claude-code-kanban 4.16.0 → 4.18.0

package/server.js

@@ -8,7 +8,10 @@ const readline = require('readline');
 const chokidar = require('chokidar');
 const os = require('os');
 const crypto = require('crypto');
-const { spawn, spawnSync } = require('child_process');
+const { spawnSync } = require('child_process');
+const { assertOpenTarget, openInEditor } = require('./lib/open-editor');
+const { createNetGuard } = require('./lib/net-guard');
+const { isContained } = require('./lib/contain');
 
 const {
   readRecentMessages: _readRecentMessagesUncached,
@@ -29,6 +32,7 @@ const {
   updateLoopInfo,
   buildLoopInfoFromState
 } = require('./lib/parsers');
+const { inlineHtmlAssets } = require('./lib/inline-assets');
 
 if (process.argv.includes("--install") || process.argv.includes("--uninstall")) {
   const { runInstall, runUninstall } = require("./install");
@@ -44,6 +48,13 @@ if (require("./cli").runCli(process.argv)) return;
 const app = express();
 const PORT = process.env.PORT || 3541;
 
+// Mounted before express.json() so a rejected request never buffers a body, and
+// before the /api catch-all so no route escapes the check.
+const net = createNetGuard({ appName: 'Claude Task Kanban' });
+app.use(net.hostGuard);
+app.use(net.frameGuard);
+app.use(net.originGuard);
+
 // Parse --dir flag for custom Claude directory
 function getClaudeDir() {
   const dirIndex = process.argv.findIndex(arg => arg.startsWith('--dir'));
@@ -197,8 +208,10 @@ function getGitBranch(cwd) {
   if (cached && now - cached.ts < GIT_BRANCH_TTL_MS) return cached.branch;
   let branch = null;
   try {
-    const r = spawnSync('git', ['-C', cwd, 'rev-parse', '--abbrev-ref', 'HEAD'], {
-      encoding: 'utf8', timeout: 500, windowsHide: true
+    // cwd rather than `-C <cwd>`: a path beginning with a dash would otherwise be
+    // read by git as an option.
+    const r = spawnSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
+      cwd, encoding: 'utf8', timeout: 500, windowsHide: true
     });
     if (r.status === 0) {
       const out = (r.stdout || '').trim();
@@ -253,8 +266,28 @@ function checkAgentStatus(agentDir, stale, logMtime, isTeam) {
   return result;
 }
 
+// isContained canonicalises both sides with realpath, which costs ~100x a plain
+// path.join. This is called once per session on the /api/sessions hot path, and
+// the verdict for a given name cannot change while TEAMS_DIR is fixed — so the
+// resolved path (or the null rejection) is memoized.
+const teamPathCache = new Map();
+const TEAM_PATH_CACHE_MAX = 1000;
+
+function teamConfigPath(teamName) {
+  if (typeof teamName !== 'string' || !teamName) return null;
+  if (teamPathCache.has(teamName)) return teamPathCache.get(teamName);
+  const candidate = path.join(TEAMS_DIR, teamName, 'config.json');
+  // TEAMS_DIR follows --dir / CLAUDE_CONFIG_DIR, so containment is checked against
+  // the module-level constant rather than a hardcoded ~/.claude/teams.
+  const configPath = isContained(candidate, TEAMS_DIR) ? candidate : null;
+  if (teamPathCache.size >= TEAM_PATH_CACHE_MAX) teamPathCache.clear();
+  teamPathCache.set(teamName, configPath);
+  return configPath;
+}
+
 function isTeamSession(sessionId) {
-  return existsSync(path.join(TEAMS_DIR, sessionId, 'config.json'));
+  const configPath = teamConfigPath(sessionId);
+  return !!configPath && existsSync(configPath);
 }
 
