great-cto 2.76.0 → 2.77.1

package/board/packages/board/public/sw.js

@@ -0,0 +1,79 @@
+/**
+ * Service Worker for great_cto board — Web Push support
+ *
+ * Strategy: empty-body push (SW fetches content from server on push).
+ * This avoids payload encryption complexity while keeping notifications fresh.
+ */
+
+const BOARD_ORIGIN = self.location.origin;
+
+self.addEventListener('activate', (event) => {
+  // Take control of all clients immediately — no reload required after install
+  event.waitUntil(self.clients.claim());
+});
+
+self.addEventListener('push', (event) => {
+  event.waitUntil(handlePush());
+});
+
+async function handlePush() {
+  let notif = null;
+  try {
+    const res = await fetch(`${BOARD_ORIGIN}/api/notif-history?unread=1&limit=1`);
+    if (res.ok) {
+      const data = await res.json();
+      if (Array.isArray(data) && data.length > 0) {
+        notif = data[0];
+      }
+    }
+  } catch { /* network error — show a generic notification */ }
+
+  const title = notif?.title || 'great_cto';
+  const body  = notif?.body  || 'You have a new notification.';
+  const tag   = notif?.id    || 'gcto-push';
+  const notifId = notif?.id  || null;
+
+  const options = {
+    body,
+    tag,
+    // icon may not exist — browsers handle missing icon gracefully
+    icon: `${BOARD_ORIGIN}/assets/logo-192.png`,
+    badge: `${BOARD_ORIGIN}/assets/favicon-32.png`,
+    data: {
+      url: `${BOARD_ORIGIN}/`,
+      notifId,
+    },
+    requireInteraction: false,
+  };
+
+  return self.registration.showNotification(title, options);
+}
+
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+  const { url, notifId } = event.notification.data || {};
+
+  event.waitUntil((async () => {
+    // Mark notification as read
+    if (notifId) {
+      try {
+        await fetch(`${BOARD_ORIGIN}/api/notif-history/read`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ id: notifId }),
+        });
+      } catch { /* best-effort */ }
+    }
+
+    // Focus existing board window or open a new one
+    const clientList = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
+    for (const client of clientList) {
+      if (client.url.startsWith(BOARD_ORIGIN) && 'focus' in client) {
+        return client.focus();
+      }
+    }
+    if (self.clients.openWindow) {
+      return self.clients.openWindow(url || `${BOARD_ORIGIN}/`);
+    }
+  })());
+});

package/board/packages/board/push-adapter.mjs

@@ -0,0 +1,222 @@
+/**
+ * push-adapter.mjs — zero-dependency VAPID Web Push helper
+ *
+ * Uses only Node.js built-in modules: node:crypto, node:https, node:http, node:fs, node:url
+ *
+ * Why zero-dep: server.mjs is intentionally dependency-free so the board
+ * starts with just `node server.mjs` — no npm install required.
+ */
+import crypto from 'node:crypto';
+import https from 'node:https';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { URL } from 'node:url';
+
+// ── Helpers: base64url ────────────────────────────────────────────────────
+
+function toBase64url(buf) {
+  return Buffer.from(buf).toString('base64url');
+}
+
+function fromBase64url(str) {
+  return Buffer.from(str, 'base64url');
+}
+
+// ── DER → raw R||S (64 bytes) ─────────────────────────────────────────────
+/**
+ * Convert DER-encoded ECDSA signature to raw R||S (64 bytes).
+ * DER structure: 30 [total_len] 02 [r_len] [r_bytes] 02 [s_len] [s_bytes]
+ * Handles both short (1-byte) and long-form (multi-byte) length encodings.
