patchwarden 1.1.0 → 1.5.1

package/dist/control/routes/process.js

@@ -0,0 +1,200 @@
+/**
+ * Control Center routes — process lifecycle proxy (/api/start-all,
+ * /api/stop-all, /api/restart-all, /api/core/*, /api/direct/*).
+ *
+ * Proxies start/stop/restart actions to scripts/control/manage-patchwarden.ps1
+ * and exposes open-logs-folder. Start/restart actions run a preflight that
+ * verifies the tunnel-client executable and launcher files exist before
+ * launching, so the non-interactive web UI never deadlocks on a missing
+ * dependency. All endpoints are POST routes gated by the control token.
+ */
+import { existsSync } from "node:fs";
+import { delimiter, extname, join } from "node:path";
+import { homedir } from "node:os";
+import { spawn } from "node:child_process";
+import { recordEvent } from "../runtime.js";
+import { DEFAULT_TUNNEL_CLIENT_EXE, errorMessage, getRuntimeRoot, manageScriptPath, projectRoot, sendJson } from "../shared.js";
+function runManageAction(action, mode) {
+    return new Promise((resolveP, rejectP) => {
+        let child;
+        try {
+            child = spawn("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", manageScriptPath, action, mode, "-Background"], { cwd: projectRoot, windowsHide: true });
+        }
+        catch (err) {
+            rejectP(err);
+            return;
+        }
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                child.kill();
+            }
+            catch { /* ignore */ }
+            rejectP(new Error(`manage-patchwarden.ps1 timed out after 60s (action=${action}, mode=${mode})`));
+        }, 60_000);
+        child.stdout.on("data", (d) => {
+            stdout += d.toString("utf-8");
+        });
+        child.stderr.on("data", (d) => {
+            stderr += d.toString("utf-8");
+        });
+        child.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            rejectP(err);
+        });
+        child.on("close", (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolveP({ exitCode: code ?? -1, stdout, stderr });
+        });
+    });
+}
+function selectedControlModes(mode) {
+    if (mode === "core" || mode === "direct")
+        return [mode];
+    return ["core", "direct"];
+}
+function launcherPathForMode(mode) {
+    const launcherName = mode === "direct" ? "Start-PatchWarden-Direct-Tunnel.cmd" : "Start-PatchWarden-Tunnel.cmd";
+    return join(projectRoot, "scripts", "launchers", launcherName);
+}
+function findExecutableOnPath(fileName) {
+    const pathValue = process.env.PATH || "";
+    const extensions = process.platform === "win32"
+        ? (process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean)
+        : [""];
+    for (const entry of pathValue.split(delimiter)) {
+        if (!entry)
+            continue;
+        const direct = join(entry, fileName);
+        if (existsSync(direct))
+            return direct;
+        if (process.platform === "win32" && !extname(fileName)) {
+            for (const ext of extensions) {
+                const candidate = join(entry, fileName + ext.toLowerCase());
+                if (existsSync(candidate))
+                    return candidate;
+            }
+        }
+    }
+    return null;
+}
+function findTunnelClientExecutable() {
+    if (process.env.PATCHWARDEN_CONTROL_FORCE_MISSING_TUNNEL_CLIENT === "1")
+        return null;
+    const explicit = process.env.TUNNEL_CLIENT_EXE || process.env.PATCHWARDEN_TUNNEL_CLIENT_EXE;
+    if (explicit && existsSync(explicit))
+        return explicit;
+    const fromPath = findExecutableOnPath("tunnel-client.exe") ?? findExecutableOnPath("tunnel-client");
+    if (fromPath)
+        return fromPath;
+    const candidates = [
+        DEFAULT_TUNNEL_CLIENT_EXE,
+        process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, "patchwarden", "tunnel-client.exe") : null,
+        process.env.APPDATA ? join(process.env.APPDATA, "tunnel-client", "tunnel-client.exe") : null,
+        join(homedir(), "tunnel-client", "tunnel-client.exe"),
+    ].filter((v) => typeof v === "string" && v.length > 0);
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+// Re-exported so the status route can surface tunnel-client availability in
+// /api/status without duplicating the discovery logic.
+export { findTunnelClientExecutable };
+function preflightManageAction(action, mode) {
+    if (action !== "start" && action !== "restart")
+        return null;
+    const missingLaunchers = selectedControlModes(mode)
+        .map((m) => ({ mode: m, path: launcherPathForMode(m) }))
+        .filter((entry) => !existsSync(entry.path));
+    const tunnelClient = findTunnelClientExecutable();
+    const missing = [];
+    if (!tunnelClient)
+        missing.push("tunnel-client.exe");
+    for (const entry of missingLaunchers)
+        missing.push(`${entry.mode} launcher`);
+    if (missing.length === 0)
+        return null;
+    return {
+        status: 409,
+        body: {
+            ok: false,
+            action,
+            mode,
+            error: "Control Center preflight failed. Start/restart from the Web UI is non-interactive, so required runtime dependencies must be available before launching.",
+            missing,
+            next_steps: [
+                "Install tunnel-client.exe or set TUNNEL_CLIENT_EXE / PATCHWARDEN_TUNNEL_CLIENT_EXE to its full path.",
+                `Default checked path: ${DEFAULT_TUNNEL_CLIENT_EXE}`,
+                "Verify the launcher files under scripts/launchers are present.",
+                "Then retry from PatchWarden Control Center or PatchWarden-Control-Tray.cmd.",
+            ],
+        },
+    };
+}
+export async function handleManageAction(res, action, mode) {
+    try {
+        const preflight = preflightManageAction(action, mode);
+        if (preflight) {
+            recordEvent("manage." + mode + "." + action + ".preflight_failed", {
+                missing: preflight.body.missing,
+            });
+            sendJson(res, preflight.status, preflight.body);
+            return;
+        }
+        const result = await runManageAction(action, mode);
+        recordEvent("manage." + mode + "." + action, {
+            exit_code: result.exitCode,
+            ok: result.exitCode === 0,
+        });
+        sendJson(res, 200, {
+            ok: result.exitCode === 0,
+            exitCode: result.exitCode,
+            stdout: result.stdout,
+            stderr: result.stderr,
+        });
+    }
+    catch (err) {
+        recordEvent("manage." + mode + "." + action + ".failed", { error: errorMessage(err) });
+        sendJson(res, 500, { error: errorMessage(err) });
+    }
+}
+export function handleOpenLogsFolder(res) {
+    try {
+        const target = getRuntimeRoot(false);
+        let cmd;
+        if (process.platform === "win32") {
+            cmd = "explorer.exe";
+        }
+        else if (process.platform === "darwin") {
+            cmd = "open";
+        }
+        else {
+            cmd = "xdg-open";
+        }
+        try {
+            const child = spawn(cmd, [target], { detached: true, stdio: "ignore" });
+            child.on("error", () => { });
+            child.unref();
+        }
+        catch {
+            /* ignore */
+        }
+        sendJson(res, 200, { ok: true, path: target });
+    }
+    catch (err) {
+        sendJson(res, 500, { error: errorMessage(err) });
+    }
+}

