@juspay/shooter 1.0.0 → 1.2.0

package/src/routes/api/device-token/+server.ts

@@ -7,79 +7,79 @@ import { join } from 'path';
 
 import type { RequestHandler } from './$types';
 
-interface DeviceTokens {
-	android?: string;
-	ios?: string;
-}
-
-interface DeviceTokenRequest {
-	bundleId?: string;
-	deviceToken?: string;
-	platform: string;
-	token?: string;
-}
-
 const TOKENS_DIR = join(homedir(), '.shooter');
 const TOKENS_FILE = join(TOKENS_DIR, 'device-tokens.json');
 
-function readTokens(): DeviceTokens {
-	try {
-		if (existsSync(TOKENS_FILE)) {
-			return JSON.parse(readFileSync(TOKENS_FILE, 'utf-8'));
-		}
-	} catch {
-		// Corrupt file — start fresh
-	}
-	return {};
+function readTokens(): { android?: string; ios?: string } {
+  try {
+    if (existsSync(TOKENS_FILE)) {
+      const parsed: unknown = JSON.parse(readFileSync(TOKENS_FILE, 'utf-8'));
+      // Guard against valid-but-wrong JSON (null, array, number, string)
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return {};
+      }
+      return parsed as { android?: string; ios?: string };
+    }
+  } catch {
+    // Corrupt file -- start fresh
+  }
+  return {};
 }
 
-function writeTokens(tokens: DeviceTokens): void {
-	if (!existsSync(TOKENS_DIR)) {
-		mkdirSync(TOKENS_DIR, { recursive: true });
-	}
-	writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2), 'utf-8');
+function writeTokens(tokens: { android?: string; ios?: string }): void {
+  if (!existsSync(TOKENS_DIR)) {
+    mkdirSync(TOKENS_DIR, { mode: 0o700, recursive: true });
+  }
+  writeFileSync(TOKENS_FILE, JSON.stringify(tokens, null, 2), { encoding: 'utf-8', mode: 0o600 });
 }
 
 export const POST: RequestHandler = async ({ request }) => {
-	const authError = validateAuth(request);
-	if (authError) return authError;
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
 
-	let body: DeviceTokenRequest;
-	try {
-		body = await request.json();
-	} catch {
-		return json({ error: 'Invalid JSON body' }, { status: 400 });
-	}
+  let body: { bundleId?: string; deviceToken?: string; platform: string; token?: string };
+  try {
+    const parsed: unknown = await request.json();
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      return json({ error: 'Invalid JSON body: expected an object' }, { status: 400 });
+    }
+    body = parsed as typeof body;
+  } catch {
+    return json({ error: 'Invalid JSON body' }, { status: 400 });
+  }
 
-	const platform = body.platform;
-	if (!platform || (platform !== 'ios' && platform !== 'android')) {
-		return json(
-			{ error: 'Missing or invalid platform (must be "ios" or "android")' },
-			{ status: 400 },
-		);
-	}
+  const platform = body.platform;
+  if (!platform || (platform !== 'ios' && platform !== 'android')) {
+    return json(
+      { error: 'Missing or invalid platform (must be "ios" or "android")' },
+      { status: 400 }
+    );
+  }
 
-	// iOS sends "deviceToken", Android sends "token"
-	const token = body.deviceToken || body.token;
-	if (!token || typeof token !== 'string' || token.trim().length === 0) {
-		return json({ error: 'Missing device token (deviceToken or token)' }, { status: 400 });
-	}
+  // iOS sends "deviceToken", Android sends "token"
+  const rawToken = body.deviceToken || body.token;
+  if (!rawToken || typeof rawToken !== 'string' || rawToken.trim().length === 0) {
+    return json({ error: 'Missing device token (deviceToken or token)' }, { status: 400 });
+  }
+  const token = rawToken.trim();
 
