@vantran-se/openchamber-web 1.23.1 → 1.24.3

package/server/lib/opencode/theme-import.test.js

@@ -0,0 +1,144 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import * as fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import express from 'express';
+import request from 'supertest';
+import { createThemeRuntime } from './theme-runtime.js';
+import { registerSettingsUtilityRoutes, registerCommonRequestMiddleware } from './core-routes.js';
+
+const directories = [];
+afterEach(async () => {
+  await Promise.all(directories.splice(0).map((directory) => fs.rm(directory, { recursive: true, force: true })));
+});
+
+const definition = {
+  metadata: { id: '../../escape', name: 'Imported fixture', variant: 'dark' },
+  colors: {
+    primary: { base: '#ffcc66' },
+    surface: { background: '#111111', foreground: '#eeeeee', muted: '#181818', mutedForeground: '#999999', elevated: '#222222' },
+    interactive: { border: '#333333' },
+    status: { error: '#ff6666', warning: '#ffcc66', success: '#66cc66', info: '#66aaff' },
+    syntax: { base: { comment: '#888888', keyword: '#aa88ff', string: '#88cc66', number: '#ffcc66', function: '#66aaff', variable: '#eeeeee', type: '#66dddd', operator: '#ff6677' } },
+  },
+};
+
+async function setup(overrides = {}) {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'oc-theme-import-'));
+  directories.push(root);
+  const themesDir = path.join(root, 'themes');
+  const runtime = createThemeRuntime({ fsPromises: { ...fs, ...overrides }, path, themesDir, maxThemeJsonBytes: 512 * 1024, logger: console });
+  const app = express();
+  registerCommonRequestMiddleware(app, { express });
+  registerSettingsUtilityRoutes(app, runtime);
+  return { root, themesDir, runtime, app };
+}
+
+describe('theme import persistence', () => {
+  it('deletes only imported files, leaves siblings intact and allows an identical reimport', async () => {
+    const { app, runtime, themesDir } = await setup();
+    const theme = await runtime.saveImportedTheme(definition);
+    await fs.writeFile(path.join(themesDir, 'custom.json'), JSON.stringify(definition));
+    await request(app).delete('/api/config/themes/openchamber-dark').expect(200);
+    await request(app).delete(`/api/config/themes/${theme.metadata.id}`).expect(200);
+    expect(await fs.readdir(themesDir)).toEqual(['custom.json']);
+    await request(app).delete(`/api/config/themes/${theme.metadata.id}`).expect(200);
+    expect(await runtime.saveImportedTheme(definition)).toEqual(theme);
+  });
+
+  it('does not follow a symlink during deletion or report deletion failure as success', async () => {
+    const { app, root, themesDir } = await setup();
+    await fs.mkdir(themesDir);
+    const outside = path.join(root, 'outside.json');
+    await fs.writeFile(outside, 'keep');
+    const id = `imported-vscode-${'a'.repeat(24)}`;
+    await fs.symlink(outside, path.join(themesDir, `${id}.json`));
+    await request(app).delete(`/api/config/themes/${id}`).expect(200);
+    expect(await fs.readFile(outside, 'utf8')).toBe('keep');
+    const denied = await setup({ unlink: async () => { throw Object.assign(new Error('denied'), { code: 'EACCES' }); } });
+    await fs.mkdir(denied.themesDir);
+    await fs.writeFile(path.join(denied.themesDir, `${id}.json`), JSON.stringify({ ...definition, metadata: { ...definition.metadata, id } }));
+    await request(denied.app).delete(`/api/config/themes/${id}`).expect(500);
+    expect(await fs.readdir(denied.themesDir)).toEqual([`${id}.json`]);
+  });
+  it('deletes a hand-added theme by its metadata ID, not by an assumed filename', async () => {
+    const { app, themesDir } = await setup();
+    await fs.mkdir(themesDir);
+    const custom = { ...definition, metadata: { ...definition.metadata, id: 't3-code-dark', name: 'T3 Code' } };
+    await fs.writeFile(path.join(themesDir, 'my-custom-palette.json'), JSON.stringify(custom));
+    const loaded = await request(app).get('/api/config/themes').expect(200);
+    expect(loaded.body.themes[0].metadata.id).toBe('t3-code-dark');
+    await request(app).delete('/api/config/themes/t3-code-dark').expect(200);
+    expect(await fs.readdir(themesDir)).toEqual([]);
+  });
+
+  it('refuses ambiguous duplicate IDs and does not turn an ID into a filesystem path', async () => {
+    const { app, themesDir, root } = await setup();
+    await fs.mkdir(themesDir);
+    const custom = { ...definition, metadata: { ...definition.metadata, id: 'duplicate' } };
