@openchambery/web 1.18.7-beta.2 → 1.18.7-beta.3

package/server/lib/opencode/routes.test.js

@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 import express from 'express';
 import request from 'supertest';
 import fs from 'fs';
@@ -125,3 +125,80 @@ describe('behavior AGENTS.md route', () => {
     readFile.mockRestore();
   });
 });
+
+describe('opencode upgrade route', () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  const jsonResponse = (body, status = 200, statusText = '') =>
+    new Response(JSON.stringify(body), {
+      status,
+      statusText,
+      headers: { 'Content-Type': 'application/json' },
+    });
+
+  const createUpgradeApp = () => {
+    const app = express();
+    app.use(express.json());
+    const deps = createDependencies({ formatSettingsResponse: vi.fn(() => ({})) });
+    deps.getOpenCodeResolutionSnapshot.mockResolvedValue({ source: 'path' });
+    deps.buildOpenCodeUrl.mockImplementation((pathname) => `http://opencode.test${pathname}`);
+    deps.refreshOpenCodeAfterConfigChange.mockResolvedValue(undefined);
+    registerOpenCodeRoutes(app, deps);
+    return { app, deps };
+  };
+
+  it('forwards an explicit target to OpenCode /global/upgrade', async () => {
+    const fetchMock = vi.fn(async (url, init) => {
+      expect(String(url)).toBe('http://opencode.test/global/upgrade');
+      expect(JSON.parse(init.body)).toEqual({ target: '1.18.26' });
+      return jsonResponse({ success: true, version: '1.18.26' });
+    });
+    globalThis.fetch = fetchMock;
+    const { app } = createUpgradeApp();
+
+    const response = await request(app)
+      .post('/api/opencode/upgrade')
+      .send({ target: 'v1.18.26' })
+      .expect(200);
+
+    expect(response.body).toEqual({ success: true, version: '1.18.26', restarted: true });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('rejects an omitted target without calling OpenCode', async () => {
+    const fetchMock = vi.fn();
+    globalThis.fetch = fetchMock;
+    const { app } = createUpgradeApp();
+
+    const response = await request(app).post('/api/opencode/upgrade').send({}).expect(400);
+
+    expect(response.body).toEqual({
+      success: false,
+      error: 'OpenCode upgrade requires a semantic version target',
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('surfaces OpenCode schema BadRequest messages instead of statusText', async () => {
+    const fetchMock = vi.fn(async () =>
+      jsonResponse(
+        { name: 'BadRequest', data: { message: 'Expected a semantic version', kind: 'Missing' } },
+        400,
+        'Bad Request',
+      ),
+    );
+    globalThis.fetch = fetchMock;
+    const { app } = createUpgradeApp();
+
+    const response = await request(app)
+      .post('/api/opencode/upgrade')
+      .send({ target: 'latest' })
+      .expect(400);
+
+    expect(response.body).toEqual({ success: false, error: 'Expected a semantic version' });
+  });
+});

package/server/lib/relay/DOCUMENTATION.md

@@ -19,9 +19,9 @@ Traffic is modeled as three stacked layers. The relay understands only Layer 1;
 ## Entrypoints and structure
 
