@blackbelt-technology/pi-agent-dashboard 0.4.6 → 0.5.0

package/packages/extension/src/server-launcher.ts

@@ -45,6 +45,23 @@ export function resolveServerCliPath(): string {
   }
 }
 
+/**
+ * Build the environment object passed to the spawned server process.
+ * Always stamps DASHBOARD_STARTER=Bridge so the server knows it was
+ * launched by the pi bridge extension.
+ */
+export function buildSpawnEnv(
+  baseEnv: NodeJS.ProcessEnv = process.env,
+): Record<string, string> {
+  // Spread process.env (may contain undefined values); filter them out.
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(baseEnv)) {
+    if (v !== undefined) out[k] = v;
+  }
+  out["DASHBOARD_STARTER"] = "Bridge";
+  return out;
+}
+
 /**
  * Build the spawn arguments from config.
  */
@@ -94,7 +111,7 @@ export async function launchServer(config: DashboardConfig): Promise<LaunchResul
     const r = await spawnDetached({
       cmd: process.execPath,
       args: ["--import", loader, entry, ...args], // ban:raw-node-import-ok: entry gated by shouldUrlWrapEntry
-      env: { ...process.env },
+      env: { ...process.env, DASHBOARD_STARTER: "Bridge" },
       logFd,
     });
 

package/packages/extension/src/session-sync.ts

@@ -8,6 +8,7 @@ import { detectSessionSource } from "./source-detector.js";
 import { replayEntriesAsEvents } from "@blackbelt-technology/pi-dashboard-shared/state-replay.js";
 import { gatherGitInfo, gatherJjInfo } from "./vcs-info.js";
 import type { FlowInfo } from "@blackbelt-technology/pi-dashboard-shared/types.js";
+import { buildProviderCatalogue } from "./provider-register.js";
 
 /**
  * Send full state sync to the server (session_register, commands, flows, models).
@@ -72,6 +73,8 @@ export function sendStateSync(
         id: m.id,
       }));
       bc.connection.send({ type: "models_list", sessionId: bc.sessionId, models });
+      // See change: replace-hardcoded-provider-lists.
+      bc.connection.send({ type: "providers_list", sessionId: bc.sessionId, providers: buildProviderCatalogue() });
     } catch { /* ignore */ }
   }
 }
@@ -164,6 +167,8 @@ export function handleSessionChange(
         id: m.id,
       }));
       bc.connection.send({ type: "models_list", sessionId: bc.sessionId, models });
+      // See change: replace-hardcoded-provider-lists.
+      bc.connection.send({ type: "providers_list", sessionId: bc.sessionId, providers: buildProviderCatalogue() });
     } catch { /* ignore */ }
   }
 }

package/packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blackbelt-technology/pi-dashboard-server",
-  "version": "0.4.6",
+  "version": "0.5.0",
   "description": "Dashboard server for monitoring and interacting with pi agent sessions",
   "type": "module",
   "repository": {
@@ -31,9 +31,9 @@
     "postinstall": "node scripts/fix-pty-permissions.cjs"
   },
   "dependencies": {
-    "@blackbelt-technology/dashboard-plugin-runtime": "^0.4.6",
-    "@blackbelt-technology/pi-dashboard-extension": "^0.4.6",
-    "@blackbelt-technology/pi-dashboard-shared": "^0.4.6",
+    "@blackbelt-technology/dashboard-plugin-runtime": "^0.5.0",
+    "@blackbelt-technology/pi-dashboard-extension": "^0.5.0",
+    "@blackbelt-technology/pi-dashboard-shared": "^0.5.0",
     "@fastify/compress": "^8.3.1",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.0.0",