+    for (const name of ['one.json', 'two.json']) await fs.writeFile(path.join(themesDir, name), JSON.stringify(custom));
+    await request(app).delete('/api/config/themes/duplicate').expect(409);
+    expect((await fs.readdir(themesDir)).sort()).toEqual(['one.json', 'two.json']);
+    await fs.writeFile(path.join(root, 'outside.json'), JSON.stringify(custom));
+    await request(app).delete('/api/config/themes/..%2Foutside').expect(200);
+    expect(await fs.readFile(path.join(root, 'outside.json'), 'utf8')).toBe(JSON.stringify(custom));
+  });
+
+  it('allows deleting a readable theme beside an unreadable sibling, but does not treat failed reads as absence', async () => {
+    const { runtime, themesDir } = await setup({ readFile: async (file, ...args) => {
+      if (path.basename(file) === 'unreadable.json') throw Object.assign(new Error('denied'), { code: 'EACCES' });
+      return fs.readFile(file, ...args);
+    } });
+    const theme = await runtime.saveImportedTheme(definition);
+    await fs.writeFile(path.join(themesDir, 'unreadable.json'), JSON.stringify(definition));
+    await runtime.deleteImportedTheme(theme.metadata.id);
+    expect(await fs.readdir(themesDir)).toEqual(['unreadable.json']);
+    await expect(runtime.deleteImportedTheme('possibly-unreadable')).rejects.toMatchObject({ code: 'EACCES' });
+  });
+  it('saves through the API under a server-owned ID and returns it through reload', async () => {
+    const { app, themesDir, root } = await setup();
+    const response = await request(app).post('/api/config/themes').send({ theme: definition }).expect(201);
+    expect(response.body.theme.metadata.id).toMatch(/^imported-vscode-[a-f0-9]{24}$/);
+    expect(await fs.readdir(root)).toEqual(['themes']);
+    expect(await fs.readdir(themesDir)).toEqual([`${response.body.theme.metadata.id}.json`]);
+    const loaded = await request(app).get('/api/config/themes').expect(200);
+    expect(loaded.body.themes).toEqual([response.body.theme]);
+  });
+
+  it('deduplicates simultaneous imports and never overwrites a subsequently edited theme', async () => {
+    const { runtime, themesDir } = await setup();
+    const [first, second] = await Promise.all([runtime.saveImportedTheme(definition), runtime.saveImportedTheme(definition)]);
+    expect(first).toEqual(second);
+    expect((await fs.readdir(themesDir)).length).toBe(1);
+    const filename = path.join(themesDir, `${first.metadata.id}.json`);
+    await fs.writeFile(filename, 'manually edited');
+    await expect(runtime.saveImportedTheme(definition)).rejects.toMatchObject({ code: 'conflict', status: 409 });
+    expect(await fs.readFile(filename, 'utf8')).toBe('manually edited');
+    expect(await fs.readdir(themesDir)).toEqual([`${first.metadata.id}.json`]);
+  });
+
+  it('rejects malformed definitions and unsafe token names without creating files', async () => {
+    const { app, root } = await setup();
+    await request(app).post('/api/config/themes').send({ theme: { ...definition, colors: {} } }).expect(400);
+    await request(app).post('/api/config/themes').send({ theme: { ...definition, colors: { ...definition.colors, syntax: { ...definition.colors.syntax, tokens: { 'x;body': '#000000' } } } } }).expect(400);
+    expect(await fs.readdir(root)).toEqual([]);
+  });
+
+  it('cleans temporary files after a publication failure', async () => {
+    const { runtime, themesDir } = await setup({ link: async () => { throw Object.assign(new Error('denied'), { code: 'EACCES' }); } });
+    await expect(runtime.saveImportedTheme(definition)).rejects.toMatchObject({ code: 'EACCES' });
+    expect(await fs.readdir(themesDir)).toEqual([]);
+  });
+
+  it('does not report a directory read failure as an empty theme library', async () => {
+    const { runtime } = await setup({ readdir: async () => { throw Object.assign(new Error('denied'), { code: 'EACCES' }); } });
+    await expect(runtime.readCustomThemesFromDisk()).rejects.toMatchObject({ code: 'EACCES' });
+  });
+
+  it('rejects oversized imports without touching the themes directory', async () => {
+    const { runtime, root } = await setup();
+    const tokens = Object.fromEntries(Array.from({ length: 30000 }, (_, index) => [`token${index}`, '#123456']));
+    await expect(runtime.saveImportedTheme({ ...definition, colors: { ...definition.colors, syntax: { ...definition.colors.syntax, tokens } } })).rejects.toMatchObject({ code: 'size', status: 413 });
+    expect(await fs.readdir(root)).toEqual([]);
+  });
+});