package/dist/control/routes/sessions.d.ts

@@ -0,0 +1,22 @@
+import { type ServerResponse } from "node:http";
+export declare function handleDirectSessions(res: ServerResponse): void;
+export declare function handleDirectSessionDetail(res: ServerResponse, sessionId: string): void;
+export declare function handleDirectSessionSafeSummary(res: ServerResponse, sessionId: string): void;
+/**
+ * Finalize a direct session via safeFinalizeDirectSession. Returns the safe
+ * summary on success, or { error } on failure with HTTP 200 (fault tolerance:
+ * the UI always gets a JSON body it can render).
+ */
+export declare function handleDirectSessionFinalize(res: ServerResponse, sessionId: string): Promise<void>;
+/**
+ * Audit a direct session via safeAuditDirectSession. Returns the safe audit
+ * result on success, or { error } on failure (HTTP 200 for fault tolerance).
+ */
+export declare function handleDirectSessionAudit(res: ServerResponse, sessionId: string): void;
+/**
+ * Hide a direct session from the dashboard list. The session itself is NOT
+ * deleted or modified — only the control-center's local
+ * hidden-direct-session-ids.json state file is updated. Requires control token
+ * (enforced by the POST router).
+ */
+export declare function handleDirectSessionHide(res: ServerResponse, sessionId: string): void;

