@cloudcli-ai/cloudcli 1.37.2 → 1.37.3

package/server/modules/scheduled-messages/tests/scheduled-messages.test.ts

@@ -0,0 +1,310 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import { closeConnection, initializeDatabase, scheduledMessagesDb, sessionDraftsDb, sessionsDb, userDb } from '@/modules/database/index.js';
+import { dispatchDueScheduledMessages, dispatchQueuedMessages } from '@/modules/scheduled-messages/services/scheduled-message-dispatcher.service.js';
+import { scheduledMessagesService } from '@/modules/scheduled-messages/services/scheduled-messages.service.js';
+import { chatRunRegistry } from '@/modules/websocket/index.js';
+
+const SESSION_ID = 'scheduled-session';
+
+async function withIsolatedDatabase(runTest: (userId: number) => void | Promise<void>): Promise<void> {
+  const previousDatabasePath = process.env.DATABASE_PATH;
+  const tempDirectory = await mkdtemp(path.join(tmpdir(), 'scheduled-messages-'));
+
+  closeConnection();
+  process.env.DATABASE_PATH = path.join(tempDirectory, 'auth.db');
+  await initializeDatabase();
+
+  try {
+    const user = userDb.createUser('scheduler', 'hash');
+    sessionsDb.createAppSession(SESSION_ID, 'claude', tempDirectory, 'Scheduled session');
+    await runTest(Number(user.id));
+  } finally {
+    chatRunRegistry.clearAll();
+    closeConnection();
+    if (previousDatabasePath === undefined) {
+      delete process.env.DATABASE_PATH;
+    } else {
+      process.env.DATABASE_PATH = previousDatabasePath;
+    }
+    await rm(tempDirectory, { recursive: true, force: true });
+  }
+}
+
+type RunCall = { provider: string; command: string; options: Record<string, unknown> };
+
+function createRuntime(runs: RunCall[], behaviour: 'ok' | 'throw' = 'ok', aborts: string[] = []) {
+  return {
+    hasRuntime: () => true,
+    run: async (provider: string, command: string, options: Record<string, unknown>) => {
+      if (behaviour === 'throw') {
+        throw new Error('provider exploded');
+      }
+      runs.push({ provider, command, options });
+    },
+    abort: async (_provider: string, sessionId: string) => {
+      aborts.push(sessionId);
+      return true;
+    },
+  } as never;
+}
+
+test('a message due in the past is sent on the next pass, not skipped', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    // The server was down when this came due.
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'run the nightly checks',
+      scheduledFor: new Date(Date.now() - 60_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    const sent = await dispatchDueScheduledMessages(createRuntime(runs));
+
+    assert.equal(sent, 1);
+    assert.equal(runs.length, 1);
+    assert.equal(runs[0].command, 'run the nightly checks');
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'sent');
+  });
+});
+
+test('a queued message is sent by the server without a browser connection', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    sessionDraftsDb.saveDraft(userId, SESSION_ID, {
+      text: '',
+      queuedMessage: {
+        content: 'continue on the VPS',
+        options: { model: 'claude-opus-5' },
+        attachments: [{ path: '/tmp/upload.png' }],
+      },
+    });
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchQueuedMessages(createRuntime(runs)), 1);
+    assert.equal(runs.length, 1);
+    assert.equal(runs[0].command, 'continue on the VPS');
+    assert.equal(runs[0].options.model, 'claude-opus-5');
+    assert.deepEqual(runs[0].options.attachments, []);
+    assert.equal(sessionDraftsDb.getDrafts(userId).length, 0);
+  });
+});
+
+test('a queued message stays pending while its session is busy', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    sessionDraftsDb.saveDraft(userId, SESSION_ID, {
+      text: '',
+      queuedMessage: { content: 'send after this run' },
+    });
+    chatRunRegistry.startRun({
+      appSessionId: SESSION_ID,
+      provider: 'claude',
+      providerSessionId: null,
+      connection: null,
+      userId,
+    });
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchQueuedMessages(createRuntime(runs)), 0);
+    assert.equal(runs.length, 0);
+    assert.deepEqual(sessionDraftsDb.getDrafts(userId)[0]?.queuedMessage, {
+      content: 'send after this run',
+    });
+  });
+});
+
+test('a due message interrupts a run in progress instead of failing', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'the schedule wins',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    chatRunRegistry.startRun({
+      appSessionId: SESSION_ID,
+      provider: 'claude',
+      providerSessionId: null,
+      connection: null,
+      userId,
+    });
+
+    const runs: RunCall[] = [];
+    const aborts: string[] = [];
+    assert.equal(await dispatchDueScheduledMessages(createRuntime(runs, 'ok', aborts)), 1);
+
+    assert.deepEqual(aborts, [SESSION_ID]);
+    assert.equal(runs.length, 1);
