claude-code-session-manager 0.62.0 → 0.62.1

package/src/main/__tests__/browserView-destroyed-handler.test.cjs

@@ -1,85 +0,0 @@
-/**
- * browserView-destroyed-handler.test.cjs — regression test for the
- * webContents.id-after-destroy crash (see
- * session-manager-operations/feedback/processed/
- * 2026-07-30-rca-v0390-blank-screen-unstable-selector-185.md, item 4).
- *
- * The webContents `'destroyed'` handler used to read `view.webContents.id`
- * from inside its own callback, after `view.webContents` could already be
- * undefined — throwing "Cannot read properties of undefined (reading 'id')"
- * on every app quit with an open Browser view. The fix captures the id at
- * creation time, before the destroyed handler is registered.
- *
- * `electron` isn't installed as a runnable binary here, and browserView.cjs
- * pulls it in via a plain CJS `require` (not vite-node's ESM graph), so
- * `vi.mock('electron', ...)` doesn't intercept it. Instead we pre-seed
- * Node's own require cache for the resolved `electron` path with a fake
- * `WebContentsView`, the only export browserView.cjs actually uses.
- *
- * Run: timeout 300 npx vitest run src/main/__tests__/browserView-destroyed-handler.test.cjs
- */
-
-'use strict';
-
-import { test, expect, beforeEach } from 'vitest';
-import { EventEmitter } from 'node:events';
-
-let nextWcId = 1;
-class FakeWebContents extends EventEmitter {
-  constructor() {
-    super();
-    this.id = nextWcId++;
-    this.session = { on() {} };
-  }
-  setZoomFactor() {}
-  setUserAgent() {}
-  setWindowOpenHandler() {}
-  isDestroyed() { return false; }
-}
-class FakeWebContentsView {
-  constructor() {
-    this.webContents = new FakeWebContents();
-  }
-}
-
-const electronPath = require.resolve('electron');
-require.cache[electronPath] = {
-  id: electronPath,
-  filename: electronPath,
-  loaded: true,
-  exports: { WebContentsView: FakeWebContentsView },
-};
-
-const { registerBrowserView, isBrowserViewContents, views } = require('../browserView.cjs');
-
-function makeFakeIpcMain() {
-  const handlers = new Map();
-  return {
-    handle: (channel, fn) => handlers.set(channel, fn),
-    on: (channel, fn) => handlers.set(channel, fn),
-    invoke: (channel, payload) => handlers.get(channel)(null, payload),
-  };
-}
-
-let ipcMain;
-beforeEach(() => {
-  ipcMain = makeFakeIpcMain();
-  registerBrowserView({ mainWindow: { isDestroyed: () => true }, ipcMain });
-});
-
-test('destroyed handler does not throw when view.webContents is already undefined', async () => {
-  const viewId = `t-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-  const result = await ipcMain.invoke('browser:create', { viewId, partition: 'sm-test' });
-  expect(result.ok).toBe(true);
-
-  const view = views.get(viewId);
-  const wc = view.webContents;
-  expect(isBrowserViewContents(wc.id)).toBe(true);
-
-  // Simulate the real crash precondition: webContents already gone by the
-  // time the 'destroyed' listener fires (e.g. on app quit).
-  view.webContents = undefined;
-
-  expect(() => wc.emit('destroyed')).not.toThrow();
-  expect(isBrowserViewContents(wc.id)).toBe(false);
-});

package/src/main/__tests__/browserView-oauth-popup.test.cjs

@@ -1,126 +0,0 @@
-/**
- * browserView-oauth-popup.test.cjs — regression test for Google (and other
- * identity-provider) OAuth login failing inside the Browser tab.
- *
- * Root cause: wc.setWindowOpenHandler() in browserView.cjs unconditionally
- * denied every window.open() popup, which kills Google's GIS/FedCM popup —
- * it needs a real window.opener to postMessage the credential back to. This
- * test asserts identity-provider popups get `{ action: 'allow', ... }` (a
- * real child window) while every other popup keeps the existing deny +
- * browser:open-tab-request behavior, and that a realistic Chrome
- * User-Agent (not Electron's default) is set on both the main view and the
- * popup's webContents.
