mstro-app 0.4.20 → 0.4.22

package/server/services/websocket/handlers/deploy-handlers.ts

@@ -0,0 +1,230 @@
+// Copyright (c) 2025-present Mstro, Inc. All rights reserved.
+// Licensed under the MIT License. See LICENSE file for details.
+
+/**
+ * Deploy HTTP Handler
+ *
+ * Handles deployHttpRequest messages from the platform server relay.
+ * Proxies HTTP requests to the developer's local server and returns
+ * the response back through the WebSocket relay.
+ */
+
+import type { HandlerContext } from '../handler-context.js';
+import type { DeployHttpRequestData, DeployHttpResponseChunkData, DeployHttpResponseData, WebSocketMessage, WSContext } from '../types.js';
+
+/** Hop-by-hop headers that must not be forwarded through a proxy (RFC 2616 §13.5.1) */
+const HOP_BY_HOP_HEADERS = new Set([
+  'connection',
+  'keep-alive',
+  'transfer-encoding',
+  'te',
+  'trailers',
+  'upgrade',
+]);
+
+/** Request timeout in milliseconds (30 seconds) */
+const REQUEST_TIMEOUT_MS = 30_000;
+
+/** Maximum total header size in bytes (16 KB) */
+const MAX_HEADER_SIZE_BYTES = 16_384;
+
+/** Chunking threshold: responses larger than 1 MB are streamed in chunks */
+const CHUNK_THRESHOLD_BYTES = 1_048_576;
+
+/** Size of each chunk (~256 KB of raw data → ~341 KB base64) */
+const CHUNK_SIZE_BYTES = 262_144;
+
+function isHopByHopHeader(name: string): boolean {
+  const lower = name.toLowerCase();
+  return HOP_BY_HOP_HEADERS.has(lower) || lower.startsWith('proxy-');
+}
+
+function stripHopByHopHeaders(headers: Record<string, string>): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (!isHopByHopHeader(key)) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+/** Check headers for null bytes or CRLF injection attempts */
+function containsHeaderInjection(headers: Record<string, string>): boolean {
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.includes('\0') || value.includes('\0')) return true;
+    if (/\r|\n/.test(key) || /\r|\n/.test(value)) return true;
+  }
+  return false;
+}
+
+/** Calculate total size of request headers in bytes */
+function calculateHeaderSize(headers: Record<string, string>): number {
+  let size = 0;
+  for (const [key, value] of Object.entries(headers)) {
+    // key: value\r\n
+    size += key.length + 2 + value.length + 2;
+  }
+  return size;
+}
+
+function sendDeployHttpResponse(
+  ctx: HandlerContext,
+  ws: WSContext,
+  data: DeployHttpResponseData,
+): void {
+  ctx.send(ws, { type: 'deployHttpResponse', data });
+}
+
+/** Send a large response body in chunks via deployHttpResponseChunk messages */
+function sendChunkedResponse(
+  ctx: HandlerContext,
+  ws: WSContext,
+  requestId: string,
+  status: number,
+  headers: Record<string, string>,
+  bodyBuffer: Buffer,
+): void {
+  const totalChunks = Math.ceil(bodyBuffer.length / CHUNK_SIZE_BYTES);
+
+  for (let i = 0; i < totalChunks; i++) {
+    const start = i * CHUNK_SIZE_BYTES;
+    const end = Math.min(start + CHUNK_SIZE_BYTES, bodyBuffer.length);
+    const chunk = bodyBuffer.subarray(start, end);
+    const isLast = i === totalChunks - 1;
+
+    const chunkData: DeployHttpResponseChunkData = {
+      requestId,
+      chunkIndex: i,
+      totalChunks,
+      data: chunk.toString('base64'),
+      isLast,
+    };
+
+    // Include status and headers only in the first chunk
+    if (i === 0) {
+      chunkData.status = status;
+      chunkData.headers = headers;
+    }
+
+    ctx.send(ws, { type: 'deployHttpResponseChunk', data: chunkData });
+  }
+}
+
