@slack/radar-mcp 1.5.0 → 1.7.0

package/dist/web/server.js

@@ -5,11 +5,11 @@ import path from "path";
 import { spawn } from "child_process";
 import { fileURLToPath } from "url";
 import { AndroidTransport, resolveAdbPath } from "../shared/android.js";
-import { RADAR_HOST, RADAR_PORT, WEB_PORT_DEFAULT } from "../shared/constants.js";
+import { RADAR_HOST, RADAR_PORT, RADAR_VERSION, WEB_PORT_DEFAULT } from "../shared/constants.js";
 import { cleanupPulledDatabases, initializeDatabasePath, listDatabases, pullDatabase, pulledSize, queryDatabase, resetDbState, } from "../shared/db.js";
 import { LogSession } from "./log-session.js";
 import { BLANK_SPEC, coerceSpec, validateSpec } from "./spec.js";
-import { screenCapabilities, grantScreenConsent, hasScreenConsent, detectDisplay, displayNote, captureScreenshot, startLive, addViewer, removeViewer, primeIfNeeded, startRecording, stopRecording, recordingPath, resetScreenState, registerScreenCleanup, resolveFfmpeg, ffmpegInstallHint, SCREEN_BOUNDARY, } from "../shared/screen.js";
+import { screenCapabilities, refreshScreenCapabilities, grantScreenConsent, hasScreenConsent, detectDisplay, displayNote, captureScreenshot, startLive, addViewer, removeViewer, reapLiveIfIdle, primeIfNeeded, startRecording, stopRecording, recordingPath, resetScreenState, registerScreenCleanup, resolveFfmpeg, ffmpegInstallHint, SCREEN_BOUNDARY, } from "../shared/screen.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const WEB_PORT = Number(process.env.SLACK_RADAR_WEB_PORT ?? WEB_PORT_DEFAULT);
 const INDEX_PATH = path.join(__dirname, "public", "index.html");
@@ -104,25 +104,58 @@ function initialSpec() {
         return BLANK_SPEC;
     }
 }
-writeSpec(initialSpec());
-// Initialize the database path with the web server port, so concurrent dashboards
-// on different ports do not collide in tmpdir.
+/**
+ * Write the starting spec for a server that is taking ownership of this port. MUST be
+ * called only AFTER a successful listen() bind, never at module load: importing this
+ * module (which bin.ts does before it knows whether the port is free) must not touch
+ * the shared spec file, or a second launcher would wipe the spec of the dashboard that
+ * already owns the port. The post-bind caller is the sole legitimate writer.
+ */
+export function seedInitialSpec() {
+    writeSpec(initialSpec());
+}
+// Initialize the database path with the web server port, so concurrent dashboards on
+// different ports do not collide in tmpdir. This only COMPUTES a path string (no filesystem
+// write), so it is safe to run at module load even for a launcher that loses the port bind.
 initializeDatabasePath(WEB_PORT);
-// Pulled DB copies are plaintext message stores; never let them linger across runs.
-// Clean on start, and on the process signals the bin wires for shutdown.
-cleanupPulledDatabases();
-for (const sig of ["SIGINT", "SIGTERM", "exit"]) {
-    process.once(sig, cleanupPulledDatabases);
+/**
+ * Wipe stale pulled-DB copies and arm the cleanup-on-exit handlers for THIS process. MUST be
+ * called only AFTER a successful listen() bind, never at module load: the pulled-DB tmp dir is
+ * scoped by WEB_PORT, so it is SHARED by every launcher that imports this module on the same
+ * port. A second launcher that loses the bind must not rmSync that dir, or it wipes the
+ * running dashboard's pulled-DB cache and breaks its open DB-browser tab until it re-pulls.
+ * Same post-bind discipline as seedInitialSpec: the port owner is the sole legitimate writer.
+ */
+export function cleanupOnBind() {
+    // Pulled DB copies are plaintext message stores; never let them linger across runs.