- *
- * `electron` isn't installed as a runnable binary here, and browserView.cjs
- * pulls it in via a plain CJS `require` (not vite-node's ESM graph), so
- * `vi.mock('electron', ...)` doesn't intercept it. Instead we pre-seed
- * Node's own require cache for the resolved `electron` path with a fake
- * `WebContentsView`, the only export browserView.cjs actually uses — same
- * pattern as browserView-destroyed-handler.test.cjs.
- *
- * Run: timeout 300 npx vitest run src/main/__tests__/browserView-oauth-popup.test.cjs
- */
-
-'use strict';
-
-import { test, expect, beforeEach } from 'vitest';
-import { EventEmitter } from 'node:events';
-
-let nextWcId = 1;
-class FakeWebContents extends EventEmitter {
-  constructor() {
-    super();
-    this.id = nextWcId++;
-    this.session = { on() {} };
-    this.userAgent = null;
-    this._windowOpenHandler = null;
-  }
-  setZoomFactor() {}
-  setUserAgent(ua) { this.userAgent = ua; }
-  setWindowOpenHandler(fn) { this._windowOpenHandler = fn; }
-  isDestroyed() { return false; }
-}
-class FakeWebContentsView {
-  constructor() {
-    this.webContents = new FakeWebContents();
-  }
-}
-class FakeBrowserWindow {
-  constructor() {
-    this.webContents = new FakeWebContents();
-  }
-}
-
-const electronPath = require.resolve('electron');
-require.cache[electronPath] = {
-  id: electronPath,
-  filename: electronPath,
-  loaded: true,
-  exports: { WebContentsView: FakeWebContentsView },
-};
-
-const { registerBrowserView, views, isBrowserViewContents } = require('../browserView.cjs');
-
-function makeFakeIpcMain() {
-  const handlers = new Map();
-  return {
-    handle: (channel, fn) => handlers.set(channel, fn),
-    on: (channel, fn) => handlers.set(channel, fn),
-    invoke: (channel, payload) => handlers.get(channel)(null, payload),
-  };
-}
-
-let ipcMain;
-beforeEach(() => {
-  ipcMain = makeFakeIpcMain();
-  registerBrowserView({ mainWindow: { isDestroyed: () => true }, ipcMain });
-});
-
-test('main view webContents gets a real Chrome user-agent, not the Electron default', async () => {
-  const viewId = `oauth-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-  await ipcMain.invoke('browser:create', { viewId, partition: 'sm-test' });
-  const view = views.get(viewId);
-  expect(view.webContents.userAgent).toBeTruthy();
-  expect(view.webContents.userAgent).not.toMatch(/Electron/);
-  expect(view.webContents.userAgent).toMatch(/Chrome\//);
-});
-
-test('setWindowOpenHandler allows identity-provider popups with a real child window and denies others', async () => {
-  const viewId = `oauth2-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-  await ipcMain.invoke('browser:create', { viewId, partition: 'sm-test' });
-  const view = views.get(viewId);
-  const handler = view.webContents._windowOpenHandler;
-  expect(typeof handler).toBe('function');
-
-  const allowed = handler({ url: 'https://accounts.google.com/o/oauth2/v2/auth?foo=bar' });
-  expect(allowed.action).toBe('allow');
-  expect(allowed.overrideBrowserWindowOptions.webPreferences).toEqual({
-    contextIsolation: true,
-    nodeIntegration: false,
-    sandbox: true,
-  });
-
-  const denied = handler({ url: 'https://example.com/some-popup' });
-  expect(denied).toEqual({ action: 'deny' });
-});
-
-test('identity-provider popup child window gets a Chrome UA and cleans up on destroy', async () => {
-  const viewId = `oauth3-${Date.now()}-${Math.random().toString(36).slice(2)}`;
-  await ipcMain.invoke('browser:create', { viewId, partition: 'sm-test' });
-  const view = views.get(viewId);
-
-  const childWindow = new FakeBrowserWindow();
-  view.webContents.emit('did-create-window', childWindow);
-
-  expect(childWindow.webContents.userAgent).toBeTruthy();
-  expect(childWindow.webContents.userAgent).toMatch(/Chrome\//);
-
-  // The popup's webContents.id must be exempted from index.cjs's global
-  // will-navigate lock the same way the main Browser view is — otherwise
-  // the OAuth handshake this fix enables would immediately get nav-locked
-  // shut once the popup tries to navigate through consent/callback pages.
