claude-code-session-manager 0.13.0 → 0.14.0

package/src/main/lib/insideHome.cjs

@@ -1,16 +1,25 @@
 /**
- * insideHome.cjs — security invariant: every renderer-controlled cwd must
- * resolve (after realpath, symlink-safe) to a path inside the user's home
- * directory. Four call sites used to reimplement this: pty.cjs spawn,
- * watchers.cjs add, index.cjs checkInsideHome, ipcSchemas.cjs setConfigSchema
- * defaultCwd refine. The check is a single chokepoint here.
+ * insideHome.cjs — single chokepoint for "is this renderer-controlled path
+ * inside $HOME?" Security boundary: bare `startsWith(home)` matches
+ * `/home/bilkoEVIL` when home=`/home/bilko` (the classic prefix-trap). Both
+ * the target and the home directory are resolved via realpath, and the
+ * boundary is either exact equality or a path-separator boundary.
  *
- * Returns { ok: true, realCwd } on success or { ok: false, error } on rejection.
- * Realpath of the cwd is returned so callers can use it without recomputing.
+ * Two exports, two policies:
+ *   assertInsideHome(p) → { realPath }                — throws on failure
+ *   checkInsideHome(p)  → { ok, realPath } | { ok, error }  — never throws
  *
- * NOTE: schemas can't easily call this (zod refines are inline); they retain
- * a simpler `startsWith` check that does NOT symlink-resolve. The runtime
- * resolution here is the authoritative one — schemas are belt-and-suspenders.
+ * Both follow the same algorithm:
+ *   1. realpath the target. On ENOENT, fall back to path.resolve(p) so callers
+ *      can validate "this is where I'm about to write" before the file exists.
+ *   2. Compare against the cached realpath of os.homedir() with the
+ *      equality-or-separator boundary check.
+ *
+ * The cached home realpath is computed once at module load. If $HOME can't be
+ * resolved at startup we keep going with the literal value — boot-time
+ * self-check in index.cjs surfaces that to the user.
+ *
+ * Linux + darwin only. No Windows path handling.
  */
 'use strict';
 
@@ -18,21 +27,65 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 
-function assertCwdInsideHome(cwd) {
-  if (typeof cwd !== 'string' || !cwd) {
-    return { ok: false, error: 'cwd must be a non-empty string' };
+// Resolve home once. Falls back to literal homedir if realpath fails
+// (which would be a misconfigured system; boot self-check in index.cjs
+// surfaces it). Cached for the lifetime of the process — home doesn't
+// move under us at runtime.
+const HOME_LITERAL = os.homedir();
+let HOME_REAL;
+try {
+  HOME_REAL = fs.realpathSync(HOME_LITERAL);
+} catch {
+  HOME_REAL = HOME_LITERAL;
+}
+
+function resolveTarget(p) {
+  // realpath fails with ENOENT for paths that don't exist yet (writes,
+  // mkdir destinations). Fall through to lexical resolve so the containment
+  // check still applies — prevents info-disclosure via stat probes on
+  // /etc/secrets/... that would be rejected later but reveal existence first.
+  try {
+    return fs.realpathSync(p);
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return path.resolve(p);
+    throw err;
+  }
+}
+
+function isContained(realPath) {
+  return realPath === HOME_REAL || realPath.startsWith(HOME_REAL + path.sep);
+}
+
+function assertInsideHome(p) {
+  if (typeof p !== 'string' || !p) {
+    throw new Error('path outside home');
+  }
+  let realPath;
+  try {
+    realPath = resolveTarget(p);
+  } catch {
+    throw new Error('path outside home');
+  }
+  if (!isContained(realPath)) {
+    throw new Error('path outside home');
+  }
+  return { realPath };
+}
+
+function checkInsideHome(p) {
+  if (typeof p !== 'string' || !p) {
+    return { ok: false, error: 'path outside home' };
   }
-  const home = os.homedir();
-  let realCwd;
+  let realPath;
   try {
-    realCwd = fs.realpathSync(cwd);
+    realPath = resolveTarget(p);
   } catch {
-    realCwd = path.resolve(cwd);
+    return { ok: false, error: 'path outside home' };
   }
-  if (realCwd !== home && !realCwd.startsWith(home + path.sep)) {
-    return { ok: false, error: `cwd outside home directory: ${realCwd}` };
+  if (!isContained(realPath)) {
+    return { ok: false, error: 'path outside home' };
   }
-  return { ok: true, realCwd };
+  return { ok: true, realPath };
 }
 
