claude-code-session-manager 0.37.0 → 0.37.2

package/src/main/__tests__/adminServer.test.cjs

@@ -1,380 +0,0 @@
-/**
- * adminServer.test.cjs — unit tests for the loopback-only scheduler admin API.
- *
- * Run: timeout 120 node --test src/main/__tests__/adminServer.test.cjs
- */
-
-'use strict';
-
-const { test } = require('node:test');
-const assert = require('node:assert/strict');
-const http = require('node:http');
-const fs = require('node:fs');
-const fsp = require('node:fs/promises');
-const os = require('node:os');
-const path = require('node:path');
-const { createAdminServer } = require('../adminServer.cjs');
-const config = require('../config.cjs');
-
-function request(port, { method = 'GET', path: reqPath, token, body }) {
-  return new Promise((resolve, reject) => {
-    const headers = {};
-    if (token !== undefined) headers.Authorization = `Bearer ${token}`;
-    let payload;
-    if (body !== undefined) {
-      payload = JSON.stringify(body);
-      headers['Content-Type'] = 'application/json';
-      headers['Content-Length'] = Buffer.byteLength(payload);
-    }
-    const req = http.request({ hostname: '127.0.0.1', port, method, path: reqPath, headers }, (res) => {
-      const chunks = [];
-      res.on('data', (c) => chunks.push(c));
-      res.on('end', () => {
-        const text = Buffer.concat(chunks).toString('utf8');
-        let json = null;
-        try { json = JSON.parse(text); } catch { /* leave null for non-JSON bodies */ }
-        resolve({ status: res.statusCode, json, text });
-      });
-    });
-    req.on('error', reject);
-    if (payload) req.write(payload);
-    req.end();
-  });
-}
-
-function makeFakeRemote({ jobs = [] } = {}) {
-  return {
-    async listJobs() {
-      return jobs.map((j) => ({ slug: j.slug, title: j.title, status: j.status, cwd: j.cwd }));
-    },
-    async resetJob(slug) {
-      const job = jobs.find((j) => j.slug === slug);
-      if (!job) return { ok: false, error: 'not found' };
-      job.status = 'pending';
-      job.runId = null;
-      job.startedAt = null;
-      job.finishedAt = null;
-      job.exitCode = null;
-      job.error = null;
-      delete job.runtime;
-      delete job.verifierVerdict;
-      return { ok: true, slug, status: 'pending' };
-    },
-  };
-}
-
-test('request without bearer token returns 401', async () => {
-  const remote = makeFakeRemote();
-  const admin = createAdminServer(remote);
-  const { port } = await admin.start();
-  try {
-    const res = await request(port, { path: '/admin/scheduler/jobs' });
-    assert.strictEqual(res.status, 401);
-    assert.strictEqual(res.json.ok, false);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('request with wrong bearer token returns 401', async () => {
-  const remote = makeFakeRemote();
-  const admin = createAdminServer(remote);
-  const { port } = await admin.start();
-  try {
-    const res = await request(port, { path: '/admin/scheduler/jobs', token: 'not-the-token' });
-    assert.strictEqual(res.status, 401);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('GET /admin/scheduler/jobs with correct token returns 200 + array', async () => {
-  const remote = makeFakeRemote({
-    jobs: [{ slug: '10-foo', title: 'Foo', status: 'completed', cwd: '/tmp/foo' }],
-  });
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, { path: '/admin/scheduler/jobs', token });
-    assert.strictEqual(res.status, 200);
-    assert.ok(Array.isArray(res.json));
-    assert.strictEqual(res.json.length, 1);
-    assert.strictEqual(res.json[0].slug, '10-foo');
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/reset-job with unknown slug returns ok:false', async () => {
-  const remote = makeFakeRemote({ jobs: [] });
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/reset-job', token, body: { slug: 'does-not-exist' },
-    });
-    assert.strictEqual(res.status, 200);
-    assert.strictEqual(res.json.ok, false);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/reset-job with known slug flips job to pending and clears run fields', async () => {
-  const job = {
-    slug: '10-foo',
-    title: 'Foo',
-    status: 'completed',
-    cwd: '/tmp/foo',
-    runId: 'run-1',
-    startedAt: 100,
-    finishedAt: 200,
-    exitCode: 0,
-    error: null,
-    runtime: { pid: 1234 },
-    verifierVerdict: 'PASS',
-  };
-  const remote = makeFakeRemote({ jobs: [job] });
