ninja-terminals 2.3.0 → 2.3.2

package/server.js

@@ -3,10 +3,13 @@ const http = require('http');
 const { WebSocketServer } = require('ws');
 const pty = require('node-pty');
 const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const multer = require('multer');
 
 // ── Lib imports ─────────────────────────────────────────────
 const { LineBuffer, RawBuffer } = require('./lib/ring-buffer');
-const { stripAnsi, detectStatus, extractContextPct, extractStructuredEvents } = require('./lib/status-detect');
+const { stripAnsi, detectStatus, extractContextPct, extractStructuredEvents, parseTaskStatus, VALID_TASK_STATES } = require('./lib/status-detect');
 const { SSEManager } = require('./lib/sse');
 const { evaluatePermission, getDefaultRules, createEvaluateMiddleware } = require('./lib/permissions');
 const { TaskDAG } = require('./lib/task-dag');
@@ -20,9 +23,20 @@ const { isImmutable, safeWrite, safeAppend } = require('./lib/safe-file-writer')
 const { logEvolution } = require('./lib/evolution-writer');
 const { getPreDispatchContext, formatContextForInjection } = require('./lib/pre-dispatch');
 const { runPostSession } = require('./lib/post-session');
+const {
+  SESSION_FILE,
+  findAvailablePort,
+  writeRuntimeSession,
+  updateRuntimeSession,
+  clearRuntimeSession,
+  openBrowserTab,
+  writeAuthToken,
+  readAuthToken,
+} = require('./lib/runtime-session');
 
 // ── Config ──────────────────────────────────────────────────
-const PORT = process.env.PORT || 3300;
+const PREFERRED_PORT = parseInt(process.env.PORT || '3300', 10);
+const BIND_HOST = process.env.NINJA_BIND_HOST || '127.0.0.1';
 const DEFAULT_TERMINALS = parseInt(process.env.DEFAULT_TERMINALS || '4', 10);
 const CLAUDE_CMD = process.env.CLAUDE_CMD || 'claude --dangerously-skip-permissions';
 const SHELL = process.env.SHELL || '/bin/zsh';
@@ -30,8 +44,34 @@ const PROJECT_DIR = __dirname;
 const DEFAULT_CWD = process.env.DEFAULT_CWD || null;  // Set to target project path to avoid cross-project prompts
 const INJECT_GUIDANCE = process.env.INJECT_GUIDANCE !== 'false';  // Default true, set INJECT_GUIDANCE=false to disable
 
+// Fleet modes — preset terminal configurations
+const FLEET_MODES = {
+  claude: ['claude', 'claude', 'claude', 'claude'],
+  teams: ['claude', 'opencode', 'codex', 'shell'],
+  mixed: ['claude', 'claude', 'opencode', 'shell'],
+  shell: ['shell', 'shell', 'shell', 'shell'],
+  duo: ['claude', 'opencode'],
+};
+const FLEET_MODE = process.env.NINJA_MODE || 'claude';
+
 const sleep = ms => new Promise(r => setTimeout(r, ms));
 
+// Delay between text and Enter for Claude Code to recognize as submission (not paste buffer)
+const SUBMIT_DELAY_MS = 180;
+
+/**
+ * Submit text to a terminal with delayed Enter.
+ * Claude Code treats text+Enter in the same PTY write as pasted multiline input and buffers it.
+ * This helper writes text first, waits, then sends Enter separately.
+ */
+async function submitToTerminal(terminal, text) {
+  // Strip any trailing newlines — we'll add Enter ourselves after delay
+  const cleanText = text.replace(/[\r\n]+$/, '');
+  terminal.pty.write(cleanText);
+  await sleep(SUBMIT_DELAY_MS);
+  terminal.pty.write('\r');
+}
+
 // ── Express + WS ────────────────────────────────────────────
 const app = express();
 const server = http.createServer(app);
@@ -60,6 +100,19 @@ const requireAuth = (req, res, next) => {
   return authMiddleware(req, res, next);
 };
 
