npm - claude-remote-cli - Versions diffs - 3.7.0 → 3.8.0 - Mend

claude-remote-cli 3.7.0 → 3.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/dist/frontend/assets/{index-BYXQcBQc.js → index-cJ7MQBLi.js} +21 -21
package/dist/frontend/index.html +1 -1
package/dist/server/auth.js +24 -4
package/dist/server/index.js +7 -14
package/dist/server/output-parsers/codex-parser.js +1 -3
package/dist/server/pty-handler.js +13 -8
package/dist/server/push.js +1 -1
package/dist/server/sessions.js +19 -29
package/dist/server/workspaces.js +27 -54
package/dist/server/ws.js +10 -11
package/dist/test/auth.test.js +45 -2
package/dist/test/sessions.test.js +2 -1
package/package.json +1 -3

package/dist/frontend/index.html CHANGED Viewed

@@ -11,7 +11,7 @@
   <meta name="apple-mobile-web-app-capable" content="yes" />
   <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
   <meta name="theme-color" content="#1a1a1a" />
-  <script type="module" crossorigin src="/assets/index-BYXQcBQc.js"></script>
+  <script type="module" crossorigin src="/assets/index-cJ7MQBLi.js"></script>
   <link rel="stylesheet" crossorigin href="/assets/index-CiwYPknn.css">
 </head>
 <body>

package/dist/server/auth.js CHANGED Viewed

@@ -1,14 +1,34 @@
-import bcrypt from 'bcrypt';
 import crypto from 'node:crypto';
-const SALT_ROUNDS = 10;
+import { promisify } from 'node:util';
+const scrypt = promisify(crypto.scrypt);
+const SCRYPT_KEYLEN = 64;
 const MAX_ATTEMPTS = 5;
 const LOCKOUT_DURATION_MS = 15 * 60 * 1000; // 15 minutes
 const attemptMap = new Map();
 export async function hashPin(pin) {
-    return bcrypt.hash(pin, SALT_ROUNDS);
+    const salt = crypto.randomBytes(16).toString('hex');
+    const derived = await scrypt(pin, salt, SCRYPT_KEYLEN);
+    return `scrypt:${salt}:${derived.toString('hex')}`;
 }
 export async function verifyPin(pin, hash) {
-    return bcrypt.compare(pin, hash);
+    if (hash.startsWith('scrypt:')) {
+        const [, salt, storedHashHex] = hash.split(':');
+        if (!salt || !storedHashHex)
+            return false;
+        try {
+            const storedBuf = Buffer.from(storedHashHex, 'hex');
+            if (storedBuf.length !== SCRYPT_KEYLEN)
+                return false;
+            const derived = await scrypt(pin, salt, SCRYPT_KEYLEN);
+            return crypto.timingSafeEqual(storedBuf, derived);
+        }
+        catch {
+            return false;
+        }
+    }
+    // Legacy bcrypt hashes: require PIN reset
+    console.warn('[auth] Legacy bcrypt PIN hash detected. Delete pinHash from config and restart to set a new PIN.');
+    return false;
 }
 export function isRateLimited(ip) {
     const entry = attemptMap.get(ip);

