conductor-oss 0.2.5 → 0.2.6

package/web/.next/standalone/packages/web/src/app/unlock/UnlockForm.tsx

@@ -0,0 +1,77 @@
+"use client";
+
+import { type FormEvent, useState } from "react";
+import { useRouter } from "next/navigation";
+
+type UnlockFormProps = {
+  initialError: string | null;
+  nextPath: string;
+};
+
+export function UnlockForm({ initialError, nextPath }: UnlockFormProps) {
+  const router = useRouter();
+  const [token, setToken] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(initialError);
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>): Promise<void> {
+    event.preventDefault();
+    setSubmitting(true);
+    setError(null);
+
+    try {
+      const response = await fetch("/api/auth/session", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ token }),
+      });
+
+      if (!response.ok) {
+        const payload = await response.json().catch(() => null) as { error?: string } | null;
+        setError(payload?.error ?? "Unable to unlock this Conductor session.");
+        return;
+      }
+
+      router.replace(nextPath);
+      router.refresh();
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  return (
+    <form className="mt-6 space-y-4" onSubmit={(event) => void handleSubmit(event)}>
+      <label className="block space-y-2">
+        <span className="text-sm font-medium text-[var(--text-strong)]">Access token</span>
+        <input
+          autoCapitalize="none"
+          autoComplete="one-time-code"
+          autoCorrect="off"
+          className="w-full rounded-[var(--radius-md)] border bg-[var(--bg-elevated)] px-3 py-2 text-sm text-[var(--text-strong)] outline-none transition focus:border-[var(--accent-primary)]"
+          inputMode="text"
+          onChange={(event) => setToken(event.target.value)}
+          placeholder="Paste the Conductor access token"
+          spellCheck={false}
+          type="password"
+          value={token}
+        />
+      </label>
+
+      {error ? (
+        <p className="rounded-[var(--radius-md)] border border-red-500/40 bg-red-500/10 px-3 py-2 text-sm text-red-200">
+          {error}
+        </p>
+      ) : null}
+
+      <button
+        className="inline-flex w-full items-center justify-center rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-sm font-medium text-[var(--accent-contrast)] transition hover:opacity-95 disabled:cursor-not-allowed disabled:opacity-60"
+        disabled={submitting || token.trim().length === 0}
+        type="submit"
+      >
+        {submitting ? "Unlocking..." : "Unlock"}
+      </button>
+    </form>
+  );
+}

package/web/.next/standalone/packages/web/src/app/unlock/page.tsx

@@ -0,0 +1,41 @@
+import { sanitizeRedirectTarget } from "@/lib/remoteAuth";
+import { UnlockForm } from "./UnlockForm";
+
+function getErrorMessage(code: string | null | undefined): string | null {
+  if (code === "invalid") return "That access link or token is invalid.";
+  if (code === "unavailable") return "Remote sign-in is not available for this session.";
+  return null;
+}
+
+type UnlockPageProps = {
+  searchParams?: Promise<Record<string, string | string[] | undefined>>;
+};
+
+export default async function UnlockPage({ searchParams }: UnlockPageProps) {
+  const resolved = searchParams ? await searchParams : {};
+  const rawNext = resolved.next;
+  const nextValue = Array.isArray(rawNext) ? rawNext[0] : rawNext;
+  const rawError = resolved.error;
+  const errorValue = Array.isArray(rawError) ? rawError[0] : rawError;
+
+  return (
+    <main className="flex min-h-screen items-center justify-center px-4 py-10">
+      <section className="surface-card w-full max-w-md rounded-[var(--radius-lg)] border p-6 shadow-[var(--shadow-card)]">
+        <div className="space-y-2">
+          <p className="text-xs font-semibold uppercase tracking-[0.28em] text-[var(--text-muted)]">
+            Secure Remote Access
+          </p>
+          <h1 className="text-2xl font-semibold text-[var(--text-strong)]">Unlock Conductor</h1>
+          <p className="text-sm leading-6 text-[var(--text-muted)]">
+            Use the secure unlock link from the terminal that started this session, or paste the access token below.
+          </p>
+        </div>
+
+        <UnlockForm
+          initialError={getErrorMessage(errorValue)}
+          nextPath={sanitizeRedirectTarget(nextValue)}
+        />
+      </section>
+    </main>
+  );
+}

package/web/.next/standalone/packages/web/src/components/Dashboard.tsx

@@ -19,6 +19,7 @@ import type {
   SSESnapshotEvent,
 } from "@/lib/types";
 import { getAttentionLevel } from "@/lib/types";
+import { AgentTileIcon } from "./AgentTileIcon";
 import { TERMINAL_STATUSES } from "@conductor-oss/core/types";
 import { SessionCard } from "./SessionCard";
 import { EmptyState } from "./EmptyState";
@@ -254,56 +255,6 @@ function getProjectFaviconUrls(repo?: string | null, iconUrl?: string | null): s
   }
 }
 
