@jlongo78/agent-spaces 0.9.8 → 0.9.10

package/.next/standalone/bin/cortex-learn-hook.js

@@ -2,11 +2,16 @@
 'use strict';
 const http = require('http');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 
-const LOG_FILE = path.join(process.cwd(), 'cortex-hook-debug.log');
+const LOG_DIR = path.join(os.homedir(), '.spaces', 'logs');
+const LOG_FILE = path.join(LOG_DIR, 'cortex-hook-debug.log');
 function log(msg) {
-  try { fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] [LEARN] " + msg + "\n"); } catch(e) {}
+  try {
+    fs.mkdirSync(LOG_DIR, { recursive: true });
+    fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] [LEARN] " + msg + "\n");
+  } catch(e) {}
 }
 
 function readSpacesEnv() {

package/.next/standalone/bin/scrub-standalone.js

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+'use strict';
+// Remove runtime-generated files from .next/standalone/ before publishing to npm.
+// Historical incident: cortex-hook-debug.log containing user prompts (and npm tokens)
+// leaked into versions 0.9.6-0.9.9 because the hook wrote to process.cwd() which
+// at runtime was .next/standalone/. Hooks now log to ~/.spaces/logs/, but this
+// belt-and-suspenders scrub runs on every publish to catch any other accidents.
+
+const fs = require('fs');
+const path = require('path');
+
+const STANDALONE = path.join(process.cwd(), '.next', 'standalone');
+
+const DENY_FILES = [
+  'cortex-hook-debug.log',
+];
+
+const DENY_DIRS = [
+  '.spaces',
+  '.claude',
+  '.codex',
+  '.gemini',
+  '.pi',
+  'logs',
+];
+
+const DENY_PATTERNS = [
+  /\.log$/i,
+  /^\.env(\..+)?$/i,
+  /^\.npmrc$/i,
+];
+
+function walk(dir, cb) {
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+  catch { return; }
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (DENY_DIRS.includes(e.name)) {
+        fs.rmSync(full, { recursive: true, force: true });
+        console.log('[scrub] removed dir: ' + path.relative(STANDALONE, full));
+        continue;
+      }
+      walk(full, cb);
+    } else if (e.isFile()) {
+      cb(full, e.name);
+    }
+  }
+}
+
+if (!fs.existsSync(STANDALONE)) {
+  console.log('[scrub] no .next/standalone to scrub');
+  process.exit(0);
+}
+
+walk(STANDALONE, (full, name) => {
+  if (DENY_FILES.includes(name) || DENY_PATTERNS.some(p => p.test(name))) {
+    fs.rmSync(full, { force: true });
+    console.log('[scrub] removed file: ' + path.relative(STANDALONE, full));
+  }
+});
+
+// Final scan: refuse to publish if any obvious secrets remain in text files
+const SECRET_PATTERNS = [
+  /npm_[A-Za-z0-9]{30,}/,
+  /sk-ant-[A-Za-z0-9_-]{20,}/,
+  /ghp_[A-Za-z0-9]{30,}/,
+];
+let leaked = false;
+walk(STANDALONE, (full, name) => {
+  if (!/\.(js|json|md|txt|log|ts|tsx|mjs|cjs)$/i.test(name)) return;
+  let content;
+  try { content = fs.readFileSync(full, 'utf-8'); } catch { return; }
+  for (const p of SECRET_PATTERNS) {
+    const m = content.match(p);
+    if (m) {
+      console.error('[scrub] SECRET DETECTED in ' + path.relative(STANDALONE, full) + ': ' + m[0].slice(0, 12) + '...');
+      leaked = true;
+    }
+  }
+});
+
+if (leaked) {
+  console.error('[scrub] aborting publish — secrets found in build output');
+  process.exit(1);
+}
+
+console.log('[scrub] done — standalone clean');