-	// Persist to ~/.shooter/device-tokens.json
-	const tokens = readTokens();
-	tokens[platform] = token;
-	writeTokens(tokens);
+  // Persist to ~/.shooter/device-tokens.json
+  const tokens = readTokens();
+  tokens[platform] = token;
+  writeTokens(tokens);
 
-	// Update in-memory env so APNs can use it immediately (iOS is the primary APNs target)
-	if (platform === 'ios') {
-		(env as Record<string, string>).DEVICE_TOKEN = token;
-	}
+  // Update in-memory env so APNs can use it immediately (iOS is the primary APNs target)
+  if (platform === 'ios') {
+    (env as Record<string, string>).DEVICE_TOKEN = token;
+  }
 
-	console.log(`[device-token] Registered ${platform} token (length: ${token.length})`);
+  console.log(`[device-token] Registered ${platform} token (length: ${token.length})`);
 
-	return json({
-		platform,
-		success: true,
-		timestamp: new Date().toISOString(),
-	});
+  return json({
+    platform,
+    success: true,
+    timestamp: new Date().toISOString(),
+  });
 };

package/src/routes/api/health/+server.ts

@@ -1,40 +1,27 @@
+import type {
+  FCMConfiguration,
+  HealthChecks,
+  HealthConfiguration,
+  HealthStatus,
+} from '$generated/types';
+
 import { env } from '$env/dynamic/private';
 import { validateAuth } from '$lib/modules/server/auth';
 import { json } from '@sveltejs/kit';
+import { readFileSync } from 'fs';
+import { join } from 'path';
 
 import type { RequestHandler } from './$types';
 
-interface FCMConfiguration {
-  configured: boolean;
-  hasClientEmail: boolean;
-  hasPrivateKey: boolean;
-  hasProjectId: boolean;
-}
-
-interface HealthChecks {
-  hasApiKey: boolean;
-  hasAPNsConfig: boolean;
-  hasBundleId: boolean;
-  hasDeviceToken: boolean;
-  hasFCMConfig: boolean;
-}
-
-interface HealthConfiguration {
-  apnsKeyId: null | string;
-  bundleId: null | string;
-  deviceTokenLength: number;
-  fcm: FCMConfiguration;
-  production: boolean;
-}
-
-interface HealthResponse {
-  checks: HealthChecks;
-  configuration: HealthConfiguration;
-  environment: string;
-  status: 'degraded' | 'healthy';
-  timestamp: string;
-  version: string;
-}
+const PKG_VERSION: string = (() => {
+  const root = process.env.SHOOTER_PKG_ROOT || process.cwd();
+  try {
+    const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf-8')) as { version?: string };
+    return pkg.version || 'unknown';
+  } catch {
+    return 'unknown';
+  }
+})();
 
 export const GET: RequestHandler = ({ request, url }) => {
   // Basic status check is public (used by layout status badge).
@@ -42,58 +29,79 @@ export const GET: RequestHandler = ({ request, url }) => {
   const wantsDetails = url.searchParams.get('details') === 'true';
   if (wantsDetails) {
     const authError = validateAuth(request);
-    if (authError) return authError;
+    if (authError) {
+      return authError;
+    }
   }
 
