claude-code-session-manager 0.35.17 → 0.35.18

package/dist/index.html

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-DuoC6oCy.js"></script>
+    <script type="module" crossorigin src="./assets/index-4dJkn9nT.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
     <link rel="stylesheet" crossorigin href="./assets/index-DX2w2YhJ.css">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.35.17",
+  "version": "0.35.18",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/src/main/__tests__/pty-write-result.test.cjs

@@ -0,0 +1,46 @@
+/**
+ * pty-write-result.test.cjs — unit tests for PtyManager.write()'s return contract.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/pty-write-result.test.cjs
+ */
+
+'use strict';
+
+import { test, expect } from 'vitest';
+const { manager } = require('../pty.cjs');
+
+test('write to an existing session succeeds', () => {
+  const tabId = 'tab-existing';
+  const proc = { write: () => {} };
+  manager.sessions.set(tabId, { proc, cwd: '/tmp', created: 0 });
+  try {
+    const result = manager.write({ tabId, data: 'hello' });
+    expect(result).toEqual({ ok: true });
+  } finally {
+    manager.sessions.delete(tabId);
+  }
+});
+
+test('write to a nonexistent tabId returns no-pty', () => {
+  const result = manager.write({ tabId: 'tab-does-not-exist', data: 'hello' });
+  expect(result).toEqual({ ok: false, reason: 'no-pty' });
+});
+
+test('write where proc.write throws returns the error reason without throwing', () => {
+  const tabId = 'tab-throws';
+  const proc = {
+    write: () => {
+      throw new Error('EPIPE: write after end');
+    },
+  };
+  manager.sessions.set(tabId, { proc, cwd: '/tmp', created: 0 });
+  try {
+    let result;
+    expect(() => {
+      result = manager.write({ tabId, data: 'hello' });
+    }).not.toThrow();
+    expect(result).toEqual({ ok: false, reason: 'EPIPE: write after end' });
+  } finally {
+    manager.sessions.delete(tabId);
+  }
+});