package/server/lib/opencode/theme-runtime.js

@@ -1,3 +1,29 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { z } from 'zod';
+
+const color = z.string().regex(/^#(?:[\da-f]{3}|[\da-f]{4}|[\da-f]{6}|[\da-f]{8})$/i);
+const role = z.string().regex(/^[a-zA-Z][a-zA-Z0-9]*$/).max(64);
+const importedThemeSchema = z.object({
+  metadata: z.object({
+    name: z.string().trim().min(1).max(160),
+    author: z.string().max(160).optional(),
+    variant: z.enum(['light', 'dark']),
+    description: z.string().max(1024).default(''),
+    version: z.string().max(40).default('1.0.0'),
+    tags: z.array(z.string().max(40)).max(16).default([]),
+  }),
+  colors: z.record(role, z.record(role, z.union([color, z.record(role, color)]))),
+});
+const fileErrorSchema = z.object({ code: z.string() });
+
+export class ThemeImportStorageError extends Error {
+  constructor(code, status) {
+    super(code);
+    this.code = code;
+    this.status = status;
+  }
+}
+
 export const createThemeRuntime = (dependencies) => {
   const {
     fsPromises,
@@ -34,46 +60,24 @@ export const createThemeRuntime = (dependencies) => {
     const status = colors.status;
     const syntax = colors.syntax;
     const syntaxBase = syntax && typeof syntax === 'object' ? syntax.base : null;
-    const syntaxHighlights = syntax && typeof syntax === 'object' ? syntax.highlights : null;
 
-    if (!primary || !surface || !interactive || !status || !syntaxBase || !syntaxHighlights) {
+    if (!primary || !surface || !interactive || !status || !syntaxBase) {
       return null;
     }
 
-    // Minimal fields required by CSSVariableGenerator and diff/syntax rendering.
+    // Authored inputs only. The UI resolves optional roles before rendering.
     const required = [
       primary.base,
-      primary.foreground,
       surface.background,
       surface.foreground,
       surface.muted,
       surface.mutedForeground,
       surface.elevated,
-      surface.elevatedForeground,
-      surface.subtle,
       interactive.border,
-      interactive.selection,
-      interactive.selectionForeground,
-      interactive.focusRing,
-      interactive.hover,
       status.error,
-      status.errorForeground,
-      status.errorBackground,
-      status.errorBorder,
       status.warning,
-      status.warningForeground,
-      status.warningBackground,
-      status.warningBorder,
       status.success,
-      status.successForeground,
-      status.successBackground,
-      status.successBorder,
       status.info,
-      status.infoForeground,
-      status.infoBackground,
-      status.infoBorder,
-      syntaxBase.background,
-      syntaxBase.foreground,
       syntaxBase.keyword,
       syntaxBase.string,
       syntaxBase.number,
@@ -82,9 +86,6 @@ export const createThemeRuntime = (dependencies) => {
       syntaxBase.type,
       syntaxBase.comment,
       syntaxBase.operator,
-      syntaxHighlights.diffAdded,
-      syntaxHighlights.diffRemoved,
-      syntaxHighlights.lineNumber,
     ];
 