package/dist/server/index.js CHANGED Viewed

@@ -26,21 +26,9 @@ import { semverLessThan } from './utils.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const execFileAsync = promisify(execFile);
-// ── Signal protection ────────────────────────────────────────────────────
-// Ignore SIGPIPE: piped bash commands (e.g. `cmd | grep | tail`) generate
-// SIGPIPE when the reading end of the pipe closes before the writer finishes.
-// node-pty's native module can propagate these to PTY sessions, causing
-// unexpected "session exited" in the browser. Ignoring SIGPIPE at the server
-// level prevents this cascade.
-process.on('SIGPIPE', () => { });
-// Ignore SIGHUP: if the controlling terminal disconnects (e.g. SSH drops),
-// keep the server and all PTY sessions alive.
-process.on('SIGHUP', () => { });
 // When run via CLI bin, config lives in ~/.config/claude-remote-cli/
 // When run directly (development), fall back to local config.json
 const CONFIG_PATH = process.env.CLAUDE_REMOTE_CONFIG || path.join(__dirname, '..', '..', 'config.json');
-// Ensure worktree metadata directory exists alongside config
-ensureMetaDir(CONFIG_PATH);
 const VERSION_CACHE_TTL = 5 * 60 * 1000;
 let versionCache = null;
 function getCurrentVersion() {
@@ -146,6 +134,11 @@ function ensureGitignore(repoPath, entry) {
     }
 }
 async function main() {
+    // Ignore SIGPIPE: node-pty can propagate pipe breaks causing unexpected session exits
+    process.on('SIGPIPE', () => { });
+    // Ignore SIGHUP: keep server alive if controlling terminal disconnects
+    process.on('SIGHUP', () => { });
+    ensureMetaDir(CONFIG_PATH);
     let config;
     try {
         config = loadConfig(CONFIG_PATH);
@@ -240,7 +233,7 @@ async function main() {
         getSession: sessions.get,
         broadcastEvent,
         fireStateChange: sessions.fireStateChange,
-        notifySessionAttention: push.notifySessionIdle,
+        notifySessionAttention: push.notifySessionAttention,
         configPath: CONFIG_PATH,
     });
     app.use('/hooks', hooksRouter);
@@ -265,7 +258,7 @@ async function main() {
                 if (session.hooksActive && session.lastAttentionNotifiedAt && Date.now() - session.lastAttentionNotifiedAt < 10000) {
                     return;
                 }
-                push.notifySessionIdle(sessionId, session);
+                push.notifySessionAttention(sessionId, session);
             }
         }
     });

package/dist/server/output-parsers/codex-parser.js CHANGED Viewed

@@ -9,7 +9,5 @@ export class CodexOutputParser {
     onData(_chunk, _recentScrollback) {
         return null;
     }
-    reset() {
-        // No state to reset
-    }
+    reset() { }
 }

package/dist/server/pty-handler.js CHANGED Viewed

@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { AGENT_COMMANDS, AGENT_CONTINUE_ARGS } from './types.js';
 import { readMeta, writeMeta } from './config.js';
-import { fireSessionEnd } from './sessions.js';
+import { cleanEnv } from './utils.js';
 import { outputParsers } from './output-parsers/index.js';
 const IDLE_TIMEOUT_MS = 5000;
 const MAX_SCROLLBACK = 256 * 1024; // 256KB max
@@ -24,7 +24,7 @@ export function resolveTmuxSpawn(command, args, tmuxSessionName) {
         ],
     };
 }
-export function generateHooksSettings(sessionId, port, token) {
+function writeHooksSettingsFile(sessionId, port, token) {
     const dir = path.join(os.tmpdir(), 'claude-remote-cli', sessionId);
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     const filePath = path.join(dir, 'hooks-settings.json');
@@ -47,14 +47,12 @@ export function generateHooksSettings(sessionId, port, token) {
     fs.chmodSync(filePath, 0o600);
     return filePath;
 }
-export function createPtySession(params, sessionsMap, idleChangeCallbacks, stateChangeCallbacks = []) {
+export function createPtySession(params, sessionsMap, idleChangeCallbacks, stateChangeCallbacks = [], sessionEndCallbacks = []) {
     const { id, type, agent = 'claude', repoName, repoPath, cwd, root, worktreeName, branchName, displayName, command, args: rawArgs = [], cols = 80, rows = 24, configPath, useTmux: paramUseTmux, tmuxSessionName: paramTmuxSessionName, initialScrollback, restored: paramRestored, port, forceOutputParser, } = params;
     let args = rawArgs;
     const createdAt = new Date().toISOString();
     const resolvedCommand = command || AGENT_COMMANDS[agent];
-    // Strip CLAUDECODE env var to allow spawning claude inside a claude-managed server
-    const env = Object.assign({}, process.env);
-    delete env.CLAUDECODE;
+    const env = cleanEnv();
     // Inject hooks settings when spawning a real claude agent (not custom command, not forceOutputParser)
     let hookToken = '';
     let hooksActive = false;
@@ -63,7 +61,7 @@ export function createPtySession(params, sessionsMap, idleChangeCallbacks, state
     if (shouldInjectHooks) {
         hookToken = crypto.randomBytes(32).toString('hex');
         try {
-            settingsPath = generateHooksSettings(id, port, hookToken);
+            settingsPath = writeHooksSettingsFile(id, port, hookToken);
             args = ['--settings', settingsPath, ...args];
             hooksActive = true;
         }
@@ -271,7 +269,14 @@ export function createPtySession(params, sessionsMap, idleChangeCallbacks, state
             if (configPath && worktreeName) {
                 writeMeta(configPath, { worktreePath: repoPath, displayName: session.displayName, lastActivity: session.lastActivity });
             }
-            fireSessionEnd(id, repoPath, session.branchName);
+            for (const cb of sessionEndCallbacks) {
+                try {
+                    cb(id, repoPath, session.branchName);
+                }
+                catch (err) {
+                    console.error('[pty-handler] sessionEnd callback error:', err);
+                }
+            }
             sessionsMap.delete(id);
             const tmpDir = path.join(os.tmpdir(), 'claude-remote-cli', id);
             fs.rm(tmpDir, { recursive: true, force: true }, () => { });