+    cleanupPulledDatabases();
+    for (const sig of ["SIGINT", "SIGTERM", "exit"]) {
+        process.once(sig, cleanupPulledDatabases);
+    }
 }
 export function createServer() {
     registerScreenCleanup(); // tear down any live screen cast on process exit/signals
     const server = http.createServer((req, res) => {
         const url = req.url ?? "";
-        if (url === "/" || url === "/index.html") {
+        const urlPath = url.split("?")[0];
+        if (urlPath === "/" || urlPath === "/index.html") {
+            // The Preact dashboard is the default (and only) UI. The old vanilla dashboard + its
+            // ?next opt-in seam were retired in the flip; index.html IS the Preact shell now.
             serveIndex(res);
             return;
         }
+        // Dashboard client modules (vendor/, next/). GET serves the body; HEAD serves headers
+        // only (a proxy/cache validator hitting a real asset should not get a 404).
+        const inm = req.headers["if-none-match"];
+        if ((req.method === "GET" || req.method === "HEAD") && serveStatic(urlPath, res, req.method === "HEAD", Array.isArray(inm) ? inm[0] : inm)) {
+            return;
+        }
         if (url === "/spec" && req.method === "GET") {
+            // Version marker for a second launcher's adopt path: it can compare this against its own
+            // RADAR_VERSION and warn on a mismatch (it still adopts; it never kills the holder).
+            // A header, not a body field, so the /spec fingerprint and the client's change-detection
+            // key (JSON.stringify of the body) stay byte-identical.
+            res.setHeader("X-Radar-Version", RADAR_VERSION);
             sendJson(res, 200, loadSpec());
             return;
         }
@@ -196,6 +229,88 @@ function serveIndex(res) {
         res.end(`Failed to read ${INDEX_PATH}: ${e.message}`);
     }
 }
+// Static assets for the dashboard client. The dashboard was historically one
+// self-contained index.html; the UI is being migrated to Preact components (container by
+// container), which the browser fetches as ES modules over HTTP. This serves only the
+// vendored runtime (vendor/) and the UI modules (next/): locked to those two dirs, .js
+// only, no path traversal, from the known public root. The listener is already
+// loopback-only (bin.ts), so this adds no network exposure.
+const PUBLIC_DIR = path.join(__dirname, "public");
+// vendor/ exists today; next/ is populated by the in-progress Preact UI migration (the very
+// next PRs). Keeping it here now means those module fetches resolve the moment they land; until
+// then a /next/* request is a harmless 404 (the dir does not exist, readFileSync misses).
+const STATIC_DIRS = ["vendor", "next"];
+// Canonicalized public root, resolved once at module load. The realpath containment check
+// below compares a resolved file path against this; if we compared against the raw PUBLIC_DIR
+// while the install prefix itself is a symlink (a global npm prefix, or macOS /tmp ->
+// /private/tmp), realpathSync(full) would resolve the prefix too and never start with the
+// un-resolved PUBLIC_DIR, so EVERY legitimate module would 403 and the UI would silently fail
+// to load. Resolve the root the same way so the comparison is apples-to-apples. Falls back to
+// PUBLIC_DIR if the dir does not exist yet (e.g. a build without vendored assets).
+const PUBLIC_REAL = (() => {
+    try {
+        return fs.realpathSync(PUBLIC_DIR);
+    }
+    catch {
+        return PUBLIC_DIR;
+    }
+})();
+// Cache policy for vendored modules: revalidate every time (no-cache), but serve a cheap 304
+// when the file is unchanged via an ETag derived from its size+mtime. This cuts redundant
+// transfers WITHOUT the stale-after-upgrade footgun a plain max-age would create: the module
+// URLs are version-less and have no content hash, so an npm upgrade that swaps vendor/ would
+// otherwise serve stale JS from a long-lived cache for up to the max-age window.
+// `clean` is the already-query-stripped request path. `isHead` sends headers with no body.
