`, `RestartCount`, `Pid` and `Paused` untouched; the pane ran the CONTAINER's claude, without `--dangerously-skip-permissions`; a stopped container was refused at both preflight and launch and was never started. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TecFD9hvPYJ1mkkMtBQbT1	2026-09-05 16:22:54 +02:00
Codeman maintainer	3d8ffcb9a2	Merge pull request #357 from dignfei/feat/docker-adopt-existing-container ... feat(docker): attach a case to an already-running container Conflicts came from work that landed after the PR was opened, and each is resolved onto the newer abstraction rather than by keeping the older code: - `defaultDockerCommandForMode` is registry-driven since #347, so the PR's `runsAsRoot` arm became `overlays.docker.rootCommand` (claude only). Claude Code still refuses `--dangerously-skip-permissions` as root in 2.1.261 and the refusal is visible only inside the container, so an adopted root container otherwise just shows a dead pane. Which flag to drop is a per-CLI fact, and `test/cli-registry-no-id-branching.test.ts` forbids expressing it as a branch. - The probe's mode list and its mode -> binary table both duplicated the registry. They now read `enabledCliIds()` / `discovery.binaries[0]`, which is also what fixes the merge's silent regression: the hand-written list predates `omp`, and the run menu gates every docker case on this probe, so owned containers would have lost that mode. `shell` needs no arm — it declares no binary, so it is dropped from the lookup and reported available regardless. - The per-mode `mode === 'claude' && !cliDir` chain in `tmux-manager.ts` is one `missingCliMessage(mode)` gate since #347; the PR's docker exemption moved onto it. Its test now pins the single gate instead of counting seven arms. - The create arm keeps #349's swap-limit warning filter, which the adopted arm never reaches; the run-mode list gains `omp` from #353. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TecFD9hvPYJ1mkkMtBQbT1	2026-09-05 16:21:51 +02:00
codeman-local	268e4819ff	feat: auto-name sessions from first prompt	2026-09-03 18:14:29 +08:00
DevvynandClaude Opus 5	66eb01ba8f	feat(docker): restore in-app self-update in the Compose deployment ... Codeman running under docker/docker-compose.yaml lost the ability to update itself from App Settings -> Updates. The image had no .git (excluded by .dockerignore), so the install reported as "unknown"; there was no init system for detectSupervisor() to find; the runtime stage had neither devDependencies nor a build toolchain; and a pull into the baked /opt/codeman would have landed in the container's writable layer and been discarded by the next `up`. Restore it through configuration rather than a second updater, so the release channel, auto-stash, status file and boot reconcile are all reused unchanged: - The checkout Compose builds from is bind-mounted over /opt/codeman, so the update's git checkout and rebuild land on the host and survive recreation. - The restart is the server exiting; `restart: unless-stopped` relaunches the container on the new dist/. This is the one supervisor whose updater does NOT outlive the restart, which is safe only because the terminal "restarting" marker is written first. - node_modules and dist are named volumes over the bind mount, so container-compiled native modules never enter the host checkout. - The runtime image keeps devDependencies and gains python3/make/g++, since `npm run build` is tsc + esbuild and node-pty has no Linux prebuild. An in-place container update applies code only, because a restart reuses the existing image and config. evaluateEnvironmentGate() reads the target release's own files with `git show <tag>:<path>` and refuses when server.Dockerfile or docker-compose.yaml changed, when .env.example gained keys the user's .env lacks, or when the restart policy would not bring the container back. The missing-key check matters most: Compose resolves an unset ${VAR} to the empty string and starts anyway, so a new required setting would otherwise arrive as a silently blank variable. Every unknown fails open, and the gate is re-evaluated server-side on POST /api/system/update. The four global agent CLIs are pinned, because an unpinned CLI bump is the one environment change no diff-derived gate can see; pinning turns it into a Dockerfile change the gate already detects. Adds test/docker-compose-env-parity.test.ts as the merge-side guard (every compose ${VAR} has an .env.example entry and the reverse) and test/docker-self-update.test.ts for the pure gate decisions. Documented in docs/docker-self-update.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013yAQ2y9t81jzSfpStUxx5T	2026-09-02 19:33:32 +08:00
shenlvkang-collab	ccfda623fe	fix(session): learn the live Claude conversation from the CLI's own hook ... Which conversation a pane is on was re-derived by correlating ~/.claude/history.jsonl against Session.lastSubmitAt — and lastSubmitAt is bumped only by input that flows through Codeman's own write path (Session.write / writeViaMux). A user who attaches to the pane's tmux session directly never set it, so resolveActiveClaudeSessionIdFromHistory() returned at its first line for that pane's whole life and the response viewer stayed pinned to the launch conversation, showing a pre-/clear transcript indefinitely. A UserPromptSubmit hook reports the live conversation id from inside the CLI process, delivered under the pane's own $CODEMAN_SESSION_ID. That binding is a fact rather than a correlation: it never consults workingDir, so it cannot be claimed by a sibling pane on the same folder, a closed tab, or a bare `claude` in the user's terminal. A pane holding such an id skips the correlation entirely, so the number of prompts eligible for cwd-based guessing goes DOWN, never up — the naive alternative (relax the guard, or synthesize an anchor from PTY activity) is the reverted bug the resolver's own comment describes. The hook also stamps lastSubmitAt, so it finally means "a prompt was submitted" rather than "typed into Codeman's web terminal". Conversations vouched for first-hand — and only those — extend a persisted claudeSessionChain, whose tail re-pins the conversation when a surviving tmux session is re-attached after a restart. ⚠️ start() resets the id at THREE points and the last one runs unconditionally after the mux branch, so the tail is applied there too; patching only the mux branch looks right and silently does nothing. ⚠️ The hook's stdout is discarded with curl's own -o /dev/null. Claude Code injects a UserPromptSubmit hook's stdout into the model's context ("Exit code 0 - stdout shown to Claude"), and a trailing >/dev/null does NOT work: curlCmd already ends `... 