@blackbelt-technology/pi-agent-dashboard 0.4.5 → 0.5.0

package/packages/extension/src/vcs-info.ts

@@ -0,0 +1,184 @@
+/**
+ * VCS info gathering — detects git branch/remote/PR AND jj workspace state.
+ * Delegates to shared platform tool modules so there's no inline execSync
+ * and every call benefits from the runner's safety defaults (windowsHide,
+ * timeout, tolerated exit codes).
+ *
+ * jj probing is fast-path-gated: when `<cwd>/.jj/` doesn't exist, NO `jj`
+ * subprocess is spawned. Only sessions inside a jj repo pay the probe cost.
+ *
+ * See changes: platform-command-executor, add-jj-workspace-plugin.
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+import * as git from "@blackbelt-technology/pi-dashboard-shared/platform/git.js";
+import * as jj from "@blackbelt-technology/pi-dashboard-shared/platform/jj.js";
+import { getDefaultRegistry } from "@blackbelt-technology/pi-dashboard-shared/tool-registry/index.js";
+import type { JjState } from "@blackbelt-technology/pi-dashboard-shared/types.js";
+import { buildGitLinks, type GitLinks } from "./git-link-builder.js";
+
+export interface GitInfo {
+  gitBranch: string;
+  gitBranchUrl?: string;
+  gitPrNumber?: number;
+  gitPrUrl?: string;
+}
+
+/** Detect the current git branch. Returns short SHA for detached HEAD. */
+export function detectBranch(cwd: string): string | undefined {
+  const ref = git.currentBranchOr({ cwd });
+  if (!ref) return undefined;
+  if (ref === "HEAD") {
+    // Detached HEAD — return short commit SHA
+    return git.headShaOr({ cwd, short: true }) ?? "HEAD";
+  }
+  return ref;
+}
+
+/** Detect the remote origin URL. */
+export function detectRemoteUrl(cwd: string): string | undefined {
+  return git.remoteUrlOr({ cwd });
+}
+
+/** Detect the PR number via gh CLI (best effort). */
+export function detectPrNumber(cwd: string): number | undefined {
+  return git.prNumberOr({ cwd });
+}
+
+/** Gather all git info for a directory. Returns undefined if not a git repo. */
+export function gatherGitInfo(cwd: string): GitInfo | undefined {
+  const branch = detectBranch(cwd);
+  if (!branch) return undefined;
+
+  const remoteUrl = detectRemoteUrl(cwd);
+  const prNumber = detectPrNumber(cwd);
+
+  const links: GitLinks = remoteUrl ? buildGitLinks(remoteUrl, branch, prNumber) : {};
+
+  return {
+    gitBranch: branch,
+    gitBranchUrl: links.branchUrl,
+    gitPrNumber: prNumber,
+    gitPrUrl: links.prUrl,
+  };
+}
+
+// ── Jujutsu probing ────────────────────────────────────────────────────────
+
+/**
+ * Module-level cache: result of resolving `jj` once per process. The tool
+ * registry already memoizes resolutions, but reading it on every probe tick
+ * adds noise to traces. Single read on first probe, sticky for the process.
+ */
+let jjAvailable: boolean | undefined;
+
+function isJjResolvable(): boolean {
+  if (jjAvailable !== undefined) return jjAvailable;
+  try {
+    const reg = getDefaultRegistry();
+    const res = reg.resolve("jj");
+    jjAvailable = res.ok;
+  } catch {
+    jjAvailable = false;
+  }
+  return jjAvailable;
+}
+
+/**
+ * Test-only hook to reset the jj-availability cache.
+ * Production code MUST NOT call this.
+ */
+export function _resetJjAvailableForTests(): void {
+  jjAvailable = undefined;
+}
+
+/**
+ * Gather jj workspace state for a directory.
+ * Returns `undefined` when:
+ *   - `jj` is not resolvable via the tool registry, OR
+ *   - `.jj/` does not exist in cwd (fast path, no subprocess spawn).
+ *
+ * Returns a populated `JjState` when both conditions are met. Errors during
+ * `jj` invocation surface in `lastError` rather than throwing; the rest of
+ * the fields fall back to undefined / empty.
