@cloudcli-ai/cloudcli 1.37.1 → 1.37.3

package/server/modules/scheduled-messages/services/scheduled-messages.service.ts

@@ -0,0 +1,121 @@
+import { scheduledMessagesDb, sessionsDb } from '@/modules/database/index.js';
+import type { ScheduledMessageRow } from '@/modules/database/index.js';
+import { AppError } from '@/shared/utils.js';
+
+/** How far ahead a message may be scheduled. Beyond this it is almost certainly a mistake. */
+const MAX_SCHEDULE_AHEAD_MS = 365 * 24 * 60 * 60 * 1000;
+const MAX_CONTENT_LENGTH = 100_000;
+
+export type ScheduledMessage = {
+  id: string;
+  sessionId: string;
+  content: string;
+  options: Record<string, unknown>;
+  scheduledFor: string;
+  status: ScheduledMessageRow['status'];
+  failureReason: string | null;
+  createdAt: string;
+};
+
+function readOptions(raw: string): Record<string, unknown> {
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown>
+      : {};
+  } catch {
+    // A corrupt options blob must not stop the message from being sent.
+    return {};
+  }
+}
+
+export function toScheduledMessage(row: ScheduledMessageRow): ScheduledMessage {
+  return {
+    id: row.id,
+    sessionId: row.session_id,
+    content: row.content,
+    options: readOptions(row.options),
+    scheduledFor: row.scheduled_for,
+    status: row.status,
+    failureReason: row.failure_reason,
+    createdAt: row.created_at,
+  };
+}
+
+export const scheduledMessagesService = {
+  /**
+   * Records a message to send to a session later.
+   *
+   * The time is taken as an absolute instant, so the schedule does not move if
+   * the user changes time zone — or schedules from a phone and is on a laptop
+   * when it fires.
+   */
+  schedule(input: {
+    userId: number;
+    sessionId: string;
+    content: string;
+    options?: unknown;
+    scheduledFor: string;
+  }): ScheduledMessage {
+    const content = input.content.trim();
+    if (!content) {
+      throw new AppError('A scheduled message needs some text.', {
+        code: 'CONTENT_REQUIRED',
+        statusCode: 400,
+      });
+    }
+    if (content.length > MAX_CONTENT_LENGTH) {
+      throw new AppError('That message is too long to schedule.', {
+        code: 'CONTENT_TOO_LONG',
+        statusCode: 400,
+      });
+    }
+
+    const scheduledFor = new Date(input.scheduledFor);
+    if (Number.isNaN(scheduledFor.getTime())) {
+      throw new AppError('scheduledFor must be an ISO timestamp.', {
+        code: 'INVALID_SCHEDULE_TIME',
+        statusCode: 400,
+      });
+    }
+    if (scheduledFor.getTime() - Date.now() > MAX_SCHEDULE_AHEAD_MS) {
+      throw new AppError('That is too far in the future to schedule.', {
+        code: 'SCHEDULE_TOO_FAR_AHEAD',
+        statusCode: 400,
+      });
+    }
+
+    if (!sessionsDb.getSessionById(input.sessionId)) {
+      throw new AppError(`Session "${input.sessionId}" was not found.`, {
+        code: 'SESSION_NOT_FOUND',
+        statusCode: 404,
+      });
+    }
+
+    return toScheduledMessage(scheduledMessagesDb.create({
+      userId: input.userId,
+      sessionId: input.sessionId,
+      content,
+      options: input.options ?? {},
+      scheduledFor,
+    }));
+  },
+
+  listForSession(userId: number, sessionId: string): ScheduledMessage[] {
+    return scheduledMessagesDb.listForSession(userId, sessionId).map(toScheduledMessage);
+  },
+
+  listPending(userId: number): ScheduledMessage[] {
+    return scheduledMessagesDb.listPendingForUser(userId).map(toScheduledMessage);
+  },
+
+  /** Cancels a pending message, or dismisses a failed one. */
+  cancel(userId: number, id: string): void {
+    if (!scheduledMessagesDb.cancel(userId, id)) {
+      throw new AppError('That message has already been sent or cancelled.', {
+        code: 'SCHEDULED_MESSAGE_NOT_PENDING',
+        statusCode: 409,
+      });
+    }
+  },
+};

