claude-remote-cli 3.6.0 → 3.8.0

package/dist/server/workspaces.js

@@ -15,9 +15,7 @@ const BROWSE_DENYLIST = new Set([
 ]);
 const BROWSE_MAX_ENTRIES = 100;
 const BULK_MAX_PATHS = 50;
-// ---------------------------------------------------------------------------
 // Exported helpers
-// ---------------------------------------------------------------------------
 /**
  * Resolves and validates a raw workspace path string.
  * Throws with a human-readable message if the path is invalid.
@@ -70,9 +68,7 @@ export async function detectGitRepo(dirPath, execAsync = execFileAsync) {
     }
     return { isGitRepo: true, defaultBranch };
 }
-// ---------------------------------------------------------------------------
 // Router factory
-// ---------------------------------------------------------------------------
 /**
  * Creates and returns an Express Router that handles all /workspaces routes.
  *
@@ -87,9 +83,7 @@ export function createWorkspaceRouter(deps) {
     function getConfig() {
         return loadConfig(configPath);
     }
-    // -------------------------------------------------------------------------
     // GET /workspaces — list all workspaces with git info
-    // -------------------------------------------------------------------------
     router.get('/', async (_req, res) => {
         const config = getConfig();
         const workspacePaths = config.workspaces ?? [];
@@ -100,9 +94,7 @@ export function createWorkspaceRouter(deps) {
         }));
         res.json({ workspaces: results });
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces — add a workspace
-    // -------------------------------------------------------------------------
     router.post('/', async (req, res) => {
         const body = req.body;
         const rawPath = body.path;
@@ -145,9 +137,7 @@ export function createWorkspaceRouter(deps) {
         };
         res.status(201).json(workspace);
     });
-    // -------------------------------------------------------------------------
     // DELETE /workspaces — remove a workspace
-    // -------------------------------------------------------------------------
     router.delete('/', async (req, res) => {
         const body = req.body;
         const rawPath = body.path;
@@ -168,9 +158,7 @@ export function createWorkspaceRouter(deps) {
         trackEvent({ category: 'workspace', action: 'removed', target: resolved });
         res.json({ removed: resolved });
     });
-    // -------------------------------------------------------------------------
     // PUT /workspaces/reorder — reorder workspaces
-    // -------------------------------------------------------------------------
     router.put('/reorder', async (req, res) => {
         const body = req.body;
         const rawPaths = body.paths;
@@ -201,9 +189,7 @@ export function createWorkspaceRouter(deps) {
         }));
         res.json({ workspaces: results });
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces/bulk — add multiple workspaces at once
-    // -------------------------------------------------------------------------
     router.post('/bulk', async (req, res) => {
         const body = req.body;
         const rawPaths = body.paths;
@@ -255,9 +241,7 @@ export function createWorkspaceRouter(deps) {
         }
         res.status(201).json({ added, errors });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/dashboard — aggregated PR + activity data for a workspace
-    // -------------------------------------------------------------------------
     router.get('/dashboard', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -339,36 +323,44 @@ export function createWorkspaceRouter(deps) {
             activity,
         });
     });
-    // -------------------------------------------------------------------------
-    // GET /workspaces/settings — per-workspace settings
-    // -------------------------------------------------------------------------
+    function buildMergedSettings(config, workspacePath) {
+        const resolved = path.resolve(workspacePath);
+        const wsOverrides = config.workspaceSettings?.[resolved] ?? {};
+        const effective = getWorkspaceSettings(config, resolved);
+        const overridden = [];
+        for (const key of ['defaultAgent', 'defaultContinue', 'defaultYolo', 'launchInTmux']) {
+            if (wsOverrides[key] !== undefined)
+                overridden.push(key);
+        }
+        return { settings: effective, overridden };
+    }
+    // GET /workspaces/settings — per-workspace overrides only
     router.get('/settings', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
-        const merged = req.query.merged === 'true';
         if (!workspacePath) {
             res.status(400).json({ error: 'path query parameter is required' });
             return;
         }
+        // Backward compat: handle merged=true inline (same logic as /settings/merged)