     if (!required.every(isValidThemeColor)) {
@@ -156,12 +157,83 @@ export const createThemeRuntime = (dependencies) => {
         return [];
       }
       logger.warn('[themes] Failed to list custom themes dir:', error);
-      return [];
+      throw error;
+    }
+  };
+
+  const saveImportedTheme = async (raw) => {
+    const parsed = importedThemeSchema.safeParse(raw);
+    if (!parsed.success) throw new ThemeImportStorageError('invalid', 400);
+    const normalized = normalizeThemeJson({ ...parsed.data, metadata: { ...parsed.data.metadata, id: 'import' } });
+    if (!normalized) throw new ThemeImportStorageError('invalid', 400);
+    // The client supplies colors, never a filename or an overwrite target.
+    // Identical imports have the same ID, including retries after a lost reply.
+    const digest = createHash('sha256').update(JSON.stringify(parsed.data)).digest('hex').slice(0, 24);
+    const theme = { ...normalized, metadata: { ...normalized.metadata, id: `imported-vscode-${digest}` } };
+    const contents = `${JSON.stringify(theme, null, 2)}\n`;
+    if (Buffer.byteLength(contents, 'utf8') > maxThemeJsonBytes) throw new ThemeImportStorageError('size', 413);
+    await fsPromises.mkdir(themesDir, { recursive: true });
+    const target = path.join(themesDir, `${theme.metadata.id}.json`);
+    const temporary = path.join(themesDir, `${randomUUID()}.tmp`);
+    try {
+      await fsPromises.writeFile(temporary, contents, { flag: 'wx', mode: 0o600 });
+      try {
+        // Link publishes the complete file atomically and cannot overwrite an
+        // existing theme, even if another import finishes at the same time.
+        await fsPromises.link(temporary, target);
+      } catch (error) {
+        const parsedError = fileErrorSchema.safeParse(error);
+        if (!parsedError.success || parsedError.data.code !== 'EEXIST') throw error;
+        if (await fsPromises.readFile(target, 'utf8') !== contents) throw new ThemeImportStorageError('conflict', 409);
+      }
+      return theme;
+    } finally {
+      await fsPromises.unlink(temporary).catch((error) => {
+        const parsedError = fileErrorSchema.safeParse(error);
+        if (!parsedError.success || parsedError.data.code !== 'ENOENT') logger.warn('[themes] Failed to clean import temporary file');
+      });
     }
   };
 
   return {
     normalizeThemeJson,
     readCustomThemesFromDisk,
+    saveImportedTheme,
+    async deleteImportedTheme(id) {
+      if (!z.string().trim().min(1).max(256).safeParse(id).success) throw new ThemeImportStorageError('invalid', 400);
+      const matches = [];
+      let readFailure;
+      let entries;
+      try { entries = await fsPromises.readdir(themesDir, { withFileTypes: true }); }
+      catch (error) {
+        if (fileErrorSchema.safeParse(error).data?.code === 'ENOENT') return;
+        throw error;
+      }
+      for (const entry of entries) {
+        if (!entry.isFile() || !entry.name.endsWith('.json')) continue;
+        const target = path.join(themesDir, entry.name);
+        let text;
+        try {
+          const stat = await fsPromises.lstat(target);
+          if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxThemeJsonBytes) continue;
+          text = await fsPromises.readFile(target, 'utf8');
+        } catch (error) {
+          if (fileErrorSchema.safeParse(error).data?.code !== 'ENOENT') readFailure = error;
+          continue;
+        }
+        let theme;
+        try { theme = normalizeThemeJson(JSON.parse(text)); }
+        catch { continue; }
+        if (theme?.metadata.id === id) matches.push(target);
+      }
+      // IDs identify themes, not filenames. Refuse ambiguous matches rather
+      // than deleting an arbitrary sibling or constructing a path from the ID.
+      if (matches.length > 1) throw new ThemeImportStorageError('conflict', 409);
+      if (!matches.length) {
+        if (readFailure) throw readFailure;
+        return;
+      }
+      await fsPromises.unlink(matches[0]);
+    },
   };
 };