package/src/main/__tests__/web-remote-e2e-pinning.test.cjs

@@ -0,0 +1,181 @@
+'use strict';
+
+/**
+ * web-remote-e2e-pinning.test.cjs — TOFU pinning for the web-remote E2E handshake.
+ *
+ * Once a browser's SPKI pubkey is manually SAS-confirmed for a paired device,
+ * a later `e2e:hello` presenting the SAME pubkey for that device should
+ * auto-authenticate (no `confirm-sas` needed); a DIFFERENT pubkey must still
+ * fall through to the manual `pending_sas` flow.
+ *
+ * Runs against a tmp HOME (config.cjs / webRemote.cjs both resolve paths off
+ * os.homedir()) and stubs the `electron` module in require.cache, mirroring
+ * the tmp-HOME + require.cache-stub pattern used by exchanges.test.cjs.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/web-remote-e2e-pinning.test.cjs
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+
+const fs = require('node:fs')
+const fsp = require('node:fs/promises')
+const path = require('node:path')
+const os = require('node:os')
+const crypto = require('node:crypto')
+
+/** Generate a P-256 keypair in the same encoding webRemote.cjs uses (SPKI/PKCS8, base64url). */
+function genP256KeyPairB64() {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
+    namedCurve: 'P-256',
+    publicKeyEncoding: { type: 'spki', format: 'der' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+  })
+  return {
+    priv: privateKey.toString('base64url'),
+    pub: publicKey.toString('base64url'),
+  }
+}
+
+let tmpHome
+let origHome
+let webRemote
+let configPath
+let handlers // captured ipcMain.handle(name, fn) map
+
+function freshRequire(mod) {
+  delete require.cache[require.resolve(mod)]
+  return require(mod)
+}
+
+async function readConfig() {
+  const text = await fsp.readFile(configPath, 'utf8')
+  return JSON.parse(text)
+}
+
+async function writeConfig(cfg) {
+  await fsp.mkdir(path.dirname(configPath), { recursive: true })
+  await fsp.writeFile(configPath, JSON.stringify(cfg, null, 2) + '\n')
+}
+
+beforeAll(async () => {
+  tmpHome = await fsp.mkdtemp(path.join(os.tmpdir(), 'web-remote-e2e-pinning-'))
+  origHome = process.env.HOME
+  process.env.HOME = tmpHome
+
+  // Stub 'electron' before webRemote.cjs (and logs.cjs, transitively) require it —
+  // outside a real Electron process, require('electron') just resolves to a path
+  // string, so destructuring { ipcMain, app } off it would throw at module load.
+  handlers = new Map()
+  const electronPath = require.resolve('electron')
+  require.cache[electronPath] = {
+    id: electronPath,
+    filename: electronPath,
+    loaded: true,
+    exports: {
+      ipcMain: {
+        handle: (name, fn) => handlers.set(name, fn),
+        on: () => {},
+      },
+      app: {
+        getPath: () => tmpHome,
+        getVersion: () => '0.0.0-test',
+      },
+    },
+  }
+
+  // Clear anything already cached under the real HOME so paths re-resolve under tmpHome.
+  for (const mod of ['../webRemote.cjs', '../config.cjs', '../logs.cjs', './e2eStateMachine.cjs']) {
+    try { delete require.cache[require.resolve(mod)] } catch { /* not yet loaded */ }
+  }
+
+  webRemote = freshRequire('../webRemote.cjs')
+  configPath = path.join(tmpHome, '.claude', 'session-manager', 'web-remote.json')
+
+  webRemote.registerRemoteHandlers()
+})
+
+afterAll(async () => {
+  process.env.HOME = origHome
+  await fsp.rm(tmpHome, { recursive: true, force: true })
+})
+
+describe('web-remote E2E SAS pinning', () => {
+  const deviceKeys = genP256KeyPairB64() // desktop's own E2E keypair
+  const browserA = genP256KeyPairB64() // first browser's keypair
+  const browserB = genP256KeyPairB64() // a different browser's keypair
+  const deviceId = 'device-under-test'
+
+  function baseDeviceRow(overrides = {}) {
+    return {
+      deviceId,
+      deviceToken: 'tok-abc',
+      e2ePrivateKey: deviceKeys.priv,
+      e2ePublicKey: deviceKeys.pub,
+      deviceName: 'Test Device',
+      issuedAt: new Date(0).toISOString(),
+      lastConnectedAt: null,
+      verifiedPeerPubKey: null,
+      ...overrides,
+    }
+  }
+
+  it('1) first e2e:hello for a never-confirmed device lands in pending_sas', async () => {
+    await writeConfig({ remoteEnabled: true, remoteControlEnabled: false, devices: [baseDeviceRow()] })
+
+    const cfg = await readConfig()
+    const device = cfg.devices[0]
+    await webRemote._internal.handleMessage(
+      JSON.stringify({ type: 'e2e:hello', id: 'm1', payload: { pubKey: browserA.pub } }),
+      device
+    )
+
+    expect(webRemote._internal.getE2eState().state).toBe('pending_sas')
+  })
+
+  it('2) a manual confirm-sas persists the connected device\'s verifiedPeerPubKey', async () => {
+    const confirmSas = handlers.get('webRemote:confirm-sas')
+    expect(typeof confirmSas).toBe('function')
+
+    const result = await confirmSas()
+    expect(result.ok).toBe(true)
+    expect(webRemote._internal.getE2eState().state).toBe('authenticated')
+
+    const cfg = await readConfig()
+    const persisted = cfg.devices.find((d) => d.deviceId === deviceId)
+    expect(persisted.verifiedPeerPubKey).toBe(browserA.pub)
+  })
+
+  it('3) a second e2e:hello presenting the SAME browserPubKey auto-authenticates (no confirm-sas)', async () => {
+    // Simulate a fresh reconnect: new WS session resets E2E state, and the device
+    // row is reloaded from disk (as connect() would), now carrying the pinned key.
+    webRemote._internal.resetE2e()
+    expect(webRemote._internal.getE2eState().state).toBe('idle')
+
+    const cfg = await readConfig()
+    const device = cfg.devices.find((d) => d.deviceId === deviceId)
+    expect(device.verifiedPeerPubKey).toBe(browserA.pub)
+
+    await webRemote._internal.handleMessage(
+      JSON.stringify({ type: 'e2e:hello', id: 'm2', payload: { pubKey: browserA.pub } }),
+      device
+    )
+
+    expect(webRemote._internal.getE2eState().state).toBe('authenticated')
+  })
+
+  it('4) a e2e:hello presenting a DIFFERENT browserPubKey still lands in pending_sas', async () => {
+    webRemote._internal.resetE2e()
+    expect(webRemote._internal.getE2eState().state).toBe('idle')
+
+    const cfg = await readConfig()
+    const device = cfg.devices.find((d) => d.deviceId === deviceId)
+    expect(device.verifiedPeerPubKey).toBe(browserA.pub) // still pinned to A, not B
+
+    await webRemote._internal.handleMessage(
+      JSON.stringify({ type: 'e2e:hello', id: 'm3', payload: { pubKey: browserB.pub } }),
+      device
+    )
+
+    expect(webRemote._internal.getE2eState().state).toBe('pending_sas')
+  })
+})

