Master's #621 added tsv and zip to both file-link extension groups in
constants.js while this branch added diff|patch to the same lines. The
resolution keeps both, in master's order with diff|patch after sql where the
PR put it; the rooted and relative groups stay identical, and every upload
document extension plus .diff/.patch still links in both patterns.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The parked-viewport test had no wrapped rows and the termination test runs at
baseY 0, so nothing pinned the walk of a multi-row composer through absolute
lines off the bottom. The new case fails on the pre-fix terminal-ui.js
('link' instead of 'history') and passes with the fix.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The new App Settings row had no zh-CN entry, so it read in English in a
Chinese UI, and docs/wiki/Settings-Reference.md did not list it. Adds the
label and description to i18n.js, a row in the Agents & CLIs table, and a
JSDOM test that runs the real translator over the real index.html.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Now that the set is exported for the parity test, type it read-only like
VIDEO_ATTACHMENT_EXTENSIONS, so an importer cannot add to the live upload
allowlist.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The reverse classifier check read only the one includes(ext) list, so a
second branch such as `if (ext === 'rtf') return 'document';` passed every
test; the method may now return 'document' from exactly one place. The
accept= checks kept only .ext tokens, so adding text/* to a picker passed;
the non-extension tokens must be exactly image/* and video/*. Both verified
by mutation (each fails the suite).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The reflow around the new UTF-8 sentence left one 120-character line; the
paragraph is wrapped at about 90 columns like the rest of the page.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
CLAUDE.md (Prompt uploads) and architecture-invariants still named
_promptAttachKind() as the filter every surface reads. That stays true, but
the surfaces now admit through _admitPromptAttachments(), which is what says
how many files a pick skipped. A new surface that filtered on the classifier
directly would drop files silently.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add pinCliSessionName (synced, default OFF), re-read at each spawn and respawn.
Off keeps the #457 behaviour; on pins every non-blank tab name as --name.
Update the docs, JSDoc and changeset that stated the old rule.
The Quick Reference listed `npm run typecheck` as `tsc --noEmit` alone; the
script also type-checks the scripts via `tsc -p config/tsconfig.scripts.json`.
The circuit-breaker and ultracode pointers showed pre-rename anchor names as
their labels while the hrefs already pointed at the current headings.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Follow-up to the previous commit, after a fact check against the code.
- Answer surfaces: the header bell answers Claude prompts, the phone
strip only Claude dialogs (and only with the inbox on), and push
Approve/Deny only a Claude permission prompt (PUSH_EVENT_MAP gives
actions to permission_prompt alone). README, its Chinese mirror, the
notifications page and the phone guide now say so.
- Antigravity and Grok Build: after the 3 s launch settle, idle is armed
only by Claude's prompt marker and working only by a braille spinner,
so "idle when output stops changing" was wrong. The wiki, the grok
guide and the API reference now call their status unreliable.
- DeepSeek Harness: its idle and working reports become stop and
agent_working, which drive respawn, waits and the inbox but not the
session's own working/idle display. Keeping Agents Running says that,
and that the respawn path needs the status bridge.
- The wait section of the API reference no longer calls exit the only
dependable signal for screen-checked modes; the inbox page names how
Codex and DeepSeek items clear; Core Concepts and Hooks And
Integrations no longer call DeepSeek "the one" exception; Agent CLIs
notes that Codex dialogs still raise the red alert; the inbox design
doc notes the alert-only items.
- Skill: stop and blocked list deepseek, and SKILL.md no longer says
codex has neither a transcript nor blocked. Mirrored with
scripts/sync-plugin.mjs.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The README (and its Chinese mirror) said the Approvals Inbox queues every
pending prompt and answers it from the bell or the phone. It holds prompts
from Claude Code, Codex (screen-read) and DeepSeek Harness only, and only
Claude's are answerable: Codex and DeepSeek items are alerts that say to
answer in the terminal, with no Approve/Deny on the push or the phone strip.
The wiki, the TUI guide and the phone guide now say the same.
Keeping Agents Running, Troubleshooting and the API reference still said
every CLI but Claude, Codex and DeepSeek falls back to output
stabilization. OpenCode, Gemini CLI, Pi and OMP declare
capabilities.workDetect too and get the same screen check; only
Antigravity and Grok Build declare none. Core Concepts now mentions
Codex's screen-read dialogs, and the respawn gotcha notes that DeepSeek's
own end-of-turn report reaches the respawn controller.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
An Excel or Notepad CSV/TXT export (UTF-16 with a BOM, or Windows-1252) was refused as "File bytes do not match declared type", which reads like a corrupt file. Name the encoding and tell the user to save it as UTF-8.