package/packages/server/src/__tests__/auto-attach-slug-defense.test.ts

@@ -0,0 +1,104 @@
+/**
+ * Defense-in-depth at the auto-attach rename site (event-wiring.ts).
+ *
+ * The detector (`detectOpenSpecActivity`) already rejects non-slug-shaped
+ * change names after fix-uuid-rename-bug. This file tests the second layer:
+ * even if a future detector regression returns a junk `changeName`, the
+ * auto-attach branch in `event-wiring.ts` MUST refuse to mutate session state
+ * or send `rename_session`.
+ *
+ * Approach: mock `detectOpenSpecActivity` to return a UUID-shaped result,
+ * drive a tool_execution_start event end-to-end, assert no mutation.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { WebSocket } from "ws";
+
+vi.mock("@blackbelt-technology/pi-dashboard-shared/openspec-activity-detector.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@blackbelt-technology/pi-dashboard-shared/openspec-activity-detector.js")>();
+  return {
+    ...actual,
+    detectOpenSpecActivity: vi.fn(() => ({
+      changeName: "019df0aa-1234-5678-9abc-def012345678",
+      isActive: true,
+    })),
+  };
+});
+
+// Imported AFTER vi.mock so the server picks up the mocked module.
+const { createServer } = await import("../server.js");
+
+async function connectSession(piPort: number, sessionId: string): Promise<WebSocket> {
+  const ws = new WebSocket(`ws://localhost:${piPort}`);
+  await new Promise<void>((resolve) => {
+    ws.on("open", () => {
+      ws.send(JSON.stringify({
+        type: "session_register",
+        sessionId,
+        cwd: "/tmp",
+        source: "cli",
+      }));
+      ws.send(JSON.stringify({ type: "replay_complete", sessionId }));
+      setTimeout(resolve, 50);
+    });
+  });
+  return ws;
+}
+
+describe("Auto-attach defense-in-depth: rename site rejects non-slug changeName", () => {
+  let server: Awaited<ReturnType<typeof createServer>>;
+  let piPort: number;
+  let browserPort: number;
+  let ws: WebSocket;
+  const piMessages: any[] = [];
+
+  let testPort = 19200;
+
+  beforeEach(async () => {
+    testPort += 2;
+    browserPort = testPort;
+    piPort = testPort + 1;
+    piMessages.length = 0;
+    server = await createServer({
+      port: browserPort,
+      piPort,
+      dev: true,
+      autoShutdown: false,
+      shutdownIdleSeconds: 999,
+      tunnel: false,
+      editor: { idleTimeoutMinutes: 10, maxInstances: 3 },
+    });
+    await server.start();
+    ws = await connectSession(piPort, "s1");
+    ws.on("message", (raw) => {
+      try { piMessages.push(JSON.parse(raw.toString())); } catch { /* ignore */ }
+    });
+  });
+
+  afterEach(async () => {
+    ws.close();
+    await server.stop();
+  });
+
+  it("does NOT mutate openspecChange / attachedProposal / name when detector returns a UUID", async () => {
+    // Any tool_execution_start triggers the (mocked) detector. Path content is
+    // irrelevant — the mock ignores its inputs and returns a UUID changeName.
+    ws.send(JSON.stringify({
+      type: "event_forward",
+      sessionId: "s1",
+      event: {
+        eventType: "tool_execution_start",
+        timestamp: Date.now(),
+        data: { toolName: "Write", args: { path: "openspec/changes/add-auth/proposal.md" } },
+      },
+    }));
+    await new Promise((r) => setTimeout(r, 100));
+
+    const session = server.sessionManager.get("s1");
+    expect(session?.openspecChange).toBeFalsy();
+    expect(session?.attachedProposal).toBeFalsy();
+    expect(session?.name).toBeFalsy();
+
+    const renameSent = piMessages.some((m) => m.type === "rename_session");
+    expect(renameSent).toBe(false);
+  });
+});