+    assert.equal(runs[0].command, 'the schedule wins');
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'sent');
+  });
+});
+
+test('a message that is not due yet is left alone', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'later',
+      scheduledFor: new Date(Date.now() + 3_600_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchDueScheduledMessages(createRuntime(runs)), 0);
+    assert.equal(runs.length, 0);
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'pending');
+  });
+});
+
+test('a due message is claimed once, so overlapping passes cannot double-send it', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'only once',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    const runtime = createRuntime(runs);
+    await Promise.all([
+      dispatchDueScheduledMessages(runtime),
+      dispatchDueScheduledMessages(runtime),
+    ]);
+
+    assert.equal(runs.length, 1);
+  });
+});
+
+test('the composer settings it was scheduled with travel with it', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'with options',
+      options: { model: 'claude-opus-5', permissionMode: 'plan' },
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+
+    const runs: RunCall[] = [];
+    await dispatchDueScheduledMessages(createRuntime(runs));
+
+    assert.equal(runs[0].options.model, 'claude-opus-5');
+    assert.equal(runs[0].options.permissionMode, 'plan');
+  });
+});
+
+test('a provider failure is recorded on the message instead of vanishing', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'will fail',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+
+    await dispatchDueScheduledMessages(createRuntime([], 'throw'));
+
+    const row = scheduledMessagesDb.listForSession(userId, SESSION_ID)[0];
+    assert.equal(row.status, 'failed');
+    assert.match(row.failure_reason ?? '', /provider exploded/);
+  });
+});
+
+test('a cancelled message never fires', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'never mind',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    scheduledMessagesService.cancel(userId, scheduled.id);
+
+    const runs: RunCall[] = [];
+    assert.equal(await dispatchDueScheduledMessages(createRuntime(runs)), 0);
+    assert.equal(runs.length, 0);
+  });
+});
+
+test('a failed message can be dismissed, and stays dismissed', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'will fail',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    await dispatchDueScheduledMessages(createRuntime([], 'throw'));
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'failed');
+
+    scheduledMessagesService.cancel(userId, scheduled.id);
+
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'cancelled');
+  });
+});
+
+test('cancelling something that already fired is refused', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'gone',
+      scheduledFor: new Date(Date.now() - 1_000).toISOString(),
+    });
+    await dispatchDueScheduledMessages(createRuntime([]));
+
+    assert.throws(
+      () => scheduledMessagesService.cancel(userId, scheduled.id),
+      (error: Error & { code?: string }) => error.code === 'SCHEDULED_MESSAGE_NOT_PENDING',
+    );
+  });
+});
+
+test('one user cannot cancel another user\'s scheduled message', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const scheduled = scheduledMessagesService.schedule({
+      userId,
+      sessionId: SESSION_ID,
+      content: 'mine',
+      scheduledFor: new Date(Date.now() + 3_600_000).toISOString(),
+    });
+
+    assert.throws(
+      () => scheduledMessagesService.cancel(userId + 1, scheduled.id),
+      (error: Error & { code?: string }) => error.code === 'SCHEDULED_MESSAGE_NOT_PENDING',
+    );
+    assert.equal(scheduledMessagesDb.listForSession(userId, SESSION_ID)[0].status, 'pending');
+  });
+});
+
+test('scheduling validates its input', async () => {
+  await withIsolatedDatabase(async (userId) => {
+    const base = { userId, sessionId: SESSION_ID, scheduledFor: new Date(Date.now() + 1000).toISOString() };
+
+    assert.throws(
+      () => scheduledMessagesService.schedule({ ...base, content: '   ' }),
+      (error: Error & { code?: string }) => error.code === 'CONTENT_REQUIRED',
+    );
+    assert.throws(
+      () => scheduledMessagesService.schedule({ ...base, content: 'hi', scheduledFor: 'not a date' }),
+      (error: Error & { code?: string }) => error.code === 'INVALID_SCHEDULE_TIME',
+    );
+    assert.throws(
+      () => scheduledMessagesService.schedule({
+        ...base,
+        content: 'hi',
+        scheduledFor: new Date(Date.now() + 400 * 24 * 3600 * 1000).toISOString(),
+      }),
+      (error: Error & { code?: string }) => error.code === 'SCHEDULE_TOO_FAR_AHEAD',
+    );
+    assert.throws(
+      () => scheduledMessagesService.schedule({ ...base, sessionId: 'nope', content: 'hi' }),
+      (error: Error & { code?: string }) => error.code === 'SESSION_NOT_FOUND',
+    );
+  });
+});