package/dist/server/push.js CHANGED Viewed

@@ -58,7 +58,7 @@ function truncatePayload(payload) {
     }
     return payload.slice(0, MAX_PAYLOAD_SIZE);
 }
-export function notifySessionIdle(sessionId, session) {
+export function notifySessionAttention(sessionId, session) {
     if (!vapidPublicKey)
         return;
     const payloadObj = {

package/dist/server/sessions.js CHANGED Viewed

@@ -34,57 +34,49 @@ function onSessionEnd(cb) {
     sessionEndCallbacks.push(cb);
 }
 function fireSessionEnd(sessionId, repoPath, branchName) {
-    for (const cb of sessionEndCallbacks)
-        cb(sessionId, repoPath, branchName);
+    for (const cb of sessionEndCallbacks) {
+        try {
+            cb(sessionId, repoPath, branchName);
+        }
+        catch (err) {
+            console.error('[sessions] sessionEnd callback error:', err);
+        }
+    }
 }
 export function fireStateChange(sessionId, state) {
     for (const cb of stateChangeCallbacks)
         cb(sessionId, state);
 }
-function create({ id: providedId, type, agent = 'claude', repoName, repoPath, cwd, root, worktreeName, branchName, displayName, command, args = [], cols = 80, rows = 24, configPath, useTmux: paramUseTmux, tmuxSessionName: paramTmuxSessionName, initialScrollback, restored: paramRestored, needsBranchRename: paramNeedsBranchRename, branchRenamePrompt: paramBranchRenamePrompt, port, forceOutputParser }) {
+function create({ id: providedId, needsBranchRename, branchRenamePrompt, agent = 'claude', cols = 80, rows = 24, args = [], port, forceOutputParser, ...rest }) {
     const id = providedId || crypto.randomBytes(8).toString('hex');
-    // PTY path
     const ptyParams = {
+        ...rest,
         id,
-        type,
         agent,
-        repoName,
-        repoPath,
-        cwd,
-        root,
-        worktreeName,
-        branchName,
-        displayName,
-        command,
-        args,
         cols,
         rows,
-        configPath,
-        useTmux: paramUseTmux,
-        tmuxSessionName: paramTmuxSessionName,
-        initialScrollback,
-        restored: paramRestored,
+        args,
         port: port ?? defaultPort,
         forceOutputParser: forceOutputParser ?? defaultForceOutputParser,
     };
-    const { session: ptySession, result } = createPtySession(ptyParams, sessions, idleChangeCallbacks, stateChangeCallbacks);
+    const { session: ptySession, result } = createPtySession(ptyParams, sessions, idleChangeCallbacks, stateChangeCallbacks, sessionEndCallbacks);
     trackEvent({
         category: 'session',
         action: 'created',
         target: id,
         properties: {
             agent,
-            type: type ?? 'worktree',
-            workspace: root ?? repoPath,
-            mode: command ? 'terminal' : 'agent',
+            type: rest.type ?? 'worktree',
+            workspace: rest.root ?? rest.repoPath,
+            mode: rest.command ? 'terminal' : 'agent',
         },
         session_id: id,
     });
-    if (paramNeedsBranchRename) {
+    if (needsBranchRename) {
         ptySession.needsBranchRename = true;
     }
-    if (paramBranchRenamePrompt) {
-        ptySession.branchRenamePrompt = paramBranchRenamePrompt;
+    if (branchRenamePrompt) {
+        ptySession.branchRenamePrompt = branchRenamePrompt;
     }
     return { ...result, needsBranchRename: !!ptySession.needsBranchRename };
 }
@@ -386,6 +378,4 @@ async function populateMetaCache() {
         }
     }));
 }
-// Re-export pty-handler utilities for backward compatibility
-export { generateTmuxSessionName, resolveTmuxSpawn } from './pty-handler.js';
-export { configure, create, get, list, kill, killAllTmuxSessions, resize, updateDisplayName, write, onIdleChange, onStateChange, onSessionEnd, fireSessionEnd, findRepoSession, nextTerminalName, serializeAll, restoreFromDisk, activeTmuxSessionNames, getSessionMeta, getAllSessionMeta, populateMetaCache, AGENT_COMMANDS, AGENT_CONTINUE_ARGS, AGENT_YOLO_ARGS };
+export { configure, create, get, list, kill, killAllTmuxSessions, resize, updateDisplayName, write, onIdleChange, onStateChange, onSessionEnd, findRepoSession, nextTerminalName, serializeAll, restoreFromDisk, activeTmuxSessionNames, getSessionMeta, getAllSessionMeta, populateMetaCache, AGENT_COMMANDS, AGENT_CONTINUE_ARGS, AGENT_YOLO_ARGS };

