Ark0N/Codeman

"owner": {     "name": "Ark0N",     "url": "https://github.com/Ark0N"

"name": "Ark0N",     "url": "https://github.com/Ark0N"   },

"url": "https://github.com/Ark0N"

"author": {         "name": "Ark0N",         "url": "https://github.com/Ark0N"

"name": "Ark0N",         "url": "https://github.com/Ark0N"       },

"url": "https://github.com/Ark0N"

},       "homepage": "https://getcodeman.com",       "category": "productivity",

"homepage": "https://getcodeman.com",

"author": {     "name": "Ark0N",     "url": "https://github.com/Ark0N"

"name": "Ark0N",     "url": "https://github.com/Ark0N"   },

"url": "https://github.com/Ark0N"

},   "homepage": "https://getcodeman.com",   "repository": "https://github.com/Ark0N/Codeman",

"homepage": "https://getcodeman.com",

"repository": "https://github.com/Ark0N/Codeman",

- **Every call fails at once with "couldn't connect" or "connection refused".** Your   CLI's sandbox blocks network access, even to this machine. Codex's default sandbox   does; it needs **Bypass approvals and sandbox** (Codeman App Setting

does; it needs **Bypass approvals and sandbox** (Codeman App Settings, Codex).

# half-written file self-heals here instead of costing you a round trip to rm it.

[Credential-related source omitted]

# user can find and delete it long after your workers are gone (§5.14). Same deal: set # once, cosmetic, never fails a spawn, and it labels only directories Codeman creates. CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -

# once, cosmetic, never fails a spawn, and it labels only directories Codeman creates. CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -H "X-Codeman-Agent-Origin: codeman-skill") CID=codeman-agent-1            # FIXED liter

CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -H "X-Codeman-Agent-Origin: codeman-skill")

# Fail-CLOSED session delete. The DELETE lives INSIDE the guard on purpose: the older # `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

# `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

# seq is the epoch second -- look like a stale duplicate and vanish silently.     "${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' |

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json'        -d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')"

-d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')" \

spawn_worker() {   local name="${1:?spawn_worker needs a case name}" mode="${2:-claude}" q sid cp r   # parentSessionId doubles the CURL header, so a spawn_worker copied off the shared

local name="${1:?spawn_worker needs a case name}" mode="${2:-claude}" q sid cp r   # parentSessionId doubles the CURL header, so a spawn_worker copied off the shared   # curl (or a body someone rebuilt from this recipe) still carries its li

# parentSessionId doubles the CURL header, so a spawn_worker copied off the shared

# curl (or a body someone rebuilt from this recipe) still carries its lineage.

# Spawn by hand (§5.1) when you want a worker that asks.   q=$("${CURL[@]}" -X POST "$API/api/v1/quick-start" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER

q=$("${CURL[@]}" -X POST "$API/api/v1/quick-start" -H 'Content-Type: application/json'        -d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}"

-d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}" \

rm -rf "$d"

# cannot deliver `stop` answer 400 (before writing anything) instead of   # resolving on a flap, which is the answer that sends you to markers (§5.5).   body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \

# resolving on a flap, which is the answer that sends you to markers (§5.5).   body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \     '{input:($p+"\r"),useMux:true,clientId:$c,seq:$s,wait:"stop,exit",waitTimeout:20000}')

body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \

n=$((n+1))       "${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \         -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json'          -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)"

-d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

rm -f "$tmp"

. "$PRE"; [ "${CODEMAN_PREAMBLE:-}" = 1.44.0 ] || { echo "preamble at $PRE is stale or truncated: rm it and re-run this block"; exit 1; }

done; rm -rf "$D"

The server has no self-protection: a session that DELETEs its own id succeeds and   dies silently (verified live). **Always delete through `delete_session "$SID"` from   §0; never write a bare `curl -X DELETE` and never reintroduce the

dies silently (verified live). **Always delete through `delete_session "$SID"` from   §0; never write a bare `curl -X DELETE` and never reintroduce the   `is_self … || curl -X DELETE …` shape.** That older form failed open: with the

§0; never write a bare `curl -X DELETE` and never reintroduce the

`is_self … || curl -X DELETE …` shape.** That older form failed open: with the

Executable file

[Credential-related source omitted]

CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -H "X-Codeman-Agent-Origin: codeman-skill")

# Fail-CLOSED session delete. The DELETE lives INSIDE the guard on purpose: the older # `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

# `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')" \

-d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')" \

# parentSessionId doubles the CURL header, so a spawn_worker copied off the shared

# curl (or a body someone rebuilt from this recipe) still carries its lineage.

q=$("${CURL[@]}" -X POST "$API/api/v1/quick-start" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}" \