-  expect(isBrowserViewContents(childWindow.webContents.id)).toBe(true);
-
-  expect(() => childWindow.webContents.emit('destroyed')).not.toThrow();
-  expect(isBrowserViewContents(childWindow.webContents.id)).toBe(false);
-});

package/src/main/__tests__/web-remote-e2e-pinning.test.cjs

@@ -1,181 +0,0 @@
-'use strict';
-
-/**
- * web-remote-e2e-pinning.test.cjs — TOFU pinning for the web-remote E2E handshake.
- *
- * Once a browser's SPKI pubkey is manually SAS-confirmed for a paired device,
- * a later `e2e:hello` presenting the SAME pubkey for that device should
- * auto-authenticate (no `confirm-sas` needed); a DIFFERENT pubkey must still
- * fall through to the manual `pending_sas` flow.
- *
- * Runs against a tmp HOME (config.cjs / webRemote.cjs both resolve paths off
- * os.homedir()) and stubs the `electron` module in require.cache, mirroring
- * the tmp-HOME + require.cache-stub pattern used by exchanges.test.cjs.
- *
- * Run: timeout 300 npx vitest run src/main/__tests__/web-remote-e2e-pinning.test.cjs
- */
-
-import { describe, it, expect, beforeAll, afterAll } from 'vitest'
-
-const fs = require('node:fs')
-const fsp = require('node:fs/promises')
-const path = require('node:path')
-const os = require('node:os')
-const crypto = require('node:crypto')
-
-/** Generate a P-256 keypair in the same encoding webRemote.cjs uses (SPKI/PKCS8, base64url). */
-function genP256KeyPairB64() {
-  const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
-    namedCurve: 'P-256',
-    publicKeyEncoding: { type: 'spki', format: 'der' },
-    privateKeyEncoding: { type: 'pkcs8', format: 'der' },
-  })
-  return {
-    priv: privateKey.toString('base64url'),
-    pub: publicKey.toString('base64url'),
-  }
-}
-
-let tmpHome
-let origHome
-let webRemote
-let configPath
-let handlers // captured ipcMain.handle(name, fn) map
-
-function freshRequire(mod) {
-  delete require.cache[require.resolve(mod)]
-  return require(mod)
-}
-
-async function readConfig() {
-  const text = await fsp.readFile(configPath, 'utf8')
-  return JSON.parse(text)
-}
-
-async function writeConfig(cfg) {
-  await fsp.mkdir(path.dirname(configPath), { recursive: true })
-  await fsp.writeFile(configPath, JSON.stringify(cfg, null, 2) + '\n')
-}
-
-beforeAll(async () => {
-  tmpHome = await fsp.mkdtemp(path.join(os.tmpdir(), 'web-remote-e2e-pinning-'))
-  origHome = process.env.HOME
-  process.env.HOME = tmpHome
-
-  // Stub 'electron' before webRemote.cjs (and logs.cjs, transitively) require it —
-  // outside a real Electron process, require('electron') just resolves to a path
-  // string, so destructuring { ipcMain, app } off it would throw at module load.
-  handlers = new Map()
-  const electronPath = require.resolve('electron')
-  require.cache[electronPath] = {
-    id: electronPath,
-    filename: electronPath,
-    loaded: true,
-    exports: {
-      ipcMain: {
-        handle: (name, fn) => handlers.set(name, fn),
-        on: () => {},
-      },
-      app: {
-        getPath: () => tmpHome,
-        getVersion: () => '0.0.0-test',
-      },
-    },
-  }
-
-  // Clear anything already cached under the real HOME so paths re-resolve under tmpHome.