package/.next/standalone/bin/terminal-server.js

@@ -1334,8 +1334,11 @@ function handleConnection(wss, ws, req) {
   const rawAgentSession = url.searchParams.get('agentSession') || '';
   const agentSession = (rawAgentSession === 'new' || SESSION_ID_RE.test(rawAgentSession)) ? rawAgentSession : '';
   const rawCustomCommand = url.searchParams.get('customCommand') || '';
-  // Sanitize: reject shell metacharacters that enable injection (;, |, &, $, `, etc.)
-  const customCommand = /[;&|`$(){}]/.test(rawCustomCommand) ? '' : rawCustomCommand;
+  // Sanitize via allowlist. Any character outside [A-Za-z0-9 . _ - /] is rejected.
+  // Earlier blocklist (/[;&|`$(){}]/) missed newlines, redirects (<,>), and
+  // backslashes — a payload like "legit\nmalicious" would inject a second command
+  // when the PTY wrote it with a trailing \r.
+  const customCommand = /^[A-Za-z0-9._\-/ ]+$/.test(rawCustomCommand) ? rawCustomCommand : '';
   const cols = parseInt(url.searchParams.get('cols') || '120', 10);
   const rows = parseInt(url.searchParams.get('rows') || '30', 10);
 
@@ -1554,8 +1557,25 @@ function handleConnection(wss, ws, req) {
   // Detect bash-on-Windows so cd commands use bash syntax, not cmd.exe `cd /d`
   const isBashOnWindows = isWindows && shell && (shell.endsWith('bash.exe') || shell.endsWith('bash'));
 
-  const env = { ...process.env };
-  delete env.CLAUDECODE;
+  // Build a minimal env for the user-facing PTY — never inherit the server's
+  // secrets (SPACES_SESSION_SECRET, GH_PAT, NPM_TOKEN, ANTHROPIC_API_KEY, etc).
+  // Only forward identity/shell/locale/terminal basics from the server env.
+  const PTY_ENV_ALLOW = [
+    'HOME', 'USER', 'LOGNAME', 'SHELL', 'PATH', 'PWD', 'OLDPWD', 'HOSTNAME',
+    'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES', 'LC_COLLATE', 'LC_TIME',
+    'LC_NUMERIC', 'LC_MONETARY', 'TZ',
+    'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'XDG_RUNTIME_DIR',
+    'XDG_STATE_HOME',
+    'TERM', 'TERM_PROGRAM', 'TERM_PROGRAM_VERSION', 'COLORTERM', 'COLUMNS', 'LINES',
+    'NODE_ENV', 'NVM_DIR', 'NVM_BIN',
+    // Windows basics
+    'SYSTEMROOT', 'WINDIR', 'APPDATA', 'LOCALAPPDATA', 'USERPROFILE', 'COMSPEC',
+    'PATHEXT', 'PROGRAMFILES', 'PROGRAMFILES(X86)', 'PROGRAMDATA',
+  ];
+  const env = {};
+  for (const k of PTY_ENV_ALLOW) {
+    if (process.env[k] !== undefined) env[k] = process.env[k];
+  }
   // Enable prompt suggestions in spawned Claude Code sessions
   env.CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION = 'true';
   // Tell Claude Code where git-bash is so it doesn't fail the bash detection
@@ -2208,19 +2228,30 @@ async function handleProxyConnection(clientWs, nodeId, opts) {
     return;
   }
 
-  // Get the remote WebSocket URL via the terminal token endpoint
-  // Only skip TLS verification if explicitly opted in (e.g., self-signed certs)
+  // Get the remote WebSocket URL via the terminal token endpoint.
+  // If the user opted into skipping TLS verification (for self-signed federation
+  // certs), scope it to JUST this request via an undici Agent rather than the
+  // process-global NODE_TLS_REJECT_UNAUTHORIZED env var, which would disable
+  // cert verification for every outbound TLS connection in the process and
+  // race with concurrent requests.
   const skipTls = process.env.SPACES_SKIP_TLS_VERIFY === '1';
-  const prevTls = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  if (skipTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+  let fetchOptions = {
+    method: 'POST',
+    headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
+    signal: AbortSignal.timeout(10000),
+  };
+  if (skipTls) {
+    try {
+      const { Agent } = require('undici');
+      fetchOptions.dispatcher = new Agent({ connect: { rejectUnauthorized: false } });
+    } catch (e) {
+      console.warn('[Proxy] undici unavailable for per-request TLS opt-out; refusing to fall back to global flag');
+    }
+  }
   let remoteWsUrl;
   try {
     const tokenUrl = `${node.url}/api/network/terminal/token/`;
-    const res = await fetch(tokenUrl, {
-      method: 'POST',
-      headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
-      signal: AbortSignal.timeout(10000),
-    });
+    const res = await fetch(tokenUrl, fetchOptions);
 
     if (!res.ok) {
       let detail = '';
@@ -2236,9 +2267,6 @@ async function handleProxyConnection(clientWs, nodeId, opts) {
     clientWs.send(JSON.stringify({ type: 'error', data: `Cannot reach remote node: ${err.message}` }));
     clientWs.close();
     return;
-  } finally {
-    if (prevTls === undefined) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevTls;
   }
 
