conductor-oss 0.2.15 → 0.2.16

package/web/.next/standalone/packages/web/src/lib/edgeAuth.test.ts

@@ -0,0 +1,91 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { exportJWK, generateKeyPair, SignJWT } from "jose";
+import { resolveTrustedEdgeAuthConfig, verifyTrustedEdgeIdentity } from "./edgeAuth";
+
+test("resolveTrustedEdgeAuthConfig defaults to verified Cloudflare Access mode", { concurrency: false }, () => {
+  const config = resolveTrustedEdgeAuthConfig(null);
+
+  assert.equal(config.enabled, false);
+  assert.equal(config.provider, "cloudflare-access");
+  assert.equal(config.emailHeader, "Cf-Access-Authenticated-User-Email");
+  assert.equal(config.jwtHeader, "Cf-Access-Jwt-Assertion");
+});
+
+test("verifyTrustedEdgeIdentity blocks generic header passthrough by default", { concurrency: false }, async () => {
+  const original = process.env.CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS;
+  delete process.env.CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS;
+
+  try {
+    const result = await verifyTrustedEdgeIdentity(
+      new Headers({
+        "Cf-Access-Authenticated-User-Email": "dev@example.com",
+      }),
+      {
+        trustedHeaders: {
+          enabled: true,
+          provider: "generic",
+          emailHeader: "Cf-Access-Authenticated-User-Email",
+        },
+      },
+    );
+
+    assert.equal(result?.ok, false);
+    assert.match(result?.reason ?? "", /disabled/i);
+  } finally {
+    if (original === undefined) {
+      delete process.env.CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS;
+    } else {
+      process.env.CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS = original;
+    }
+  }
+});
+
+test("verifyTrustedEdgeIdentity validates a Cloudflare Access JWT before trusting the email", { concurrency: false }, async () => {
+  const { privateKey, publicKey } = await generateKeyPair("RS256");
+  const jwk = await exportJWK(publicKey);
+  jwk.kid = "edge-auth-test";
+
+  const assertion = await new SignJWT({ email: "dev@example.com" })
+    .setProtectedHeader({ alg: "RS256", kid: "edge-auth-test" })
+    .setIssuedAt()
+    .setIssuer("https://acme.cloudflareaccess.com")
+    .setAudience("cf-access-audience")
+    .setExpirationTime("5m")
+    .sign(privateKey);
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async (input) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    assert.equal(url, "https://acme.cloudflareaccess.com/cdn-cgi/access/certs");
+    return new Response(JSON.stringify({ keys: [jwk] }), {
+      headers: { "content-type": "application/json" },
+      status: 200,
+    });
+  };
+
+  try {
+    const result = await verifyTrustedEdgeIdentity(
+      new Headers({
+        "Cf-Access-Jwt-Assertion": assertion,
+        "Cf-Access-Authenticated-User-Email": "dev@example.com",
+      }),
+      {
+        trustedHeaders: {
+          enabled: true,
+          provider: "cloudflare-access",
+          teamDomain: "acme.cloudflareaccess.com",
+          audience: "cf-access-audience",
+          emailHeader: "Cf-Access-Authenticated-User-Email",
+          jwtHeader: "Cf-Access-Jwt-Assertion",
+        },
+      },
+    );
+
+    assert.equal(result?.ok, true);
+    assert.equal(result?.provider, "cloudflare-access");
+    assert.equal(result?.ok ? result.email : null, "dev@example.com");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});