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/reset-job', token, body: { slug: '10-foo' },
-    });
-    assert.strictEqual(res.status, 200);
-    assert.deepStrictEqual(res.json, { ok: true, slug: '10-foo', status: 'pending' });
-    assert.strictEqual(job.status, 'pending');
-    assert.strictEqual(job.runId, null);
-    assert.strictEqual(job.startedAt, null);
-    assert.strictEqual(job.finishedAt, null);
-    assert.strictEqual(job.exitCode, null);
-    assert.strictEqual(job.error, null);
-    assert.strictEqual('runtime' in job, false);
-    assert.strictEqual('verifierVerdict' in job, false);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('unknown path/method returns 404', async () => {
-  const remote = makeFakeRemote();
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, { path: '/admin/scheduler/nope', token });
-    assert.strictEqual(res.status, 404);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('server binds only to 127.0.0.1', async () => {
-  const remote = makeFakeRemote();
-  const admin = createAdminServer(remote);
-  await admin.start();
-  try {
-    assert.strictEqual(admin.server.address().address, '127.0.0.1');
-  } finally {
-    await admin.stop();
-  }
-});
-
-// ──────────────────────────────────────────── create-prd
-
-const prdParser = require('../scheduler/prdParser.cjs');
-
-// config.cjs's validateWrite only allows writes under a registered non-home
-// allowedRoot's `.claude/` subtree (mirrors the real ROOT layout, which is
-// $HOME/.claude/session-manager/...) — so the temp prdsDir must live under
-// `<root>/.claude/...`, not directly under the temp root itself.
-async function mkTmpPrdsDir() {
-  const root = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-admin-create-prd-'));
-  config.addAllowedRoot(root);
-  const prdsDir = path.join(root, '.claude', 'prds');
-  await fsp.mkdir(prdsDir, { recursive: true });
-  return prdsDir;
-}
-
-// Mirrors scheduler.cjs's real `remote.allocateParallelGroup` / `remote.writePrd`
-// (same underlying prdParser.allocateParallelGroup + config.writeTextAtomic
-// calls) but pointed at a throwaway temp dir instead of the user's real
-// scheduled-plans/prds — so these tests never touch $HOME/.claude.
-function makeFakeRemoteWithPrdsDir(prdsDir) {
-  return {
-    async allocateParallelGroup() {
-      return prdParser.allocateParallelGroup(prdsDir);
-    },
-    async readPrd(slug) {
-      try {
-        const text = await fsp.readFile(path.join(prdsDir, `${slug}.md`), 'utf8');
-        return { ok: true, text };
-      } catch (e) {
-        return { ok: false, error: e?.message };
-      }
-    },
-    async writePrd(slug, body) {
-      try {
-        const filePath = path.join(prdsDir, `${slug}.md`);
-        await config.writeTextAtomic(filePath, body);
-        return { ok: true };
-      } catch (e) {
-        return { ok: false, error: e?.message };
-      }
-    },
-  };
-}
-
-function validCreateBody(overrides = {}) {
-  return {
-    title: 'Add widget frobnication',
-    cwd: os.homedir(),
-    estimateMinutes: 15,
-    goal: 'Add frobnication to the widget subsystem.',
-    acceptanceCriteria: ['widget frobnicates on click', 'timeout 300 npm run typecheck passes'],
-    implementationNotes: 'See src/widget.cjs:10.',
-    outOfScope: ['not touching gadgets'],
-    ...overrides,
-  };
-}
-
-test('POST /admin/scheduler/create-prd without token returns 401', async () => {
-  const remote = makeFakeRemote();
-  const admin = createAdminServer(remote);
-  const { port } = await admin.start();
-  try {
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/create-prd', body: validCreateBody(),
-    });
-    assert.strictEqual(res.status, 401);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/create-prd with a valid payload writes a file with frontmatter + standards appended, returns {nn, filename, status}', async () => {
-  const prdsDir = await mkTmpPrdsDir();
-  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/create-prd', token, body: validCreateBody(),
-    });
-    assert.strictEqual(res.status, 200);
-    assert.strictEqual(res.json.status, 'queued');
-    assert.strictEqual(typeof res.json.nn, 'number');
-    assert.match(res.json.filename, /^\d+-add-widget-frobnication\.md$/);
-
-    const written = await fsp.readFile(path.join(prdsDir, res.json.filename), 'utf8');
-    assert.match(written, /^---\n/);
-    assert.match(written, /title: Add widget frobnication/);
