codehere 0.2.1 → 0.3.0-rc.1

package/dist/infrastructure/protocols/mcp-server-impl.js

@@ -19,10 +19,16 @@
  *   codehere serve --port 8080  # custom port
  */
 import http from 'http';
-import { readFileSync, existsSync } from 'fs';
+import { readFileSync, existsSync, statSync, watchFile, unwatchFile } from 'fs';
 import { join, relative } from 'path';
 import { collectFilesForMCP, scoreFileForMCP } from './mcp-helpers.js';
-import { scanPayload, calculateRiskScore } from '../hooks/claude-sdk-hook.js';
+import { scanPayload, calculateRiskScore, AUDIT_FILE } from '../hooks/claude-sdk-hook.js';
+import { getVersion } from '../../utils/version.js';
+import { TASK_HTML, HISTORY_HTML } from './ui-page.js';
+import { SessionManager, availableAgents, readinessForAllAgents, getAdapter, allAdapters, } from '../orchestration/session-manager.js';
+import { isAbsolute } from 'path';
+import { installAgent } from '../orchestration/agent-installer.js';
+import { detectReadiness } from '../orchestration/readiness.js';
 // ── Tool definitions ─────────────────────────────────────────────────────────
 const TOOLS = [
     {
@@ -100,8 +106,8 @@ function handleTrust(params) {
             score: result.score,
             grade: result.grade,
             summary: result.summary,
-            criticalCount: result.findings.filter(f => f.severity === 'critical').length,
-            highCount: result.findings.filter(f => f.severity === 'high').length,
+            criticalCount: result.findings.filter((f) => f.severity === 'critical').length,
+            highCount: result.findings.filter((f) => f.severity === 'high').length,
             recommendation: result.score >= 75
                 ? 'Safe — minor issues can be addressed in follow-up'
                 : result.score >= 60
@@ -115,7 +121,7 @@ function handleScan(params) {
     const text = String(params.text ?? '');
     const findings = scanPayload(text);
     const riskScore = calculateRiskScore(findings);
-    const criticalFindings = findings.filter(f => f.severity === 'critical');
+    const criticalFindings = findings.filter((f) => f.severity === 'critical');
     const blocked = criticalFindings.length > 0 || riskScore >= 60;
     return JSON.stringify({
         blocked,
@@ -137,7 +143,7 @@ function handleReview(params) {
         if (files.length === 0) {
             return JSON.stringify({ message: 'No code files found', path: targetPath });
         }
-        const results = files.map(f => scoreFileForMCP(relative(targetPath, f.filepath), f.code));
+        const results = files.map((f) => scoreFileForMCP(relative(targetPath, f.filepath), f.code));
         results.sort((a, b) => a.score - b.score); // worst first
         const top = results.slice(0, topN);
         const overallScore = Math.round(results.reduce((s, r) => s + r.score, 0) / results.length);
@@ -145,13 +151,13 @@ function handleReview(params) {
             overallScore,
             grade: overallScore >= 90 ? 'A' : overallScore >= 75 ? 'B' : overallScore >= 60 ? 'C' : overallScore >= 40 ? 'D' : 'F',
             totalFiles: results.length,
-            riskiestFiles: top.map(r => ({
+            riskiestFiles: top.map((r) => ({
                 filepath: r.filepath,
                 score: r.score,
                 grade: r.grade,
                 summary: r.summary,
-                criticalCount: r.findings.filter(f => f.severity === 'critical').length,
-                highCount: r.findings.filter(f => f.severity === 'high').length,
+                criticalCount: r.findings.filter((f) => f.severity === 'critical').length,
+                highCount: r.findings.filter((f) => f.severity === 'high').length,
             })),
         });
     }
@@ -163,19 +169,24 @@ function handleAudit(params) {
     const limit = Number(params.limit ?? 20);
     const blockedOnly = Boolean(params.blockedOnly);
     if (!existsSync(AUDIT_FILE_PATH)) {
-        return JSON.stringify({ message: 'No audit log yet — install hooks first with: codehere hook install', entries: [] });
+        return JSON.stringify({
+            message: 'No audit log yet — install hooks first with: codehere hook install',
+            entries: [],
+        });
     }
     const lines = readFileSync(AUDIT_FILE_PATH, 'utf-8')
         .split('\n')
         .filter(Boolean)
         .slice(-Math.min(limit * 3, 500)); // read more than needed to account for filter
     const entries = lines
-        .map(l => { try {
-        return JSON.parse(l);
-    }
-    catch {
-        return null;
-    } })
+        .map((l) => {
+        try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null;
+        }
+    })
         .filter(Boolean)
         .filter((e) => !blockedOnly || e.blocked)
         .slice(-limit);
@@ -189,11 +200,12 @@ function dispatch(req) {
         switch (req.method) {