-function getAgentIconUrls(agent: AgentIconSeed): string[] {
-  const urls: string[] = [];
-
-  if (agent.iconUrl) {
-    const direct = agent.iconUrl.trim();
-    if (direct) {
-      urls.push(direct);
-    }
-  }
-
-  const simpleIconCandidates = [
-    asSimpleIconSlug(agent.label),
-    asSimpleIconSlug(agent.launchName),
-    asSimpleIconSlug(agent.launchName).replace(/-cli$/u, ""),
-  ].filter((slug) => slug.length > 0);
-  for (const slug of simpleIconCandidates) {
-    urls.push(`https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/${slug}.svg`);
-  }
-
-  if (!agent.homepage) return urls;
-
-  try {
-    const homepageUrl = new URL(agent.homepage);
-    const homepageOrigin = `${homepageUrl.origin}`;
-    urls.push(`https://www.google.com/s2/favicons?sz=64&domain_url=${encodeURIComponent(homepageOrigin)}`);
-    urls.push(`https://www.google.com/s2/favicons?sz=64&domain=${encodeURIComponent(homepageUrl.hostname)}`);
-    const gitHubRepo = parseGithubRepo(agent.homepage);
-    if (gitHubRepo) {
-      const owner = encodeURIComponent(gitHubRepo.owner);
-      const project = encodeURIComponent(gitHubRepo.name);
-      urls.push(`https://opengraph.githubassets.com/1/${owner}/${project}`);
-      const repoFiles = [
-        ".github/logo.png",
-        ".github/favicon.png",
-        ".github/logo.svg",
-        "assets/logo.png",
-        "assets/favicon.png",
-        "logo.png",
-        "favicon.png",
-        "logo.svg",
-      ];
-      urls.push(...repoFiles.map((file) => `https://raw.githubusercontent.com/${owner}/${project}/HEAD/${file}`));
-    }
-  } catch {
-    // Ignore malformed homepages.
-  }
-
-  return [...new Set(urls)];
-}
-
 function getProjectAbbrev(projectId: string): string {
   const parts = projectId.split(/[-_\s/]+/).filter(Boolean);
   if (parts.length === 1) {
@@ -329,82 +280,16 @@ function DefaultProjectIcon({ projectId, color }: { projectId: string; color: st
   );
 }
 
