hammoc 1.7.1 → 1.8.0

package/packages/server/dist/handlers/websocket.js

@@ -39,6 +39,9 @@ import { buildRawMessageTree, getActiveRawBranch, getDefaultRawBranchSelections,
 import { sessionBufferManager } from '../services/sessionBufferManager.js';
 import { imageStorageService } from '../services/imageStorageService.js';
 import { isSnippetRef, resolveSnippet, listSnippets, SnippetError } from '../utils/snippetResolver.js';
+import { ClaudeLoginSession, deleteCredentials } from '../services/claudeLoginService.js';
+import { accountInfoService } from '../services/accountInfoService.js';
+import { accountStorageService } from '../services/accountStorageService.js';
 const log = createLogger('websocket');
 // Alias for concise usage in guards
 const queueInstances = getQueueInstances;
@@ -46,6 +49,8 @@ const queueInstances = getQueueInstances;
 const warnedMissing1M = new Set();
 // Socket-to-terminal mapping: socket.id → Set of terminalIds (Story 17.1)
 const socketTerminals = new Map();
+// Story BS-7: one in-flight Claude Code login session per socket (disposable PTY).
+const socketLoginSessions = new Map();
 // Story 20.1: Session-to-project mapping for dashboard triggers
 const sessionProjectMap = new Map();
 // Story 20.1: Per-project debounced dashboard status change broadcaster
@@ -456,6 +461,38 @@ export function isSessionStreaming(sessionId) {
     const stream = activeStreams.get(sessionId);
     return !!stream && stream.status === 'running';
 }
+/** Check if a session has any pending AskUserQuestion interactions */
+export function sessionHasPendingQuestion(sessionId) {
+    const stream = activeStreams.get(sessionId);
+    if (!stream)
+        return false;
+    for (const p of stream.pendingPermissions.values()) {
+        if (p.interactionType === 'question')
+            return true;
+    }
+    return false;
+}
+/** Get pending AskUserQuestion counts grouped by project slug (in-memory, no I/O) */
+export function getPendingQuestionCountsByProject() {
+    const counts = new Map();
+    for (const [sessionId, stream] of activeStreams.entries()) {
+        if (stream.status !== 'running')
+            continue;
+        let hasQuestion = false;
+        for (const p of stream.pendingPermissions.values()) {
+            if (p.interactionType === 'question') {
+                hasQuestion = true;
+                break;
+            }
+        }
+        if (hasQuestion) {
+            const slug = sessionProjectMap.get(sessionId);
+            if (slug)
+                counts.set(slug, (counts.get(slug) ?? 0) + 1);
+        }
+    }
+    return counts;
+}
 /** Get session IDs that have active socket connections for a given project */
 export function getJoinedSessionIdsByProject(projectSlug) {
     const sessionIds = new Set();
@@ -566,6 +603,15 @@ function cleanupStream(streamKey, expectedStream) {
     // Only delete from activeStreams and clean up socket mappings if the stream
     // hasn't been replaced. When replaced, the new stream owns those resources.
     if (!replaced) {
+        // Clear pending question state before removing the stream
+        if (current) {
+            for (const p of current.pendingPermissions.values()) {
+                if (p.interactionType === 'question') {
+                    emitQuestionChange(streamKey, false);
+                    break;
+                }
+            }
+        }
         activeStreams.delete(streamKey);
         for (const [sockId, sessId] of socketToSession.entries()) {
             if (sessId === streamKey)
@@ -719,6 +765,17 @@ function emitStreamChange(sessionId, active, projectSlug) {
         }
     }
 }
+/**
+ * Emit session:question-change when an AskUserQuestion becomes pending or is resolved.
+ * Scoped to the project room so only relevant session list viewers receive it.