             case 'initialize':
                 return {
-                    jsonrpc: '2.0', id,
+                    jsonrpc: '2.0',
+                    id,
                     result: {
                         protocolVersion: '2024-11-05',
                         capabilities: { tools: {} },
-                        serverInfo: { name: 'codehere', version: '0.2.0' },
+                        serverInfo: { name: 'codehere', version: getVersion() },
                     },
                 };
             case 'tools/list':
@@ -219,7 +231,8 @@ function dispatch(req) {
                         return { jsonrpc: '2.0', id, error: { code: -32601, message: `Unknown tool: ${toolName}` } };
                 }
                 return {
-                    jsonrpc: '2.0', id,
+                    jsonrpc: '2.0',
+                    id,
                     result: { content: [{ type: 'text', text: content }] },
                 };
             }
@@ -250,13 +263,338 @@ export function startMCPServer(options = {}) {
         // Health check
         if (req.method === 'GET' && req.url === '/health') {
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ status: 'ok', server: 'codehere-mcp', version: '0.2.0', tools: TOOLS.length }));
+            res.end(JSON.stringify({ status: 'ok', server: 'codehere-mcp', version: getVersion(), tools: TOOLS.length }));
+            return;
+        }
+        // v0.3 primary UI: task intake + active sessions
+        if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(TASK_HTML);
+            return;
+        }
+        // History / audit feed (what we built Day 0; now secondary)
+        if (req.method === 'GET' && (req.url === '/history' || req.url === '/history/')) {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(HISTORY_HTML);
+            return;
+        }
+        // Backwards-compat: /ui used to be the Mission Control audit view — now at /history
+        if (req.method === 'GET' && (req.url === '/ui' || req.url === '/ui/')) {
+            res.writeHead(302, { Location: '/history' });
+            res.end();
+            return;
+        }
+        // Live audit event stream (SSE)
+        if (req.method === 'GET' && req.url === '/events') {
+            res.writeHead(200, {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                Connection: 'keep-alive',
+            });
+            // Replay last 50 events on connect so the UI isn't empty
+            let lastSize = 0;
+            if (existsSync(AUDIT_FILE)) {
+                try {
+                    const content = readFileSync(AUDIT_FILE, 'utf-8');
+                    lastSize = Buffer.byteLength(content, 'utf-8');
+                    const lines = content.split('\n').filter((l) => l.trim().length > 0);
+                    for (const line of lines.slice(-50)) {
+                        res.write(`data: ${line}\n\n`);
+                    }
+                }
+                catch {
+                    /* no audit yet */
+                }
+            }
+            // Tail the audit file for new events
+            const onChange = () => {
+                try {
+                    if (!existsSync(AUDIT_FILE))
+                        return;
+                    const currentSize = statSync(AUDIT_FILE).size;
+                    if (currentSize <= lastSize)
+                        return;
+                    const fd = readFileSync(AUDIT_FILE, 'utf-8');
+                    const fresh = fd.slice(lastSize);
+                    lastSize = Buffer.byteLength(fd, 'utf-8');
+                    for (const line of fresh.split('\n').filter((l) => l.trim().length > 0)) {
+                        res.write(`data: ${line}\n\n`);
+                    }
+                }
+                catch {
+                    /* transient read errors are fine */
+                }
+            };
+            watchFile(AUDIT_FILE, { interval: 500 }, onChange);
+            // Keep-alive ping every 15s so proxies don't kill the stream
+            const ping = setInterval(() => res.write(': ping\n\n'), 15000);
+            req.on('close', () => {
+                clearInterval(ping);
+                unwatchFile(AUDIT_FILE, onChange);
+            });
+            return;
+        }
+        // ── F2 agent registry ─────────────────────────────────────────────────────
+        if (req.method === 'GET' && req.url === '/api/agents') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ agents: availableAgents() }));
+            return;
+        }
+        // ── Gate B3 · Audit summary (moat visible on main page) ───────────────────
+        // Principle #3 status-at-a-glance + #7 agent-provenance. Reads the hook audit
+        // log's last 24h, aggregates: how many actions fired across all agents, how
+        // many codehere blocked, mean trust (= 100 - mean riskScore).