+export async function handleDeployHttpRequest(
+  ctx: HandlerContext,
+  ws: WSContext,
+  msg: WebSocketMessage,
+): Promise<void> {
+  const data = msg.data as DeployHttpRequestData;
+
+  if (!data?.requestId || !data?.method || !data?.url || !data?.port) {
+    sendDeployHttpResponse(ctx, ws, {
+      requestId: data?.requestId || 'unknown',
+      status: 400,
+      headers: {},
+      body: 'Bad Request: missing required fields (requestId, method, url, port)',
+    });
+    return;
+  }
+
+  // Reject headers with null bytes or CRLF injection
+  if (data.headers && containsHeaderInjection(data.headers)) {
+    sendDeployHttpResponse(ctx, ws, {
+      requestId: data.requestId,
+      status: 400,
+      headers: {},
+      body: 'Bad Request: headers contain null bytes or CRLF injection',
+    });
+    return;
+  }
+
+  // Enforce header size limit
+  if (data.headers && calculateHeaderSize(data.headers) > MAX_HEADER_SIZE_BYTES) {
+    sendDeployHttpResponse(ctx, ws, {
+      requestId: data.requestId,
+      status: 431,
+      headers: {},
+      body: 'Request Header Fields Too Large: total headers exceed 16KB',
+    });
+    return;
+  }
+
+  // Build local URL: localhost:{port}{path with query string}
+  const localUrl = `http://localhost:${data.port}${data.url}`;
+
+  try {
+    const requestHeaders = stripHopByHopHeaders(data.headers);
+
+    // Only include body for methods that support it
+    const hasBody = data.body !== undefined && data.method !== 'GET' && data.method !== 'HEAD';
+
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+
+    let response: Response;
+    try {
+      response = await fetch(localUrl, {
+        method: data.method,
+        headers: requestHeaders,
+        body: hasBody ? data.body : undefined,
+        signal: controller.signal,
+        redirect: 'manual',
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+
+    // Serialize response headers, stripping hop-by-hop
+    const responseHeaders: Record<string, string> = {};
+    response.headers.forEach((value, key) => {
+      if (!isHopByHopHeader(key)) {
+        responseHeaders[key] = value;
+      }
+    });
+
+    // Read response as binary to handle both text and binary payloads
+    const bodyBuffer = Buffer.from(await response.arrayBuffer());
+
+    // Stream large responses in chunks
+    if (bodyBuffer.length > CHUNK_THRESHOLD_BYTES) {
+      sendChunkedResponse(ctx, ws, data.requestId, response.status, responseHeaders, bodyBuffer);
+      return;
+    }
+
+    // Small response — send as a single message
+    sendDeployHttpResponse(ctx, ws, {
+      requestId: data.requestId,
+      status: response.status,
+      headers: responseHeaders,
+      body: bodyBuffer.toString('utf-8'),
+    });
+  } catch (error: unknown) {
+    let status = 502;
+    let body = 'Bad Gateway';
+
+    if (error instanceof Error) {
+      if (error.name === 'AbortError') {
+        status = 504;
+        body = 'Gateway Timeout';
+      } else if (isConnectionRefused(error)) {
+        status = 502;
+        body = 'Bad Gateway: target server is not running';
+      }
+    }
+
+    sendDeployHttpResponse(ctx, ws, {
+      requestId: data.requestId,
+      status,
+      headers: {},
+      body,
+    });
+  }
+}
+
+/** Detect ECONNREFUSED across Node.js error shapes */
+function isConnectionRefused(error: Error): boolean {
+  if (error.message.includes('ECONNREFUSED')) return true;
+  const cause = (error as Error & { cause?: { code?: string } }).cause;
+  return cause?.code === 'ECONNREFUSED';
+}