-module.exports = { assertCwdInsideHome };
+module.exports = { assertInsideHome, checkInsideHome };

package/src/main/lib/openExternalApp.cjs

@@ -0,0 +1,141 @@
+/**
+ * openExternalApp.cjs — helpers for launching editor / file manager / terminal.
+ *
+ * Security invariant: callers (IPC handlers in index.cjs) MUST run containment
+ * checks before delegating here. These functions receive already-validated paths.
+ *
+ * All four functions return:
+ *   { ok: true;  opener: string }  — name of the program that was launched
+ *   { ok: false; error: string }   — human-readable failure reason
+ */
+'use strict';
+
+const { execFileSync, spawn } = require('node:child_process');
+const path = require('node:path');
+const fsp = require('node:fs/promises');
+const { shell } = require('electron');
+const { cleanChildEnv } = require('./cleanEnv.cjs');
+
+// IMAGE_RE — extensions opened in the OS default viewer, not a code editor.
+// Keep in sync with the comment in index.cjs open-file-in-editor handler.
+const IMAGE_RE = /\.(png|jpe?g|gif|webp|bmp|svg|tiff?|avif|heic|ico)$/i;
+
+// EDITOR_CANDIDATES — single source for the default editor resolution order (AC #5).
+// process.env.VISUAL / EDITOR are read lazily so they pick up any runtime overrides.
+const editorCandidates = () =>
+  [process.env.VISUAL, process.env.EDITOR, 'code', 'cursor', 'subl', 'nano'].filter(Boolean);
+
+/**
+ * Returns the resolved path of a command, or null if not found on $PATH.
+ * Moved here from index.cjs (was the only caller of the local helper there).
+ */
+function findCommand(name) {
+  try {
+    const out = execFileSync(
+      process.platform === 'win32' ? 'where' : 'which',
+      [name],
+      { encoding: 'utf8', env: process.env, timeout: 500 },
+    ).trim().split(/\r?\n/)[0];
+    if (out) return out;
+  } catch { /* not found */ }
+  return null;
+}
+
+/**
+ * Open a project root directory in the user's editor.
+ *
+ * @param {{ cwd: string, editor?: string | null }} opts
+ * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
+ */
+async function openInEditor({ cwd, editor }) {
+  const candidates = (editor && editor !== 'auto') ? [editor] : editorCandidates();
+  for (const cmd of candidates) {
+    if (!findCommand(cmd)) continue;
+    spawn(cmd, [cwd], { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
+    return { ok: true, opener: cmd };
+  }
+  return { ok: false, error: 'no editor found' };
+}
+
+/**
+ * Open a specific file (with optional line:col) in the user's editor.
+ * Image files are routed to the OS default viewer via shell.openPath.
+ *
+ * The path MUST already have passed containment checks at the IPC boundary.
+ * `abs` must be an absolute path.
+ *
+ * Goto-line flag behavior (AC #6):
+ *   code | cursor | subl  → spawn with ['-g', 'file:line:col']
+ *   everything else        → spawn with ['file']  (bare path, no goto support)
+ *
+ * @param {{ path: string, line?: number, col?: number, editor?: string | null }} opts
+ * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
+ */
+async function openFileInEditor({ path: abs, line, col, editor }) {
+  try { await fsp.access(abs); } catch { return { ok: false, error: `file not found: ${abs}` }; }
+
+  // Image fast path — use the OS default viewer instead of a code editor.
+  // path.basename avoids .tar.gz-style extension ambiguities (AC implementation note).
+  if (IMAGE_RE.test(path.basename(abs))) {
+    const errStr = await shell.openPath(abs);
+    if (errStr) return { ok: false, error: errStr };
+    return { ok: true, opener: 'shell' };
+  }
+
+  const candidates = (editor && editor !== 'auto') ? [editor] : editorCandidates();
+  for (const cmd of candidates) {
+    if (!findCommand(cmd)) continue;
+    // Only code/cursor/subl understand the -g goto-line flag (AC #6).
+    const supportsGoto = /^(code|cursor|subl)$/.test(cmd);
+    const target = (supportsGoto && line) ? `${abs}:${line}${col ? `:${col}` : ''}` : abs;
+    const args = supportsGoto ? ['-g', target] : [abs];
+    spawn(cmd, args, { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
+    return { ok: true, opener: cmd };
+  }
+  return { ok: false, error: 'no editor found' };
+}
+
+/**
+ * Open a directory in the OS file manager (Finder on macOS, Nautilus etc on Linux).
+ *
+ * @param {{ cwd: string }} opts
+ * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
+ */
+async function openInFinder({ cwd }) {
+  const errStr = await shell.openPath(cwd);
+  if (errStr) return { ok: false, error: errStr };
+  return { ok: true, opener: 'shell' };
+}
+
+/**
+ * Open a terminal emulator in the given directory.
+ *
+ * Linux: tries gnome-terminal → konsole → xfce4-terminal → xterm.
+ * macOS: delegates to Terminal.app via `open -a`.
+ *
+ * Arg shapes per terminal are preserved verbatim from index.cjs (AC impl note):
+ *   gnome-terminal  → ['--working-directory=<cwd>']
+ *   others          → ['-e', "bash -c \"cd '<cwd>' && exec bash\""]
+ *
+ * @param {{ cwd: string }} opts
+ * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
+ */
+async function openInTerminal({ cwd }) {
+  if (process.platform === 'linux') {
+    const terms = ['gnome-terminal', 'konsole', 'xfce4-terminal', 'xterm'];
+    for (const t of terms) {
+      if (!findCommand(t)) continue;
+      const args = t === 'gnome-terminal'
+        ? ['--working-directory=' + cwd]
+        : ['-e', `bash -c "cd '${cwd.replace(/'/g, "'\\''")}' && exec bash"`];
+      spawn(t, args, { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
+      return { ok: true, opener: t };
+    }
+  } else if (process.platform === 'darwin') {
+    spawn('open', ['-a', 'Terminal', cwd], { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
+    return { ok: true, opener: 'Terminal.app' };
+  }
+  return { ok: false, error: 'no terminal found' };
+}
+
+module.exports = { findCommand, openInEditor, openFileInEditor, openInFinder, openInTerminal };

