npm - claude-code-session-manager - Versions diffs - 0.35.13 → 0.35.14 - Mend

claude-code-session-manager 0.35.13 → 0.35.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/dist/assets/{TiptapBody-B_2hT1QJ.js → TiptapBody-o1hQcwtq.js} +1 -1
package/dist/assets/index-B39Qiq0n.css +32 -0
package/dist/assets/{index-LqC9hNy3.js → index-DqWSSMkp.js} +463 -463
package/dist/index.html +2 -2
package/package.json +1 -1
package/src/main/__tests__/browserAgentServer.test.cjs +186 -0
package/src/main/__tests__/scheduler-autofix-select.test.cjs +45 -0
package/src/main/browserAgentServer.cjs +202 -0
package/src/main/browserView.cjs +197 -1
package/src/main/index.cjs +11 -0
package/src/main/lib/__tests__/browserAgentActions.test.cjs +76 -0
package/src/main/lib/browserAgentActions.cjs +114 -0
package/src/main/lib/schedulerBatch.cjs +40 -33
package/src/main/scheduler.cjs +105 -13
package/src/preload/api.d.ts +8 -2
package/dist/assets/index-C7NyYuXu.css +0 -32

package/dist/index.html CHANGED Viewed

@@ -7,10 +7,10 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-LqC9hNy3.js"></script>
+    <script type="module" crossorigin src="./assets/index-DqWSSMkp.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
-    <link rel="stylesheet" crossorigin href="./assets/index-C7NyYuXu.css">
+    <link rel="stylesheet" crossorigin href="./assets/index-B39Qiq0n.css">
   </head>
   <body class="bg-bg text-fg font-sans antialiased">
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.35.13",
+  "version": "0.35.14",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/src/main/__tests__/browserAgentServer.test.cjs ADDED Viewed