2>/dev/null || true`, and in `pipeline || true >/dev/null` the shell binds the redirection to `true`, which never runs on the success path. The discard is opt-in so the five SSE-fed events keep byte-identical command text and no workspace's settings file is rewritten for them. The staleness marker is quote-free for the matching reason: hooksJson is JSON.stringify'd, so a quoted needle never matches and the gate would rewrite every workspace on every spawn. Existing workspaces heal on their next Claude spawn through the staleness sweep.	2026-09-01 12:33:24 +08:00
d fei	8e5e207386	fix(docker): send the probe body as an object, and explain an unreachable container ... The run menu still offered every mode for an attached container. The browser's actual request showed why: POST /api/docker-cases/adopt-preflight -> 400 {"error":"Invalid input: expected object, received string"} _api serializes `body` and sets Content-Type itself, and three call sites each passed an already-stringified body, so it was encoded twice and the server saw a JSON string where it expects an object. curl was fine throughout, so nothing in the server logs pointed at it. Also fixes the design defect underneath: a failed probe fell through to "do not gate", which silently offered every mode. When the container has been recreated, is stopped, or the engine is unreachable, the user sees claude, clicks it, and it can only fail — with the reason visible nowhere. A failed probe now hides every agent mode (Shell needs no CLI and stays) and shows the server's own reason at the top of the menu. Two static guards switched from a character window to brace matching. They sliced between two call sites, and _loadRunModeHistory's call appears above its definition, so the slice came out empty and the assertion verified nothing — the same trap twice in one file.	2026-08-29 23:31:28 -07:00
d fei	3685ad85bc	fix(docker): stop requiring the CLI on the host for a container session ... Attaching a container, picking claude and hitting Run gave one line — `execvp(3) failed.: No such file or directory` — and the run-mode menu offered every mode. Three separate defects, found on a real deployment. TmuxManager.createSession resolved the CLI directory without distinguishing a docker session, so a host with no claude threw, the catch fell back to a direct PTY, and that PTY exec'd the CLI on the HOST. The failure surfaced as a bare execvp error naming nothing. A docker session runs its CLI inside the container; the host does not need it. All eight modes now sit behind a cliRunsInContainer guard, and whether the container has the CLI is settled by the adoption preflight or the image gate before launch. The running check used a bare double quote and command substitution. The whole chain is embedded in an outer `bash -c "…"`, so the unescaped quote closed that string early and the remainder was re-tokenized. It is now a `grep -qx` pipeline using only the single-quote form every other line in the builder already uses. Claude Code refuses --dangerously-skip-permissions as root. Our base image runs a non-root user, so an owned container never hit this; an adopted container's user belongs to its owner and is frequently root, and keeping the flag killed the pane with a message visible only inside the container. The preflight now reports runsAsRoot and the launch chain drops the flag for it. The menu also showed every mode because the container CLI probe only started when the menu opened. It is warmed when the case is selected instead.	2026-08-29 23:31:28 -07:00
d fei	2f83a37c6d	feat(docker): take run-mode availability from the container ... The run-mode dropdown hides CLIs that are not installed on the HOST (#201). That is right for local sessions and wrong for a container case, whose agents run inside the container: a host with no claude installed hides the mode while the container ships one, which is exactly what happened on a real deployment. The adoption preflight already probes what the container has, so that result is persisted on the case and surfaced through CaseInfo. Docker cases gate on it; every other case keeps the host probe unchanged. An absent list reads as "do not gate" rather than "nothing available": an owned container runs our base image, which ships every CLI, and treating unknown as empty would leave the menu with Shell alone.	2026-08-29 21:02:19 -07:00
d fei	15eebde832	feat(docker): attach a case to an already-running container ... Docker cases could only run in a container Codeman created itself. Attaching to one the user already built and runs means Codeman must leave that container's lifecycle completely alone, which the launch chain could not do: it was `image inspect` -> `inspect || create` -> `start` -> `exec`. Adds `DockerCase.owned`, mirroring the `owned:false` contract remote-SSH already uses for attached sessions. Absent (every existing case) means owned, so current behaviour is byte-identical. `false` means the container belongs to the user and Codeman may only exec into it. The launch chain for an attached container only looks, then execs: no image gate (the image is theirs), no create, and no `start` — starting a container we do not own is the very mutation attaching promises not to perform. A missing or stopped container fails closed with an actionable message instead. Credential seeding is skipped too: those copies read from create-time read-only mounts that do not exist here, and writing host credentials into someone's container is not ours to do, so its CLIs must already be authenticated inside it. Four fail-closed guards. buildDockerStopCommand and buildDockerRemoveCommand throw during pure string construction, so no caller bug can turn into a `docker stop`/`rm` on a container we do not