mango-cms 0.3.33 → 0.3.35

package/lib/vibe-orchestrator/src/recovery.js

@@ -0,0 +1,199 @@
+// recovery.js
+//
+// Always a way back (HAP-1124, protection #2). A vibe edit must never leave the
+// staging clone in a non-recoverable state, so:
+//
+//   • autoCommit(site)      — after every run, stage the clone (settings.json
+//                             excluded, exactly like publish) and commit any
+//                             change with a structured message. History always
+//                             exists, so any edit is verifiable + reversible.
+//   • ensureBaseline(site)  — on the first auto-commit, tag the pre-edit tree as
+//                             the known-good baseline `vibe-baseline`.
+//   • revertLast(site)      — undo the most recent vibe edit (git revert, keeps
+//                             history; non-destructive).
+//   • resetToBaseline(site) — hard-reset the clone back to the baseline tag,
+//                             discarding all vibe edits (recoverable via reflog).
+//   • status(site)          — baseline + recent vibe commits + what's available.
+//
+// All of this is plain git on the staging clone — no engineer required. The
+// orchestrator exposes it as endpoints and a one-command script (scripts/
+// vibe-recover.sh) so the client/board can recover with one call/click.
+
+import { execFile } from 'node:child_process'
+import { resolveSiteDir, config } from './config.js'
+import { SETTINGS_PATH } from './publisher.js'
+
+const EXCLUDE_SETTINGS = `:(exclude)${SETTINGS_PATH}`
+const COMMIT_PREFIX = 'vibe:'
+
+/** Promisified git scoped to a dir. Resolves { code, stdout, stderr }; rejects
+ *  only when mustSucceed and the command fails. */
+function git(cwd, args, { mustSucceed = false } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile('git', args, { cwd, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+      const code = err && typeof err.code === 'number' ? err.code : err ? 1 : 0
+      if (err && mustSucceed) {
+        const e = new Error(`git ${args[0]} failed: ${(stderr || err.message || '').trim()}`)
+        e.code = code
+        return reject(e)
+      }
+      resolve({ code, stdout: stdout || '', stderr: stderr || '' })
+    })
+  })
+}
+
+async function headSha(cwd) {
+  const r = await git(cwd, ['rev-parse', 'HEAD'])
+  return r.code === 0 ? r.stdout.trim() : null
+}
+
+async function tagSha(cwd, tag) {
+  const r = await git(cwd, ['rev-parse', '--verify', '--quiet', `${tag}^{commit}`])
+  return r.code === 0 ? r.stdout.trim() : null
+}
+
+/** Build a single-line, structured commit message for an applied vibe edit. */
+function commitMessage({ summary, sessionId }) {
+  const s = String(summary || 'edit').replace(/\s+/g, ' ').trim().slice(0, 140) || 'edit'
+  const sess = sessionId ? ` [session ${sessionId}]` : ''
+  return `${COMMIT_PREFIX} ${s}${sess}`
+}
+
+/**
+ * Ensure the known-good baseline tag exists, pointing at the current HEAD. Called
+ * before the first auto-commit so the baseline captures the pre-edit tree.
+ * Idempotent — never moves an existing tag.
+ * @returns {Promise<{tag, sha, created}>}
+ */
+async function ensureBaseline(site, opts = {}) {
+  const dir = opts.dir || resolveSiteDir(site)
+  const tag = opts.tag || config.baselineTag
+  const existing = await tagSha(dir, tag)
+  if (existing) return { tag, sha: existing, created: false }
+  const sha = await headSha(dir)
+  if (!sha) return { tag, sha: null, created: false } // no commits yet — nothing to tag
+  await git(dir, ['tag', '-a', tag, '-m', 'vibe known-good baseline (HAP-1124)'], { mustSucceed: true })
+  return { tag, sha, created: true }
+}
+
+/**
+ * Auto-commit any working-tree change from a vibe run. settings.json is excluded
+ * (same hard rule as publish). No-op when the tree is clean. Tags the baseline on
+ * the first commit.
+ * @returns {Promise<{committed, sha?, message?, baseline}>}
+ */
+async function autoCommit(site, opts = {}) {
+  const dir = opts.dir || resolveSiteDir(site)
+
+  // Tag the pre-edit tree as baseline before the first commit lands.
+  const baseline = await ensureBaseline(site, { dir, tag: opts.tag })
+
+  // Stage everything except settings.json (overlay-materialized; never committed
+  // by vibe — it is also on the protected denylist).
