@juspay/shooter 1.0.0

package/src/lib/modules/client/terminal/xterm-wrapper.ts

@@ -0,0 +1,243 @@
+// IMPORTANT: This module must NEVER be imported at module top level in a Svelte component.
+// Always call createTerminal() inside onMount() only.
+
+import type { Terminal } from '@xterm/xterm';
+
+interface TerminalInstance {
+  dispose: () => void;
+  fitAddon: any; // FitAddon type
+  sendInput: (data: string) => void;
+  term: Terminal;
+}
+
+interface TerminalOptions {
+  apiKey?: string;
+  container: HTMLElement;
+  fontSize?: number;
+  getTicket: () => Promise<string>;
+  onActivity?: (active: boolean) => void;
+  onCwd?: (path: string) => void;
+  onDisconnect?: () => void;
+  onExit?: (code: number) => void;
+  onReconnect?: () => void;
+  terminalId?: string;
+  wsUrl: string;
+}
+
+export async function createTerminal(options: TerminalOptions): Promise<TerminalInstance> {
+  // Dynamic imports — only loaded client-side
+  const { Terminal } = await import('@xterm/xterm');
+  const { FitAddon } = await import('@xterm/addon-fit');
+  const { WebLinksAddon } = await import('@xterm/addon-web-links');
+
+  // Also need to import the CSS
+  await import('@xterm/xterm/css/xterm.css');
+
+  const fitAddon = new FitAddon();
+
+  const term = new Terminal({
+    allowTransparency: true,
+    cursorBlink: true,
+    cursorStyle: 'block',
+    fontFamily: "'SF Mono', 'Fira Code', 'Cascadia Code', 'Menlo', monospace",
+    fontSize: options.fontSize || 14,
+    theme: {
+      background: '#0a0a0f',
+      black: '#0a0a0f',
+      blue: '#3b82f6',
+      brightBlack: '#64748b',
+      brightBlue: '#60a5fa',
+      brightCyan: '#67e8f9',
+      brightGreen: '#4ade80',
+      brightMagenta: '#c4b5fd',
+      brightRed: '#f87171',
+      brightWhite: '#f8fafc',
+      brightYellow: '#fbbf24',
+      cursor: '#e2e8f0',
+      cursorAccent: '#0a0a0f',
+      cyan: '#38bdf8',
+      foreground: '#e2e8f0',
+      green: '#22c55e',
+      magenta: '#a78bfa',
+      red: '#ef4444',
+      selectionBackground: 'rgba(99, 102, 241, 0.3)',
+      white: '#e2e8f0',
+      yellow: '#f59e0b',
+    },
+  });
+
+  term.loadAddon(fitAddon);
+  term.loadAddon(new WebLinksAddon());
+  term.open(options.container);
+  fitAddon.fit();
+
+  // Block browser-level Cmd/Ctrl shortcuts from reaching the PTY.
+  // Allow Ctrl+<letter> terminal signals (Ctrl+C/D/L/R/Z etc.) through.
+  const browserShortcuts = new Set(['s', 'w', 't', 'n', 'p', 'q', 'h', 'j', 'f', 'g', 'o', 'u']);
+  term.attachCustomKeyEventHandler((e) => {
+    // Cmd+key on Mac: block known browser shortcuts, allow the rest
+    if (e.metaKey) {
+      if (e.key === 'c' || e.key === 'v') { return true; } // allow copy/paste
+      if (browserShortcuts.has(e.key)) { return false; }    // block browser shortcuts
+      return true;
+    }
+    // Ctrl+key (non-Mac modifier): allow all through to PTY (Ctrl+C/D/L/R/Z etc.)
+    return true;
+  });
+
+  // Clipboard image paste interception
+  let pasteListener: ((e: ClipboardEvent) => void) | null = null;
+  if (options.terminalId && options.apiKey) {
+    const pasteTermId = options.terminalId;
+    const pasteApiKey = options.apiKey;
+
+    pasteListener = async (e: ClipboardEvent) => {
+      try {
+        if (!e.clipboardData) return;
+        const items = Array.from(e.clipboardData.items);
+        const imageItem = items.find(item => item.type.startsWith('image/'));
+        if (!imageItem) return; // No image — let normal paste proceed
+
+        e.preventDefault();
+        const blob = imageItem.getAsFile();
+        if (!blob) return;
+
+        // Read image as base64
+        const reader = new FileReader();
+        const base64 = await new Promise<string>((resolve, reject) => {
+          reader.onload = () => resolve(reader.result as string);
+          reader.onerror = reject;
+          reader.readAsDataURL(blob);
+        });