-d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}" \

rm -rf "$d"

body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \

n=$((n+1))       "${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \         -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json'          -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)"

-d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

rm -f "$tmp"

**Use Basic, not the cookie.** Send `-u user:password` on every call. A successful Basic auth also mints a 24 h `codeman_session` cookie, but that is the browser's path: curl throws it away unless you keep a jar, and re-sending Basic costs 

[Credential-related source omitted]

[Credential-related source omitted]

curl throws it away unless you keep a jar, and re-sending Basic costs nothing. There is

[Credential-related source omitted]

CURL=(curl -sk "${AUTH[@]}")   # -k: harmless on http, required on https (self-signed cert)

- ⚠<U+FE0F> **It consumes an SSE slot.** `MAX_SSE_CLIENTS` is 100 process-wide, shared with   every open browser tab; over the cap the server answers a plain-text   `503 Too many SSE connections`. A curl you forget to bound holds its slot until it

every open browser tab; over the cap the server answers a plain-text   `503 Too many SSE connections`. A curl you forget to bound holds its slot until it   exits.

`503 Too many SSE connections`. A curl you forget to bound holds its slot until it

| Symptom | Cause / fix | |---------|-------------| | every curl fails with a certificate error | you dropped `-k`; `CODEMAN_API_URL` is HTTPS with a self-signed cert |

|---------|-------------| | every curl fails with a certificate error | you dropped `-k`; `CODEMAN_API_URL` is HTTPS with a self-signed cert | | `GET .../sessions/$CODEMAN_SESSION_ID` 404s | Docker case: the env id is truncated to 8 chars; 

| every curl fails with a certificate error | you dropped `-k`; `CODEMAN_API_URL` is HTTPS with a self-signed cert |

| new claude worker ignores its first prompt | it was showing the first-run trust dialog and Codeman's auto-accept did not fire (it is bounded by a 90 s window and a keystroke cap); use the readiness recipe in SKILL.md, wait for `shift+tab`

| a brand-new claude worker's pane is DEAD (`status 1`) seconds after the spawn | something pressed Enter at the first-run trust dialog. Since claude-cli 2.1.252 its options are unnumbered, reversed, and the highlighted default is `No, exit

| readiness burns its whole budget, then the worker answers fine anyway | you matched `bypass`, which is the statusline of ONE permission mode. Codeman spawns `--dangerously-skip-permissions` by default, but the server's `claudeMode` settin

side as bypassing-permissions or prompting, and a CLASS MISMATCH holds the message    behind an approval dialog in the receiving session (default expiry ~5 min, then    dropped). Codeman's default spawn is `--dangerously-skip-permissions`, 

behind an approval dialog in the receiving session (default expiry ~5 min, then    dropped). Codeman's default spawn is `--dangerously-skip-permissions`, bypass on    both ends, which DELIVERS (verified live; `from-mode="bypass"` rides on e

dropped). Codeman's default spawn is `--dangerously-skip-permissions`, bypass on

jq -c '.data.wait | {signal, waitedMs}' "$D/1" "$D/2"; rm -rf "$D"

- Always go through `delete_session`. It refuses an empty id, refuses when `$SELF` is   unset or too short to prove the target is not you, and prefix-checks in both   directions. A hand-written `curl -X DELETE`, or the old

unset or too short to prove the target is not you, and prefix-checks in both   directions. A hand-written `curl -X DELETE`, or the old   `is_self "$id" || curl -X DELETE …`, has none of that: an undefined `is_self` exits

directions. A hand-written `curl -X DELETE`, or the old

`is_self "$id" || curl -X DELETE …`, has none of that: an undefined `is_self` exits

hint, which the web UI draws as a line from your tab to each worker's tab. The §0 preamble already sets the header on `"${CURL[@]}"`, so you get this for free. For a request that builds its own body, or one you send without the shared curl 

preamble already sets the header on `"${CURL[@]}"`, so you get this for free. For a request that builds its own body, or one you send without the shared curl array, pass it explicitly instead:

request that builds its own body, or one you send without the shared curl array, pass it

| how Codeman spawned it | statusline reads | `shift+tab` | `bypass` | |------------------------|------------------|-------------|----------| | `--dangerously-skip-permissions` (default) | `bypass permissions on` | yes | yes |

|------------------------|------------------|-------------|----------| | `--dangerously-skip-permissions` (default) | `bypass permissions on` | yes | yes | | `--permission-mode auto` | `auto mode on` | yes | no |

| `--dangerously-skip-permissions` (default) | `bypass permissions on` | yes | yes |

- **Every call fails at once with "couldn't connect" or "connection refused".** Your   CLI's sandbox blocks network access, even to this machine. Codex's default sandbox   does; it needs **Bypass approvals and sandbox** (Codeman App Setting

does; it needs **Bypass approvals and sandbox** (Codeman App Settings, Codex).