package/server/modules/scheduled-messages/tests/scheduled-messages.test.ts

@@ -0,0 +1,310 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import { closeConnection, initializeDatabase, scheduledMessagesDb, sessionDraftsDb, sessionsDb, userDb } from '@/modules/database/index.js';
+import { dispatchDueScheduledMessages, dispatchQueuedMessages } from '@/modules/scheduled-messages/services/scheduled-message-dispatcher.service.js';
+import { scheduledMessagesService } from '@/modules/scheduled-messages/services/scheduled-messages.service.js';
+import { chatRunRegistry } from '@/modules/websocket/index.js';
+
+const SESSION_ID = 'scheduled-session';
+
+async function withIsolatedDatabase(runTest: (userId: number) => void | Promise<void>): Promise<void> {
+  const previousDatabasePath = process.env.DATABASE_PATH;
+  const tempDirectory = await mkdtemp(path.join(tmpdir(), 'scheduled-messages-'));
+
+  closeConnection();
+  process.env.DATABASE_PATH = path.join(tempDirectory, 'auth.db');
+  await initializeDatabase();
+
+  try {
+    const user = userDb.createUser('scheduler', 'hash');
+    sessionsDb.createAppSession(SESSION_ID, 'claude', tempDirectory, 'Scheduled session');
+    await runTest(Number(user.id));
+  } finally {
+    chatRunRegistry.clearAll();
+    closeConnection();
+    if (previousDatabasePath === undefined) {
+      delete process.env.DATABASE_PATH;
+    } else {
+      process.env.DATABASE_PATH = previousDatabasePath;
+    }
+    await rm(tempDirectory, { recursive: true, force: true });
+  }
+}
+
+type RunCall = { provider: string; command: string; options: Record<string, unknown> };
+
+function createRuntime(runs: RunCall[], behaviour: 'ok' | 'throw' = 'ok', aborts: string[] = []) {
+  return {
+    hasRuntime: () => true,
+    run: async (provider: string, command: string, options: Record<string, unknown>) => {
+      if (behaviour === 'throw') {
+        throw new Error('provider exploded');
+      }
+      runs.push({ provider, command, options });
+    },
+    abort: async (_provider: string, sessionId: string) => {
+      aborts.push(sessionId);
+      return true;
+    },
+  } as never;
+}
+
+test('a message due in the past is sent on the next pass, not skipped', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    // The server was down when this came due.
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'run the nightly checks',
+      scheduledFor: new Date(Date.now() - 60_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    const sent = await dispatchDueScheduledMessages(createRuntime(runs));
+
+    assert.equal(sent, 1);
+    assert.equal(runs.length, 1);
+    assert.equal(runs[0].command, 'run the nightly checks');
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'sent');
+  });
+});
+
+test('a queued message is sent by the server without a browser connection', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    sessionDraftsDb.saveDraft(userId, SESSION_ID, {
+      text: '',
+      queuedMessage: {
+        content: 'continue on the VPS',
+        options: { model: 'claude-opus-5' },
+        attachments: [{ path: '/tmp/upload.png' }],
+      },
+    });
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchQueuedMessages(createRuntime(runs)), 1);
+    assert.equal(runs.length, 1);
+    assert.equal(runs[0].command, 'continue on the VPS');
+    assert.equal(runs[0].options.model, 'claude-opus-5');
+    assert.deepEqual(runs[0].options.attachments, []);
+    assert.equal(sessionDraftsDb.getDrafts(userId).length, 0);
+  });
+});
+
+test('a queued message stays pending while its session is busy', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    sessionDraftsDb.saveDraft(userId, SESSION_ID, {
+      text: '',
+      queuedMessage: { content: 'send after this run' },
+    });
+    chatRunRegistry.startRun({
+      appSessionId: SESSION_ID,
+      provider: 'claude',
+      providerSessionId: null,
+      connection: null,
+      userId,
+    });
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchQueuedMessages(createRuntime(runs)), 0);
+    assert.equal(runs.length, 0);
+    assert.deepEqual(sessionDraftsDb.getDrafts(userId)[0]?.queuedMessage, {
+      content: 'send after this run',
+    });
+  });
+});
+
+test('a due message interrupts a run in progress instead of failing', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'the schedule wins',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    chatRunRegistry.startRun({
+      appSessionId: SESSION_ID,
+      provider: 'claude',
+      providerSessionId: null,
+      connection: null,
+      userId,
+    });
+
+    const runs: RunCall[] = [];
+    const aborts: string[] = [];
+    assert.equal(await dispatchDueScheduledMessages(createRuntime(runs, 'ok', aborts)), 1);
+