 const teamConfigCache = new Map();
@@ -264,8 +297,8 @@ function loadTeamConfig(teamName) {
   const cached = teamConfigCache.get(teamName);
   if (cached && Date.now() - cached.ts < TEAM_CACHE_TTL) return cached.data;
   try {
-    const configPath = path.join(TEAMS_DIR, teamName, 'config.json');
-    if (!existsSync(configPath)) return null;
+    const configPath = teamConfigPath(teamName);
+    if (!configPath || !existsSync(configPath)) return null;
     const data = JSON.parse(readFileSync(configPath, 'utf8'));
     teamConfigCache.set(teamName, { data, ts: Date.now() });
     return data;
@@ -416,6 +449,12 @@ app.param('taskId', (req, res, next, val) => {
   if (!isSafeId(val)) return res.status(400).json({ error: 'Invalid task ID' });
   next();
 });
+// Team names are directory names under TEAMS_DIR, so /api/teams/:name was a
+// straight traversal before this.
+app.param('name', (req, res, next, val) => {
+  if (!isSafeId(val)) return res.status(400).json({ error: 'Invalid team name' });
+  next();
+});
 
 // Parse JSON bodies
 app.use(express.json());
@@ -633,6 +672,7 @@ function refreshSessionMetadataPath(jsonlPath) {
   // Direct assign (not guarded) so a /goal clear propagates as null.
   existing.goal = info.goal || null;
   if (info.logicalParentUuid) existing.logicalParentUuid = info.logicalParentUuid;
+  if (info.compactBoundaryUuid) existing.compactBoundaryUuid = info.compactBoundaryUuid;
   return true;
 }
 
@@ -719,7 +759,8 @@ function loadSessionMetadata() {
           customTitle: sessionInfo.customTitle || null,
           goal: sessionInfo.goal || null,
           jsonlPath: jsonlPath,
-          logicalParentUuid: sessionInfo.logicalParentUuid || null
+          logicalParentUuid: sessionInfo.logicalParentUuid || null,
+          compactBoundaryUuid: sessionInfo.compactBoundaryUuid || null
         };
         sessionIds.push(sessionId);
       }
@@ -1249,15 +1290,22 @@ app.get('/api/sessions', async (req, res) => {
 
     // Suppress parent sessions that have a compact continuation — compaction is involuntary
     // (context limit hit), not an intentional fork. Only the continuation is shown.
+    // A fork off an already-compacted transcript looks identical from the metadata alone
+    // (its copied compact_boundary gives the child a logicalParentUuid), so the verdict
+    // comes from lookupParentSession, not from the anchor's presence.
     const compactSuppressed = new Set();
     for (const [sid] of sessionsMap) {
-      const compactAnchor = metadata[sid]?.logicalParentUuid;
-      if (!compactAnchor) continue;
+      // Cheap pre-gate: only a session with a boundary anchor can be a continuation,
+      // and lookupParentSession reads JSONLs on a cold cache.
+      if (!metadata[sid]?.logicalParentUuid) continue;
       const parent = lookupParentSession(sid);
-      if (parent.parentSessionId && sessionsMap.has(parent.parentSessionId)) {
-        compactSuppressed.add(parent.parentSessionId);
-        sessionsMap.get(sid).continuedFromSessionId = parent.parentSessionId;
-      }
+      if (parent.relation !== 'compact' || !sessionsMap.has(parent.parentSessionId)) continue;
+      compactSuppressed.add(parent.parentSessionId);
+      sessionsMap.get(sid).continuedFromSessionId = parent.parentSessionId;
+    }
+    // Invariant: a running process is never a superseded lineage, whatever the heuristics say.
+    if (compactSuppressed.size) {
+      for (const s of loadLiveSessions()) compactSuppressed.delete(s.sessionId);
     }
     for (const sid of compactSuppressed) sessionsMap.delete(sid);
 
@@ -1652,17 +1700,12 @@ app.get('/api/sessions/:sessionId/workflows/:wfId/run', async (req, res) => {
   }
 });
 
-function openInEditor(...targets) {
-  const editor = process.env.EDITOR || 'code';
-  spawn(editor, ['-n', ...targets], { shell: true, stdio: 'ignore', detached: true }).unref();
-}
-
 // API: Open a workflow script in VS Code
 app.post('/api/sessions/:sessionId/workflows/:wfId/open', (req, res) => {
   try {
     const wf = getWorkflowScripts(req.params.sessionId).find((w) => w.id === req.params.wfId);
     if (!wf) return res.status(404).json({ error: 'Workflow script not found' });
-    openInEditor(wf.path);
+    openInEditor([wf.path]);
     res.json({ success: true });
   } catch (error) {
     console.error('Error opening workflow script in editor:', error);
@@ -1681,7 +1724,7 @@ app.post('/api/sessions/:sessionId/plan/open', (req, res) => {
     const planPath = path.join(PLANS_DIR, `${slug}.md`);
     if (!existsSync(planPath)) return res.status(404).json({ error: 'No plan found' });
 