package/src/main/pty.cjs

@@ -188,19 +188,19 @@ class PtyManager {
       // Tab was removed or never existed — tell the renderer so it can surface
       // "skipped" feedback rather than silently dropping the write.
       sendIfAlive(this.window, 'pty:write-error', { tabId, reason: 'no-pty' });
-      return;
+      return { ok: false, reason: 'no-pty' };
     }
     try {
       s.proc.write(data);
+      return { ok: true };
     } catch (err) {
       // node-pty throws synchronously (or the underlying net.Socket emits an
       // error that node-pty re-throws) when writing to an exited process.
       // Catch here so the uncaught-exception handler never sees it, and notify
       // the renderer to surface "skipped" feedback.
-      sendIfAlive(this.window, 'pty:write-error', {
-        tabId,
-        reason: String(err?.message || 'write-failed'),
-      });
+      const reason = String(err?.message || 'write-failed');
+      sendIfAlive(this.window, 'pty:write-error', { tabId, reason });
+      return { ok: false, reason };
     }
   }
 

package/src/main/webRemote.cjs

@@ -189,6 +189,11 @@ let _destroyed = false; // set at app shutdown to stop reconnect loops
 // E2E session state — reset on each new WS connection.
 // .state: 'idle' | 'pending_sas' | 'authenticated' | 'failed'
 let _e2e = makeState();
+// Browser SPKI pubkey (base64url) that produced the current _e2e session, and the
+// deviceId it was received on — tracked so a manual SAS confirmation can pin it to
+// that device's `verifiedPeerPubKey` for auto-trust on future reconnects.
+let _e2ePeerPubKey = null;
+let _e2eDeviceId = null;
 
 // ─── Config helpers ───────────────────────────────────────────────────────────
 
@@ -317,6 +322,8 @@ async function getDeviceTicket(deviceToken) {
 
 function resetE2e(state = 'idle') {
   _e2e = makeState(state);
+  _e2ePeerPubKey = null;
+  _e2eDeviceId = null;
 }
 
 // ─── WebSocket lifecycle ──────────────────────────────────────────────────────
@@ -781,6 +788,19 @@ async function maybeSummarize(w) {
   });
 }
 