package/web/.next/standalone/packages/web/src/lib/edgeAuth.ts

@@ -0,0 +1,205 @@
+import { createRemoteJWKSet, jwtVerify, type JWTPayload } from "jose";
+import type {
+  DashboardAccessConfig,
+  TrustedHeaderAccessProvider,
+} from "@conductor-oss/core/types";
+
+export type TrustedEdgeAuthProvider = "trusted-header" | "cloudflare-access";
+
+export type TrustedEdgeAuthConfig = {
+  enabled: boolean;
+  provider: TrustedHeaderAccessProvider;
+  emailHeader: string;
+  jwtHeader: string;
+  teamDomain: string | null;
+  audience: string | null;
+  allowInsecureEmailHeader: boolean;
+};
+
+export type TrustedEdgeIdentity =
+  | {
+      ok: true;
+      email: string;
+      provider: TrustedEdgeAuthProvider;
+    }
+  | {
+      ok: false;
+      reason: string;
+      provider: TrustedEdgeAuthProvider;
+    };
+
+const DEFAULT_EMAIL_HEADER = "Cf-Access-Authenticated-User-Email";
+const DEFAULT_JWT_HEADER = "Cf-Access-Jwt-Assertion";
+const CLOUDFLARE_PROVIDER = "cloudflare-access";
+const jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
+
+function normalizeValue(value: string | null | undefined): string | null {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : null;
+}
+
+function normalizeTeamDomain(value: string | null | undefined): string | null {
+  const trimmed = normalizeValue(value);
+  if (!trimmed) return null;
+
+  try {
+    return new URL(trimmed.includes("://") ? trimmed : `https://${trimmed}`).hostname.toLowerCase();
+  } catch {
+    return trimmed
+      .replace(/^https?:\/\//i, "")
+      .replace(/\/+$/g, "")
+      .toLowerCase();
+  }
+}
+
+function getProvider(
+  access: DashboardAccessConfig | null | undefined,
+  teamDomain: string | null,
+  audience: string | null,
+): TrustedHeaderAccessProvider {
+  const provider =
+    normalizeValue(process.env.CONDUCTOR_TRUST_AUTH_PROVIDER)?.toLowerCase()
+    || access?.trustedHeaders?.provider
+    || (teamDomain || audience ? CLOUDFLARE_PROVIDER : null);
+
+  return provider === "generic" ? "generic" : CLOUDFLARE_PROVIDER;
+}
+
+export function resolveTrustedEdgeAuthConfig(
+  access: DashboardAccessConfig | null | undefined,
+): TrustedEdgeAuthConfig {
+  const teamDomain = normalizeTeamDomain(
+    process.env.CONDUCTOR_CLOUDFLARE_ACCESS_TEAM_DOMAIN
+    ?? access?.trustedHeaders?.teamDomain,
+  );
+  const audience = normalizeValue(
+    process.env.CONDUCTOR_CLOUDFLARE_ACCESS_AUDIENCE
+    ?? access?.trustedHeaders?.audience,
+  );
+
+  return {
+    enabled:
+      access?.trustedHeaders?.enabled === true
+      || (process.env.CONDUCTOR_TRUST_AUTH_HEADERS ?? "").trim().toLowerCase() === "true",
+    provider: getProvider(access, teamDomain, audience),
+    emailHeader:
+      normalizeValue(process.env.CONDUCTOR_TRUST_AUTH_EMAIL_HEADER)
+      ?? normalizeValue(access?.trustedHeaders?.emailHeader)
+      ?? DEFAULT_EMAIL_HEADER,
+    jwtHeader:
+      normalizeValue(process.env.CONDUCTOR_TRUST_AUTH_JWT_HEADER)
+      ?? normalizeValue(access?.trustedHeaders?.jwtHeader)
+      ?? DEFAULT_JWT_HEADER,
+    teamDomain,
+    audience,
+    allowInsecureEmailHeader:
+      (process.env.CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS ?? "").trim().toLowerCase() === "true",
+  };
+}
+
+function getCloudflareJwks(teamDomain: string) {
+  const cached = jwksCache.get(teamDomain);
+  if (cached) return cached;
+
+  const next = createRemoteJWKSet(
+    new URL(`https://${teamDomain}/cdn-cgi/access/certs`),
+  );
+  jwksCache.set(teamDomain, next);
+  return next;
+}
+
+function extractEmailFromPayload(payload: JWTPayload): string | null {
+  const emailClaim = payload.email;
+  if (typeof emailClaim === "string" && emailClaim.trim().length > 0) {
+    return emailClaim.trim().toLowerCase();
+  }
+
+  const subClaim = payload.sub;
+  if (typeof subClaim === "string" && subClaim.includes("@")) {
+    return subClaim.trim().toLowerCase();
+  }
+
+  return null;
+}
+
+function formatJwtError(error: unknown): string {
+  if (error instanceof Error && error.message.trim().length > 0) {
+    return error.message;
+  }
+  return "Cloudflare Access token verification failed";
+}
+
+export async function verifyTrustedEdgeIdentity(
+  headers: Headers,
+  access: DashboardAccessConfig | null | undefined,
+): Promise<TrustedEdgeIdentity | null> {
+  const config = resolveTrustedEdgeAuthConfig(access);
+  if (!config.enabled) return null;
+
+  if (config.provider === CLOUDFLARE_PROVIDER) {
+    const assertion = headers.get(config.jwtHeader)?.trim() ?? "";
+    if (!assertion) return null;
+
+    if (!config.teamDomain || !config.audience) {
+      return {
+        ok: false,
+        reason: "Cloudflare Access is enabled but team domain or audience is missing.",
+        provider: "cloudflare-access",
+      };
+    }
+
+    try {
+      const { payload } = await jwtVerify(assertion, getCloudflareJwks(config.teamDomain), {
+        audience: config.audience,
+        issuer: `https://${config.teamDomain}`,
+      });
+      const email = extractEmailFromPayload(payload);
+      if (!email) {
+        return {
+          ok: false,
+          reason: "Cloudflare Access token is missing an email claim.",
+          provider: "cloudflare-access",
+        };
+      }
+
+      const assertedEmail = headers.get(config.emailHeader)?.trim().toLowerCase() ?? "";
+      if (assertedEmail && assertedEmail !== email) {
+        return {
+          ok: false,
+          reason: "Cloudflare Access email header does not match the verified token.",
+          provider: "cloudflare-access",
+        };
+      }
+
+      return {
+        ok: true,
+        email,
+        provider: "cloudflare-access",
+      };
+    } catch (error) {
+      return {
+        ok: false,
+        reason: formatJwtError(error),
+        provider: "cloudflare-access",
+      };
+    }
+  }
+
+  const email = headers.get(config.emailHeader)?.trim().toLowerCase() ?? "";
+  if (!email) return null;
+
+  if (!config.allowInsecureEmailHeader) {
+    return {
+      ok: false,
+      reason:
+        "Generic trusted-header mode is disabled. Use verified Cloudflare Access, or explicitly set CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS=true.",
+      provider: "trusted-header",
+    };
+  }
+
+  return {
+    ok: true,
+    email,
+    provider: "trusted-header",
+  };
+}