package/server/modules/taskmaster/taskmaster.routes.ts

@@ -13,6 +13,8 @@ import path from 'path';
 
 import express from 'express';
 
+import { WS_OPEN_STATE, connectedClients } from '@/modules/websocket/index.js';
+
 import type { createTaskmasterService } from './taskmaster.service.js';
 // cross-spawn: drop-in spawn with Windows .cmd/PATHEXT resolution — required
 // here since task-master/npx are .cmd shims on Windows.
@@ -25,22 +27,30 @@ type TaskmasterRouterDependencies = {
     taskmasterService: ReturnType<typeof createTaskmasterService>;
 };
 
-function broadcastTaskMasterUpdate(wss, type, projectId, payloadKey, payload) {
-    if (!wss || !projectId) return;
+/**
+ * These frames are `type`-keyed and only TaskMasterContext, which lives on the
+ * `/ws` chat socket, knows what to do with them. Broadcasting over the raw
+ * `wss.clients` set instead delivered them to every `/shell`, `/plugin-ws` and
+ * `/desktop-notifications` socket as well, where they were parsed and dropped —
+ * and, on `/plugin-ws`, handed to third-party plugin frontends that have no
+ * business seeing them. `connectedClients` is the `/ws`-only set every other
+ * broadcast in the server already uses.
+ */
+function broadcastTaskMasterUpdate(type, projectId, payloadKey, payload) {
+    if (!projectId) return;
     const message = JSON.stringify({
         type,
         projectId,
         ...(payload === undefined ? {} : { [payloadKey]: payload }),
         timestamp: new Date().toISOString(),
     });
-    wss.clients.forEach((client) => {
-        if (client.readyState === 1) client.send(message);
+    connectedClients.forEach((client) => {
+        if (client.readyState === WS_OPEN_STATE) client.send(message);
     });
 }
 
-function broadcastTaskMasterProjectUpdate(wss, projectId, taskMasterData) {
+function broadcastTaskMasterProjectUpdate(projectId, taskMasterData) {
     broadcastTaskMasterUpdate(
-        wss,
         'taskmaster-project-updated',
         projectId,
         'taskMasterData',
@@ -48,8 +58,8 @@ function broadcastTaskMasterProjectUpdate(wss, projectId, taskMasterData) {
     );
 }
 