package/dist/server/workspaces.js CHANGED Viewed

@@ -15,9 +15,7 @@ const BROWSE_DENYLIST = new Set([
 ]);
 const BROWSE_MAX_ENTRIES = 100;
 const BULK_MAX_PATHS = 50;
-// ---------------------------------------------------------------------------
 // Exported helpers
-// ---------------------------------------------------------------------------
 /**
  * Resolves and validates a raw workspace path string.
  * Throws with a human-readable message if the path is invalid.
@@ -70,9 +68,7 @@ export async function detectGitRepo(dirPath, execAsync = execFileAsync) {
     }
     return { isGitRepo: true, defaultBranch };
 }
-// ---------------------------------------------------------------------------
 // Router factory
-// ---------------------------------------------------------------------------
 /**
  * Creates and returns an Express Router that handles all /workspaces routes.
  *
@@ -87,9 +83,7 @@ export function createWorkspaceRouter(deps) {
     function getConfig() {
         return loadConfig(configPath);
     }
-    // -------------------------------------------------------------------------
     // GET /workspaces — list all workspaces with git info
-    // -------------------------------------------------------------------------
     router.get('/', async (_req, res) => {
         const config = getConfig();
         const workspacePaths = config.workspaces ?? [];
@@ -100,9 +94,7 @@ export function createWorkspaceRouter(deps) {
         }));
         res.json({ workspaces: results });
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces — add a workspace
-    // -------------------------------------------------------------------------
     router.post('/', async (req, res) => {
         const body = req.body;
         const rawPath = body.path;
@@ -145,9 +137,7 @@ export function createWorkspaceRouter(deps) {
         };
         res.status(201).json(workspace);
     });
-    // -------------------------------------------------------------------------
     // DELETE /workspaces — remove a workspace
-    // -------------------------------------------------------------------------
     router.delete('/', async (req, res) => {
         const body = req.body;
         const rawPath = body.path;
@@ -168,9 +158,7 @@ export function createWorkspaceRouter(deps) {
         trackEvent({ category: 'workspace', action: 'removed', target: resolved });
         res.json({ removed: resolved });
     });
-    // -------------------------------------------------------------------------
     // PUT /workspaces/reorder — reorder workspaces
-    // -------------------------------------------------------------------------
     router.put('/reorder', async (req, res) => {
         const body = req.body;
         const rawPaths = body.paths;
@@ -201,9 +189,7 @@ export function createWorkspaceRouter(deps) {
         }));
         res.json({ workspaces: results });
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces/bulk — add multiple workspaces at once
-    // -------------------------------------------------------------------------
     router.post('/bulk', async (req, res) => {
         const body = req.body;
         const rawPaths = body.paths;
@@ -255,9 +241,7 @@ export function createWorkspaceRouter(deps) {
         }
         res.status(201).json({ added, errors });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/dashboard — aggregated PR + activity data for a workspace
-    // -------------------------------------------------------------------------
     router.get('/dashboard', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -339,36 +323,44 @@ export function createWorkspaceRouter(deps) {
             activity,
         });
     });
-    // -------------------------------------------------------------------------
-    // GET /workspaces/settings — per-workspace settings
-    // -------------------------------------------------------------------------
+    function buildMergedSettings(config, workspacePath) {
+        const resolved = path.resolve(workspacePath);
+        const wsOverrides = config.workspaceSettings?.[resolved] ?? {};
+        const effective = getWorkspaceSettings(config, resolved);
+        const overridden = [];
+        for (const key of ['defaultAgent', 'defaultContinue', 'defaultYolo', 'launchInTmux']) {
+            if (wsOverrides[key] !== undefined)
+                overridden.push(key);
+        }
+        return { settings: effective, overridden };
+    }
+    // GET /workspaces/settings — per-workspace overrides only
     router.get('/settings', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
-        const merged = req.query.merged === 'true';
         if (!workspacePath) {
             res.status(400).json({ error: 'path query parameter is required' });
             return;
         }
+        // Backward compat: handle merged=true inline (same logic as /settings/merged)
+        if (req.query.merged === 'true') {
+            res.json(buildMergedSettings(getConfig(), workspacePath));
+            return;
+        }
         const config = getConfig();
         const resolved = path.resolve(workspacePath);
-        if (merged) {
-            const wsOverrides = config.workspaceSettings?.[resolved] ?? {};
-            const effective = getWorkspaceSettings(config, resolved);
-            const overridden = [];
-            for (const key of ['defaultAgent', 'defaultContinue', 'defaultYolo', 'launchInTmux']) {
-                if (wsOverrides[key] !== undefined)
-                    overridden.push(key);
-            }
-            res.json({ settings: effective, overridden });
-        }
-        else {
-            const settings = config.workspaceSettings?.[resolved] ?? {};
-            res.json(settings);
+        const settings = config.workspaceSettings?.[resolved] ?? {};
+        res.json(settings);
+    });
+    // GET /workspaces/settings/merged — effective settings with override tracking
+    router.get('/settings/merged', async (req, res) => {