@@ -0,0 +1,186 @@
+/**
+ * browserAgentServer.test.cjs — unit tests for the loopback-only browser
+ * agent HTTP API (PRD 535).
+ *
+ * Run: timeout 120 node --test src/main/__tests__/browserAgentServer.test.cjs
+ */
+'use strict';
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { createBrowserAgentServer } = require('../browserAgentServer.cjs');
+function request(port, { method = 'GET', path: reqPath, token, body }) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    if (token !== undefined) headers.Authorization = `Bearer ${token}`;
+    let payload;
+    if (body !== undefined) {
+      payload = JSON.stringify(body);
+      headers['Content-Type'] = 'application/json';
+      headers['Content-Length'] = Buffer.byteLength(payload);
+    }
+    const req = http.request({ hostname: '127.0.0.1', port, method, path: reqPath, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null;
+        try { json = JSON.parse(text); } catch { /* leave null for non-JSON bodies */ }
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+function makeFakeRemote() {
+  const actions = [];
+  return {
+    actions,
+    async listTabs() {
+      return [{ viewId: 'v1', url: 'https://example.com', title: 'Example', active: true }];
+    },
+    async screenshot({ viewId }) {
+      if (!viewId && viewId !== undefined) return { ok: false, error: 'unknown viewId' };
+      return { ok: true, viewId: viewId || 'v1', dataUrl: 'data:image/png;base64,AAA', scale: 1 };
+    },
+    async action(params) {
+      actions.push(params);
+      if (params.action === 'boom') return { ok: false, error: 'unsupported action: boom' };
+      return { ok: true };
+    },
+    async dom({ viewId }) {
+      return { ok: true, viewId: viewId || 'v1', text: 'hello', elements: [] };
+    },
+  };
+}
+test('rejects requests without a bearer token', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port } = await server.start();
+  try {
+    const res = await request(port, { path: '/agent/browser/tabs' });
+    assert.equal(res.status, 401);
+    assert.equal(res.json.ok, false);
+  } finally {
+    await server.stop();
+  }
+});
+test('rejects requests with a wrong token', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port } = await server.start();
+  try {
+    const res = await request(port, { path: '/agent/browser/tabs', token: 'wrong-token' });
+    assert.equal(res.status, 401);
+  } finally {
+    await server.stop();
+  }
+});
+test('GET /agent/browser/tabs lists open tabs', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port, token } = await server.start();
+  try {
+    const res = await request(port, { path: '/agent/browser/tabs', token });
+    assert.equal(res.status, 200);
+    assert.equal(res.json.ok, true);
+    assert.equal(res.json.tabs.length, 1);
+    assert.equal(res.json.tabs[0].active, true);
+  } finally {
+    await server.stop();
+  }
+});
+test('POST /agent/browser/screenshot returns a resized image payload', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port, token } = await server.start();
+  try {
+    const res = await request(port, { method: 'POST', path: '/agent/browser/screenshot', token, body: {} });
+    assert.equal(res.status, 200);
+    assert.equal(res.json.ok, true);
+    assert.ok(res.json.dataUrl.startsWith('data:image/png'));
+  } finally {
+    await server.stop();
+  }
+});
+test('POST /agent/browser/action dispatches a single action', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port, token } = await server.start();
+  try {
+    const res = await request(port, {
+      method: 'POST',
+      path: '/agent/browser/action',
+      token,
+      body: { action: 'left_click', coordinate: [10, 20] },
+    });
+    assert.equal(res.status, 200);
+    assert.equal(res.json.ok, true);
+    assert.equal(remote.actions.length, 1);
+    assert.deepEqual(remote.actions[0].coordinate, [10, 20]);
+  } finally {
+    await server.stop();
+  }
+});
+test('POST /agent/browser/action without an action field is a 400', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port, token } = await server.start();
+  try {
