Codeman maintainer a798c461db fix(multi-user): skip server-wide settings writes for a non-admin browser ...

With PUT /api/settings admin-only in multi-user mode, a non-admin's page must
not run into the 403. `_settingsReadOnly()` (settings-ui.js) reads the role
from window.__codemanUser; single-user mode and admins are unchanged.

For a non-admin, App Settings Save/Apply still saves the per-device keys to
localStorage exactly as before, but sends neither the settings PUT nor the
model-config PUT, and keeps every synced key at the server's value (the next
page load would put it back anyway). Only when the user really changed a
synced setting do they get one toast that server-wide settings can only be
changed by an admin; a form baseline taken at open keeps an untouched default
that no admin ever stored from reading as a change. The background writes
(run mode, respawn presets and their load-time migration, last used case,
case order, the tunnel toggles) are not sent, and a 403 FORBIDDEN on a tunnel
enable is no longer mistaken for the no-password prompt. zh-CN for both toasts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-16 12:12:50 +02:00

..

config

Merge pull request #624 from Ark0N/feat/codex-blocked-detection

2026-10-16 02:00:29 +02:00

cron

fix(cron): send a paste-mode prompt's Enter as its own write

2026-09-28 17:10:12 +02:00

prompts

fix(terminal): linear-time link-provider regex; always allow blob workers in CSP

2026-06-10 18:06:45 +02:00

services

feat(worktrees): create, list and remove git worktrees of a local case

2026-10-14 05:16:00 +02:00

templates

feat(templates): new cases' CLAUDE.md asks for absolute file paths and points at the codeman skill

2026-10-09 23:28:55 +02:00

tui

refactor(cli): one credential reader for every client of the API

2026-10-09 12:59:48 +02:00

types

fix(telemetry): stamp a compaction on entering the null window

2026-10-11 12:36:59 -04:00

utils

fix(#616): install pnpm only when none is on PATH

2026-10-16 01:37:41 +02:00

web

fix(multi-user): skip server-wide settings writes for a non-admin browser

2026-10-16 12:12:50 +02:00

agent-case-marker.ts

feat(agent-cases): tag agent-spawned case dirs and sweep their leftovers

2026-09-07 19:09:24 +02:00

ai-checker-base.ts

feat: Read My Mind phase 2, the predictor and the brain button

2026-08-09 23:05:11 +02:00

ai-idle-checker.ts

refactor: remove dead code and narrow internal exports (knip sweep)

2026-04-23 11:57:00 +02:00

ai-plan-checker.ts

chore: version packages

2026-05-31 05:17:07 +02:00

attachment-magic.ts

fix(review): harden Codex generated-artifact attachment pipeline (PR #150)

2026-07-12 17:50:21 +02:00

attachment-registry.ts

feat(preview): folder grid — browse every previewable file of a folder

2026-10-10 21:54:37 +02:00

bash-tool-parser.ts

refactor: remove dead code and narrow internal exports (knip sweep)

2026-04-23 11:57:00 +02:00

claude-credentials.ts

feat(voice): dictate through the server's Claude Code login, no API key

2026-08-10 11:19:51 +02:00

claude-session-title.ts

fix(sessions): stop pinning the w1-myapp placeholder as Claude's /resume title (#457)

2026-09-24 01:48:33 +02:00

cli-agent.ts

feat(codex): raise a screen-read dialog as BLOCKED, alert-only

2026-10-14 05:18:37 +02:00

cli-style.ts

fix: drop the two keymap and style entries nothing reaches

2026-08-22 14:13:58 +02:00

cli.ts

Merge pull request #615: feat(mcp): codeman mcp, a Model Context Protocol server for any MCP client

2026-10-13 17:44:15 +02:00

codeman-credentials.ts

refactor(cli): one credential reader for every client of the API

2026-10-09 12:59:48 +02:00

codex-transcript.ts

fix(codex): fold a codex session into its own rollout row

2026-09-06 21:53:38 +02:00

custom-model-hosts.ts

fix(custom-model): merge-time fixes for the Run-menu picker

2026-09-19 12:27:01 +02:00

custom-model-injection-apply.ts

fix(custom-model): split the two confirmation questions, and seed the API key the way claude reads it

2026-09-19 12:32:50 +02:00

custom-model-injection.ts

fix(custom-model): root-cause and fix DeepSeek's HTTP_404 (missing /v1)

