@juspay/shooter 1.0.0 → 1.2.0

package/src/routes/api/qr-config/+server.ts

@@ -1,45 +1,43 @@
 import { env } from '$env/dynamic/private';
 import { validateAuth } from '$lib/modules/server/auth';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 import QRCode from 'qrcode';
 
 import type { RequestHandler } from './$types';
 
-export const GET: RequestHandler = async ({ request }) => {
-	const authError = validateAuth(request);
-	if (authError) {
-		return authError;
-	}
+export const GET: RequestHandler = async ({ request, url }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
 
-	const apiKey = env.API_KEY?.trim();
-	if (!apiKey) {
-		return json({ error: 'API_KEY not configured on server' }, { status: 500 });
-	}
+  const apiKey = env.API_KEY?.trim();
+  if (!apiKey) {
+    return json({ error: 'API_KEY not configured on server' }, { status: 500 });
+  }
 
-	// Derive the server URL from the incoming request's Host header so the QR
-	// code always points to the right address (works behind tunnels, proxies, etc.)
-	const proto = request.headers.get('x-forwarded-proto') || 'http';
-	const host = request.headers.get('x-forwarded-host') || request.headers.get('host') || 'localhost:3000';
-	const serverUrl = `${proto}://${host}`;
+  // Use a configured server URL from env when available (trusted), otherwise
+  // fall back to url.origin (derived from the incoming request URL by SvelteKit).
+  const serverUrl = env.ORIGIN?.trim() || url.origin;
 
-	const configPayload = JSON.stringify({ apiKey, serverUrl });
+  const configPayload = JSON.stringify({ apiKey, serverUrl });
 
-	try {
-		const dataUrl = await QRCode.toDataURL(configPayload, {
-			color: {
-				dark: '#ededed',
-				light: '#0a0a0a',
-			},
-			errorCorrectionLevel: 'M',
-			margin: 2,
-			type: 'image/png',
-			width: 280,
-		});
+  try {
+    const dataUrl = await QRCode.toDataURL(configPayload, {
+      color: {
+        dark: '#ededed',
+        light: '#0a0a0a',
+      },
+      errorCorrectionLevel: 'M',
+      margin: 2,
+      type: 'image/png',
+      width: 280,
+    });
 
-		return json({ dataUrl, serverUrl });
-	} catch (error) {
-		const err = error as Error;
-		console.error('[qr-config] QR generation failed:', err.message);
-		return json({ error: 'Failed to generate QR code' }, { status: 500 });
-	}
+    return json({ dataUrl, serverUrl });
+  } catch (error) {
+    console.error('[qr-config] QR generation failed:', toErrorMessage(error));
+    return json({ error: 'Failed to generate QR code' }, { status: 500 });
+  }
 };

package/src/routes/api/response/+server.ts

@@ -1,5 +1,6 @@
 import { cleanup, getDecision, setDecision } from '$lib/modules/server/apn/pending-requests';
 import { validateAuth } from '$lib/modules/server/auth';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 
 import type { RequestHandler } from './$types';
@@ -9,7 +10,9 @@ export const POST: RequestHandler = async ({ request }) => {
   cleanup();
 
   const authError = validateAuth(request);
-  if (authError) {return authError;}
+  if (authError) {
+    return authError;
+  }
 
   let body: { decision?: string; requestId?: string };
   try {
@@ -42,8 +45,8 @@ export const POST: RequestHandler = async ({ request }) => {
       timestamp: new Date().toISOString(),
     });
   } catch (error) {
-    const err = error as Error;
-    return json({ details: err.message, error: 'Failed to process response' }, { status: 500 });
+    console.error('[response] Failed to process response:', toErrorMessage(error));
+    return json({ error: 'Failed to process response' }, { status: 500 });
   }
 };
 
