dr-claw 1.1.2 → 1.1.4

package/server/mcp-compute.js

@@ -0,0 +1,223 @@
+#!/usr/bin/env node
+
+/**
+ * Compute Tools MCP Server
+ *
+ * Exposes compute node operations (run, sync, slurm) as MCP tools
+ * that the AI agent can use during a chat session.
+ *
+ * Launched as a child process by the Claude Agent SDK via mcpServers config.
+ */
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { ComputeNode, getActiveNode } from './compute-node.js';
+
+const server = new Server(
+  { name: 'compute-tools', version: '1.0.0' },
+  { capabilities: { tools: {} } },
+);
+
+// ─── Tool definitions ───
+
+const TOOLS = [
+  {
+    name: 'compute_info',
+    description:
+      'Get information about the active remote compute node, including hostname, type, and GPU status. Use this first to check what compute resources are available.',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+    },
+  },
+  {
+    name: 'compute_run',
+    description:
+      'Run a shell command on the active remote compute node via SSH. Use this for GPU tasks, training scripts, or any command that should execute on the remote server instead of locally.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        command: {
+          type: 'string',
+          description: 'The shell command to execute on the remote node',
+        },
+        cwd: {
+          type: 'string',
+          description:
+            'Local working directory. If provided and skipSync is false, code will be synced to the remote node before execution.',
+        },
+        skipSync: {
+          type: 'boolean',
+          description:
+            'If true, skip syncing code before running. Default: true. Set to false if you need to sync local code first.',
+          default: true,
+        },
+      },
+      required: ['command'],
+    },
+  },
+  {
+    name: 'compute_sync',
+    description:
+      'Sync project code between the local machine and the active remote compute node. Use "up" to push local code to remote, "down" to pull results back.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        direction: {
+          type: 'string',
+          enum: ['up', 'down'],
+          description: '"up" = push local→remote, "down" = pull remote→local',
+        },
+        cwd: {
+          type: 'string',
+          description: 'Local project directory to sync',
+        },
+        files: {
+          type: 'array',
+          items: { type: 'string' },
+          description:
+            'For "down" direction: specific file patterns to pull (e.g., ["logs/", "checkpoints/"]). Defaults to logs/, checkpoints/, results/.',
+        },
+      },
+      required: ['direction', 'cwd'],
+    },
+  },
+  {
+    name: 'compute_slurm_submit',
+    description:
+      'Submit a Slurm batch job on the active compute node. Provide a full sbatch script including #SBATCH directives. Only works on Slurm HPC nodes.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        script: {
+          type: 'string',
+          description:
+            'Full sbatch script content including #!/bin/bash and #SBATCH directives',
+        },
+      },
+      required: ['script'],
+    },
+  },
+  {
+    name: 'compute_slurm_queue',
+    description:
+      'List current Slurm jobs on the active compute node. Shows job ID, name, state, and elapsed time. Only works on Slurm HPC nodes.',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+    },
+  },
+];
+
+// ─── Tool handlers ───
+
+async function requireActiveNode() {
+  const node = await getActiveNode();
+  if (!node) {
+    throw new Error(
+      'No active compute node configured. Please set one in the Compute Dashboard (click "Set as Active" on a node).',
+    );
+  }
+  return node;
+}
+
+async function handleTool(name, args) {
+  switch (name) {
+    case 'compute_info': {
+      const node = await requireActiveNode();
+      let gpuInfo = 'Unknown';
+      try {
+        gpuInfo = await ComputeNode.run({
+          nodeId: node.id,
+          command: 'nvidia-smi --query-gpu=name,memory.total,utilization.gpu --format=csv,noheader 2>/dev/null || echo "No GPU detected"',
+          skipSync: true,
+        });
+      } catch {
+        gpuInfo = 'Could not query GPU (connection error)';
+      }
+      return [
+        `Active Compute Node: ${node.name}`,
+        `Host: ${node.user}@${node.host}${node.port && node.port !== 22 ? ':' + node.port : ''}`,
+        `Type: ${node.type === 'slurm' ? 'Slurm HPC cluster' : 'Direct GPU server'}`,
+        `Work Directory: ${node.workDir || '~'}`,
+        `GPU Info:\n${gpuInfo}`,
+      ].join('\n');
+    }
+
+    case 'compute_run': {
+      const node = await requireActiveNode();
+      const output = await ComputeNode.run({
+        nodeId: node.id,
+        command: args.command,
+        cwd: args.cwd || undefined,
+        skipSync: args.skipSync !== false,
+      });
+      return output || '(no output)';
+    }
+
+    case 'compute_sync': {
+      const node = await requireActiveNode();
+      const output = await ComputeNode.sync({
+        nodeId: node.id,
+        direction: args.direction,
+        cwd: args.cwd,
+        files: args.files || [],
+      });
+      return output || `Sync ${args.direction} completed successfully.`;
+    }
+
+    case 'compute_slurm_submit': {
+      const node = await requireActiveNode();
+      const output = await ComputeNode.sbatch({
+        nodeId: node.id,
+        rawScript: args.script,
+      });
+      return output || 'Job submitted.';
+    }
+
+    case 'compute_slurm_queue': {
+      const node = await requireActiveNode();
+      const jobs = await ComputeNode.squeue({ nodeId: node.id });
+      if (jobs.length === 0) return 'No active jobs.';
+      const header = 'JobID\tName\tPartition\tState\tElapsed\tTime Limit';
+      const rows = jobs.map(
+        (j) => `${j.jobId}\t${j.name}\t${j.partition}\t${j.state}\t${j.elapsed}\t${j.timeLimit}`,
+      );
+      return [header, ...rows].join('\n');
+    }
+
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}
+
+// ─── MCP protocol handlers ───
+
+server.setRequestHandler(
+  ListToolsRequestSchema,
+  async () => ({ tools: TOOLS }),
+);
+
+server.setRequestHandler(
+  CallToolRequestSchema,
+  async (request) => {
+    const { name, arguments: args } = request.params;
+    try {
+      const result = await handleTool(name, args || {});
+      return {
+        content: [{ type: 'text', text: result }],
+      };
+    } catch (error) {
+      return {
+        content: [{ type: 'text', text: `Error: ${error.message}` }],
+        isError: true,
+      };
+    }
+  },
+);
+
+// ─── Start server ───
+
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/server/middleware/auth.js

