coding-agent-harness 1.0.1 → 1.0.2

package/scripts/lib/dashboard-workbench.mjs

@@ -0,0 +1,217 @@
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import http from "node:http";
+import path from "node:path";
+import { URL } from "node:url";
+import { confirmTaskReview } from "./task-lifecycle.mjs";
+import { normalizeTarget } from "./core-shared.mjs";
+import { collectTasks } from "./task-scanner.mjs";
+import { writeDashboardFolder } from "./dashboard-data.mjs";
+
+const jsonHeaders = { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" };
+
+export async function serveDashboardWorkbench(outDir, targetInput, { host = "127.0.0.1", port = 0, localeOverride = "", autoRefresh = false, open = false, label = "dashboard workbench" } = {}) {
+  if (host !== "127.0.0.1") throw new Error("dashboard workbench only supports --host 127.0.0.1");
+  const target = normalizeTarget(targetInput);
+  const outputDir = path.resolve(outDir);
+  const csrfToken = crypto.randomBytes(24).toString("hex");
+  const options = localeOverride ? { localeOverride } : {};
+  let snapshotVersion = Date.now();
+  const regenerate = () => {
+    writeDashboardFolder(outputDir, targetInput, { ...options, workbenchRuntime: true });
+    snapshotVersion = Date.now();
+  };
+  regenerate();
+
+  const server = http.createServer(async (request, response) => {
+    try {
+      const address = server.address();
+      const actualPort = typeof address === "object" && address ? address.port : port;
+      const origin = `http://${host}:${actualPort}`;
+      const requestUrl = new URL(request.url || "/", origin);
+
+      if (requestUrl.pathname === "/api/runtime" && request.method === "GET") {
+        writeJson(response, 200, {
+          mode: "workbench",
+          csrfToken,
+          writableActions: ["review-complete"],
+          target: target.projectRoot,
+          autoRefresh: autoRefresh === true,
+          snapshotVersion,
+        });
+        return;
+      }
+
+      if (requestUrl.pathname === "/api/tasks/review-complete" && request.method === "POST") {
+        assertTrustedWorkbenchRequest(request, { origin, csrfToken });
+        const body = await readJsonBody(request);
+        const taskId = String(body.taskId || "");
+        const task = collectTasks(target).find((item) => item.id === taskId);
+        if (!task) {
+          writeJson(response, 404, { error: "Task not found" });
+          return;
+        }
+        if (!isTaskInReviewStage(task)) {
+          writeJson(response, 409, { error: "Review completion is only available while the task is in review." });
+          return;
+        }
+        if (task.reviewStatus === "confirmed") {
+          writeJson(response, 409, { error: "Review is already confirmed." });
+          return;
+        }
+        const result = confirmTaskReview(target.projectRoot, taskId, {
+          reviewer: body.reviewer || "Human Reviewer",
+          message: body.message || "confirmed from dashboard workbench",
+          evidence: body.evidence || "",
+          confirmText: body.confirmText || "",
+        });
+        regenerate();
+        writeJson(response, 200, result);
+        return;
+      }
+
+      if (request.method !== "GET" && request.method !== "HEAD") {
+        writeJson(response, 405, { error: "Method not allowed" });
+        return;
+      }
+      serveStaticFile(response, outputDir, requestUrl.pathname, request.method === "HEAD");
+    } catch (error) {
+      const status = /CSRF|Origin|Host/.test(error.message) ? 403 : 400;
+      writeJson(response, status, { error: error.message });
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(Number(port), host, resolve);
+  });
+  const address = server.address();
+  const actualPort = typeof address === "object" && address ? address.port : port;
+  const url = `http://${host}:${actualPort}/`;
+  let watcher = null;
+  if (autoRefresh) watcher = startPollingWatch(target.docsRoot, regenerate);
+  console.log(`${label}: ${url} csrf=${csrfToken} outDir=${outputDir}`);