package/server/lib/opencode/theme-runtime.test.js

@@ -90,6 +90,21 @@ const createTestRuntime = ({ entries, files, stats }) => createThemeRuntime({
 
 describe('theme runtime', () => {
   describe('readCustomThemesFromDisk', () => {
+    it('loads compact authored roles without requiring derived colors', async () => {
+      const theme = validTheme('compact');
+      theme.colors.primary = { base: '#ffffff' };
+      theme.colors.interactive = { border: '#444444' };
+      theme.colors.status = { error: '#ff0000', warning: '#ffaa00', success: '#00ff00', info: '#0000ff' };
+      delete theme.colors.syntax.highlights;
+      delete theme.colors.syntax.base.background;
+      delete theme.colors.syntax.base.foreground;
+      const runtime = createTestRuntime({
+        entries: [fileEntry('compact.json'), fileEntry('bad.json')],
+        files: { '/themes/compact.json': JSON.stringify(theme), '/themes/bad.json': '{broken' },
+        stats: { '/themes/compact.json': { isFile: () => true, size: 1024 }, '/themes/bad.json': { isFile: () => true, size: 10 } },
+      });
+      expect((await runtime.readCustomThemesFromDisk()).map((item) => item.metadata.id)).toEqual(['compact']);
+    });
     it('loads valid theme files', async () => {
       const runtime = createTestRuntime({
         entries: [fileEntry('direct.json')],

package/server/lib/permission-auto-accept/DOCUMENTATION.md

@@ -16,6 +16,14 @@ Policy inheritance uses the nearest explicit session value. A child `false` ther
 
 Unknown lineage and failed policy loads fail closed. A failed pending-permission fetch is distinct from an empty successful response and never clears policy state.
 
+## Safety net
+
+`evaluatePermission` (the routing runtime, `../routing/DOCUMENTATION.md`) is
+consulted after the policy check and before the reply. `hold` counts the
+request as handled without replying, so it stays on screen; `accept` replies as
+before. A `permission.replied` event is passed to `onPermissionReplied` so the
+routing runtime forgets its cached decision.
+
 ## Routes
 
 - `GET /api/permission-auto-accept`

package/server/lib/permission-auto-accept/runtime.js

@@ -25,6 +25,10 @@ export function createPermissionAutoAcceptRuntime({
   readSettingsFromDiskMigrated,
   persistSettings,
   broadcastGlobalUiEvent,
+  // The routing safety net: asked once per request before the automatic reply.
+  // `hold` leaves the request for the user; absent means every request is replied to.
+  evaluatePermission = null,
+  onPermissionReplied = null,
   fetchImpl = fetch,
   retryDelaysMs = RETRY_DELAYS_MS,
   requestTimeoutMs = REQUEST_TIMEOUT_MS,
@@ -148,6 +152,10 @@ export function createPermissionAutoAcceptRuntime({
     if (!permission?.id || !permission?.sessionID) return false;
     await load();
     if (!(await isSessionAutoAccepting(permission.sessionID, directory))) return false;
+    if (evaluatePermission) {
+      const verdict = await evaluatePermission(permission, directory);
+      if (verdict?.action === 'hold') return true;
+    }
     await request(`/permission/${encodeURIComponent(permission.id)}/reply`, {
       directory,
       method: 'POST',
@@ -218,6 +226,11 @@ export function createPermissionAutoAcceptRuntime({
     }
     if (payload?.type === 'permission.asked') {
       void processPermission(payload.properties, directory);
+      return;
+    }
+    if (payload?.type === 'permission.replied') {
+      const permissionId = payload.properties?.requestID;
+      if (typeof permissionId === 'string') onPermissionReplied?.(permissionId);
     }
   };
 

package/server/lib/permission-auto-accept/runtime.test.js

@@ -1,7 +1,7 @@
 import { describe, expect, it, vi } from 'vitest';
 import { createPermissionAutoAcceptRuntime } from './runtime.js';
 