# half-written file self-heals here instead of costing you a round trip to rm it.

[Credential-related source omitted]

# user can find and delete it long after your workers are gone (§5.14). Same deal: set # once, cosmetic, never fails a spawn, and it labels only directories Codeman creates. CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -

# once, cosmetic, never fails a spawn, and it labels only directories Codeman creates. CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -H "X-Codeman-Agent-Origin: codeman-skill") CID=codeman-agent-1            # FIXED liter

CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -H "X-Codeman-Agent-Origin: codeman-skill")

# Fail-CLOSED session delete. The DELETE lives INSIDE the guard on purpose: the older # `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

# `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

# seq is the epoch second -- look like a stale duplicate and vanish silently.     "${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' |

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json'        -d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')"

-d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')" \

spawn_worker() {   local name="${1:?spawn_worker needs a case name}" mode="${2:-claude}" q sid cp r   # parentSessionId doubles the CURL header, so a spawn_worker copied off the shared

local name="${1:?spawn_worker needs a case name}" mode="${2:-claude}" q sid cp r   # parentSessionId doubles the CURL header, so a spawn_worker copied off the shared   # curl (or a body someone rebuilt from this recipe) still carries its li

# parentSessionId doubles the CURL header, so a spawn_worker copied off the shared

# curl (or a body someone rebuilt from this recipe) still carries its lineage.

# Spawn by hand (§5.1) when you want a worker that asks.   q=$("${CURL[@]}" -X POST "$API/api/v1/quick-start" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER

q=$("${CURL[@]}" -X POST "$API/api/v1/quick-start" -H 'Content-Type: application/json'        -d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}"

-d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}" \

rm -rf "$d"

# cannot deliver `stop` answer 400 (before writing anything) instead of   # resolving on a flap, which is the answer that sends you to markers (§5.5).   body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \

# resolving on a flap, which is the answer that sends you to markers (§5.5).   body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \     '{input:($p+"\r"),useMux:true,clientId:$c,seq:$s,wait:"stop,exit",waitTimeout:20000}')

body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \

n=$((n+1))       "${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \         -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json'          -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)"

-d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

rm -f "$tmp"

. "$PRE"; [ "${CODEMAN_PREAMBLE:-}" = 1.44.0 ] || { echo "preamble at $PRE is stale or truncated: rm it and re-run this block"; exit 1; }

done; rm -rf "$D"

The server has no self-protection: a session that DELETEs its own id succeeds and   dies silently (verified live). **Always delete through `delete_session "$SID"` from   §0; never write a bare `curl -X DELETE` and never reintroduce the

dies silently (verified live). **Always delete through `delete_session "$SID"` from   §0; never write a bare `curl -X DELETE` and never reintroduce the   `is_self … || curl -X DELETE …` shape.** That older form failed open: with the

§0; never write a bare `curl -X DELETE` and never reintroduce the

`is_self … || curl -X DELETE …` shape.** That older form failed open: with the

Executable file

[Credential-related source omitted]

CURL=(curl -sk "${AUTH[@]}" -H "X-Codeman-Parent-Session: $SELF" -H "X-Codeman-Agent-Origin: codeman-skill")

# Fail-CLOSED session delete. The DELETE lives INSIDE the guard on purpose: the older # `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

# `is_self "$SID" || curl -X DELETE ...` shape failed OPEN, because an undefined

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')" \

-d "$(jq -nc --arg k "$([ "$k" = confirm ] && printf '\r' || printf '\033[B')" \

# parentSessionId doubles the CURL header, so a spawn_worker copied off the shared

# curl (or a body someone rebuilt from this recipe) still carries its lineage.

q=$("${CURL[@]}" -X POST "$API/api/v1/quick-start" -H 'Content-Type: application/json' \       -d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}" \

-d "$(jq -nc --arg n "$name" --arg m "$mode" --arg p "$SELF" --arg a "${CODEMAN_WORKER_ADVISOR:-}" \

rm -rf "$d"

body=$(jq -nc --arg p "$p" --arg c "$CID-$sid" --argjson s "$seq" \

n=$((n+1))       "${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json' \         -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

"${CURL[@]}" -X POST "$API/api/v1/sessions/$sid/input" -H 'Content-Type: application/json'          -d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)"