@@ -4,6 +4,25 @@ import { IS_PLATFORM } from '../constants/config.js';
 
 // Get JWT secret from environment or use default (for development)
 const JWT_SECRET = process.env.JWT_SECRET || 'claude-ui-dev-secret-change-in-production';
+if (!process.env.JWT_SECRET && process.env.NODE_ENV === 'production') {
+  console.warn(
+    '[SECURITY] JWT_SECRET is not set — using the default development secret. '
+    + 'Tokens signed with this known-public secret are trivially forgeable. '
+    + 'Set JWT_SECRET in your environment before deploying to production.'
+  );
+}
+
+// Token lifetime (default: 30 days). Set JWT_EXPIRY to override, e.g. "24h", "30d".
+const JWT_EXPIRY = process.env.JWT_EXPIRY || '30d';
+// Validate JWT_EXPIRY at startup to fail fast on misconfiguration
+try {
+  jwt.sign({ _validate: true }, 'test', { expiresIn: JWT_EXPIRY });
+} catch {
+  throw new Error(
+    `Invalid JWT_EXPIRY value: "${JWT_EXPIRY}". `
+    + 'Use formats like "1h", "7d", "30d", or a number of seconds.'
+  );
+}
 
 // Optional API key middleware
 const validateApiKey = (req, res, next) => {
@@ -54,15 +73,15 @@ const authenticateToken = async (req, res, next) => {
   }
 };
 
-// Generate JWT token (never expires)
+// Generate JWT token with configurable expiry (default: 7 days)
 const generateToken = (user) => {
   return jwt.sign(
-    { 
-      userId: user.id, 
-      username: user.username 
+    {
+      userId: user.id,
+      username: user.username
     },
-    JWT_SECRET
-    // No expiration - token lasts forever
+    JWT_SECRET,
+    { expiresIn: JWT_EXPIRY }
   );
 };
 