 Host side (`packages/web/server/lib/relay/`):
-- `service.js` — thin entrypoint: relay config (enabled flag + relay URL), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. Host lifecycle is gated by `isRelayHostRuntime()` (`desktop` or `ssh-remote`): other runtimes (`bun run dev`, `dev:web:hmr`, ordinary CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` unless it is already `ssh-remote`, so a leftover desktop env cannot open the host-control socket. On host runtimes, started from `packages/web/server/index.js` when demand/opt-in enables the relay. Desktop auto-clears `privateRelay.enabled` when demand drops; `ssh-remote` keeps an explicit opt-in (e.g. `openchamber serve --relay-host`) sticky until disabled. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session or the local `desktop-local` shell client; `/relay/enable` follows its API auth gate.
+- `service.js` — thin entrypoint: relay config (enabled flag + relay URL), the management routes (`GET/POST /api/openchamber/relay/{status,enable,disable}`), a `getPairingCandidate()` accessor (the relay transport candidate folded into pairing-v2 links when enabled, consumed by the pairing-session route in `core-routes.js`), and lifecycle wiring. Host lifecycle is gated by `isRelayHostRuntime()` (`desktop` or `ssh-remote`): other runtimes (`bun run dev`, `dev:web:hmr`, ordinary CLI `serve`, VS Code, plain `node server`) report `state: 'unavailable'`, refuse `/relay/enable`, `/relay/disable`, and relay pairing with 403, never mint a relay identity, never advertise `relayAvailable`, and never call `startRelayHost`. Direct `node server/index.js` forces `OPENCHAMBER_RUNTIME=web` unless it is already `ssh-remote`, so a leftover desktop env cannot open the host-control socket. On host runtimes, started from `packages/web/server/index.js` when demand/opt-in enables the relay. Desktop auto-clears `privateRelay.enabled` when demand drops; `ssh-remote` keeps an explicit opt-in (e.g. `openchamber serve --relay-host`) sticky until disabled. The relay endpoint defaults to the OpenChamber-hosted relay but can be pinned to a self-hosted relay via the `OPENCHAMBER_RELAY_URL` env var; when set it overrides the stored setting for the host connection, the pairing candidate, and status, so paired clients inherit the endpoint automatically. Endpoint identity is scheme/host/path only: accepted schemes are `ws://` and `wss://`; URLs with userinfo are rejected (no silent default fallback); query and fragment are stripped before persistence and pairing candidates. Custom endpoint persistence and Host control-connection switching are explicit authenticated management actions. Pairing creation with `relayUrl` requires an owner UI session or the local `desktop-local` shell client; `/relay/enable` follows its API auth gate. `derivePushSendUrlFromRelayUrl` maps a canonical Relay `wss://`/`ws://` URL to the same host's `https://`/`http://` `/v1/push/send` path (register is `/v1/push/register-token`); `OPENCHAMBER_PUSH_RELAY_URL` on the Host overrides that derivation. The isolated Push process lives in `packages/relay-server/src/push/` and does not share Layer 1 credentials or tunnel state.
 - `identity.js` — the host's stable identity: the long-lived signing keypair (shared with the push relay, defines the routing id) plus a long-lived encryption keypair (the E2EE trust anchor). Reused across restarts; never rotated implicitly.
-- `signing-key.js` — storage/derivation of the signing keypair and the routing id, shared with the notifications runtime.
+- `signing-key.js` — storage/derivation of the signing keypair and the routing id, shared with the notifications runtime. Canonical public JWK hashing matches `packages/relay-server/src/push/crypto.js`.
 - `host-client.js` — the long-lived connection manager: one outbound control connection to the relay, a per-client data connection for each connected device, reconnect/backoff, and the E2EE responder handshake per connection.
 - `host-lock.js` — the per-machine host claim. Every local instance sharing the data dir shares the relay identity (same serverId), so concurrent relay hosts evict each other at the relay worker (`4001: Control replaced`) and paired devices land on whichever local process won last. The claim file (`<data-dir>/relay-host.lock`, `{ pid }`) makes this deterministic: `service.js` only starts the host when no LIVE process holds the claim (stale claims from dead pids are ignored), goes to `standby` otherwise, and a 30s watcher both takes over when the claimant dies and stands down when another process claims. Explicit user intent — creating a pairing link or hitting `/relay/enable` — force-claims; the previous holder's watcher sees the takeover and backs off instead of fighting. The claim is cooperative (the relay worker still enforces the single host slot); it only decides which process keeps retrying.
 - `tunnel-host.js` — the per-connection dispatcher: decrypts tunnel frames and forwards HTTP/SSE/WS to the local server over loopback, then streams responses back. Enforces a path allowlist and never injects credentials.

package/server/lib/relay/service.js

@@ -54,6 +54,25 @@ export const canonicalizeRelayUrl = (value) => {
   }
 };
 
+// Canonical ws(s) relay URL → Push send endpoint on the same host/port.
+// Always `/v1/push/send`; never derived from window/location.
+export const derivePushSendUrlFromRelayUrl = (value) => {
+  const canonical = canonicalizeRelayUrl(value);
+  if (!canonical) return null;
+  try {
+    const url = new URL(canonical);
+    url.protocol = url.protocol === 'wss:' ? 'https:' : 'http:';
+    url.pathname = '/v1/push/send';
+    url.username = '';
+    url.password = '';
+    url.hash = '';
+    url.search = '';
+    return url.toString();
+  } catch {
+    return null;
+  }
+};
+
 const normalizeRelayUrl = (value) => {
   if (typeof value !== 'string') return DEFAULT_RELAY_URL;
   return canonicalizeRelayUrl(value) ?? DEFAULT_RELAY_URL;
@@ -63,12 +82,16 @@ const normalizeRelayUrl = (value) => {
 // your own Cloudflare account/domain). When set and valid it overrides the
 // stored setting entirely, so the host connection, the pairing offer, and the
 // status all point at it — clients then inherit it from the offer automatically.
-const envRelayUrlOverride = () => {
-  const raw = process.env.OPENCHAMBER_RELAY_URL;
+const envRelayUrlOverride = (env = process.env) => {
+  const raw = env?.OPENCHAMBER_RELAY_URL;
   if (typeof raw !== 'string' || !raw.trim()) return null;
   return canonicalizeRelayUrl(raw);
 };
 
