@juspay/shooter 1.5.0 → 1.6.1

package/src/routes/api/neurolink-proxy/+server.ts

@@ -0,0 +1,136 @@
+// Server-side proxy for AI providers that block direct browser requests (CORS).
+// The browser NeuroLink bundle POSTs here; this endpoint forwards to the real API.
+// Currently supports: anthropic (api.anthropic.com blocks browser fetch).
+
+import { env } from '$env/dynamic/private';
+import { validateAuth } from '$lib/modules/server/auth';
+import { json } from '@sveltejs/kit';
+
+import type { RequestHandler } from './$types';
+
+// Per-provider allowlist of client-supplied headers that may be forwarded
+// upstream. Everything else (including host, x-forwarded-*, content-type) is
+// dropped so the browser can't influence provider behavior beyond what we
+// explicitly permit.
+const ALLOWED_CLIENT_HEADERS: Record<string, Set<string>> = {
+  anthropic: new Set(['anthropic-beta', 'anthropic-version']),
+  'google-ai': new Set<string>([]),
+  mistral: new Set([]),
+  openai: new Set(['openai-organization', 'openai-project']),
+};
+
+export const POST: RequestHandler = async ({ request }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
+  }
+
+  let payload: unknown;
+  try {
+    payload = await request.json();
+  } catch {
+    return json({ error: 'Invalid JSON body' }, { status: 400 });
+  }
+
+  if (
+    !payload ||
+    typeof payload !== 'object' ||
+    typeof (payload as { provider?: unknown }).provider !== 'string' ||
+    typeof (payload as { url?: unknown }).url !== 'string' ||
+    !(payload as { headers?: unknown }).headers ||
+    typeof (payload as { headers?: unknown }).headers !== 'object'
+  ) {
+    return json({ error: 'Invalid proxy payload' }, { status: 400 });
+  }
+
+  const {
+    body,
+    headers: reqHeaders,
+    provider,
+    url,
+  } = payload as {
+    body: unknown;
+    headers: Record<string, string>;
+    provider: string;
+    url: string;
+  };
+
+  // Only proxy known safe providers — never forward arbitrary URLs
+  const ALLOWED_PREFIXES: Record<string, string> = {
+    anthropic: 'https://api.anthropic.com/',
+    'google-ai': 'https://generativelanguage.googleapis.com/',
+    mistral: 'https://api.mistral.ai/',
+    openai: 'https://api.openai.com/',
+  };
+
+  const allowedPrefix = ALLOWED_PREFIXES[provider];
+  if (!allowedPrefix || !url.startsWith(allowedPrefix)) {
+    return json({ error: `Provider "${provider}" or URL not allowed` }, { status: 403 });
+  }
+
+  // Inject the server-side API key so the browser never sees it
+  const apiKeyEnv: Record<string, string> = {
+    anthropic: env.ANTHROPIC_API_KEY ?? '',
+    'google-ai': env.GOOGLE_AI_API_KEY ?? '',
+    mistral: env.MISTRAL_API_KEY ?? '',
+    openai: env.OPENAI_API_KEY ?? '',
+  };
+
+  // Copy only explicitly-allowed headers per provider. Everything else is
+  // dropped so the browser can't influence upstream behavior via host,
+  // x-forwarded-*, organization selectors, provider feature toggles, etc.
+  const allowedForProvider = ALLOWED_CLIENT_HEADERS[provider] ?? new Set<string>();
+  const normalizedReqHeaders: Record<string, string> = {};
+  for (const [k, v] of Object.entries(reqHeaders)) {
+    const key = k.toLowerCase();
+    if (allowedForProvider.has(key)) {
+      normalizedReqHeaders[key] = v;
+    }
+  }
+
+  const forwardHeaders: Record<string, string> = {
+    'Content-Type': 'application/json',
+    ...normalizedReqHeaders,
+  };
+
+  // Override / set auth header with server-side key
+  if (provider === 'anthropic') {
+    forwardHeaders['x-api-key'] = apiKeyEnv.anthropic;
+    forwardHeaders['anthropic-version'] = forwardHeaders['anthropic-version'] ?? '2023-06-01';
+  } else if (provider === 'google-ai') {
+    forwardHeaders['x-goog-api-key'] = apiKeyEnv['google-ai'];
+  } else if (provider === 'openai') {
+    forwardHeaders.Authorization = `Bearer ${apiKeyEnv.openai}`;
+  } else if (provider === 'mistral') {
+    forwardHeaders.Authorization = `Bearer ${apiKeyEnv.mistral}`;
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => {
+    controller.abort();
+  }, 30_000);
+
+  let resp: Response;
+  try {
+    resp = await fetch(url, {
+      body: JSON.stringify(body),
+      headers: forwardHeaders,
+      method: 'POST',
+      signal: controller.signal,
+    });
+  } catch (err) {
+    clearTimeout(timeout);
+    const message = err instanceof Error ? err.message : 'Upstream request failed';
+    return json({ error: message }, { status: 502 });
+  }
+  clearTimeout(timeout);
+
+  let data: unknown;
+  try {
+    data = await resp.json();
+  } catch {
+    return json({ error: 'Upstream returned non-JSON response' }, { status: 502 });
+  }
+
+  return json(data, { status: resp.status });
+};