package/server/nano-claude-code.js

@@ -0,0 +1,340 @@
+/**
+ * Nano Claude Code provider — spawns the nano-claude-code CLI in stream-json harness mode.
+ * Uses the same WebSocket shapes as Claude (claude-response / claude-complete) for UI reuse.
+ *
+ * Requires a nano-claude-code build that supports:
+ *   --output-format stream-json -p "..." --dangerously-skip-permissions
+ *   --session-file <path.json> and --resume <path.json> for multi-turn persistence (absolute path under ~/.dr-claw/nano-sessions)
+ *   result lines may include nano_session_file (optional)
+ * Install: https://github.com/OpenLAIR/nano-claude-code — pip install from that repo or use the published CLI name on PATH.
+ */
+
+import { spawn } from 'child_process';
+import crossSpawn from 'cross-spawn';
+import crypto from 'crypto';
+import { encodeProjectPath, ensureProjectSkillLinks } from './projects.js';
+import { writeProjectTemplates } from './templates/index.js';
+import { applyStageTagsToSession, recordIndexedSession } from './utils/sessionIndex.js';
+import { ensureNanoDrClawSessionsRoot, resolveNanoSessionAbsPath } from './nanoSessionPaths.js';
+
+const spawnFunction = process.platform === 'win32' ? crossSpawn : spawn;
+
+const activeNanoSessions = new Map();
+
+let nanoShutdownHooksInstalled = false;
+
+function installNanoProcessShutdownHooks() {
+  if (nanoShutdownHooksInstalled) {
+    return;
+  }
+  nanoShutdownHooksInstalled = true;
+  const shutdown = () => {
+    for (const { process: childProc } of activeNanoSessions.values()) {
+      try {
+        if (childProc && !childProc.killed) {
+          childProc.kill('SIGTERM');
+        }
+      } catch (_) {
+        // ignore
+      }
+    }
+    activeNanoSessions.clear();
+  };
+  process.on('exit', shutdown);
+  for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    process.on(sig, shutdown);
+  }
+}
+
+function resolveNanoCommand() {
+  const explicit = String(
+    process.env.NANO_CLAUDE_CODE_COMMAND || ''
+  ).trim();
+  if (explicit) {
+    return explicit;
+  }
+  return 'nano-claude-code';
+}
+
+async function persistNanoSessionMetadata(sessionId, projectPath, sessionMode) {
+  if (!sessionId || !projectPath) return;
+  try {
+    const { sessionDb } = await import('./database/db.js');
+    sessionDb.upsertSession(
+      sessionId,
+      encodeProjectPath(projectPath),
+      'nano',
+      'Nano Claude Code Session',
+      new Date().toISOString(),
+      0,
+      { sessionMode: sessionMode || 'research', projectPath },
+    );
+  } catch (error) {
+    console.warn('[Nano] Failed to persist session metadata:', error.message);
+  }
+}
+
+export async function spawnNanoClaudeCode(command, options = {}, ws) {
+  installNanoProcessShutdownHooks();
+  const {
+    sessionId,
+    projectPath,
+    cwd,
+    model,
+    env,
+    sessionMode,
+    stageTagKeys,
+    stageTagSource = 'task_context',
+  } = options;
+
+  const workingDir = cwd || projectPath || process.cwd();
+
+  try {
+    await writeProjectTemplates(workingDir);
+    await ensureProjectSkillLinks(workingDir);
+  } catch (error) {
+    console.warn('[Nano] Project template setup:', error.message);
+  }
+
+  const streaming = String(
+    process.env.NANO_CLAUDE_CODE_STREAMING || ''
+  ).trim() === '1';
+
+  const isPlaceholderSession =
+    !sessionId ||
+    String(sessionId).startsWith('new-session-');
+
+  const capturedSessionId = isPlaceholderSession ? crypto.randomUUID() : String(sessionId);
+
+  await ensureNanoDrClawSessionsRoot();
+  const sessionAbsPath = resolveNanoSessionAbsPath(capturedSessionId);
+  if (!sessionAbsPath) {
+    const err = 'Invalid Nano Claude Code session id';
+    ws.send({ type: 'claude-error', error: err, sessionId: null });
+    return Promise.reject(new Error(err));
+  }
+
+  if (capturedSessionId && workingDir) {
+    applyStageTagsToSession({
+      sessionId: capturedSessionId,
+      projectPath: workingDir,
+      stageTagKeys,
+      source: stageTagSource,
+    });
+  }
+
+  if (isPlaceholderSession) {
+    recordIndexedSession({
+      sessionId: capturedSessionId,
+      provider: 'nano',
+      projectPath: workingDir,
+      sessionMode: sessionMode || 'research',
+      stageTagKeys,
+      tagSource: stageTagSource,
+    });
+    ws.send({
+      type: 'session-created',
+      sessionId: capturedSessionId,
+      provider: 'nano',
+      mode: sessionMode || 'research',
+      projectName: encodeProjectPath(workingDir),
+    });
+  }
+
+  if (ws.setSessionId && typeof ws.setSessionId === 'function') {
+    ws.setSessionId(capturedSessionId);
+  }
+
+  await persistNanoSessionMetadata(capturedSessionId, workingDir, sessionMode);
+
+  const nanoCmd = resolveNanoCommand();
+  const args = [
+    '--output-format', 'stream-json',
+    '-p', command,
+    '--dangerously-skip-permissions',
+    '--session-file', sessionAbsPath,
+  ];
+  if (!isPlaceholderSession) {
+    args.push('--resume', sessionAbsPath);
+  }
+  if (streaming) {
+    args.push('--streaming');
+  }
+  if (model) {
+    args.push('--model', model);
+  }
+
+  console.log('[Nano] spawn:', nanoCmd, args.join(' '));
+  console.log('[Nano] cwd:', workingDir);
+
+  return new Promise((resolve, reject) => {
+    const child = spawnFunction(nanoCmd, args, {
+      cwd: workingDir,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...(env || process.env) },