-    assert.match(written, /cwd: .+/);
-    assert.match(written, /estimateMinutes: 15/);
-    assert.match(written, /# Goal/);
-    assert.match(written, /# Acceptance criteria/);
-    assert.match(written, /- \[ \] widget frobnicates on click/);
-    assert.match(written, /# Implementation notes/);
-    assert.match(written, /# Out of scope/);
-    assert.match(written, /## Engineering standards/);
-    assert.ok(written.includes('Execution discipline'), 'must inline standards.md verbatim');
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/create-prd with malformed frontmatter (missing acceptanceCriteria) is rejected and writes no file', async () => {
-  const prdsDir = await mkTmpPrdsDir();
-  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const body = validCreateBody();
-    delete body.acceptanceCriteria;
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/create-prd', token, body,
-    });
-    assert.strictEqual(res.status, 400);
-    assert.strictEqual(res.json.ok, false);
-    const entries = await fsp.readdir(prdsDir);
-    assert.strictEqual(entries.filter((f) => f.endsWith('.md')).length, 0);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/create-prd with cwd outside allowed roots is rejected and writes no file', async () => {
-  const prdsDir = await mkTmpPrdsDir();
-  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/create-prd', token,
-      body: validCreateBody({ cwd: '/etc/passwd-adjacent-outside-home' }),
-    });
-    assert.strictEqual(res.status, 400);
-    assert.strictEqual(res.json.ok, false);
-    const entries = await fsp.readdir(prdsDir);
-    assert.strictEqual(entries.filter((f) => f.endsWith('.md')).length, 0);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/create-prd rejects a title containing a newline (frontmatter-injection guard) and writes no file', async () => {
-  const prdsDir = await mkTmpPrdsDir();
-  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/create-prd', token,
-      body: validCreateBody({ title: 'Legit title\n---\nEvil: injected' }),
-    });
-    assert.strictEqual(res.status, 400);
-    assert.strictEqual(res.json.ok, false);
-    const entries = await fsp.readdir(prdsDir);
-    assert.strictEqual(entries.filter((f) => f.endsWith('.md')).length, 0);
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/create-prd with an explicit parallelGroup+slug that already exists on disk returns 409 and does not clobber the file', async () => {
-  const prdsDir = await mkTmpPrdsDir();
-  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    await fsp.writeFile(path.join(prdsDir, '777-my-explicit-slug.md'), 'ORIGINAL CONTENT\n');
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/create-prd', token,
-      body: validCreateBody({ slug: 'my-explicit-slug', parallelGroup: 777 }),
-    });
-    assert.strictEqual(res.status, 409);
-    assert.strictEqual(res.json.ok, false);
-    const stillThere = await fsp.readFile(path.join(prdsDir, '777-my-explicit-slug.md'), 'utf8');
-    assert.strictEqual(stillThere, 'ORIGINAL CONTENT\n', 'existing PRD file must not be overwritten');
-  } finally {
-    await admin.stop();
-  }
-});
-
-test('POST /admin/scheduler/create-prd honors an explicit slug + parallelGroup instead of deriving/allocating', async () => {
-  const prdsDir = await mkTmpPrdsDir();
-  const remote = makeFakeRemoteWithPrdsDir(prdsDir);
-  const admin = createAdminServer(remote);
-  const { port, token } = await admin.start();
-  try {
-    const res = await request(port, {
-      method: 'POST', path: '/admin/scheduler/create-prd', token,
-      body: validCreateBody({ slug: 'my-explicit-slug', parallelGroup: 777 }),
-    });
-    assert.strictEqual(res.status, 200);
-    assert.strictEqual(res.json.nn, 777);
-    assert.strictEqual(res.json.filename, '777-my-explicit-slug.md');
-    assert.ok(fs.existsSync(path.join(prdsDir, '777-my-explicit-slug.md')));
-  } finally {
-    await admin.stop();
-  }
-});

package/src/main/adminServer.cjs

@@ -1,242 +0,0 @@
-/**
- * adminServer.cjs — loopback-only HTTP admin API for the scheduler.
- *
- * Foundation for PRD 449 (an MCP server wraps this HTTP API). Exposes a
- * narrow, token-authed surface so a same-machine script/tool can reset a
- * stuck scheduler job or list jobs without hand-editing queue.json from
- * outside the running app (which would race the in-process mutate() queue
- * — see scheduler.cjs's serialized-mutation comment).