+        const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
+        if (!workspacePath) {
+            res.status(400).json({ error: 'path query parameter is required' });
+            return;
         }
+        res.json(buildMergedSettings(getConfig(), workspacePath));
     });
-    // -------------------------------------------------------------------------
     // PATCH /workspaces/settings — update per-workspace settings
-    // -------------------------------------------------------------------------
     router.patch('/settings', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -401,9 +393,7 @@ export function createWorkspaceRouter(deps) {
         const final = config.workspaceSettings?.[resolved] ?? {};
         res.json(final);
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/pr — PR info for a specific branch
-    // -------------------------------------------------------------------------
     router.get('/pr', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         const branch = typeof req.query.branch === 'string' ? req.query.branch : undefined;
@@ -430,9 +420,7 @@ export function createWorkspaceRouter(deps) {
             res.status(404).json({ error: 'No PR found for branch' });
         }
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/ci-status — CI check results for a workspace + branch
-    // -------------------------------------------------------------------------
     router.get('/ci-status', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         const branch = typeof req.query.branch === 'string' ? req.query.branch : undefined;
@@ -448,9 +436,7 @@ export function createWorkspaceRouter(deps) {
             res.json({ total: 0, passing: 0, failing: 0, pending: 0 });
         }
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces/branch — switch branch for a workspace
-    // -------------------------------------------------------------------------
     router.post('/branch', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -471,9 +457,7 @@ export function createWorkspaceRouter(deps) {
             res.status(400).json({ error: result.error ?? `Failed to switch to branch: ${branch}` });
         }
     });
-    // -------------------------------------------------------------------------
     // POST /workspaces/worktree — create a new worktree with the next mountain name
-    // -------------------------------------------------------------------------
     router.post('/worktree', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -534,9 +518,7 @@ export function createWorkspaceRouter(deps) {
         }
         res.json({ branchName, mountainName, worktreePath });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/current-branch — current checked-out branch for a path
-    // -------------------------------------------------------------------------
     router.get('/current-branch', async (req, res) => {
         const workspacePath = typeof req.query.path === 'string' ? req.query.path : undefined;
         if (!workspacePath) {
@@ -546,9 +528,7 @@ export function createWorkspaceRouter(deps) {
         const branch = await getCurrentBranch(path.resolve(workspacePath));
         res.json({ branch });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/browse — browse filesystem directories for tree UI
-    // -------------------------------------------------------------------------
     router.get('/browse', async (req, res) => {
         const rawPath = typeof req.query.path === 'string' ? req.query.path : '~';
         const prefix = typeof req.query.prefix === 'string' ? req.query.prefix : '';
@@ -558,7 +538,6 @@ export function createWorkspaceRouter(deps) {
             ? path.join(os.homedir(), rawPath.slice(1))
             : rawPath;
         const resolved = path.resolve(expanded);
-        // Validate path
         let stat;
         try {
             stat = await fs.promises.stat(resolved);
@@ -577,7 +556,6 @@ export function createWorkspaceRouter(deps) {
             res.status(400).json({ error: `Not a directory: ${resolved}` });
             return;
         }
-        // Read directory entries
         let dirents;
         try {
             dirents = await fs.promises.readdir(resolved, { withFileTypes: true });
@@ -600,7 +578,6 @@ export function createWorkspaceRouter(deps) {
                 return false;
             return true;
         });
-        // Sort alphabetically case-insensitive
         dirs.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()));
         const total = dirs.length;
         const truncated = dirs.length > BROWSE_MAX_ENTRIES;
@@ -609,7 +586,6 @@ export function createWorkspaceRouter(deps) {
         // Enrich each entry with isGitRepo and hasChildren (parallelized)
         const entries = await Promise.all(dirs.map(async (d) => {
             const entryPath = path.join(resolved, d.name);
-            // Check for .git directory (isGitRepo)
             let isGitRepo = false;
             try {
                 const gitStat = await fs.promises.stat(path.join(entryPath, '.git'));
@@ -618,7 +594,6 @@ export function createWorkspaceRouter(deps) {
             catch {
                 // not a git repo
             }
-            // Check if has at least one subdirectory child (hasChildren)
             let hasChildren = false;
             try {
                 const children = await fs.promises.readdir(entryPath, { withFileTypes: true });
@@ -636,9 +611,7 @@ export function createWorkspaceRouter(deps) {
         }));
         res.json({ resolved, entries, truncated, total });
     });
-    // -------------------------------------------------------------------------
     // GET /workspaces/autocomplete — path prefix autocomplete
-    // -------------------------------------------------------------------------
     router.get('/autocomplete', async (req, res) => {
         const prefix = typeof req.query.prefix === 'string' ? req.query.prefix : '';
         if (!prefix) {