+
+        // Upload to server
+        const res = await fetch(`/api/terminals/${pasteTermId}/paste-image`, {
+          method: 'POST',
+          headers: {
+            'Authorization': `Bearer ${pasteApiKey}`,
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({ image: base64 }),
+        });
+
+        // Send Ctrl+V (0x16) to PTY only after a successful upload
+        if (res.ok && ws?.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify({ data: '\x16', type: 'input' }));
+        }
+      } catch {
+        // Silent failure — don't break text paste
+      }
+    };
+
+    options.container.addEventListener('paste', pasteListener as EventListener);
+  }
+
+  // WebSocket connection
+  let ws: null | WebSocket = null;
+  let reconnectTimer: null | ReturnType<typeof setTimeout> = null;
+  let reconnectDelay = 1000;
+  let disposed = false;
+
+  async function connect() {
+    if (disposed) {return;}
+
+    let ticket: string;
+    try {
+      ticket = await options.getTicket();
+    } catch {
+      // Ticket fetch failed — schedule a retry
+      if (!disposed) {
+        options.onDisconnect?.();
+        reconnectTimer = setTimeout(() => {
+          reconnectDelay = Math.min(reconnectDelay * 2, 30_000);
+          void connect();
+        }, reconnectDelay);
+      }
+      return;
+    }
+
+    if (disposed) {return;}
+
+    ws = new WebSocket(`${options.wsUrl}?ticket=${ticket}`);
+
+    ws.onopen = () => {
+      reconnectDelay = 1000; // Reset backoff
+      options.onReconnect?.();
+    };
+
+    ws.onmessage = (event) => {
+      const msg = JSON.parse(event.data);
+      if (msg.type === 'output') {
+        term.write(msg.data);
+      } else if (msg.type === 'scrollback') {
+        term.write(msg.data);
+      } else if (msg.type === 'exit') {
+        term.write(`\r\n\x1b[90m[Process exited with code ${msg.code}]\x1b[0m\r\n`);
+        // Process exited — stop reconnection and notify parent
+        disposed = true;
+        if (reconnectTimer) {clearTimeout(reconnectTimer);}
+        options.onExit?.(msg.code);
+      } else if (msg.type === 'output-dropped') {
+        term.write(`\r\n\x1b[33m[${msg.bytes} bytes dropped]\x1b[0m\r\n`);
+      } else if (msg.type === 'activity') {
+        options.onActivity?.(msg.active);
+      } else if (msg.type === 'cwd') {
+        options.onCwd?.(msg.path);
+      }
+    };
+
+    ws.onclose = () => {
+      if (disposed) {return;}
+      options.onDisconnect?.();
+      // Exponential backoff reconnect
+      reconnectTimer = setTimeout(() => {
+        reconnectDelay = Math.min(reconnectDelay * 2, 30_000);
+        void connect();
+      }, reconnectDelay);
+    };
+  }
+
+  void connect();
+
+  // Terminal input -> WebSocket
+  term.onData((data) => {
+    if (ws?.readyState === WebSocket.OPEN) {
+      ws.send(JSON.stringify({ data, type: 'input' }));
+    }
+  });
+
+  // Handle resize
+  const resizeObserver = new ResizeObserver(() => {
+    fitAddon.fit();
+    if (ws?.readyState === WebSocket.OPEN) {
+      ws.send(JSON.stringify({ cols: term.cols, rows: term.rows, type: 'resize' }));
+    }
+  });
+  resizeObserver.observe(options.container);
+
+  function dispose() {
+    disposed = true;
+    if (reconnectTimer) {clearTimeout(reconnectTimer);}
+    if (pasteListener) {
+      options.container.removeEventListener('paste', pasteListener as EventListener);
+    }
+    resizeObserver.disconnect();
+    ws?.close();
+    term.dispose();
+  }
+
+  function sendInput(data: string) {
+    if (ws?.readyState === WebSocket.OPEN) {
+      ws.send(JSON.stringify({ data, type: 'input' }));
+    }
+  }
+
+  return { dispose, fitAddon, sendInput, term };
+}
+
+// Helper to send signals
+export function sendSignal(ws: WebSocket, signal: string): void {
+  if (ws.readyState === WebSocket.OPEN) {
+    ws.send(JSON.stringify({ signal, type: 'signal' }));
+  }
+}