package/server/services/websocket/plan-board-handlers.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2025-present Mstro, Inc. All rights reserved.
 // Licensed under the MIT License. See LICENSE file for details.
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { replaceFrontMatterField } from '../plan/front-matter.js';
 import { getNextBoardId, getNextBoardNumber, parseBoardArtifacts, parseBoardDirectory, parsePlanDirectory, resolvePmDir } from '../plan/parser.js';
@@ -125,6 +125,24 @@ export function handleUpdateBoard(
   }
   writeFileSync(boardMdPath, content, 'utf-8');
 
+  // When review criteria are set, also write a board-level review agent file
+  // so users can discover and edit the full prompt as markdown.
+  const typedFields = fields as Record<string, unknown>;
+  if ('reviewCriteria' in typedFields) {
+    const boardDir = join(pmDir, 'boards', boardId);
+    const agentsDir = join(boardDir, 'agents');
+    const agentPath = join(agentsDir, 'review-custom.md');
+    const criteriaValue = String(typedFields.reviewCriteria ?? '').trim();
+
+    if (criteriaValue) {
+      if (!existsSync(agentsDir)) mkdirSync(agentsDir, { recursive: true });
+      writeFileSync(agentPath, buildBoardReviewAgent(criteriaValue), 'utf-8');
+    } else if (existsSync(agentPath)) {
+      // Clear the agent file when criteria are removed
+      try { unlinkSync(agentPath); } catch { /* non-fatal */ }
+    }
+  }
+
   const boardState = parseBoardDirectory(pmDir, boardId);
   if (boardState) {
     ctx.broadcastToAll({ type: 'planBoardUpdated', data: boardState.board });
@@ -275,3 +293,37 @@ export function handleGetBoardArtifacts(
 
   ctx.send(ws, { type: 'planBoardArtifacts', data: artifacts });
 }
+
+// ── Private helpers ──────────────────────────────────────────────────
+
+/** Build a board-level review-custom agent file from user-provided criteria. */
+function buildBoardReviewAgent(criteria: string): string {
+  return `---
+name: review-custom
+description: Board-specific review agent with custom criteria
+type: review
+variables: [issue_id, issue_title, context_section, acceptance_criteria, review_criteria, read_instruction]
+checks: [criteria_met, review_criteria]
+---
+
+You are a reviewer. Review the work done for issue {{issue_id}}: {{issue_title}}.
+{{context_section}}
+
+## Acceptance Criteria
+{{acceptance_criteria}}
+
+## Review Criteria
+${criteria}
+
+## Instructions
+1. {{read_instruction}}
+2. Check if all acceptance criteria are met — evaluate each criterion individually
+3. Evaluate thoroughly against the review criteria above
+4. Consider the overall quality of the work: does it fully address the issue's intent, is it well-structured, and is it ready to ship?
+
+Output EXACTLY one JSON object on its own line (no markdown fencing):
+{"passed": true, "checks": [{"name": "criteria_met", "passed": true, "details": "..."}]}
+
+Include checks for: criteria_met, review_criteria.
+`;
+}

package/server/services/websocket/plan-helpers.ts

@@ -13,7 +13,7 @@ import type { WSContext } from './types.js';
 export const watcherCache = new Map<string, PlanWatcher>();
 export const executorCache = new Map<string, PlanExecutor>();
 
-/** Validate that a user-supplied path resolves within the .pm/ (or legacy .plan/) directory. */
+/** Validate that a user-supplied path resolves within the .mstro/pm/ directory. */
 export function resolvePlanPath(workingDir: string, relativePath: string): string | null {
   const pmDir = resolvePmDir(workingDir);
   if (!pmDir) return null;
@@ -52,7 +52,7 @@ export function buildIssueMarkdown(
 id: ${id}
 title: "${title.replace(/"/g, '\\"')}"
 type: ${type}
-status: backlog
+status: todo
 priority: ${priority}
 estimate: null
 labels: ${labelsYaml}
@@ -109,8 +109,7 @@ labels: []
 ## Workflows
 | Status | Category | Description |
 |---|---|---|
-| backlog | unstarted | Accepted, not yet scheduled |
-| todo | unstarted | Scheduled for current sprint |
+| todo | ready | Refined and ready for agent execution |
 | in_progress | started | Actively being worked on |
 | in_review | started | PR open, awaiting review |
 | done | completed | Merged and verified |

package/server/services/websocket/plan-issue-handlers.ts

@@ -3,7 +3,7 @@
 
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
-import { replaceFrontMatterField } from '../plan/front-matter.js';
+import { checkAllAcceptanceCriteria, replaceFrontMatterField } from '../plan/front-matter.js';
 import { defaultPmDir, getNextId, parseBoardDirectory, parsePlanDirectory, parseSingleIssue, parseSingleMilestone, parseSingleSprint, planDirExists, resolvePmDir } from '../plan/parser.js';
 import { tryCompleteParentEpic } from '../plan/state-reconciler.js';
 import type { HandlerContext } from './handler-context.js';
@@ -163,6 +163,11 @@ export function handleUpdateIssue(
     content = replaceFrontMatterField(content, yamlKey, formatYamlValue(value));
   }
 