package/packages/server/src/__tests__/bootstrap-install-from-list.test.ts

@@ -0,0 +1,263 @@
+/**
+ * Integration tests for bootstrapInstallFromList.
+ *
+ * All file I/O and install calls are injected via opts so no real
+ * filesystem or subprocesses are touched.
+ *
+ * See change: simplify-electron-bootstrap-derived-state.
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { createBootstrapState } from "../bootstrap-state.js";
+import {
+  bootstrapInstallFromList,
+  type PackageInstaller,
+} from "../bootstrap-install-from-list.js";
+import type { InstallablePackage, InstallableList } from "@blackbelt-technology/pi-dashboard-shared/installable-list.js";
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function makePackage(overrides: Partial<InstallablePackage> = {}): InstallablePackage {
+  return {
+    name: "test-pkg",
+    version: "1.0.0",
+    required: true,
+    kind: "npm",
+    ...overrides,
+  };
+}
+
+function makeList(packages: InstallablePackage[]): InstallableList {
+  return { version: "1", packages };
+}
+
+/**
+ * Build a `bootstrapInstallFromList` opts object that bypasses all real I/O.
+ * - `listResult`: the installable list (null = file absent).
+ * - `installedNames`: package names that are already installed.
+ * - `npmInstall`/`piInstall`: injectable install fns (default: succeed).
+ */
+interface FakeOpts {
+  listResult: InstallableList | null;
+  installedNames?: string[];
+  npmInstall?: PackageInstaller;
+  piInstall?: PackageInstaller;
+}
+
+function buildOpts(fake: FakeOpts, extra?: object) {
+  const installedSet = new Set(fake.installedNames ?? []);
+  return {
+    configDir: "/fake/config",
+    managedDir: "/fake/managed",
+    isInstalled: (pkg: InstallablePackage) => installedSet.has(pkg.name),
+    npmInstall: fake.npmInstall ?? (async () => { /* succeed */ }),
+    piInstall: fake.piInstall ?? (async () => { /* succeed */ }),
+    // Override readInstallableList via module mock — done per test via vi.mock
+    // (see below). We instead inject listResult via a wrapping helper.
+    ...extra,
+  };
+}
+
+// We cannot easily mock `readInstallableList` without vi.mock at module level.
+// Instead we factor out a testable inner function and re-export it.
+// Since we cannot easily mock the module import inside bootstrapInstallFromList,
+// we use a different approach: inject a `_readList` seam via opts.
+//
+// However, the current public API doesn't expose that seam. We'll test via
+// the observable side effects (bootstrap state + thrown errors) and fake the
+// injectable installers. For the list itself, we monkey-patch the module.
+//
+// Pragmatic solution: use vi.mock to replace readInstallableList.
+
+vi.mock("@blackbelt-technology/pi-dashboard-shared/installable-list.js", () => ({
+  readInstallableList: vi.fn(),
+}));
+
+import { readInstallableList } from "@blackbelt-technology/pi-dashboard-shared/installable-list.js";
+const mockReadList = vi.mocked(readInstallableList);
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+describe("bootstrapInstallFromList", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  // ── Test 1: no installable.json (Bridge/Standalone parity) ──────────────
+
+  describe("file-absent path", () => {
+    it("returns immediately without setting installable state or calling any installer", async () => {
+      mockReadList.mockResolvedValue(null);
+      const state = createBootstrapState();
+      const npmInstall = vi.fn();
+      const piInstall = vi.fn();
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall,
+        isInstalled: () => false,
+      });
+
+      // No installer calls.
+      expect(npmInstall).not.toHaveBeenCalled();
+      expect(piInstall).not.toHaveBeenCalled();
+
+      // installable field NOT set (file was absent — no tracking started).
+      expect(state.get().installable).toBeUndefined();
+
+      // Status remains ready.
+      expect(state.get().status).toBe("ready");
+    });
+  });
+
+  // ── Test 2: synthetic installable.json ──────────────────────────────────
+
+  describe("with installable.json present", () => {
+    it("skips already-installed npm package, installs missing required + optional, final state is correct", async () => {
+      const alreadyInstalled = makePackage({ name: "already-installed-pkg", required: false });
+      const missingRequired = makePackage({ name: "missing-required-pkg", required: true });
+      const missingOptional = makePackage({ name: "missing-optional-pkg", required: false });
+
+      mockReadList.mockResolvedValue(
+        makeList([alreadyInstalled, missingRequired, missingOptional]),
+      );
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockResolvedValue(undefined);