package/src/routes/api/notify/+server.ts

@@ -1,4 +1,4 @@
-import type { NotificationData } from '$generated/types';
+import type { NotificationData } from '$lib/types';
 
 import { env } from '$env/dynamic/private';
 import { LibraryAPNsService } from '$lib/modules/server/apn/library-apns';
@@ -7,10 +7,33 @@ import { createPendingRequest } from '$lib/modules/server/apn/pending-requests';
 import { validateAuth } from '$lib/modules/server/auth';
 import { isFCMConfigured, sendFCMNotification } from '$lib/modules/server/fcm/fcm-service.js';
 import { toErrorMessage } from '$lib/modules/server/utils/error';
+import { broadcastEvent } from '$lib/modules/server/ws/server';
 import { json } from '@sveltejs/kit';
+import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
 
 import type { RequestHandler } from './$types';
 
+// Reads tokens persisted by /api/device-token — populated automatically when
+// the Android or iOS app registers on first launch.
+function readPersistedDeviceToken(platform: 'android' | 'ios'): string | undefined {
+  const tokensFile = join(homedir(), '.shooter', 'device-tokens.json');
+  if (!existsSync(tokensFile)) {
+    return undefined;
+  }
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(tokensFile, 'utf-8'));
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      const value = (parsed as Record<string, unknown>)[platform];
+      return typeof value === 'string' && value ? value : undefined;
+    }
+  } catch {
+    // corrupt / unreadable — fall through
+  }
+  return undefined;
+}
+
 // Singleton APNs client - reuses HTTP/2 connection across requests
 let apnsSingleton: LibraryAPNsService | null = null;
 function getAPNsClient(): LibraryAPNsService {
@@ -24,15 +47,118 @@ function getAPNsClient(): LibraryAPNsService {
 const notificationCache = new Map<string, number>();
 const DEDUP_WINDOW = 10000; // 10 seconds deduplication window
 