package/dist/server/ws.js CHANGED Viewed

@@ -72,15 +72,14 @@ function setupWebSocket(server, authenticatedTokens, watcher, _configPath) {
         const session = sessionMap.get(ws);
         if (!session)
             return;
-        const ptySession = session;
         let dataDisposable = null;
         let exitDisposable = null;
-        function attachToPty(ptyProcess) {
+        const attachToPty = (ptyProcess) => {
             // Dispose previous handlers
             dataDisposable?.dispose();
             exitDisposable?.dispose();
             // Replay scrollback
-            for (const chunk of ptySession.scrollback) {
+            for (const chunk of session.scrollback) {
                 if (ws.readyState === ws.OPEN)
                     ws.send(chunk);
             }
@@ -92,29 +91,29 @@ function setupWebSocket(server, authenticatedTokens, watcher, _configPath) {
                 if (ws.readyState === ws.OPEN)
                     ws.close(1000);
             });
-        }
-        attachToPty(ptySession.pty);
+        };
+        attachToPty(session.pty);
         const ptyReplacedHandler = (newPty) => attachToPty(newPty);
-        ptySession.onPtyReplacedCallbacks.push(ptyReplacedHandler);
+        session.onPtyReplacedCallbacks.push(ptyReplacedHandler);
         ws.on('message', (msg) => {
             const str = msg.toString();
             try {
                 const parsed = JSON.parse(str);
                 if (parsed.type === 'resize' && parsed.cols && parsed.rows) {
-                    sessions.resize(ptySession.id, parsed.cols, parsed.rows);
+                    sessions.resize(session.id, parsed.cols, parsed.rows);
                     return;
                 }
             }
             catch (_) { }
-            // Use ptySession.pty dynamically so writes go to current PTY
-            ptySession.pty.write(str);
+            // Use session.pty dynamically so writes go to current PTY
+            session.pty.write(str);
         });
         ws.on('close', () => {
             dataDisposable?.dispose();
             exitDisposable?.dispose();
-            const idx = ptySession.onPtyReplacedCallbacks.indexOf(ptyReplacedHandler);
+            const idx = session.onPtyReplacedCallbacks.indexOf(ptyReplacedHandler);
             if (idx !== -1)
-                ptySession.onPtyReplacedCallbacks.splice(idx, 1);
+                session.onPtyReplacedCallbacks.splice(idx, 1);
         });
     });
     sessions.onIdleChange((sessionId, idle) => {