+        if (req.query.merged === 'true') {
+            res.json(buildMergedSettings(getConfig(), workspacePath));
+            return;
+        }
         const config = getConfig();
         const resolved = path.resolve(workspacePath);
-        if (merged) {
-            const wsOverrides = config.workspaceSettings?.[resolved] ?? {};
-            const effective = getWorkspaceSettings(config, resolved);
-            const overridden = [];
-            for (const key of ['defaultAgent', 'defaultContinue', 'defaultYolo', 'launchInTmux']) {
-                if (wsOverrides[key] !== undefined)
-                    overridden.push(key);
-            }
-            res.json({ settings: effective, overridden });
-        }
-        else {
-            const settings = config.workspaceSettings?.[resolved] ?? {};
-            res.json(settings);
+        const settings = config.workspaceSettings?.[resolved] ?? {};
+        res.json(settings);
+    });
+    // GET /workspaces/settings/merged — effective settings with override tracking
+    router.get('/settings/merged', async (req, res) => {
+        const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
+        if (!workspacePath) {
+            res.status(400).json({ error: 'path query parameter is required' });
+            return;
         }
+        res.json(buildMergedSettings(getConfig(), workspacePath));
     });
-    // -------------------------------------------------------------------------
     // PATCH /workspaces/settings — update per-workspace settings
-    // -------------------------------------------------------------------------
     router.patch('/settings', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -401,9 +393,7 @@ export function createWorkspaceRouter(deps) {
         const final = config.workspaceSettings?.[resolved] ?? {};
         res.json(final);
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/pr — PR info for a specific branch
-    // -------------------------------------------------------------------------
     router.get('/pr', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         const branch = typeof req.query.branch === 'string' ? req.query.branch : undefined;
@@ -430,9 +420,7 @@ export function createWorkspaceRouter(deps) {
             res.status(404).json({ error: 'No PR found for branch' });
         }
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/ci-status — CI check results for a workspace + branch
-    // -------------------------------------------------------------------------
     router.get('/ci-status', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         const branch = typeof req.query.branch === 'string' ? req.query.branch : undefined;
@@ -448,9 +436,7 @@ export function createWorkspaceRouter(deps) {
             res.json({ total: 0, passing: 0, failing: 0, pending: 0 });
         }
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces/branch — switch branch for a workspace
-    // -------------------------------------------------------------------------
     router.post('/branch', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -471,9 +457,7 @@ export function createWorkspaceRouter(deps) {
             res.status(400).json({ error: result.error ?? `Failed to switch to branch: ${branch}` });
         }
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces/worktree — create a new worktree with the next mountain name
-    // -------------------------------------------------------------------------
     router.post('/worktree', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -534,9 +518,7 @@ export function createWorkspaceRouter(deps) {
         }
         res.json({ branchName, mountainName, worktreePath });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/current-branch — current checked-out branch for a path
-    // -------------------------------------------------------------------------
     router.get('/current-branch', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -546,9 +528,7 @@ export function createWorkspaceRouter(deps) {
         const branch = await getCurrentBranch(path.resolve(workspacePath));
         res.json({ branch });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/browse — browse filesystem directories for tree UI
-    // -------------------------------------------------------------------------
     router.get('/browse', async (req, res) => {
         const rawPath = typeof req.query.path === 'string' ? req.query.path : '~';
         const prefix = typeof req.query.prefix === 'string' ? req.query.prefix : '';
@@ -558,7 +538,6 @@ export function createWorkspaceRouter(deps) {
             ? path.join(os.homedir(), rawPath.slice(1))
             : rawPath;
         const resolved = path.resolve(expanded);
-        // Validate path
         let stat;
         try {
             stat = await fs.promises.stat(resolved);