+ */
+function emitQuestionChange(sessionId, hasPendingQuestion) {
+    const projectSlug = sessionProjectMap.get(sessionId);
+    if (projectSlug) {
+        io.to(`project:${projectSlug}`).emit('session:question-change', { sessionId, hasPendingQuestion, projectSlug });
+        triggerDashboardStatusChange(projectSlug);
+    }
+}
 /**
  * Broadcast session:stream-change to project room (or all clients as fallback).
  * Used by queue service to signal stream start/end.
@@ -787,11 +844,13 @@ export async function initializeWebSocket(httpServer) {
     });
     // Session middleware for WebSocket (Story 2.5 - Task 4)
     const sessionMiddleware = await createSessionMiddleware();
-    // Parse session from cookie for Socket.io connections
+    // Parse session from cookie for Socket.io connections.
+    // cookie-session + on-headers expect a response-like object; a real
+    // ServerResponse would try to send headers over the upgraded WebSocket.
     io.use((socket, next) => {
-        // Express middleware adapter for Socket.io
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        sessionMiddleware(socket.request, {}, next);
+        const res = { getHeader() { }, setHeader() { }, writeHead() { } };
+        sessionMiddleware(socket.request, res, next);
     });
     // Authentication middleware (Story 2.5 - Task 4)
     io.use((socket, next) => {
@@ -1032,9 +1091,15 @@ export async function initializeWebSocket(httpServer) {
             if (!sessionId)
                 return;
             const stream = activeStreams.get(sessionId);
-            if (stream?.pendingPermissions.has(data.requestId)) {
-                stream.pendingPermissions.get(data.requestId).resolve({ approved: data.approved, response: data.response });
+            if (!stream)
+                return;
+            const pending = stream.pendingPermissions.get(data.requestId);
+            if (pending) {
+                const wasQuestion = pending.interactionType === 'question';
+                pending.resolve({ approved: data.approved, response: data.response });
                 stream.pendingPermissions.delete(data.requestId);
+                if (wasQuestion)
+                    emitQuestionChange(sessionId, sessionHasPendingQuestion(sessionId));
                 // Broadcast the actual resolution to all OTHER viewers so their
                 // tool/interactive cards can show the correct approve/deny state.
                 // Also buffer via createStreamEmit so reconnecting clients see the
@@ -2146,8 +2211,67 @@ export async function initializeWebSocket(httpServer) {
                 // Ignore close errors — session may already be gone
             }
         });
+        // Story BS-7: Claude Code in-app login flow over a disposable PTY.
+        // auth:start spawns the login session; the session drives boot → /login and reports each
+        // phase back through these socket emits. One session per socket (a re-start disposes the prior).
+        socket.on('auth:start', async () => {
+            const prior = socketLoginSessions.get(socket.id);
+            if (prior) {
+                prior.dispose();
+                socketLoginSessions.delete(socket.id);
+            }
+            // The login PTY uses the same binary-path override as chat (global preference).
+            let cliBinaryPath;
+            try {
+                cliBinaryPath = (await preferencesService.readPreferences()).cliBinaryPath;
+            }
+            catch {
+                cliBinaryPath = undefined;
+            }
+            const session = new ClaudeLoginSession({
+                onMethodPrompt: () => socket.emit('auth:method-prompt'),
+                onUrl: (url) => socket.emit('auth:url', { url }),
+                onCodePrompt: () => socket.emit('auth:code-prompt'),
+                onComplete: (account) => {
+                    socket.emit('auth:complete', { account });
+                    socketLoginSessions.delete(socket.id);
+                    // Story BS-8: accumulate the just-written credential into the multi-account store.
+                    // Login already made this account active, so the credentials file holds its credential
+                    // and accountInfoService supplied the email (or null → fallback key, AC1a). Fire-and-forget.
