conductor-oss 0.3.4 → 0.4.0

package/web/.next/standalone/packages/web/src/lib/edgeAuth.ts

@@ -13,7 +13,6 @@ export type TrustedEdgeAuthConfig = {
   jwtHeader: string;
   teamDomain: string | null;
   audience: string | null;
-  allowInsecureEmailHeader: boolean;
 };
 
 export type TrustedEdgeIdentity =
@@ -92,8 +91,6 @@ export function resolveTrustedEdgeAuthConfig(
       ?? DEFAULT_JWT_HEADER,
     teamDomain,
     audience,
-    allowInsecureEmailHeader:
-      (process.env.CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS ?? "").trim().toLowerCase() === "true",
   };
 }
 
@@ -136,70 +133,60 @@ export async function verifyTrustedEdgeIdentity(
   const config = resolveTrustedEdgeAuthConfig(access);
   if (!config.enabled) return null;
 
-  if (config.provider === CLOUDFLARE_PROVIDER) {
-    const assertion = headers.get(config.jwtHeader)?.trim() ?? "";
-    if (!assertion) return null;
+  if (config.provider !== CLOUDFLARE_PROVIDER) {
+    const legacyEmail = headers.get(config.emailHeader)?.trim().toLowerCase() ?? "";
+    if (!legacyEmail) return null;
+    return {
+      ok: false,
+      reason: "Generic trusted-header mode has been removed. Configure verified Cloudflare Access instead.",
+      provider: "trusted-header",
+    };
+  }
+
+  const assertion = headers.get(config.jwtHeader)?.trim() ?? "";
+  if (!assertion) return null;
 
-    if (!config.teamDomain || !config.audience) {
+  if (!config.teamDomain || !config.audience) {
+    return {
+      ok: false,
+      reason: "Cloudflare Access is enabled but team domain or audience is missing.",
+      provider: "cloudflare-access",
+    };
+  }
+
+  try {
+    const { payload } = await jwtVerify(assertion, getCloudflareJwks(config.teamDomain), {
+      audience: config.audience,
+      issuer: `https://${config.teamDomain}`,
+    });
+    const email = extractEmailFromPayload(payload);
+    if (!email) {
       return {
         ok: false,
-        reason: "Cloudflare Access is enabled but team domain or audience is missing.",
+        reason: "Cloudflare Access token is missing an email claim.",
         provider: "cloudflare-access",
       };
     }
 
-    try {
-      const { payload } = await jwtVerify(assertion, getCloudflareJwks(config.teamDomain), {
-        audience: config.audience,
-        issuer: `https://${config.teamDomain}`,
-      });
-      const email = extractEmailFromPayload(payload);
-      if (!email) {
-        return {
-          ok: false,
-          reason: "Cloudflare Access token is missing an email claim.",
-          provider: "cloudflare-access",
-        };
-      }
-
-      const assertedEmail = headers.get(config.emailHeader)?.trim().toLowerCase() ?? "";
-      if (assertedEmail && assertedEmail !== email) {
-        return {
-          ok: false,
-          reason: "Cloudflare Access email header does not match the verified token.",
-          provider: "cloudflare-access",
-        };
-      }
-
-      return {
-        ok: true,
-        email,
-        provider: "cloudflare-access",
-      };
-    } catch (error) {
+    const assertedEmail = headers.get(config.emailHeader)?.trim().toLowerCase() ?? "";
+    if (assertedEmail && assertedEmail !== email) {
       return {
         ok: false,
-        reason: formatJwtError(error),
+        reason: "Cloudflare Access email header does not match the verified token.",
         provider: "cloudflare-access",
       };
     }
-  }
-
-  const email = headers.get(config.emailHeader)?.trim().toLowerCase() ?? "";
-  if (!email) return null;
 