+// Env (`OPENCHAMBER_RELAY_URL`) → settings.privateRelay.relayUrl → DEFAULT_RELAY_URL.
+export const resolveEffectiveRelayUrl = ({ settings = null, env = process.env } = {}) =>
+  envRelayUrlOverride(env) ?? normalizeRelayUrl(settings?.privateRelay?.relayUrl);
+
 /**
  * @param {{
  *   crypto: typeof import('node:crypto'),
@@ -77,6 +100,7 @@ const envRelayUrlOverride = () => {
  *   getLocalPort: () => number,
  *   logger?: Pick<Console, 'warn'>,
  *   canHostRelay?: () => boolean,
+ *   onRelayUrlChanged?: () => Promise<void> | void,
  * }} deps
  */
 export const createRelayService = ({
@@ -98,6 +122,7 @@ export const createRelayService = ({
   // Host gate: false for non-host runtimes (dev server, ordinary CLI, VS Code, …).
   canHostRelay = () => isRelayHostRuntime(),
   logger = console,
+  onRelayUrlChanged = null,
 }) => {
   const identityRuntime = createRelayIdentityRuntime({ crypto, readSettingsFromDiskMigrated, writeSettingsToDisk, readSettingsStrict });
 
@@ -131,13 +156,22 @@ export const createRelayService = ({
     const override = envRelayUrlOverride();
     return {
       enabled: stored?.enabled === true,
-      relayUrl: override ?? normalizeRelayUrl(stored?.relayUrl),
+      relayUrl: resolveEffectiveRelayUrl({ settings }),
       // True when the endpoint is pinned by OPENCHAMBER_RELAY_URL (a self-hosted
       // relay); the stored setting is ignored while it is set.
       relayUrlLocked: override !== null,
     };
   };
 
+  const notifyRelayUrlChanged = async () => {
+    if (typeof onRelayUrlChanged !== 'function') return;
+    try {
+      await onRelayUrlChanged();
+    } catch (error) {
+      logger.warn(`[Relay] push token re-register failed: ${error?.message ?? error}`);
+    }
+  };
+
   const writeConfig = async (config) => {
     const settings = await readSettingsFromDiskMigrated();
     await writeSettingsToDisk({
@@ -365,6 +399,10 @@ export const createRelayService = ({
     if (!config.enabled || endpointChanged) {
       await writeConfig({ enabled: true, relayUrl });
     }
+    const next = await readConfig();
+    if (next.relayUrl !== config.relayUrl) {
+      await notifyRelayUrlChanged();
+    }
     if (endpointChanged) {
       // One Host identity can have only one live Relay control connection. A
       // custom endpoint therefore becomes the authoritative transport before
@@ -409,6 +447,10 @@ export const createRelayService = ({
           relayUrl = canonical;
         }
         await writeConfig({ enabled: true, relayUrl });
+        const next = await readConfig();
+        if (next.relayUrl !== current.relayUrl) {
+          await notifyRelayUrlChanged();
+        }
         if (hostClient) stop();
         // Explicit user action: take the machine's host claim like pairing does.
         await start(relayUrl, { claim: 'force' });

package/server/lib/relay/service.test.js

@@ -34,8 +34,10 @@ vi.mock('./host-client.js', () => ({
 import {
   createRelayService,
   DEFAULT_RELAY_URL,
+  derivePushSendUrlFromRelayUrl,
   isRelayHostRuntime,
   RELAY_HOST_DESKTOP_ONLY_MESSAGE,
+  resolveEffectiveRelayUrl,
 } from './service.js';
 
 const createSettingsHarness = () => {
@@ -60,6 +62,59 @@ const createTestRelayService = ({ canHostRelay = true, ...overrides } = {}) => {
   return { service, settings };
 };
 