package/src/lib/modules/server/apn/library-apns.ts

@@ -0,0 +1,137 @@
+import { env } from '$env/dynamic/private';
+// APNs service using proven library instead of manual implementation
+import apn from '@parse/node-apn';
+
+import type { LibraryResult as APNsLibraryResult, NotificationPayload } from './types';
+
+export class LibraryAPNsService {
+  private bundleId: string | undefined;
+  private configured = false;
+  private keyId: string | undefined;
+  private privateKey: string | undefined;
+  private provider: apn.Provider | null = null;
+  private teamId: string | undefined;
+
+  constructor() {
+    this.keyId = env.APNS_KEY_ID;
+    this.teamId = env.APNS_TEAM_ID;
+    this.bundleId = env.APNS_BUNDLE_ID;
+    this.privateKey = env.APNS_KEY;
+
+    if (!this.keyId || !this.teamId || !this.bundleId || !this.privateKey) {
+      console.error(
+        '[apns] Missing required configuration (APNS_KEY_ID, APNS_TEAM_ID, APNS_BUNDLE_ID, or APNS_KEY)'
+      );
+      this.configured = false;
+      return;
+    }
+
+    const production = env.APNS_PRODUCTION === 'true';
+    const options = {
+      production,
+      token: {
+        key: this.privateKey,
+        keyId: this.keyId,
+        teamId: this.teamId,
+      },
+    };
+
+    try {
+      this.provider = new apn.Provider(options);
+      this.configured = true;
+      console.log(`[apns] Provider initialized (${production ? 'production' : 'sandbox'} mode)`);
+    } catch (error) {
+      const err = error as Error;
+      console.error('[apns] Failed to create provider:', err.message);
+      this.configured = false;
+    }
+  }
+
+  isConfigured(): boolean {
+    return this.configured;
+  }
+
+  async sendNotification(
+    deviceToken: string,
+    payload: NotificationPayload
+  ): Promise<{
+    details?: unknown[];
+    error?: string;
+    failed: number;
+    sent: number;
+    success: boolean;
+  }> {
+    if (!this.configured || !this.provider) {
+      throw new Error('APNs service not configured properly');
+    }
+
+    if (!deviceToken || !payload) {
+      throw new Error('Device token and payload are required');
+    }
+
+    const notification = new apn.Notification();
+
+    notification.alert = {
+      body: payload.body ?? payload.message ?? '',
+      title: payload.title,
+    };
+
+    notification.badge = payload.badge ?? 1;
+    notification.sound = payload.sound ?? 'default';
+    notification.topic = this.bundleId!;
+
+    if (payload.category) {
+      notification.aps.category = payload.category;
+    }
+
+    if (payload.data) {
+      notification.payload = payload.data;
+    }
+
+    const result = (await this.provider.send(notification, deviceToken)) as APNsLibraryResult;
+
+    if (result.failed && result.failed.length > 0) {
+      console.error(`[apns] Full failed result: ${JSON.stringify(result.failed[0])}`);
+      const failedItem = result.failed[0] as unknown as Record<string, unknown>;
+      const rawReason =
+        (failedItem?.response as Record<string, unknown>)?.reason ??
+        failedItem?.status ??
+        failedItem?.error;
+      const reason =
+        typeof rawReason === 'string' ? rawReason : JSON.stringify(rawReason ?? failedItem);
+      console.error(`[apns] Delivery failed: ${reason}`);
+
+      return {
+        error: reason,
+        failed: result.failed?.length || 0,
+        sent: result.sent?.length || 0,
+        success: false,
+      };
+    }
+
+    if (result.sent && result.sent.length > 0) {
+      return {
+        details: result.sent,
+        failed: 0,
+        sent: result.sent.length,
+        success: true,
+      };
+    }
+
+    return {
+      details: [result as unknown as Record<string, unknown>],
+      error: 'Unexpected result format',
+      failed: 1,
+      sent: 0,
+      success: false,
+    };
+  }
+
+  shutdown(): void {
+    if (this.provider) {
+      void this.provider.shutdown();
+    }
+  }
+}
+
+export default LibraryAPNsService;

package/src/lib/modules/server/apn/notification-history.ts

@@ -0,0 +1,35 @@
+// In-memory notification history store.
+// Same pattern as pending-requests.ts — suitable for single-instance deployments.
+
+export interface NotificationRecord {
+  category?: string;
+  data?: Record<string, unknown>;
+  error?: string;
+  id: string;
+  message: string;
+  project?: string;
+  source?: string;
+  status: 'failed' | 'filtered' | 'sent';
+  timestamp: string;
+  title: string;
+  tool?: string;
+}
+
+const MAX_HISTORY = 100;
+
+const history: NotificationRecord[] = [];
+
+export function addNotification(record: NotificationRecord): void {
+  history.unshift(record); // newest first
+  if (history.length > MAX_HISTORY) {
+    history.length = MAX_HISTORY; // trim old entries
+  }
+}
+
+export function clearNotifications(): void {
+  history.length = 0;
+}
+
+export function getNotifications(limit = 50): NotificationRecord[] {
+  return history.slice(0, limit);
+}