@@ -52,7 +55,9 @@ export const GET: RequestHandler = ({ request, url }) => {
   cleanup();
 
   const authErr = validateAuth(request);
-  if (authErr) {return authErr;}
+  if (authErr) {
+    return authErr;
+  }
 
   const requestId = url.searchParams.get('requestId');
   if (!requestId) {

package/src/routes/api/sessions/+server.ts

@@ -13,10 +13,10 @@ import { json } from '@sveltejs/kit';
 
 import type { RequestHandler } from './$types';
 
-// Server-side cache for merged projects (30s TTL)
+// Server-side cache for merged projects (5s TTL)
 let cachedProjects: null | ProjectGroup[] = null;
 let cacheTimestamp = 0;
-const CACHE_TTL_MS = 30_000;
+const CACHE_TTL_MS = 5_000;
 
 function getMergedProjects(): ProjectGroup[] {
   const now = Date.now();
@@ -57,14 +57,24 @@ function getMergedProjects(): ProjectGroup[] {
 
 export const GET: RequestHandler = ({ request, url }) => {
   const authError = validateAuth(request);
-  if (authError) {return authError;}
+  if (authError) {
+    return authError;
+  }
+
+  // Force cache invalidation when ?refresh=true is passed
+  if (url.searchParams.get('refresh') === 'true') {
+    cachedProjects = null;
+    cacheTimestamp = 0;
+  }
 
   const sessionId = url.searchParams.get('id');
 
   if (sessionId) {
     const projectId = url.searchParams.get('project') || '';
-    const offset = parseInt(url.searchParams.get('offset') || '0');
-    const limit = parseInt(url.searchParams.get('limit') || '100');
+    const rawOffset = parseInt(url.searchParams.get('offset') || '0');
+    const rawLimit = parseInt(url.searchParams.get('limit') || '200');
+    const offset = Number.isFinite(rawOffset) && rawOffset >= 0 ? rawOffset : 0;
+    const limit = Number.isFinite(rawLimit) && rawLimit >= 1 ? Math.min(rawLimit, 500) : 200;
 
     // Resolve short project ID to full path for the readers
     const allProjects = getMergedProjects();