own; removeDockerContainer refuses again at the lowest layer; drift reports "none" for an attached container, which carries no `codeman.confighash` label and would otherwise always look drifted and 409 the launch gate forever; and the orphan reaper skips attached containers through a check deliberately independent of the two conditions already covering them. `owned` is applied AFTER the config hash is computed. dockerConfigHash takes an explicit field list, so ownership can never shift an existing case's hash — if it did, every pre-existing case would trip the drift gate at once, and the remedy the UI offers is "recreate the container". Adds POST /api/cases/docker-adopt and a read-only POST /api/docker-cases/adopt-preflight. The preflight refuses at LINK time rather than at session launch, where the only ways out would be a dead pane or starting a container we do not own. Tests assert the negative guarantee directly — that create, start, stop, rm, restart and kill are absent from the generated commands while `docker exec -it` and `new-session -A` remain — since it cannot be observed by using the feature.	2026-08-29 21:02:19 -07:00
timkjr	3e1a0e679f	fix(omp): resume by mode, not silently as claude, and support --continue ... resumeHistorySession() never sent mode when recreating a session from a history/session-manager row, so the server default silently opened a plain Claude session for every non-claude row -- reproduced live: OMP rows spawned Claude sessions on click. Thread the row's mode through every call site (welcome list, session manager, mobile overview) and only send the Claude-specific resumeSessionId for claude rows. Codeman has no live PTY-reattach outside server boot, and it's moot for OMP anyway (exiting it kills the pane's only process), so route the non-claude relaunch through each CLI's own continue-most-recent flag instead of a context-free fresh start. OMP never got one: buildOmpCommand only implemented --model/--resume despite omp --help documenting -c/--continue. Added continueSession to OmpConfig end-to-end (type, schema, builder) mirroring the existing opencode/pi/grok/deepseek fields, and wired resumeHistorySession to use it. Verified live: told a real omp session a secret, exited it, closed the tab without killing tmux, relaunched with --continue in the same directory, and had it recall the secret.	2026-08-28 11:32:30 -05:00
timkjr	4f5678fac4	feat(omp): rebase OMP backend onto master (merge Pi + OMP modes)	2026-08-26 20:05:48 -05:00
Codeman maintainer	a628737d1f	fix(deepseek): review-driven hardening across the harness integration ... Fifteen review findings on the dsh mode, the serious ones first: - Multi-user: DEEPSEEK_BASE_URL joins the owner-clamped env keys. _configureDeepSeek() forwards the SERVER's own DEEPSEEK_API_KEY into every dsh pane and applyEnvOverrides() lands after it, so a non-granted owner who could redirect the base URL would have the operator's key sent as a bearer credential to a host of their choosing. - Wait registry: until=stop/blocked is refused on docker and remote-SSH dsh sessions (new deepSeekBridgeUnreachable fact in sessionHookOptions). The HERDR triple is set via LOCAL tmux setenv, which crosses neither docker exec nor ssh, so such a session can never post a hook event and the wait burned its whole timeout on every turn. - Approvals: a dsh item is an ALERT, not an answerable card. The answer route refuses (the '1'/Esc keystrokes are Claude-dialog-shaped and the option parser cannot read a third-party TUI's frames, so an answer was a blind keystroke into a foreign composer), and the push notification carries no Approve/Deny actions for dsh sessions. - Status shim (v3): --seq is forwarded and the server drops stale retried reports inside a 60s window (the TUI retries with backoff, so a retried 'working' could land after 'blocked' and resolve an approval whose dialog was still on screen); 4xx responses exit 0 instead of retrying, so one misconfigured session cannot feed the auth rate-limit bucket until the hook endpoint 429s for the whole instance. - Web-UI server: concurrent starts are serialized through a lock (two racing POSTs used to pick the same port and orphan the winner), and the readiness poll / timeout paths only clear or stop the singleton while it is still theirs. First click actually opens the tab now (refreshWebviews, not the nonexistent loadWebviews). DELETE /api/deepseek/web requires the privileged grant in multi-user mode. - Cron: deepseek jobs run the same two-part launch gate as the HTTP create paths (impl moved into the resolver so all three share it) and no longer stamp a Claude default model on the session. - Parity sweeps: quick-start's docker branch rejects deepSeekConfig like the remote branch; the Ralph auto-enable list gained deepseek; HookEventType gained agent_working; the phone overview run menu filters managed webview records like the desktop menu. - install.sh: the dsh identity probe closes stdin (under curl|bash a child that reads stdin eats the rest of the script), bounds the exec with timeout where available, and is memoized to one scan per install. - Welcome screen: .welcome-btn-deepseek styled in the #4d6bfe brand identity (it rendered as an unstyled UA-grey button); stale markup comment about the web shortcut rewritten; clamp docs updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 19:01:29 +02:00