+// Loopback check for local-only endpoints (e.g., auth bootstrap)
+function isLoopbackRequest(req) {
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || '';
+  const loopbackAddrs = ['127.0.0.1', '::1', '::ffff:127.0.0.1'];
+  if (!loopbackAddrs.includes(remote)) return false;
+
+  // Also check Host header matches localhost
+  const host = req.get('host') || '';
+  const hostWithoutPort = host.split(':')[0];
+  const validHosts = ['localhost', '127.0.0.1', '[::1]', '::1'];
+  return validHosts.includes(hostWithoutPort);
+}
+
 const sse = new SSEManager();
 const taskDag = new TaskDAG();
 const retryBudget = new RetryBudget();
@@ -107,18 +160,32 @@ function getTerminalRules(terminalId) {
 
 // ── Terminal Spawning ───────────────────────────────────────
 
-function spawnTerminal(label, scope = [], cwd = null, tier = 'pro') {
+const AGENT_COMMANDS = {
+  claude: process.env.CLAUDE_CMD || 'claude --dangerously-skip-permissions',
+  opencode: 'opencode',
+  codex: 'codex',
+  shell: null, // No command — just shell
+};
+
+const VALID_AGENT_TYPES = Object.keys(AGENT_COMMANDS);
+
+function spawnTerminal(label, scope = [], cwd = null, tier = 'pro', agentType = 'claude') {
   const id = nextId++;
   const cols = 120;
   const rows = 30;
 
   // Resolve working directory — custom cwd or default to PROJECT_DIR
-  const workDir = cwd || PROJECT_DIR;
-  const settingsDir = cwd || PROJECT_DIR;
+  // Validate cwd to prevent broken paths like "\" from corrupting terminal startup
+  let workDir = cwd || PROJECT_DIR;
+  if (!workDir || workDir.length < 2 || !path.isAbsolute(workDir)) {
+    console.warn(`[spawn] Invalid cwd "${workDir}", falling back to PROJECT_DIR`);
+    workDir = PROJECT_DIR;
+  }
+  const settingsDir = workDir;
 
   // Write worker settings to the TARGET project (not ninja-terminal)
   try {
-    writeWorkerSettings(id, settingsDir, scope, { port: PORT, tier });
+    writeWorkerSettings(id, settingsDir, scope, { port: server.address()?.port || PREFERRED_PORT, tier });
   } catch (e) {
     console.error(`Failed to write worker settings for terminal ${id}:`, e.message);
   }
@@ -146,14 +213,20 @@ function spawnTerminal(label, scope = [], cwd = null, tier = 'pro') {
     },
   });
 
-  // After shell starts, cd to work dir and launch claude
+  // After shell starts, cd to work dir and launch agent (if not shell)
+  const agentCmd = AGENT_COMMANDS[agentType] || null;
   setTimeout(() => {
-    ptyProcess.write(`cd "${workDir}" && ${CLAUDE_CMD}\r`);
+    if (agentCmd) {
+      ptyProcess.write(`cd "${workDir}" && ${agentCmd}\r`);
+    } else {
+      ptyProcess.write(`cd "${workDir}"\r`);
+    }
   }, 500);
 
   const terminal = {
     id,
     label: label || `T${id}`,
+    agentType: agentType || 'claude',
     pty: ptyProcess,
     clients: new Set(),
     status: 'starting',
@@ -172,6 +245,14 @@ function spawnTerminal(label, scope = [], cwd = null, tier = 'pro') {
     previousFiles: [],
     lastTaskCompletedAt: null,
     circuitBreaker: new CircuitBreaker(id),
+    // Semantic task status (separate from process status)
+    taskStatus: {
+      state: 'pending',
+      marker: null,
+      message: null,
+      updatedAt: new Date().toISOString(),
+      source: 'init',
+    },
   };
 
   // ── PTY data handler ──────────────────────────────────────
@@ -194,6 +275,34 @@ function spawnTerminal(label, scope = [], cwd = null, tier = 'pro') {
       sse.broadcast(evt.type, evt);
     }
 