- *
- * Security posture:
- *   - Binds 127.0.0.1 only, OS-assigned ephemeral port. Never reachable
- *     off-box.
- *   - Bearer token, regenerated every app boot, written to
- *     ~/.claude/session-manager/admin-api.json with 0600 perms.
- *   - Token compared with crypto.timingSafeEqual to avoid a timing
- *     side-channel on the comparison itself.
- *   - Three routes: reset-job (flips fields on an already-vetted job),
- *     jobs (read-only list), and create-prd (PRD 549 — authors a BRAND-NEW
- *     file that the scheduler will later run as `claude -p
- *     --dangerously-skip-permissions` in a caller-chosen, home-dir-bounded
- *     cwd; a materially larger blast radius than reset-job, justified only
- *     because it unblocks external automation with no other queueing path).
- *     cwd is validated via config.cjs's validatePath; title/cwd are
- *     newline-blocked at the zod boundary (ipcSchemas.cjs) to prevent
- *     frontmatter injection into the hand-rolled PRD serializer
- *     (prdCreate.cjs). pause/resume/cancel/update remain intentionally NOT
- *     exposed here.
- */
-
-'use strict';
-
-const http = require('node:http');
-const os = require('node:os');
-const path = require('node:path');
-const crypto = require('node:crypto');
-const fsp = require('node:fs/promises');
-const config = require('./config.cjs');
-const { expandHome } = require('./lib/expandHome.cjs');
-const { schemas } = require('./ipcSchemas.cjs');
-const prdCreate = require('./lib/prdCreate.cjs');
-
-const TOKEN_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'admin-api.json');
-
-function timingSafeEqualStrings(a, b) {
-  const bufA = Buffer.from(String(a ?? ''));
-  const bufB = Buffer.from(String(b ?? ''));
-  if (bufA.length !== bufB.length) {
-    // Compare against a same-length buffer anyway so the failure path still
-    // takes constant time relative to the (fixed) token length, rather than
-    // returning early on a length mismatch.
-    crypto.timingSafeEqual(bufA, bufA);
-    return false;
-  }
-  return crypto.timingSafeEqual(bufA, bufB);
-}
-
-function readBody(req, maxBytes = 1024 * 1024) {
-  return new Promise((resolve, reject) => {
-    let total = 0;
-    const chunks = [];
-    req.on('data', (chunk) => {
-      total += chunk.length;
-      if (total > maxBytes) {
-        reject(new Error('body too large'));
-        req.destroy();
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
-    req.on('error', reject);
-  });
-}
-
-function sendJson(res, status, obj) {
-  const body = JSON.stringify(obj);
-  res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
-  res.end(body);
-}
-
-/**
- * Create the admin HTTP server. `remote` is scheduler.cjs's remote object
- * (injected, not required directly, so this module stays testable without
- * booting Electron).
- */
-function createAdminServer(remote) {
-  let server = null;
-  let token = null;
-
-  async function ensureToken() {
-    token = crypto.randomBytes(32).toString('hex');
-    await config.writeJson(TOKEN_PATH, { port: null, token });
-    try { await fsp.chmod(TOKEN_PATH, 0o600); } catch { /* best-effort on platforms without POSIX perms */ }
-    return token;
-  }
-
-  async function persistPort(port) {
-    await config.writeJson(TOKEN_PATH, { port, token });
-    try { await fsp.chmod(TOKEN_PATH, 0o600); } catch { /* */ }
-  }
-
-  function authorized(req) {
-    const header = req.headers.authorization || '';
-    const match = /^Bearer (.+)$/.exec(header);
-    if (!match) return false;
-    return timingSafeEqualStrings(match[1], token);
-  }
-
-  async function handleRequest(req, res) {
-    if (!authorized(req)) {
-      sendJson(res, 401, { ok: false, error: 'unauthorized' });
-      return;
-    }
-    try {
-      if (req.method === 'GET' && req.url === '/admin/scheduler/jobs') {
-        const jobs = await remote.listJobs();
-        sendJson(res, 200, jobs);
-        return;
-      }
-      if (req.method === 'POST' && req.url === '/admin/scheduler/reset-job') {
-        const raw = await readBody(req);
-        let parsed;
-        try {
-          parsed = raw ? JSON.parse(raw) : {};
-        } catch {
-          sendJson(res, 400, { ok: false, error: 'invalid JSON body' });
-          return;
-        }
-        const slug = typeof parsed.slug === 'string' ? parsed.slug : null;
-        if (!slug) {
-          sendJson(res, 400, { ok: false, error: 'missing slug' });
-          return;
-        }
-        const result = await remote.resetJob(slug);
-        sendJson(res, 200, result);
-        return;
-      }
-      if (req.method === 'POST' && req.url === '/admin/scheduler/create-prd') {
-        const raw = await readBody(req);
-        let parsed;
-        try {
-          parsed = raw ? JSON.parse(raw) : {};
-        } catch {
-          sendJson(res, 400, { ok: false, error: 'invalid JSON body' });
-          return;
-        }
-
-        let input;
-        try {
-          input = schemas.schedulerCreatePrd.parse(parsed);
-        } catch (e) {
-          sendJson(res, 400, { ok: false, error: 'invalid PRD payload', details: e?.issues ?? e?.message });
-          return;
-        }
-
-        // cwd is untrusted: this is the first *creating* mutation on a
-        // token-authed API whose product is "a command that will later run
-        // with --dangerously-skip-permissions in a chosen cwd". Route it
-        // through config.cjs's validatePath (allowedRoots = home dir) —
-        // same boundary every other fs-touching IPC handler uses — never a
-        // bespoke check here.