Codeman maintainer	15ae5f5d81	fix(deepseek): make the web-UI shortcut pick a free port, verify it, and trust its frame ... The `Run > DeepSeek web UI...` shortcut failed three ways at once against a real install, and the three are independent. 1. It hardcoded `--port 3080`. That is dsh web's OWN default, which makes it precisely the port a DeepSeek user is most likely to be serving on already, so the launch died with EADDRINUSE against the user's own server. The port now comes from `GET /api/deepseek/web-port`, which walks 3080..3119 for a free loopback port by BINDING it (a connect probe cannot tell "free" from "listening but not answering yet"). 2. It opened the tab unconditionally. The crashed server left a saved dashboard pointing at nothing, with the failure only visible in a shell tab nobody had a reason to look at. The launch now polls the existing webview probe until the URL answers, and on timeout reports the error naming the shell tab instead of persisting a dead dashboard. 3. The saved tab was untrusted, so the frame was sandboxed without `allow-same-origin` and the dashboard was broken twice over: the dsh client-runtime reads `localStorage` while loading its plugins and died there ("the document is sandboxed and lacks the 'allow-same-origin' flag"), and an opaque-origin frame sends `Origin: null`, so dsh's own trust fence 403'd every `/api` call no matter which authority `--trusted-host` named. Passing `location.host` only means anything once the frame actually carries that origin, so `--trusted-host` had never once done its job. The managed tab is now created `trusted: true`. That trade is real and deliberate: a trusted proxied frame is same-origin with Codeman and can reach Codeman's API. It is defensible only because this dashboard is an agent harness Codeman just started itself, on loopback, which can already run code as the user. It is not a precedent for trusting third-party dashboards, which is why it is set at this one call site rather than defaulted. Separately, the shortcut listed its own dashboard twice: once as the menu entry that starts it and once as the row that entry had written on the previous click. Webviews now carry an optional `managed` marker, managed rows are filtered out of the saved-dashboard list, and a relaunch repoints the existing row rather than stacking one dead dashboard per restart (which the per-launch port would otherwise guarantee). `managed` is declared in the schema because a plain `z.object` strips undeclared keys, so an undeclared marker would never survive the round trip. `DEEPSEEK_WEB_PORT` is gone from constants.js; its doc comment asserted that a hand-started `dsh web` and the shortcut "land on the same place and share one saved tab", which is the bug stated as a feature. Verified on a real install with the user's own `dsh web` holding 3080: the shortcut takes 3081, the server answers, exactly one DeepSeek entry shows in the run menu, and the proxied dashboard renders its workspaces and completes its own API calls (the previously-403'd `api/settings.describe` now succeeds). Full gate green (6142 passed), typecheck/lint/format/public-assets clean.	2026-08-25 02:39:57 +02:00
Codeman maintainer	4cda150493	feat(deepseek): add DeepSeek Harness (dsh) as a ninth CLI run mode ... Adds `mode: 'deepseek'` alongside claude/shell/opencode/codex/gemini/ antigravity/pi/grok, plus a shortcut that opens the harness's own browser UI as a Codeman web tab. DeepSeek is wired unlike its siblings in three ways, each of which is the reason for a design decision rather than an accident: 1. The agent is a PROFILE, not the binary. `dsh` is a launcher over $DSH_HOME/profiles/<name>, and DeepSeek ships only `web`, `headless` and `base` -- the interactive terminal front door is always a third-party plugin. So availability is two questions: `isDeepSeekAvailable()` (binary) and `isDeepSeekRunnable()` (binary AND a pane-capable profile). The Run button gates on the latter, because reporting only the binary would spawn a pane that dies on arrival. When the binary is present but no profile is, the run menu offers to install one (POST /api/deepseek/install-profile). 2. The permission switch is an env var, not a flag. The harness has no command-line permission option; its sandbox/approval rows read DSH_PERMISSION_MODE (read-only / workspace-write / danger-full-access). Exported via `tmux setenv`, never on the spawn line. Absent = the harness's own workspace-write, which still asks, so the multi-user clamp is the only-if-sent branch and clamps to workspace-write, never read-only. 3. It is the only non-claude mode that passes hooksAvailableForMode(), and it earned that. The terminal front door reports idle/working/blocked to a supervising process over a generic env-gated contract; a generated shim (deepseek-status-shim.ts) makes Codeman that supervisor and forwards each report to /api/hook-event as stop / agent_working / permission_prompt. So a dsh session gets definitive respawn triggers, real wait-endpoint signals and real Approvals Inbox items instead of output-stabilization guesswork. `agent_working` is new (157th SSE constant) and joins APPROVAL_RESOLVING_EVENTS so a dialog answered in the terminal clears its alert at once. The resolver needs the strictest identity probe of the family: `dsh` is not merely a squattable npm name, Debian ships an unrelated `dsh` (dancer's shell), so `dsh --help` must print the harness's own banner before a candidate is handed a spawn line. Model is deliberately not a session field -- it is a composition entry in the profile's config tree. Env allowlist gains DSH_* and DEEPSEEK_* only; provider keys named by a settings-file `apiKeyEnv` stay out, which is pi's 34-provider-key problem in a new shape. Verified live against dsh 0.1.1-rc.2 and @deepseek-harness-tui/dsh-tui: the status endpoint's two-part answer, the no-profile refusal, the profile bootstrap, a real session whose pane runs `dsh --profile dsh-tui` with the permission mode injected via setenv, and the full status bridge -- a send-and-wait returned signal "stop" from a real turn, and blocked/working created and cleared an Approvals Inbox item. Docs: docs/deepseek-integration.md (guide), docs/deepseek-integration-plan.md (decisions + honest gaps). Tests: test/deepseek-mode.test.ts, test/deepseek-cli-resolver.test.ts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-24 03:37:56 +02:00
Codeman maintainer	c173ae0264	Merge remote-tracking branch 'origin/master' into worktree-grok-mode ... # Conflicts: # src/web/public/app.js	2026-08-24 00:32:25 +02:00
Aamer Akhter	74194e4fc0	feat(tabs): COD-359 add owner-scoped tab layouts	2026-08-23 14:46:10 -04:00