package/src/routes/api/sessions/connect/+server.ts

@@ -0,0 +1,125 @@
+import { validateAuth } from '$lib/modules/server/auth';
+import { ptyManager } from '$lib/modules/server/terminal/pty-manager';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
+import { json } from '@sveltejs/kit';
+import { realpathSync, statSync } from 'fs';
+import { isAbsolute, relative } from 'path';
+
+import type { RequestHandler } from './$types';
+
+// POST /api/sessions/connect — Resume a Claude Code / OpenCode session in a new terminal
+export const POST: RequestHandler = async ({ request }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
+
+  let body: { command?: string; cwd?: string; noCreate?: boolean; sessionId?: string };
+  try {
+    body = (await request.json()) as {
+      command?: string;
+      cwd?: string;
+      noCreate?: boolean;
+      sessionId?: string;
+    };
+  } catch {
+    return json({ error: 'Invalid JSON in request body' }, { status: 400 });
+  }
+
+  const { command, cwd, noCreate, sessionId } = body;
+
+  // --- Validate required fields ---
+
+  if (!sessionId || typeof sessionId !== 'string') {
+    return json({ error: 'sessionId is required (string)' }, { status: 400 });
+  }
+
+  if (!cwd || typeof cwd !== 'string') {
+    return json({ error: 'cwd is required (string)' }, { status: 400 });
+  }
+
+  if (!command || (command !== 'claude' && command !== 'opencode')) {
+    return json({ error: 'command must be "claude" or "opencode"' }, { status: 400 });
+  }
+
+  // --- Validate cwd (same checks as POST /api/terminals) ---
+
+  let realCwd: string;
+  try {
+    realCwd = realpathSync(cwd);
+    if (!statSync(realCwd).isDirectory()) {
+      return json({ error: 'Invalid working directory' }, { status: 400 });
+    }
+  } catch {
+    return json({ error: 'Invalid working directory' }, { status: 400 });
+  }
+  const home = process.env.HOME || '';
+  if (home) {
+    const rel = relative(home, realCwd);
+    if (rel.startsWith('..') || isAbsolute(rel)) {
+      return json({ error: 'Working directory must be under home directory' }, { status: 400 });
+    }
+  }
+
+  // --- Reuse existing terminal if one is already running for this session ---
+
+  const existing = ptyManager
+    .list()
+    .find((t) => t.status === 'running' && (
+      t.sessionFile?.endsWith(`/${sessionId}.jsonl`) || t.openCodeSessionId === sessionId
+    ));
+
+  if (existing) {
+    console.log(
+      `[sessions/connect] Reusing terminal ${existing.id} for ${command} session ${sessionId}`
+    );
+    return json({
+      command: existing.command,
+      createdAt: existing.createdAt.toISOString(),
+      cwd: existing.cwd,
+      id: existing.id,
+      pid: existing.pid,
+      reused: true,
+      sessionId,
+      sessionWs: `/ws/session/${existing.id}`,
+      terminalId: existing.id,
+      ws: `/ws/terminal/${existing.id}`,
+    });
+  }
+
+  // No existing terminal — return 404 if caller requested no-create
+  if (noCreate) {
+    return json({ error: 'No existing terminal for this session' }, { status: 404 });
+  }
+
+  // --- Build args based on command ---
+
+  const args: string[] =
+    command === 'claude' ? ['--resume', sessionId] : ['--session', sessionId];
+
+  try {
+    const terminal = await ptyManager.create(command, args, realCwd, 120, 40);
+
+    console.log(
+      `[sessions/connect] Created terminal ${terminal.id} for ${command} session ${sessionId} (pid=${terminal.pid})`
+    );
+
+    return json(
+      {
+        command: terminal.command,
+        createdAt: terminal.createdAt instanceof Date ? terminal.createdAt.toISOString() : terminal.createdAt,
+        cwd: terminal.cwd,
+        id: terminal.id,
+        pid: terminal.pid,
+        sessionId,
+        sessionWs: `/ws/session/${terminal.id}`,
+        terminalId: terminal.id,
+        ws: `/ws/terminal/${terminal.id}`,
+      },
+      { status: 201 }
+    );
+  } catch (error) {
+    console.error('[sessions/connect] Failed to create terminal:', toErrorMessage(error));
+    return json({ error: 'Failed to create terminal for session' }, { status: 500 });
+  }
+};

package/src/routes/api/sessions/detect/+server.ts

@@ -0,0 +1,27 @@
+import { validateAuth } from '$lib/modules/server/auth';
+import { detectRunningAISessions } from '$lib/modules/server/sessions/process-detector';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
+import { json } from '@sveltejs/kit';
+
+import type { RequestHandler } from './$types';
+
+// GET /api/sessions/detect — Detect running Claude Code / OpenCode processes
+export const GET: RequestHandler = ({ request }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
+
+  try {
+    const processes = detectRunningAISessions();
+
+    return json({
+      count: processes.length,
+      processes,
+      timestamp: new Date().toISOString(),
+    });
+  } catch (error) {
+    console.error('[sessions/detect] Failed to detect running sessions:', toErrorMessage(error));
+    return json({ error: 'Failed to detect running sessions' }, { status: 500 });
+  }
+};

package/src/routes/api/terminals/+server.ts

@@ -1,8 +1,9 @@
 import { validateAuth } from '$lib/modules/server/auth';
-import { ptyManager } from '$lib/modules/server/terminal/pty-manager.js';
+import { ptyManager } from '$lib/modules/server/terminal/pty-manager';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 import { realpathSync, statSync } from 'fs';
-import { basename } from 'path';
+import { basename, isAbsolute, relative } from 'path';
 
 import type { RequestHandler } from './$types';
 