@@ -577,7 +556,6 @@ export function createWorkspaceRouter(deps) {
             res.status(400).json({ error: `Not a directory: ${resolved}` });
             return;
         }
-        // Read directory entries
         let dirents;
         try {
             dirents = await fs.promises.readdir(resolved, { withFileTypes: true });
@@ -600,7 +578,6 @@ export function createWorkspaceRouter(deps) {
                 return false;
             return true;
         });
-        // Sort alphabetically case-insensitive
         dirs.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()));
         const total = dirs.length;
         const truncated = dirs.length > BROWSE_MAX_ENTRIES;
@@ -609,7 +586,6 @@ export function createWorkspaceRouter(deps) {
         // Enrich each entry with isGitRepo and hasChildren (parallelized)
         const entries = await Promise.all(dirs.map(async (d) => {
             const entryPath = path.join(resolved, d.name);
-            // Check for .git directory (isGitRepo)
             let isGitRepo = false;
             try {
                 const gitStat = await fs.promises.stat(path.join(entryPath, '.git'));
@@ -618,7 +594,6 @@ export function createWorkspaceRouter(deps) {
             catch {
                 // not a git repo
             }
-            // Check if has at least one subdirectory child (hasChildren)
             let hasChildren = false;
             try {
                 const children = await fs.promises.readdir(entryPath, { withFileTypes: true });
@@ -636,9 +611,7 @@ export function createWorkspaceRouter(deps) {
         }));
         res.json({ resolved, entries, truncated, total });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/autocomplete — path prefix autocomplete
-    // -------------------------------------------------------------------------
     router.get('/autocomplete', async (req, res) => {
         const prefix = typeof req.query.prefix === 'string' ? req.query.prefix : '';
         if (!prefix) {

package/dist/server/ws.js

@@ -1,85 +1,6 @@
 import { WebSocketServer } from 'ws';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import * as sessions from './sessions.js';
-import { writeMeta } from './config.js';
-import { branchToDisplayName } from './git.js';
 import { trackEvent } from './analytics.js';
-const execFileAsync = promisify(execFile);
-const BRANCH_POLL_INTERVAL_MS = 3000;
-const BRANCH_POLL_MAX_ATTEMPTS = 10;
-function startBranchWatcher(session, broadcastEvent, cfgPath) {
-    const originalBranch = session.branchName;
-    let attempts = 0;
-    const timer = setInterval(async () => {
-        attempts++;
-        if (attempts > BRANCH_POLL_MAX_ATTEMPTS) {
-            clearInterval(timer);
-            return;
-        }
-        try {
-            const { stdout } = await execFileAsync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd: session.cwd });
-            const currentBranch = stdout.trim();
-            if (currentBranch && currentBranch !== originalBranch) {
-                clearInterval(timer);
-                const displayName = branchToDisplayName(currentBranch);
-                session.branchName = currentBranch;
-                session.displayName = displayName;
-                broadcastEvent('session-renamed', { sessionId: session.id, branchName: currentBranch, displayName });
-                writeMeta(cfgPath, {
-                    worktreePath: session.repoPath,
-                    displayName,
-                    lastActivity: new Date().toISOString(),
-                    branchName: currentBranch,
-                });
-            }
-        }
-        catch {
-            // git command failed — session cwd may not exist yet, retry
-        }
-    }, BRANCH_POLL_INTERVAL_MS);
-}
-/** Sideband branch rename: uses headless claude to generate a branch name from the first message */
-async function spawnBranchRename(session, firstMessage, cfgPath, broadcastEvent) {
-    try {
-        const cleanMessage = firstMessage.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '').replace(/[\x00-\x1f]/g, ' ').trim();
-        if (!cleanMessage)
-            return;
-        const basePrompt = session.branchRenamePrompt
-            ?? `Output ONLY a short kebab-case git branch name (no explanation, no backticks, no prefix, just the name) that describes this task:`;
-        const prompt = `${basePrompt}\n\n${cleanMessage.slice(0, 500)}`;
-        const { stdout } = await execFileAsync('claude', ['-p', '--model', 'haiku', prompt], {
-            cwd: session.cwd,
-            timeout: 30000,
-        });
-        const branchName = stdout.trim().replace(/`/g, '').replace(/[^a-z0-9-]/gi, '-').replace(/-+/g, '-').replace(/^-|-$/g, '').toLowerCase().slice(0, 60);
-        if (!branchName)
-            return;
-        await execFileAsync('git', ['branch', '-m', branchName], { cwd: session.cwd });
-        // Update session state