-function DefaultAgentIcon({
-  label,
-  color,
-  className = "h-5 w-5",
-}: {
-  label: string;
-  color: string;
-  className?: string;
-}) {
-  const fallback = getProjectAbbrev(label);
-  return (
-    <span
-      className={`flex ${className} shrink-0 items-center justify-center rounded-sm text-[10px] font-semibold text-white`}
-      style={{ backgroundColor: color }}
-      aria-hidden="true"
-    >
-      {fallback}
-    </span>
-  );
-}
-
-function getSeededColor(seed: string): string {
-  const FALLBACK_COLORS = [
-    "#14b8a6",
-    "#22c55e",
-    "#84cc16",
-    "#eab308",
-    "#f97316",
-    "#f43f5e",
-    "#a855f7",
-    "#ec4899",
-    "#06b6d4",
-    "#0ea5e9",
-  ];
-  let hash = 0;
-  for (let i = 0; i < seed.length; i += 1) {
-    hash = (hash * 31 + seed.charCodeAt(i)) % 360;
-  }
-  return FALLBACK_COLORS[hash % FALLBACK_COLORS.length] ?? "#6b7280";
-}
-
 function AgentIcon({ agent, className = "h-5 w-5" }: { agent: AgentIconSeed; className?: string }) {
-  const [iconErrorIndex, setIconErrorIndex] = useState(0);
-  const [isLoaded, setIsLoaded] = useState(false);
-  const iconUrls = useMemo(() => getAgentIconUrls(agent), [agent.iconUrl, agent.homepage, agent.label, agent.launchName]);
-  const color = useMemo(
-    () => getSeededColor(`${agent.label}-${agent.launchName}`),
-    [agent.label, agent.launchName],
-  );
-
-  useEffect(() => {
-    setIconErrorIndex(0);
-    setIsLoaded(false);
-  }, [iconUrls]);
-  useEffect(() => setIsLoaded(false), [iconErrorIndex]);
-
-  const shouldUseFallback =
-    !iconUrls.length || iconErrorIndex >= iconUrls.length || !iconUrls[iconErrorIndex];
-
-  if (shouldUseFallback) {
-    return <DefaultAgentIcon className={className} label={agent.label} color={color} />;
-  }
-
   return (
-    <span className="relative inline-flex">
-      {!isLoaded && <DefaultAgentIcon className={className} label={agent.label} color={color} />}
-      <img
-        src={iconUrls[iconErrorIndex]}
-        alt={`${agent.label} icon`}
-        className={`${className} shrink-0 rounded-sm border border-[var(--color-border-subtle)] bg-white object-contain ${isLoaded ? "inline-flex" : "hidden"}`}
-        onError={() => {
-          setIconErrorIndex((current) => current + 1);
-          setIsLoaded(false);
+    <span className="inline-flex rounded-sm border border-[var(--color-border-subtle)] bg-white p-[1px]">
+      <AgentTileIcon
+        seed={{
+          label: agent.label,
+          homepage: agent.homepage,
+          iconUrl: agent.iconUrl,
         }}
-        onLoad={() => setIsLoaded(true)}
-        loading="lazy"
+        className={className}
       />
     </span>
   );
@@ -450,7 +335,7 @@ const KNOWN_AGENTS: KnownAgent[] = [
     description: "OpenAI Codex CLI",
     homepage: "https://github.com/openai/codex",
     iconUrl: "https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/openai.svg",
-    installHint: "npm install -g @openai/codex-cli",
+    installHint: "npm install -g @openai/codex",
     launchCommand: "codex",
     capabilities: ["chat", "review", "terminal"],
   },
@@ -555,7 +440,8 @@ const KNOWN_AGENTS: KnownAgent[] = [
     aliases: ["qwen code", "qwen_code", "qwen", "qwen-code", "qwen-code-cli"],
     description: "Qwen Code CLI",
     homepage: "https://qwenlm.github.io/announcements/",
-    launchCommand: "qwen-code",
+    installHint: "npm install -g @qwen-code/qwen-code@latest",
+    launchCommand: "qwen",
     capabilities: ["chat", "review", "reasoning", "analysis"],
   },
 ];

package/web/.next/standalone/packages/web/src/hooks/useConfig.ts

@@ -10,6 +10,7 @@ export interface ConfigProject {
   boardFile?: string | null;
   description: string | null;
   agent: string;
+  agentModel: string | null;
 }
 
 interface UseConfigReturn {
@@ -33,6 +34,9 @@ function normalizeProject(
     agent: typeof raw?.["agent"] === "string" && raw["agent"].trim().length > 0
       ? raw["agent"]
       : "qwen-code",
+    agentModel: typeof raw?.["agentModel"] === "string" && raw["agentModel"].trim().length > 0
+      ? raw["agentModel"]
+      : null,
   };
 }
 

package/web/.next/standalone/packages/web/src/lib/accessControl.test.ts

@@ -0,0 +1,46 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { isLoopbackHost, resolveRoleForEmail, roleMeetsRequirement } from "./accessControl";
+
+test("resolveRoleForEmail prefers the highest matching bound role", () => {
+  const resolution = resolveRoleForEmail("lead@example.com", {
+    roles: {
+      viewers: ["lead@example.com"],
+      admins: ["lead@example.com"],
+    },
+  });
+
+  assert.equal(resolution.role, "admin");
+  assert.equal(resolution.matchedBinding, true);
+});
+
+test("resolveRoleForEmail falls back to the configured default role", () => {
+  const resolution = resolveRoleForEmail("member@example.com", {
+    defaultRole: "viewer",
+  });
+
+  assert.equal(resolution.role, "viewer");
+  assert.equal(resolution.matchedBinding, false);
+});
+
+test("resolveRoleForEmail denies unmatched users when explicit bindings exist", () => {
+  const resolution = resolveRoleForEmail("outsider@example.com", {
+    roles: {
+      operators: ["operator@example.com"],
+    },
+  });
+
+  assert.equal(resolution.role, null);
+});
+
+test("roleMeetsRequirement enforces the viewer/operator/admin hierarchy", () => {
+  assert.equal(roleMeetsRequirement("admin", "operator"), true);
+  assert.equal(roleMeetsRequirement("operator", "viewer"), true);
+  assert.equal(roleMeetsRequirement("viewer", "operator"), false);
+});
+
+test("isLoopbackHost recognizes local dashboard hosts", () => {
+  assert.equal(isLoopbackHost("localhost"), true);
+  assert.equal(isLoopbackHost("127.0.0.1"), true);
+  assert.equal(isLoopbackHost("app.example.com"), false);
+});