+function broadcastHookEvent(body: Record<string, unknown>): void {
+  const data = (body.data ?? {}) as Record<string, unknown>;
+  const eventType =
+    typeof data.eventType === 'string'
+      ? data.eventType
+      : typeof body.eventType === 'string'
+        ? body.eventType
+        : '';
+  const tool = typeof data.tool === 'string' ? data.tool : '';
+  const terminalId = typeof data.terminalId === 'string' ? data.terminalId : undefined;
+  const sessionId = typeof data.sessionId === 'string' ? data.sessionId : undefined;
+
+  switch (eventType) {
+    case 'error':
+      broadcastEvent({
+        error:
+          typeof data.error === 'string'
+            ? data.error
+            : typeof data.message === 'string'
+              ? data.message
+              : 'Unknown error',
+        terminalId,
+        tool,
+        type: 'tool-failed',
+      });
+      break;
+    case 'idle_input':
+    case 'session.idle':
+      broadcastEvent({
+        message: typeof data.message === 'string' ? data.message : '',
+        sessionId,
+        terminalId,
+        type: 'agent-idle',
+      });
+      break;
+    case 'permission':
+    case 'permission_notification':
+      if (data.requestId && data.toolName) {
+        broadcastEvent({
+          input:
+            typeof data.toolInput === 'object' && data.toolInput !== null
+              ? (data.toolInput as Record<string, unknown>)
+              : {},
+          requestId: data.requestId as string,
+          tool: data.toolName as string,
+          type: 'permission-requested',
+        });
+      }
+      break;
+    case 'question':
+      broadcastEvent({
+        message: typeof data.message === 'string' ? data.message : '',
+        sessionId,
+        terminalId,
+        type: 'agent-question',
+      });
+      break;
+    case 'tool.after':
+      broadcastEvent({ success: true, terminalId, tool, type: 'tool-completed' });
+      break;
+    case 'tool.before':
+      broadcastEvent({
+        command: typeof data.command === 'string' ? data.command : '',
+        filePath:
+          typeof data.filePath === 'string'
+            ? data.filePath
+            : typeof data.files === 'string'
+              ? data.files
+              : '',
+        terminalId,
+        tool,
+        type: 'tool-started',
+      });
+      break;
+    // session.status, intervention — skip or use existing types
+  }
+}
+
+/** Build a notification history record from common fields. */
+function buildNotificationRecord(
+  id: string,
+  title: string,
+  message: string,
+  status: 'failed' | 'filtered' | 'sent' | 'skipped',
+  data?: NotificationData,
+  error?: null | string
+): Parameters<typeof addNotification>[0] {
+  return {
+    category: data?.category ?? null,
+    data: (data as Record<string, unknown>) ?? null,
+    error: error ?? null,
+    id,
+    message,
+    project: data?.project ?? null,
+    source: data?.source ?? null,
+    status,
+    timestamp: new Date().toISOString(),
+    title,
+    tool: data?.tool ?? null,
+  };
+}
+
 function intelligentNotificationFilter(
   title: string,
   message: string,
-  data?: NotificationData
+  data?: NotificationData,
+  waitForResponse = false
 ): { reason: string; send: boolean } {
   const source = data?.source || 'unknown';
 
   // Check for duplicate notifications first
-  if (isDuplicateNotification(title, message, data)) {
+  if (isDuplicateNotification(title, message, data, waitForResponse)) {
     return {
       reason: 'Duplicate notification within 10-second window',
       send: false,
@@ -100,12 +226,23 @@ function intelligentNotificationFilter(
   };
 }
 
-function isDuplicateNotification(title: string, message: string, data?: NotificationData): boolean {
+function isDuplicateNotification(
+  title: string,
+  message: string,
+  data?: NotificationData,
+  waitForResponse = false
+): boolean {
+  // Never deduplicate bidirectional permission requests — each one creates a
+  // unique pending request that the hook polls by requestId.
+  if (waitForResponse) {
+    return false;
+  }
+
   const key = `${title}|${message}|${data?.category || 'unknown'}`;
   const now = Date.now();
 
   if (notificationCache.has(key)) {
-    const lastSent = notificationCache.get(key)!;
+    const lastSent = notificationCache.get(key) ?? 0;
     if (now - lastSent < DEDUP_WINDOW) {
       return true; // Duplicate within time window
     }
@@ -159,6 +296,13 @@ export const POST: RequestHandler = async ({ request }) => {
     const waitForResponse =
       typeof body.waitForResponse === 'boolean' ? body.waitForResponse : false;
 