   // Connect to remote terminal server using the API key directly.

package/.next/standalone/docs/features/claude-usage.md

@@ -0,0 +1,105 @@
+# Claude Plan-Usage Display
+
+**Status:** stable
+**Owner:** jlongo
+**Last updated:** 2026-04-22
+
+## Overview
+
+A compact readout of the user's Anthropic plan-usage rate limits, surfaced in the terminal page header whenever the active workspace has at least one Claude pane. Shows 5-hour, 7-day Opus, and 7-day Sonnet windows at a glance; click expands to all windows plus overage credits. Data matches what `/usage` shows inside Claude Code.
+
+## User-facing behavior
+
+- Open any workspace on `/terminal` that has a Claude pane.
+- A horizontal strip appears in the header (right side, before Files / Collab / Close / Add Pane).
+- Three thin progress bars: **5h**, **Opus**, **Sonnet** — each with a percent label and a color that escalates green → amber → red.
+- Hover a bar → tooltip `{label}: X% used · resets in 2h 14m`.
+- Click the strip → popover with all five rate-limit windows + an overage-credits block if the account has overage enabled.
+- If the OAuth token is missing or expired, the strip shows `sign in via Claude Code` with a small login icon. No auto-refresh.
+- If the Anthropic endpoint fails or times out, the strip hides silently.
+
+## Architecture
+
+UI (`src/components/claude/claude-usage-strip.tsx`) → polling hook (`src/hooks/use-claude-usage.ts`) → API route (`src/app/api/claude/usage/route.ts`) → credentials reader (`src/lib/claude/credentials.ts`) + Anthropic fetcher with 30s cache (`src/lib/claude/usage.ts`) → `https://api.anthropic.com/api/oauth/usage`.
+
+Polling: hook calls the route on mount and every 60s while the strip is enabled. Server caches the Anthropic response 30s per access-token prefix so rapid re-polls don't hammer Anthropic.
+
+## Key files
+
+| Path | Role |
+|---|---|
+| `src/lib/claude/credentials.ts` | Reads `~/.claude/.credentials.json`, extracts `claudeAiOauth`, exposes `isTokenExpired()`. |
+| `src/lib/claude/usage.ts` | Calls Anthropic's `/api/oauth/usage`, 5s timeout, 30s in-memory cache. |
+| `src/app/api/claude/usage/route.ts` | `GET` handler; returns one of `ok` / `unauthenticated` / `expired` / `upstream_error`. |
+| `src/hooks/use-claude-usage.ts` | 60s polling hook, toggled by `enabled` arg. |
+| `src/components/claude/claude-usage-strip.tsx` | Compact 3-bar strip + expanded popover. |
+| `src/app/(desktop)/terminal/page.tsx` | Mounts the strip conditionally in the header. |
+| `src/types/claude.ts` | `RateLimit`, `ExtraUsage`, `Utilization`, `UsageResponse`. |
+
+## Data model
+
+No DB tables. All state is transient:
+- Server-side: in-memory `Map<tokenPrefix, { fetchedAt, data }>` in `src/lib/claude/usage.ts` with 30s TTL. Process-local; resets on server restart.
+- Client-side: React state in the hook.
+
+## APIs / contracts
+
+### Internal endpoints
+
+- `GET /api/claude/usage` — returns `UsageResponse`:
+  - `200 { status: "ok", data: Utilization }` — happy path.
+  - `200 { status: "unauthenticated" }` — no credentials file or no `claudeAiOauth`.