package/dist/test/auth.test.js CHANGED Viewed

@@ -1,10 +1,12 @@
 import { test } from 'node:test';
 import assert from 'node:assert';
 import { hashPin, verifyPin, isRateLimited, recordFailedAttempt, generateCookieToken, _resetForTesting, } from '../server/auth.js';
-test('hashPin returns bcrypt hash starting with $2b$', async () => {
+test('hashPin returns scrypt hash with expected format', async () => {
     _resetForTesting();
     const hash = await hashPin('1234');
-    assert.ok(hash.startsWith('$2b$'), `Expected hash to start with $2b$, got: ${hash}`);
+    assert.ok(hash.startsWith('scrypt:'), `Expected hash to start with scrypt:, got: ${hash}`);
+    const parts = hash.split(':');
+    assert.strictEqual(parts.length, 3, 'Hash should have 3 colon-separated parts');
 });
 test('verifyPin returns true for correct PIN', async () => {
     _resetForTesting();
@@ -34,6 +36,47 @@ test('rate limiter allows under threshold', () => {
     }
     assert.strictEqual(isRateLimited(ip), false);
 });
+test('verifyPin returns false for legacy bcrypt hash (requires PIN reset)', async () => {
+    _resetForTesting();
+    const legacyHash = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012';
+    const result = await verifyPin('1234', legacyHash);
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for malformed scrypt hash (missing parts)', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'scrypt:saltonly');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for scrypt hash with empty salt', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'scrypt::deadbeef');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for scrypt hash with wrong key length', async () => {
+    _resetForTesting();
+    // Valid hex but wrong length (should be 64 bytes = 128 hex chars)
+    const result = await verifyPin('1234', 'scrypt:abcd1234:deadbeef');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for completely empty hash', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', '');
+    assert.strictEqual(result, false);
+});
+test('verifyPin returns false for garbage input', async () => {
+    _resetForTesting();
+    const result = await verifyPin('1234', 'not-a-valid-hash-at-all');
+    assert.strictEqual(result, false);
+});
+test('hashPin produces unique salts', async () => {
+    _resetForTesting();
+    const hash1 = await hashPin('1234');
+    const hash2 = await hashPin('1234');
+    assert.notStrictEqual(hash1, hash2, 'Two hashes of the same PIN should have different salts');
+    // But both should verify correctly
+    assert.strictEqual(await verifyPin('1234', hash1), true);
+    assert.strictEqual(await verifyPin('1234', hash2), true);
+});
 test('generateCookieToken returns non-empty string', () => {
     _resetForTesting();
     const token = generateCookieToken();

package/dist/test/sessions.test.js CHANGED Viewed

@@ -4,7 +4,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import * as sessions from '../server/sessions.js';
-import { resolveTmuxSpawn, generateTmuxSessionName, serializeAll, restoreFromDisk } from '../server/sessions.js';
+import { resolveTmuxSpawn, generateTmuxSessionName } from '../server/pty-handler.js';
+import { serializeAll, restoreFromDisk } from '../server/sessions.js';
 // Track created session IDs so we can clean up after each test
 const createdIds = [];
 afterEach(() => {