+ */
+export function derToRaw(der) {
+  let offset = 0;
+  // Skip 0x30 (SEQUENCE tag)
+  if (der[offset++] !== 0x30) throw new Error('DER: expected SEQUENCE tag 0x30');
+  // Skip total length (may be long form)
+  if (der[offset] & 0x80) {
+    offset += (der[offset] & 0x7f) + 1;
+  } else {
+    offset++;
+  }
+  // Read r
+  if (der[offset++] !== 0x02) throw new Error('DER: expected INTEGER tag 0x02 for r');
+  const rLen = der[offset++];
+  const r = der.slice(offset, offset + rLen);
+  offset += rLen;
+  // Read s
+  if (der[offset++] !== 0x02) throw new Error('DER: expected INTEGER tag 0x02 for s');
+  const sLen = der[offset++];
+  const s = der.slice(offset, offset + sLen);
+
+  // Pad r and s to 32 bytes each (DER may prepend 0x00 for sign, or be shorter)
+  const result = Buffer.alloc(64, 0);
+  // r: right-align, ignore leading 0x00 padding
+  const rStart = Math.max(0, r.length - 32);
+  const rDest = 32 - Math.min(r.length, 32);
+  r.copy(result, rDest, rStart);
+  // s: right-align
+  const sStart = Math.max(0, s.length - 32);
+  const sDest = 64 - Math.min(s.length, 32);
+  s.copy(result, sDest, sStart);
+
+  return result;
+}
+
+// ── VAPID key management ───────────────────────────────────────────────────
+
+/**
+ * Generate or load VAPID key pair.
+ * Persists as JWK JSON at keyPath. Returns { publicKey: base64url, privateKey: JWK }.
+ * The publicKey is the uncompressed P-256 point: 0x04 || x || y (65 bytes, base64url).
+ */
+export function getVapidKeys(keyPath) {
+  // Load existing keys from disk
+  if (fs.existsSync(keyPath)) {
+    try {
+      const stored = JSON.parse(fs.readFileSync(keyPath, 'utf8'));
+      if (stored.publicKey && stored.privateKey) return stored;
+    } catch { /* regenerate if corrupt */ }
+  }
+
+  // Generate new P-256 key pair
+  const { privateKey: privObj } = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const jwk = privObj.export({ format: 'jwk' });
+  // jwk = { kty: 'EC', crv: 'P-256', x, y, d }
+
+  // Build uncompressed public key: 0x04 || x || y
+  const xBuf = fromBase64url(jwk.x);
+  const yBuf = fromBase64url(jwk.y);
+  const pubRaw = Buffer.concat([Buffer.from([0x04]), xBuf, yBuf]);
+  const publicKey = toBase64url(pubRaw);
+
+  const keys = { publicKey, privateKey: jwk };
+
+  // Persist — best effort
+  try { fs.mkdirSync(path.dirname(keyPath), { recursive: true }); } catch { /* ignore */ }
+  try { fs.writeFileSync(keyPath, JSON.stringify(keys, null, 2)); } catch { /* best-effort */ }
+
+  return keys;
+}
+
+// ── VAPID JWT ─────────────────────────────────────────────────────────────
+
+/**
+ * Build an ES256 JWT for VAPID authorization.
+ *
+ * @param {string} endpoint - push service endpoint URL
+ * @param {object} privateKeyJwk - JWK { kty, crv, x, y, d }
+ * @param {string} subject - mailto: or https: contact URI
+ * @returns {string} compact JWT (header.payload.signature)
+ */
+export function createVapidJwt(endpoint, privateKeyJwk, subject) {
+  // aud = origin of the push endpoint
+  const url = new URL(endpoint);
+  const aud = `${url.protocol}//${url.host}`;
+  const exp = Math.floor(Date.now() / 1000) + 12 * 3600; // 12h
+
+  const header = toBase64url(JSON.stringify({ typ: 'JWT', alg: 'ES256' }));
+  const payload = toBase64url(JSON.stringify({ aud, exp, sub: subject }));
+  const signingInput = `${header}.${payload}`;
+
+  // Re-import JWK as crypto private key for signing
+  const privKey = crypto.createPrivateKey({ key: privateKeyJwk, format: 'jwk' });
+
+  // Sign with ECDSA SHA-256 → DER output
+  const sign = crypto.createSign('SHA256');
+  sign.update(signingInput);
+  const derSig = sign.sign(privKey);
+
+  // Convert DER → raw R||S (64 bytes)
+  const rawSig = derToRaw(derSig);
+  const signature = toBase64url(rawSig);
+
+  return `${signingInput}.${signature}`;
+}
+
+// ── HTTP POST to push service ─────────────────────────────────────────────
+
+/**
+ * Send a Web Push notification (empty body — SW fetches content from server).
+ *
+ * @param {object} subscription - { endpoint, keys: { p256dh, auth } }
+ * @param {object} vapidKeys - { publicKey, privateKey }
+ * @param {string} subject - VAPID contact URI
+ * @returns {Promise<void>}
+ * @throws on non-2xx (except 201). 410 = subscription expired — caller removes it.