2026-09-17 13:41:19 +08:00

daemon-control.ts

feat(web): support a reverse-proxy base URL (--base-url / CODEMAN_BASE_URL)

2026-09-04 16:08:57 -04:00

deepseek-route-config.ts

feat(deepseek): read the model a dsh session's TUI route config pins

2026-10-07 19:27:45 +02:00

deepseek-status-shim.ts

fix(deepseek): review-driven hardening across the harness integration

2026-08-25 19:01:29 +02:00

deepseek-transcript.ts

fix(deepseek): review fixes for the transcript reader — docker/remote gate, poll memo, honest pairing docs

2026-08-25 18:30:41 +02:00

deepseek-web-server.ts

fix(deepseek): review-driven hardening across the harness integration

2026-08-25 19:01:29 +02:00

docker-export.ts

fix(docker): close the three adoption gaps the negative guarantee missed

2026-09-05 16:22:54 +02:00

docker-hosts.ts

fix(docker): merge-time fixes for #492

2026-09-28 16:28:29 +02:00

document-conversion-limiter.ts

fix(attachments): harden document preview/thumbnail path (review of #120)

2026-06-14 08:43:57 +02:00

document-preview-cache.ts

fix(attachments): harden document preview/thumbnail path (review of #120)

2026-06-14 08:43:57 +02:00

document-thumbnailer.ts

fix(review): harden Codex generated-artifact attachment pipeline (PR #150)

2026-07-12 17:50:21 +02:00

file-stream-manager.ts

fix(security): push-endpoint SSRF guard + tmux name validation; document tail-file roots

2026-06-09 20:02:17 +02:00

folder-listing.ts

fix(preview): folder grid review — multi-user scope, bounded probing, smaller items

2026-10-11 14:03:20 +02:00

generated-artifact-attachments.ts

fix(files): serve remote-case attachments, the path a click takes outside the case

2026-09-14 17:06:42 +02:00

git-clone.ts

fix(git): pin git's locale for clone, so failures classify on any host

2026-10-09 17:48:28 +02:00

git-workspace-status.ts

fix(git-status): #543 landing fixes

2026-10-09 05:36:57 +02:00

git-worktrees.ts

fix(#625): never remove a worktree that is, or holds, a Docker case workspace

2026-10-16 01:36:45 +02:00

hooks-config.ts

feat(agent-skill): give the codeman skill to every agent CLI, not just Claude

2026-10-13 12:33:47 +02:00

html-view-capabilities.ts

fix(html-view): re-check workspace confinement on every served request

2026-10-13 17:09:00 +02:00

image-watcher.ts

feat(uploads): write prompt uploads to a hidden, self-ignoring .codeman-uploads/ folder

2026-10-09 14:10:54 -04:00

index.ts

COD-115 fix: scrub TMUX/TMUX_PANE so tmux-backed sessions don't crash-loop

2026-07-09 11:47:38 -04:00

intent-store.ts

feat: Read My Mind phase 1, per-case intent profiles (capture + API + skill)

2026-08-09 18:03:13 +02:00

mcp-server.ts

feat(codex): raise a screen-read dialog as BLOCKED, alert-only

2026-10-14 05:18:37 +02:00

mcp-sync-targets.ts

feat(mcp-sync): sync GitHub Copilot CLI's MCP servers too

2026-10-09 18:42:00 +08:00

mcp-sync.ts

docs(mcp-sync): the alt config file is written when it parses (#599 merge-time fix)

2026-10-13 18:28:34 +02:00

model-config-resolvers.ts

feat(sessions): a dsh session shows its route config's model while its screen names none

2026-10-07 19:41:56 +02:00

mux-factory.ts

chore: bump version to 0.1538

2026-02-18 12:51:35 +01:00

mux-interface.ts

Merge pull request #607: feat(telemetry): read out Claude Code's prompt cache state per session

2026-10-13 18:07:15 +02:00

omp-transcript.ts

harden(omp): resume-path test coverage, silent-fallback logging, cwd validation

2026-08-28 11:32:30 -05:00

orchestrator-loop.ts

refactor: remove dead code and narrow internal exports (knip sweep)

2026-04-23 11:57:00 +02:00

orchestrator-planner.ts

feat: add Orchestrator Loop — phased plan execution with team agents

2026-03-21 07:20:18 +01:00

orchestrator-verifier.ts

chore: version packages

2026-03-27 01:43:59 +01:00

pane-exit-sweep.ts

feat(session): close sessions whose agent exited cleanly (#486)