-        const displayName = branchToDisplayName(branchName);
-        session.branchName = branchName;
-        session.displayName = displayName;
-        broadcastEvent('session-renamed', {
-            sessionId: session.id,
-            branchName,
-            displayName,
-        });
-        if (cfgPath) {
-            writeMeta(cfgPath, {
-                worktreePath: session.repoPath,
-                displayName,
-                lastActivity: new Date().toISOString(),
-                branchName,
-            });
-        }
-    }
-    catch {
-        // Sideband rename is best-effort — fall back to branch watcher if claude CLI isn't available
-        if (cfgPath)
-            startBranchWatcher(session, broadcastEvent, cfgPath);
-    }
-}
 function parseCookies(cookieHeader) {
     const cookies = {};
     if (!cookieHeader)
@@ -94,7 +15,7 @@ function parseCookies(cookieHeader) {
     });
     return cookies;
 }
-function setupWebSocket(server, authenticatedTokens, watcher, configPath) {
+function setupWebSocket(server, authenticatedTokens, watcher, _configPath) {
     const wss = new WebSocketServer({ noServer: true });
     const eventClients = new Set();
     function broadcastEvent(type, data) {
@@ -151,15 +72,14 @@ function setupWebSocket(server, authenticatedTokens, watcher, configPath) {
         const session = sessionMap.get(ws);
         if (!session)
             return;
-        const ptySession = session;
         let dataDisposable = null;
         let exitDisposable = null;
-        function attachToPty(ptyProcess) {
+        const attachToPty = (ptyProcess) => {
             // Dispose previous handlers
             dataDisposable?.dispose();
             exitDisposable?.dispose();
             // Replay scrollback
-            for (const chunk of ptySession.scrollback) {
+            for (const chunk of session.scrollback) {
                 if (ws.readyState === ws.OPEN)
                     ws.send(chunk);
             }
@@ -171,53 +91,29 @@ function setupWebSocket(server, authenticatedTokens, watcher, configPath) {
                 if (ws.readyState === ws.OPEN)
                     ws.close(1000);
             });
-        }
-        attachToPty(ptySession.pty);
+        };
+        attachToPty(session.pty);
         const ptyReplacedHandler = (newPty) => attachToPty(newPty);
-        ptySession.onPtyReplacedCallbacks.push(ptyReplacedHandler);
+        session.onPtyReplacedCallbacks.push(ptyReplacedHandler);
         ws.on('message', (msg) => {
             const str = msg.toString();
             try {
                 const parsed = JSON.parse(str);
                 if (parsed.type === 'resize' && parsed.cols && parsed.rows) {
-                    sessions.resize(ptySession.id, parsed.cols, parsed.rows);
+                    sessions.resize(session.id, parsed.cols, parsed.rows);
                     return;
                 }
             }
             catch (_) { }
-            // Sideband branch rename: capture first message, pass through unmodified, rename out-of-band
-            if (ptySession.needsBranchRename && ptySession.agentState !== 'waiting-for-input') {
-                ptySession.pty.write(str);
-                return;
-            }
-            if (ptySession.needsBranchRename) {
-                if (!ptySession._renameBuffer)
-                    ptySession._renameBuffer = '';
-                const enterIndex = str.indexOf('\r');
-                if (enterIndex === -1) {
-                    ptySession._renameBuffer += str;
-                    ptySession.pty.write(str); // pass through to PTY normally — user sees their typing
-                    return;
-                }
-                // Enter detected — pass everything through unmodified
-                const buffered = ptySession._renameBuffer;
-                const firstMessage = buffered + str.slice(0, enterIndex);
-                ptySession.pty.write(str); // pass through the Enter key
-                ptySession.needsBranchRename = false;
-                delete ptySession._renameBuffer;
-                // Sideband: spawn headless claude to generate branch name (async, non-blocking)
-                spawnBranchRename(ptySession, firstMessage, configPath, broadcastEvent);
-                return;
-            }
-            // Use ptySession.pty dynamically so writes go to current PTY
-            ptySession.pty.write(str);
+            // Use session.pty dynamically so writes go to current PTY
+            session.pty.write(str);
         });
         ws.on('close', () => {
             dataDisposable?.dispose();
             exitDisposable?.dispose();
-            const idx = ptySession.onPtyReplacedCallbacks.indexOf(ptyReplacedHandler);
+            const idx = session.onPtyReplacedCallbacks.indexOf(ptyReplacedHandler);
             if (idx !== -1)
-                ptySession.onPtyReplacedCallbacks.splice(idx, 1);