-  const hasProjectId = !!env.FCM_PROJECT_ID;
-  const hasClientEmail = !!env.FCM_CLIENT_EMAIL;
-  const hasPrivateKey = !!env.FCM_PRIVATE_KEY;
+  const hasProjectId = !!env.FCM_PROJECT_ID?.trim();
+  const hasClientEmail = !!env.FCM_CLIENT_EMAIL?.trim();
+  const hasPrivateKey = !!env.FCM_PRIVATE_KEY?.trim();
+
+  const checks: HealthChecks = {
+    hasApiKey: !!env.API_KEY?.trim(),
+    hasAPNsConfig: !!(env.APNS_KEY_ID?.trim() && env.APNS_TEAM_ID?.trim() && env.APNS_KEY?.trim()),
+    hasBundleId: !!env.APNS_BUNDLE_ID?.trim(),
+    hasDeviceToken: !!env.DEVICE_TOKEN?.trim(),
+    hasFCMConfig: hasProjectId && hasClientEmail && hasPrivateKey,
+  };
+
+  const fcm: FCMConfiguration = {
+    configured: hasProjectId && hasClientEmail && hasPrivateKey,
+    hasClientEmail,
+    hasPrivateKey,
+    hasProjectId,
+  };
+
+  const configuration: HealthConfiguration = {
+    apnsKeyId: env.APNS_KEY_ID ? `${env.APNS_KEY_ID.substring(0, 4)}...` : '',
+    bundleId: env.APNS_BUNDLE_ID || '',
+    deviceTokenLength: env.DEVICE_TOKEN ? env.DEVICE_TOKEN.length : 0,
+    fcm,
+    production: env.APNS_PRODUCTION === 'true',
+  };
+
+  // Collect warnings for optional features that are not configured.
+  // These are informational — the server is still fully functional for
+  // terminals and sessions without push notification support.
+  const warnings: string[] = [];
 
-  const health: HealthResponse = {
-    checks: {
-      hasApiKey: !!env.API_KEY,
-      hasAPNsConfig: !!(
-        env.APNS_KEY_ID &&
-        env.APNS_TEAM_ID &&
-        env.APNS_KEY
-      ),
-      hasBundleId: !!env.APNS_BUNDLE_ID,
-      hasDeviceToken: !!env.DEVICE_TOKEN,
-      hasFCMConfig: hasProjectId && hasClientEmail && hasPrivateKey,
-    },
-    configuration: {
-      apnsKeyId: env.APNS_KEY_ID ? `${env.APNS_KEY_ID.substring(0, 4)}...` : null,
-      bundleId: env.APNS_BUNDLE_ID || null,
-      deviceTokenLength: env.DEVICE_TOKEN ? env.DEVICE_TOKEN.length : 0,
-      fcm: {
-        configured: hasProjectId && hasClientEmail && hasPrivateKey,
-        hasClientEmail,
-        hasPrivateKey,
-        hasProjectId,
-      },
-      production: env.APNS_PRODUCTION === 'true',
-    },
+  if (!checks.hasAPNsConfig || !checks.hasBundleId) {
+    warnings.push('APNs not configured — iOS push notifications disabled');
+  }
+  if (!checks.hasDeviceToken) {
+    warnings.push('No device token set — push notifications have no target');
+  }
+  if (!checks.hasFCMConfig) {
+    warnings.push('FCM not configured — Android push notifications disabled');
+  }
+
+  const health: {
+    checks: HealthChecks;
+    configuration: HealthConfiguration;
+    environment: string;
+    status: HealthStatus;
+    timestamp: string;
+    version: string;
+    warnings: string[];
+  } = {
+    checks,
+    configuration,
     environment: env.NODE_ENV || 'development',
     status: 'healthy',
     timestamp: new Date().toISOString(),
-    version: '1.1.0',
+    version: PKG_VERSION,
+    warnings,
   };
 
-  // Determine overall health status
-  // FCM is not a critical check - only APNs is required for core functionality
-  const criticalChecks = [
-    health.checks.hasDeviceToken,
-    health.checks.hasAPNsConfig,
-    health.checks.hasBundleId,
-  ];
-
-  if (criticalChecks.some((check) => !check)) {
-    health.status = 'degraded';
-  }
+  // Only mark as degraded for actual system-level problems
+  // (e.g., DB unreachable, critical services down).
+  // Missing push-notification config is NOT a degraded state — it just
+  // means notifications are disabled, which is fine for terminal/session use.
 