-function broadcastTaskMasterTasksUpdate(wss, projectId, tasksData) {
-    broadcastTaskMasterUpdate(wss, 'taskmaster-tasks-updated', projectId, 'tasksData', tasksData);
+function broadcastTaskMasterTasksUpdate(projectId, tasksData) {
+    broadcastTaskMasterUpdate('taskmaster-tasks-updated', projectId, 'tasksData', tasksData);
 }
 
 /**
@@ -596,13 +606,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                     // Broadcast TaskMaster project update via WebSocket. The
                     // WebSocket payload keeps using `projectId` so the frontend
                     // can match notifications against the current selection.
-                    if (req.app.locals.wss) {
-                        broadcastTaskMasterProjectUpdate(
-                            req.app.locals.wss,
-                            projectId,
-                            { hasTaskmaster: true, status: 'initialized' }
-                        );
-                    }
+                    broadcastTaskMasterProjectUpdate(projectId, { hasTaskmaster: true, status: 'initialized' });
 
                     res.json({
                         projectId,
@@ -688,12 +692,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                 if (code === 0) {
                     // Broadcast task update via WebSocket using the projectId so
                     // clients subscribed to this project get notified immediately.
-                    if (req.app.locals.wss) {
-                        broadcastTaskMasterTasksUpdate(
-                            req.app.locals.wss,
-                            projectId
-                        );
-                    }
+                    broadcastTaskMasterTasksUpdate(projectId);
 
                     res.json({
                         projectId,
@@ -748,9 +747,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                 }, ({ code, error, stdout, stderr }) => {
                     if (code === 0) {
                         // Broadcast task update via WebSocket
-                        if (req.app.locals.wss) {
-                            broadcastTaskMasterTasksUpdate(req.app.locals.wss, projectId);
-                        }
+                        broadcastTaskMasterTasksUpdate(projectId);
 
                         res.json({
                             projectId,
@@ -787,9 +784,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
                 }, ({ code, error, stdout, stderr }) => {
                     if (code === 0) {
                         // Broadcast task update via WebSocket
-                        if (req.app.locals.wss) {
-                            broadcastTaskMasterTasksUpdate(req.app.locals.wss, projectId);
-                        }
+                        broadcastTaskMasterTasksUpdate(projectId);
 
                         res.json({
                             projectId,
@@ -870,12 +865,7 @@ export function createTaskmasterRouter(dependencies: TaskmasterRouterDependencie
             }, ({ code, error, stdout, stderr }) => {
                 if (code === 0) {
                     // Broadcast task update via WebSocket
-                    if (req.app.locals.wss) {
-                        broadcastTaskMasterTasksUpdate(
-                            req.app.locals.wss,
-                            projectId
-                        );
-                    }
+                    broadcastTaskMasterTasksUpdate(projectId);
 
                     res.json({
                         projectId,

package/server/modules/taskmaster/tests/taskmaster.routes.test.ts

@@ -6,6 +6,8 @@ import test from 'node:test';
 
 import express from 'express';
 
+import { connectedClients } from '@/modules/websocket/index.js';
+
 import { createTaskmasterRouter } from '../taskmaster.routes.js';
 