+  await git(dir, ['add', '-A', '--', '.', EXCLUDE_SETTINGS], { mustSucceed: true })
+
+  const staged = await git(dir, ['diff', '--cached', '--quiet'])
+  if (staged.code === 0) return { committed: false, baseline } // nothing changed
+
+  const message = commitMessage(opts)
+  await git(dir, ['commit', '-m', message], { mustSucceed: true })
+  const sha = await headSha(dir)
+  return { committed: true, sha, message, baseline }
+}
+
+/** Recent vibe commits (newest first), most-recent `limit`. */
+async function vibeCommits(dir, limit = 20) {
+  const r = await git(dir, ['log', `-n${limit}`, '--pretty=format:%H%x1f%s%x1f%cI'])
+  if (r.code !== 0 || !r.stdout.trim()) return []
+  return r.stdout.trim().split('\n').map((line) => {
+    const [sha, subject, date] = line.split('\x1f')
+    return { sha, subject, date, isVibe: (subject || '').startsWith(COMMIT_PREFIX) }
+  })
+}
+
+/**
+ * Recovery status: baseline, current HEAD, recent commits, and which recovery
+ * actions are currently available.
+ */
+async function status(site, opts = {}) {
+  const dir = opts.dir || resolveSiteDir(site)
+  const tag = opts.tag || config.baselineTag
+  const [head, baseline, commits] = await Promise.all([
+    headSha(dir),
+    tagSha(dir, tag),
+    vibeCommits(dir),
+  ])
+  const lastIsVibe = commits.length > 0 && commits[0].isVibe
+  const aheadOfBaseline = !!(baseline && head && baseline !== head)
+  return {
+    site,
+    dir,
+    head,
+    baselineTag: tag,
+    baselineSha: baseline,
+    hasBaseline: !!baseline,
+    aheadOfBaseline,
+    recentCommits: commits,
+    canRevertLast: lastIsVibe,
+    canResetToBaseline: !!baseline && aheadOfBaseline,
+  }
+}
+
+/**
+ * Revert the most recent vibe edit (git revert HEAD — keeps full history, never
+ * destructive). Refuses when HEAD is not a vibe commit so we never revert manual
+ * engineer work.
+ * @returns {Promise<{ok, revertedSha, newSha, message}>}
+ */
+async function revertLast(site, opts = {}) {
+  const dir = opts.dir || resolveSiteDir(site)
+  const commits = await vibeCommits(dir, 1)
+  if (!commits.length || !commits[0].isVibe) {
+    const e = new Error('the most recent commit is not a vibe edit — nothing to revert')
+    e.statusCode = 409
+    throw e
+  }
+  const revertedSha = commits[0].sha
+  // Guard against a dirty tree wedging the revert: commit any stray change first.
+  await git(dir, ['add', '-A', '--', '.', EXCLUDE_SETTINGS])
+  const dirty = await git(dir, ['diff', '--cached', '--quiet'])
+  if (dirty.code !== 0) {
+    await git(dir, ['commit', '-m', `${COMMIT_PREFIX} snapshot before revert`], { mustSucceed: true })
+  }
+  await git(dir, ['revert', '--no-edit', revertedSha], { mustSucceed: true })
+  const newSha = await headSha(dir)
+  return { ok: true, revertedSha, newSha, message: `Reverted ${revertedSha.slice(0, 8)}` }
+}
+
+/**
+ * Reset the clone hard back to the known-good baseline, discarding all vibe edits
+ * since. Destructive on the working branch but fully recoverable via the reflog,
+ * and the baseline tag itself is never moved.
+ * @returns {Promise<{ok, baselineTag, baselineSha, previousHead}>}
+ */
+async function resetToBaseline(site, opts = {}) {
+  const dir = opts.dir || resolveSiteDir(site)
+  const tag = opts.tag || config.baselineTag
+  const baseline = await tagSha(dir, tag)
+  if (!baseline) {
+    const e = new Error(`no baseline tag (${tag}) to reset to`)
+    e.statusCode = 409
+    throw e
+  }
+  const previousHead = await headSha(dir)
+  await git(dir, ['reset', '--hard', tag], { mustSucceed: true })
+  // Drop untracked files a vibe edit may have created so the tree truly matches
+  // the baseline. settings.json (and anything gitignored) is preserved with -e.