The browser cannot import the server's document allowlist, so the classifier, the three pickers' accept lists and the two file-path link patterns each carry a hand-kept copy. A missed copy fails silently: a file greyed out in the picker, an upload dropped client-side, or a pasted path that is no longer a link. Hoist the set to module scope so the test reads the shipped list.
A selection mixing a file the server takes with one it refuses dropped the refused one without a word, and the Compose and paste-dialog pickers never toasted even when every file was refused. Every pick, drop and paste filter now goes through one helper that counts what the classifier refused: a partial refusal toasts how many were skipped while the rest upload, a full one keeps the existing Unsupported file type toast, and a clipboard paste that falls back to its text stays quiet.
xterm's cursorY is relative to baseY, but _tapIsOnCaretLine read it as a screen row. With the viewport parked above the bottom (a tab switch onto a frame with trailing blank rows) a tap on a URL typed in the prompt opened it, and a URL in scrollback on the row cursorY happened to name stayed inert.
- docs/api-reference.md: a non-admin's GET /api/settings omits
voiceSettings.apiKey, caseOrder and lastUsedCase; a new "System
operations" table for the admin-only routes and the scoped
POST /api/auth/revoke; the error-code table now lists FORBIDDEN and the
other multi-user codes (PASSWORD_CHANGE_REQUIRED, USER_NOT_FOUND,
USER_EXISTS, LAST_ADMIN).
- docs/wiki/Multi-User-Mode.md: what a regular user reads, that their run
mode and respawn presets stay theirs on the device, the slow sign-in
case, and the admin-only system operations.
- docs/multi-user-plan.md: Settings and System ops rows marked implemented.
- CLAUDE.md: the Multi-user mode paragraph names the new pieces and tests.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Two gaps in how a regular user's browser handled the admin-only settings
writes:
- The role comes from GET /api/me, which answers after page load, and on
a failed request admin-ui.js falls back to a single-user admin. A save
made then was sent, came back 403, and still said "Settings saved",
while the refused server-wide change stayed on the device. A 403
FORBIDDEN on a settings write now ends that save like a known
non-admin's: synced keys back to the server's value, the one admin-only
notice, and the page is read-only from then on (_noteSettingsWriteRefusal).
The display-key list moved into one method (_displaySettingKeySet), so
that split no longer depends on GET /api/settings having loaded.
- A regular user's run mode and respawn presets were skipped for the
server but overwritten by the server's on the next page load, while
"Saved preset" said otherwise. They are now kept as that user's own on
the device and put back over the server's after the settings load and
on codeman:me (_rememberOwnSetting, _applyOwnSettings).
Admins and single-user mode are unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
docs/multi-user-plan.md lists the system operations as admin-only, but
these routes had no role check, so any signed-in regular user could run
them in multi-user mode:
- POST /api/auth/revoke with an empty body cleared EVERY login session on
the server, every admin's included. A non-admin now revokes only their
own logins, and a named sessionToken only when it is one of theirs.
- POST /api/system/update (update and restart the server for everyone),
POST /api/system/span-displays (a window on the server's desktop),
POST /api/tunnel/qr/regenerate (clears every user's pending QR login
code) and POST /api/cleanup-state (drops every user's stale session
records) now answer 403 FORBIDDEN to a non-admin.
- GET /api/tunnel/info lists only a non-admin's own logins (it showed the
address and browser of every user's sessions).
Admins and single-user mode are unchanged. The tunnel panel's Regenerate
QR button no longer reports success for a refused request.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
GET /api/settings returned the whole settings.json to every signed-in user.
An admin's App Settings save stores the Deepgram key there
(voiceSettings.apiKey), so any regular user could read it, and their
browser copied it into its own voice config and dictated on the admin's
account. caseOrder and lastUsedCase also named the admin's cases.
In multi-user mode a non-admin now reads the file without those three
(settingsForNonAdmin). Admins and single-user mode get the file as it
is. Pinned by route tests and the live multi-user test.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
api-reference gains a Settings section (GET/PUT /api/settings, the model
config, the case order and PUT /api/config, with the 403 FORBIDDEN a non-admin
gets in multi-user mode). The Multi-User Mode wiki page explains what a regular
user's App Settings save does now, Settings-Reference links it, the plan's
Settings row is marked implemented, and CLAUDE.md notes the gate for the
Multi-user paragraph and for anyone adding a settings write.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- test/routes/system-routes-settings-admin-only.test.ts (app.inject): a
non-admin PUT /api/settings is 403 FORBIDDEN before the body is parsed, and
nothing is written, no watcher toggled, no tunnel started, no history limit
set; the same gate on PUT /api/execution/model-config, PUT /api/config and
PUT /api/cases/order; admins and single-user mode write as before; GET stays
readable.
