[devswha]

Closes #2132.

Change

A watch-only device was refused GET /api/agent/commands (a folder's command rows), but GET /api/pane/commands?pane_id= gave it the same scanned rows: each custom command's description (its Markdown file's first line or frontmatter description) and its path as id. As the issue recommends, the rows are now refused, not trimmed. The composer menu that lists them is a drive feature.

• Access check (server/index.ts): the watch refusal covers (agent|pane)/commands on this PC, its /api/machines/local/ alias and another PC's /api/machines/<id>/ route, answering 403 read_only.
• PC proxy (server/machine-api.ts): a read-only connection is never forwarded pane/commands with the PC's credential, as agent/commands and sessions/history are not.
• Client (src/lib/usePaneCommands.ts): the chat and terminal views still mount the hook for a watcher, so it takes a read_only refusal as a final empty list instead of asking again on its 2/5/15/30 s backoff. A watcher's chat therefore draws sent slash commands as plain bubbles, the cost of refusing the rows. A device's role cannot change while the app runs, so this cannot stick for a driving device.

A driving device keeps the rows on every path.

Tests

Each new test failed on the code before the fix and passes after it:

• server/device-access.contract.test.ts: a watching device gets 403 read_only on the local, local-alias and remote paths; a driving device reaches the route (pane_not_found for an absent pane locally and through the alias, 503 for an unconnected PC). Before: the local path answered 404 pane_not_found instead of 403. After: the whole file passes, 15 pass.
• server/machine-proxy.test.ts: the proxy never asks a PC for pane/commands or agent/commands for a read-only connection, and passes a driving device the PC's rows.
• src/lib/usePaneCommands.hook.test.ts: one read and no retry after a read_only refusal (before: a second fetch after 2 s).

bun run check fast passes.

Manual QA

An isolated Ovis server (mkdtemp state dir, port 0, the check run's own herdr session) has a Claude pane in a folder holding .claude/commands/deploy.md, whose first line is SECRET. Each path was requested with curl -i:

device	path	answer
watch	/api/pane/commands	403 read_only
watch	/api/machines/local/pane/commands	403 read_only
watch	/api/machines/pc1/pane/commands	403 read_only
drive	/api/pane/commands	200, rows include SECRET
drive	/api/machines/local/pane/commands	200, rows include SECRET
drive	/api/machines/pc1/pane/commands	503 machine_offline (no such PC connected)

Reviews

This touches observe permissions and an HTTP contract, so it was reviewed adversarially before opening:

• omo-native-code-reviewer: APPROVE. It probed HEAD and other methods, odd path spellings (already a 404), query strings, WS frames and outcome payloads, and found no other way to the rows. In-scope LOWs, accepted as designed: watchers get an empty list, built-ins included; the refusal holds while the hook stays mounted; the path list is duplicated in the access check and the proxy, as for agent/commands.
• Codex Sol 6.1 fast xhigh: APPROVE. 288 in-memory method/path probes found no bypass, and driving access holds on all three paths.
• Both reviewers raised the same pre-existing, out-of-scope gap: GET /api/pane/files still lists up to 100 relative paths under a pane's folder to a watch device. It was reproduced in the QA above ({"files":[".claude/commands/deploy.md",".commandcode/commands/deploy.md"]}) and filed as Watch devices can list a pane folder's file paths through /api/pane/files #2244.

No REMOTE_BUNDLE_VERSION change: only a release PR raises it.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 11 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devswha/ovis
• Branch: fix/watch-pane-commands-permission
• File: .coderabbit.yaml
• Commit: faab4fe
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0ff63e4c-0c5e-46d4-af0c-6f956bc0beba

Commits

Reviewing files that changed from the base of the PR and between 84824f1 and faab4fe.

Files selected for processing: 7

• changelog.d/watch-pane-commands-refused.md
• server/device-access.contract.test.ts
• server/index.ts
• server/machine-api.ts
• server/machine-proxy.test.ts
• src/lib/usePaneCommands.hook.test.ts
• src/lib/usePaneCommands.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devswha]

CodeRabbit's review limit was reached, so no CodeRabbit review ran on this PR. This PR touches observe permissions and an HTTP contract, so here are the code-review agents' findings and how each was resolved (head faab4fe1; the reviews ran on the same diff before the rebase onto 84824f1f, which only adds an unrelated voice fix).

omo-native-code-reviewer (adversarial, read-only): APPROVE

• No bypass found. HEAD and other methods are refused by path. Trailing, doubled or encoded slashes are already a 404. Query strings don't change the decision. The server's remembered command list is read only when sending input, which a watcher is refused. WS frames and outcomes carry only sent text, not rows.
• LOW (accepted as designed): a watcher now gets an empty list, built-ins included, so its chat draws sent slash commands as plain bubbles and shows no skill chips. That follows from refusing instead of hiding.
• LOW (accepted): once refused, the hook does not ask again while mounted. A device's role cannot change while the app runs (the device update route changes only the label), so a driving device never gets stuck with it.
• LOW (accepted): the path list appears in both server/index.ts and server/machine-api.ts, the same two-layer pattern agent/commands and sessions/history use.
• Out of scope, pre-existing: GET /api/pane/files lists up to 100 paths under a pane's folder to a watch device. Reproduced in this PR's manual QA and filed as Watch devices can list a pane folder's file paths through /api/pane/files #2244.

Codex Sol 6.1 fast xhigh (adversarial, read-only): APPROVE

• No blocking findings. 288 in-memory method/path probes showed no way for a watcher to reach command rows, and driving access held on all three paths. The hook and cache tests pass.
• MEDIUM, pre-existing, out of scope: the same /api/pane/files gap, filed as Watch devices can list a pane folder's file paths through /api/pane/files #2244.

No CRITICAL, HIGH or MEDIUM finding is in scope, so nothing was changed after the reviews.

[devswha]

Merging faab4fe. An access change, so it got a strict review; Codex was at capacity, so an omo reviewer on gpt-6.1-sol and an independent second reviewer reviewed it; both pass with no HIGH. The watch refusal is checked on the parsed pathname after the noncanonical-path rejection and before alias rewriting or forwarding, for (agent|pane)/commands on this PC, the local alias and other PCs; the PC proxy never forwards pane/commands for a read-only connection. A matrix of 448 watch-device attempts (16 path spellings incl. encoded letters, %2F, dot segments, case, suffixes and query tricks; 7 methods; local, local alias, remote and direct proxy) got no rows and caused no upstream request, while a driving device still got its rows. Against a real pane with a seeded private command, main served that row to a watch device on /api/pane/commands, /api/machines/local/... and /api/machines/<id>/...; this head answers 403 read_only on all three while the driving device still gets it (170 requests across main and head). No other HTTP route, WebSocket frame or snapshot field carries the same rows. The device-access contract tests (15/15, isolated herdr session) and the proxy and hook tests pass. Not filed: /api/pane/files still lists relative filenames (e.g. .claude/commands/deploy.md) to a watcher, on main as well; that is tracked in #2244.