-    openInEditor(planPath);
+    openInEditor([planPath]);
     res.json({ success: true });
   } catch (error) {
     console.error('Error opening plan in editor:', error);
@@ -1693,10 +1736,12 @@ app.post('/api/sessions/:sessionId/plan/open', (req, res) => {
 app.post('/api/open-folder', (req, res) => {
   try {
     const { folder, file } = req.body;
-    const target = folder || CLAUDE_DIR;
-    openInEditor(target, ...(file ? [file] : []));
+    const targets = [folder ? assertOpenTarget(folder, 'folder') : CLAUDE_DIR];
+    if (file) targets.push(assertOpenTarget(file, 'file'));
+    openInEditor(targets);
     res.json({ success: true });
   } catch (error) {
+    if (error.status) return res.status(error.status).json({ error: error.message });
     console.error('Error opening folder:', error);
     res.status(500).json({ error: 'Failed to open folder' });
   }
@@ -1707,8 +1752,9 @@ app.post('/api/open-in-editor', (req, res) => {
   try {
     const { content, title, file } = req.body;
     if (file) {
-      openInEditor(file);
-      return res.json({ success: true, path: file });
+      const resolved = assertOpenTarget(file, 'file');
+      openInEditor([resolved]);
+      return res.json({ success: true, path: resolved });
     }
     if (!content) return res.status(400).json({ error: 'No content provided' });
 
@@ -1717,9 +1763,10 @@ app.post('/api/open-in-editor', (req, res) => {
     const tmpFile = path.join(os.tmpdir(), `claude-kanban-${safeName}-${hash}.md`);
     require('fs').writeFileSync(tmpFile, content, 'utf8');
 