-  // Public response: status only. Authenticated: full details.
+  // Public response: status + warnings. Authenticated: full details.
   if (!wantsDetails) {
-    return json({ status: health.status, timestamp: health.timestamp });
+    return json({ status: health.status, timestamp: health.timestamp, version: health.version, warnings: health.warnings });
   }
 
   return json(health);

package/src/routes/api/notify/+server.ts

@@ -1,34 +1,16 @@
+import type { NotificationData } from '$generated/types';
+
 import { env } from '$env/dynamic/private';
 import { LibraryAPNsService } from '$lib/modules/server/apn/library-apns';
 import { addNotification, getNotifications } from '$lib/modules/server/apn/notification-history';
 import { createPendingRequest } from '$lib/modules/server/apn/pending-requests';
 import { validateAuth } from '$lib/modules/server/auth';
 import { isFCMConfigured, sendFCMNotification } from '$lib/modules/server/fcm/fcm-service.js';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 
 import type { RequestHandler } from './$types';
 
-interface FilterResult {
-  reason: string;
-  send: boolean;
-}
-
-interface NotificationData {
-  [key: string]: unknown;
-  category?: string;
-  files?: string;
-  project?: string;
-  source?: string;
-  tool?: string;
-}
-
-interface NotificationRequest {
-  data?: NotificationData;
-  message: string;
-  title: string;
-  waitForResponse?: boolean;
-}
-
 // Singleton APNs client - reuses HTTP/2 connection across requests
 let apnsSingleton: LibraryAPNsService | null = null;
 function getAPNsClient(): LibraryAPNsService {
@@ -42,12 +24,11 @@ function getAPNsClient(): LibraryAPNsService {
 const notificationCache = new Map<string, number>();
 const DEDUP_WINDOW = 10000; // 10 seconds deduplication window
 
-// 🎯 INTELLIGENT NOTIFICATION FILTERING
 function intelligentNotificationFilter(
   title: string,
   message: string,
   data?: NotificationData
-): FilterResult {
+): { reason: string; send: boolean } {
   const source = data?.source || 'unknown';
 
   // Check for duplicate notifications first
@@ -137,7 +118,7 @@ function isDuplicateNotification(title: string, message: string, data?: Notifica
     }
   }
 
-  // Do NOT record here — caller must call recordNotification() after
+  // Do NOT record here -- caller must call recordNotification() after
   // successful delivery to avoid cache poisoning on send failure.
   return false;
 }
@@ -155,14 +136,35 @@ export const POST: RequestHandler = async ({ request }) => {
 
     // Validate API key using timing-safe comparison
     const authError = validateAuth(request);
-    if (authError) return authError;
+    if (authError) {
+      return authError;
+    }
 
     // Parse request body
-    const body = (await request.json()) as NotificationRequest;
-    const { data, message, title, waitForResponse } = body;
+    const rawBody: unknown = await request.json();
 
-    if (!title || !message) {
-      return json({ error: 'Title and message are required' }, { status: 400 });
+    if (!rawBody || typeof rawBody !== 'object' || Array.isArray(rawBody)) {
+      return json({ error: 'Request body must be a JSON object' }, { status: 400 });
+    }
+
+    const body = rawBody as Record<string, unknown>;
+    const data = body.data as NotificationData | undefined;
+    const requestDeviceToken = body.deviceToken as string | undefined;
+    const message = body.message as string;
+    const title = body.title as string;
+
+    // Coerce skipPush and waitForResponse to booleans — string "false" would
+    // be truthy so we require an actual boolean, defaulting to false otherwise.
+    const skipPush = typeof body.skipPush === 'boolean' ? body.skipPush : false;
+    const waitForResponse =
+      typeof body.waitForResponse === 'boolean' ? body.waitForResponse : false;
+
+    if (!title || typeof title !== 'string' || !message || typeof message !== 'string') {
+      return json({ error: 'Title and message are required and must be strings' }, { status: 400 });
+    }
+
+    if (requestDeviceToken !== undefined && typeof requestDeviceToken !== 'string') {
+      return json({ error: 'deviceToken must be a string' }, { status: 400 });
     }
 