+ *
+ * Per spec scenario "Non-jj cwd incurs no jj subprocess cost".
+ */
+export function gatherJjInfo(cwd: string): JjState | undefined {
+  if (!isJjResolvable()) return undefined;
+  if (!existsSync(path.join(cwd, ".jj"))) return undefined;
+
+  const isColocated = existsSync(path.join(cwd, ".git"));
+
+  // Resolve workspace name + root. Errors are caught and surfaced via
+  // lastError so callers always get *some* JjState rather than nothing.
+  let workspaceName: string | undefined;
+  let workspaceRoot: string | undefined;
+  let lastError: string | undefined;
+
+  const rootResult = jj.workspaceRoot({ cwd });
+  if (rootResult.ok) {
+    workspaceRoot = rootResult.value;
+  } else if (rootResult.error.kind !== "not-found") {
+    lastError = describeJjError(rootResult.error);
+  }
+
+  // Workspace name: parse `jj workspace list` and match by working-copy
+  // path. The CLI does not include the path in list output, so we fall
+  // back to identifying the workspace via the `<name>@` revset matching
+  // the workspace root. For now: if there's only one workspace, use
+  // its name; otherwise default to "default" if found, else first entry.
+  // (Multi-workspace name disambiguation tracked as Phase 4 follow-up.)
+  const listResult = jj.workspaceList({ cwd });
+  if (listResult.ok) {
+    const entries = jj.parseWorkspaceList(listResult.value);
+    if (entries.length === 1) {
+      workspaceName = entries[0]?.name;
+    } else if (entries.length > 1) {
+      workspaceName = entries.find((e) => e.name === "default")?.name
+        ?? entries[0]?.name;
+    }
+  } else if (listResult.error.kind !== "not-found" && !lastError) {
+    lastError = describeJjError(listResult.error);
+  }
+
+  return {
+    isJjRepo: true,
+    isColocated,
+    workspaceName,
+    workspaceRoot,
+    lastError,
+  };
+}
+
+function describeJjError(
+  error: { kind: string; [k: string]: unknown },
+): string {
+  if (error.kind === "timeout") return "jj probe timed out";
+  if (error.kind === "exit") {
+    const stderr = typeof error.stderr === "string" ? error.stderr.trim() : "";
+    return stderr.split("\n")[0] || `jj exited ${String(error.code)}`;
+  }
+  if (error.kind === "spawn-failure") {
+    return typeof error.message === "string" ? error.message : "spawn failed";
+  }
+  return error.kind;
+}
+
+// ── Combined VCS gather ────────────────────────────────────────────────────
+
+export interface VcsInfo {
+  git?: GitInfo;
+  jj?: JjState;
+}
+
+/**
+ * Convenience helper that gathers both git and jj info in one call.
+ * Used by the bridge's per-session 30 s probe tick.
+ */
+export function gatherVcsInfo(cwd: string): VcsInfo {
+  return {
+    git: gatherGitInfo(cwd),
+    jj: gatherJjInfo(cwd),
+  };
+}

package/packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blackbelt-technology/pi-dashboard-server",
-  "version": "0.4.5",
+  "version": "0.5.0",
   "description": "Dashboard server for monitoring and interacting with pi agent sessions",
   "type": "module",
   "repository": {
@@ -31,9 +31,9 @@
     "postinstall": "node scripts/fix-pty-permissions.cjs"
   },
   "dependencies": {
-    "@blackbelt-technology/dashboard-plugin-runtime": "^0.4.5",
-    "@blackbelt-technology/pi-dashboard-extension": "^0.4.5",
-    "@blackbelt-technology/pi-dashboard-shared": "^0.4.5",
+    "@blackbelt-technology/dashboard-plugin-runtime": "^0.5.0",
+    "@blackbelt-technology/pi-dashboard-extension": "^0.5.0",
+    "@blackbelt-technology/pi-dashboard-shared": "^0.5.0",
     "@fastify/compress": "^8.3.1",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.0.0",

package/packages/server/src/__tests__/auto-attach-slug-defense.test.ts

@@ -0,0 +1,104 @@
+/**
+ * Defense-in-depth at the auto-attach rename site (event-wiring.ts).