+  - `200 { status: "expired" }` — access token past `expiresAt`.
+  - `200 { status: "upstream_error" }` — Anthropic non-2xx or timeout.
+
+Auth: same `withUser`/`getAuthUser` wrapping as every other `/api/*` route.
+
+### External calls
+
+- **Anthropic `GET https://api.anthropic.com/api/oauth/usage`** — uses the user's own OAuth access token read from `~/.claude/.credentials.json`. No secret of our own. User-Agent `claude-code/spaces-integration`.
+
+## Configuration & environment
+
+- `CLAUDE_CONFIG_DIR` — respected (defaults to `~/.claude`). Same semantics as Claude Code.
+- No env vars, feature flags, or tier gates specific to this feature.
+
+## How to run / test locally
+
+```bash
+npm install
+npm run build
+npm start
+# visit http://localhost:3457/terminal, enter a workspace, add a Claude pane
+```
+
+Manual QA checklist:
+
+1. With a valid OAuth session (logged in via any recent Claude Code run): the strip appears in the header; percents match `/usage` inside Claude Code.
+2. Hover each bar → tooltip shows the reset timing.
+3. Click → popover with all five windows and overage block (if applicable).
+4. Delete the Claude pane from the workspace → strip disappears.
+5. Set `claudeAiOauth.expiresAt` to a past timestamp in `.credentials.json`, reload → strip shows "sign in via Claude Code".
+6. Move `.credentials.json` aside temporarily, reload → same sign-in hint.
+7. Disconnect network → within ~90s the strip silently hides (`upstream_error` → null render).
+
+No automated tests for v1.
+
+## Known quirks & decisions
+
+- **Passive refresh.** We do not refresh the OAuth access token. Claude Code owns the refresh lifecycle and writes `.credentials.json`; racing with it would corrupt the shared file.
+- **Account-wide data, not per-pane.** The Anthropic endpoint returns account-level rate limits. Rendering once in the header (not per-pane) is intentional.
+- **User-Agent and anthropic-beta header.** The Anthropic `/api/oauth/usage` endpoint requires the `anthropic-beta: oauth-2025-04-20` header in addition to the Bearer token — without it the call 4xx-errors out. Both the UA (`claude-code/spaces`) and the beta header are constants in `src/lib/claude/usage.ts`; if upstream ever rotates the beta header, bump it there.
+- **30s cache + 60s poll.** Outer-bound staleness is ~90s; fine for windows that move in hours.
+- **Token-prefix cache key.** First 16 chars of `accessToken`. Collision probability is effectively nil; avoids holding full tokens in the cache structure beyond the single request.
+- **Silent upstream failure.** Errors hide the strip rather than showing a red toast — rate-limit info is nice-to-have, not mission-critical.
+- **Ships direct to `main`.** Per repo convention.
+
+## Open questions / TODOs
+
+- [ ] Active OAuth refresh — mirror Claude Code's `/oauth/token` dance to keep the widget live past expiry. Deferred for v1.
+- [ ] Session-cost complement using local JSONL token counts (different data source).
+- [ ] Consider surfacing 7-day-overall alongside the current three for users who care.
+
+## Changelog
+
+- 2026-04-22 — Initial implementation. v1 ships direct to `main`.