-    openInEditor(tmpFile);
+    openInEditor([tmpFile]);
     res.json({ success: true, path: tmpFile });
   } catch (error) {
+    if (error.status) return res.status(error.status).json({ error: error.message });
     console.error('Error opening in editor:', error);
     res.status(500).json({ error: 'Failed to open in editor' });
   }
@@ -2091,12 +2138,14 @@ function findForkAnchorUuid(jsonlPath) {
   }
   return firstUuid;
 }
-// Fallback when metadata cache lacks logicalParentUuid (older entries, cold cache).
-// Hot path reads from metadata directly; this never runs from the suppression loop.
+// Fallback when the metadata cache lacks the boundary pair (older entries, cold cache).
+// Reached only from lookupParentSession, whose result is memoized for the process life —
+// at most one read per session, never per request.
 // Bounded read (~1 MB) mirrors readSessionInfoFromJsonl's HEAD_MAX — compact_boundary
 // always sits in the preamble before the first user/assistant record.
 const COMPACT_ANCHOR_READ_MAX = 1048576;
-function findCompactAnchorUuid(jsonlPath) {
+// Returns { anchor, boundaryUuid } for the preamble compact_boundary, or null.
+function findCompactBoundary(jsonlPath) {
   let fd;
   try {
     fd = openSync(jsonlPath, 'r');
@@ -2110,17 +2159,23 @@ function findCompactAnchorUuid(jsonlPath) {
       try {
         const d = JSON.parse(l);
         if (d.type === 'user' || d.type === 'assistant') return null;
-        if (d.subtype === 'compact_boundary' && d.logicalParentUuid) return d.logicalParentUuid;
+        if (d.subtype === 'compact_boundary' && d.logicalParentUuid) {
+          return { anchor: d.logicalParentUuid, boundaryUuid: d.uuid || null };
+        }
       } catch { /* skip malformed */ }
     }
     return null;
   } catch { return null; }
   finally { if (fd !== undefined) { try { closeSync(fd); } catch {} } }
 }
-function findSessionContainingUuid(projectDir, targetUuid, excludeJsonlPath, maxBirthtimeMs) {
+// forkProbeUuid (optional): the child's own compact_boundary uuid. It only shows up
+// in the parent when the child copied the record — i.e. a fork off an already-compacted
+// transcript, not a compact continuation. Probed once, on the winner's text, which the
+// scan already read.
+function findSessionContainingUuid(projectDir, targetUuid, excludeJsonlPath, maxBirthtimeMs, forkProbeUuid) {
   let files;
   try { files = readdirSync(projectDir); } catch { return null; }
-  let best = null;
+  let best = null, bestBirthtime = Infinity, bestText = null;
   for (const f of files) {
     if (!f.endsWith('.jsonl')) continue;
     const fp = path.join(projectDir, f);
@@ -2128,7 +2183,7 @@ function findSessionContainingUuid(projectDir, targetUuid, excludeJsonlPath, max
     let birthtime = 0;
     try { birthtime = statSync(fp).birthtimeMs; } catch { continue; }
     if (maxBirthtimeMs != null && birthtime >= maxBirthtimeMs) continue;
-    if (best && birthtime >= best.birthtime) continue;
+    if (birthtime >= bestBirthtime) continue;
     let text;
     try { text = readFileSync(fp, 'utf8'); } catch { continue; }
     if (!text.includes(targetUuid)) continue;
@@ -2137,32 +2192,51 @@ function findSessionContainingUuid(projectDir, targetUuid, excludeJsonlPath, max
       try {
         const d = JSON.parse(l);
         if (d.uuid === targetUuid && d.sessionId) {
-          best = { parentSessionId: d.sessionId, parentJsonlPath: fp, birthtime };
+          best = { parentSessionId: d.sessionId, parentJsonlPath: fp, isFork: false };
+          bestBirthtime = birthtime;
+          bestText = text;
           break;
         }
       } catch { /* skip */ }
     }
   }
   if (!best) return null;
-  return { parentSessionId: best.parentSessionId, parentJsonlPath: best.parentJsonlPath };
+  if (forkProbeUuid) best.isFork = bestText.includes(forkProbeUuid);
+  return best;
 }
 function lookupParentSession(sessionId) {
   if (parentSessionCache.has(sessionId)) return parentSessionCache.get(sessionId);
   const meta = loadSessionMetadata()[sessionId];
-  const result = { parentSessionId: null, parentJsonlPath: null, isCompact: false };
+  // relation is the single verdict: 'none' (no parent found), 'compact' (this session
+  // continues a lineage the parent could not hold) or 'fork' (an intentional branch off
+  // a parent that keeps its own life). isCompact/isFork are derived views of it.
+  const result = { parentSessionId: null, parentJsonlPath: null, relation: 'none', isCompact: false, isFork: false };
   if (meta?.jsonlPath) {
-    const compactAnchor = meta.logicalParentUuid || findCompactAnchorUuid(meta.jsonlPath);
-    result.isCompact = !!compactAnchor;
+    // Metadata entries cached before compactBoundaryUuid existed carry the anchor
+    // without the boundary uuid — re-read rather than lose fork detection.
+    const boundary = (meta.logicalParentUuid && meta.compactBoundaryUuid)
+      ? { anchor: meta.logicalParentUuid, boundaryUuid: meta.compactBoundaryUuid }
+      : findCompactBoundary(meta.jsonlPath);
+    const compactAnchor = boundary?.anchor ?? meta.logicalParentUuid ?? null;
+    // A fork copies the parent's early records verbatim, so its first uuid is the anchor.
     const anchorUuid = compactAnchor ?? findForkAnchorUuid(meta.jsonlPath);
     if (anchorUuid) {
       let selfBirthtime;
       try { selfBirthtime = statSync(meta.jsonlPath).birthtimeMs; } catch { /* ignore */ }
       if (selfBirthtime != null) {
-        const hit = findSessionContainingUuid(path.dirname(meta.jsonlPath), anchorUuid, meta.jsonlPath, selfBirthtime);
-        if (hit) Object.assign(result, hit);
+        const hit = findSessionContainingUuid(path.dirname(meta.jsonlPath), anchorUuid, meta.jsonlPath, selfBirthtime, boundary?.boundaryUuid);
+        if (hit) {
+          // No compact boundary at all → fork by construction; with one, the copied
+          // boundary uuid (hit.isFork) is what separates a fork from a continuation.
+          result.parentSessionId = hit.parentSessionId;
+          result.parentJsonlPath = hit.parentJsonlPath;
+          result.relation = (!compactAnchor || hit.isFork) ? 'fork' : 'compact';
+        }
       }
     }
   }
+  result.isCompact = result.relation === 'compact';
+  result.isFork = result.relation === 'fork';
   parentSessionCache.set(sessionId, result);
   return result;
 }
@@ -2656,12 +2730,36 @@ async function validatePreviewFile(absPath) {
 