+ *
+ * The detector (`detectOpenSpecActivity`) already rejects non-slug-shaped
+ * change names after fix-uuid-rename-bug. This file tests the second layer:
+ * even if a future detector regression returns a junk `changeName`, the
+ * auto-attach branch in `event-wiring.ts` MUST refuse to mutate session state
+ * or send `rename_session`.
+ *
+ * Approach: mock `detectOpenSpecActivity` to return a UUID-shaped result,
+ * drive a tool_execution_start event end-to-end, assert no mutation.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { WebSocket } from "ws";
+
+vi.mock("@blackbelt-technology/pi-dashboard-shared/openspec-activity-detector.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@blackbelt-technology/pi-dashboard-shared/openspec-activity-detector.js")>();
+  return {
+    ...actual,
+    detectOpenSpecActivity: vi.fn(() => ({
+      changeName: "019df0aa-1234-5678-9abc-def012345678",
+      isActive: true,
+    })),
+  };
+});
+
+// Imported AFTER vi.mock so the server picks up the mocked module.
+const { createServer } = await import("../server.js");
+
+async function connectSession(piPort: number, sessionId: string): Promise<WebSocket> {
+  const ws = new WebSocket(`ws://localhost:${piPort}`);
+  await new Promise<void>((resolve) => {
+    ws.on("open", () => {
+      ws.send(JSON.stringify({
+        type: "session_register",
+        sessionId,
+        cwd: "/tmp",
+        source: "cli",
+      }));
+      ws.send(JSON.stringify({ type: "replay_complete", sessionId }));
+      setTimeout(resolve, 50);
+    });
+  });
+  return ws;
+}
+
+describe("Auto-attach defense-in-depth: rename site rejects non-slug changeName", () => {
+  let server: Awaited<ReturnType<typeof createServer>>;
+  let piPort: number;
+  let browserPort: number;
+  let ws: WebSocket;
+  const piMessages: any[] = [];
+
+  let testPort = 19200;
+
+  beforeEach(async () => {
+    testPort += 2;
+    browserPort = testPort;
+    piPort = testPort + 1;
+    piMessages.length = 0;
+    server = await createServer({
+      port: browserPort,
+      piPort,
+      dev: true,
+      autoShutdown: false,
+      shutdownIdleSeconds: 999,
+      tunnel: false,
+      editor: { idleTimeoutMinutes: 10, maxInstances: 3 },
+    });
+    await server.start();
+    ws = await connectSession(piPort, "s1");
+    ws.on("message", (raw) => {
+      try { piMessages.push(JSON.parse(raw.toString())); } catch { /* ignore */ }
+    });
+  });
+
+  afterEach(async () => {
+    ws.close();
+    await server.stop();
+  });
+
+  it("does NOT mutate openspecChange / attachedProposal / name when detector returns a UUID", async () => {
+    // Any tool_execution_start triggers the (mocked) detector. Path content is
+    // irrelevant — the mock ignores its inputs and returns a UUID changeName.
+    ws.send(JSON.stringify({
+      type: "event_forward",
+      sessionId: "s1",
+      event: {
+        eventType: "tool_execution_start",
+        timestamp: Date.now(),
+        data: { toolName: "Write", args: { path: "openspec/changes/add-auth/proposal.md" } },
+      },
+    }));
+    await new Promise((r) => setTimeout(r, 100));
+
+    const session = server.sessionManager.get("s1");
+    expect(session?.openspecChange).toBeFalsy();
+    expect(session?.attachedProposal).toBeFalsy();
+    expect(session?.name).toBeFalsy();
+
+    const renameSent = piMessages.some((m) => m.type === "rename_session");
+    expect(renameSent).toBe(false);
+  });
+});

package/packages/server/src/__tests__/bootstrap-install-from-list.test.ts

@@ -0,0 +1,263 @@
+/**
+ * Integration tests for bootstrapInstallFromList.
+ *
+ * All file I/O and install calls are injected via opts so no real
+ * filesystem or subprocesses are touched.
+ *
+ * See change: simplify-electron-bootstrap-derived-state.