+    // Parse task status from recent buffered lines (not just current chunk)
+    // This handles STATUS markers split across PTY chunks
+    const recentLines = terminal.lineBuffer.last(20);
+    const taskStatusResult = parseTaskStatus(recentLines);
+    if (taskStatusResult) {
+      const prevState = terminal.taskStatus.state;
+      // Only update if state changed (avoid redundant updates from same marker)
+      if (prevState !== taskStatusResult.state) {
+        terminal.taskStatus = {
+          state: taskStatusResult.state,
+          marker: taskStatusResult.marker,
+          message: taskStatusResult.message,
+          updatedAt: new Date().toISOString(),
+          source: 'output-parser',
+        };
+
+        // Broadcast task status change
+        sse.broadcast('task_status_change', {
+          terminal: terminal.label,
+          id: terminal.id,
+          processStatus: terminal.status,
+          taskStatus: terminal.taskStatus,
+          ts: terminal.taskStatus.updatedAt,
+        });
+        console.log(`[task-status] T${terminal.id} (${terminal.label}): ${prevState} -> ${taskStatusResult.state}`);
+      }
+    }
+
     // Broadcast raw to WebSocket clients
     for (const ws of terminal.clients) {
       if (ws.readyState === 1) ws.send(data);
@@ -359,6 +468,31 @@ server.on('upgrade', async (req, socket, head) => {
 
 // ── API Routes ──────────────────────────────────────────────
 
+// ── File Upload ─────────────────────────────────────────────
+const UPLOAD_DIR = path.join(os.homedir(), '.ninja', 'uploads');
+fs.mkdirSync(UPLOAD_DIR, { recursive: true, mode: 0o700 });
+
+const upload = multer({
+  storage: multer.diskStorage({
+    destination: UPLOAD_DIR,
+    filename: (_req, file, cb) => {
+      const ext = path.extname(file.originalname) || '';
+      const base = path.basename(file.originalname, ext).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 50);
+      const name = `${base}-${Date.now()}${ext}`;
+      cb(null, name);
+    },
+  }),
+  limits: { fileSize: 50 * 1024 * 1024 }, // 50MB max
+});
+
+app.post('/api/upload', requireAuth, upload.single('file'), (req, res) => {
+  if (!req.file) {
+    return res.status(400).json({ error: 'No file uploaded' });
+  }
+  const filePath = req.file.path;
+  res.json({ path: filePath, filename: req.file.filename, size: req.file.size });
+});
+
 // Health
 app.get('/health', (_req, res) => {
   res.json({
@@ -387,6 +521,18 @@ app.post('/api/session', requireAuth, (req, res) => {
 
       console.log(`[session] Returning existing session: tier=${tier}, terminals=${existingTerminals.length}`);
 
+      // Repair session.json authToken if missing (e.g., after orphan recovery)
+      updateRuntimeSession({
+        authToken: token,
+        tier,
+        terminalsMax,
+        features,
+        activeSessionCreatedAt: activeSession.createdAt
+          ? new Date(activeSession.createdAt).toISOString()
+          : undefined,
+      });
+      writeAuthToken(token);
+
       return res.json({
         tier,
         terminalsMax,
@@ -417,6 +563,15 @@ app.post('/api/session', requireAuth, (req, res) => {
       createdAt: Date.now(),
     };
 
+    updateRuntimeSession({
+      authToken: token,
+      tier,
+      terminalsMax,
+      features,
+      activeSessionCreatedAt: new Date(activeSession.createdAt).toISOString(),
+    });
+    writeAuthToken(token);
+
     console.log(`[session] Created new session: tier=${tier}, terminalsMax=${terminalsMax}`);
 
     // Return empty terminals - user can add via + button
@@ -563,7 +718,10 @@ app.get('/api/terminals', requireAuth, (req, res) => {
     const entry = {
       id: t.id,
       label: t.label,
+      agentType: t.agentType || 'claude',
       status: t.status,
+      taskStatus: t.taskStatus.state,
+      taskStatusMessage: t.taskStatus.message,
       elapsed: getElapsed(t),
       contextPct: extractContextPct(recentLines),
       cols: t.cols,
@@ -588,14 +746,15 @@ app.post('/api/terminals', requireAuth, (req, res) => {
     const label = req.body?.label;
     const scope = req.body?.scope || [];
     const cwd = req.body?.cwd || null;
-    const terminal = spawnTerminal(label, scope, cwd, tier);
+    const agentType = VALID_AGENT_TYPES.includes(req.body?.agentType) ? req.body.agentType : 'claude';
+    const terminal = spawnTerminal(label, scope, cwd, tier, agentType);
 