-  if (!config.allowInsecureEmailHeader) {
+    return {
+      ok: true,
+      email,
+      provider: "cloudflare-access",
+    };
+  } catch (error) {
     return {
       ok: false,
-      reason:
-        "Generic trusted-header mode is disabled. Use verified Cloudflare Access, or explicitly set CONDUCTOR_ALLOW_INSECURE_TRUSTED_HEADERS=true.",
-      provider: "trusted-header",
+      reason: formatJwtError(error),
+      provider: "cloudflare-access",
     };
   }
-
-  return {
-    ok: true,
-    email,
-    provider: "trusted-header",
-  };
 }

package/web/.next/standalone/packages/web/src/lib/guardedRustProxy.ts

@@ -1,6 +1,6 @@
 import type { DashboardRole } from "@conductor-oss/core/types";
 import { NextRequest } from "next/server";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
+import { getDashboardAccess, guardApiAccess, guardApiActionAccess } from "@/lib/auth";
 import { proxyToRustOrUnavailable } from "@/lib/rustBackendProxy";
 
 type ProxyOptions = {
@@ -8,6 +8,32 @@ type ProxyOptions = {
   requireActionGuard?: boolean;
 };
 
+const PROXY_AUTHORIZED_HEADER = "x-conductor-proxy-authorized";
+const PROXY_AUTHENTICATED_HEADER = "x-conductor-access-authenticated";
+const PROXY_ROLE_HEADER = "x-conductor-access-role";
+const PROXY_EMAIL_HEADER = "x-conductor-access-email";
+const PROXY_PROVIDER_HEADER = "x-conductor-access-provider";
+
+export async function buildForwardedAccessHeaders(request: Request): Promise<Headers> {
+  const access = await getDashboardAccess(request);
+  const headers = new Headers({
+    [PROXY_AUTHORIZED_HEADER]: "true",
+    [PROXY_AUTHENTICATED_HEADER]: access.authenticated ? "true" : "false",
+  });
+
+  if (access.role) {
+    headers.set(PROXY_ROLE_HEADER, access.role);
+  }
+  if (access.email) {
+    headers.set(PROXY_EMAIL_HEADER, access.email);
+  }
+  if (access.provider) {
+    headers.set(PROXY_PROVIDER_HEADER, access.provider);
+  }
+
+  return headers;
+}
+
 export async function guardAndProxy(
   request: Request,
   pathname: string,
@@ -21,5 +47,7 @@ export async function guardAndProxy(
     if (deniedAction) return deniedAction;
   }
 
-  return proxyToRustOrUnavailable(request, pathname);
+  return proxyToRustOrUnavailable(request, pathname, {
+    headers: await buildForwardedAccessHeaders(request),
+  });
 }