+  if (open) openBrowser(url);
+
+  const close = () => {
+    if (watcher) clearInterval(watcher);
+    server.close(() => process.exit(0));
+  };
+  process.once("SIGINT", close);
+  process.once("SIGTERM", close);
+  await new Promise(() => {});
+}
+
+function isTaskInReviewStage(task) {
+  const state = task?.state || "";
+  const lifecycle = task?.lifecycleState || "";
+  if (["not_started", "planned", "in_progress"].includes(state)) return false;
+  return state === "review" || ["in_review", "review-blocked"].includes(lifecycle);
+}
+
+function startPollingWatch(root, regenerate) {
+  let lastMtime = latestTreeMtime(root);
+  let timer = null;
+  return setInterval(() => {
+    const nextMtime = latestTreeMtime(root);
+    if (nextMtime <= lastMtime) return;
+    lastMtime = nextMtime;
+    clearTimeout(timer);
+    timer = setTimeout(() => {
+      try {
+        regenerate();
+      } catch (error) {
+        console.error(`dashboard regeneration failed: ${error.message}`);
+      }
+    }, 250);
+  }, 1000);
+}
+
+function latestTreeMtime(root) {
+  let latest = 0;
+  if (!fs.existsSync(root)) return latest;
+  const visit = (dir) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if ([".git", "node_modules", "tmp"].includes(entry.name)) continue;
+      const fullPath = path.join(dir, entry.name);
+      const stat = fs.statSync(fullPath);
+      latest = Math.max(latest, stat.mtimeMs);
+      if (entry.isDirectory()) visit(fullPath);
+    }
+  };
+  visit(root);
+  return latest;
+}
+
+function openBrowser(url) {
+  const command =
+    process.platform === "darwin" ? "open" :
+    process.platform === "win32" ? "cmd" :
+    "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => {});
+  child.unref();
+}
+
+function assertTrustedWorkbenchRequest(request, { origin, csrfToken }) {
+  const host = request.headers.host || "";
+  if (host !== origin.replace(/^http:\/\//, "")) throw new Error("Host mismatch");
+  if (request.headers.origin !== origin) throw new Error("Origin mismatch");
+  if (request.headers["x-harness-csrf"] !== csrfToken) throw new Error("CSRF token mismatch");
+}
+
+function readJsonBody(request) {
+  return new Promise((resolve, reject) => {
+    let raw = "";
+    request.setEncoding("utf8");
+    request.on("data", (chunk) => {
+      raw += chunk;
+      if (raw.length > 32_768) {
+        reject(new Error("Request body too large"));
+        request.destroy();
+      }
+    });
+    request.on("end", () => {
+      try {
+        resolve(raw ? JSON.parse(raw) : {});
+      } catch {
+        reject(new Error("Invalid JSON body"));
+      }
+    });
+    request.on("error", reject);
+  });
+}
+
+function serveStaticFile(response, outputDir, urlPath, headOnly) {
+  const decoded = decodeURIComponent(urlPath);
+  const relative = decoded === "/" ? "index.html" : decoded.replace(/^\/+/, "");
+  const filePath = path.resolve(outputDir, relative);
+  if (!isPathInside(filePath, outputDir) || !fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
+    writeJson(response, 404, { error: "Not found" });
+    return;
+  }
+  response.writeHead(200, { "content-type": mimeType(filePath), "cache-control": "no-store" });
+  if (!headOnly) response.end(fs.readFileSync(filePath));
+  else response.end();
+}
+
+function writeJson(response, status, payload) {
+  response.writeHead(status, jsonHeaders);
+  response.end(`${JSON.stringify(payload)}\n`);
+}
+
+function mimeType(filePath) {
+  if (filePath.endsWith(".html")) return "text/html; charset=utf-8";
+  if (filePath.endsWith(".js")) return "text/javascript; charset=utf-8";
+  if (filePath.endsWith(".css")) return "text/css; charset=utf-8";
+  if (filePath.endsWith(".json")) return "application/json; charset=utf-8";
+  if (filePath.endsWith(".md")) return "text/markdown; charset=utf-8";
+  return "application/octet-stream";
+}
+
+function isPathInside(candidate, parent) {
+  const relative = path.relative(path.resolve(parent), path.resolve(candidate));
+  return !relative.startsWith("..") && !path.isAbsolute(relative);
+}