-const createRuntime = ({ stored, fetchImpl, retryDelaysMs = [0] } = {}) => {
+const createRuntime = ({ stored, fetchImpl, retryDelaysMs = [0], evaluatePermission, onPermissionReplied } = {}) => {
   let settings = stored ?? { permissionAutoAccept: { sessions: {} } };
   let eventHandler;
   let statusHandler;
@@ -16,6 +16,8 @@ const createRuntime = ({ stored, fetchImpl, retryDelaysMs = [0] } = {}) => {
     persistSettings: async (changes) => { settings = { ...settings, ...changes }; },
     fetchImpl: fetchImpl ?? vi.fn(async () => new Response('[]')),
     retryDelaysMs,
+    evaluatePermission,
+    onPermissionReplied,
   });
   runtime.start();
   return {
@@ -143,4 +145,38 @@ describe('permission auto-accept runtime', () => {
     expect(fetchImpl.mock.calls.some(([url]) => new URL(url).searchParams.get('directory') === '/project')).toBe(true);
     expect(await runtime.load()).toEqual({ sessions: { root: true }, revision: 1 });
   });
+
+  it('leaves a request held by the safety net unanswered and forgets it once replied', async () => {
+    const fetchImpl = vi.fn(async () => new Response('[]'));
+    const verdicts = { held: { action: 'hold', score: 0.9, kind: 'git_history' }, safe: { action: 'accept', score: 0.1 } };
+    const evaluatePermission = vi.fn(async (permission) => verdicts[permission.id]);
+    const onPermissionReplied = vi.fn();
+    const { runtime, emit } = createRuntime({
+      stored: { permissionAutoAccept: { sessions: { root: true } } },
+      fetchImpl,
+      evaluatePermission,
+      onPermissionReplied,
+    });
+    await runtime.load();
+
+    emit({ type: 'permission.asked', properties: { id: 'held', sessionID: 'root', permission: 'bash', metadata: {} } });
+    emit({ type: 'permission.asked', properties: { id: 'safe', sessionID: 'root', permission: 'bash', metadata: {} } });
+    await flush();
+
+    const replies = fetchImpl.mock.calls.map(([url]) => String(url)).filter((url) => url.includes('/reply'));
+    expect(replies).toEqual(['http://opencode.test/permission/safe/reply?directory=%2Fproject']);
+    expect(evaluatePermission).toHaveBeenCalledTimes(2);
+
+    emit({ type: 'permission.replied', properties: { sessionID: 'root', requestID: 'held', reply: 'once' } });
+    expect(onPermissionReplied).toHaveBeenCalledWith('held');
+  });
+
+  it('does not consult the safety net for sessions that are not auto-accepting', async () => {
+    const evaluatePermission = vi.fn(async () => ({ action: 'hold' }));
+    const { runtime, emit } = createRuntime({ evaluatePermission });
+    await runtime.load();
+    emit({ type: 'permission.asked', properties: { id: 'p', sessionID: 'manual', permission: 'bash', metadata: {} } });
+    await flush();
+    expect(evaluatePermission).not.toHaveBeenCalled();
+  });
 });

package/server/lib/projects/project-config.js

@@ -1,5 +1,5 @@
 import { DateTime, IANAZone } from 'luxon';
-import parser from 'cron-parser';
+import { CronExpressionParser } from 'cron-parser';
 
 import { projectConfigFileStemOf, projectPathFromId } from './project-id.js';
 import {
@@ -145,7 +145,7 @@ const normalizeTimezone = (value, fallback = resolveDefaultTimezone()) => {
 
 const validateCronExpression = (expression, timezone) => {
   try {
-    const iterator = parser.parseExpression(expression, {
+    const iterator = CronExpressionParser.parse(expression, {
       tz: timezone,
       currentDate: new Date(),
     });

package/server/lib/quota/DOCUMENTATION.md

@@ -27,7 +27,6 @@ These provider IDs are currently dispatchable via `fetchQuotaForProvider(provide
 | `codex` | Codex | `providers/codex.js` | `openai`, `codex`, `chatgpt` |
 | `command-code` | Command Code | `providers/command-code.js` | `command-code` OAuth/API credential in OpenCode `auth.json`, or `COMMAND_CODE_API_KEY` |
 | `cursor` | Cursor | `providers/cursor.js` | Environment/token files, OpenChamber-managed credentials, or explicit one-time Cursor import |
-| `crof` | CrofAI | `providers/crof.js` | `crof` (API key under `key` or `token`) |
 | `deepseek` | DeepSeek | `providers/deepseek.js` | `deepseek` (API key under `key` or `token`) |
 | `exe-dev` | exe.dev | `providers/exe-dev.js` | Usage API token stored under `~/.config/openchamber/quota/` |
 | `google` | Google | `providers/google/index.js` | `google`, `google.oauth`, Antigravity accounts file |