package/src/lib/modules/server/apn/notification-sessions.ts

@@ -0,0 +1,117 @@
+import { getNotifications, type NotificationRecord } from './notification-history';
+
+export interface Session {
+  duration: number; // seconds
+  endTime: string;
+  eventCount: number;
+  events: NotificationRecord[];
+  filesModified: string[];
+  id: string;
+  project: string;
+  runtime: string;
+  startTime: string;
+  status: 'active' | 'complete';
+  toolsUsed: string[];
+}
+
+const SESSION_GAP_MS = 30 * 60 * 1000; // 30 min gap = new session
+const ACTIVE_THRESHOLD_MS = 5 * 60 * 1000; // active if last event < 5 min ago
+
+export function getSessionById(id: string): null | Session {
+  return getSessions().find((s) => s.id === id) || null;
+}
+
+export function getSessions(): Session[] {
+  const notifications = getNotifications(100);
+  if (notifications.length === 0) {
+    return [];
+  }
+
+  // Sort by timestamp ascending for grouping
+  const sorted = [...notifications].sort(
+    (a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime()
+  );
+
+  const sessions: Session[] = [];
+  let currentGroup: NotificationRecord[] = [sorted[0]];
+
+  for (let i = 1; i < sorted.length; i++) {
+    const prev = new Date(sorted[i - 1].timestamp).getTime();
+    const curr = new Date(sorted[i].timestamp).getTime();
+
+    if (curr - prev > SESSION_GAP_MS) {
+      // Gap too large — start new session
+      sessions.push(buildSession(currentGroup, sessions.length + 1));
+      currentGroup = [sorted[i]];
+    } else {
+      currentGroup.push(sorted[i]);
+    }
+  }
+
+  // Don't forget last group
+  if (currentGroup.length > 0) {
+    sessions.push(buildSession(currentGroup, sessions.length + 1));
+  }
+
+  // Return newest first
+  return sessions.reverse();
+}
+
+function buildSession(events: NotificationRecord[], index: number): Session {
+  const startTime = events[0].timestamp;
+  const endTime = events[events.length - 1].timestamp;
+  const startMs = new Date(startTime).getTime();
+  const endMs = new Date(endTime).getTime();
+  const now = Date.now();
+
+  // Extract tools from events
+  const tools = new Set<string>();
+  const files = new Set<string>();
+  let project = 'unknown';
+  let runtime = 'claude-code';
+
+  for (const event of events) {
+    if (event.tool) {
+      tools.add(event.tool);
+    }
+    if (event.data?.tool && typeof event.data.tool === 'string') {
+      tools.add(event.data.tool);
+    }
+    if (event.project) {
+      project = event.project;
+    }
+    if (event.data?.project && typeof event.data.project === 'string') {
+      project = event.data.project;
+    }
+    if (event.data?.runtime && typeof event.data.runtime === 'string') {
+      runtime = event.data.runtime;
+    }
+    // Extract files from data
+    if (event.data?.file && typeof event.data.file === 'string') {
+      files.add(event.data.file);
+    }
+    if (event.data?.files && typeof event.data.files === 'string') {
+      event.data.files.split(',').forEach((f: string) => {
+        if (f.trim()) {
+          files.add(f.trim());
+        }
+      });
+    }
+  }
+
+  const isActive = now - endMs < ACTIVE_THRESHOLD_MS;
+
+  return {
+    duration: Math.round((endMs - startMs) / 1000),
+    endTime,
+    eventCount: events.length,
+    events, // already sorted ascending
+    filesModified: [...files],
+    id: `session-${index}`,
+    project,
+    runtime,
+    startTime,
+    status: isActive ? 'active' : 'complete',
+    toolsUsed: [...tools],
+  };
+}