     // Track in session
     if (activeSession) {
       activeSession.terminalIds.push(terminal.id);
     }
 
-    res.json({ id: terminal.id, label: terminal.label, status: terminal.status, scope: terminal.scope, cwd: terminal.cwd });
+    res.json({ id: terminal.id, label: terminal.label, agentType: terminal.agentType, status: terminal.status, scope: terminal.scope, cwd: terminal.cwd });
   } catch (err) {
     res.status(500).json({ error: 'Failed to spawn terminal', detail: err.message });
   }
@@ -634,11 +793,13 @@ app.post('/api/terminals/:id/restart', requireAuth, (req, res) => {
   const label = terminal.label;
   const scope = terminal.scope;
   const termCwd = terminal.cwd;
+  // Allow changing agentType on restart, default to current
+  const agentType = VALID_AGENT_TYPES.includes(req.body?.agentType) ? req.body.agentType : (terminal.agentType || 'claude');
   terminal.pty.kill();
   for (const ws of terminal.clients) ws.close();
   terminals.delete(id);
 
-  const newTerminal = spawnTerminal(label, scope, termCwd, tier);
+  const newTerminal = spawnTerminal(label, scope, termCwd, tier, agentType);
 
   // Update session tracking
   if (activeSession) {
@@ -646,7 +807,7 @@ app.post('/api/terminals/:id/restart', requireAuth, (req, res) => {
     activeSession.terminalIds.push(newTerminal.id);
   }
 
-  res.json({ id: newTerminal.id, label: newTerminal.label, status: newTerminal.status });
+  res.json({ id: newTerminal.id, label: newTerminal.label, agentType: newTerminal.agentType, status: newTerminal.status });
 });
 
 // Send input
@@ -658,11 +819,33 @@ app.post('/api/terminals/:id/input', requireAuth, async (req, res) => {
   const text = req.body?.text;
   if (!text) return res.status(400).json({ error: 'text required' });
 
+  // Reset task status on new dispatch (clear previous done/error state)
+  const prevTaskState = terminal.taskStatus.state;
+  terminal.taskStatus = {
+    state: 'running',
+    marker: null,
+    message: `Dispatched: ${text.slice(0, 80)}${text.length > 80 ? '...' : ''}`,
+    updatedAt: new Date().toISOString(),
+    source: 'dispatch',
+  };
+
+  // Broadcast task status reset
+  sse.broadcast('task_status_change', {
+    terminal: terminal.label,
+    id: terminal.id,
+    processStatus: terminal.status,
+    taskStatus: terminal.taskStatus,
+    ts: terminal.taskStatus.updatedAt,
+  });
+  console.log(`[task-status] T${terminal.id} (${terminal.label}): ${prevTaskState} -> running (dispatch)`);
+
   let finalText = text;
   let guidanceInjected = false;
 
-  // Inject guidance from prior sessions if enabled
-  if (INJECT_GUIDANCE) {
+  // Inject guidance only for Claude Code terminals (not opencode, codex, shell)
+  const shouldInjectGuidance = INJECT_GUIDANCE && terminal.agentType === 'claude';
+
+  if (shouldInjectGuidance) {
     try {
       const ctx = await getPreDispatchContext();
       const hasGuidance = ctx.toolGuidance.length > 0 || ctx.playbookInsights.length > 0;
@@ -679,7 +862,8 @@ app.post('/api/terminals/:id/input', requireAuth, async (req, res) => {
     }
   }
 
-  terminal.pty.write(finalText);
+  // Use delayed Enter for proper Claude Code submission
+  await submitToTerminal(terminal, finalText);
   res.json({ ok: true, guidanceInjected });
 });
 
@@ -704,6 +888,9 @@ app.get('/api/terminals/:id/status', requireAuth, (req, res) => {
     id: terminal.id,
     label: terminal.label,
     status: terminal.status,
+    taskStatus: terminal.taskStatus.state,
+    taskStatusMessage: terminal.taskStatus.message,
+    taskStatusUpdatedAt: terminal.taskStatus.updatedAt,
     elapsed: getElapsed(terminal),
     contextPct: extractContextPct(recentLines),
     taskName: terminal.taskName,
@@ -712,6 +899,41 @@ app.get('/api/terminals/:id/status', requireAuth, (req, res) => {
   });
 });
 