package/server/lib/quota/providers/index.js

@@ -11,7 +11,6 @@ import * as claude from './claude/index.js';
 import * as clinePass from './cline-pass.js';
 import * as codex from './codex.js';
 import * as copilot from './copilot.js';
-import * as crof from './crof.js';
 import * as cursor from './cursor.js';
 import * as deepseek from './deepseek.js';
 import * as exeDev from './exe-dev.js';
@@ -50,12 +49,6 @@ const registry = {
     isConfigured: codex.isConfigured,
     fetchQuota: codex.fetchQuota
   },
-  crof: {
-    providerId: crof.providerId,
-    providerName: crof.providerName,
-    isConfigured: crof.isConfigured,
-    fetchQuota: crof.fetchQuota
-  },
   cursor: {
     providerId: cursor.providerId,
     providerName: cursor.providerName,

package/server/lib/realtime-proxy-terminal.test.js

@@ -0,0 +1,150 @@
+import { afterAll, expect, it } from 'vitest';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+import express from 'express';
+import { WebSocket } from 'ws';
+
+import { attachRealtimeProxy, buildRealtimeProxyWsUrl } from './realtime-proxy.js';
+import { createRequestSecurityRuntime } from './security/request-security.js';
+import { createTerminalRuntime } from './terminal/runtime.js';
+import { readTerminalWsControlFrame } from './terminal/terminal-ws-protocol.js';
+
+const previousDataDir = process.env.OPENCHAMBER_DATA_DIR;
+const dataDir = fs.mkdtempSync(path.join(os.tmpdir(), 'oc-proxy-terminal-'));
+process.env.OPENCHAMBER_DATA_DIR = dataDir;
+const { createUiAuth } = await import('./ui-auth/ui-auth.js');
+
+afterAll(() => {
+  if (previousDataDir === undefined) delete process.env.OPENCHAMBER_DATA_DIR;
+  else process.env.OPENCHAMBER_DATA_DIR = previousDataDir;
+  fs.rmSync(dataDir, { recursive: true, force: true });
+});
+
+const listen = async (server) => {
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  return `http://127.0.0.1:${server.address().port}`;
+};
+
+const login = async (origin, password) => {
+  const response = await fetch(`${origin}/auth/session`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ password }),
+  });
+  expect(response.status).toBe(200);
+  const cookie = response.headers.get('set-cookie').split(';')[0];
+  const minted = await fetch(`${origin}/auth/url-token`, {
+    method: 'POST',
+    headers: { Cookie: cookie, 'Content-Type': 'application/json' },
+    body: '{}',
+  });
+  expect(minted.status).toBe(200);
+  const { token } = await minted.json();
+  expect(token).toBeTruthy();
+  return token;
+};
+
+const connect = (url, origin = 'openchamber-ui://app') => new Promise((resolve, reject) => {
+  const socket = new WebSocket(url, { origin });
+  let hello = null;
+  let status = null;
+  const timeout = setTimeout(() => {
+    socket.terminate();
+    reject(new Error('Timed out waiting for terminal handshake'));
+  }, 3000);
+  socket.on('upgrade', (response) => { status = response.statusCode; });
+  socket.on('unexpected-response', (_request, response) => {
+    status = response.statusCode;
+    response.resume();
+    socket.terminate();
+  });
+  socket.on('message', (raw) => {
+    hello = readTerminalWsControlFrame(raw);
+    socket.close();
+  });
+  socket.on('error', () => {});
+  socket.on('close', (code) => {
+    clearTimeout(timeout);
+    resolve({ hello, status, code });
+  });
+});
+
+it('connects through the desktop proxy to an authenticated terminal without weakening either gate', async () => {
+  const password = crypto.randomBytes(24).toString('hex');
+  const remoteAuth = createUiAuth({ password });
+  const localAuth = createUiAuth({ password });
+  const remoteApp = express();