+                session.onPtyReplacedCallbacks.splice(idx, 1);
         });
     });
     sessions.onIdleChange((sessionId, idle) => {

package/dist/test/auth.test.js

@@ -1,10 +1,12 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import { hashPin, verifyPin, isRateLimited, recordFailedAttempt, generateCookieToken, _resetForTesting, } from '../server/auth.js';
-test('hashPin returns bcrypt hash starting with $2b$', async () => {
+test('hashPin returns scrypt hash with expected format', async () => {
     _resetForTesting();
     const hash = await hashPin('1234');
-    assert.ok(hash.startsWith('$2b$'), `Expected hash to start with $2b$, got: ${hash}`);
+    assert.ok(hash.startsWith('scrypt:'), `Expected hash to start with scrypt:, got: ${hash}`);
+    const parts = hash.split(':');
+    assert.strictEqual(parts.length, 3, 'Hash should have 3 colon-separated parts');
 });
 test('verifyPin returns true for correct PIN', async () => {
     _resetForTesting();
@@ -34,6 +36,47 @@ test('rate limiter allows under threshold', () => {
     }
     assert.strictEqual(isRateLimited(ip), false);
 });
+test('verifyPin returns false for legacy bcrypt hash (requires PIN reset)', async () => {
+    _resetForTesting();
+    const legacyHash = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012';
+    const result = await verifyPin('1234', legacyHash);
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for malformed scrypt hash (missing parts)', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'scrypt:saltonly');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for scrypt hash with empty salt', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'scrypt::deadbeef');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for scrypt hash with wrong key length', async () => {
+    _resetForTesting();
+    // Valid hex but wrong length (should be 64 bytes = 128 hex chars)
+    const result = await verifyPin('1234', 'scrypt:abcd1234:deadbeef');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for completely empty hash', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', '');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for garbage input', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'not-a-valid-hash-at-all');
+    assert.strictEqual(result, false);
+});
+test('hashPin produces unique salts', async () => {
+    _resetForTesting();
+    const hash1 = await hashPin('1234');
+    const hash2 = await hashPin('1234');
+    assert.notStrictEqual(hash1, hash2, 'Two hashes of the same PIN should have different salts');
+    // But both should verify correctly
+    assert.strictEqual(await verifyPin('1234', hash1), true);
+    assert.strictEqual(await verifyPin('1234', hash2), true);
+});
 test('generateCookieToken returns non-empty string', () => {
     _resetForTesting();
     const token = generateCookieToken();

package/dist/test/hooks.test.js

@@ -0,0 +1,139 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { stripAnsi, semverLessThan, cleanEnv } from '../server/utils.js';
+import { onStateChange, fireStateChange } from '../server/sessions.js';
+describe('stripAnsi', () => {
+    it('strips CSI color sequences', () => {
+        assert.equal(stripAnsi('\x1b[32mhello\x1b[0m'), 'hello');
+    });
+    it('strips CSI bold/reset sequences', () => {
+        assert.equal(stripAnsi('\x1b[1mbold\x1b[0m'), 'bold');
+    });
+    it('strips OSC sequences', () => {
+        assert.equal(stripAnsi('\x1b]0;window title\x07plain'), 'plain');
+    });
+    it('strips cursor movement sequences', () => {
+        assert.equal(stripAnsi('\x1b[2Jhello'), 'hello');
+    });
+    it('preserves plain text', () => {
+        assert.equal(stripAnsi('hello world'), 'hello world');
+    });
+    it('handles empty string', () => {
+        assert.equal(stripAnsi(''), '');
+    });
+    it('strips multiple sequences in one string', () => {
+        assert.equal(stripAnsi('\x1b[32mfoo\x1b[0m and \x1b[1mbar\x1b[0m'), 'foo and bar');
+    });
+});
+describe('semverLessThan', () => {
+    it('returns true when major is lower', () => {
+        assert.equal(semverLessThan('1.0.0', '2.0.0'), true);
+    });
+    it('returns false when major is higher', () => {
+        assert.equal(semverLessThan('2.0.0', '1.0.0'), false);
+    });
+    it('returns true when patch is lower', () => {
+        assert.equal(semverLessThan('1.2.3', '1.2.4'), true);
+    });
+    it('returns false when patch is higher', () => {
+        assert.equal(semverLessThan('1.2.4', '1.2.3'), false);
+    });
+    it('returns false for equal versions', () => {
+        assert.equal(semverLessThan('1.0.0', '1.0.0'), false);
+    });
+    it('strips pre-release tag before comparing — 1.2.3-beta.1 vs 1.2.3 treated as equal', () => {
+        assert.equal(semverLessThan('1.2.3-beta.1', '1.2.3'), false);
+    });
+    it('strips pre-release tag before comparing — 1.2.3-beta.1 vs 1.3.0 treated as less than', () => {