package/web/.next/standalone/packages/web/src/lib/editorLinks.ts

@@ -0,0 +1,51 @@
+export type RemoteEditorId = "vscode" | "vscode-insiders";
+
+const REMOTE_EDITOR_LABELS: Record<RemoteEditorId, string> = {
+  vscode: "VS Code",
+  "vscode-insiders": "VS Code Insiders",
+};
+
+function normalizeWorkspacePath(workspacePath: string): string {
+  if (!workspacePath.startsWith("/")) {
+    return `/${workspacePath}`;
+  }
+  return workspacePath;
+}
+
+export function supportsRemoteEditor(editorId: string | null | undefined): editorId is RemoteEditorId {
+  return editorId === "vscode" || editorId === "vscode-insiders";
+}
+
+export function getRemoteEditorLabel(editorId: RemoteEditorId): string {
+  return REMOTE_EDITOR_LABELS[editorId];
+}
+
+export function formatRemoteAuthority(host: string, user?: string | null): string {
+  const trimmedHost = host.trim();
+  const trimmedUser = user?.trim();
+  if (!trimmedHost) return "";
+  return trimmedUser ? `${trimmedUser}@${trimmedHost}` : trimmedHost;
+}
+
+export function buildRemoteEditorUrl({
+  editorId,
+  workspacePath,
+  remoteSshHost,
+  remoteSshUser,
+}: {
+  editorId: string | null | undefined;
+  workspacePath: string | null | undefined;
+  remoteSshHost: string | null | undefined;
+  remoteSshUser?: string | null | undefined;
+}): string | null {
+  if (!supportsRemoteEditor(editorId)) return null;
+  const host = remoteSshHost?.trim();
+  const path = workspacePath?.trim();
+  if (!host || !path) return null;
+
+  const authority = formatRemoteAuthority(host, remoteSshUser);
+  const normalizedPath = normalizeWorkspacePath(path);
+  const encodedPath = encodeURI(normalizedPath);
+
+  return `${editorId}://vscode-remote/ssh-remote+${authority}${encodedPath}`;
+}

package/web/.next/standalone/packages/web/src/lib/event-bus-singleton.ts

@@ -0,0 +1,50 @@
+/**
+ * Singleton accessor for the event bus in the web dashboard.
+ *
+ * The event bus is created once and stored on globalThis to survive
+ * Next.js hot reloads in development. In production, module scope
+ * provides the same guarantee.
+ */
+
+// EventBus type is defined in the event-bus module
+interface EventBus {
+  query(filter: Record<string, unknown>): Array<{
+    id: string;
+    type: string;
+    priority: string;
+    sessionId: string;
+    projectId: string;
+    message: string;
+    timestamp: Date;
+    data: Record<string, unknown>;
+  }>;
+  pending(): Array<Record<string, unknown>>;
+  acknowledge(eventId: string): boolean;
+  metrics(): {
+    totalEmitted: number;
+    bufferSize: number;
+    maxBufferSize: number;
+    subscriberCount: number;
+    pendingCount: number;
+  };
+}
+
+// Use globalThis to survive HMR in development
+const globalForEventBus = globalThis as unknown as {
+  __conductorEventBus?: EventBus;
+};
+
+/**
+ * Get the shared event bus instance. Returns null if not yet initialized.
+ * The event bus is initialized during service bootstrap (getServices).
+ */
+export function getEventBus(): EventBus | null {
+  return globalForEventBus.__conductorEventBus ?? null;
+}
+
+/**
+ * Set the shared event bus instance. Called during service initialization.
+ */
+export function setEventBus(bus: EventBus): void {
+  globalForEventBus.__conductorEventBus = bus;
+}