package/src/lib/modules/server/apn/pending-requests.ts

@@ -0,0 +1,65 @@
+// Shared in-memory store for pending permission requests.
+// Used by /api/notify (creates entries) and /api/response (reads/updates).
+
+export interface PendingRequest {
+  createdAt: number;
+  decidedAt: null | number;
+  decision: 'allow' | 'deny' | null;
+  sessionId: string;
+  toolInput: Record<string, unknown>;
+  toolName: string;
+}
+
+const MAX_AGE_MS = 5 * 60 * 1000; // 5 minutes
+
+const pendingRequests = new Map<string, PendingRequest>();
+
+export function cleanup(maxAgeMs: number = MAX_AGE_MS): void {
+  const now = Date.now();
+  for (const [id, entry] of pendingRequests.entries()) {
+    if (now - entry.createdAt > maxAgeMs) {
+      pendingRequests.delete(id);
+    }
+  }
+}
+
+export function createPendingRequest(
+  requestId: string,
+  data: { sessionId: string; toolInput: Record<string, unknown>; toolName: string }
+): void {
+  cleanup();
+  pendingRequests.set(requestId, {
+    createdAt: Date.now(),
+    decidedAt: null,
+    decision: null,
+    sessionId: data.sessionId,
+    toolInput: data.toolInput,
+    toolName: data.toolName,
+  });
+}
+
+export function getDecision(requestId: string): {
+  decision?: 'allow' | 'deny';
+  status: 'decided' | 'not_found' | 'pending';
+} {
+  const entry = pendingRequests.get(requestId);
+  if (!entry) {
+    return { status: 'not_found' };
+  }
+  if (entry.decision) {
+    // Clean up after reading a decided response
+    pendingRequests.delete(requestId);
+    return { decision: entry.decision, status: 'decided' };
+  }
+  return { status: 'pending' };
+}
+
+export function setDecision(requestId: string, decision: 'allow' | 'deny'): boolean {
+  const entry = pendingRequests.get(requestId);
+  if (!entry) {
+    return false;
+  }
+  entry.decision = decision;
+  entry.decidedAt = Date.now();
+  return true;
+}

package/src/lib/modules/server/apn/types.ts

@@ -0,0 +1,51 @@
+import type {
+  Error as APNsError,
+  ErrorData,
+  LibraryFailedItem,
+  LibrarySentItem,
+  RawResponse,
+  SentDetail,
+} from '$generated/types';
+
+// Types not yet generated by type-crafter (contain $ref/arrays/oneOf)
+// TODO: Remove these once type-crafter generates them
+
+export interface LibraryResult {
+  failed: LibraryFailedItem[] | null;
+  sent: LibrarySentItem[] | null;
+}
+
+export interface NotificationPayload {
+  badge: null | number;
+  body: null | string;
+  category?: null | string;
+  data: null | Record<string, unknown>;
+  message: null | string;
+  sound: null | string;
+  title: string;
+}
+
+export interface NotificationResult {
+  apnsId: null | string;
+  details: null | SentDetail[];
+  error: ErrorData | null | string;
+  errorData: ErrorData | null;
+  errors: APNsError[] | null;
+  failed: number;
+  headers: null | Record<string, unknown>;
+  response: null | RawResponse;
+  responseBody: null | string;
+  sent: number;
+  status: null | number;
+  statusCode: null | number;
+  success: boolean;
+}
+
+export type {
+  APNsError as Error,
+  ErrorData,
+  LibraryFailedItem,
+  LibrarySentItem,
+  RawResponse,
+  SentDetail,
+};

package/src/lib/modules/server/auth.ts

@@ -0,0 +1,34 @@
+import { env } from '$env/dynamic/private';
+import { timingSafeEqual } from 'crypto';
+
+/**
+ * Validate Bearer token authentication against the API_KEY environment variable.
+ * Returns a 401 Response if auth fails, or null if auth passed.
+ */
+export function validateAuth(request: Request): null | Response {
+  const auth = request.headers.get('Authorization') || request.headers.get('authorization');
+  if (!auth?.startsWith('Bearer ')) {
+    return new Response(JSON.stringify({ error: 'Missing authorization' }), {
+      headers: { 'Content-Type': 'application/json' },
+      status: 401,
+    });
+  }
+  const token = auth.slice(7);
+  const expectedKey = env.API_KEY?.trim();
+  if (!expectedKey) {
+    return new Response(JSON.stringify({ error: 'Invalid API key' }), {
+      headers: { 'Content-Type': 'application/json' },
+      status: 401,
+    });
+  }
+  // Timing-safe comparison to prevent timing attacks on the API key.
+  const tokenBuf = Buffer.from(token);
+  const expectedBuf = Buffer.from(expectedKey);
+  if (tokenBuf.length !== expectedBuf.length || !timingSafeEqual(tokenBuf, expectedBuf)) {
+    return new Response(JSON.stringify({ error: 'Invalid API key' }), {
+      headers: { 'Content-Type': 'application/json' },
+      status: 401,
+    });
+  }
+  return null; // auth passed
+}