@@ -11,10 +12,12 @@ const ALLOWED_COMMANDS = ['zsh', 'bash', 'sh', 'fish', 'claude', 'opencode'];
 // GET /api/terminals — List all terminals (active + recently exited)
 export const GET: RequestHandler = ({ request }) => {
   const authError = validateAuth(request);
-  if (authError) {return authError;}
+  if (authError) {
+    return authError;
+  }
 
   try {
-    const terminals = ptyManager.list().map(t => ({
+    const terminals = ptyManager.list().map((t) => ({
       args: t.args,
       clientCount: t.clients.size,
       command: t.command,
@@ -35,15 +38,17 @@ export const GET: RequestHandler = ({ request }) => {
       timestamp: new Date().toISOString(),
     });
   } catch (error) {
-    const err = error as Error;
-    return json({ details: err.message, error: 'Failed to list terminals' }, { status: 500 });
+    console.error('[terminals] Failed to list terminals:', toErrorMessage(error));
+    return json({ error: 'Failed to list terminals' }, { status: 500 });
   }
 };
 
 // POST /api/terminals — Create a new terminal session
 export const POST: RequestHandler = async ({ request }) => {
   const authError = validateAuth(request);
-  if (authError) {return authError;}
+  if (authError) {
+    return authError;
+  }
 
   let body: { args?: string[]; cols?: number; command?: string; cwd?: string; rows?: number };
   try {
@@ -70,7 +75,7 @@ export const POST: RequestHandler = async ({ request }) => {
     if (!ALLOWED_COMMANDS.includes(commandBasename)) {
       return json(
         { error: `Command not allowed. Allowed: ${ALLOWED_COMMANDS.join(', ')}` },
-        { status: 400 },
+        { status: 400 }
       );
     }
 
@@ -82,15 +87,18 @@ export const POST: RequestHandler = async ({ request }) => {
     let realCwd: string;
     try {
       realCwd = realpathSync(cwd);
+      if (!statSync(realCwd).isDirectory()) {
+        return json({ error: 'cwd must be a directory' }, { status: 400 });
+      }
     } catch {
-      return json({ error: 'Invalid working directory' }, { status: 400 });
-    }
-    if (!statSync(realCwd).isDirectory()) {
-      return json({ error: 'Invalid working directory' }, { status: 400 });
+      return json({ error: 'cwd must be a directory' }, { status: 400 });
     }
     const home = process.env.HOME || '';
-    if (home && !realCwd.startsWith(home)) {
-      return json({ error: 'Working directory must be under home directory' }, { status: 400 });
+    if (home) {
+      const rel = relative(home, realCwd);
+      if (rel.startsWith('..') || isAbsolute(rel)) {
+        return json({ error: 'Working directory must be under home directory' }, { status: 400 });
+      }
     }
 
     if (args !== undefined && !Array.isArray(args)) {
@@ -110,13 +118,7 @@ export const POST: RequestHandler = async ({ request }) => {
       return json({ error: 'rows must be a positive number' }, { status: 400 });
     }
 
-    const terminal = await ptyManager.create(
-      command,
-      args ?? [],
-      realCwd,
-      cols ?? 80,
-      rows ?? 24,
-    );
+    const terminal = await ptyManager.create(command, args ?? [], realCwd, cols ?? 80, rows ?? 24);
 
     console.log(
       `[terminals] Created terminal ${terminal.id} (pid=${terminal.pid}, command=${command})`
@@ -125,7 +127,7 @@ export const POST: RequestHandler = async ({ request }) => {
     return json(
       {
         command: terminal.command,
-        createdAt: terminal.createdAt,
+        createdAt: terminal.createdAt instanceof Date ? terminal.createdAt.toISOString() : terminal.createdAt,
         cwd: terminal.cwd,
         id: terminal.id,
         pid: terminal.pid,
@@ -135,7 +137,7 @@ export const POST: RequestHandler = async ({ request }) => {
       { status: 201 }
     );
   } catch (error) {
-    const err = error as Error;
-    return json({ details: err.message, error: 'Failed to create terminal' }, { status: 500 });
+    console.error('[terminals] Failed to create terminal:', toErrorMessage(error));
+    return json({ error: 'Failed to create terminal' }, { status: 500 });
   }
 };