+        if (req.method === 'GET' && req.url === '/api/audit/summary') {
+            const windowMs = 24 * 60 * 60 * 1000;
+            const cutoff = Date.now() - windowMs;
+            let actions = 0, blocked = 0, riskSum = 0, riskN = 0;
+            const sessionIds = new Set();
+            try {
+                if (existsSync(AUDIT_FILE)) {
+                    const content = readFileSync(AUDIT_FILE, 'utf-8');
+                    const lines = content.split('\n');
+                    // Walk backwards; stop at first line older than cutoff (log is append-chronological)
+                    for (let i = lines.length - 1; i >= 0; i--) {
+                        const line = lines[i].trim();
+                        if (!line)
+                            continue;
+                        let entry;
+                        try {
+                            entry = JSON.parse(line);
+                        }
+                        catch {
+                            continue;
+                        }
+                        const ts = typeof entry.timestamp === 'number'
+                            ? entry.timestamp
+                            : entry.timestamp
+                                ? Date.parse(String(entry.timestamp))
+                                : 0;
+                        if (!ts || ts < cutoff)
+                            break;
+                        actions += 1;
+                        if (entry.blocked)
+                            blocked += 1;
+                        if (typeof entry.riskScore === 'number') {
+                            riskSum += entry.riskScore;
+                            riskN += 1;
+                        }
+                        if (entry.sessionId)
+                            sessionIds.add(entry.sessionId);
+                    }
+                }
+            }
+            catch {
+                /* empty audit — zeros are fine */
+            }
+            const avgTrust = riskN > 0 ? Math.max(0, Math.round(100 - riskSum / riskN)) : null;
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                windowHours: 24,
+                actions,
+                blocked,
+                agents: sessionIds.size,
+                avgTrust,
+            }));
+            return;
+        }
+        // ── F1 · Agent install (zero-terminal setup — principle #10) ──────────────
+        // POST /api/agents/:id/install → SSE stream of install output.
+        // The command comes from the adapter's checkReadiness().installHint — never
+        // from the user over the wire. codehere is the thing that runs the install,
+        // not a page that tells the user how to run it.
+        const installMatch = req.url?.match(/^\/api\/agents\/([a-z0-9-]+)\/install$/i);
+        if (req.method === 'POST' && installMatch) {
+            const adapterId = installMatch[1];
+            const adapter = getAdapter(adapterId);
+            if (!adapter) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: `No such agent: ${adapterId}` }));
+                return;
+            }
+            const session = installAgent(adapter);
+            if (!session) {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Agent already installed or has no install hint' }));
+                return;
+            }
+            res.writeHead(200, {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                Connection: 'keep-alive',
+            });
+            const unsubscribe = session.subscribe((evt) => {
+                res.write(`data: ${JSON.stringify(evt)}\n\n`);
+            });
+            const ping = setInterval(() => res.write(': ping\n\n'), 15000);
+            req.on('close', () => {
+                clearInterval(ping);
+                unsubscribe();
+            });
+            return;
+        }
+        // ── E2 · Per-agent readiness (onboarding surface) ─────────────────────────
+        // Full registry snapshot: install state + auth state + hints. Powers the
+        // setup-aware agent dropdown and the one-click swap flow on auth errors.
+        if (req.method === 'GET' && req.url === '/api/readiness/agents') {
+            try {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ agents: readinessForAllAgents() }));
+            }
+            catch (e) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'readiness_check_failed', detail: String(e) }));
+            }
+            return;
+        }
+        // ── F1a readiness check ───────────────────────────────────────────────────
+        if (req.method === 'GET' && req.url === '/api/readiness') {
+            try {
+                const report = detectReadiness();
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(report));
+            }
+            catch (e) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'readiness_check_failed', detail: String(e) }));
+            }
+            return;
+        }
+        // ── F1 task orchestration routes ─────────────────────────────────────────
+        // POST /api/task               — { prompt, cwd? } → { sessionId }
+        // GET  /api/tasks              — list all sessions
+        // GET  /api/task/:id/events    — SSE stream
+        // POST /api/task/:id/kill      — terminate
+        if (req.url && req.url.startsWith('/api/task')) {
+            const manager = SessionManager.getInstance();
+            if (req.method === 'POST' && req.url === '/api/task') {
+                let body = '';
+                req.on('data', (c) => {
+                    body += c;
+                });
+                req.on('end', () => {
+                    try {
+                        const { prompt, cwd, agent } = JSON.parse(body || '{}');
+                        if (!prompt || typeof prompt !== 'string') {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'prompt (string) required' }));
+                            return;
+                        }
+                        // CRIT-5 fix · whitelist agent ID against the registry BEFORE any
+                        // log/spawn. Stops log injection (`agent: "claude-code\n[FAKE]"`),
+                        // future-proofs against partial-match exploits, and fails fast
+                        // with a clear 400 instead of letting SessionManager.spawn throw.