+  // Check off all acceptance criteria when status transitions to done
+  if ((fields as Record<string, unknown>).status === 'done') {
+    content = checkAllAcceptanceCriteria(content);
+  }
+
   writeFileSync(fullPath, content, 'utf-8');
 
   const issue = parseSingleIssue(workingDir, path);

package/server/services/websocket/plan-sprint-handlers.ts

@@ -97,15 +97,9 @@ export function handleCreateSprint(
   ctx.broadcastToAll({ type: 'planSprintCreated', data: sprint });
 }
 
-/** Promote sprint issues from 'backlog' to 'todo' status. */
-function promoteSprintIssues(pmDir: string, sprint: { issues: Array<{ id: string; path: string }> }, allIssues: Issue[]): void {
-  for (const issueSummary of sprint.issues) {
-    const issue = allIssues.find(i => i.id === issueSummary.id || i.path === issueSummary.path);
-    if (!issue || issue.status !== 'backlog') continue;
-    const issuePath = join(pmDir, issue.path);
-    if (!existsSync(issuePath)) continue;
-    writeFileSync(issuePath, replaceFrontMatterField(readFileSync(issuePath, 'utf-8'), 'status', 'todo'), 'utf-8');
-  }
+/** @deprecated Legacy sprint promotion — backlog status removed in v2 board-centric model. */
+function promoteSprintIssues(_pmDir: string, _sprint: { issues: Array<{ id: string; path: string }> }, _allIssues: Issue[]): void {
+  // No-op: all issues are created with status 'todo' in v2. Legacy sprint promotion is no longer needed.
 }
 
 /** Update a file's front matter field if the file exists. */

package/server/services/websocket/settings-handlers.ts

@@ -78,6 +78,17 @@ Respond with ONLY the summary text, nothing else.`;
 
     let stdout = '';
     let stderr = '';
+    let responseSent = false;
+
+    const sendSummaryOnce = (summary: string) => {
+      if (responseSent) return;
+      responseSent = true;
+      ctx.send(ws, {
+        type: 'notificationSummary',
+        tabId,
+        data: { summary }
+      });
+    };
 
     claude.stdout?.on('data', (data: Buffer) => {
       stdout += data.toString();
@@ -94,42 +105,27 @@ Respond with ONLY the summary text, nothing else.`;
         // Ignore cleanup errors
       }
 
-      let summary: string;
       if (code === 0 && stdout.trim()) {
-        summary = stdout.trim().slice(0, 150);
+        sendSummaryOnce(stdout.trim().slice(0, 150));
       } else {
         console.error('[WebSocketImproviseHandler] Claude error:', stderr || 'Unknown error');
-        summary = createFallbackSummary(userPrompt);
+        sendSummaryOnce(createFallbackSummary(userPrompt));
       }
-
-      ctx.send(ws, {
-        type: 'notificationSummary',
-        tabId,
-        data: { summary }
-      });
     });
 
     claude.on('error', (err: Error) => {
       console.error('[WebSocketImproviseHandler] Failed to spawn Claude:', err);
-      const summary = createFallbackSummary(userPrompt);
-      ctx.send(ws, {
-        type: 'notificationSummary',
-        tabId,
-        data: { summary }
-      });
+      sendSummaryOnce(createFallbackSummary(userPrompt));
     });
 
     // Timeout after 10 seconds
-    setTimeout(() => {
+    const timeout = setTimeout(() => {
       claude.kill();
-      const summary = createFallbackSummary(userPrompt);
-      ctx.send(ws, {
-        type: 'notificationSummary',
-        tabId,
-        data: { summary }
-      });
+      sendSummaryOnce(createFallbackSummary(userPrompt));
     }, 10000);
 
+    claude.on('close', () => { clearTimeout(timeout); });
+
   } catch (error) {
     console.error('[WebSocketImproviseHandler] Error generating summary:', error);
     const summary = createFallbackSummary(userPrompt);