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall: vi.fn(),
+        isInstalled: (pkg) => pkg.name === "already-installed-pkg",
+      });
+
+      // Two install calls (already-installed skipped).
+      expect(npmInstall).toHaveBeenCalledTimes(2);
+      expect(npmInstall.mock.calls[0][0].name).toBe("missing-required-pkg");
+      expect(npmInstall.mock.calls[1][0].name).toBe("missing-optional-pkg");
+
+      // Final state: installed=3 (1 pre-installed + 2 freshly installed), failed=0.
+      const installable = state.get().installable;
+      expect(installable).toBeDefined();
+      expect(installable!.total).toBe(3);
+      expect(installable!.installed).toBe(3);
+      expect(installable!.failed).toHaveLength(0);
+
+      // Status remains ready (no error).
+      expect(state.get().status).toBe("ready");
+    });
+
+    it("installs pi-extension packages via piInstall", async () => {
+      const pkg = makePackage({ name: "my-extension", kind: "pi-extension", required: true });
+      mockReadList.mockResolvedValue(makeList([pkg]));
+
+      const state = createBootstrapState();
+      const piInstall = vi.fn().mockResolvedValue(undefined);
+      const npmInstall = vi.fn();
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall,
+        isInstalled: () => false,
+      });
+
+      expect(piInstall).toHaveBeenCalledOnce();
+      expect(npmInstall).not.toHaveBeenCalled();
+      expect(piInstall.mock.calls[0][0].name).toBe("my-extension");
+    });
+
+    it("optional package failure is recorded in failed[] but does not throw", async () => {
+      const optionalFail = makePackage({ name: "optional-bad", required: false });
+      mockReadList.mockResolvedValue(makeList([optionalFail]));
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockRejectedValue(new Error("network error"));
+
+      await expect(
+        bootstrapInstallFromList(state, {
+          configDir: "/fake/config",
+          managedDir: "/fake/managed",
+          npmInstall,
+          piInstall: vi.fn(),
+          isInstalled: () => false,
+        }),
+      ).resolves.toBeUndefined();
+
+      const installable = state.get().installable;
+      expect(installable!.failed).toEqual(["optional-bad"]);
+      expect(installable!.installed).toBe(0);
+      expect(state.get().status).toBe("ready");
+    });
+
+    it("required package failure sets status=failed and throws", async () => {
+      const requiredFail = makePackage({ name: "required-bad", required: true });
+      mockReadList.mockResolvedValue(makeList([requiredFail]));
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockRejectedValue(new Error("disk full"));
+
+      await expect(
+        bootstrapInstallFromList(state, {
+          configDir: "/fake/config",
+          managedDir: "/fake/managed",
+          npmInstall,
+          piInstall: vi.fn(),
+          isInstalled: () => false,
+        }),
+      ).rejects.toThrow('Required package "required-bad" failed to install');
+
+      expect(state.get().status).toBe("failed");
+      expect(state.get().error?.message).toContain("required-bad");
+    });
+
+    it("deprecated and defaultOff packages are skipped entirely", async () => {
+      const deprecated = makePackage({ name: "old-pkg", deprecated: true });
+      const defaultOff = makePackage({ name: "opt-pkg", defaultOff: true });
+      const normal = makePackage({ name: "normal-pkg", required: true });
+      mockReadList.mockResolvedValue(makeList([deprecated, defaultOff, normal]));
+
+      const state = createBootstrapState();
+      const npmInstall = vi.fn().mockResolvedValue(undefined);
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall: vi.fn(),
+        isInstalled: () => false,
+      });
+
+      // Only "normal-pkg" is processed (total=1, not 3).
+      expect(npmInstall).toHaveBeenCalledOnce();
+      expect(state.get().installable!.total).toBe(1);
+    });
+
+    it("emits progress steps during install", async () => {
+      const pkg = makePackage({ name: "tracked-pkg" });
+      mockReadList.mockResolvedValue(makeList([pkg]));
+
+      const state = createBootstrapState();
+      const progressSteps: string[] = [];
+      state.subscribe((s) => {
+        if (s.progress) progressSteps.push(s.progress.step);
+      });
+
+      const npmInstall = vi.fn().mockResolvedValue(undefined);
+
+      await bootstrapInstallFromList(state, {
+        configDir: "/fake/config",
+        managedDir: "/fake/managed",
+        npmInstall,
+        piInstall: vi.fn(),
+        isInstalled: () => false,
+      });
+
+      expect(progressSteps).toContain("tracked-pkg");
+    });
+  });
+});