-  for (const mod of ['../webRemote.cjs', '../config.cjs', '../logs.cjs', './e2eStateMachine.cjs']) {
-    try { delete require.cache[require.resolve(mod)] } catch { /* not yet loaded */ }
-  }
-
-  webRemote = freshRequire('../webRemote.cjs')
-  configPath = path.join(tmpHome, '.claude', 'session-manager', 'web-remote.json')
-
-  webRemote.registerRemoteHandlers()
-})
-
-afterAll(async () => {
-  process.env.HOME = origHome
-  await fsp.rm(tmpHome, { recursive: true, force: true })
-})
-
-describe('web-remote E2E SAS pinning', () => {
-  const deviceKeys = genP256KeyPairB64() // desktop's own E2E keypair
-  const browserA = genP256KeyPairB64() // first browser's keypair
-  const browserB = genP256KeyPairB64() // a different browser's keypair
-  const deviceId = 'device-under-test'
-
-  function baseDeviceRow(overrides = {}) {
-    return {
-      deviceId,
-      deviceToken: 'tok-abc',
-      e2ePrivateKey: deviceKeys.priv,
-      e2ePublicKey: deviceKeys.pub,
-      deviceName: 'Test Device',
-      issuedAt: new Date(0).toISOString(),
-      lastConnectedAt: null,
-      verifiedPeerPubKey: null,
-      ...overrides,
-    }
-  }
-
-  it('1) first e2e:hello for a never-confirmed device lands in pending_sas', async () => {
-    await writeConfig({ remoteEnabled: true, remoteControlEnabled: false, devices: [baseDeviceRow()] })
-
-    const cfg = await readConfig()
-    const device = cfg.devices[0]
-    await webRemote._internal.handleMessage(
-      JSON.stringify({ type: 'e2e:hello', id: 'm1', payload: { pubKey: browserA.pub } }),
-      device
-    )
-
-    expect(webRemote._internal.getE2eState().state).toBe('pending_sas')
-  })
-
-  it('2) a manual confirm-sas persists the connected device\'s verifiedPeerPubKey', async () => {
-    const confirmSas = handlers.get('webRemote:confirm-sas')
-    expect(typeof confirmSas).toBe('function')
-
-    const result = await confirmSas()
-    expect(result.ok).toBe(true)
-    expect(webRemote._internal.getE2eState().state).toBe('authenticated')
-
-    const cfg = await readConfig()
-    const persisted = cfg.devices.find((d) => d.deviceId === deviceId)
-    expect(persisted.verifiedPeerPubKey).toBe(browserA.pub)
-  })
-
-  it('3) a second e2e:hello presenting the SAME browserPubKey auto-authenticates (no confirm-sas)', async () => {
-    // Simulate a fresh reconnect: new WS session resets E2E state, and the device
-    // row is reloaded from disk (as connect() would), now carrying the pinned key.
-    webRemote._internal.resetE2e()
-    expect(webRemote._internal.getE2eState().state).toBe('idle')
-
-    const cfg = await readConfig()
-    const device = cfg.devices.find((d) => d.deviceId === deviceId)
-    expect(device.verifiedPeerPubKey).toBe(browserA.pub)
-
-    await webRemote._internal.handleMessage(
-      JSON.stringify({ type: 'e2e:hello', id: 'm2', payload: { pubKey: browserA.pub } }),
-      device
-    )
-
-    expect(webRemote._internal.getE2eState().state).toBe('authenticated')
-  })
-
-  it('4) a e2e:hello presenting a DIFFERENT browserPubKey still lands in pending_sas', async () => {
-    webRemote._internal.resetE2e()
-    expect(webRemote._internal.getE2eState().state).toBe('idle')
-
-    const cfg = await readConfig()
-    const device = cfg.devices.find((d) => d.deviceId === deviceId)
-    expect(device.verifiedPeerPubKey).toBe(browserA.pub) // still pinned to A, not B
-
-    await webRemote._internal.handleMessage(
-      JSON.stringify({ type: 'e2e:hello', id: 'm3', payload: { pubKey: browserB.pub } }),
-      device
-    )
-
-    expect(webRemote._internal.getE2eState().state).toBe('pending_sas')
-  })
-})

package/src/main/browserAgentServer.cjs

@@ -1,224 +0,0 @@
-/**
- * browserAgentServer.cjs — loopback-only HTTP API for driving the Browser
- * tab one ad-hoc action at a time (PRD 535 foundation).