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { createBootstrapState } from "../bootstrap-state.js";
+import {
+  bootstrapInstallFromList,
+  type PackageInstaller,
+} from "../bootstrap-install-from-list.js";
+import type { InstallablePackage, InstallableList } from "@blackbelt-technology/pi-dashboard-shared/installable-list.js";
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function makePackage(overrides: Partial<InstallablePackage> = {}): InstallablePackage {
+  return {
+    name: "test-pkg",
+    version: "1.0.0",
+    required: true,
+    kind: "npm",
+    ...overrides,
+  };
+}
+
+function makeList(packages: InstallablePackage[]): InstallableList {
+  return { version: "1", packages };
+}
+
+/**
+ * Build a `bootstrapInstallFromList` opts object that bypasses all real I/O.
+ * - `listResult`: the installable list (null = file absent).
+ * - `installedNames`: package names that are already installed.
+ * - `npmInstall`/`piInstall`: injectable install fns (default: succeed).
+ */
+interface FakeOpts {
+  listResult: InstallableList | null;
+  installedNames?: string[];
+  npmInstall?: PackageInstaller;
+  piInstall?: PackageInstaller;
+}
+
+function buildOpts(fake: FakeOpts, extra?: object) {
+  const installedSet = new Set(fake.installedNames ?? []);
+  return {
+    configDir: "/fake/config",
+    managedDir: "/fake/managed",
+    isInstalled: (pkg: InstallablePackage) => installedSet.has(pkg.name),
+    npmInstall: fake.npmInstall ?? (async () => { /* succeed */ }),
+    piInstall: fake.piInstall ?? (async () => { /* succeed */ }),
+    // Override readInstallableList via module mock — done per test via vi.mock
+    // (see below). We instead inject listResult via a wrapping helper.
+    ...extra,
+  };
+}
+
+// We cannot easily mock `readInstallableList` without vi.mock at module level.
+// Instead we factor out a testable inner function and re-export it.
+// Since we cannot easily mock the module import inside bootstrapInstallFromList,
+// we use a different approach: inject a `_readList` seam via opts.
+//
+// However, the current public API doesn't expose that seam. We'll test via
+// the observable side effects (bootstrap state + thrown errors) and fake the
+// injectable installers. For the list itself, we monkey-patch the module.
+//
+// Pragmatic solution: use vi.mock to replace readInstallableList.
+
+vi.mock("@blackbelt-technology/pi-dashboard-shared/installable-list.js", () => ({
+  readInstallableList: vi.fn(),
+}));
+
+import { readInstallableList } from "@blackbelt-technology/pi-dashboard-shared/installable-list.js";
+const mockReadList = vi.mocked(readInstallableList);
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+describe("bootstrapInstallFromList", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  // ── Test 1: no installable.json (Bridge/Standalone parity) ──────────────
+
+  describe("file-absent path", () => {
+    it("returns immediately without setting installable state or calling any installer", async () => {
+      mockReadList.mockResolvedValue(null);
+      const state = createBootstrapState();
+      const npmInstall = vi.fn();
+      const piInstall = vi.fn();
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall,
+        isInstalled: () => false,
+      });
+
+      // No installer calls.
+      expect(npmInstall).not.toHaveBeenCalled();
+      expect(piInstall).not.toHaveBeenCalled();
+
+      // installable field NOT set (file was absent — no tracking started).
+      expect(state.get().installable).toBeUndefined();
+
+      // Status remains ready.
+      expect(state.get().status).toBe("ready");
+    });
+  });
+
+  // ── Test 2: synthetic installable.json ──────────────────────────────────
+
+  describe("with installable.json present", () => {
+    it("skips already-installed npm package, installs missing required + optional, final state is correct", async () => {
+      const alreadyInstalled = makePackage({ name: "already-installed-pkg", required: false });
+      const missingRequired = makePackage({ name: "missing-required-pkg", required: true });
+      const missingOptional = makePackage({ name: "missing-optional-pkg", required: false });
+
+      mockReadList.mockResolvedValue(
+        makeList([alreadyInstalled, missingRequired, missingOptional]),
+      );
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockResolvedValue(undefined);
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall: vi.fn(),
+        isInstalled: (pkg) => pkg.name === "already-installed-pkg",
+      });
+
+      // Two install calls (already-installed skipped).