+    const res = await request(port, { method: 'POST', path: '/agent/browser/action', token, body: {} });
+    assert.equal(res.status, 400);
+    assert.equal(res.json.ok, false);
+  } finally {
+    await server.stop();
+  }
+});
+test('POST /agent/browser/action surfaces a remote failure as a 400', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port, token } = await server.start();
+  try {
+    const res = await request(port, { method: 'POST', path: '/agent/browser/action', token, body: { action: 'boom' } });
+    assert.equal(res.status, 400);
+    assert.equal(res.json.ok, false);
+  } finally {
+    await server.stop();
+  }
+});
+test('GET /agent/browser/dom returns a text snapshot', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port, token } = await server.start();
+  try {
+    const res = await request(port, { path: '/agent/browser/dom', token });
+    assert.equal(res.status, 200);
+    assert.equal(res.json.text, 'hello');
+  } finally {
+    await server.stop();
+  }
+});
+test('unknown route is a 404', async () => {
+  const remote = makeFakeRemote();
+  const server = createBrowserAgentServer(remote);
+  const { port, token } = await server.start();
+  try {
+    const res = await request(port, { path: '/agent/browser/nope', token });
+    assert.equal(res.status, 404);
+  } finally {
+    await server.stop();
+  }
+});

package/src/main/__tests__/scheduler-autofix-select.test.cjs CHANGED Viewed

@@ -11,6 +11,7 @@ const assert = require('node:assert/strict');
 const {
   selectAutoFixTargets, isUnresolvableNeedsReview, isRescanCandidate,
   healTargetForFix, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH,
+  isEligibleForImmediateAutoFix,
 } = require('../scheduler.cjs');
 const noSiblingOnDisk = () => false;
@@ -213,4 +214,48 @@ test('healTargetForFix: depth-2 fix-of-a-fix slug resolves back to the depth-1 f
   assert.strictEqual(resolved, depth1FixJob);
 });
+// ---- isEligibleForImmediateAutoFix (spawnJob's same-tick auto-fix trigger,
+// PRD 2026-07-12: needs_review jobs no longer wait up to 10 min for
+// reverifyNeedsReview()'s periodic pass) ----
+test('isEligibleForImmediateAutoFix: fresh needs_review job (fresh from spawnJob, not reverifyNeedsReview) is eligible', () => {
+  const job = makeJob();
+  const result = isEligibleForImmediateAutoFix(job, [job], noSiblingOnDisk);
+  assert.strictEqual(result, true);
+});
+test('isEligibleForImmediateAutoFix: job already autoFixAttempted is excluded (prevents double-spawn with the periodic pass)', () => {
+  const job = makeJob({ autoFixAttempted: true });
+  const result = isEligibleForImmediateAutoFix(job, [job], noSiblingOnDisk);
+  assert.strictEqual(result, false);
+});
+test('isEligibleForImmediateAutoFix: fix sibling already on disk excludes the job', () => {
+  const job = makeJob();
+  // fixSlug = '05-fix-my-feature'
+  const result = isEligibleForImmediateAutoFix(job, [job], (s) => s === '05-fix-my-feature');
+  assert.strictEqual(result, false);
+});
+test('isEligibleForImmediateAutoFix: fix-plan job beyond the depth cap is excluded', () => {
+  const job = makeJob({ slug: '05-fix-foo', investigationDepth: 3 });
+  const result = isEligibleForImmediateAutoFix(job, [job], noSiblingOnDisk);
+  assert.strictEqual(result, false);
+});
+test('isEligibleForImmediateAutoFix: a different job in the same queue does not affect this job\'s eligibility', () => {
+  const job = makeJob();
+  const other = { slug: '05-fix-my-feature', status: 'pending', runId: null };
+  const result = isEligibleForImmediateAutoFix(job, [job, other], noSiblingOnDisk);
+  // The fix sibling is already queued, so this job is excluded too (matches
+  // selectAutoFixTargets's "no fix sibling in queue" rule).
+  assert.strictEqual(result, false);
+});
+test('isEligibleForImmediateAutoFix: a job whose status is not needs_review (e.g. still pending) is excluded', () => {
+  const job = makeJob({ status: 'pending' });
+  const result = isEligibleForImmediateAutoFix(job, [job], noSiblingOnDisk);
+  assert.strictEqual(result, false);
+});
 console.log('scheduler-autofix-select tests: PASS');