- *
- * Deliberately a SEPARATE server from the scheduler's admin HTTP API
- * (src/main/lib/localAdminHttp.cjs + scheduler.cjs's registerAdminRoutes),
- * not a route added to it: that admin API documents itself as intentionally
- * narrow ("Only two routes... writePrd/pause/resume are intentionally NOT
- * exposed here"). Arbitrary click/type/navigate/screenshot control of a live
- * browser is a materially larger capability surface than "reset one
- * scheduler job" and deserves its own security boundary, not creeping scope
- * onto the existing narrow one. A future MCP server (PRD 536) wraps this
- * HTTP API the same way scripts/scheduler-mcp-server.cjs wraps the admin API.
- *
- * Security posture (mirrors the scheduler's admin API exactly):
- *   - Binds 127.0.0.1 only, OS-assigned ephemeral port. Never reachable
- *     off-box.
- *   - Bearer token, regenerated every app boot, written to
- *     ~/.claude/session-manager/browser-agent-api.json with 0600 perms.
- *     A distinct file from admin-api.json — this token is never shared with
- *     or derived from the scheduler's token.
- *   - Token compared with crypto.timingSafeEqual to avoid a timing
- *     side-channel on the comparison itself.
- *   - Mode-scoped token file, same rationale/fix as localAdminHttp.cjs's
- *     resolveTokenPath() (confirmed-live incident 2026-07-29): a dev/e2e
- *     launch (SM_DEV=1 / SM_E2E=1) writes to browser-agent-api.dev.json /
- *     browser-agent-api.e2e.json instead of the production file, so it can
- *     never silently orphan a concurrently-running production instance.
- *   - Four routes: list tabs (read-only), screenshot, single action
- *     (click/type/key/scroll/navigate), DOM/text snapshot.
- *
- * Out of scope for THIS server (see PRD 535's "Out of scope" section):
- * no confirmation/consent gating, no domain allowlist/blocklist, no
- * content-injection scanning. That safety layer is a deliberate, separate
- * follow-up decision, not an oversight.
- */
-
-'use strict';
-
-const http = require('node:http');
-const os = require('node:os');
-const path = require('node:path');
-const crypto = require('node:crypto');
-const fsp = require('node:fs/promises');
-const config = require('./config.cjs');
-
-const TOKEN_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'browser-agent-api.json');
-// Screenshots are base64 PNG data URLs — bigger cap than the admin API's 1MB,
-// still bounded so a malformed/malicious body can't exhaust memory.
-const BODY_MAX_BYTES = 8 * 1024 * 1024;
-
-/**
- * Mode-aware token file path, resolved fresh on every call — see
- * localAdminHttp.cjs's resolveTokenPath() for the full rationale.
- */
-function resolveTokenPath() {
-  if (process.env.SM_DEV === '1') {
-    return path.join(os.homedir(), '.claude', 'session-manager', 'browser-agent-api.dev.json');
-  }
-  if (process.env.SM_E2E === '1') {
-    return path.join(os.homedir(), '.claude', 'session-manager', 'browser-agent-api.e2e.json');
-  }
-  return TOKEN_PATH;
-}
-
-function timingSafeEqualStrings(a, b) {
-  const bufA = Buffer.from(String(a ?? ''));
-  const bufB = Buffer.from(String(b ?? ''));
-  if (bufA.length !== bufB.length) {
-    // Compare against a same-length buffer anyway so the failure path still
-    // takes constant time relative to the (fixed) token length, rather than
-    // returning early on a length mismatch.