+  const localApp = express();
+  for (const [app, auth] of [[remoteApp, remoteAuth], [localApp, localAuth]]) {
+    app.use(express.json());
+    app.post('/auth/session', auth.handleSessionCreate);
+    app.post('/auth/url-token', auth.handleUrlAuthToken);
+  }
+  const remote = http.createServer(remoteApp);
+  const local = http.createServer(localApp);
+  const security = createRequestSecurityRuntime({ readSettingsFromDiskMigrated: async () => ({}) });
+  const received = [];
+  remote.on('upgrade', (req) => {
+    received.push({ origin: req.headers.origin, custom: req.headers['x-proxy-test'] });
+  });
+  const rejected = [];
+  const terminal = createTerminalRuntime({
+    app: remoteApp, server: remote, fs, path, uiAuthController: remoteAuth,
+    buildAugmentedPath: () => process.env.PATH || '',
+    searchPathFor: () => null,
+    isExecutable: () => false,
+    isRequestOriginAllowed: security.isRequestOriginAllowed,
+    rejectWebSocketUpgrade: (socket, status, reason) => {
+      rejected.push(status);
+      security.rejectWebSocketUpgrade(socket, status, reason);
+    },
+    TERMINAL_INPUT_WS_HEARTBEAT_INTERVAL_MS: 30_000,
+  });
+  let proxy;
+  try {
+    const remoteOrigin = await listen(remote);
+    const localOrigin = await listen(local);
+    proxy = attachRealtimeProxy({
+      app: localApp, server: local,
+      getDesktopRuntimeConfig: () => ({
+        apiBaseUrl: remoteOrigin,
+        requestHeaders: { 'X-Proxy-Test': 'present' },
+      }),
+      getUiAuthController: () => localAuth,
+      isRequestOriginAllowed: security.isRequestOriginAllowed,
+    });
+    const remoteToken = await login(remoteOrigin, password);
+    const localToken = await login(localOrigin, password);
+    const target = new URL('/api/terminal/ws', remoteOrigin);
+    target.protocol = 'ws:';
+    target.searchParams.set('oc_url_token', remoteToken);
+    const proxied = new URL(buildRealtimeProxyWsUrl(localOrigin, target.toString()));
+    proxied.searchParams.set('oc_url_token', localToken);
+
+    expect((await connect(target.toString())).hello).toEqual({ t: 'hello', v: 3 });
+    expect((await connect(proxied.toString())).hello).toEqual({ t: 'hello', v: 3 });
+    expect(received.at(-1)).toEqual({ origin: remoteOrigin, custom: 'present' });
+    expect(rejected).toEqual([]);
+
+    const beforeRejectedLocal = received.length;
+    expect((await connect(proxied.toString(), 'https://untrusted.example')).status).toBe(403);
+    const unauthenticatedLocal = new URL(proxied);
+    unauthenticatedLocal.searchParams.delete('oc_url_token');
+    expect((await connect(unauthenticatedLocal.toString())).status).toBe(401);
+    expect(received).toHaveLength(beforeRejectedLocal);
+
+    target.searchParams.delete('oc_url_token');
+    proxied.searchParams.set('url', target.toString());
+    expect((await connect(proxied.toString())).hello).toBeNull();
+    expect(rejected).toEqual([401]);
+  } finally {
+    proxy?.stop();
+    await terminal.shutdown();
+    remoteAuth.dispose();
+    localAuth.dispose();
+    await Promise.all([remote, local].map((server) => new Promise((resolve) => server.close(resolve))));
+  }
+});

package/server/lib/realtime-proxy.js

@@ -200,6 +200,8 @@ export const attachRealtimeProxy = ({ app, server, getDesktopRuntimeConfig, getU
 
     const upstream = new WebSocket(resolved.target.toString(), {
       headers: resolved.requestHeaders,
+      // ws does not send Origin by default; protected upstreams require it.
+      origin: `${resolved.target.protocol === 'wss:' ? 'https:' : 'http:'}//${resolved.target.host}`,
     });
     const pending = [];