2026-09-24 22:18:07 +02:00

plan-orchestrator.ts

review fixes: every claude create path routes through the workspace-hooks decision

2026-08-16 20:27:38 +02:00

proc-tree.ts

fix(mux): bound the process-tree walk — it can take a machine down

2026-08-07 01:34:47 +02:00

push-store.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

ralph-config.ts

refactor: remove dead code and narrow internal exports (knip sweep)

2026-04-23 11:57:00 +02:00

ralph-fix-plan-watcher.ts

refactor: split god files into focused modules (phase 4, steps 2-4)

2026-03-01 04:04:35 +01:00

ralph-loop.ts

fix(ralph): loop stops rescheduling after two ticks

2026-08-20 12:58:17 -04:00

ralph-plan-tracker.ts

refactor: split god files into focused modules (phase 4, steps 2-4)

2026-03-01 04:04:35 +01:00

ralph-stall-detector.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

ralph-status-parser.ts

refactor: pass 3 — extract helpers, split long functions, deduplicate patterns

2026-03-26 22:50:25 +01:00

ralph-tracker.ts

fix: address PR review findings for Gemini run mode + Ralph todo-config

2026-06-25 00:26:06 +02:00

readmymind-collectors.ts

feat: Read My Mind phase 2, the predictor and the brain button

2026-08-09 23:05:11 +02:00

readmymind-context.ts

feat: Read My Mind phase 2, the predictor and the brain button

2026-08-09 23:05:11 +02:00

readmymind-predictor.ts

feat: Read My Mind phase 2, the predictor and the brain button

2026-08-09 23:05:11 +02:00

reboot-restore.ts

feat(session): close sessions whose agent exited cleanly (#486)

2026-09-24 22:18:07 +02:00

remote-files.ts

fix(preview): list a remote folder under an explicit sh

2026-10-12 14:06:19 +02:00

remote-hosts.ts

feat(remote): host-unreachable banner, manual wake, and native MAC wake-on-LAN

2026-09-15 14:20:31 +02:00

remote-pane-history.ts

fix(remote): accept the history marker glued to a row on tmux before 3.2

2026-10-11 18:54:20 -05:00

remote-reconnect.ts

fix(remote): never auto-revive a remote session after a clean agent exit

2026-08-29 17:43:07 -05:00

remote-ssh-limiter.ts

fix(remote): bound the history read's slot wait in the queue, back off only on transport failures

2026-10-10 23:28:25 -05:00

remote-wake.ts

fix(remote): merge-time fixes for Wake-on-LAN

2026-09-19 12:18:40 +02:00

respawn-adaptive-timing.ts

fix: code cleanup — path traversal, test leaks, dead code, consistency

2026-03-01 17:26:31 +01:00

respawn-controller.ts

fix(respawn): do not revive a stopped controller after a cycle-step write

2026-08-18 10:59:44 -04:00

respawn-health.ts

refactor: split god files into focused modules (phase 4, steps 2-4)

2026-03-01 04:04:35 +01:00

respawn-metrics.ts

refactor: split god files into focused modules (phase 4, steps 2-4)

2026-03-01 04:04:35 +01:00

respawn-patterns.ts

fix(session): decide working/idle from the pane, not the composer redraw

2026-08-09 15:31:02 +02:00

run-summary.ts

refactor: codebase cleanup — dead code, regex helper, centralized constants, tests

2026-03-07 07:33:44 +01:00

search-service.ts

style: drop em-dashes from the prose added in this branch

2026-08-10 03:15:13 +02:00

service-installer.ts

feat(cli): codeman web -d and codeman service install (#231)

2026-08-09 01:34:55 +02:00

session-activity.ts

fix(codex): skip the blocked re-read while the pane is quiet

2026-10-14 05:53:58 +02:00

session-attachment-history.ts

COD-39 attachment history drawer

2026-06-14 09:05:17 +02:00

session-auto-name.ts

feat(sessions): land auto-naming opt-in, in the prefix form, from the first user prompt only

2026-09-15 17:59:16 +02:00

session-auto-ops.ts

feat(session,mobile): auto-resume on usage limit + mobile view fixes

2026-06-10 20:41:34 +02:00

session-cli-builder.ts

feat(claude): advisor tool support, per session and as an App Settings default

2026-10-04 19:05:43 +02:00

session-cli-registry-bridge.ts

feat(claude): advisor tool support, per session and as an App Settings default

2026-10-04 19:05:43 +02:00

session-display-model.ts

fix(deepseek): reject the dsh footer's non-model words instead of requiring a digit