+ */
+export function sendWebPush(subscription, vapidKeys, subject) {
+  return new Promise((resolve, reject) => {
+    const endpoint = subscription.endpoint;
+    const jwt = createVapidJwt(endpoint, vapidKeys.privateKey, subject);
+    const authorization = `vapid t=${jwt},k=${vapidKeys.publicKey}`;
+
+    let parsedUrl;
+    try { parsedUrl = new URL(endpoint); }
+    catch (e) { return reject(new Error(`Invalid push endpoint URL: ${endpoint}`)); }
+
+    const options = {
+      method: 'POST',
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port || (parsedUrl.protocol === 'https:' ? 443 : 80),
+      path: parsedUrl.pathname + parsedUrl.search,
+      headers: {
+        'Authorization': authorization,
+        'TTL': '86400',
+        'Content-Length': '0',
+        'Content-Type': 'application/octet-stream',
+      },
+    };
+
+    const lib = parsedUrl.protocol === 'https:' ? https : http;
+    const req = lib.request(options, (res) => {
+      // Drain response body
+      res.resume();
+      res.on('end', () => {
+        const sc = res.statusCode;
+        if (sc === 201 || (sc >= 200 && sc < 300)) {
+          resolve();
+        } else {
+          const err = new Error(`Push service returned ${sc}`);
+          err.statusCode = sc;
+          reject(err);
+        }
+      });
+    });
+
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// ── Subscription persistence ──────────────────────────────────────────────
+
+export function loadSubscriptions(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return [];
+    const raw = fs.readFileSync(filePath, 'utf8');
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+export function saveSubscriptions(filePath, subs) {
+  try {
+    fs.writeFileSync(filePath, JSON.stringify(subs, null, 2));
+  } catch { /* best-effort */ }
+}
+
+export function addSubscription(filePath, sub) {
+  const subs = loadSubscriptions(filePath);
+  if (subs.some(s => s.endpoint === sub.endpoint)) return; // dedupe
+  subs.push(sub);
+  saveSubscriptions(filePath, subs);
+}
+
+export function removeSubscription(filePath, endpoint) {
+  const subs = loadSubscriptions(filePath);
+  const filtered = subs.filter(s => s.endpoint !== endpoint);
+  saveSubscriptions(filePath, filtered);
+}

package/board/packages/board/server.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+/**
+ * great_cto board server
+ * Serves Kanban + CTO Dashboard on localhost:3141
+ * Data source: bd list --json (Beads), verdicts/*.log, docs/
+ *
+ * Usage: node server.mjs [--port 3141] [--no-open]
+ */
+
+import http from 'http';
+// The build board. (The separate operator-console runtime lives in its own repo.)
+import fs from 'fs';
+import path from 'path';
+import { spawnSync } from 'child_process';
+import { PORT, PUBLIC, HOST } from './lib/config.mjs';
+import { originAllowed } from './lib/util.mjs';
+import { discoverProjects, resolveProjectInfo } from './lib/projects.mjs';
+import { startAlertCron } from './lib/alerts.mjs';
+import { watchBeads, watchVerdicts } from './lib/watchers.mjs';
+import { dispatch } from './lib/routes.mjs';
+
+// ── Helpers ────────────────────────────────────────────────────────────────────
+
+// ── HTTP router ────────────────────────────────────────────────────────────────
+const MAX_BODY_BYTES = 2 * 1024 * 1024; // 2 MB — board payloads are tiny; cap guards against unbounded `body += c` accumulation.
+const server = http.createServer(async (req, res) => {
+  // Single-point body-size guard: every route reads `body += c`, so cap cumulative
+  // request bytes here and kill the socket on overflow rather than buffering forever.
+  if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
+    let _seen = 0;
+    req.on('data', (c) => {
+      _seen += c.length;
+      if (_seen > MAX_BODY_BYTES && !res.headersSent) {
+        res.writeHead(413, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'request body too large' }));
+        req.destroy();
+      }
+    });
+  }
+  const url = new URL(req.url, `http://localhost:${PORT}`);
+  const pathname = url.pathname;
+  const proj = url.searchParams.get('project');
+  // BH-5 fix: surface project resolution as a response header. Previously
+  // ?project=<unknown> silently returned cwd's data — user thought they
+  // were viewing projectX but saw projectY. Now: X-Project-Fallback header
+  // tells the client what happened.