package/scripts/lib/dashboard-writer.mjs

@@ -19,6 +19,8 @@ export function writeDashboardDirectory(outDir, bundle, options = {}) {
   assertSafeDashboardTarget(target, options);
   if (fs.existsSync(target)) fs.rmSync(target, { recursive: true, force: true });
   copyDashboardAssets(target, options);
+  fs.writeFileSync(path.join(target, "assets/app.js"), readDashboardApp(dashboardTemplateRootForLocale(options.locale)));
+  fs.writeFileSync(path.join(target, "index.html"), renderDashboardIndex(options.locale, options));
   fs.writeFileSync(path.join(target, dashboardMarker), "generated dashboard directory\n");
   writeJsonFile(path.join(target, "data/status.json"), bundle.status);
   writeJsonFile(path.join(target, "data/tables.json"), bundle.tables);
@@ -42,8 +44,98 @@ export function writeDashboardDirectory(outDir, bundle, options = {}) {
   return target;
 }
 
+export function writeDashboardFile(outFile, bundle, options = {}) {
+  const target = path.resolve(outFile);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.writeFileSync(target, renderDashboardFile(bundle, options));
+  return target;
+}
+
+export function renderDashboardFile(bundle, options = {}) {
+  const templateRoot = dashboardTemplateRootForLocale(options.locale);
+  const readAsset = (relativePath) => fs.readFileSync(path.join(templateRoot, relativePath), "utf8");
+  const css = readAsset("assets/app.css");
+  const i18n = readAsset("assets/i18n.js");
+  const markdown = readAsset("assets/markdown-reader.js");
+  const mermaid = readAsset("assets/mermaid-renderer.js");
+  const app = readDashboardApp(templateRoot);
+  const title = options.locale === "zh-CN" ? "Harness 控制台" : "Harness Dashboard";
+  const payload = JSON.stringify(bundle).replace(/</g, "\\u003c");
+  const runtimeLocale = options.locale === "zh-CN" ? "zh" : "en";
+  return `<!doctype html>
+<html lang="${options.locale === "zh-CN" ? "zh-CN" : "en"}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${title}</title>
+  <link rel="icon" href="data:,">
+  <style>${css}</style>
+</head>
+<body>
+  <div id="app" class="app-shell" aria-live="polite"></div>
+  <script>window.__HARNESS_DASHBOARD__ = ${payload};</script>
+  <script>window.__HARNESS_LOCALE__ = ${JSON.stringify(runtimeLocale)};</script>
+  <script>${i18n}</script>
+  <script>${markdown}</script>
+  <script>${mermaid}</script>
+  <script>${app}</script>
+</body>
+</html>`;
+}
+
+function renderDashboardIndex(locale = "en-US", options = {}) {
+  const normalizedLocale = locale === "zh-CN" ? "zh-CN" : "en";
+  const runtimeLocale = locale === "zh-CN" ? "zh" : "en";
+  const title = locale === "zh-CN" ? "Harness 控制台" : "Harness Dashboard";
+  const assetVersion = Date.now();
+  return `<!doctype html>
+<html lang="${normalizedLocale}">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${title}</title>
+  <link rel="icon" href="data:,">
+  <link rel="stylesheet" href="./assets/app.css?v=${assetVersion}">
+</head>
+<body>
+  <div id="app" class="app-shell" aria-live="polite"></div>
+  <script src="./assets/dashboard-data.js?v=${assetVersion}"></script>
+  <script>window.__HARNESS_LOCALE__ = ${JSON.stringify(runtimeLocale)};</script>
+  <script>window.__HARNESS_WORKBENCH__ = ${options.workbenchRuntime === true ? "true" : "false"};</script>
+  <script src="./assets/i18n.js?v=${assetVersion}"></script>
+  <script src="./assets/markdown-reader.js?v=${assetVersion}"></script>
+  <script src="./assets/mermaid-renderer.js?v=${assetVersion}"></script>
+  <script src="./assets/app.js?v=${assetVersion}"></script>
+</body>
+</html>`;
+}
+
+function readDashboardApp(templateRoot) {
+  const manifestPath = path.join(templateRoot, "assets/app.manifest.json");
+  if (!fs.existsSync(manifestPath)) return fs.readFileSync(path.join(templateRoot, "assets/app.js"), "utf8");
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  if (!Array.isArray(manifest) || manifest.length === 0) throw new Error(`Invalid dashboard app manifest: ${manifestPath}`);
+  return `${manifest.map((relativePath) => {
+    const source = path.join(templateRoot, "assets", relativePath);
+    if (!fs.existsSync(source)) throw new Error(`Dashboard app source missing: ${relativePath}`);
+    return fs.readFileSync(source, "utf8").trimEnd();
+  }).join("\n\n")}\n`;
+}
+
 function assertSafeDashboardTarget(target, options) {
   const localizedDashboardTemplateRoot = dashboardTemplateRootForLocale(options.locale);
+  const sourceRepoRoot = options.repoRoot ? path.resolve(options.repoRoot) : "";
+  const projectRoot = options.projectRoot ? path.resolve(options.projectRoot) : "";
+  if (
+    sourceRepoRoot &&
+    projectRoot &&
+    isPathInside(projectRoot, sourceRepoRoot) &&
+    path.basename(projectRoot) === ".harness-private" &&
+    isPathInside(target, sourceRepoRoot) &&
+    !isPathInside(target, projectRoot)
+  ) {
+    throw new Error(`Refusing private dashboard output inside publishable source package: ${target}`);
+  }
   const protectedRoots = [
     path.parse(target).root,
     process.env.HOME,
@@ -71,8 +163,7 @@ function assertSafeDashboardTarget(target, options) {
 }
 
 function dashboardTemplateRootForLocale(locale = "en-US") {
-  const localized = locale === "zh-CN" ? path.join(repoRoot, "templates-zh-CN/dashboard") : dashboardTemplateRoot;
-  return fs.existsSync(localized) ? localized : dashboardTemplateRoot;
+  return dashboardTemplateRoot;
 }
 
 function isPathInside(candidate, parent) {