+        assert.equal(semverLessThan('1.2.3-beta.1', '1.3.0'), true);
+    });
+    it('returns true when minor is lower', () => {
+        assert.equal(semverLessThan('1.1.0', '1.2.0'), true);
+    });
+    it('handles major version jumps', () => {
+        assert.equal(semverLessThan('1.9.9', '2.0.0'), true);
+    });
+});
+describe('cleanEnv', () => {
+    it('returns an object that does not contain CLAUDECODE', () => {
+        const originalValue = process.env.CLAUDECODE;
+        process.env.CLAUDECODE = 'some-value';
+        try {
+            const env = cleanEnv();
+            assert.equal(Object.prototype.hasOwnProperty.call(env, 'CLAUDECODE'), false);
+        }
+        finally {
+            if (originalValue === undefined) {
+                delete process.env.CLAUDECODE;
+            }
+            else {
+                process.env.CLAUDECODE = originalValue;
+            }
+        }
+    });
+    it('does not modify original process.env', () => {
+        const originalValue = process.env.CLAUDECODE;
+        process.env.CLAUDECODE = 'test-token';
+        try {
+            cleanEnv();
+            assert.equal(process.env.CLAUDECODE, 'test-token');
+        }
+        finally {
+            if (originalValue === undefined) {
+                delete process.env.CLAUDECODE;
+            }
+            else {
+                process.env.CLAUDECODE = originalValue;
+            }
+        }
+    });
+    it('returns a copy — mutations do not affect process.env', () => {
+        const env = cleanEnv();
+        const testKey = '__CRC_TEST_KEY__';
+        env[testKey] = 'injected';
+        assert.equal(process.env[testKey], undefined);
+    });
+    it('preserves other environment variables', () => {
+        const env = cleanEnv();
+        // PATH is virtually always set; verify it round-trips
+        if (process.env.PATH !== undefined) {
+            assert.equal(env.PATH, process.env.PATH);
+        }
+    });
+});
+describe('fireStateChange callbacks', () => {
+    it('calls a registered onStateChange callback with correct args', () => {
+        const received = [];
+        onStateChange((sessionId, state) => {
+            received.push({ sessionId, state });
+        });
+        fireStateChange('test-session-id', 'processing');
+        const match = received.find(e => e.sessionId === 'test-session-id' && e.state === 'processing');
+        assert.ok(match, 'callback should have been called with the expected sessionId and state');
+    });
+    it('fires multiple registered callbacks', () => {
+        let count = 0;
+        onStateChange(() => { count++; });
+        onStateChange(() => { count++; });
+        fireStateChange('multi-cb-session', 'idle');
+        assert.ok(count >= 2, 'both callbacks should have been invoked');
+    });
+    it('passes idle state to callback', () => {
+        let received;
+        onStateChange((_, state) => { received = state; });
+        fireStateChange('some-session', 'idle');
+        assert.equal(received, 'idle');
+    });
+    it('passes permission-prompt state to callback', () => {
+        let received;
+        onStateChange((_, state) => { received = state; });
+        fireStateChange('some-session', 'permission-prompt');
+        assert.equal(received, 'permission-prompt');
+    });
+    it('passes waiting-for-input state to callback', () => {
+        let received;
+        onStateChange((_, state) => { received = state; });
+        fireStateChange('some-session', 'waiting-for-input');
+        assert.equal(received, 'waiting-for-input');
+    });
+});

package/dist/test/sessions.test.js

@@ -4,7 +4,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import * as sessions from '../server/sessions.js';
-import { resolveTmuxSpawn, generateTmuxSessionName, serializeAll, restoreFromDisk } from '../server/sessions.js';
+import { resolveTmuxSpawn, generateTmuxSessionName } from '../server/pty-handler.js';
+import { serializeAll, restoreFromDisk } from '../server/sessions.js';
 // Track created session IDs so we can clean up after each test
 const createdIds = [];
 afterEach(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-remote-cli",
-  "version": "3.6.0",
+  "version": "3.8.0",
   "description": "Remote web interface for Claude Code CLI sessions",
   "type": "module",
   "main": "dist/server/index.js",
@@ -45,7 +45,6 @@
     "@tanstack/svelte-query": "^6.0.18",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
-    "bcrypt": "^5.1.1",
     "better-sqlite3": "^12.8.0",
     "cookie-parser": "^1.4.7",
     "express": "^4.21.0",
@@ -58,7 +57,6 @@
   "devDependencies": {
     "@playwright/test": "^1.58.2",
     "@sveltejs/vite-plugin-svelte": "^5.1.1",
-    "@types/bcrypt": "^5.0.2",
     "@types/better-sqlite3": "^7.6.13",
     "@types/cookie-parser": "^1.4.7",
     "@types/express": "^4.17.21",