+    assert.deepEqual(aborts, [SESSION_ID]);
+    assert.equal(runs.length, 1);
+    assert.equal(runs[0].command, 'the schedule wins');
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'sent');
+  });
+});
+
+test('a message that is not due yet is left alone', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'later',
+      scheduledFor: new Date(Date.now() + 3_600_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchDueScheduledMessages(createRuntime(runs)), 0);
+    assert.equal(runs.length, 0);
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'pending');
+  });
+});
+
+test('a due message is claimed once, so overlapping passes cannot double-send it', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'only once',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    const runtime = createRuntime(runs);
+    await Promise.all([
+      dispatchDueScheduledMessages(runtime),
+      dispatchDueScheduledMessages(runtime),
+    ]);
+
+    assert.equal(runs.length, 1);
+  });
+});
+
+test('the composer settings it was scheduled with travel with it', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'with options',
+      options: { model: 'claude-opus-5', permissionMode: 'plan' },
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    await dispatchDueScheduledMessages(createRuntime(runs));
+
+    assert.equal(runs[0].options.model, 'claude-opus-5');
+    assert.equal(runs[0].options.permissionMode, 'plan');
+  });
+});
+
+test('a provider failure is recorded on the message instead of vanishing', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'will fail',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+
+    await dispatchDueScheduledMessages(createRuntime([], 'throw'));
+
+    const row = scheduledMessagesDb.listForSession(userId, SESSION_ID)[0];
+    assert.equal(row.status, 'failed');
+    assert.match(row.failure_reason ?? '', /provider exploded/);
+  });
+});
+
+test('a cancelled message never fires', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'never mind',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    scheduledMessagesService.cancel(userId, scheduled.id);
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchDueScheduledMessages(createRuntime(runs)), 0);
+    assert.equal(runs.length, 0);
+  });
+});
+
+test('a failed message can be dismissed, and stays dismissed', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'will fail',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    await dispatchDueScheduledMessages(createRuntime([], 'throw'));
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'failed');
+
+    scheduledMessagesService.cancel(userId, scheduled.id);
+
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'cancelled');
+  });
+});
+
+test('cancelling something that already fired is refused', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'gone',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    await dispatchDueScheduledMessages(createRuntime([]));
+
+    assert.throws(
+      () => scheduledMessagesService.cancel(userId, scheduled.id),
+      (error: Error & { code?: string }) => error.code === 'SCHEDULED_MESSAGE_NOT_PENDING',
+    );
+  });
+});
+
+test('one user cannot cancel another user\'s scheduled message', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'mine',
+      scheduledFor: new Date(Date.now() + 3_600_000).toISOString(),
+    });
+
+    assert.throws(
+      () => scheduledMessagesService.cancel(userId + 1, scheduled.id),
+      (error: Error & { code?: string }) => error.code === 'SCHEDULED_MESSAGE_NOT_PENDING',
+    );
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'pending');
+  });
+});
+
+test('scheduling validates its input', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const base = { userId, sessionId: SESSION_ID, scheduledFor: new Date(Date.now() + 1000).toISOString() };
+
+    assert.throws(
+      () => scheduledMessagesService.schedule({ ...base, content: '   ' }),
+      (error: Error & { code?: string }) => error.code === 'CONTENT_REQUIRED',
+    );
+    assert.throws(
+      () => scheduledMessagesService.schedule({ ...base, content: 'hi', scheduledFor: 'not a date' }),
+      (error: Error & { code?: string }) => error.code === 'INVALID_SCHEDULE_TIME',
+    );
+    assert.throws(
+      () => scheduledMessagesService.schedule({
+        ...base,
+        content: 'hi',
+        scheduledFor: new Date(Date.now() + 400 * 24 * 3600 * 1000).toISOString(),
+      }),
+      (error: Error & { code?: string }) => error.code === 'SCHEDULE_TOO_FAR_AHEAD',
+    );
+    assert.throws(
+      () => scheduledMessagesService.schedule({ ...base, sessionId: 'nope', content: 'hi' }),
+      (error: Error & { code?: string }) => error.code === 'SESSION_NOT_FOUND',
+    );
+  });
+});