     // Smart notification filtering
@@ -173,17 +175,17 @@ export const POST: RequestHandler = async ({ request }) => {
 
     if (!shouldSendNotification.send) {
       addNotification({
-        category: data?.category,
-        data: data as Record<string, unknown>,
+        category: data?.category ?? null,
+        data: (data as Record<string, unknown>) ?? null,
         error: shouldSendNotification.reason,
         id: canonicalRequestId,
         message,
-        project: data?.project,
-        source: data?.source,
+        project: data?.project ?? null,
+        source: data?.source ?? null,
         status: 'filtered',
         timestamp: new Date().toISOString(),
         title,
-        tool: data?.tool,
+        tool: data?.tool ?? null,
       });
 
       return json({
@@ -194,6 +196,41 @@ export const POST: RequestHandler = async ({ request }) => {
       });
     }
 
+    // When skipPush is true, the caller wants to register a pending request
+    // (for bidirectional permission polling) without actually sending a push
+    // notification.  This happens when WebSocket clients are connected and the
+    // events channel will broadcast the permission-requested event instead.
+    if (skipPush) {
+      if (waitForResponse) {
+        createPendingRequest(canonicalRequestId, {
+          sessionId: (data?.sessionId as string) || '',
+          toolInput: (data?.toolInput as Record<string, unknown>) || {},
+          toolName: (data?.toolName as string) || '',
+        });
+      }
+
+      addNotification({
+        category: data?.category ?? null,
+        data: (data as Record<string, unknown>) ?? null,
+        error: null,
+        id: canonicalRequestId,
+        message,
+        project: data?.project ?? null,
+        source: data?.source ?? null,
+        status: 'skipped',
+        timestamp: new Date().toISOString(),
+        title,
+        tool: data?.tool ?? null,
+      });
+
+      return json({
+        message: 'Push skipped (WebSocket clients connected)',
+        requestId: canonicalRequestId,
+        success: true,
+        timestamp: new Date().toISOString(),
+      });
+    }
+
     // Build notification payload (shared between APNs and FCM)
     const payload = {
       badge: 1,
@@ -219,19 +256,23 @@ export const POST: RequestHandler = async ({ request }) => {
       if (!isFCMConfigured()) {
         return json(
           {
-            details: 'Missing FCM_PROJECT_ID, FCM_CLIENT_EMAIL, or FCM_PRIVATE_KEY environment variables',
+            details:
+              'Missing FCM_PROJECT_ID, FCM_CLIENT_EMAIL, or FCM_PRIVATE_KEY environment variables',
             error: 'FCM not configured',
           },
           { status: 500 }
         );
       }
 
-      const androidToken = (env.ANDROID_DEVICE_TOKEN || env.DEVICE_TOKEN)?.trim();
+      // Honor request-scoped deviceToken, falling back to environment variables.
+      const androidToken =
+        requestDeviceToken?.trim() || (env.ANDROID_DEVICE_TOKEN || env.DEVICE_TOKEN)?.trim();
 
       if (!androidToken) {
         return json(
           {
-            details: 'ANDROID_DEVICE_TOKEN or DEVICE_TOKEN environment variable is missing',
+            details:
+              'ANDROID_DEVICE_TOKEN or DEVICE_TOKEN environment variable is missing and no deviceToken in request body',
             error: 'No device token configured',
           },
           { status: 500 }
@@ -253,16 +294,17 @@ export const POST: RequestHandler = async ({ request }) => {
         }
 
         addNotification({
-          category: data?.category,
-          data: data as Record<string, unknown>,
+          category: data?.category ?? null,
+          data: (data as Record<string, unknown>) ?? null,
+          error: null,
           id: canonicalRequestId,
           message,
-          project: data?.project,
-          source: data?.source,
+          project: data?.project ?? null,
+          source: data?.source ?? null,
           status: 'sent',
           timestamp: new Date().toISOString(),
           title,
-          tool: data?.tool,
+          tool: data?.tool ?? null,
         });
 
         return json({
@@ -276,17 +318,17 @@ export const POST: RequestHandler = async ({ request }) => {
         console.error(`[notify] FCM delivery failed: ${fcmResult.error}`);
 