package/src/routes/api/terminals/[id]/+server.ts

@@ -1,5 +1,6 @@
 import { validateAuth } from '$lib/modules/server/auth';
 import { ptyManager } from '$lib/modules/server/terminal/pty-manager.js';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 
 import type { RequestHandler } from './$types';
@@ -7,7 +8,9 @@ import type { RequestHandler } from './$types';
 // GET /api/terminals/:id — Get terminal details by ID
 export const GET: RequestHandler = ({ params, request }) => {
   const authError = validateAuth(request);
-  if (authError) {return authError;}
+  if (authError) {
+    return authError;
+  }
 
   try {
     const terminal = ptyManager.get(params.id);
@@ -25,7 +28,8 @@ export const GET: RequestHandler = ({ params, request }) => {
       exitCode: terminal.exitCode,
       exitedAt: terminal.exitedAt?.toISOString() ?? null,
       id: terminal.id,
-      lastOutput: terminal.scrollback.length > 0 ? terminal.scrollback[terminal.scrollback.length - 1] : null,
+      lastOutput:
+        terminal.scrollback.length > 0 ? terminal.scrollback[terminal.scrollback.length - 1] : null,
       pid: terminal.pid,
       sessionWs: `/ws/session/${terminal.id}`,
       status: terminal.status,
@@ -33,15 +37,17 @@ export const GET: RequestHandler = ({ params, request }) => {
       ws: `/ws/terminal/${terminal.id}`,
     });
   } catch (error) {
-    const err = error as Error;
-    return json({ details: err.message, error: 'Failed to get terminal' }, { status: 500 });
+    console.error('[terminals] Failed to get terminal:', toErrorMessage(error));
+    return json({ error: 'Failed to get terminal' }, { status: 500 });
   }
 };
 
 // DELETE /api/terminals/:id — Kill terminal by ID (SIGTERM)
 export const DELETE: RequestHandler = ({ params, request }) => {
   const authError = validateAuth(request);
-  if (authError) {return authError;}
+  if (authError) {
+    return authError;
+  }
 
   try {
     const terminal = ptyManager.get(params.id);
@@ -69,7 +75,7 @@ export const DELETE: RequestHandler = ({ params, request }) => {
       timestamp: new Date().toISOString(),
     });
   } catch (error) {
-    const err = error as Error;
-    return json({ details: err.message, error: 'Failed to kill terminal' }, { status: 500 });
+    console.error('[terminals] Failed to kill terminal:', toErrorMessage(error));
+    return json({ error: 'Failed to kill terminal' }, { status: 500 });
   }
 };

package/src/routes/api/terminals/[id]/paste-image/+server.ts

@@ -1,4 +1,5 @@
 import { validateAuth } from '$lib/modules/server/auth';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 import { mkdirSync, writeFileSync } from 'fs';
 
@@ -6,56 +7,57 @@ import type { RequestHandler } from './$types';
 