+function serveStatic(clean, res, isHead, ifNoneMatch) {
+    const top = clean.split("/")[1];
+    if (!STATIC_DIRS.includes(top))
+        return false;
+    if (!clean.endsWith(".js"))
+        return false; // only JS modules; no arbitrary file types
+    const full = path.normalize(path.join(PUBLIC_DIR, clean));
+    // Lexical containment: the normalized path must stay under PUBLIC_DIR (defeats ../).
+    if (full !== PUBLIC_DIR && !full.startsWith(PUBLIC_DIR + path.sep)) {
+        res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("forbidden");
+        return true;
+    }
+    try {
+        // path.normalize is lexical only; a symlink inside vendor/ could still point outside the
+        // root. Resolve the real path and re-check containment against the canonicalized root
+        // (PUBLIC_REAL, not the raw PUBLIC_DIR) before reading.
+        const real = fs.realpathSync(full);
+        if (real !== PUBLIC_REAL && !real.startsWith(PUBLIC_REAL + path.sep)) {
+            res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+            res.end("forbidden");
+            return true;
+        }
+        // Weak ETag from size + mtime: changes whenever the file is rebuilt/upgraded, so a stale
+        // browser copy revalidates to a fresh body instead of being served from cache.
+        const st = fs.statSync(real);
+        const etag = `W/"${st.size.toString(16)}-${Math.round(st.mtimeMs).toString(16)}"`;
+        if (ifNoneMatch === etag) {
+            res.writeHead(304, { ETag: etag, "Cache-Control": "no-cache" });
+            res.end();
+            return true;
+        }
+        const body = fs.readFileSync(real);
+        // Set Content-Length explicitly so a HEAD mirrors the GET's framing (RFC 7230): a
+        // cache validator doing HEAD gets the size, and GET returns a real length not chunked.
+        // no-cache = always revalidate (cheap 304 above); never serve a stale module after upgrade.
+        res.writeHead(200, {
+            "Content-Type": "text/javascript; charset=utf-8",
+            "Content-Length": body.length,
+            "Cache-Control": "no-cache",
+            ETag: etag,
+        });
+        res.end(isHead ? undefined : body);
+    }
+    catch {
+        res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("not found");
+    }
+    return true;
+}
 function sendJson(res, status, payload) {
     // A device probe can fire both "end" and "error"/"timeout" for one request, so its
     // callbacks may call sendJson twice. The second writeHead would throw
@@ -253,11 +368,20 @@ function handleHealth(res) {
     // drop), so guard the response to exactly one write. Without this the second sendJson
     // does a second writeHead -> ERR_HTTP_HEADERS_SENT -> uncaught -> the whole server dies.
     let replied = false;
-    const reply = (device) => {
+    // The bound profile, read from the device ping body. This is the TRUTH about which
+    // profile owns the socket (the app that bound first), unlike the host-side activate
+    // guess in getActiveUserId() which can drift. The dashboard shows this so it never
+    // claims a profile you are not actually seeing.
+    const reply = (device, boundUserId, boundProfile) => {
         if (replied)
             return;
         replied = true;
-        sendJson(res, 200, { device, screen: screenCapabilities() });
+        sendJson(res, 200, {
+            device,
+            screen: screenCapabilities(),
+            boundUserId: boundUserId ?? null,
+            boundProfile: boundProfile ?? null,
+        });
     };
     const probe = http.request({
         host: RADAR_HOST,
@@ -266,8 +390,38 @@ function handleHealth(res) {
         method: "GET",
         timeout: 2500,
     }, (up) => {
-        up.resume();
-        up.on("end", () => reply(up.statusCode === 200));
+        // The ping body is the device's own small JSON status. Bound the accumulation anyway so
+        // a misbehaving/compromised local endpoint cannot grow it without limit (matches the
+        // bounded-read posture elsewhere in this file). 64KB is far above any real ping body;
+        // once tripped we stop appending and parse what we have (a truncated body simply fails
+        // the JSON.parse below and falls back to no bound profile, which is the safe default).