package/dist/control/routes/sessions.js

@@ -0,0 +1,224 @@
+/**
+ * Control Center routes — Direct sessions (/api/direct-sessions/*).
+ *
+ * Lists, inspects, finalizes, audits, and hides Direct editing sessions. The
+ * list/detail endpoints are read-only and fault-tolerant (missing dir returns
+ * an empty list, never 500). The finalize/audit/hide endpoints are POST routes
+ * gated by the control token in the server router.
+ */
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { getDirectSessionsDir } from "../../config.js";
+import { safeAuditDirectSession, safeDirectSummary, safeFinalizeDirectSession } from "../../tools/safeViews.js";
+import { fileMtimeIso, isValidDirectSessionId, readHiddenDirectSessionIds, recordEvent, writeHiddenDirectSessionIds, } from "../runtime.js";
+import { config, errorMessage, readJsonFileSafe, readTextFileSafe, sendJson } from "../shared.js";
+function readDirectSessionSummary(sessionDir, sessionId) {
+    const sessionFile = join(sessionDir, "session.json");
+    if (!existsSync(sessionFile))
+        return null;
+    const data = readJsonFileSafe(sessionFile);
+    if (!data)
+        return null;
+    // summary.json holds the finalized change summary (changed_files_total, etc.)
+    const summaryFile = join(sessionDir, "summary.json");
+    const summary = readJsonFileSafe(summaryFile);
+    const changedFilesTotal = summary
+        ? typeof summary.changed_files_total === "number"
+            ? summary.changed_files_total
+            : null
+        : null;
+    // audit.json (written by audit_session) holds the audit decision
+    const auditFile = join(sessionDir, "audit.json");
+    const audit = readJsonFileSafe(auditFile);
+    const auditDecision = audit
+        ? typeof audit.decision === "string"
+            ? audit.decision
+            : typeof audit.verdict === "string"
+                ? audit.verdict
+                : null
+        : null;
+    const auditCheckedAt = audit
+        ? typeof audit.checked_at === "string"
+            ? audit.checked_at
+            : fileMtimeIso(auditFile)
+        : null;
+    // verification summary: read from session.json verification_runs (last run)
+    let verificationSummary = null;
+    if (Array.isArray(data.verification_runs) && data.verification_runs.length > 0) {
+        const runs = data.verification_runs;
+        verificationSummary = runs[runs.length - 1];
+    }
+    return {
+        session_id: sessionId,
+        repo_path: typeof data.repo_path === "string" ? data.repo_path : "",
+        resolved_repo_path: typeof data.resolved_repo_path === "string" ? data.resolved_repo_path : "",
+        created_at: typeof data.created_at === "string" ? data.created_at : "",
+        expires_at: typeof data.expires_at === "string" ? data.expires_at : "",
+        finalized: Boolean(data.finalized),
+        finalized_at: typeof data.finalized_at === "string" ? data.finalized_at : null,
+        audited: Boolean(data.audited),
+        changed_files_total: changedFilesTotal,
+        verification_summary: verificationSummary,
+        audit_decision: auditDecision,
+        audit_checked_at: auditCheckedAt,
+        title: typeof data.title === "string" ? data.title : "",
+    };
+}
+export function handleDirectSessions(res) {
+    try {
+        const sessionsDir = getDirectSessionsDir(config);
+        if (!existsSync(sessionsDir)) {
+            // Directory missing -> empty list, never 500.
+            sendJson(res, 200, { sessions: [], total: 0, reason: null });
+            return;
+        }
+        let entries = [];
+        try {
+            entries = readdirSync(sessionsDir, { withFileTypes: true }).filter((e) => e.isDirectory());
+        }
+        catch (err) {
+            sendJson(res, 200, { sessions: [], total: 0, reason: errorMessage(err) });
+            return;
+        }
+        // Filter out sessions hidden from the dashboard via POST .../hide.
+        const hiddenIds = new Set(readHiddenDirectSessionIds());
+        const summaries = [];
+        for (const entry of entries) {
+            if (hiddenIds.has(entry.name))
+                continue;
+            const summary = readDirectSessionSummary(join(sessionsDir, entry.name), entry.name);
+            if (summary)
+                summaries.push(summary);
+        }
+        // Sort by created_at descending.
+        summaries.sort((a, b) => b.created_at.localeCompare(a.created_at));
+        sendJson(res, 200, { sessions: summaries, total: summaries.length, reason: null });
+    }
+    catch (err) {
+        sendJson(res, 200, { sessions: [], total: 0, reason: errorMessage(err) });
+    }
+}
+export function handleDirectSessionDetail(res, sessionId) {
+    try {
+        if (sessionId === "." ||
+            sessionId === ".." ||
+            sessionId.includes("/") ||
+            sessionId.includes("\\") ||