package/.next/standalone/docs/features/workspace-todos.md

@@ -0,0 +1,127 @@
+# Workspace Todos
+
+**Status:** stable
+**Owner:** jlongo
+**Last updated:** 2026-04-21
+
+## Overview
+
+A lightweight todo list attached to each workspace. Renders inline at the top of `/terminal` above the pane grid, always visible. Minimal model: text + checkbox + delete. Scoped per-workspace — switching workspaces swaps the list. Not in scope: agent read/write, drag-reorder, priorities/due dates, cross-workspace views.
+
+## User-facing behavior
+
+- Visit `/terminal`, enter any workspace.
+- A "Todos" bar renders above the pane grid with an "Add todo…" input.
+- Enter adds a todo at the bottom of the uncompleted list. Input stays focused.
+- Click the checkbox → strike-through + sink to the completed section.
+- Click text → inline edit. Enter saves, Esc cancels, blur saves.
+- Hover row → `×` delete button.
+- Eye icon in the header toggles visibility of completed todos (ephemeral, resets on reload).
+
+## Architecture
+
+UI (`src/components/workspace/workspace-todos.tsx`) → API routes (`src/app/api/workspaces/[id]/todos/*`) → DB helpers (`src/lib/db/queries.ts`) → SQLite (`workspace_todos` table in the per-user DB at `~/.spaces/<user>.db`).
+
+Mutations are optimistic client-side with rollback on failure. Workspace switch triggers a fresh refetch keyed on `workspaceId`.
+
+## Key files
+
+| Path | Role |
+|---|---|
+| `src/components/workspace/workspace-todos.tsx` | Inline UI component — fetching, optimistic CRUD, rendering |
+| `src/app/api/workspaces/[id]/todos/route.ts` | `GET` list, `POST` create |
+| `src/app/api/workspaces/[id]/todos/[todoId]/route.ts` | `PATCH` update, `DELETE` remove |
+| `src/lib/db/schema.ts` | `workspace_todos` table declaration inside `initSchema()` |
+| `src/lib/db/queries.ts` | `getWorkspaceTodos`, `addWorkspaceTodo`, `updateWorkspaceTodo`, `deleteWorkspaceTodo` |
+| `src/types/claude.ts` | `WorkspaceTodo` type |
+| `src/app/(desktop)/terminal/page.tsx` | Mounts `<WorkspaceTodos>` above the pane grid |
+| `tests/db/workspace-todos.test.ts` | Query-layer tests — ordering, cascade, scoping |
+
+## Data model
+
+### `workspace_todos`
+
+| Column | Type | Notes |
+|---|---|---|
+| `id` | INTEGER PK | autoincrement |
+| `workspace_id` | INTEGER NOT NULL | FK → `workspaces(id)` ON DELETE CASCADE |
+| `text` | TEXT NOT NULL | trimmed on insert/update; empty rejected |
+| `completed` | INTEGER NOT NULL DEFAULT 0 | 0 or 1 |
+| `sort_order` | INTEGER NOT NULL DEFAULT 0 | meaningful only among uncompleted rows |
+| `created` | TEXT NOT NULL DEFAULT datetime('now') | |
+| `completed_at` | TEXT | set when completed flips 0→1, cleared on 1→0 |
+
+Index: `idx_workspace_todos_workspace` on `workspace_id`.
+
+### TypeScript
+
+```ts
+interface WorkspaceTodo {
+  id: number;
+  workspaceId: number;
+  text: string;
+  completed: boolean;
+  sortOrder: number;
+  created: string;
+  completedAt: string | null;
+}
+```
+
+### Invariants
+
+- Listing order: uncompleted first by `sort_order` ASC, then completed by `completed_at` DESC.
+- New todos get `sort_order = MAX(sort_order WHERE completed=0) + 1`.
+- `completed_at` is `NULL` iff `completed = 0`.
+- Deleting a workspace deletes its todos via FK cascade.
+
+## APIs / contracts
+
+### Internal endpoints
+
+| Method | Path | Request | Response |
+|---|---|---|---|
+| `GET` | `/api/workspaces/:id/todos` | — | `WorkspaceTodo[]` |
+| `POST` | `/api/workspaces/:id/todos` | `{ text: string }` | `201 WorkspaceTodo` or `400 { error }` |
+| `PATCH` | `/api/workspaces/:id/todos/:todoId` | `{ text?, completed? }` | `WorkspaceTodo` or `400`/`404` |
+| `DELETE` | `/api/workspaces/:id/todos/:todoId` | — | `{ ok: true }` |
+
+Auth via `getAuthUser` + `withUser`, same pattern as sibling workspace routes.
+
+### External calls
+N/A.
+
+## Configuration & environment
+None. Always-on Community-tier feature. No env vars, flags, or tier gates.
+
+## How to run / test locally
+
+```bash
+npm install
+npm run build
+npm start
+# visit http://localhost:3457/terminal, enter any workspace
+```
+
+Automated:
+```bash
+npx vitest run tests/db/workspace-todos.test.ts
+```
+
+## Known quirks & decisions
+
+- **Schema lives in `initSchema()`, no migration file.** Matches the pattern in `src/lib/db/schema.ts`; the repo has no separate migration system.
+- **No agent write path in v1.** The coworker's "pi /todos" plugin that inspired this lets agents add todos from inside the session — deferred because it requires an MCP tool or CLI surface.
+- **Optimistic updates without toasts.** Failures `console.error` and revert local state; this is a local-only app, so silent revert is acceptable for v1.
+- **`sort_order = Number.MAX_SAFE_INTEGER` for optimistic inserts.** The temp row sorts to the bottom of uncompleted; the server returns the real `sort_order` on response and replaces the temp.
+- **No confirm on delete.** Minimal ethos. Add undo toast in a follow-up if this proves painful.
+- **Direct-to-main workflow.** Per repo convention for this codebase; no PR flow.
+
+## Open questions / TODOs
+
+- [ ] Agent write access via MCP tool once UI v1 proves out.
+- [ ] Optional: persist the "show completed" toggle in localStorage.
+- [ ] Optional: keyboard shortcut to focus the add-input from anywhere on `/terminal`.
+
+## Changelog
+
+- 2026-04-21 — Initial implementation. v1 ships direct to `main`.