package/server/modules/taskmaster/taskmaster.routes.ts

@@ -13,6 +13,8 @@ import path from 'path';
 
 import express from 'express';
 
+import { WS_OPEN_STATE, connectedClients } from '@/modules/websocket/index.js';
+
 import type { createTaskmasterService } from './taskmaster.service.js';
 // cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution — required
 // here since task-master/npx are .cmd shims on Windows.
@@ -25,22 +27,30 @@ type TaskmasterRouterDependencies = {
     taskmasterService: ReturnType<typeof createTaskmasterService>;
 };
 
-function broadcastTaskMasterUpdate(wss, type, projectId, payloadKey, payload) {
-    if (!wss || !projectId) return;
+/**
+ * These frames are `type`-keyed and only TaskMasterContext, which lives on the
+ * `/ws` chat socket, knows what to do with them. Broadcasting over the raw
+ * `wss.clients` set instead delivered them to every `/shell`, `/plugin-ws` and
+ * `/desktop-notifications` socket as well, where they were parsed and dropped —
+ * and, on `/plugin-ws`, handed to third-party plugin frontends that have no
+ * business seeing them. `connectedClients` is the `/ws`-only set every other
+ * broadcast in the server already uses.
+ */
+function broadcastTaskMasterUpdate(type, projectId, payloadKey, payload) {
+    if (!projectId) return;
     const message = JSON.stringify({
         type,
         projectId,
         ...(payload === undefined ? {} : { [payloadKey]: payload }),
         timestamp: new Date().toISOString(),
     });
-    wss.clients.forEach((client) => {
-        if (client.readyState === 1) client.send(message);
+    connectedClients.forEach((client) => {
+        if (client.readyState === WS_OPEN_STATE) client.send(message);
     });
 }
 
-function broadcastTaskMasterProjectUpdate(wss, projectId, taskMasterData) {
+function broadcastTaskMasterProjectUpdate(projectId, taskMasterData) {
     broadcastTaskMasterUpdate(
-        wss,
         'taskmaster-project-updated',
         projectId,
         'taskMasterData',
@@ -48,8 +58,8 @@ function broadcastTaskMasterProjectUpdate(wss, projectId, taskMasterData) {
     );
 }
 
-function broadcastTaskMasterTasksUpdate(wss, projectId, tasksData) {
-    broadcastTaskMasterUpdate(wss, 'taskmaster-tasks-updated', projectId, 'tasksData', tasksData);
+function broadcastTaskMasterTasksUpdate(projectId, tasksData) {
+    broadcastTaskMasterUpdate('taskmaster-tasks-updated', projectId, 'tasksData', tasksData);
 }
 
 /**
@@ -596,13 +606,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                     // Broadcast TaskMaster project update via WebSocket. The
                     // WebSocket payload keeps using `projectId` so the frontend
                     // can match notifications against the current selection.
-                    if (req.app.locals.wss) {
-                        broadcastTaskMasterProjectUpdate(
-                            req.app.locals.wss,
-                            projectId,
-                            { hasTaskmaster: true, status: 'initialized' }
-                        );
-                    }
+                    broadcastTaskMasterProjectUpdate(projectId, { hasTaskmaster: true, status: 'initialized' });
 
                     res.json({
                         projectId,
@@ -688,12 +692,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                 if (code === 0) {
                     // Broadcast task update via WebSocket using the projectId so
                     // clients subscribed to this project get notified immediately.
-                    if (req.app.locals.wss) {
-                        broadcastTaskMasterTasksUpdate(
-                            req.app.locals.wss,
-                            projectId
-                        );
-                    }
+                    broadcastTaskMasterTasksUpdate(projectId);
 
                     res.json({
                         projectId,
@@ -748,9 +747,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                 }, ({ code, error, stdout, stderr }) => {
                     if (code === 0) {
                         // Broadcast task update via WebSocket
-                        if (req.app.locals.wss) {
-                            broadcastTaskMasterTasksUpdate(req.app.locals.wss, projectId);
-                        }
+                        broadcastTaskMasterTasksUpdate(projectId);
 