 test('tasks route resolves project ids through the injected project adapter', async () => {
@@ -142,3 +144,58 @@ test('TaskMaster process errors use the endpoint failure response and settle onc
     await new Promise<void>((resolve) => server.close(() => resolve()));
   }
 });
+
+test('TaskMaster broadcasts reach only the tracked chat clients', async () => {
+  const child = new EventEmitter() as EventEmitter & {
+    stdin: PassThrough;
+    stdout: PassThrough;
+    stderr: PassThrough;
+  };
+  child.stdin = new PassThrough();
+  child.stdout = new PassThrough();
+  child.stderr = new PassThrough();
+
+  const chatClient = { readyState: 1, frames: [] as string[], send(data: string) { this.frames.push(data); } };
+  const closingClient = { readyState: 3, frames: [] as string[], send(data: string) { this.frames.push(data); } };
+
+  const router = createTaskmasterRouter({
+    fileSystem: { constants: { F_OK: 0 } } as typeof import('node:fs'),
+    fileSystemPromises: {
+      access: async () => { throw new Error('not initialized'); },
+    } as unknown as typeof import('node:fs/promises'),
+    spawnProcess: (() => {
+      process.nextTick(() => child.emit('close', 0));
+      return child;
+    }) as unknown as Parameters<typeof createTaskmasterRouter>[0]['spawnProcess'],
+    resolveProjectPathById: () => '/workspace/project',
+    taskmasterService: {
+      detectMcpServer: async () => ({
+        hasMCPServer: false,
+        reason: 'Not configured',
+        hasConfig: false,
+      }),
+    },
+  });
+  const app = express().use('/api/taskmaster', router);
+  const server = app.listen(0, '127.0.0.1');
+  await once(server, 'listening');
+
+  connectedClients.add(chatClient as never);
+  connectedClients.add(closingClient as never);
+  try {
+    const address = server.address() as AddressInfo;
+    const response = await fetch(`http://127.0.0.1:${address.port}/api/taskmaster/init/project-1`, {
+      method: 'POST',
+    });
+    assert.equal(response.status, 200);
+
+    assert.equal(chatClient.frames.length, 1);
+    const frame = JSON.parse(chatClient.frames[0]) as Record<string, unknown>;
+    assert.equal(frame.type, 'taskmaster-project-updated');
+    assert.equal(frame.projectId, 'project-1');
+    assert.equal(closingClient.frames.length, 0);
+  } finally {
+    connectedClients.clear();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+});

package/server/modules/user/tests/user.service.test.ts

@@ -13,6 +13,15 @@ function createDependencies(overrides: Partial<UserDependencies> = {}): UserDepe
       completeOnboarding: () => undefined,
       hasCompletedOnboarding: () => false,
     },
+    preferences: {
+      getPreferences: () => ({}),
+      savePreferences: () => undefined,
+    },
+    drafts: {
+      getDrafts: () => [],
+      saveDraft: () => undefined,
+      deleteDraft: () => undefined,
+    },
     readSystemGitConfig: async () => ({ git_name: null, git_email: null }),
     applyGlobalGitConfig: async () => undefined,
     logInfo: () => undefined,
@@ -59,3 +68,84 @@ test('updateGitConfig persists valid input and invokes the Git adapter', async (
     'git:Alice:alice@example.com',
   ]);
 });
+
+test('savePreferences forwards only the keys the client sent', () => {
+  const saved: Array<Record<string, unknown>> = [];
+  const service = createUserService(createDependencies({
+    preferences: {
+      getPreferences: () => ({ theme: 'dark' }),
+      savePreferences: (_id, updates) => saved.push(updates),
+    },
+  }));
+
+  const result = service.savePreferences(3, { theme: 'light' });
+
+  assert.deepEqual(saved, [{ theme: 'light' }]);
+  assert.deepEqual(result.preferences, { theme: 'dark' });
+});
+
+test('savePreferences rejects a non-object body', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(() => service.savePreferences(3, ['theme']), /object/i);
+  assert.throws(() => service.savePreferences(3, 'theme'), /object/i);
+});
+
+test('savePreferences rejects an over-long preference key', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(() => service.savePreferences(3, { ['k'.repeat(201)]: 1 }), /1-200/);
+});
+
+test('saveDraft stores the text and queued message under the given scope', () => {
+  const saved: unknown[][] = [];
+  const service = createUserService(createDependencies({
+    drafts: {
+      getDrafts: () => [],
+      saveDraft: (...args) => saved.push(args),
+      deleteDraft: () => undefined,
+    },
+  }));
+
+  service.saveDraft(5, 'session-1', {
+    scope: 'session-1',
+    text: 'half a thought',
+    queuedMessage: { content: 'later' },
+  });
+
+  assert.deepEqual(saved, [[5, 'session-1', {
+    text: 'half a thought',
+    queuedMessage: { content: 'later' },
+  }]]);
+});
+
+test('saveDraft defaults a missing queued message to null rather than dropping the row', () => {
+  const saved: unknown[][] = [];
+  const service = createUserService(createDependencies({
+    drafts: {
+      getDrafts: () => [],
+      saveDraft: (...args) => saved.push(args),
+      deleteDraft: () => undefined,
+    },
+  }));
+
+  service.saveDraft(5, 'session-1', { scope: 'session-1', text: 'typing' });
+
+  assert.deepEqual(saved, [[5, 'session-1', { text: 'typing', queuedMessage: null }]]);
+});
+
+test('saveDraft rejects a blank or over-long scope', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(() => service.saveDraft(5, '   ', { text: 'x' }), /scope/i);
+  assert.throws(() => service.saveDraft(5, 'x'.repeat(201), { text: 'x' }), /scope/i);
+});
+
+test('saveDraft rejects text past the storage limit', () => {
+  const service = createUserService(createDependencies());
+
+  assert.throws(
+    () => service.saveDraft(5, 'session-1', { text: 'x'.repeat(100_001) }),
+    /too long/i,
+  );
+});