-    crypto.timingSafeEqual(bufA, bufA);
-    return false;
-  }
-  return crypto.timingSafeEqual(bufA, bufB);
-}
-
-function readBody(req, maxBytes = BODY_MAX_BYTES) {
-  return new Promise((resolve, reject) => {
-    let total = 0;
-    const chunks = [];
-    req.on('data', (chunk) => {
-      total += chunk.length;
-      if (total > maxBytes) {
-        reject(new Error('body too large'));
-        req.destroy();
-        return;
-      }
-      chunks.push(chunk);
-    });
-    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
-    req.on('error', reject);
-  });
-}
-
-function sendJson(res, status, obj) {
-  const body = JSON.stringify(obj);
-  res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
-  res.end(body);
-}
-
-function safeParseJson(raw) {
-  if (!raw) return {};
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * Create the browser-agent HTTP server. `remote` exposes the browserView.cjs
- * functions this server dispatches to (injected, not required directly, so
- * this module stays testable without booting Electron) — shape:
- *   { listTabs(): Promise<Array>, screenshot({viewId}): Promise<obj>,
- *     action(params): Promise<obj>, dom({viewId}): Promise<obj> }
- */
-function createBrowserAgentServer(remote) {
-  let server = null;
-  let token = null;
-
-  async function ensureToken() {
-    token = crypto.randomBytes(32).toString('hex');
-    const tokenPath = resolveTokenPath();
-    await config.writeJson(tokenPath, { port: null, token });
-    try { await fsp.chmod(tokenPath, 0o600); } catch { /* best-effort on platforms without POSIX perms */ }
-    return token;
-  }
-
-  async function persistPort(port) {
-    const tokenPath = resolveTokenPath();
-    await config.writeJson(tokenPath, { port, token });
-    try { await fsp.chmod(tokenPath, 0o600); } catch { /* */ }
-  }
-
-  function authorized(req) {
-    const header = req.headers.authorization || '';
-    const match = /^Bearer (.+)$/.exec(header);
-    if (!match) return false;
-    return timingSafeEqualStrings(match[1], token);
-  }
-
-  async function handleRequest(req, res) {
-    if (!authorized(req)) {
-      sendJson(res, 401, { ok: false, error: 'unauthorized' });
-      return;
-    }
-    try {
-      const url = new URL(req.url, 'http://127.0.0.1');
-
-      if (req.method === 'GET' && url.pathname === '/agent/browser/tabs') {
-        const tabs = await remote.listTabs();
-        sendJson(res, 200, { ok: true, tabs });
-        return;
-      }
-
-      if (req.method === 'POST' && url.pathname === '/agent/browser/screenshot') {
-        const raw = await readBody(req);
-        const parsed = safeParseJson(raw);
-        if (parsed === undefined) {
-          sendJson(res, 400, { ok: false, error: 'invalid JSON body' });
-          return;
-        }
-        const result = await remote.screenshot({ viewId: typeof parsed.viewId === 'string' ? parsed.viewId : undefined });
-        sendJson(res, result.ok ? 200 : 400, result);
-        return;
-      }
-
-      if (req.method === 'POST' && url.pathname === '/agent/browser/action') {
-        const raw = await readBody(req);
-        const parsed = safeParseJson(raw);
-        if (parsed === undefined) {
-          sendJson(res, 400, { ok: false, error: 'invalid JSON body' });
-          return;
-        }
-        if (typeof parsed.action !== 'string' || !parsed.action) {
-          sendJson(res, 400, { ok: false, error: 'missing action' });
-          return;
-        }
-        const result = await remote.action(parsed);
-        sendJson(res, result.ok ? 200 : 400, result);
-        return;
-      }
-
-      if (req.method === 'GET' && url.pathname === '/agent/browser/dom') {
-        const viewId = url.searchParams.get('viewId') || undefined;
-        const result = await remote.dom({ viewId });
-        sendJson(res, result.ok ? 200 : 400, result);
-        return;
-      }
-
-      sendJson(res, 404, { ok: false, error: 'not found' });
-    } catch (e) {
-      sendJson(res, 500, { ok: false, error: e?.message ?? 'internal error' });
-    }
-  }
-
-  async function start() {
-    await ensureToken();
-    server = http.createServer((req, res) => {
-      handleRequest(req, res).catch(() => {
-        try { sendJson(res, 500, { ok: false, error: 'internal error' }); } catch { /* */ }
-      });
-    });
-    await new Promise((resolve, reject) => {
-      server.once('error', reject);
-      server.listen(0, '127.0.0.1', resolve);
-    });
-    const { port } = server.address();
-    await persistPort(port);
-    return { port, token };
-  }
-
-  async function stop() {
-    if (!server) return;
-    await new Promise((resolve) => server.close(() => resolve()));
-    server = null;
-  }
-
-  return { start, stop, get token() { return token; }, get server() { return server; } };
-}
-
-module.exports = { createBrowserAgentServer, TOKEN_PATH, resolveTokenPath };