Codeman maintainer	3f8c8e99d1	feat(grok): add Grok Build (xAI) as a seventh CLI run mode ... SessionMode gains 'grok', a first-class backend alongside Claude Code, shell, OpenCode, Codex, Gemini, Antigravity and Pi: its own PTY, tmux session, charcoal tab identity ('gk' badge), welcome button, run-mode entry, cron agentType, Docker and remote-SSH command defaults, and clone-repo Brain option. Flag surface verified live against grok 1.0.5. Grok mixes two existing shapes and the wiring follows from that: - Codex-shaped on permissions: the bypass switch is GrokConfig.alwaysApprove (--always-approve, grok's bypassPermissions mode; config-level deny rules still apply on top). The Run button sends it true, like runAntigravity(), and clampExternalCliBypassForOwner() puts grok in the only-if-sent branch: a bare grok spawn is grok's own ask-mode default, which is already safe, so only a sent config needs the flag forced off. Cron needs nothing for the same reason. - OpenCode-shaped on rendering: grok is a fullscreen alternate-screen TUI with mouse support, so it stays OUT of isAltScreenStripMode() and lands on the narrow tmux-attach strip and the 'buffer' local-echo fallthrough (unmeasured against an authenticated composer; documented fallback is the 'off' branch). - Pi-shaped on resolution: 'grok' has npm squatters (@vibe-kit/grok-cli also installs a grok bin), so grok-cli-resolver.ts version-probes every candidate (grok --version, killSignal SIGKILL, VITEST-gated) and GET /api/grok/status surfaces path AND version; GROK_VERSION_REGEX is shared with the dependency registry so doctor and run mode cannot drift. Env allowlist gains GROK_* plus the XAI_* vendor namespace (XAI_API_KEY is grok's documented headless auth var), the same narrow-vendor reasoning as GOOGLE_* for gemini. Resume is id-regexed on purpose: grok's own --resume also matches session titles, which are arbitrary user strings that must never reach the bash -c spawn line. Docker: grok is not on npm, so the agent image installs it in its own step (xAI's installer has no --dir override; the binary is copied to /usr/local/bin and root's ~/.grok dropped in the same layer), and credentials are seeded per-file (auth.json, config.toml, pager.toml; the dir also holds sessions/, memory/ and the ~160MB binary). Remote SSH routes through the login-shell wrapper like the other agent CLIs. Verified end to end on an isolated CODEMAN_INSTANCE with grok 1.0.5 installed: /api/grok/status resolves and reports the probed version, quick-start spawns a pane whose command line ends in 'grok --always-approve', the real TUI renders (OAuth device screen on an unauthenticated box), and grokConfig round-trips through state.json. Docs: docs/grok-integration.md (user guide) + docs/grok-integration-plan.md (decisions, verification record, follow-ups). Tests: test/grok-mode.test.ts, test/grok-cli-resolver.test.ts, plus extended clamp/system-routes/render-index-html/run-mode-ui/mobile-overview/ local-echo-gating coverage. npm test (the CI gate) green: 5910 tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-23 08:39:03 +02:00
Ark0N	2073a1b185	Merge pull request #328 from aakhter/repo-status-panel ... Report repository status for git-clone installs (GET /api/system/repo-status)	2026-08-21 02:10:38 +02:00
Aamer Akhter	02e7d3fcba	feat(system): report repository status for git-clone installs ... `GET /api/system/update/check` answers "is there a newer published release tag?", which is the right question for an npm install but not for a git clone that tracks a branch. Such an install can be many commits behind its own remote while the latest tag says it is current, and nothing surfaces that. Adds `GET /api/system/repo-status`: an informational companion that reports what this CHECKOUT looks like against its own remotes — current branch and commit, ahead/behind counts per remote, the remote's role (tracking / upstream / other), and a bounded list of incoming commits. Read-only and defensive: every git invocation is `execFileSync` with an argv array and a timeout, a non-git or remote-less install reports a structured `error` rather than throwing, and nothing here mutates the working tree or touches the updater's own state. Tests: 24 cases in test/repo-status.test.ts.	2026-08-20 12:39:28 -04:00
Codeman maintainer	fa7e700834	fix(terminal): report a click to the CLI only when it asked for the mouse ... Found while verifying Auto Copy in a browser: a plain left click in a claude/codex/gemini pane sent a synthetic SGR mouse report into the PTY whether or not the program in that pane had ever enabled mouse tracking. When the pane holds a plain shell (the CLI exited, or a shell was started inside a session of that mode) readline prints the report as literal text and it garbles the next line typed: $ [<0;88;20Mecho hello bash: 0: No such file or directory The cause is that the browser could not know. The full strip (isAltScreenStripMode) removes the mouse DECSETs from the stream, so xterm's modes.mouseTrackingMode is permanently 'none' for those modes and _sendSyntheticSgrTap() hand-encodes reports to stand in for xterm's own encoder. With no state to consult it had to do that on every click. What the strip removes, the server now remembers. _recordStrippedMouseMode() records each sequence as it is stripped, toState() publishes it as cliMouseTracking, and the browser's _shouldReportMouseToCli() (renamed from _sessionUsesServerMouseStrip) requires it at all three report sites: the desktop click, the touchend tap, and the mobile tap classifier. Details that are easy to get wrong: * Only the tracking modes count (1000/1001/1002/1003). 1005/1006 select an encoding and 1007 is alt-scroll; a CLI that picks SGR encoding without turning tracking on is not asking about clicks, and counting those would put the stray reports straight back. * Modes are held in a Set, so a TUI disabling a mode it never enabled cannot clear the ones that are really on. * The change broadcasts immediately instead of through broadcastSessionStateDebounced: the flag flips when a dialog opens, and the user can click that dialog well inside the 500ms debounce window. * It fails toward silence. After a server restart the flag is false until the CLI re-emits its DECSET, which tmux does at client attach. Verified against a live claude 2.x session: the CLI holds a tracking mode on continuously, so its clicks are still reported byte for byte as before, while a bash prompt in the same stripped mode now reports nothing and types cleanly. The flag also propagates live over SSE in both directions, checked by toggling ?1002h/?1002l from inside the pane. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-20 11:21:29 +02:00