 async function readPreviewFile(absPath) {
   const { kind } = await validatePreviewFile(absPath);
-  return { content: await fs.readFile(absPath, 'utf8'), kind };
+  const raw = await fs.readFile(absPath, 'utf8');
+  if (kind !== 'html') return { content: raw, kind };
+  // The client renders HTML into a `srcdoc` iframe, which has no base URL — sibling
+  // assets have to travel inside the document or they never load.
+  try {
+    const { html, skipped } = await inlineHtmlAssets(raw, absPath);
+    for (const s of skipped) {
+      console.warn(`Preview: skipped inlining ${s.path} (${s.reason}, ${s.size} bytes)`);
+    }
+    return { content: html, kind };
+  } catch (e) {
+    // Inlining is an enhancement: a failure here must not cost the user the preview.
+    console.error('Preview: asset inlining failed, serving as authored:', e.message);
+    return { content: raw, kind };
+  }
+}
+
+// Paths copied out of a browser or a slide deck carry a URL fragment
+// ("deck.html#10"). Dropped only when the literal path is missing and the trimmed one
+// exists, so a filename that genuinely contains '#' still resolves to itself.
+function dropUrlFragment(abs) {
+  const i = abs.lastIndexOf('#');
+  if (i <= 0 || existsSync(abs)) return abs;
+  const trimmed = abs.slice(0, i);
+  return existsSync(trimmed) ? trimmed : abs;
 }
 
 function resolvePreviewPath(filePath, base) {
   if (!filePath || typeof filePath !== 'string') return null;
-  if (path.isAbsolute(filePath)) return filePath;
+  if (path.isAbsolute(filePath)) return dropUrlFragment(filePath);
   if (base && typeof base === 'string' && path.isAbsolute(base)) {
     let baseDir = base;
     try {
@@ -2670,9 +2768,9 @@ function resolvePreviewPath(filePath, base) {
       // base doesn't exist — fall back to dirname if it looks like a file
       if (path.extname(base)) baseDir = path.dirname(base);
     }
-    return path.resolve(baseDir, filePath);
+    return dropUrlFragment(path.resolve(baseDir, filePath));
   }
-  return path.resolve(filePath);
+  return dropUrlFragment(path.resolve(filePath));
 }
 
 app.post('/api/preview', async (req, res) => {
@@ -3102,28 +3200,23 @@ async function prewarmCaches() {
   }
 }
 
-  const server = app.listen(PORT, () => {
-    const actualPort = server.address().port;
+  const onReady = (actualPort) => {
     console.log(`Claude Task Kanban running at http://localhost:${actualPort}`);
+    const warning = net.exposureWarning();
+    if (warning) console.log(warning);
 
     if (process.argv.includes('--open')) {
       import('open').then(open => open.default(`http://localhost:${actualPort}`));
     }
     setImmediate(prewarmCaches);
-  });
+  };
+
+  const server = net.listenLoopback(app, PORT, onReady);
 
   server.on('error', (err) => {
     if (err.code === 'EADDRINUSE') {
       console.log(`Port ${PORT} in use, trying random port...`);
-      const fallback = app.listen(0, () => {
-        const actualPort = fallback.address().port;
-        console.log(`Claude Task Kanban running at http://localhost:${actualPort}`);
-
-        if (process.argv.includes('--open')) {
-          import('open').then(open => open.default(`http://localhost:${actualPort}`));
-        }
-        setImmediate(prewarmCaches);
-      });
+      net.listenLoopback(app, 0, onReady);
     } else {
       throw err;
     }