package/packages/server/src/__tests__/browser-gateway-snapshot-on-connect.test.ts

@@ -0,0 +1,143 @@
+/**
+ * Regression suite for change: fix-stale-sessions-on-reconnect.
+ *
+ * Pin: on every browser WS connect, the gateway sends exactly one
+ * `sessions_snapshot` message containing all sessions and all non-empty
+ * per-cwd orders, AND it does NOT iterate per-session `session_added`
+ * or per-cwd `sessions_reordered` for the bootstrap.
+ */
+import { describe, it, expect, vi } from "vitest";
+import { EventEmitter } from "node:events";
+import { createBrowserGateway } from "../browser-gateway.js";
+import { createMemorySessionManager } from "../memory-session-manager.js";
+import { createMemoryEventStore } from "../memory-event-store.js";
+import type { PiGateway } from "../pi-gateway.js";
+import type { SessionOrderManager } from "../session-order-manager.js";
+
+function makeFakeWs() {
+  const ws = new EventEmitter() as EventEmitter & {
+    send: ReturnType<typeof vi.fn>;
+    close: ReturnType<typeof vi.fn>;
+    readyState: number;
+    OPEN: number;
+  };
+  ws.send = vi.fn();
+  ws.close = vi.fn();
+  ws.readyState = 1;
+  ws.OPEN = 1;
+  return ws;
+}
+
+function makeStubPiGateway(): PiGateway {
+  return {
+    start: vi.fn(),
+    stop: vi.fn(),
+    sendToSession: vi.fn(),
+    getConnectedSessionIds: vi.fn(() => []),
+    hasSession: vi.fn(() => false),
+    onEvent: vi.fn(),
+  } as unknown as PiGateway;
+}
+
+function makeStubOrderManager(orders: Record<string, string[]>): SessionOrderManager {
+  return {
+    insert: vi.fn(),
+    remove: vi.fn(),
+    getOrder: vi.fn((cwd: string) => orders[cwd] ?? []),
+    reorder: vi.fn(),
+    getAllOrders: vi.fn(() => orders),
+    moveToFront: vi.fn(),
+  } as unknown as SessionOrderManager;
+}
+
+function sentMessages(ws: ReturnType<typeof makeFakeWs>) {
+  return ws.send.mock.calls
+    .map((args) => {
+      try { return JSON.parse(String(args[0])); } catch { return null; }
+    })
+    .filter((m): m is Record<string, unknown> => !!m && typeof m === "object");
+}
+
+describe("browser-gateway on-connect sessions_snapshot", () => {
+  it("sends exactly one sessions_snapshot and no per-session session_added/sessions_reordered", () => {
+    const sessionManager = createMemorySessionManager();
+    sessionManager.restore({
+      id: "alive-1",
+      cwd: "/repo/a",
+      source: "tui",
+      status: "active",
+      startedAt: 1,
+      hidden: false,
+      dataUnavailable: false,
+    } as never);
+    sessionManager.restore({
+      id: "ended-1",
+      cwd: "/repo/a",
+      source: "tui",
+      status: "ended",
+      startedAt: 2,
+      endedAt: 3,
+      hidden: false,
+      dataUnavailable: true,
+    } as never);
+
+    const orders: Record<string, string[]> = {
+      "/repo/a": ["alive-1"],
+      "/repo/empty": [], // should be filtered out of snapshot.orders
+    };
+
+    const gateway = createBrowserGateway(
+      sessionManager,
+      createMemoryEventStore(() => false),
+      makeStubPiGateway(),
+      undefined,
+      undefined,
+      makeStubOrderManager(orders),
+    );
+
+    const ws = makeFakeWs();
+    gateway.wss.emit("connection", ws, {});
+
+    const msgs = sentMessages(ws);
+    const snapshots = msgs.filter((m) => m.type === "sessions_snapshot");
+    const sessionAddeds = msgs.filter((m) => m.type === "session_added");
+    const sessionsReordereds = msgs.filter((m) => m.type === "sessions_reordered");
+
+    expect(snapshots).toHaveLength(1);
+    expect(sessionAddeds).toHaveLength(0);
+    expect(sessionsReordereds).toHaveLength(0);
+
+    const snap = snapshots[0] as { sessions: Array<{ id: string; status: string }>; orders: Record<string, string[]> };
+    const ids = snap.sessions.map((s) => s.id).sort();
+    expect(ids).toEqual(["alive-1", "ended-1"]); // alive AND ended both included
+    expect(snap.orders).toEqual({ "/repo/a": ["alive-1"] }); // empty entry filtered out
+  });
+
+  it("snapshot is sent before pinned_dirs_updated and other on-connect sends", () => {
+    const sessionManager = createMemorySessionManager();
+    const gateway = createBrowserGateway(
+      sessionManager,
+      createMemoryEventStore(() => false),
+      makeStubPiGateway(),
+      undefined,
+      undefined,
+      makeStubOrderManager({}),
+      // Stub preferencesStore so pinned_dirs_updated fires.
+      {
+        getPinnedDirectories: () => [],
+        setPinnedDirectories: () => {},
+        getSessionOrder: () => ({}),
+        setSessionOrder: () => {},
+      } as never,
+    );
+
+    const ws = makeFakeWs();
+    gateway.wss.emit("connection", ws, {});
+
+    const types = sentMessages(ws).map((m) => m.type as string);
+    const snapshotIdx = types.indexOf("sessions_snapshot");
+    const pinnedIdx = types.indexOf("pinned_dirs_updated");
+    expect(snapshotIdx).toBeGreaterThanOrEqual(0);
+    expect(pinnedIdx).toBeGreaterThan(snapshotIdx);
+  });
+});