package/server/modules/user/user.module.ts

@@ -1,6 +1,6 @@
 import spawn from 'cross-spawn';
 
-import { userDb } from '@/modules/database/index.js';
+import { sessionDraftsDb, userDb, userPreferencesDb } from '@/modules/database/index.js';
 
 import { createUserRouter } from './user.routes.js';
 import { createUserService } from './user.service.js';
@@ -45,6 +45,15 @@ const userService = createUserService({
     completeOnboarding: (userId) => userDb.completeOnboarding(userId),
     hasCompletedOnboarding: (userId) => userDb.hasCompletedOnboarding(userId),
   },
+  preferences: {
+    getPreferences: (userId) => userPreferencesDb.getPreferences(userId),
+    savePreferences: (userId, updates) => userPreferencesDb.savePreferences(userId, updates),
+  },
+  drafts: {
+    getDrafts: (userId) => sessionDraftsDb.getDrafts(userId),
+    saveDraft: (userId, scope, draft) => sessionDraftsDb.saveDraft(userId, scope, draft),
+    deleteDraft: (userId, scope) => sessionDraftsDb.deleteDraft(userId, scope),
+  },
   readSystemGitConfig,
   applyGlobalGitConfig: async (gitName, gitEmail) => {
     await runGit(['config', '--global', 'user.name', gitName]);

package/server/modules/user/user.routes.ts

@@ -46,5 +46,49 @@ export function createUserRouter(service: ReturnType<typeof createUserService>):
     }
   });
 
+  router.get('/preferences', (req, res, next) => {
+    try {
+      res.json(service.getPreferences(readUserId(req)));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.patch('/preferences', (req, res, next) => {
+    try {
+      res.json(service.savePreferences(readUserId(req), req.body));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.get('/drafts', (req, res, next) => {
+    try {
+      res.json(service.getDrafts(readUserId(req)));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  // The scope is a session id or `project:<id>`, so it is read from the body
+  // rather than the path: neither form is guaranteed to be URL-path-safe.
+  router.put('/drafts', (req, res, next) => {
+    try {
+      const body = req.body as { scope?: unknown };
+      res.json(service.saveDraft(readUserId(req), body?.scope, req.body));
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  router.delete('/drafts', (req, res, next) => {
+    try {
+      const body = req.body as { scope?: unknown };
+      res.json(service.deleteDraft(readUserId(req), body?.scope));
+    } catch (error) {
+      next(error);
+    }
+  });
+
   return router;
 }