package/web/.next/standalone/packages/web/src/lib/liveEvents.ts

@@ -0,0 +1,49 @@
+"use client";
+
+import type { SSESnapshotEvent } from "@/lib/types";
+
+type SnapshotListener = (event: SSESnapshotEvent) => void;
+
+const listeners = new Set<SnapshotListener>();
+let eventSource: EventSource | null = null;
+
+function ensureEventSource() {
+  if (eventSource || typeof EventSource === "undefined") {
+    return;
+  }
+
+  eventSource = new EventSource("/api/events");
+  eventSource.onmessage = (event) => {
+    try {
+      const payload = JSON.parse(event.data as string) as SSESnapshotEvent;
+      if (payload.type !== "snapshot" || !Array.isArray(payload.sessions)) {
+        return;
+      }
+      for (const listener of listeners) {
+        listener(payload);
+      }
+    } catch {
+      // Ignore malformed snapshot events.
+    }
+  };
+
+  eventSource.onerror = () => {
+    if (listeners.size === 0) {
+      eventSource?.close();
+      eventSource = null;
+    }
+  };
+}
+
+export function subscribeToSnapshotEvents(listener: SnapshotListener): () => void {
+  listeners.add(listener);
+  ensureEventSource();
+
+  return () => {
+    listeners.delete(listener);
+    if (listeners.size === 0 && eventSource) {
+      eventSource.close();
+      eventSource = null;
+    }
+  };
+}

package/web/.next/standalone/packages/web/src/lib/modelAccess.ts

@@ -0,0 +1,40 @@
+import {
+  getDefaultModelAccessPreferences,
+  type ModelAccessPreferences,
+} from "@conductor-oss/core/types";
+
+const CLAUDE_ACCESS = ["pro", "max", "api"] as const;
+const CODEX_ACCESS = ["chatgpt", "api"] as const;
+const GEMINI_ACCESS = ["oauth", "api"] as const;
+const QWEN_ACCESS = ["oauth", "api"] as const;
+
+function toObject(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return { ...(value as Record<string, unknown>) };
+}
+
+function selectValue<T extends string>(
+  value: unknown,
+  supported: readonly T[],
+  fallback: T,
+): T {
+  return typeof value === "string" && supported.includes(value as T)
+    ? value as T
+    : fallback;
+}
+
+export function normalizeModelAccessPreferences(
+  value: unknown,
+): Required<ModelAccessPreferences> {
+  const root = toObject(value);
+  const defaults = getDefaultModelAccessPreferences();
+
+  return {
+    claudeCode: selectValue(root["claudeCode"], CLAUDE_ACCESS, defaults.claudeCode),
+    codex: selectValue(root["codex"], CODEX_ACCESS, defaults.codex),
+    gemini: selectValue(root["gemini"], GEMINI_ACCESS, defaults.gemini),
+    qwenCode: selectValue(root["qwenCode"], QWEN_ACCESS, defaults.qwenCode),
+  };
+}