2026-10-07 21:16:53 +02:00

session-env-clamp.ts

fix(custom-model): address fourth pre-merge review + merge upstream master (Ark0N)

2026-09-19 18:05:51 +08:00

session-lifecycle-log.ts

feat(web): session detach/undock + beta instance isolation (port 5000)

2026-06-06 03:53:54 +02:00

session-manager.ts

fix(custom-model): unset injected env on clear, resume on restart, select the model for pi/omp/grok

2026-09-14 23:46:28 +02:00

session-order.ts

COD-131 sync tab order across devices via server state

2026-07-17 16:21:16 -04:00

session-pty-exit-breaker.ts

COD-118 feat: circuit breaker bounding repeated non-zero interactive-PTY exits

2026-07-09 11:49:23 -04:00

session-submit-verifier.ts

fix(tmux): submit text as a bracketed paste so Codex does not swallow Enter

2026-10-14 10:20:01 +02:00

session-task-cache.ts

refactor: split god files into focused modules (phase 4, steps 2-4)

2026-03-01 04:04:35 +01:00

session-trust-dialog.ts

fix(session): answer Claude Code 2.1.252's reversed folder-trust dialog

2026-09-01 02:31:26 +02:00

session.ts

Merge pull request #624 from Ark0N/feat/codex-blocked-detection

2026-10-16 02:00:29 +02:00

state-store.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

subagent-watcher.ts

perf(sessions): closing a session no longer waits on the server

2026-10-10 04:20:46 +02:00

tab-layout-legacy-order.ts

fix(tabs): put child follow behind a setting, stop unpinning children on order PUTs

2026-10-09 20:34:37 -04:00

tab-layout-persistence.ts

feat(tabs): COD-359 add owner-scoped tab layouts

2026-08-23 14:46:10 -04:00

tab-layout-service.ts

fix(tabs): children spawned from one parent keep creation order (#528 merge-time fix)

2026-10-13 18:10:49 +02:00

tab-layout.ts

feat(tabs): pin tabs to a Focus section on the vertical rail

2026-10-10 13:43:20 -04:00

task-queue.ts

refactor: remove dead code and narrow internal exports (knip sweep)

2026-04-23 11:57:00 +02:00

task-tracker.ts

refactor: remove dead code and narrow internal exports (knip sweep)

2026-04-23 11:57:00 +02:00

task.ts

refactor: pre-compile regex patterns and remove dead code

2026-01-24 04:36:18 +01:00

team-watcher.ts

chore: codebase cleanup — remove dead code, consolidate imports, extract constants

2026-03-12 15:50:40 +01:00

tmux-manager.ts

Merge pull request #628 from Randalix/fix/codex-submit-paste

2026-10-16 01:59:46 +02:00

transcript-watcher.ts

feat: Read My Mind phase 2, the predictor and the brain button

2026-08-09 23:05:11 +02:00

tunnel-manager.ts

fix(cli-gating): gate the tunnel button instead of deleting it, and cover antigravity

2026-08-05 01:53:43 +02:00

types.ts

refactor: SSE event handlers, LLM context optimization, @fileoverview docs (#29)

2026-03-03 22:40:18 +01:00

usage-limit-patterns.ts

feat(session,mobile): auto-resume on usage limit + mobile view fixes

2026-06-10 20:41:34 +02:00

usage-telemetry.ts

docs(telemetry): expected_rebuilds is no longer the compaction signal (#607 merge-time fix)

2026-10-13 18:07:26 +02:00

user-store.ts

fix(multiuser): close cross-user web-layer scoping holes found in review

2026-07-20 12:33:12 +02:00

webhook-notify.ts

fix(notifications): main Save keeps webhook edits, glue test, docs and nits (#523 review)

2026-10-04 23:52:41 +02:00

webview-capabilities.ts

fix(webview): revoke proxy capabilities on logout and stamp Referrer-Policy

2026-09-04 15:21:13 +02:00

webview-store.ts

feat(web-tabs): open dashboard URLs as tabs beside agent sessions

2026-07-27 17:06:36 +02:00

workflow-run-watcher.ts

feat(ultracode): enrich live run tracking — real per-agent tokens/tools/state, readable title, blue connector line, click-to-open window

2026-06-18 10:00:04 +02:00