package/web/.next/standalone/packages/web/src/lib/knownAgents.ts

@@ -0,0 +1,125 @@
+import { normalizeAgentName } from "@/lib/agentUtils";
+
+export type KnownAgent = {
+  name: string;
+  label: string;
+  description: string;
+  homepage: string | null;
+  iconUrl: string | null;
+  installHint?: string;
+  installUrl?: string;
+  setupUrl?: string;
+};
+
+export const KNOWN_AGENTS: KnownAgent[] = [
+  {
+    name: "codex",
+    label: "Codex",
+    description: "OpenAI Codex CLI",
+    homepage: "https://github.com/openai/codex",
+    iconUrl: "https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/openai.svg",
+    installHint: "npm install -g @openai/codex",
+    installUrl: "https://github.com/openai/codex",
+    setupUrl: "https://chatgpt.com/codex",
+  },
+  {
+    name: "gemini",
+    label: "Gemini",
+    description: "Google Gemini CLI",
+    homepage: "https://ai.google.dev/gemini-api/docs",
+    iconUrl: "https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/googlegemini.svg",
+    installHint: "npm install -g @google/gemini-cli",
+    installUrl: "https://ai.google.dev/gemini-api/docs",
+    setupUrl: "https://aistudio.google.com/",
+  },
+  {
+    name: "qwen-code",
+    label: "Qwen Code",
+    description: "Qwen Code CLI",
+    homepage: "https://qwenlm.github.io/announcements/",
+    iconUrl: null,
+    installHint: "npm install -g @qwen-code/qwen-code@latest",
+    installUrl: "https://qwenlm.github.io/announcements/",
+    setupUrl: "https://chat.qwen.ai/",
+  },
+  {
+    name: "droid",
+    label: "Droid",
+    description: "Factory Droid CLI",
+    homepage: "https://github.com/Factory-AI/factory",
+    iconUrl: "https://raw.githubusercontent.com/Factory-AI/factory/main/docs/images/droid_logo_cli.png",
+    installHint: "npm install -g @factory/cli",
+    installUrl: "https://github.com/Factory-AI/factory",
+  },
+  {
+    name: "claude-code",
+    label: "Claude Code",
+    description: "Claude Code CLI",
+    homepage: "https://www.anthropic.com/claude",
+    iconUrl: "https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/claude.svg",
+    installHint: "npm install -g @anthropic-ai/claude-code",
+    installUrl: "https://www.anthropic.com/claude-code",
+    setupUrl: "https://claude.ai/",
+  },
+  {
+    name: "amp",
+    label: "Amp",
+    description: "Amp Code CLI",
+    homepage: "https://www.ampcode.com",
+    iconUrl: "https://ampcode.com/amp-mark-color.svg",
+    installHint: "npm install -g @sourcegraph/amp",
+    installUrl: "https://www.ampcode.com",
+  },
+  {
+    name: "opencode",
+    label: "OpenCode",
+    description: "OpenCode CLI",
+    homepage: "https://opencode.ai",
+    iconUrl: null,
+    installHint: "npm install -g opencode-ai",
+    installUrl: "https://opencode.ai",
+  },
+  {
+    name: "github-copilot",
+    label: "GitHub Copilot",
+    description: "GitHub Copilot CLI",
+    homepage: "https://docs.github.com/copilot/how-tos/copilot-cli",
+    iconUrl: "https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/githubcopilot.svg",
+    installHint: "npm install -g @github/copilot",
+    installUrl: "https://docs.github.com/copilot/how-tos/copilot-cli",
+    setupUrl: "https://github.com/settings/copilot",
+  },
+  {
+    name: "cursor-cli",
+    label: "Cursor Agent",
+    description: "Cursor Agent CLI",
+    homepage: "https://www.cursor.com",
+    iconUrl: "https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/cursor.svg",
+    installHint: "npm install -g cursor-agent",
+  },
+  {
+    name: "ccr",
+    label: "CCR",
+    description: "Claude Code Router",
+    homepage: "https://www.npmjs.com/package/@musistudio/claude-code-router",
+    iconUrl: "https://cdn.jsdelivr.net/npm/simple-icons@latest/icons/claude.svg",
+    installHint: "npm install -g @musistudio/claude-code-router",
+    installUrl: "https://www.npmjs.com/package/@musistudio/claude-code-router",
+  },
+];
+
+export const KNOWN_AGENT_ORDER = KNOWN_AGENTS.map((agent) => agent.name);
+
+const KNOWN_AGENT_MAP = new Map(
+  KNOWN_AGENTS.map((agent) => [normalizeAgentName(agent.name), agent] as const),
+);
+
+export function getKnownAgent(value: string): KnownAgent | null {
+  return KNOWN_AGENT_MAP.get(normalizeAgentName(value)) ?? null;
+}
+
+export function getKnownAgentOrderIndex(value: string): number {
+  const normalized = normalizeAgentName(value);
+  const index = KNOWN_AGENT_ORDER.findIndex((agent) => normalizeAgentName(agent) === normalized);
+  return index >= 0 ? index : Number.MAX_SAFE_INTEGER;
+}

package/web/.next/standalone/packages/web/src/lib/liveEvents.ts

@@ -1,10 +1,12 @@
 "use client";
 
-import type { SSESnapshotEvent } from "@/lib/types";
+import type { AppUpdateStatus, SSESnapshotEvent } from "@/lib/types";
 
 type SnapshotListener = (event: SSESnapshotEvent) => void;
+type AppUpdateListener = (update: AppUpdateStatus | null) => void;
 
 const listeners = new Set<SnapshotListener>();
+const appUpdateListeners = new Set<AppUpdateListener>();
 let eventSource: EventSource | null = null;
 let refreshInFlight: Promise<void> | null = null;
 