+                    accountStorageService.captureActiveCredential(account?.email ?? null).catch((err) => {
+                        log.warn(`BS-8: failed to capture credential after login: ${err instanceof Error ? err.message : String(err)}`);
+                    });
+                },
+                onError: (message) => {
+                    socket.emit('auth:error', { message });
+                    socketLoginSessions.delete(socket.id);
+                },
+            });
+            socketLoginSessions.set(socket.id, session);
+            session.start(cliBinaryPath);
+        });
+        socket.on('auth:select-method', (data) => {
+            socketLoginSessions.get(socket.id)?.selectMethod(data.method);
+        });
+        socket.on('auth:submit-code', (data) => {
+            socketLoginSessions.get(socket.id)?.submitCode(data.code);
+        });
+        socket.on('auth:logout', async () => {
+            const ok = deleteCredentials();
+            // Re-read usage credentials freshly (the deleted file → no token) so probing reflects logout.
+            rateLimitProbeService.invalidateTokenCache();
+            if (!ok) {
+                socket.emit('auth:error', { message: 'Failed to delete credentials' });
+                return;
+            }
+            // Refresh the in-memory account cache so a subsequent /account read reflects the logout.
+            // The client transitions to the inline login flow optimistically (no success event needed).
+            accountInfoService.refresh().catch(() => {
+                /* best-effort — the file is gone regardless */
+            });
+        });
         // Disconnect: detach socket from stream, DON'T abort or deny permissions
-        socket.on('disconnect', () => {
+        socket.on('disconnect', (reason) => {
             const sessionId = socketToSession.get(socket.id);
             if (sessionId) {
                 const stream = activeStreams.get(sessionId);
@@ -2216,8 +2340,15 @@ export async function initializeWebSocket(httpServer) {
             if (terminalIds) {
                 socketTerminals.delete(socket.id);
             }
+            // Story BS-7: dispose any in-flight login PTY for this socket (the disposable login session
+            // must not outlive its only client — it has no background-completion semantics like chat).
+            const loginSession = socketLoginSessions.get(socket.id);
+            if (loginSession) {
+                loginSession.dispose();
+                socketLoginSessions.delete(socket.id);
+            }
             connectedClients--;
-            log.info(`Client disconnected. Total: ${connectedClients}`);
+            log.info(`Client disconnected (reason=${reason}). Total: ${connectedClients}`);
             // Stop polling when no clients connected
             if (connectedClients === 0) {
                 rateLimitProbeService.stopPolling();
@@ -2515,7 +2646,10 @@ async function handleChatSend(stream, data, abortController, lang) {
         // Story 33.3: resolve the effective engine mode (override > global > 'sdk' default).
         // Captured once into a local so the progress-callback gating below reuses the same
         // decision (no second resolve, and `engineMode === 'cli'` stays consistent).
-        const engineMode = await projectService.getEffectiveEngineMode(workingDirectory);
+        const [engineMode, isBmadProject] = await Promise.all([
+            projectService.getEffectiveEngineMode(workingDirectory),
+            projectService.checkBmadProject(workingDirectory),
+        ]);
         // Auto-compaction master switch (both engines). Default ON. Gates the engine-internal
         // auto-compact (forwarded into each engine's settings) AND Hammoc's overflow-triggered
         // /compact recovery below, so one toggle controls all auto-compaction.
@@ -2547,6 +2681,8 @@ async function handleChatSend(stream, data, abortController, lang) {
                 : { images }),
             // Advanced settings from preferences
             customSystemPrompt: effectivePrefs.customSystemPrompt,
+            displayName: effectivePrefs.displayName,
+            isBmadProject,
             // maxThinkingTokens: legacy path; SDK docs say it takes precedence for backward-compat,
             // which conflicts with adaptive mode on Opus 4.7+ (rejects enabled+budget). Skip on
             // adaptive-capable models so the explicit `thinking` field governs.
@@ -2623,6 +2759,8 @@ async function handleChatSend(stream, data, abortController, lang) {
                         resolve,
                         interactionType: isAskUserQuestion ? 'question' : 'permission',
                     });
+                    if (isAskUserQuestion)
+                        emitQuestionChange(sessionIdRef.current || '', true);
                 });
                 if (isAskUserQuestion) {
                     const questions = input.questions;