+  await git(dir, ['clean', '-fd', '-e', SETTINGS_PATH])
+  return { ok: true, baselineTag: tag, baselineSha: baseline, previousHead }
+}
+
+export {
+  autoCommit,
+  ensureBaseline,
+  revertLast,
+  resetToBaseline,
+  status,
+  commitMessage,
+  COMMIT_PREFIX,
+}

package/lib/vibe-orchestrator/src/screenshot.js

@@ -0,0 +1,38 @@
+// screenshot.js
+//
+// Persist a client-sent viewport screenshot (a base64 data URL) to a temp file
+// the agent can Read — Claude Code reads images. The file lives in the OS temp
+// dir, NOT in the staging repo, so it is never committed or published. One file
+// per site is reused (overwritten each turn) to avoid unbounded growth.
+
+import { writeFileSync, mkdirSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const DIR = join(tmpdir(), 'vibe-orchestrator')
+const DATA_URL = /^data:image\/(png|jpeg|jpg|webp);base64,([A-Za-z0-9+/=]+)$/
+
+/**
+ * Write a data-URL screenshot to disk and return its absolute path, or null when
+ * the input is missing/invalid or the write fails (best-effort — never throws).
+ * @param {string} site
+ * @param {string} dataUrl
+ * @returns {string|null}
+ */
+function persistScreenshot(site, dataUrl) {
+  if (!dataUrl || typeof dataUrl !== 'string') return null
+  const m = DATA_URL.exec(dataUrl.trim())
+  if (!m) return null
+  try {
+    mkdirSync(DIR, { recursive: true })
+    const ext = m[1] === 'jpeg' ? 'jpg' : m[1]
+    const safe = String(site || 'site').replace(/[^a-z0-9_-]/gi, '_')
+    const path = join(DIR, `${safe}-viewport.${ext}`)
+    writeFileSync(path, Buffer.from(m[2], 'base64'))
+    return path
+  } catch {
+    return null
+  }
+}
+
+export { persistScreenshot }

package/lib/vibe-orchestrator/src/sessionManager.js

@@ -0,0 +1,291 @@
+// sessionManager.js
+//
+// Per-site session registry. One logical session per site survives across
+// prompts: we remember the last claude session_id so the next prompt resumes
+// the same conversation (`claude --resume <id>`), and we carry cumulative token
+// usage forward so the per-session cap spans the whole conversation, not a
+// single turn. Only one run may be in-flight per site at a time.
+
+import { EventEmitter } from 'node:events'
+import { runPrompt } from './claudeRunner.js'
+import { resolveSiteDir, config, canRunLive } from './config.js'
+import { composePrompt } from './preamble.js'
+import { persistScreenshot } from './screenshot.js'
+import { persistAttachments } from './attachments.js'
+import { appendCost } from './costStore.js'
+import { mirrorCost } from './costMirror.js'
+import { autoCommit } from './recovery.js'
+
+class SessionManager {
+  /** @param {object} [deps] - injectable runPrompt / clock / reaper for tests */
+  constructor(deps = {}) {
+    this.runPrompt = deps.runPrompt || runPrompt
+    this.cfg = deps.config || config
+    this.now = deps.now || (() => Date.now())
+    // HAP-1123: per-turn cost persistence. recordCost writes the durable NDJSON
+    // log (system of record); mirrorCost best-effort POSTs the same record to the
+    // Mango `vibeCosts` collection. Both injectable so tests stay fs/network-free.
+    this.recordCost = deps.recordCost || appendCost
+    this.mirrorCost = deps.mirrorCost || mirrorCost
+    // HAP-1124: after each run, auto-commit the applied edit to the clone's git so
+    // there is always a way back. Injectable so tests stay git-free.
+    this.autoCommit = deps.autoCommit || autoCommit
+    /** @type {Map<string, object>} site -> session record */
+    this.sessions = new Map()
+    this._reaper = null
+    // Auto-start the idle reaper unless explicitly disabled (tests pass false).
+    if (deps.startReaper !== false && this.cfg.sessionIdleMs > 0) this.startReaper()
+  }
+
+  _ensure(site) {
+    let s = this.sessions.get(site)
+    if (!s) {
+      s = {
+        site,
+        sessionId: null,
+        cumulativeTokens: 0,
+        status: 'idle', // idle | running | error
+        active: null,    // current run handle while running
+        lastResult: null,
+        promptCount: 0,
+        lastActivity: this.now(), // ms; bumped by prompts, events, and keepalive touches
+        readers: 0,               // open SSE connections actively reading this session
+      }
+      this.sessions.set(site, s)
+    }
+    return s
+  }
+
+  get(site) {
+    return this.sessions.get(site) || null
+  }
+
+  list() {
+    return [...this.sessions.values()].map((s) => ({
+      site: s.site,
+      sessionId: s.sessionId,
+      cumulativeTokens: s.cumulativeTokens,
+      status: s.status,
+      promptCount: s.promptCount,
+    }))
+  }
+
+  /** Reset a site's conversation (next prompt starts fresh). */
+  reset(site) {
+    const s = this.sessions.get(site)
+    if (s && s.status === 'running') throw new Error('cannot reset while running')
+    this.sessions.delete(site)
+  }
+
+  /**
+   * Submit a prompt to a site. Returns the run's EventEmitter immediately;
+   * progress events flow through it, and the session record is updated on end.