package/src/main/browserAgentServer.cjs ADDED Viewed

@@ -0,0 +1,202 @@
+/**
+ * browserAgentServer.cjs — loopback-only HTTP API for driving the Browser
+ * tab one ad-hoc action at a time (PRD 535 foundation).
+ *
+ * Deliberately a SEPARATE server from adminServer.cjs, not a route added to
+ * it: adminServer.cjs documents itself as intentionally narrow ("Only two
+ * routes... writePrd/pause/resume are intentionally NOT exposed here").
+ * Arbitrary click/type/navigate/screenshot control of a live browser is a
+ * materially larger capability surface than "reset one scheduler job" and
+ * deserves its own security boundary, not creeping scope onto the existing
+ * narrow one. A future MCP server (PRD 536) wraps this HTTP API the same way
+ * scripts/scheduler-mcp-server.cjs wraps adminServer.cjs.
+ *
+ * Security posture (mirrors adminServer.cjs exactly):
+ *   - Binds 127.0.0.1 only, OS-assigned ephemeral port. Never reachable
+ *     off-box.
+ *   - Bearer token, regenerated every app boot, written to
+ *     ~/.claude/session-manager/browser-agent-api.json with 0600 perms.
+ *     A distinct file from admin-api.json — this token is never shared with
+ *     or derived from the scheduler's token.
+ *   - Token compared with crypto.timingSafeEqual to avoid a timing
+ *     side-channel on the comparison itself.
+ *   - Four routes: list tabs (read-only), screenshot, single action
+ *     (click/type/key/scroll/navigate), DOM/text snapshot.
+ *
+ * Out of scope for THIS server (see PRD 535's "Out of scope" section):
+ * no confirmation/consent gating, no domain allowlist/blocklist, no
+ * content-injection scanning. That safety layer is a deliberate, separate
+ * follow-up decision, not an oversight.
+ */
+'use strict';
+const http = require('node:http');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const fsp = require('node:fs/promises');
+const config = require('./config.cjs');
+const TOKEN_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'browser-agent-api.json');
+// Screenshots are base64 PNG data URLs — bigger cap than adminServer's 1MB,
+// still bounded so a malformed/malicious body can't exhaust memory.
+const BODY_MAX_BYTES = 8 * 1024 * 1024;
+function timingSafeEqualStrings(a, b) {
+  const bufA = Buffer.from(String(a ?? ''));
+  const bufB = Buffer.from(String(b ?? ''));
+  if (bufA.length !== bufB.length) {
+    // Compare against a same-length buffer anyway so the failure path still
+    // takes constant time relative to the (fixed) token length, rather than
+    // returning early on a length mismatch.
+    crypto.timingSafeEqual(bufA, bufA);
+    return false;
+  }
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+function readBody(req, maxBytes = BODY_MAX_BYTES) {
+  return new Promise((resolve, reject) => {
+    let total = 0;
+    const chunks = [];
+    req.on('data', (chunk) => {
+      total += chunk.length;
+      if (total > maxBytes) {
+        reject(new Error('body too large'));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    req.on('error', reject);
+  });
+}
+function sendJson(res, status, obj) {
+  const body = JSON.stringify(obj);
+  res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
+  res.end(body);
+}
+function safeParseJson(raw) {
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return undefined;
+  }
+}
+/**
+ * Create the browser-agent HTTP server. `remote` exposes the browserView.cjs
+ * functions this server dispatches to (injected, not required directly, so
+ * this module stays testable without booting Electron) — shape:
+ *   { listTabs(): Promise<Array>, screenshot({viewId}): Promise<obj>,
+ *     action(params): Promise<obj>, dom({viewId}): Promise<obj> }
+ */
+function createBrowserAgentServer(remote) {
+  let server = null;
+  let token = null;
+  async function ensureToken() {
+    token = crypto.randomBytes(32).toString('hex');
+    await config.writeJson(TOKEN_PATH, { port: null, token });
+    try { await fsp.chmod(TOKEN_PATH, 0o600); } catch { /* best-effort on platforms without POSIX perms */ }
+    return token;
+  }
+  async function persistPort(port) {
+    await config.writeJson(TOKEN_PATH, { port, token });
+    try { await fsp.chmod(TOKEN_PATH, 0o600); } catch { /* */ }
+  }
+  function authorized(req) {
+    const header = req.headers.authorization || '';
+    const match = /^Bearer (.+)$/.exec(header);
+    if (!match) return false;
+    return timingSafeEqualStrings(match[1], token);
+  }
+  async function handleRequest(req, res) {
+    if (!authorized(req)) {
+      sendJson(res, 401, { ok: false, error: 'unauthorized' });
+      return;
+    }
+    try {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      if (req.method === 'GET' && url.pathname === '/agent/browser/tabs') {
+        const tabs = await remote.listTabs();
+        sendJson(res, 200, { ok: true, tabs });
+        return;
+      }
+      if (req.method === 'POST' && url.pathname === '/agent/browser/screenshot') {
+        const raw = await readBody(req);
+        const parsed = safeParseJson(raw);
+        if (parsed === undefined) {
+          sendJson(res, 400, { ok: false, error: 'invalid JSON body' });
+          return;
+        }
+        const result = await remote.screenshot({ viewId: typeof parsed.viewId === 'string' ? parsed.viewId : undefined });
+        sendJson(res, result.ok ? 200 : 400, result);
+        return;
+      }
+      if (req.method === 'POST' && url.pathname === '/agent/browser/action') {
+        const raw = await readBody(req);
+        const parsed = safeParseJson(raw);
+        if (parsed === undefined) {
+          sendJson(res, 400, { ok: false, error: 'invalid JSON body' });
+          return;
+        }
+        if (typeof parsed.action !== 'string' || !parsed.action) {
+          sendJson(res, 400, { ok: false, error: 'missing action' });
+          return;
+        }
+        const result = await remote.action(parsed);
+        sendJson(res, result.ok ? 200 : 400, result);
+        return;
+      }
+      if (req.method === 'GET' && url.pathname === '/agent/browser/dom') {
+        const viewId = url.searchParams.get('viewId') || undefined;
+        const result = await remote.dom({ viewId });
+        sendJson(res, result.ok ? 200 : 400, result);
+        return;
+      }
+      sendJson(res, 404, { ok: false, error: 'not found' });
+    } catch (e) {
+      sendJson(res, 500, { ok: false, error: e?.message ?? 'internal error' });
+    }
+  }
+  async function start() {
+    await ensureToken();
+    server = http.createServer((req, res) => {
+      handleRequest(req, res).catch(() => {
+        try { sendJson(res, 500, { ok: false, error: 'internal error' }); } catch { /* */ }
+      });
+    });
+    await new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(0, '127.0.0.1', resolve);
+    });
+    const { port } = server.address();
+    await persistPort(port);
+    return { port, token };
+  }
+  async function stop() {
+    if (!server) return;
+    await new Promise((resolve) => server.close(() => resolve()));
+    server = null;
+  }
+  return { start, stop, get token() { return token; }, get server() { return server; } };
+}
+module.exports = { createBrowserAgentServer, TOKEN_PATH };