package/src/main/pluginInstall.cjs

@@ -28,6 +28,7 @@ const { schemas } = require('./ipcSchemas.cjs');
 const SLUG_RE = /^[a-z0-9\-/]+$/;
 const MAX_LINE_BYTES = 16 * 1024;
 const KILL_AFTER_MS = 5 * 60 * 1000; // 5 min hard ceiling per install
+const KILL_GRACE_MS = 5_000;          // SIGTERM → SIGKILL escalation window
 
 let mainWindow = null;
 const inFlight = new Map(); // slug -> proc
@@ -81,9 +82,28 @@ function install({ slug }) {
     inFlight.set(slug, proc);
 
     let lineBuf = '';
+    let settled = false;
+
     const killTimer = setTimeout(() => {
-      try { proc.kill(); } catch { /* */ }
+      try { proc.kill('SIGTERM'); } catch { /* */ }
+      // Escalate to SIGKILL after KILL_GRACE_MS if the pty hasn't exited.
+      const escalate = setTimeout(() => {
+        try { proc.kill('SIGKILL'); } catch { /* already dead */ }
+      }, KILL_GRACE_MS);
+      if (escalate.unref) escalate.unref();
     }, KILL_AFTER_MS);
+    if (killTimer.unref) killTimer.unref();
+
+    // Belt-and-suspenders: if onExit never fires (broken pty event path after
+    // SIGKILL — analogous to anthropics/claude-code #61735's unreachable pts),
+    // force-release the inFlight lock so the slug isn't permanently stuck.
+    const deadman = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      inFlight.delete(slug);
+      resolve({ ok: false, exitCode: -1, error: 'install hung — pty onExit never fired' });
+    }, KILL_AFTER_MS + KILL_GRACE_MS + 30_000);
+    if (deadman.unref) deadman.unref();
 
     proc.onData((data) => {
       lineBuf += data;
@@ -101,7 +121,10 @@ function install({ slug }) {
     });
 