+    // Broadcast to /ws/events for real-time activity feed
+    try {
+      broadcastHookEvent(body);
+    } catch {
+      // Best-effort broadcast — don't fail the notify request
+    }
+
     if (!title || typeof title !== 'string' || !message || typeof message !== 'string') {
       return json({ error: 'Title and message are required and must be strings' }, { status: 400 });
     }
@@ -171,22 +315,24 @@ export const POST: RequestHandler = async ({ request }) => {
     const requestId = Math.random().toString(36).substring(2, 15);
     const dataRequestId = typeof data?.requestId === 'string' ? data.requestId : undefined;
     const canonicalRequestId = dataRequestId || requestId;
-    const shouldSendNotification = intelligentNotificationFilter(title, message, data);
+    const shouldSendNotification = intelligentNotificationFilter(
+      title,
+      message,
+      data,
+      waitForResponse
+    );
 
     if (!shouldSendNotification.send) {
-      addNotification({
-        category: data?.category ?? null,
-        data: (data as Record<string, unknown>) ?? null,
-        error: shouldSendNotification.reason,
-        id: canonicalRequestId,
-        message,
-        project: data?.project ?? null,
-        source: data?.source ?? null,
-        status: 'filtered',
-        timestamp: new Date().toISOString(),
-        title,
-        tool: data?.tool ?? null,
-      });
+      addNotification(
+        buildNotificationRecord(
+          canonicalRequestId,
+          title,
+          message,
+          'filtered',
+          data,
+          shouldSendNotification.reason
+        )
+      );
 
       return json({
         message: 'Notification filtered (not sent)',
@@ -209,19 +355,7 @@ export const POST: RequestHandler = async ({ request }) => {
         });
       }
 
-      addNotification({
-        category: data?.category ?? null,
-        data: (data as Record<string, unknown>) ?? null,
-        error: null,
-        id: canonicalRequestId,
-        message,
-        project: data?.project ?? null,
-        source: data?.source ?? null,
-        status: 'skipped',
-        timestamp: new Date().toISOString(),
-        title,
-        tool: data?.tool ?? null,
-      });
+      addNotification(buildNotificationRecord(canonicalRequestId, title, message, 'skipped', data));
 
       return json({
         message: 'Push skipped (WebSocket clients connected)',
@@ -264,15 +398,21 @@ export const POST: RequestHandler = async ({ request }) => {
         );
       }
 
-      // Honor request-scoped deviceToken, falling back to environment variables.
+      // Honor request-scoped deviceToken, then the Android-specific env var,
+      // then the token auto-registered by the Android app via /api/device-token.
+      // env.DEVICE_TOKEN is intentionally NOT in this chain: the iOS branch
+      // treats it as an APNs token (see below), and letting it bleed into the
+      // FCM path would ship an APNs token to FCM in mixed-platform setups.
       const androidToken =
-        requestDeviceToken?.trim() || (env.ANDROID_DEVICE_TOKEN || env.DEVICE_TOKEN)?.trim();
+        requestDeviceToken?.trim() ||
+        env.ANDROID_DEVICE_TOKEN?.trim() ||
+        readPersistedDeviceToken('android');
 
       if (!androidToken) {
         return json(
           {
             details:
-              'ANDROID_DEVICE_TOKEN or DEVICE_TOKEN environment variable is missing and no deviceToken in request body',
+              'No Android device token available — set ANDROID_DEVICE_TOKEN, pass deviceToken in the request body, or open the Android app so it can auto-register its FCM token.',
             error: 'No device token configured',
           },
           { status: 500 }
@@ -293,19 +433,7 @@ export const POST: RequestHandler = async ({ request }) => {
           });
         }
 
-        addNotification({
-          category: data?.category ?? null,
-          data: (data as Record<string, unknown>) ?? null,
-          error: null,
-          id: canonicalRequestId,
-          message,
-          project: data?.project ?? null,
-          source: data?.source ?? null,
-          status: 'sent',
-          timestamp: new Date().toISOString(),
-          title,
-          tool: data?.tool ?? null,
-        });
+        addNotification(buildNotificationRecord(canonicalRequestId, title, message, 'sent', data));
 
         return json({
           message: 'Notification sent successfully',
@@ -317,19 +445,16 @@ export const POST: RequestHandler = async ({ request }) => {
       } else {
         console.error(`[notify] FCM delivery failed: ${fcmResult.error}`);
 