 // POST /api/terminals/[id]/paste-image — Write clipboard image for a terminal
 export const POST: RequestHandler = async ({ params, request }) => {
-	const authError = validateAuth(request);
-	if (authError) {
-		return authError;
-	}
-
-	const terminalId = params.id;
-
-	// Validate terminalId to prevent path traversal
-	if (!/^[A-Za-z0-9_-]+$/.test(terminalId)) {
-		return json({ error: 'Invalid terminal ID' }, { status: 400 });
-	}
-
-	let body: { image: string };
-	try {
-		body = (await request.json()) as { image: string };
-	} catch {
-		return json({ error: 'Invalid JSON' }, { status: 400 });
-	}
-
-	if (!body.image || typeof body.image !== 'string') {
-		return json({ error: 'image (base64) is required' }, { status: 400 });
-	}
-
-	// Decode base64 image
-	let imageBuffer: Buffer;
-	try {
-		// Strip data URI prefix if present
-		const base64Data = body.image.replace(/^data:image\/\w+;base64,/, '');
-
-		// Validate base64 encoding via round-trip check
-		// Buffer.from silently ignores invalid chars, so verify re-encoding matches
-		const decoded = Buffer.from(base64Data, 'base64');
-		if (decoded.length === 0 || decoded.toString('base64') !== base64Data) {
-			return json({ error: 'Invalid base64 image data' }, { status: 400 });
-		}
-		imageBuffer = decoded;
-	} catch {
-		return json({ error: 'Invalid base64 image data' }, { status: 400 });
-	}
-
-	// Write to per-terminal clipboard directory
-	const clipboardDir = `/tmp/shooter-clipboard-${terminalId}`;
-	const imagePath = `${clipboardDir}/image.png`;
-
-	try {
-		mkdirSync(clipboardDir, { recursive: true });
-		writeFileSync(imagePath, imageBuffer);
-	} catch (err) {
-		return json({ details: (err as Error).message, error: 'Failed to write image' }, { status: 500 });
-	}
-
-	return json({ path: imagePath, size: imageBuffer.length });
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
+
+  const terminalId = params.id;
+
+  // Validate terminalId to prevent path traversal
+  if (!/^[A-Za-z0-9_-]+$/.test(terminalId)) {
+    return json({ error: 'Invalid terminal ID' }, { status: 400 });
+  }
+
+  let body: { image: string };
+  try {
+    body = (await request.json()) as { image: string };
+  } catch {
+    return json({ error: 'Invalid JSON' }, { status: 400 });
+  }
+
+  if (!body.image || typeof body.image !== 'string') {
+    return json({ error: 'image (base64) is required' }, { status: 400 });
+  }
+
+  // Decode base64 image
+  let imageBuffer: Buffer;
+  try {
+    // Strip data URI prefix if present
+    const base64Data = body.image.replace(/^data:image\/\w+;base64,/, '');
+
+    // Validate base64 encoding via round-trip check
+    // Buffer.from silently ignores invalid chars, so verify re-encoding matches
+    const decoded = Buffer.from(base64Data, 'base64');
+    if (decoded.length === 0 || decoded.toString('base64') !== base64Data) {
+      return json({ error: 'Invalid base64 image data' }, { status: 400 });
+    }
+    imageBuffer = decoded;
+  } catch {
+    return json({ error: 'Invalid base64 image data' }, { status: 400 });
+  }
+
+  // Write to per-terminal clipboard directory
+  const clipboardDir = `/tmp/shooter-clipboard-${terminalId}`;
+  const imagePath = `${clipboardDir}/image.png`;
+
+  try {
+    mkdirSync(clipboardDir, { recursive: true });
+    writeFileSync(imagePath, imageBuffer);
+  } catch (err) {
+    console.error('[paste-image] Failed to write image:', toErrorMessage(err));
+    return json({ error: 'Failed to write image' }, { status: 500 });
+  }
+
+  return json({ size: imageBuffer.length, success: true });
 };

package/src/routes/api/terminals/[id]/resize/+server.ts

@@ -1,5 +1,6 @@
 import { validateAuth } from '$lib/modules/server/auth';
 import { ptyManager } from '$lib/modules/server/terminal/pty-manager.js';
+import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 
 import type { RequestHandler } from './$types';
@@ -7,7 +8,9 @@ import type { RequestHandler } from './$types';
 // POST /api/terminals/:id/resize — Resize terminal
 export const POST: RequestHandler = async ({ params, request }) => {
   const authError = validateAuth(request);
-  if (authError) {return authError;}
+  if (authError) {
+    return authError;
+  }
 
   let body: { cols?: number; rows?: number };
   try {
@@ -54,7 +57,7 @@ export const POST: RequestHandler = async ({ params, request }) => {
       timestamp: new Date().toISOString(),
     });
   } catch (error) {
-    const err = error as Error;
-    return json({ details: err.message, error: 'Failed to resize terminal' }, { status: 500 });
+    console.error('[terminals] Failed to resize terminal:', toErrorMessage(error));
+    return json({ error: 'Failed to resize terminal' }, { status: 500 });
   }
 };