+describe('derivePushSendUrlFromRelayUrl', () => {
+  it('converts wss and ws canonical relay URLs to the fixed push send path', () => {
+    expect(derivePushSendUrlFromRelayUrl('wss://relay.openchamber.dev/ws')).toBe(
+      'https://relay.openchamber.dev/v1/push/send',
+    );
+    expect(derivePushSendUrlFromRelayUrl('ws://127.0.0.1:8787/custom')).toBe(
+      'http://127.0.0.1:8787/v1/push/send',
+    );
+    expect(derivePushSendUrlFromRelayUrl('wss://relay.example:8443/any/path?token=secret#frag')).toBe(
+      'https://relay.example:8443/v1/push/send',
+    );
+  });
+
+  it('rejects userinfo and non-ws(s) URLs', () => {
+    expect(derivePushSendUrlFromRelayUrl('wss://user:pass@relay.example/ws')).toBeNull();
+    expect(derivePushSendUrlFromRelayUrl('https://relay.openchamber.dev/ws')).toBeNull();
+    expect(derivePushSendUrlFromRelayUrl('http://relay.example/v1/push/send')).toBeNull();
+    expect(derivePushSendUrlFromRelayUrl('')).toBeNull();
+    expect(derivePushSendUrlFromRelayUrl(null)).toBeNull();
+  });
+});
+
+describe('resolveEffectiveRelayUrl', () => {
+  afterEach(() => {
+    delete process.env.OPENCHAMBER_RELAY_URL;
+  });
+
+  it('prefers a valid env URL, then settings, then the default', () => {
+    expect(resolveEffectiveRelayUrl()).toBe(DEFAULT_RELAY_URL);
+    expect(
+      resolveEffectiveRelayUrl({
+        settings: { privateRelay: { relayUrl: 'wss://settings.example/ws' } },
+      }),
+    ).toBe('wss://settings.example/ws');
+
+    process.env.OPENCHAMBER_RELAY_URL = 'wss://env.example/ws?x=1#frag';
+    expect(
+      resolveEffectiveRelayUrl({
+        settings: { privateRelay: { relayUrl: 'wss://settings.example/ws' } },
+      }),
+    ).toBe('wss://env.example/ws');
+  });
+
+  it('ignores an invalid env URL and falls through to settings', () => {
+    process.env.OPENCHAMBER_RELAY_URL = 'https://not-a-relay.example/ws';
+    expect(
+      resolveEffectiveRelayUrl({
+        settings: { privateRelay: { relayUrl: 'wss://settings.example/ws' } },
+      }),
+    ).toBe('wss://settings.example/ws');
+  });
+});
+
 describe('relay service pairing endpoint', () => {
   afterEach(() => {
     relayMocks.starts.length = 0;
@@ -142,6 +197,68 @@ describe('relay service pairing endpoint', () => {
     });
     expect(relayMocks.starts).toEqual(['wss://relay.example/custom']);
   });
+
+  it('invokes onRelayUrlChanged only when the canonical URL actually changes', async () => {
+    const onRelayUrlChanged = vi.fn(async () => {});
+    const { service } = createTestRelayService({ onRelayUrlChanged });
+
+    await service.ensureEnabledForPairing();
+    expect(onRelayUrlChanged).not.toHaveBeenCalled();
+
+    await service.ensureEnabledForPairing('wss://relay.example/custom');
+    expect(onRelayUrlChanged).toHaveBeenCalledTimes(1);
+
+    await service.ensureEnabledForPairing('wss://relay.example/custom?x=1#frag');
+    expect(onRelayUrlChanged).toHaveBeenCalledTimes(1);
+
+    const app = express();
+    service.registerRoutes(app);
+    await request(app)
+      .post('/api/openchamber/relay/enable')
+      .send({ relayUrl: 'wss://relay.example/other' })
+      .expect(200);
+    expect(onRelayUrlChanged).toHaveBeenCalledTimes(2);
+
+    await request(app)
+      .post('/api/openchamber/relay/enable')
+      .send({ relayUrl: 'wss://relay.example/other' })
+      .expect(200);
+    expect(onRelayUrlChanged).toHaveBeenCalledTimes(2);
+  });
+
+  it('does not invoke onRelayUrlChanged for an env-pinned relay and still uses the pin', async () => {
+    process.env.OPENCHAMBER_RELAY_URL = 'wss://pinned.example/ws';
+    const onRelayUrlChanged = vi.fn(async () => {});
+    const { service } = createTestRelayService({ onRelayUrlChanged });
+    const app = express();
+    service.registerRoutes(app);
+
+    const candidate = await service.ensureEnabledForPairing('wss://ignored.example/ws');
+    expect(candidate.relayUrl).toBe('wss://pinned.example/ws');
+    expect(onRelayUrlChanged).not.toHaveBeenCalled();
+
+    await request(app)
+      .post('/api/openchamber/relay/enable')
+      .send({ relayUrl: 'wss://ignored.example/ws' })
+      .expect(200);
+    expect(onRelayUrlChanged).not.toHaveBeenCalled();
+    expect((await service.getStatus()).relayUrl).toBe('wss://pinned.example/ws');
+  });
+
+  it('continues the relay switch when onRelayUrlChanged fails', async () => {
+    const onRelayUrlChanged = vi.fn(async () => {
+      throw new Error('push relay unavailable');
+    });
+    const logger = { warn: vi.fn() };
+    const { service } = createTestRelayService({ onRelayUrlChanged, logger });
+
+    await expect(service.ensureEnabledForPairing('wss://relay.example/custom')).resolves.toMatchObject({
+      relayUrl: 'wss://relay.example/custom',
+    });
+    expect(onRelayUrlChanged).toHaveBeenCalledTimes(1);
+    expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('push token re-register failed'));
+    expect(relayMocks.starts).toEqual(['wss://relay.example/custom']);
+  });
 });
 