     proc.onExit(({ exitCode }) => {
+      if (settled) return;
+      settled = true;
       clearTimeout(killTimer);
+      clearTimeout(deadman);
       if (lineBuf.length > 0) {
         send('plugins:install-progress', { slug, line: lineBuf });
         lineBuf = '';
@@ -124,6 +147,21 @@ function registerPluginInstallHandlers() {
     }
     return install({ slug: parsed.data.slug });
   });
+
+  // plugins:abort — send SIGKILL to a stuck install and release the inFlight
+  // lock immediately, analogous to pty:kill. UI wiring is a follow-up PRD.
+  ipcMain.handle('plugins:abort', async (_e, payload) => {
+    const parsed = schemas.pluginsAbort.safeParse(payload);
+    if (!parsed.success) {
+      return { ok: false, error: 'invalid slug' };
+    }
+    const { slug } = parsed.data;
+    const proc = inFlight.get(slug);
+    if (!proc) return { ok: false, error: 'no install in progress for slug' };
+    try { proc.kill('SIGKILL'); } catch { /* */ }
+    inFlight.delete(slug);
+    return { ok: true };
+  });
 }
 
 module.exports = { registerPluginInstallHandlers, attachWindow };

package/src/main/pty.cjs

@@ -5,7 +5,7 @@ const os = require('node:os');
 const fs = require('node:fs');
 const { addAllowedRoot } = require('./config.cjs');
 const { cleanChildEnv } = require('./lib/cleanEnv.cjs');
-const { assertCwdInsideHome } = require('./lib/insideHome.cjs');
+const { checkInsideHome } = require('./lib/insideHome.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 
 /**
@@ -28,9 +28,9 @@ class PtyManager {
 
     // Validate that cwd is inside homedir before widening the allowed-root set.
     if (cwd) {
-      const r = assertCwdInsideHome(cwd);
+      const r = checkInsideHome(cwd);
       if (!r.ok) throw new Error(`pty ${r.error}`);
-      addAllowedRoot(r.realCwd);
+      addAllowedRoot(r.realPath);
     }
 
     // Idempotent reattach: renderer reloads (HMR/Ctrl+R) re-run App.tsx's
@@ -164,6 +164,9 @@ class PtyManager {
       }
       this.sessions.delete(tabId);
     }
+    // Always drop superagent run state — a run can be started before the pty
+    // finishes spawning, so clean up regardless of whether a session existed.
+    try { require('./superagent.cjs').dropTab(tabId); } catch { /* superagent not loaded (e2e) */ }
   }
 
   killAll() {
@@ -178,7 +181,11 @@ function registerPtyHandlers() {
   ipcMain.handle('pty:spawn', v(s.ptySpawn, (payload) => manager.spawn(payload)));
   ipcMain.on('pty:write', (_e, payload) => { try { manager.write(s.ptyWrite.parse(payload)); } catch { /* ignore */ } });
   ipcMain.on('pty:resize', (_e, payload) => { try { manager.resize(s.ptyResize.parse(payload)); } catch { /* ignore */ } });
-  ipcMain.on('pty:kill', (_e, tabId) => { if (typeof tabId === 'string') manager.kill(tabId); });
+  ipcMain.on('pty:kill', (_e, tabId) => {
+    if (typeof tabId !== 'string') return;
+    manager.kill(tabId);
+    try { require('./superagent.cjs').dropTab(tabId); } catch { /* superagent module not initialized (e2e) */ }
+  });
 }
 
 module.exports = { manager, registerPtyHandlers };

package/src/main/queueOps.cjs

@@ -37,6 +37,7 @@ const { ipcMain } = require('electron');
 const { SCHEDULE_SLUG_RE: SLUG_RE, schemas } = require('./ipcSchemas.cjs');
 const logs = require('./logs.cjs');
 const config = require('./config.cjs');
+const { expandHome } = require('./lib/expandHome.cjs');
 
 const ROOT = path.join(os.homedir(), '.claude', 'session-manager', 'scheduled-plans');
 const PRDS_DIR = path.join(ROOT, 'prds');
@@ -114,8 +115,7 @@ function lintParsed(slug, raw) {
     findings.push({ rule: 'missing-cwd', line: 1, snippet: 'frontmatter "cwd" is required', severity: 'error' });
   } else {
     // cwd existence — only if it looks like an absolute path. ~ -> homedir.
-    let candidate = fm.cwd;
-    if (candidate.startsWith('~/')) candidate = path.join(os.homedir(), candidate.slice(2));
+    const candidate = expandHome(fm.cwd);
     if (path.isAbsolute(candidate)) {
       try {
         fs.accessSync(candidate, fs.constants.F_OK);