+      expect(npmInstall).toHaveBeenCalledTimes(2);
+      expect(npmInstall.mock.calls[0][0].name).toBe("missing-required-pkg");
+      expect(npmInstall.mock.calls[1][0].name).toBe("missing-optional-pkg");
+
+      // Final state: installed=3 (1 pre-installed + 2 freshly installed), failed=0.
+      const installable = state.get().installable;
+      expect(installable).toBeDefined();
+      expect(installable!.total).toBe(3);
+      expect(installable!.installed).toBe(3);
+      expect(installable!.failed).toHaveLength(0);
+
+      // Status remains ready (no error).
+      expect(state.get().status).toBe("ready");
+    });
+
+    it("installs pi-extension packages via piInstall", async () => {
+      const pkg = makePackage({ name: "my-extension", kind: "pi-extension", required: true });
+      mockReadList.mockResolvedValue(makeList([pkg]));
+
+      const state = createBootstrapState();
+      const piInstall = vi.fn().mockResolvedValue(undefined);
+      const npmInstall = vi.fn();
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall,
+        isInstalled: () => false,
+      });
+
+      expect(piInstall).toHaveBeenCalledOnce();
+      expect(npmInstall).not.toHaveBeenCalled();
+      expect(piInstall.mock.calls[0][0].name).toBe("my-extension");
+    });
+
+    it("optional package failure is recorded in failed[] but does not throw", async () => {
+      const optionalFail = makePackage({ name: "optional-bad", required: false });
+      mockReadList.mockResolvedValue(makeList([optionalFail]));
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockRejectedValue(new Error("network error"));
+
+      await expect(
+        bootstrapInstallFromList(state, {
+          configDir: "/fake/config",
+          managedDir: "/fake/managed",
+          npmInstall,
+          piInstall: vi.fn(),
+          isInstalled: () => false,
+        }),
+      ).resolves.toBeUndefined();
+
+      const installable = state.get().installable;
+      expect(installable!.failed).toEqual(["optional-bad"]);
+      expect(installable!.installed).toBe(0);
+      expect(state.get().status).toBe("ready");
+    });
+
+    it("required package failure sets status=failed and throws", async () => {
+      const requiredFail = makePackage({ name: "required-bad", required: true });
+      mockReadList.mockResolvedValue(makeList([requiredFail]));
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockRejectedValue(new Error("disk full"));
+
+      await expect(
+        bootstrapInstallFromList(state, {
+          configDir: "/fake/config",
+          managedDir: "/fake/managed",
+          npmInstall,
+          piInstall: vi.fn(),
+          isInstalled: () => false,
+        }),
+      ).rejects.toThrow('Required package "required-bad" failed to install');
+
+      expect(state.get().status).toBe("failed");
+      expect(state.get().error?.message).toContain("required-bad");
+    });
+
+    it("deprecated and defaultOff packages are skipped entirely", async () => {
+      const deprecated = makePackage({ name: "old-pkg", deprecated: true });
+      const defaultOff = makePackage({ name: "opt-pkg", defaultOff: true });
+      const normal = makePackage({ name: "normal-pkg", required: true });
+      mockReadList.mockResolvedValue(makeList([deprecated, defaultOff, normal]));
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockResolvedValue(undefined);
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall: vi.fn(),
+        isInstalled: () => false,
+      });
+
+      // Only "normal-pkg" is processed (total=1, not 3).
+      expect(npmInstall).toHaveBeenCalledOnce();
+      expect(state.get().installable!.total).toBe(1);
+    });
+
+    it("emits progress steps during install", async () => {
+      const pkg = makePackage({ name: "tracked-pkg" });
+      mockReadList.mockResolvedValue(makeList([pkg]));
+
+      const state = createBootstrapState();
+      const progressSteps: string[] = [];
+      state.subscribe((s) => {
+        if (s.progress) progressSteps.push(s.progress.step);
+      });
+
+      const npmInstall = vi.fn().mockResolvedValue(undefined);
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall: vi.fn(),
+        isInstalled: () => false,
+      });
+
+      expect(progressSteps).toContain("tracked-pkg");
+    });
+  });
+});