- test/settings-admin-only-multiuser.test.ts (live server, port 0, real
multi-user auth): settings.json is byte-identical after a non-admin's PUTs,
and a non-admin's quick-start or Ralph loop no longer records lastUsedCase.
- test/settings-admin-only-ui.test.ts (real index.html in JSDOM): a non-admin
App Settings save sends no PUT, keeps per-device keys, keeps synced keys at
the server value, and toasts once only on a real synced change; the
background writes are skipped; admins still PUT; zh-CN for both toasts.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With PUT /api/settings admin-only in multi-user mode, a non-admin's page must
not run into the 403. `_settingsReadOnly()` (settings-ui.js) reads the role
from window.__codemanUser; single-user mode and admins are unchanged.
For a non-admin, App Settings Save/Apply still saves the per-device keys to
localStorage exactly as before, but sends neither the settings PUT nor the
model-config PUT, and keeps every synced key at the server's value (the next
page load would put it back anyway). Only when the user really changed a
synced setting do they get one toast that server-wide settings can only be
changed by an admin; a form baseline taken at open keeps an untouched default
that no admin ever stored from reading as a change. The background writes
(run mode, respawn presets and their load-time migration, last used case,
case order, the tunnel toggles) are not sent, and a 403 FORBIDDEN on a tunnel
enable is no longer mistaken for the no-password prompt. zh-CN for both toasts.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
In multi-user mode any signed-in non-admin could rewrite the server-wide
~/.codeman/settings.json through PUT /api/settings (feature switches, the
plan-usage collection switch, run mode, respawn presets, the tunnel), although
docs/multi-user-plan.md makes settings writes admin-only.
PUT /api/settings now answers 403 FORBIDDEN for a non-admin before anything is
parsed, written, toggled or started. The other request paths that write a
server-wide setting get the same gate: PUT /api/execution/model-config (the
modelConfig key), PUT /api/config (state.json app config) and
PUT /api/cases/order (the one global caseOrder list). Quick-start and
ralph-loop start no longer record a non-admin's lastUsedCase in settings.json,
where every user could read it. GET /api/settings stays readable by everyone;
single-user mode is unchanged (requireAdmin short-circuits there).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
#642 stamped the preamble with the version it expected to ship in, 1.41.2. The release is 1.42.0, so the stamp would name a version that never existed. Any new value makes cached preambles from the broken version stale, which is what the stamp is for.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
An agent that writes a diff for review prints a path such as
/tmp/.../scratchpad/resolution.diff, and that path rendered as plain text
because the link patterns had no diff or patch extension. The attachment
allowlist already serves both as inert text/plain, so only the two link
patterns in constants.js change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner chose a minor release. #618's own changeset is folded into the release changeset like the others.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
feat(codex): raise codex approval, question and trust dialogs as BLOCKED
Conflict resolved against #634 in src/session.ts _probePaneWorking():
#624's assignment (a dialog on screen is never work) is kept, and #634's
trust-dialog verdict block (log the hold once, remember the reading)
follows it, before _readWatching().
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
feat(shortcuts): rebindable previous/next session, duplicate-chord refusal, rebinds stay out of the PTY
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
fix(deepseek): find pnpm when installing the terminal profile, and install it with dsh
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
fix(skill): keep the §0 bootstrap intact when Claude Code loads the skill with arguments
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
fix(uploads): refuse an unsupported video before uploading it
Conflict resolved against #621 in src/web/public/image-input.js (the
_promptAttachKind doc comment only): #621's comment is kept with #622's
clause that a video MIME counts only for the containers the server
admits; #622's video MIME check and #621's document branch both stay.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
fix(telemetry): gate the prompt cache like the model report, and keep the first 20 miss causes
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
On codex-cli 0.162.0, with 0.163.0 released, every launch first shows the
"Update available" prompt, and choosing Skip leads to a variant of the
workspace trust prompt: "2. Back to Agent Command Center" over the key-hint
row "enter continue · esc back". The pattern only accepted cancel,
interrupt, quit, answer or all as the closing word, so a fresh git repo
launched from Codeman sat on that trust prompt reading idle, with no red
alert and no blocked signal (measured live on a throwaway instance).
Adding "back" is safe because the hint row must still START with one of
the anchored hints ("enter continue" here): the popups the user opens at
the keyboard (/model, /permissions, /review, Implement this plan?) end in
"esc back" too, but their row starts with "enter select", so they stay
unmatched, as every existing negative fixture confirms. The new fixture is
the live capture with the scratch path replaced.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Codeman maintainer