-        try {
-          config.validatePath(expandHome(input.cwd));
-        } catch (e) {
-          sendJson(res, 400, { ok: false, error: `cwd rejected: ${e?.message ?? 'outside allowed roots'}` });
-          return;
-        }
-
-        const slug = input.slug || prdCreate.deriveSlugFromTitle(input.title);
-        if (!slug || !prdCreate.PRD_CREATE_SLUG_RE.test(slug)) {
-          sendJson(res, 400, { ok: false, error: 'could not derive a valid kebab-case slug from title; supply "slug" explicitly' });
-          return;
-        }
-
-        // NN allocation is delegated to allocateParallelGroup() (PRD 548) via
-        // the injected remote — never re-derived here — unless the caller
-        // opted into an existing group explicitly.
-        const nn = input.parallelGroup ?? await remote.allocateParallelGroup();
-        const filenameSlug = `${nn}-${slug}`;
-
-        // An explicit `parallelGroup` bypasses allocateParallelGroup()'s
-        // collision-proof reservation, so re-check for an existing file at
-        // this exact destination before writing — remote.writePrd itself has
-        // no existence guard (by design, it doubles as the edit-in-place
-        // path for Scheduler UI PRD edits), so "create" must not silently
-        // clobber an existing job's PRD.
-        const existing = await remote.readPrd(filenameSlug);
-        if (existing?.ok) {
-          sendJson(res, 409, { ok: false, error: `PRD already exists: ${filenameSlug}.md` });
-          return;
-        }
-
-        let standardsText;
-        try {
-          standardsText = await prdCreate.readStandards();
-        } catch (e) {
-          sendJson(res, 500, { ok: false, error: `could not read engineering standards: ${e?.message}` });
-          return;
-        }
-
-        const body = prdCreate.buildPrdBody(input, standardsText);
-        const writeResult = await remote.writePrd(filenameSlug, body);
-        if (!writeResult?.ok) {
-          sendJson(res, 500, { ok: false, error: writeResult?.error ?? 'write failed' });
-          return;
-        }
-
-        sendJson(res, 200, { nn, filename: `${filenameSlug}.md`, status: 'queued' });
-        return;
-      }
-      sendJson(res, 404, { ok: false, error: 'not found' });
-    } catch (e) {
-      sendJson(res, 500, { ok: false, error: e?.message ?? 'internal error' });
-    }
-  }
-
-  async function start() {
-    await ensureToken();
-    server = http.createServer((req, res) => {
-      handleRequest(req, res).catch(() => {
-        try { sendJson(res, 500, { ok: false, error: 'internal error' }); } catch { /* */ }
-      });
-    });
-    await new Promise((resolve, reject) => {
-      server.once('error', reject);
-      server.listen(0, '127.0.0.1', resolve);
-    });
-    const { port } = server.address();
-    await persistPort(port);
-    return { port, token };
-  }
-
-  async function stop() {
-    if (!server) return;
-    await new Promise((resolve) => server.close(() => resolve()));
-    server = null;
-  }
-
-  return { start, stop, get token() { return token; }, get server() { return server; } };
-}
-
-module.exports = { createAdminServer, TOKEN_PATH };