+   *
+   * @param {string} site
+   * @param {string} prompt
+   * @param {object} [opts]
+   * @param {object} [opts.pageContext] - per-turn snapshot of what the owner sees
+   * @param {Array}  [opts.attachments] - { name, mime, dataUrl } files to persist
+   * @returns {{ emitter: EventEmitter, done: Promise<object>, abort: ()=>void }}
+   */
+  submit(site, prompt, opts = {}) {
+    if (!prompt || typeof prompt !== 'string' || !prompt.trim()) {
+      throw new Error('prompt is required')
+    }
+    if (!canRunLive()) {
+      throw new Error('CLAUDE_CODE_OAUTH_TOKEN not set — cannot run live')
+    }
+    const cwd = resolveSiteDir(site) // throws on bad slug / not allowed
+    const s = this._ensure(site)
+    if (s.status === 'running') {
+      throw new Error(`site ${site} already has a run in progress`)
+    }
+
+    // Remaining budget for this conversation (cap spans all turns).
+    const remaining = this.cfg.tokenCap > 0
+      ? Math.max(0, this.cfg.tokenCap - s.cumulativeTokens)
+      : 0
+    if (this.cfg.tokenCap > 0 && remaining === 0) {
+      throw new Error(`session token cap (${this.cfg.tokenCap}) reached for ${site}`)
+    }
+
+    // HAP-1111: enrich the prompt with agent orientation (first turn only) and a
+    // per-turn snapshot of what the owner is looking at, including a screenshot
+    // the agent can Read. Resumed turns already carry the orientation in history.
+    const ctx = { ...(opts.pageContext || {}) }
+    if (ctx.screenshot) {
+      const shot = persistScreenshot(site, ctx.screenshot)
+      delete ctx.screenshot
+      if (shot) ctx.screenshotPath = shot
+    }
+    // HAP-1126: persist any pasted/uploaded files (images + PDFs) to temp paths
+    // the agent can Read, and hand the absolute paths to the preamble. Passing an
+    // array (even empty) sweeps the previous turn's files so temp stays bounded.
+    const savedAttachments = persistAttachments(site, opts.attachments)
+    if (savedAttachments.length) {
+      ctx.attachmentPaths = savedAttachments.map((a) => ({ name: a.name, path: a.path }))
+    }
+    const composedPrompt = composePrompt({
+      prompt,
+      pageContext: ctx,
+      includePreamble: !s.sessionId,
+    })
+
+    // HAP-1123: remember a short, single-line prompt summary and the page the
+    // owner was on so the persisted cost record is human-readable on an invoice.
+    const promptSummary = prompt.trim().replace(/\s+/g, ' ').slice(0, 140)
+    const pagePath = ctx.route || ctx.url || null
+
+    const handle = this.runPrompt({
+      prompt: composedPrompt,
+      cwd,
+      oauthToken: this.cfg.oauthToken,
+      claudeBin: this.cfg.claudeBin,
+      permissionMode: this.cfg.permissionMode,
+      model: this.cfg.model,
+      resumeSessionId: s.sessionId,
+      tokenCap: remaining,
+      timeoutMs: this.cfg.runTimeoutMs,
+      markupPct: this.cfg.markupPct,
+      // HAP-1124: install the server-side PreToolUse path guard for this run.
+      pathGuardHook: this.cfg.pathGuardEnabled ? this.cfg.pathGuardHook : '',
+      // HAP-1096: pre-approve read-only web tools + grant read access to the temp
+      // dir holding the viewport screenshot and any pasted/uploaded attachments.
+      allowedTools: this.cfg.allowedTools,
+      addDirs: this.cfg.toolExtraDirs,
+    })
+
+    s.status = 'running'
+    s.active = handle
+    s.promptCount += 1
+    s.lastActivity = this.now()
+
+    // Every streamed event is fresh activity — keep the session warm while it runs.