         addNotification({
-          category: data?.category,
-          data: data as Record<string, unknown>,
-          error: fcmResult.error,
+          category: data?.category ?? null,
+          data: (data as Record<string, unknown>) ?? null,
+          error: fcmResult.error ?? null,
           id: canonicalRequestId,
           message,
-          project: data?.project,
-          source: data?.source,
+          project: data?.project ?? null,
+          source: data?.source ?? null,
           status: 'failed',
           timestamp: new Date().toISOString(),
           title,
-          tool: data?.tool,
+          tool: data?.tool ?? null,
         });
 
         return json(
@@ -311,12 +353,15 @@ export const POST: RequestHandler = async ({ request }) => {
         );
       }
 
-      const deviceToken = env.DEVICE_TOKEN?.trim();
+      // Honor request-scoped deviceToken (e.g., from config page test),
+      // falling back to the server-wide environment variable.
+      const deviceToken = requestDeviceToken?.trim() || env.DEVICE_TOKEN?.trim();
 
       if (!deviceToken) {
         return json(
           {
-            details: 'DEVICE_TOKEN environment variable is missing',
+            details:
+              'DEVICE_TOKEN environment variable is missing and no deviceToken in request body',
             error: 'No device token configured',
           },
           { status: 500 }
@@ -340,16 +385,17 @@ export const POST: RequestHandler = async ({ request }) => {
         }
 
         addNotification({
-          category: data?.category,
-          data: data as Record<string, unknown>,
+          category: data?.category ?? null,
+          data: (data as Record<string, unknown>) ?? null,
+          error: null,
           id: canonicalRequestId,
           message,
-          project: data?.project,
-          source: data?.source,
+          project: data?.project ?? null,
+          source: data?.source ?? null,
           status: 'sent',
           timestamp: new Date().toISOString(),
           title,
-          tool: data?.tool,
+          tool: data?.tool ?? null,
         });
 
         return json({
@@ -360,26 +406,26 @@ export const POST: RequestHandler = async ({ request }) => {
           timestamp: new Date().toISOString(),
         });
       } catch (notificationError) {
-        const err = notificationError as Error;
-        console.error(`[notify] APNs delivery failed: ${err.message}`);
+        const notifErrMsg = toErrorMessage(notificationError);
+        console.error(`[notify] APNs delivery failed: ${notifErrMsg}`);
 
         addNotification({
-          category: data?.category,
-          data: data as Record<string, unknown>,
-          error: err.message,
+          category: data?.category ?? null,
+          data: (data as Record<string, unknown>) ?? null,
+          error: notifErrMsg,
           id: canonicalRequestId,
           message,
-          project: data?.project,
-          source: data?.source,
+          project: data?.project ?? null,
+          source: data?.source ?? null,
           status: 'failed',
           timestamp: new Date().toISOString(),
           title,
-          tool: data?.tool,
+          tool: data?.tool ?? null,
         });
 
         return json(
           {
-            details: err.message,
+            details: notifErrMsg,
             error: 'Failed to send notification',
             requestId: canonicalRequestId,
             timestamp: new Date().toISOString(),
@@ -389,11 +435,10 @@ export const POST: RequestHandler = async ({ request }) => {
       }
     }
   } catch (error) {
-    const err = error as Error;
-    console.error('Notification error:', err);
+    console.error('Notification error:', error);
     return json(
       {
-        details: err.message,
+        details: toErrorMessage(error),
         error: 'Failed to send notification',
         timestamp: new Date().toISOString(),
       },
@@ -405,7 +450,9 @@ export const POST: RequestHandler = async ({ request }) => {
 export const GET: RequestHandler = ({ request, url }) => {
   // Validate API key using timing-safe comparison
   const authError = validateAuth(request);
-  if (authError) return authError;
+  if (authError) {
+    return authError;
+  }
 
   const limit = parseInt(url.searchParams.get('limit') || '50');
   const notifications = getNotifications(limit);