-        addNotification({
-          category: data?.category ?? null,
-          data: (data as Record<string, unknown>) ?? null,
-          error: fcmResult.error ?? null,
-          id: canonicalRequestId,
-          message,
-          project: data?.project ?? null,
-          source: data?.source ?? null,
-          status: 'failed',
-          timestamp: new Date().toISOString(),
-          title,
-          tool: data?.tool ?? null,
-        });
+        addNotification(
+          buildNotificationRecord(
+            canonicalRequestId,
+            title,
+            message,
+            'failed',
+            data,
+            fcmResult.error
+          )
+        );
 
         return json(
           {
@@ -384,19 +509,7 @@ export const POST: RequestHandler = async ({ request }) => {
           });
         }
 
-        addNotification({
-          category: data?.category ?? null,
-          data: (data as Record<string, unknown>) ?? null,
-          error: null,
-          id: canonicalRequestId,
-          message,
-          project: data?.project ?? null,
-          source: data?.source ?? null,
-          status: 'sent',
-          timestamp: new Date().toISOString(),
-          title,
-          tool: data?.tool ?? null,
-        });
+        addNotification(buildNotificationRecord(canonicalRequestId, title, message, 'sent', data));
 
         return json({
           message: 'Notification sent successfully',
@@ -409,19 +522,9 @@ export const POST: RequestHandler = async ({ request }) => {
         const notifErrMsg = toErrorMessage(notificationError);
         console.error(`[notify] APNs delivery failed: ${notifErrMsg}`);
 
-        addNotification({
-          category: data?.category ?? null,
-          data: (data as Record<string, unknown>) ?? null,
-          error: notifErrMsg,
-          id: canonicalRequestId,
-          message,
-          project: data?.project ?? null,
-          source: data?.source ?? null,
-          status: 'failed',
-          timestamp: new Date().toISOString(),
-          title,
-          tool: data?.tool ?? null,
-        });
+        addNotification(
+          buildNotificationRecord(canonicalRequestId, title, message, 'failed', data, notifErrMsg)
+        );
 
         return json(
           {

package/src/routes/api/sessions/+server.ts

@@ -1,4 +1,4 @@
-import type { ProjectGroup } from '$lib/modules/server/sessions/types';
+import type { ProjectGroup } from '$lib/types';
 
 import { validateAuth } from '$lib/modules/server/auth';
 import {

package/src/routes/api/sessions/connect/+server.ts

@@ -65,9 +65,11 @@ export const POST: RequestHandler = async ({ request }) => {
 
   const existing = ptyManager
     .list()
-    .find((t) => t.status === 'running' && (
-      t.sessionFile?.endsWith(`/${sessionId}.jsonl`) || t.openCodeSessionId === sessionId
-    ));
+    .find(
+      (t) =>
+        t.status === 'running' &&
+        (t.sessionFile?.endsWith(`/${sessionId}.jsonl`) || t.openCodeSessionId === sessionId)
+    );
 
   if (existing) {
     console.log(
@@ -94,8 +96,7 @@ export const POST: RequestHandler = async ({ request }) => {
 
   // --- Build args based on command ---
 
-  const args: string[] =
-    command === 'claude' ? ['--resume', sessionId] : ['--session', sessionId];
+  const args: string[] = command === 'claude' ? ['--resume', sessionId] : ['--session', sessionId];
 
   try {
     const terminal = await ptyManager.create(command, args, realCwd, 120, 40);
@@ -107,7 +108,10 @@ export const POST: RequestHandler = async ({ request }) => {
     return json(
       {
         command: terminal.command,
-        createdAt: terminal.createdAt instanceof Date ? terminal.createdAt.toISOString() : terminal.createdAt,
+        createdAt:
+          terminal.createdAt instanceof Date
+            ? terminal.createdAt.toISOString()
+            : terminal.createdAt,
         cwd: terminal.cwd,
         id: terminal.id,
         pid: terminal.pid,

package/src/routes/api/terminals/+server.ts

@@ -9,6 +9,21 @@ import type { RequestHandler } from './$types';
 
 const ALLOWED_COMMANDS = ['zsh', 'bash', 'sh', 'fish', 'claude', 'opencode'];
 