+/**
+ * Shared finish-up for any path that transitions _e2e into 'authenticated'
+ * (manual SAS confirmation or pinned-key auto-trust): log, broadcast the new
+ * status, and flush the session list immediately rather than waiting for the
+ * next SESSION_LIST_PUSH_MS tick.
+ */
+function finalizeE2eAuthenticated(logMessage) {
+  logs.writeLine({ scope: 'webRemote', level: 'info', message: logMessage });
+  broadcastStatus();
+  _lastSessionListJson = null;
+  pushSessionList().catch(() => {});
+}
+
 // ─── Message handling & command dispatch ─────────────────────────────────────
 
 async function handleMessage(raw, device) {
@@ -883,6 +903,18 @@ async function handleMessage(raw, device) {
         broadcastStatus();
         return;
       }
+      _e2ePeerPubKey = browserPubKey;
+      _e2eDeviceId = device.deviceId;
+      // TOFU pinning: if this exact (deviceId, browserPubKey) pair was already
+      // manually SAS-confirmed once, skip pending_sas and auto-authenticate — the
+      // user already verified this browser. A different/first-seen pubKey always
+      // falls through to the manual pending_sas flow below, unchanged.
+      if (device.verifiedPeerPubKey && device.verifiedPeerPubKey === browserPubKey) {
+        _e2e = makeState('authenticated', sessionKey, null);
+        finalizeE2eAuthenticated('E2E session auto-authenticated — pinned browser key matched');
+        respond(id, undefined, 'e2e:ready');
+        return;
+      }
       _e2e = makeState('pending_sas', sessionKey, pendingSas);
       logs.writeLine({ scope: 'webRemote', level: 'info', message: 'E2E session key established — SAS pending confirmation' });
       broadcastStatus();
@@ -1047,8 +1079,7 @@ function getDispatchMap() {
 
     'cmd:pty:write': async (payload) => {
       const parsed = schemas.ptyWrite.parse(payload);
-      ptyManager.write(parsed);
-      return { ok: true };
+      return ptyManager.write(parsed);
     },
 
     'cmd:pty:resize': async (payload) => {
@@ -1167,6 +1198,9 @@ async function pair(otp) {
     deviceName: `Device (paired ${new Date().toISOString().slice(0, 10)})`,
     issuedAt: new Date().toISOString(),
     lastConnectedAt: null,
+    // Set once a browser's SAS is manually confirmed; TOFU-pinned for auto-trust
+    // on future reconnects from the same (deviceId, browserPubKey) pair.
+    verifiedPeerPubKey: null,
   }];
 
   await saveConfig({ ...cfg, devices });
@@ -1234,13 +1268,23 @@ function registerRemoteHandlers() {
       return { ok: false, error };
     }
     _e2e = next;
-    logs.writeLine({ scope: 'webRemote', level: 'info', message: 'E2E session authenticated — SAS confirmed by user' });
-    broadcastStatus();
+    // Pin this browser's pubkey to the device so future reconnects with the same
+    // key auto-authenticate (see e2e:hello above) instead of re-prompting forever.
+    if (_e2ePeerPubKey && _e2eDeviceId) {
+      try {
+        const cfg = await loadConfig();
+        const devices = (cfg.devices || []).map((d) =>
+          d.deviceId === _e2eDeviceId ? { ...d, verifiedPeerPubKey: _e2ePeerPubKey } : d
+        );
+        await saveConfig({ ...cfg, devices });
+      } catch (e) {
+        logs.writeLine({ scope: 'webRemote', level: 'warn', message: 'failed to persist pinned peer pubkey', meta: { error: e?.message } });
+      }
+    }
     // Flush the session list immediately — the push loop was suppressed while
     // state !== 'authenticated', so the mobile app would otherwise wait up to
     // SESSION_LIST_PUSH_MS for the first useful data.
-    _lastSessionListJson = null;
-    pushSessionList().catch(() => {});
+    finalizeE2eAuthenticated('E2E session authenticated — SAS confirmed by user');
     return { ok: true };
   });
 
@@ -1334,4 +1378,11 @@ module.exports = {
   registerRemoteHandlers,
   init,
   destroy,
+  // Test-only internals — not part of the IPC surface. Lets unit tests drive
+  // e2e:hello / SAS-pinning transitions without a real relay WS connection.
+  _internal: {
+    handleMessage,
+    resetE2e,
+    getE2eState: () => _e2e,
+  },
 };