+  const projInfo = resolveProjectInfo(proj);
+  const cwd = projInfo.cwd;
+  if (projInfo.resolved === 'fallback') {
+    res.setHeader('X-Project-Fallback', `requested='${projInfo.requested}' served='cwd'`);
+    res.setHeader('X-Project-Resolved', 'fallback');
+  } else {
+    res.setHeader('X-Project-Resolved', projInfo.resolved);
+  }
+
+  // CORS
+  res.setHeader('Access-Control-Allow-Origin', '*');
+  // Expose our debug headers to browsers (CORS hides custom headers by default)
+  res.setHeader('Access-Control-Expose-Headers', 'X-Project-Fallback, X-Project-Resolved');
+
+  // ── CSRF guard (BH-31) ──────────────────────────────────────────────────────
+  // The board binds 127.0.0.1, but a page the user visits in their browser can still
+  // issue *simple* cross-origin POSTs to localhost (no preflight). Every state-changing
+  // request must therefore be SAME-ORIGIN — otherwise a malicious page could approve an
+  // autopilot gate (→ run an irreversible write), approve a dev gate, or mutate tasks.
+  // (originAllowed() permits requests with no Origin — curl, the CLI, server-to-server —
+  // and rejects a foreign browser Origin.)
+  if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method) && !originAllowed(req)) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'cross-origin request blocked — the board only accepts same-origin state changes' }));
+    return;
+  }
+
+  // Try all /api/* routes + /api/sse first.
+  if (await dispatch(req, res, url, cwd)) return;
+
+  // Static files
+  let filePath = pathname === '/' ? '/index.html' : pathname;
+  const fullPath = path.join(PUBLIC, filePath);
+  if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
+    const ext = path.extname(fullPath);
+    const mime = { '.html': 'text/html', '.css': 'text/css', '.js': 'text/javascript', '.svg': 'image/svg+xml' };
+    // HTML must never cache — board UI is iterated daily and stale layouts
+    // hide new features (period selector, push toggle, etc.) until hard refresh
+    const headers = { 'Content-Type': mime[ext] || 'text/plain' };
+    if (ext === '.html' || ext === '.js') headers['Cache-Control'] = 'no-cache, no-store, must-revalidate';
+    res.writeHead(200, headers);
+    res.end(fs.readFileSync(fullPath));
+    return;
+  }
+
+  // API requests get a JSON 404 so frontends can JSON.parse() the response
+  // without crashing. Static-file 404s stay plain text.
+  if (pathname.startsWith('/api/')) {
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Not found', path: pathname, hint: 'Endpoint missing — restart the board after a great-cto update.' }));
+    return;
+  }
+  res.writeHead(404);
+  res.end('Not found');
+});
+
+// ── Start ──────────────────────────────────────────────────────────────────────
+server.listen(PORT, HOST, () => {
+  console.log(`great_cto board → http://${HOST === '0.0.0.0' ? 'localhost' : HOST}:${PORT}`);
+  if (HOST !== '127.0.0.1' && HOST !== 'localhost') {
+    console.log(`  ⚠ bound to ${HOST} — reachable beyond this machine. Operators authenticate via invite`);
+    console.log(`    links; put your reverse-proxy auth in front for anything admin-grade.`);
+  }
+  // Discover all great_cto projects on disk asynchronously — don't block
+  // the listening event so /api/tasks is available immediately.
+  discoverProjects().then(n => {
+    if (n > 0) console.log(`  → discovered ${n} project${n === 1 ? '' : 's'} with .great_cto/PROJECT.md`);
+  }).catch(() => {}); // non-fatal
+  watchBeads();
+  startAlertCron();
+  watchVerdicts();
+
+  // Auto-open browser unless --no-open
+  if (!process.argv.includes('--no-open')) {
+    const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    spawnSync(opener, [`http://localhost:${PORT}`], { detached: true });
+  }
+});
+
+server.on('error', e => {
+  if (e.code === 'EADDRINUSE') {
+    console.log(`Port ${PORT} in use — board already running at http://localhost:${PORT}`);
+  } else {
+    console.error(e);
+  }
+  process.exit(0);
+});