+    if (handle.emitter?.on) handle.emitter.on('event', () => { s.lastActivity = this.now() })
+
+    handle.done.then((summary) => {
+      if (summary.sessionId) s.sessionId = summary.sessionId
+      // Accumulate BILLABLE tokens (new input + output), not the full volume that
+      // re-counts cached context each turn — keeps the per-session cap meaningful
+      // across multiple prompts. Falls back to totalTokens for older summaries.
+      if (summary.tokens) {
+        s.cumulativeTokens += summary.tokens.billableTokens ?? summary.tokens.totalTokens
+      }
+      s.status = summary.ok ? 'idle' : 'error'
+      s.active = null
+      s.lastResult = summary
+      s.lastActivity = this.now()
+
+      // Persist a per-turn cost record (HAP-1123). Best-effort: a logging failure
+      // must never surface to the run, and the Mango mirror is fire-and-forget.
+      try {
+        const tk = summary.tokens || {}
+        const entry = {
+          ts: this.now(),
+          site,
+          path: pagePath,
+          sessionId: summary.sessionId || s.sessionId || null,
+          model: summary.model || this.cfg.model || null,
+          costUsd: typeof summary.costUsd === 'number' ? summary.costUsd : null,
+          tokens: {
+            input: tk.inputTokens,
+            output: tk.outputTokens,
+            cacheRead: tk.cacheReadTokens,
+            total: tk.totalTokens,
+            billable: tk.billableTokens,
+          },
+          promptSummary,
+          ok: !!summary.ok,
+        }
+        const saved = this.recordCost(entry)
+        Promise.resolve(this.mirrorCost(saved)).catch(() => {})
+      } catch { /* cost logging is never allowed to break a run */ }
+
+      // HAP-1124: auto-commit any applied edit so history always exists and the
+      // tree is never left non-recoverable. Runs even on a non-ok/aborted summary
+      // (a partial edit must still be captured). Best-effort + injectable: a git
+      // failure must never surface to the run.
+      if (this.cfg.autoCommitEnabled !== false) {
+        Promise.resolve()
+          .then(() => this.autoCommit(site, {
+            summary: promptSummary,
+            sessionId: summary.sessionId || s.sessionId || null,
+          }))
+          .catch(() => {})
+      }
+    }).catch(() => {
+      s.status = 'error'
+      s.active = null
+      s.lastActivity = this.now()
+    })
+
+    return handle
+  }
+
+  /** Abort the in-flight run for a site, if any. */
+  abort(site) {
+    const s = this.sessions.get(site)
+    if (s?.active) s.active.abort()
+  }
+
+  /**
+   * Mark a session as freshly active without sending a prompt. Called on the SSE
+   * keepalive ping so a session that is being actively read (but not prompted) is
+   * not reaped mid-read — the original idle-reaper bug (HAP-1110 item 4): the old
+   * code only updated activity on a new message, so the keepalive did not count.
+   */
+  touch(site) {
+    const s = this.sessions.get(site)
+    if (s) s.lastActivity = this.now()
+  }
+
+  /** Register an open SSE reader for a site; a session with readers is never reaped. */
+  addReader(site) {
+    const s = this._ensure(site)
+    s.readers += 1
+    s.lastActivity = this.now()
+  }
+
+  /** Release an SSE reader and record the disconnect time as activity. */
+  removeReader(site) {
+    const s = this.sessions.get(site)
+    if (!s) return
+    s.readers = Math.max(0, s.readers - 1)
+    s.lastActivity = this.now()
+  }
+
+  /**
+   * Reap idle sessions. A session is reaped only when it is NOT running, has NO
+   * open readers, and has been quiet longer than the idle TTL. Running sessions
+   * and actively-read sessions are always kept warm.
+   * @returns {string[]} the sites that were reaped
+   */
+  reap() {
+    const ttl = this.cfg.sessionIdleMs
+    if (!ttl || ttl <= 0) return []
+    const now = this.now()
+    const reaped = []
+    for (const [site, s] of this.sessions) {
+      if (s.status === 'running' || s.readers > 0) continue
+      if (now - s.lastActivity > ttl) {
+        this.sessions.delete(site)
+        reaped.push(site)
+      }
+    }
+    return reaped
+  }
+
+  /** Start the periodic idle reaper (no-op if already running). */
+  startReaper() {
+    if (this._reaper) return
+    this._reaper = setInterval(() => this.reap(), this.cfg.reaperIntervalMs)
+    if (this._reaper.unref) this._reaper.unref() // never keep the process alive
+  }
+
+  /** Stop the idle reaper. */
+  stopReaper() {
+    if (this._reaper) { clearInterval(this._reaper); this._reaper = null }
+  }
+}
+
+export { SessionManager }