@@ -25,10 +27,31 @@ function normalizeSessionArray(value: unknown): SSESnapshotEvent | null {
   return Array.isArray(payload.sessions) ? payload : null;
 }
 
+function normalizeAppUpdate(value: unknown): AppUpdateStatus | null {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+
+  const candidate = value as AppUpdateStatus;
+  return typeof candidate.enabled === "boolean" ? candidate : null;
+}
+
 function dispatchSnapshots(payload: SSESnapshotEvent) {
   for (const listener of listeners) {
     listener(payload);
   }
+
+  const normalizedAppUpdate = normalizeAppUpdate(payload.appUpdate);
+  if (!normalizedAppUpdate) return;
+  for (const listener of appUpdateListeners) {
+    listener(normalizedAppUpdate);
+  }
+}
+
+function dispatchAppUpdate(update: AppUpdateStatus | null) {
+  for (const listener of appUpdateListeners) {
+    listener(update);
+  }
 }
 
 async function refreshSessions() {
@@ -49,6 +72,17 @@ async function refreshSessions() {
     } catch {
       // Ignore transient refresh failures.
     }
+
+    try {
+      const response = await fetch("/api/app-update");
+      if (!response.ok) {
+        return;
+      }
+      const body = await response.json().catch(() => null);
+      dispatchAppUpdate(normalizeAppUpdate(body));
+    } catch {
+      // Ignore transient refresh failures.
+    }
   })();
 
   refreshInFlight = load.finally(() => {
@@ -85,7 +119,7 @@ function ensureEventSource() {
   });
 
   eventSource.onerror = () => {
-    if (listeners.size === 0) {
+    if (listeners.size === 0 && appUpdateListeners.size === 0) {
       eventSource?.close();
       eventSource = null;
     }
@@ -98,7 +132,20 @@ export function subscribeToSnapshotEvents(listener: SnapshotListener): () => voi
 
   return () => {
     listeners.delete(listener);
-    if (listeners.size === 0 && eventSource) {
+    if (listeners.size === 0 && appUpdateListeners.size === 0 && eventSource) {
+      eventSource.close();
+      eventSource = null;
+    }
+  };
+}
+
+export function subscribeToAppUpdateEvents(listener: AppUpdateListener): () => void {
+  appUpdateListeners.add(listener);
+  ensureEventSource();
+
+  return () => {
+    appUpdateListeners.delete(listener);
+    if (listeners.size === 0 && appUpdateListeners.size === 0 && eventSource) {
       eventSource.close();
       eventSource = null;
     }

package/web/.next/standalone/packages/web/src/lib/modelAccess.ts

@@ -5,6 +5,7 @@ import {
 
 const CLAUDE_ACCESS = ["pro", "max", "api"] as const;
 const CODEX_ACCESS = ["chatgpt", "api"] as const;
+const DEFAULT_ACCESS = ["default"] as const;
 const GEMINI_ACCESS = ["oauth", "api"] as const;
 const QWEN_ACCESS = ["oauth", "api"] as const;
 
@@ -32,9 +33,15 @@ export function normalizeModelAccessPreferences(
   const defaults = getDefaultModelAccessPreferences();
 
   return {
+    amp: selectValue(root["amp"], DEFAULT_ACCESS, defaults.amp),
     claudeCode: selectValue(root["claudeCode"], CLAUDE_ACCESS, defaults.claudeCode),
     codex: selectValue(root["codex"], CODEX_ACCESS, defaults.codex),
+    cursorCli: selectValue(root["cursorCli"], DEFAULT_ACCESS, defaults.cursorCli),
+    droid: selectValue(root["droid"], DEFAULT_ACCESS, defaults.droid),
     gemini: selectValue(root["gemini"], GEMINI_ACCESS, defaults.gemini),
+    githubCopilot: selectValue(root["githubCopilot"], DEFAULT_ACCESS, defaults.githubCopilot),
+    opencode: selectValue(root["opencode"], DEFAULT_ACCESS, defaults.opencode),
     qwenCode: selectValue(root["qwenCode"], QWEN_ACCESS, defaults.qwenCode),
+    ccr: selectValue(root["ccr"], DEFAULT_ACCESS, defaults.ccr),
   };
 }