package/web/.next/standalone/packages/web/src/lib/projectConfigSync.ts

@@ -0,0 +1,144 @@
+import { join, resolve } from "node:path";
+import { stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import {
+  buildConductorYaml,
+  normalizeProjectConfigMap,
+  resolveConfiguredProjectPath,
+  type ScaffoldProjectConfig,
+} from "@conductor-oss/core";
+import { normalizeModelAccessPreferences } from "@/lib/modelAccess";
+
+type MutableConfig = Record<string, unknown>;
+
+function asNonEmptyString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function toObject(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return { ...(value as Record<string, unknown>) };
+}
+
+function expandHome(value: string): string {
+  if (value.startsWith("~/")) {
+    return resolve(homedir(), value.slice(2));
+  }
+  return resolve(value);
+}
+
+async function isDirectory(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+function normalizePreferences(value: unknown) {
+  const root = toObject(value);
+  const notifications = toObject(root["notifications"]);
+
+  return {
+    onboardingAcknowledged: root["onboardingAcknowledged"] === true,
+    codingAgent: asNonEmptyString(root["codingAgent"]) ?? "claude-code",
+    ide: asNonEmptyString(root["ide"]) ?? "vscode",
+    remoteSshHost: asNonEmptyString(root["remoteSshHost"]),
+    remoteSshUser: asNonEmptyString(root["remoteSshUser"]),
+    markdownEditor: asNonEmptyString(root["markdownEditor"]) ?? "obsidian",
+    modelAccess: normalizeModelAccessPreferences(root["modelAccess"]),
+    notifications: {
+      soundEnabled: notifications["soundEnabled"] !== false,
+      soundFile: notifications["soundFile"] === null
+        ? null
+        : asNonEmptyString(notifications["soundFile"]) ?? "abstract-sound-4",
+    },
+  };
+}
+
+function buildProjectScaffold(
+  projectId: string,
+  project: Record<string, unknown>,
+  projectPath: string,
+): ScaffoldProjectConfig {
+  const agentConfig = toObject(project["agentConfig"]);
+
+  return {
+    projectId,
+    displayName: asNonEmptyString(project["name"]) ?? projectId,
+    repo: asNonEmptyString(project["repo"]) ?? `local-${projectId}`,
+    path: projectPath,
+    agent: asNonEmptyString(project["agent"]) ?? "claude-code",
+    defaultBranch: asNonEmptyString(project["defaultBranch"]) ?? "main",
+    defaultWorkingDirectory: asNonEmptyString(project["defaultWorkingDirectory"]),
+    sessionPrefix: asNonEmptyString(project["sessionPrefix"]),
+    workspace: asNonEmptyString(project["workspace"]),
+    runtime: asNonEmptyString(project["runtime"]),
+    scm: asNonEmptyString(project["scm"]),
+    boardDir: asNonEmptyString(project["boardDir"]),
+    agentModel: asNonEmptyString(agentConfig["model"]),
+    agentReasoningEffort: asNonEmptyString(agentConfig["reasoningEffort"]),
+    agentPermissions: agentConfig["permissions"] === "default" ? "default" : "skip",
+  };
+}
+
+export async function normalizeRootProjectPaths(rootConfig: MutableConfig): Promise<void> {
+  const projects = normalizeProjectConfigMap(rootConfig["projects"]);
+
+  for (const [projectId, rawProject] of Object.entries(projects)) {
+    const project = toObject(rawProject);
+    const rawProjectPath = asNonEmptyString(project["path"]);
+    if (!rawProjectPath) {
+      continue;
+    }
+
+    const resolvedProjectPath = resolveConfiguredProjectPath(
+      rawProjectPath,
+      asNonEmptyString(project["repo"]),
+    );
+
+    if (!await isDirectory(resolvedProjectPath)) {
+      continue;
+    }
+
+    projects[projectId] = {
+      ...project,
+      path: resolvedProjectPath,
+    };
+  }
+
+  rootConfig["projects"] = projects;
+}
+
+export async function syncProjectLocalConfig(rootConfig: MutableConfig, projectId: string): Promise<void> {
+  const projects = normalizeProjectConfigMap(rootConfig["projects"]);
+  const project = toObject(projects[projectId]);
+  const rawProjectPath = asNonEmptyString(project["path"]);
+  if (!rawProjectPath) {
+    return;
+  }
+  const projectPath = resolveConfiguredProjectPath(rawProjectPath, asNonEmptyString(project["repo"]));
+  if (!await isDirectory(projectPath)) {
+    return;
+  }
+
+  const yaml = buildConductorYaml({
+    port: typeof rootConfig["port"] === "number" ? rootConfig["port"] : 4747,
+    dashboardUrl: asNonEmptyString(rootConfig["dashboardUrl"]),
+    preferences: normalizePreferences(rootConfig["preferences"]),
+    projects: [buildProjectScaffold(projectId, project, projectPath)],
+  });
+  await writeFile(join(projectPath, "conductor.yaml"), yaml, "utf8");
+}
+
+export async function syncAllProjectLocalConfigs(rootConfig: MutableConfig): Promise<void> {
+  await normalizeRootProjectPaths(rootConfig);
+  const projects = normalizeProjectConfigMap(rootConfig["projects"]);
+  for (const projectId of Object.keys(projects)) {
+    await syncProjectLocalConfig(rootConfig, projectId);
+  }
+}