+    });
+
+    activeNanoSessions.set(capturedSessionId, { process: child, startTime: Date.now() });
+
+    const getSessionStartTime = () => activeNanoSessions.get(capturedSessionId)?.startTime;
+
+    let stdoutBuf = '';
+
+    child.stdout.on('data', (data) => {
+      stdoutBuf += data.toString();
+      const lines = stdoutBuf.split('\n');
+      stdoutBuf = lines.pop() || '';
+      for (const line of lines) {
+        const t = line.trim();
+        if (!t) continue;
+        try {
+          const response = JSON.parse(t);
+          switch (response.type) {
+            case 'assistant':
+              if (response.message) {
+                ws.send({
+                  type: 'claude-response',
+                  data: {
+                    type: 'assistant',
+                    message: response.message,
+                    startTime: getSessionStartTime(),
+                  },
+                  sessionId: capturedSessionId,
+                });
+              }
+              break;
+            case 'user':
+              if (response.message) {
+                ws.send({
+                  type: 'claude-response',
+                  data: {
+                    type: 'user',
+                    message: response.message,
+                    startTime: getSessionStartTime(),
+                  },
+                  sessionId: capturedSessionId,
+                });
+              }
+              break;
+            case 'stream_delta':
+              if (response.content && (response.delta_type === 'text' || response.delta_type === 'thinking')) {
+                ws.send({
+                  type: 'claude-response',
+                  data: {
+                    type: 'content_block_delta',
+                    startTime: getSessionStartTime(),
+                    delta: { type: 'text_delta', text: response.content },
+                  },
+                  sessionId: capturedSessionId,
+                });
+              }
+              break;
+            case 'result': {
+              const u = response.usage || {};
+              const input = Number(u.input_tokens) || 0;
+              const output = Number(u.output_tokens) || 0;
+              const cacheCreate = Number(u.cache_creation_input_tokens) || 0;
+              const cacheRead = Number(u.cache_read_input_tokens) || 0;
+              if (input || output || cacheCreate || cacheRead) {
+                const total = parseInt(process.env.CONTEXT_WINDOW || process.env.VITE_CONTEXT_WINDOW || '200000', 10);
+                ws.send({
+                  type: 'token-budget',
+                  data: {
+                    used: input + output + cacheCreate + cacheRead,
+                    total,
+                    breakdown: {
+                      input,
+                      output,
+                      cacheCreation: cacheCreate,
+                      cacheRead,
+                    },
+                  },
+                  sessionId: capturedSessionId,
+                });
+              }
+              break;
+            }
+            default:
+              break;
+          }
+        } catch {
+          console.warn('[Nano] Ignoring non-JSON stdout line:', t.slice(0, 200));
+        }
+      }
+    });
+
+    child.stderr.on('data', (data) => {
+      const msg = data.toString().trim();
+      if (!msg) return;
+      console.error('[Nano] stderr:', msg);
+      ws.send({
+        type: 'claude-error',
+        error: msg.slice(0, 2000),
+        sessionId: capturedSessionId,
+      });
+    });
+
+    child.on('close', async (code) => {
+      activeNanoSessions.delete(capturedSessionId);
+      ws.send({
+        type: 'claude-complete',
+        sessionId: capturedSessionId,
+        exitCode: code,
+        isNewSession: isPlaceholderSession && Boolean(command && String(command).trim()),
+      });
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`nano-claude-code exited with code ${code}`));
+      }
+    });
+
+    child.on('error', (error) => {
+      activeNanoSessions.delete(capturedSessionId);
+      ws.send({
+        type: 'claude-error',
+        error: error.message,
+        sessionId: capturedSessionId,
+      });
+      reject(error);
+    });
+  });
+}
+
+export function abortNanoClaudeCodeSession(sessionId) {
+  const sessionData = activeNanoSessions.get(sessionId);
+  if (sessionData?.process) {
+    console.log(`[Nano] Aborting session: ${sessionId}`);
+    sessionData.process.kill('SIGTERM');
+    activeNanoSessions.delete(sessionId);
+    return true;
+  }
+  return false;
+}
+
+export function isNanoClaudeCodeSessionActive(sessionId) {
+  return activeNanoSessions.has(sessionId);
+}
+
+export function getNanoClaudeCodeSessionStartTime(sessionId) {
+  const sessionData = activeNanoSessions.get(sessionId);
+  return sessionData ? sessionData.startTime : null;
+}
+
+export function getActiveNanoClaudeCodeSessions() {
+  return Array.from(activeNanoSessions.keys());
+}
+
+/** Kill all in-flight Nano CLI children (e.g. before process exit). */
+export function killAllNanoClaudeCodeChildren() {
+  for (const { process: childProc } of activeNanoSessions.values()) {
+    try {
+      if (childProc && !childProc.killed) {
+        childProc.kill('SIGTERM');
+      }
+    } catch (_) {
+      // ignore
+    }
+  }
+  activeNanoSessions.clear();
+}