Codeman maintainer	cbc54fc98d	feat(files): play video and audio from outside the workspace too ... A clip an agent wrote inside the workspace played with a working scrub bar, while the same file in /tmp was refused as an unsupported type. The workspace preview classified media with its own inline extension sets and the attachment allowlist had no media at all, so the two paths disagreed about what a video is. - VIDEO_ATTACHMENT_EXTENSIONS and AUDIO_ATTACHMENT_EXTENSIONS now live in attachment-registry.ts and are imported by file-content's classification, so both paths answer the same. mp4/webm/mov/m4v/ogv and mp3/wav/ogg/oga/m4a/aac/flac/opus join the attachment allowlist. - Real MIME types for those extensions. Without one the raw route falls back to application/octet-stream, which a <video> refuses to decode: the player renders and then does nothing. - getAttachmentType() gained the video and audio members of AttachmentDetectedType. Attachment cards have no per-type CSS and their thumbnail falls back to the type label, since the thumbnailer has no media branch and answers 204 rather than spawning a converter. - The preview overlay's by-id branch renders <video>/<audio> with the same markup as the workspace branch, playsinline included. Serving was already range-aware, so seeking works. The image-watcher keeps its own narrow detection list (png/pdf/docx/pptx), so this does not start popping cards for every video an agent writes. Text types that are not md or txt (.json, .log, code files) remain out of the allowlist by choice and still report what is previewable instead. Verified on an isolated instance: an external mp4 and mp3 both play, seek, and report the right duration, matching the in-workspace clip exactly, and a click on an external mp4 in the terminal opens the player with no attachment card. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-16 17:35:43 +02:00
Codeman maintainer	c5b59633d8	feat(pi): add Pi (pi.dev) as a sixth CLI run mode (#206) ... SessionMode gains 'pi', a first-class backend alongside Claude Code, OpenCode, Codex, Gemini and Antigravity: its own PTY, tmux session, rose tab identity, welcome button, run-mode entry, cron agentType, Docker and remote-SSH command defaults, and clone-repo Brain option. Pi is a different shape of CLI from the other four, and three decisions follow from that: - It has NO permission prompts and no sandbox, so there is no --dangerously-skip-permissions analog and none was invented. The privilege-shaped knob is the tri-state approveProjectTrust, which makes pi load and EXECUTE repo-local .pi/extensions TypeScript and install missing project packages. clampExternalCliBypassForOwner() therefore puts pi in the MATERIALIZE branch: a non-granted multi-user owner gets --no-approve even when no config was sent, because pi's own default is a prompt the session user could answer themselves. That helper had zero test coverage; it now has coverage for all four CLIs. - Only the PI_ prefix joins the env allowlist. Pi's ~34 provider key vars share no prefix and ALLOWED_ENV_PREFIXES is one global list with no mode context, so admitting them would widen the allowlist for every mode at once. Auth goes through pi's /login or the server's own environment. --api-key is deliberately never wired: it would put a provider secret on the spawn command line. - pi stays OUT of isAltScreenStripMode(). Its default TUI renders into the main screen with terminal-owned scrollback, and its 0.84.0 fullscreen mode is runtime-switchable via /settings; that flip was measured to put the pane into the alt screen, which the strip would have corrupted. pi-cli-resolver.ts additionally sanity-probes `pi --version` and requires semver-shaped output, because `pi` is a short generic name a stray binary can shadow; GET /api/pi/status surfaces path and version so a misresolution is diagnosable rather than presenting as a broken mode. Docker installs pi in its own --ignore-scripts step so that flag cannot affect the other four CLIs, and seeds its credentials per-file rather than whole-dir (~/.pi/agent also holds sessions, extensions and package trees). Verified end to end against pi 0.84.1 on an isolated instance: resolver search-dir fallback, flag construction, piConfig persistence across a full server restart, the trust prompt and its --no-approve suppression, the rose Run button on the default daylight-blue skin (the nested skin block eats per-mode gradients unless the rule lives inside it), and the buffer local-echo policy, which pi tolerates where codex did not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-13 13:54:47 +02:00
Codeman maintainer	f39beb3326	chore: version packages ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-12 02:30:08 +02:00
Codeman maintainer	5d42f64393	fix(web): usable past-conversation list, and search that finds past sessions ... Two home-screen reports from @jordan8037310, both about history that is present but unreachable. #260 — "Resume Conversation" rendered 4 rows, then a button that appended every remaining row into a `max-height: 240px` box, so 35 conversations landed in a four-row scroll well with no ordering or filtering. Rendering now goes through `_renderHistoryList()` over a cached corpus: 10 rows to start, Show more/Show less that grows and shrinks the box (the height cap is class-driven, `.history-list.expanded`), plus a filter box (name, folder, #case label, prompts), a sort control (recent / name / folder, pinned rows still first) and a shown-of-total count. A filter implies expansion, so every match is visible, and the whole header hides as one unit while a federated search is active. The A-Z sort keys off the same string the row renders, since most rows are transcript-backed and carry no session name at all. #261 — the search box could not match a past project by folder name: `harvestSources()` built its session corpus from the live in-memory map, while past sessions come from `/api/sessions/unified` (lifecycle log + transcript scan). Folding that scan into the request path would have cost the search its no-filesystem-reads property, so the corpus arrives via a bounded snapshot instead: `session-history-index.ts` is published as a side effect of `/api/sessions/unified` (the home screen fetches it on open, which is the same screen the search box lives on) and rebuilt fire-and-forget, single-flight and TTL-guarded when a search finds it stale. A result for a closed session now resumes the conversation rather than selecting a tab that no longer exists, and is badged RESUME. The snapshot is stored unscoped with a per-row owner and re-filtered through canAccessOwned() on read, so multi-user sees exactly what /api/sessions/unified exposes: own sessions only, host-wide transcript history admin-only. Live rows are harvested first and win the dedupe. Verified end-to-end against a real instance with 60 past sessions: cold process answers its first search without history and its second with it; folder-name queries return resume targets; clicking one posts the right resumeSessionId + workingDir. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-10 03:02:11 +02:00
Codeman maintainer	161f1da2eb	feat: Read My Mind phase 1, per-case intent profiles (capture + API + skill) ... Per-case profiles of user intent (docs/readmymind-plan.md): user-stated goals plus the user's recently submitted prompts, captured from the Claude session transcript behind the new synced readMyMindEnabled setting (default OFF). - intent-store.ts: keyed by owner + realpath(workingDir), FIFO/size caps, consecutive-dupe collapse, atomic 0600 writes to ~/.codeman/intents.json - transcript-watcher.ts: new transcript:user_prompt event for typed user turns (tool_result-only entries stay silent); capture wiring in server.ts is claude-only and gated on the setting per event - readmymind-routes.ts: GET/PUT/DELETE /api/sessions/:id/intent, ownership via findSessionOrFail, strict Zod schema - agent skill: SKILL.md recipe + endpoints.md rows so agents can read and record intent (PUT replaces: read + merge; never delete unprompted) - groundwork for the phase-2 predictor button; nothing is ever auto-sent Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-09 18:03:13 +02:00
Codeman maintainer	ff10a50bc0	feat: Approvals Inbox, one cross-session queue for prompts waiting on a human ... Permission dialogs, AskUserQuestion questions and idle prompts from every session now land in a server-side inbox (web/approval-inbox.ts, one item per session, claude-mode only) and are answerable in place: a header bell + drawer on desktop, inline answer strips on the phone overview's NEEDS YOU rows, and working push Approve/Deny buttons (previously dead ends, now answered straight from sw.js with no tab open). Pending alerts survive reloads because the frontend seeds from GET /api/approvals on init. Answering sends the digit / Esc / prompt text through the existing tmux input path; option digits are accepted only when they match options parsed from the captured pane frame, and the answer path re-captures the pane first so a dialog that already left the screen refuses with 409 instead of typing into the composer. New elicitation_complete / elicitation_response hook matchers resolve question items the moment they are answered in the terminal; refreshStaleCodemanHooks heals existing cases. Verified end-to-end against a live claude session: a real AskUserQuestion dialog parsed into 5 option buttons and was answered from the drawer. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-09 14:04:34 +02:00
Ark0N	b641560040	Merge pull request #203 from shenlvkang-collab/contrib/claude-viewer-session-pin ... fix(web): pin the Claude response viewer to the pane's own conversation	2026-08-05 21:44:37 +02:00
Codeman maintainer	4ea781c80f	feat(file-viewer): edit mode for text files (edit + save in the viewer) ... Closes #212. The file-preview overlay can now edit workspace text files in place, phone-first: agent writes a file, you review it in the viewer, tweak two lines, save, tell the agent to continue. Backend (file-routes.ts, policy in src/config/file-editing.ts): - GET file-content?edit=1: read-for-edit that never truncates (a truncated buffer must never become an edit buffer), 512KB cap (413 over it), and returns the sha256 hash + detected EOL the client echoes back on save. - PUT /api/sessions/:id/file-content: edit-in-place only, with no O_CREAT anywhere in the handler. Confinement matches the read path (realpath + workspace boundary + ownership via findSessionOrFail), plus sensitive-path and attachment-guard blocklists, a .git subtree deny, and an extension allowlist (svg and env deliberately excluded). Optimistic concurrency via baseHash: mismatch is a 409 unless force. Writes are wx-temp + fchmod + fsync + rename, closing the validate-then-write TOCTOU window. - Corruption guards: NUL sniff + UTF-8 round-trip compare (refuses binary and latin-1), and server-side EOL re-application so a textarea's LF normalization cannot rewrite every line of a CRLF file. - Plain reads gain an additive editable flag the UI keys the button off. Frontend (panels-ui.js + overlay markup/styles): - Edit button on editable text previews; textarea editor with Save/Cancel, dirty indicator, discard-confirm on cancel/close, and a conflict dialog that offers overwrite (force) when the file changed on disk mid-edit. - Phone: full-bleed window sized by --app-height so the editor and Save bar track the OS keyboard; 16px editor font (iOS zoom guard); no autofocus. - zh-CN strings for the new chrome. Tests: pure policy unit tests plus a route suite that deliberately does NOT mock node:fs. It runs against a real temp workspace so symlink escapes, write-through of in-workspace symlinks, mode preservation, CRLF round-trip, 409/force, and the no-create property are exercised for real. Also verified end to end on an isolated beta instance: 39-check curl matrix, Playwright desktop flow (real clicks and typing, bytes asserted on disk, live conflict with an external rewrite), and a 393px phone profile. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-05 08:44:47 +02:00
Codeman maintainer	cb3eecad9b	Merge branch 'master' into pr181	2026-08-05 00:04:43 +02:00