 describe('relay host runtime gate', () => {

package/server/lib/relay/signing-key.js

@@ -49,7 +49,7 @@ export const getOrCreateRelaySigningKeypair = async ({ crypto, readSettingsFromD
 };
 
 // Fixed key order so the hash is stable regardless of stored JSON field order.
-// Byte-for-byte mirror of canonicalJwk in openchamber-website apps/api relay-auth.ts.
+// Byte-for-byte mirror of canonicalPublicJwkString in packages/relay-server/src/push/crypto.js.
 /** @param {JsonWebKey} jwk */
 export const canonicalPublicJwkString = (jwk) =>
   JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });

package/server/lib/scheduled-tasks/DOCUMENTATION.md

@@ -65,6 +65,7 @@ Server-owned scheduled task runtime and routes for OpenChamber-only automation.
   - `syncAllProjects()`
   - `syncProject(projectId)`
   - `runNow(projectId, taskId)`
+  - `observeSessionEvent(event)`
 
 Dependencies include optional `runHistoryStore` with:
 
@@ -212,11 +213,35 @@ Every actual run (timer or manual):
     row so the session stays openable from history. Task state persistence
     failures also finalize history as `error`. A failed history finalize
     returns error and may leave a `running` row for next-start convergence.
- 11. `lastSessionId` remains success-only on the task state; full association
-     lives in the history table.
+  11. `lastSessionId` is written on the task state whenever the run has a
+     session (success or error). If the run has no session, omit
+     `lastSessionId` from the patch so a previous value is preserved. Full
+     association still lives in the history table; history rows are not
+     rewritten after finalize.
 
 SSE events keep the existing `openchamber:scheduled-task-ran` shape.
 
+## Post-run continuation
+
+After a run has finalized with a session, the user may continue chatting in
+that same history session. `observeSessionEvent` corrects **only task state**
+(history rows are not rewritten, `finishRun` is not called again):
+
+- `session.status` busy/retry while `lastStatus` is `error` or `success` →
+  `lastStatus` `running`, clear `lastError`, keep/set `lastSessionId`
+- later `session.idle` (or idle `session.status`) with a success snapshot →
+  `lastStatus` `success`
+- do not change `lastRunAt` / `lastDurationMs` / `nextRunAt`
+
+A live run (`runningTaskKeys`) owns settlement; the observer is a no-op while
+the task is in `runningTaskKeys`. Idle correction is a no-op if `lastStatus`
+is already `success`, or if the snapshot is still error/busy/unknown. Observer
+failures are logged and must not throw out of the event bus.
+
+Run start also emits `scheduled-task-ran` with `status: running` as soon as
+task state is persisted, so the outer task list can show in-progress before
+the session is attached.
+
 ## Watchdog cancel / upstream abort
 
 - Timeout path: abort the per-run signal → cancel in-flight cancellable