package/server/nanoSessionPaths.js

@@ -0,0 +1,41 @@
+/**
+ * Central Nano Claude Code session JSON location (~/.dr-claw/nano-sessions).
+ * Matches file watcher PROVIDER_WATCH_PATHS and avoids cwd-scattered drclaw-nano-*.json.
+ */
+
+import fs from 'fs/promises';
+import path from 'path';
+import os from 'os';
+
+export function getNanoDrClawSessionsRoot() {
+  return path.join(os.homedir(), '.dr-claw', 'nano-sessions');
+}
+
+export async function ensureNanoDrClawSessionsRoot() {
+  const root = getNanoDrClawSessionsRoot();
+  await fs.mkdir(root, { recursive: true });
+  return root;
+}
+
+/**
+ * Plain filename only: drclaw-nano-<sanitizedId>.json — no path segments / traversal.
+ */
+export function safeNanoSessionFilename(sessionId) {
+  const safe = String(sessionId || '').replace(/[^a-zA-Z0-9._-]/g, '');
+  if (!safe || safe.includes('..')) {
+    return null;
+  }
+  const filename = `drclaw-nano-${safe}.json`;
+  if (path.basename(filename) !== filename) {
+    return null;
+  }
+  return filename;
+}
+
+export function resolveNanoSessionAbsPath(sessionId) {
+  const filename = safeNanoSessionFilename(sessionId);
+  if (!filename) {
+    return null;
+  }
+  return path.join(getNanoDrClawSessionsRoot(), filename);
+}

package/server/openai-codex.js

@@ -22,6 +22,7 @@ import { applyStageTagsToSession, recordIndexedSession } from './utils/sessionIn
 import { classifyError, classifySDKError } from '../shared/errorClassifier.js';
 import { buildTempAttachmentFilename } from './utils/imageAttachmentFiles.js';
 import { buildCodexRealtimeTokenBudget } from './utils/sessionTokenUsage.js';
+import { expandSkillCommand } from './utils/skillExpander.js';
 
 // Track active sessions
 const activeCodexSessions = new Map();
@@ -446,14 +447,17 @@ export async function queryCodex(command, options = {}, ws) {
 
     publishSessionId(thread.id || sessionId || null);
 
-    const preparedInput = await prepareCodexInput(command, images, workingDirectory);
+    // Expand /skill-name slash commands into full SKILL.md instructions
+    const expandedCommand = await expandSkillCommand(command?.trim() || command, workingDirectory);
+
+    const preparedInput = await prepareCodexInput(expandedCommand, images, workingDirectory);
     tempImagePaths = preparedInput.tempImagePaths;
     tempDir = preparedInput.tempDir;
 
     // Execute with streaming
     // Prefer pre-uploaded attachments (buildCodexInput) over base64 temp images (prepareCodexInput)
     const codexInput = attachments
-      ? buildCodexInput(command, attachments)
+      ? buildCodexInput(expandedCommand, attachments)
       : preparedInput.input;
     const streamedTurn = await thread.runStreamed(codexInput, {
       signal: abortController.signal