package/web/.next/standalone/packages/web/src/lib/accessControl.ts

@@ -0,0 +1,115 @@
+import type {
+  DashboardAccessConfig,
+  DashboardRole,
+  DashboardRoleBindings,
+} from "@conductor-oss/core/types";
+
+export type RoleRequirement = DashboardRole;
+
+const ROLE_WEIGHT: Record<DashboardRole, number> = {
+  viewer: 0,
+  operator: 1,
+  admin: 2,
+};
+
+function normalizeList(values: string[] | undefined): string[] {
+  return (values ?? [])
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function roleBindingsConfigured(bindings?: DashboardRoleBindings | null): boolean {
+  if (!bindings) return false;
+  return (
+    normalizeList(bindings.viewers).length > 0 ||
+    normalizeList(bindings.operators).length > 0 ||
+    normalizeList(bindings.admins).length > 0 ||
+    normalizeList(bindings.viewerDomains).length > 0 ||
+    normalizeList(bindings.operatorDomains).length > 0 ||
+    normalizeList(bindings.adminDomains).length > 0
+  );
+}
+
+function matchesDomain(email: string, domains: string[]): boolean {
+  return domains.some((domain) => email.endsWith(`@${domain}`));
+}
+
+function matchesEmailOrDomain(email: string, emails: string[], domains: string[]): boolean {
+  return emails.includes(email) || matchesDomain(email, domains);
+}
+
+export function isLoopbackHost(hostname: string | null | undefined): boolean {
+  const normalized = (hostname ?? "").trim().toLowerCase();
+  return normalized === "localhost"
+    || normalized === "127.0.0.1"
+    || normalized === "0.0.0.0"
+    || normalized === "::1"
+    || normalized === "[::1]";
+}
+
+export function roleMeetsRequirement(
+  actualRole: DashboardRole,
+  requiredRole: RoleRequirement,
+): boolean {
+  return ROLE_WEIGHT[actualRole] >= ROLE_WEIGHT[requiredRole];
+}
+
+export function resolveRoleForEmail(
+  email: string,
+  access: DashboardAccessConfig | null | undefined,
+  envFallback?: {
+    allowedEmails?: string[];
+    allowedDomains?: string[];
+    adminEmails?: string[];
+  },
+): {
+  role: DashboardRole | null;
+  matchedBinding: boolean;
+  explicitBindingsConfigured: boolean;
+} {
+  const normalizedEmail = email.trim().toLowerCase();
+  const bindings = access?.roles;
+
+  const adminEmails = [
+    ...normalizeList(bindings?.admins),
+    ...normalizeList(envFallback?.adminEmails),
+  ];
+  const operatorEmails = [
+    ...normalizeList(bindings?.operators),
+    ...normalizeList(envFallback?.allowedEmails),
+  ];
+  const viewerEmails = normalizeList(bindings?.viewers);
+
+  const adminDomains = normalizeList(bindings?.adminDomains);
+  const operatorDomains = [
+    ...normalizeList(bindings?.operatorDomains),
+    ...normalizeList(envFallback?.allowedDomains),
+  ];
+  const viewerDomains = normalizeList(bindings?.viewerDomains);
+
+  const explicitBindingsConfigured =
+    roleBindingsConfigured(bindings) ||
+    adminEmails.length > 0 ||
+    operatorEmails.length > 0 ||
+    operatorDomains.length > 0;
+
+  if (matchesEmailOrDomain(normalizedEmail, adminEmails, adminDomains)) {
+    return { role: "admin", matchedBinding: true, explicitBindingsConfigured };
+  }
+  if (matchesEmailOrDomain(normalizedEmail, operatorEmails, operatorDomains)) {
+    return { role: "operator", matchedBinding: true, explicitBindingsConfigured };
+  }
+  if (matchesEmailOrDomain(normalizedEmail, viewerEmails, viewerDomains)) {
+    return { role: "viewer", matchedBinding: true, explicitBindingsConfigured };
+  }
+
+  if (access?.defaultRole) {
+    return { role: access.defaultRole, matchedBinding: false, explicitBindingsConfigured };
+  }
+
+  if (explicitBindingsConfigured) {
+    return { role: null, matchedBinding: false, explicitBindingsConfigured };
+  }
+
+  return { role: "operator", matchedBinding: false, explicitBindingsConfigured };
+}