package/web/.next/standalone/packages/web/src/lib/previewSession.test.ts

@@ -0,0 +1,109 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import type { DashboardSession } from "./types";
+import { discoverPreviewCandidateUrls, loadPreviewSessionContext } from "./previewSession";
+
+function buildSession(metadata: Record<string, string>): DashboardSession {
+  return {
+    id: "session-1",
+    projectId: "demo",
+    status: "working",
+    activity: "active",
+    branch: "feature/demo",
+    issueId: null,
+    summary: "Summary with remote preview https://preview.example.com",
+    createdAt: new Date().toISOString(),
+    lastActivityAt: new Date().toISOString(),
+    pr: {
+      number: 1,
+      url: "https://github.com/example/repo/pull/1",
+      title: "PR",
+      branch: "feature/demo",
+      baseBranch: "main",
+      isDraft: false,
+      state: "open",
+      ciStatus: "none",
+      reviewDecision: "none",
+      mergeability: {
+        mergeable: true,
+        ciPassing: true,
+        approved: false,
+        noConflicts: true,
+        blockers: [],
+      },
+      previewUrl: "https://deploy-preview.example.com",
+    },
+    metadata,
+  };
+}
+
+test("discoverPreviewCandidateUrls prefers explicit dev server urls and ignores backend api urls", async () => {
+  const previousBackendUrl = process.env.CONDUCTOR_BACKEND_URL;
+  const previousFetch = global.fetch;
+  const tempDir = mkdtempSync(join(tmpdir(), "conductor-preview-test-"));
+  const logPath = join(tempDir, "dev-server.log");
+
+  writeFileSync(
+    logPath,
+    [
+      "ready at http://localhost:3001",
+      "backend http://127.0.0.1:4749/api/sessions/session-1",
+    ].join("\n"),
+    "utf8",
+  );
+
+  process.env.CONDUCTOR_BACKEND_URL = "http://127.0.0.1:4749";
+  global.fetch = (async (input: string | URL) => {
+    const url = String(input);
+    assert.match(url, /\/api\/sessions\/session-1\/output\?lines=400$/);
+    return new Response(JSON.stringify({ output: "stdout http://localhost:3002" }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }) as typeof fetch;
+
+  try {
+    const session = buildSession({
+      devServerUrl: "http://0.0.0.0:3000",
+      devServerLog: logPath,
+      other: "ignored http://127.0.0.1:4749/api/health",
+    });
+
+    const urls = await discoverPreviewCandidateUrls(session);
+
+    assert.deepEqual(urls, [
+      "http://127.0.0.1:3000/",
+      "http://localhost:3001/",
+      "https://deploy-preview.example.com/",
+      "https://preview.example.com/",
+      "http://localhost:3002/",
+    ]);
+  } finally {
+    process.env.CONDUCTOR_BACKEND_URL = previousBackendUrl;
+    global.fetch = previousFetch;
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+test("loadPreviewSessionContext captures backend lookup failures without throwing", async () => {
+  const previousBackendUrl = process.env.CONDUCTOR_BACKEND_URL;
+
+  delete process.env.CONDUCTOR_BACKEND_URL;
+
+  try {
+    const context = await loadPreviewSessionContext("session-1");
+
+    assert.equal(context.session, null);
+    assert.deepEqual(context.candidateUrls, []);
+    assert.equal(context.error, "Rust backend URL is not configured");
+  } finally {
+    if (previousBackendUrl === undefined) {
+      delete process.env.CONDUCTOR_BACKEND_URL;
+    } else {
+      process.env.CONDUCTOR_BACKEND_URL = previousBackendUrl;
+    }
+  }
+});