+            sessionId.includes("\0")) {
+            sendJson(res, 400, { error: "Invalid session id" });
+            return;
+        }
+        const sessionsDir = getDirectSessionsDir(config);
+        const sessionDir = join(sessionsDir, sessionId);
+        if (!existsSync(sessionDir) || !statSync(sessionDir).isDirectory()) {
+            sendJson(res, 404, { error: "Direct session not found" });
+            return;
+        }
+        const summary = readDirectSessionSummary(sessionDir, sessionId);
+        sendJson(res, 200, {
+            session_id: sessionId,
+            summary,
+            session: readJsonFileSafe(join(sessionDir, "session.json")),
+            summary_md: readTextFileSafe(join(sessionDir, "summary.md")),
+            diff_patch: readTextFileSafe(join(sessionDir, "diff.patch")),
+            audit_json: readJsonFileSafe(join(sessionDir, "audit.json")),
+            audit_md: readTextFileSafe(join(sessionDir, "audit.md")),
+            changed_files: readJsonFileSafe(join(sessionDir, "changed-files.json")),
+        });
+    }
+    catch (err) {
+        sendJson(res, 200, { session_id: sessionId, error: errorMessage(err) });
+    }
+}
+export function handleDirectSessionSafeSummary(res, sessionId) {
+    try {
+        if (sessionId === "." ||
+            sessionId === ".." ||
+            sessionId.includes("/") ||
+            sessionId.includes("\\") ||
+            sessionId.includes("\0")) {
+            sendJson(res, 400, { error: "Invalid session id" });
+            return;
+        }
+        sendJson(res, 200, safeDirectSummary(sessionId, { max_items: 12 }));
+    }
+    catch (err) {
+        sendJson(res, 200, {
+            session_id: sessionId,
+            error: errorMessage(err),
+            large_logs_omitted: true,
+            diff_omitted: true,
+        });
+    }
+}
+/**
+ * Finalize a direct session via safeFinalizeDirectSession. Returns the safe
+ * summary on success, or { error } on failure with HTTP 200 (fault tolerance:
+ * the UI always gets a JSON body it can render).
+ */
+export async function handleDirectSessionFinalize(res, sessionId) {
+    try {
+        if (!isValidDirectSessionId(sessionId)) {
+            sendJson(res, 400, { error: "Invalid session id" });
+            return;
+        }
+        const result = await safeFinalizeDirectSession(sessionId, { max_items: 12 });
+        recordEvent("direct_session.finalized", { session_id: sessionId });
+        sendJson(res, 200, result);
+    }
+    catch (err) {
+        sendJson(res, 200, {
+            session_id: sessionId,
+            error: errorMessage(err),
+            large_logs_omitted: true,
+            diff_omitted: true,
+        });
+    }
+}
+/**
+ * Audit a direct session via safeAuditDirectSession. Returns the safe audit
+ * result on success, or { error } on failure (HTTP 200 for fault tolerance).
+ */
+export function handleDirectSessionAudit(res, sessionId) {
+    try {
+        if (!isValidDirectSessionId(sessionId)) {
+            sendJson(res, 400, { error: "Invalid session id" });
+            return;
+        }
+        const result = safeAuditDirectSession(sessionId, { max_items: 12 });
+        recordEvent("direct_session.audited", { session_id: sessionId });
+        sendJson(res, 200, result);
+    }
+    catch (err) {
+        sendJson(res, 200, {
+            session_id: sessionId,
+            error: errorMessage(err),
+            large_logs_omitted: true,
+            diff_omitted: true,
+        });
+    }
+}
+/**
+ * Hide a direct session from the dashboard list. The session itself is NOT
+ * deleted or modified — only the control-center's local
+ * hidden-direct-session-ids.json state file is updated. Requires control token
+ * (enforced by the POST router).
+ */
+export function handleDirectSessionHide(res, sessionId) {
+    try {
+        if (!isValidDirectSessionId(sessionId)) {
+            sendJson(res, 400, { error: "Invalid session id" });
+            return;
+        }
+        const ids = readHiddenDirectSessionIds();
+        if (!ids.includes(sessionId)) {
+            ids.push(sessionId);
+            writeHiddenDirectSessionIds(ids);
+        }
+        recordEvent("direct_session.hidden", { session_id: sessionId });
+        sendJson(res, 200, { ok: true, hidden: sessionId });
+    }
+    catch (err) {
+        sendJson(res, 500, { error: errorMessage(err) });
+    }
+}

package/dist/control/routes/status.d.ts

@@ -0,0 +1,6 @@
+import { type ServerResponse } from "node:http";
+export declare function handleStatus(res: ServerResponse): Promise<void>;
+export declare function handleControlCenterStatus(res: ServerResponse): void;
+export declare function handleEvents(res: ServerResponse, limit: number): void;
+export declare function handleTunnelUiUrl(res: ServerResponse): void;
+export declare function handleDiagnostics(res: ServerResponse): void;