+                        const validAgentIds = new Set(allAdapters().map((a) => a.id));
+                        const agentId = agent ?? 'claude-code';
+                        if (typeof agentId !== 'string' || !validAgentIds.has(agentId)) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({
+                                error: `Unknown agent: ${typeof agentId === 'string' ? agentId.slice(0, 64) : '<non-string>'}`,
+                                valid: [...validAgentIds],
+                            }));
+                            return;
+                        }
+                        // Path-traversal + null-byte defense · cwd must be absolute and
+                        // free of NUL bytes (some filesystems treat \0 as terminator).
+                        if (cwd !== undefined) {
+                            if (typeof cwd !== 'string' || cwd.includes('\0') || !isAbsolute(cwd)) {
+                                res.writeHead(400, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: 'cwd must be an absolute path with no NUL bytes' }));
+                                return;
+                            }
+                        }
+                        const session = manager.spawn(prompt, agentId, { cwd });
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            sessionId: session.sessionId,
+                            startedAt: session.startedAt,
+                            status: session.status,
+                            agent: session.agent,
+                        }));
+                    }
+                    catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid JSON body', detail: String(e) }));
+                    }
+                });
+                return;
+            }
+            if (req.method === 'GET' && req.url === '/api/tasks') {
+                const spawned = manager.list().map((s) => ({
+                    sessionId: s.sessionId,
+                    prompt: s.prompt,
+                    startedAt: s.startedAt,
+                    status: s.status,
+                    agent: s.agent,
+                    steps: s.steps ?? [],
+                    artifacts: s.artifacts,
+                    provenance: 'spawned',
+                }));
+                const activeAgents = manager.listActiveAgents();
+                const persisted = manager.listPersisted();
+                // Layer 7: timestamp of most recent hook-audit line (= "last edit on this machine")
+                let lastEditAt = null;
+                try {
+                    if (existsSync(AUDIT_FILE))
+                        lastEditAt = statSync(AUDIT_FILE).mtimeMs;
+                }
+                catch {
+                    /* no audit yet — null */
+                }
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    spawned,
+                    persisted,
+                    activeAgents,
+                    lastEditAt,
+                    sessions: spawned, // back-compat for earlier UI code
+                    observed: manager.listObserved(), // legacy, kept for /history or future use
+                }));
+                return;
+            }
+            // /api/task/:id/events  or  /api/task/:id/kill
+            const m = req.url.match(/^\/api\/task\/([^/]+)\/(events|kill)$/);
+            if (m) {
+                const [, sessionId, verb] = m;
+                const session = manager.get(sessionId);
+                if (!session) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: `No session: ${sessionId}` }));
+                    return;
+                }
+                if (verb === 'events' && req.method === 'GET') {
+                    res.writeHead(200, {
+                        'Content-Type': 'text/event-stream',
+                        'Cache-Control': 'no-cache',
+                        Connection: 'keep-alive',
+                    });
+                    const unsubscribe = session.subscribe((event) => {
+                        res.write(`data: ${JSON.stringify(event)}\n\n`);
+                    });
+                    const ping = setInterval(() => res.write(': ping\n\n'), 15000);
+                    req.on('close', () => {
+                        clearInterval(ping);
+                        unsubscribe();
+                    });
+                    return;
+                }
+                if (verb === 'kill' && req.method === 'POST') {
+                    session.kill();
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ sessionId, status: session.status }));
+                    return;
+                }
+            }
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed for this path' }));
             return;
         }
         // MCP endpoint
         if (req.method === 'POST' && req.url === '/mcp') {
             let body = '';
-            req.on('data', chunk => { body += chunk; });
+            req.on('data', (chunk) => {
+                body += chunk;
+            });
             req.on('end', () => {
                 try {
                     const mcpReq = JSON.parse(body);