+// Get task status (semantic status separate from process status)
+app.get('/api/terminals/:id/task-status', requireAuth, (req, res) => {
+  const id = parseInt(req.params.id, 10);
+  const terminal = terminals.get(id);
+  if (!terminal) return res.status(404).json({ error: 'Not found' });
+
+  res.json({
+    id: terminal.id,
+    label: terminal.label,
+    processStatus: terminal.status,
+    taskStatus: terminal.taskStatus.state,
+    marker: terminal.taskStatus.marker,
+    message: terminal.taskStatus.message,
+    updatedAt: terminal.taskStatus.updatedAt,
+    source: terminal.taskStatus.source,
+  });
+});
+
+// Get all terminals task status
+app.get('/api/terminals/task-status', requireAuth, (_req, res) => {
+  const list = [];
+  for (const [, t] of terminals) {
+    list.push({
+      id: t.id,
+      label: t.label,
+      processStatus: t.status,
+      taskStatus: t.taskStatus.state,
+      marker: t.taskStatus.marker,
+      message: t.taskStatus.message,
+      updatedAt: t.taskStatus.updatedAt,
+    });
+  }
+  res.json(list);
+});
+
 // Paginated output
 app.get('/api/terminals/:id/output', requireAuth, (req, res) => {
   const id = parseInt(req.params.id, 10);
@@ -792,7 +1014,7 @@ app.post('/api/terminals/:id/compacted', (req, res) => {
 });
 
 // Assign task to terminal
-app.post('/api/terminals/:id/task', requireAuth, (req, res) => {
+app.post('/api/terminals/:id/task', requireAuth, async (req, res) => {
   const id = parseInt(req.params.id, 10);
   const terminal = terminals.get(id);
   if (!terminal) return res.status(404).json({ error: 'Not found' });
@@ -804,6 +1026,26 @@ app.post('/api/terminals/:id/task', requireAuth, (req, res) => {
   terminal.progress = null;
   terminal.taskStartedAt = Date.now();
 
+  // Reset task status on new task assignment (clear previous DONE/BLOCKED/ERROR)
+  const prevTaskState = terminal.taskStatus.state;
+  terminal.taskStatus = {
+    state: 'running',
+    marker: null,
+    message: `Task: ${name}${description ? ` — ${description.slice(0, 60)}` : ''}`,
+    updatedAt: new Date().toISOString(),
+    source: 'task-assign',
+  };
+
+  // Broadcast task status reset
+  sse.broadcast('task_status_change', {
+    terminal: terminal.label,
+    id: terminal.id,
+    processStatus: terminal.status,
+    taskStatus: terminal.taskStatus,
+    ts: terminal.taskStatus.updatedAt,
+  });
+  console.log(`[task-status] T${terminal.id} (${terminal.label}): ${prevTaskState} -> running (task-assign)`);
+
   if (scope) {
     terminal.scope = Array.isArray(scope) ? scope : [scope];
   }
@@ -817,9 +1059,9 @@ app.post('/api/terminals/:id/task', requireAuth, (req, res) => {
     ts: new Date().toISOString(),
   });
 
-  // Send the task as input to the terminal
+  // Send the task as input to the terminal with delayed Enter
   if (description) {
-    terminal.pty.write(`${description}\r`);
+    await submitToTerminal(terminal, description);
   }
 
   res.json({ ok: true, taskName: name, scope: terminal.scope });
@@ -1002,6 +1244,29 @@ function handleSessionInvalidation(token) {
 
 const BACKEND_URL = process.env.NINJA_BACKEND_URL || 'https://emtchat-backend.onrender.com';
 
+// Bootstrap: return saved token for local auto-login
+// SECURITY: This endpoint is local-only. Server must bind to loopback (127.0.0.1).
+// If NINJA_BIND_HOST is changed to expose the server, this endpoint refuses to serve tokens.
+app.get('/api/auth/bootstrap', (req, res) => {
+  // Strict loopback check — refuse if request is not from localhost
+  if (!isLoopbackRequest(req)) {
+    return res.status(403).json({ error: 'Bootstrap only available from localhost' });
+  }
+
+  // Refuse if server is bound to non-loopback (exposed to network)
+  if (BIND_HOST !== '127.0.0.1' && BIND_HOST !== 'localhost' && BIND_HOST !== '::1') {
+    return res.status(403).json({ error: 'Bootstrap disabled when server is network-exposed' });
+  }
+
+  const token = readAuthToken();
+  if (token) {
+    res.set('Cache-Control', 'no-store');
+    res.json({ token });
+  } else {
+    res.status(404).json({ error: 'No saved token' });
+  }
+});
+
 app.post('/api/auth/login', async (req, res) => {
   try {
     const fetch = require('node-fetch');
@@ -1034,23 +1299,61 @@ app.post('/api/auth/register', async (req, res) => {
 