Codeman maintainer	26cbbe0dcb	feat(cli): Antigravity run mode ... Adds Antigravity as a sixth CLI backend alongside Claude Code, shell, OpenCode, Codex and Gemini, following the existing pluggable-resolver pattern. - `utils/antigravity-cli-resolver.ts` resolves the CLI, mirroring the other resolvers; `GET /api/antigravity/status` reports availability and path. - `ANTIGRAVITY_*` joins the `ALLOWED_ENV_PREFIXES` allowlist in schemas.ts, so env overrides stay CLI-scoped rather than blanket-forwarded. - Session, tmux-manager, mux-interface and types carry the new mode; secrets are injected via socket-scoped `tmux setenv`, never on the spawn command line, so the mode requires tmux with no direct PTY fallback like the other external CLIs. - Frontend: Run-dropdown entry, agent-type option, `ag` tab badge and toolbar colours. `runAntigravity()` routes remote/docker cases through `POST /api/quick-start` and skips the local status probe for them. Tests: test/antigravity-mode.test.ts, plus run-mode-ui and system-routes coverage. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-04 12:59:40 +02:00
shenlvkang-collab	ab7a703e90	fix(web): keep the viewer's conversation anchor across a Codeman restart ... start() reassigns _claudeSessionId to `resumeSessionId || id` on every launch, including the path that re-attaches to a mux session that outlived the restart. A pane whose CLI had moved on via /clear therefore came back pointing the response viewer at its pre-/clear transcript, and because Session.lastSubmitAt lived only in memory, the history correlation had nothing to correct it with until the user happened to type again — observed as hours of the eye showing a conversation the pane had long since left. Persist lastSubmitAt in SessionState, restore it in restoreMuxSessions(), and flush it when the viewer adopts (a /clear emits no completion event, which is the trigger that would otherwise have persisted it). Recovered panes now re-derive their live conversation on the viewer's first poll. Restoring a stale anchor is safe: the resolver already refuses a candidate transcript older than the one the pane is currently on, which is the shape of a respawn into a fresh conversation.	2026-08-03 21:22:33 +08:00
lior	94e3aae57d	feat(codex): make terminal animations configurable	2026-07-29 03:39:07 +03:00
Codeman maintainer	390516ca3f	merge master into mobile-path-picker-preview ... Only CLAUDE.md conflicted: master restructured it into the short-rule + docs/architecture-invariants.md pointer layout while this PR was open. Route counts reconciled against master's numbering (files 14 -> 16 for the two new filesystem endpoints, total ~197 -> ~199) and the path picker's detail moved into architecture-invariants under its own section.	2026-07-28 01:13:32 +02:00
Codeman maintainer	b34fcaf928	feat(web-tabs): open dashboard URLs as tabs beside agent sessions ... Adds a "Web / URL" section to the Run dropdown. A saved URL renders as a tab in the same strip as Claude/Codex/Gemini sessions, with the same Alt+1..9 numbering, so Codeman is one mission control instead of Codeman plus a pile of browser tabs. A webview is NOT a sixth SessionMode: no PTY, no tmux, no respawn, no idle detection. It is a separate resource sharing only the tab strip and the main content area, the same call that keeps Docker and remote-SSH as case overlays. Dashboards are proxied through Codeman's own origin, because a direct iframe fails three ways at once in the shipped deployment: prod serves HTTPS behind tailscale serve, so http:// targets are hard-blocked as mixed content (with no override at all on iOS Safari); Grafana/Portainer-class dashboards send X-Frame-Options: DENY; and our own default-src 'self' CSP blocks cross-origin frames. Proxying dissolves all three and leaves the production CSP byte-for-byte unchanged, since /webview/... is already covered by 'self'. A useful side effect: the fetch happens server-side, so a tailnet-only dashboard is reachable from a phone that is not on the tailnet. The proxy is not an API surface. It authenticates on a 192-bit capability in the path (memory-only, rolling TTL, bound to the minting user, revoked on edit or delete) and is correspondingly exempt from the cookie and Origin checks, because a sandboxed iframe is opaque-origin: it sends no SameSite=lax cookie and its writes arrive with Origin: null. The Host allowlist is never bypassed. A second Referer-keyed form of the exemption exists for root-absolute assets and is fenced to safe methods on non-/api, non-/ws, non-/q paths. Iframes omit allow-same-origin unless a URL is explicitly marked trusted, since a proxied page is served from Codeman's own origin and could otherwise read this document and drive the agent-spawning API. Authorization and codeman_session are stripped upstream in BOTH modes, so CODEMAN_PASSWORD cannot leak into a dashboard. Two things only a real browser reveals, both presenting as the dashboard's own "Failed to fetch" while the page itself renders fine: - Runtime-built root-absolute URLs (fetch('/api/data')) escape <base href> and land on Codeman's root. Widening the Referer fallback into /api would trade security for it, so an injected shim patches fetch/XHR/WebSocket/EventSource inside the frame instead, removing the class rather than the guard. - An opaque-origin document CORS-checks every request, including to the host it was served from. Script/css/img loads are not CORS-checked, which is why the page renders while its API calls die. The proxy now emits CORS headers and answers preflights itself. registerSecurityHeaders answered every OPTIONS with a bare 204 before routing, carrying no ACAO for Origin: null, so that short-circuit now exempts a valid capability. Neither is reproducible with curl, which does not enforce CORS. Also fixes a pre-existing bug found on the way: .toolbar has backdrop-filter, making it a stacking context that trapped .run-mode-menu's z-index:1000, so .welcome-overlay painted over the whole Run menu. With no session open, every item in it (Claude Code included) was unclickable. Verified end to end against a real tailnet dashboard: live data, WebSocket push, no failed requests, and switching tabs does not reload the frame. 98 new tests cover the pure rewrite helpers, the CORS helper, the shim's rewrite logic, route CRUD, and every edge of the auth exemption. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-27 17:06:36 +02:00