                         res.json({
                             projectId,
@@ -787,9 +784,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                 }, ({ code, error, stdout, stderr }) => {
                     if (code === 0) {
                         // Broadcast task update via WebSocket
-                        if (req.app.locals.wss) {
-                            broadcastTaskMasterTasksUpdate(req.app.locals.wss, projectId);
-                        }
+                        broadcastTaskMasterTasksUpdate(projectId);
 
                         res.json({
                             projectId,
@@ -870,12 +865,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
             }, ({ code, error, stdout, stderr }) => {
                 if (code === 0) {
                     // Broadcast task update via WebSocket
-                    if (req.app.locals.wss) {
-                        broadcastTaskMasterTasksUpdate(
-                            req.app.locals.wss,
-                            projectId
-                        );
-                    }
+                    broadcastTaskMasterTasksUpdate(projectId);
 
                     res.json({
                         projectId,

package/server/modules/taskmaster/tests/taskmaster.routes.test.ts

@@ -6,6 +6,8 @@ import test from 'node:test';
 
 import express from 'express';
 
+import { connectedClients } from '@/modules/websocket/index.js';
+
 import { createTaskmasterRouter } from '../taskmaster.routes.js';
 
 test('tasks route resolves project ids through the injected project adapter', async () => {
@@ -142,3 +144,58 @@ test('TaskMaster process errors use the endpoint failure response and settle onc
     await new Promise<void>((resolve) => server.close(() => resolve()));
   }
 });
+
+test('TaskMaster broadcasts reach only the tracked chat clients', async () => {
+  const child = new EventEmitter() as EventEmitter & {
+    stdin: PassThrough;
+    stdout: PassThrough;
+    stderr: PassThrough;
+  };
+  child.stdin = new PassThrough();
+  child.stdout = new PassThrough();
+  child.stderr = new PassThrough();
+
+  const chatClient = { readyState: 1, frames: [] as string[], send(data: string) { this.frames.push(data); } };
+  const closingClient = { readyState: 3, frames: [] as string[], send(data: string) { this.frames.push(data); } };
+
+  const router = createTaskmasterRouter({
+    fileSystem: { constants: { F_OK: 0 } } as typeof import('node:fs'),
+    fileSystemPromises: {
+      access: async () => { throw new Error('not initialized'); },
+    } as unknown as typeof import('node:fs/promises'),
+    spawnProcess: (() => {
+      process.nextTick(() => child.emit('close', 0));
+      return child;
+    }) as unknown as Parameters<typeof createTaskmasterRouter>[0]['spawnProcess'],
+    resolveProjectPathById: () => '/workspace/project',
+    taskmasterService: {
+      detectMcpServer: async () => ({
+        hasMCPServer: false,
+        reason: 'Not configured',
+        hasConfig: false,
+      }),
+    },
+  });
+  const app = express().use('/api/taskmaster', router);
+  const server = app.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+
+  connectedClients.add(chatClient as never);
+  connectedClients.add(closingClient as never);
+  try {
+    const address = server.address() as AddressInfo;
+    const response = await fetch(`http://127.0.0.1:${address.port}/api/taskmaster/init/project-1`, {
+      method: 'POST',
+    });
+    assert.equal(response.status, 200);
+
+    assert.equal(chatClient.frames.length, 1);
+    const frame = JSON.parse(chatClient.frames[0]) as Record<string, unknown>;
+    assert.equal(frame.type, 'taskmaster-project-updated');
+    assert.equal(frame.projectId, 'project-1');
+    assert.equal(closingClient.frames.length, 0);
+  } finally {
+    connectedClients.clear();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});