 // ── Start ───────────────────────────────────────────────────
 
-server.listen(PORT, () => {
-  console.log(`Ninja Terminals v2 running on http://localhost:${PORT}`);
+async function startServer() {
+  const selectedPort = await findAvailablePort(PREFERRED_PORT);
+  if (selectedPort !== PREFERRED_PORT) {
+    console.log(`[port] ${PREFERRED_PORT} is unavailable; using ${selectedPort}`);
+  }
+
+  server.listen(selectedPort, BIND_HOST, () => {
+    const url = `http://localhost:${selectedPort}`;
+    console.log(`[bind] Listening on ${BIND_HOST}:${selectedPort}`);
+    const session = writeRuntimeSession({
+      port: selectedPort,
+      host: BIND_HOST,
+      url,
+      cwd: DEFAULT_CWD || process.cwd(),
+      terminals: DEFAULT_TERMINALS,
+      command: 'ninja-terminals',
+    });
+
+    console.log(`Ninja Terminals v2 running on ${url}`);
+    console.log(`[session] wrote ${SESSION_FILE}`);
 
-  // Start SSE heartbeat
-  sse.startHeartbeat(15000);
+    // Open a fresh browser tab unless disabled.
+    openBrowserTab(session.url);
 
-  // Start session heartbeat — re-validates tokens every 5 minutes
-  startSessionHeartbeat(sessionCache, handleSessionInvalidation, 5 * 60 * 1000);
+    // Start SSE heartbeat
+    sse.startHeartbeat(15000);
 
-  // Auto-spawn terminals based on DEFAULT_TERMINALS env var
-  const terminalCount = DEFAULT_TERMINALS;
-  const labels = ['T1', 'T2', 'T3', 'T4', 'T5', 'T6', 'T7', 'T8'];
+    // Start session heartbeat — re-validates tokens every 5 minutes
+    startSessionHeartbeat(sessionCache, handleSessionInvalidation, 5 * 60 * 1000);
 
-  console.log(`Auto-spawning ${terminalCount} terminals...`);
-  for (let i = 0; i < terminalCount; i++) {
-    const label = labels[i] || `T${i + 1}`;
-    spawnTerminal(label, [], DEFAULT_CWD || process.cwd(), 'pro');
+    // Auto-spawn terminals based on fleet mode
+    const fleetConfig = FLEET_MODES[FLEET_MODE] || FLEET_MODES.claude;
+    const terminalCount = DEFAULT_TERMINALS > 0 ? Math.min(DEFAULT_TERMINALS, fleetConfig.length) : fleetConfig.length;
+    const agentLabels = { claude: 'Claude', opencode: 'OpenCode', codex: 'Codex', shell: 'Shell' };
+
+    console.log(`Auto-spawning ${terminalCount} terminals (mode: ${FLEET_MODE})...`);
+    for (let i = 0; i < terminalCount; i++) {
+      const agentType = fleetConfig[i] || 'claude';
+      const label = `T${i + 1}-${agentLabels[agentType] || agentType}`;
+      spawnTerminal(label, [], DEFAULT_CWD || process.cwd(), 'pro', agentType);
+    }
+    console.log(`All ${terminalCount} terminals ready`);
+  });
+}
+
+process.on('exit', () => {
+  try {
+    const addr = server.address();
+    if (addr && addr.port) clearRuntimeSession();
+  } catch {
+    // ignore shutdown cleanup failures
   }
-  console.log(`All ${terminalCount} terminals ready`);
+});
+
+startServer().catch((err) => {
+  console.error(`Failed to start Ninja Terminals: ${err.message}`);
+  process.exit(1);
 });