-d "$(jq -nc --arg c "$CID-$sid" --argjson s "$(date +%s)" \

rm -f "$tmp"

**Use Basic, not the cookie.** Send `-u user:password` on every call. A successful Basic auth also mints a 24 h `codeman_session` cookie, but that is the browser's path: curl throws it away unless you keep a jar, and re-sending Basic costs 

[Credential-related source omitted]

[Credential-related source omitted]

curl throws it away unless you keep a jar, and re-sending Basic costs nothing. There is

[Credential-related source omitted]

CURL=(curl -sk "${AUTH[@]}")   # -k: harmless on http, required on https (self-signed cert)

- ⚠<U+FE0F> **It consumes an SSE slot.** `MAX_SSE_CLIENTS` is 100 process-wide, shared with   every open browser tab; over the cap the server answers a plain-text   `503 Too many SSE connections`. A curl you forget to bound holds its slot until it

every open browser tab; over the cap the server answers a plain-text   `503 Too many SSE connections`. A curl you forget to bound holds its slot until it   exits.

`503 Too many SSE connections`. A curl you forget to bound holds its slot until it

| Symptom | Cause / fix | |---------|-------------| | every curl fails with a certificate error | you dropped `-k`; `CODEMAN_API_URL` is HTTPS with a self-signed cert |

|---------|-------------| | every curl fails with a certificate error | you dropped `-k`; `CODEMAN_API_URL` is HTTPS with a self-signed cert | | `GET .../sessions/$CODEMAN_SESSION_ID` 404s | Docker case: the env id is truncated to 8 chars; 

| every curl fails with a certificate error | you dropped `-k`; `CODEMAN_API_URL` is HTTPS with a self-signed cert |

| new claude worker ignores its first prompt | it was showing the first-run trust dialog and Codeman's auto-accept did not fire (it is bounded by a 90 s window and a keystroke cap); use the readiness recipe in SKILL.md, wait for `shift+tab`

| a brand-new claude worker's pane is DEAD (`status 1`) seconds after the spawn | something pressed Enter at the first-run trust dialog. Since claude-cli 2.1.252 its options are unnumbered, reversed, and the highlighted default is `No, exit

| readiness burns its whole budget, then the worker answers fine anyway | you matched `bypass`, which is the statusline of ONE permission mode. Codeman spawns `--dangerously-skip-permissions` by default, but the server's `claudeMode` settin

side as bypassing-permissions or prompting, and a CLASS MISMATCH holds the message    behind an approval dialog in the receiving session (default expiry ~5 min, then    dropped). Codeman's default spawn is `--dangerously-skip-permissions`, 

behind an approval dialog in the receiving session (default expiry ~5 min, then    dropped). Codeman's default spawn is `--dangerously-skip-permissions`, bypass on    both ends, which DELIVERS (verified live; `from-mode="bypass"` rides on e

dropped). Codeman's default spawn is `--dangerously-skip-permissions`, bypass on

jq -c '.data.wait | {signal, waitedMs}' "$D/1" "$D/2"; rm -rf "$D"

- Always go through `delete_session`. It refuses an empty id, refuses when `$SELF` is   unset or too short to prove the target is not you, and prefix-checks in both   directions. A hand-written `curl -X DELETE`, or the old

unset or too short to prove the target is not you, and prefix-checks in both   directions. A hand-written `curl -X DELETE`, or the old   `is_self "$id" || curl -X DELETE …`, has none of that: an undefined `is_self` exits

directions. A hand-written `curl -X DELETE`, or the old

`is_self "$id" || curl -X DELETE …`, has none of that: an undefined `is_self` exits

hint, which the web UI draws as a line from your tab to each worker's tab. The §0 preamble already sets the header on `"${CURL[@]}"`, so you get this for free. For a request that builds its own body, or one you send without the shared curl 

preamble already sets the header on `"${CURL[@]}"`, so you get this for free. For a request that builds its own body, or one you send without the shared curl array, pass it explicitly instead:

request that builds its own body, or one you send without the shared curl array, pass it

| how Codeman spawned it | statusline reads | `shift+tab` | `bypass` | |------------------------|------------------|-------------|----------| | `--dangerously-skip-permissions` (default) | `bypass permissions on` | yes | yes |

|------------------------|------------------|-------------|----------| | `--dangerously-skip-permissions` (default) | `bypass permissions on` | yes | yes | | `--permission-mode auto` | `auto mode on` | yes | no |

| `--dangerously-skip-permissions` (default) | `bypass permissions on` | yes | yes |