+/** Extract the last non-empty line from a scrollback string. */
+function lastScrollbackLine(scrollback: string): null | string {
+  if (!scrollback) {
+    return null;
+  }
+  const lines = scrollback.trimEnd().split('\n');
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i].trim();
+    if (line) {
+      return line.slice(0, 200);
+    }
+  }
+  return null;
+}
+
 // GET /api/terminals — List all terminals (active + recently exited)
 export const GET: RequestHandler = ({ request }) => {
   const authError = validateAuth(request);
@@ -28,6 +43,7 @@ export const GET: RequestHandler = ({ request }) => {
       exitedAt: t.exitedAt?.toISOString() ?? null,
       id: t.id,
       isActive: t.isActive,
+      lastOutput: lastScrollbackLine(t.scrollback),
       pid: t.pid,
       status: t.status,
     }));
@@ -127,7 +143,10 @@ export const POST: RequestHandler = async ({ request }) => {
     return json(
       {
         command: terminal.command,
-        createdAt: terminal.createdAt instanceof Date ? terminal.createdAt.toISOString() : terminal.createdAt,
+        createdAt:
+          terminal.createdAt instanceof Date
+            ? terminal.createdAt.toISOString()
+            : terminal.createdAt,
         cwd: terminal.cwd,
         id: terminal.id,
         pid: terminal.pid,

package/src/routes/api/terminals/[id]/+server.ts

@@ -5,6 +5,21 @@ import { json } from '@sveltejs/kit';
 
 import type { RequestHandler } from './$types';
 
+/** Extract the last non-empty line from a scrollback string. */
+function lastScrollbackLine(scrollback: string): null | string {
+  if (!scrollback) {
+    return null;
+  }
+  const lines = scrollback.trimEnd().split('\n');
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i].trim();
+    if (line) {
+      return line.slice(0, 200);
+    }
+  }
+  return null;
+}
+
 // GET /api/terminals/:id — Get terminal details by ID
 export const GET: RequestHandler = ({ params, request }) => {
   const authError = validateAuth(request);
@@ -28,8 +43,7 @@ export const GET: RequestHandler = ({ params, request }) => {
       exitCode: terminal.exitCode,
       exitedAt: terminal.exitedAt?.toISOString() ?? null,
       id: terminal.id,
-      lastOutput:
-        terminal.scrollback.length > 0 ? terminal.scrollback[terminal.scrollback.length - 1] : null,
+      lastOutput: lastScrollbackLine(terminal.scrollback),
       pid: terminal.pid,
       sessionWs: `/ws/session/${terminal.id}`,
       status: terminal.status,

package/src/routes/api/webhook/+server.ts

@@ -1,40 +1,12 @@
 import { validateAuth } from '$lib/modules/server/auth';
-import { toErrorMessage } from '$lib/modules/server/utils/error';
 import { json } from '@sveltejs/kit';
 
 import type { RequestHandler } from './$types';
 
-// TODO: Add HMAC signature validation for webhook payloads.
-// This is currently a stub endpoint — no signature verification is performed.
-export const POST: RequestHandler = async ({ request }) => {
-  try {
-    const authError = validateAuth(request);
-    if (authError) {
-      return authError;
-    }
-
-    const body = (await request.json()) as Record<string, unknown>;
-
-    console.log('Webhook received:', {
-      body,
-      timestamp: new Date().toISOString(),
-    });
-
-    // In a full implementation, this would forward to Claude Code
-    // For now, just log and acknowledge
-
-    return json({
-      message: 'Webhook received successfully',
-      success: true,
-      timestamp: new Date().toISOString(),
-    });
-  } catch (error) {
-    console.error('[webhook] Failed to process webhook:', toErrorMessage(error));
-    return json(
-      {
-        error: 'Failed to process webhook',
-      },
-      { status: 500 }
-    );
+export const POST: RequestHandler = ({ request }) => {
+  const authError = validateAuth(request);
+  if (authError) {
+    return authError;
   }
+  return json({ error: 'Webhook endpoint not implemented' }, { status: 501 });
 };