+        const MAX_PING_BODY = 64 * 1024;
+        let body = "";
+        up.on("data", (c) => {
+            if (body.length < MAX_PING_BODY)
+                body += c;
+        });
+        up.on("end", () => {
+            const ok = up.statusCode === 200;
+            let uid = null;
+            let profile = null;
+            // Only trust the body on a 200. A device 5xx-ing with a stale ping body must NOT
+            // surface a bound profile while device:false — that would let the dashboard show a
+            // confident profile label for an unhealthy device.
+            if (ok) {
+                try {
+                    const p = JSON.parse(body);
+                    if (p.android_user_id != null)
+                        uid = String(p.android_user_id);
+                    if (typeof p.profile === "string")
+                        profile = p.profile;
+                }
+                catch {
+                    // non-JSON / partial body: device is up but we cannot name the profile
+                }
+            }
+            reply(ok, uid, profile);
+        });
         up.on("error", () => reply(false));
     });
     probe.on("error", () => reply(false));
@@ -546,8 +700,28 @@ async function handleDbQuery(req, res) {
 function handleScreen(req, res) {
     const url = req.url ?? "";
     // Capabilities + consent state. Always available; drives the overlay's degrade UI.
+    // ?refresh=1 re-probes ffmpeg/scrcpy (asynchronously, so it never blocks the event
+    // loop / live stream) before reading, so a user who installs ffmpeg then reopens the
+    // overlay is detected without a server restart. Without refresh it reads the cache.
     if (url.startsWith("/screen/caps")) {
-        sendJson(res, 200, { ...screenCapabilities(), consent: hasScreenConsent() });
+        const refresh = new URL(url, "http://localhost").searchParams.get("refresh") === "1";
+        if (refresh) {
+            void (async () => {
+                // refreshScreenCapabilities cannot throw today, but a future edit that lets a rejection
+                // escape would leave this request hanging until the client's 3s timeout. Guard it: on a
+                // failed re-probe, still answer with the (cached) capabilities rather than nothing.
+                try {
+                    await refreshScreenCapabilities();
+                }
+                catch {
+                    // fall through to the cached capabilities below
+                }
+                sendJson(res, 200, { ...screenCapabilities(), consent: hasScreenConsent() });
+            })();
+        }
+        else {
+            sendJson(res, 200, { ...screenCapabilities(), consent: hasScreenConsent() });
+        }
         return;
     }
     // Grant consent for this process. Required before any pixels are mirrored.
@@ -625,6 +799,10 @@ function handleScreen(req, res) {
     if (url === "/screen/record/stop" && req.method === "POST") {
         void (async () => {
             const p = await stopRecording();
+            // If the viewer already left (the close-while-recording path drops the <img> before
+            // this POST lands), the recording was the only thing keeping the cast alive — reap it
+            // now so screenrecord + ffmpeg do not run on with no viewer.
+            reapLiveIfIdle();
             const file = p ? path.basename(p) : null;
             let sizeBytes = 0;
             if (p) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slack/radar-mcp",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "MCP server and web dashboard for on-device debugging of the Slack Android app via ADB",
   "type": "module",
   "main": "dist/mcp/index.js",
@@ -16,7 +16,9 @@
   "scripts": {
     "clean": "rm -rf dist",
     "prebuild": "npm run clean",
-    "build": "tsc && cp -r src/web/public dist/web/public && chmod +x dist/mcp/index.js dist/web/bin.js",
+    "copy-vendor": "node scripts/copy-vendor.mjs",
+    "build:web": "tsc -p tsconfig.web.json",
+    "build": "tsc && npm run build:web && node scripts/copy-public.mjs && npm run copy-vendor && chmod +x dist/mcp/index.js dist/web/bin.js",
     "start": "node dist/mcp/index.js",
     "start:web": "node dist/web/bin.js",
     "watch": "tsc --watch",
@@ -49,6 +51,8 @@
   },
   "devDependencies": {
     "@types/node": "^22.10.5",
+    "htm": "^3.1.1",
+    "preact": "^10.29.3",
     "typescript": "^5.7.2"
   }
 }