specrails-desktop 2.0.0

package/server/dist/metrics.js

@@ -0,0 +1,136 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProjectMetrics = getProjectMetrics;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+function readCoverage(projectPath) {
+    const candidatePaths = [
+        path_1.default.join(projectPath, 'coverage', 'coverage-summary.json'),
+        path_1.default.join(projectPath, 'coverage', 'coverage-final.json'),
+    ];
+    for (const filePath of candidatePaths) {
+        if (!fs_1.default.existsSync(filePath))
+            continue;
+        try {
+            const raw = JSON.parse(fs_1.default.readFileSync(filePath, 'utf-8'));
+            const total = raw['total'];
+            if (total) {
+                return {
+                    pct: total.lines?.pct ?? null,
+                    lines: total.lines?.pct ?? null,
+                    statements: total.statements?.pct ?? null,
+                    functions: total.functions?.pct ?? null,
+                    branches: total.branches?.pct ?? null,
+                    source: path_1.default.relative(projectPath, filePath),
+                };
+            }
+        }
+        catch { /* malformed file — try next */ }
+    }
+    return { pct: null, lines: null, statements: null, functions: null, branches: null, source: null };
+}
+// ─── Git activity ─────────────────────────────────────────────────────────────
+function getGitCommits(projectPath, limit = 10) {
+    try {
+        const out = (0, child_process_1.execSync)(`git log --pretty=format:"%H|%s|%an|%ai" -${limit}`, { cwd: projectPath, timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim();
+        if (!out)
+            return [];
+        return out.split('\n').map((line) => {
+            const parts = line.split('|');
+            return {
+                hash: (parts[0] ?? '').slice(0, 7),
+                message: parts[1] ?? '',
+                author: parts[2] ?? '',
+                date: parts[3] ?? '',
+            };
+        });
+    }
+    catch {
+        return [];
+    }
+}
+// ─── Failure pattern detection ────────────────────────────────────────────────
+const FAILURE_PATTERN_THRESHOLD = 3;
+const FAILURE_PATTERN_WINDOW_DAYS = 7;
+function getFailurePatterns(db) {
+    const rows = db.prepare(`
+    SELECT
+      CASE
+        WHEN instr(command, ' ') > 0 THEN substr(command, 1, instr(command, ' ') - 1)
+        ELSE command
+      END as command_key,
+      COUNT(*) as failure_count,
+      MAX(started_at) as last_failed_at
+    FROM jobs
+    WHERE status = 'failed'
+      AND started_at >= datetime('now', '-${FAILURE_PATTERN_WINDOW_DAYS} days')
+    GROUP BY command_key
+    HAVING COUNT(*) >= ${FAILURE_PATTERN_THRESHOLD}
+    ORDER BY failure_count DESC
+    LIMIT 10
+  `).all();
+    return rows.map((r) => ({
+        command: r.command_key,
+        count: r.failure_count,
+        lastFailedAt: r.last_failed_at,
+    }));
+}
+// ─── Pipeline status ──────────────────────────────────────────────────────────
+function getPipelineStatus(db) {
+    const row = db.prepare(`SELECT id, status, command, finished_at
+     FROM jobs
+     WHERE status IN ('completed', 'failed', 'canceled', 'zombie_terminated')
+     ORDER BY finished_at DESC
+     LIMIT 1`).get();
+    if (!row) {
+        return { lastJobId: null, lastJobStatus: null, lastJobCommand: null, lastJobAt: null };
+    }
+    return {
+        lastJobId: row.id,
+        lastJobStatus: row.status,
+        lastJobCommand: row.command,
+        lastJobAt: row.finished_at,
+    };
+}
+// ─── Health score computation ─────────────────────────────────────────────────
+function computeHealthScore(coverage, pipeline, commits) {
+    const hasCoverage = coverage.pct !== null;
+    const coverageGood = hasCoverage && (coverage.pct ?? 0) >= 70;
+    const pipelineHealthy = pipeline.lastJobStatus === 'completed';
+    const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
+    const hasRecentActivity = commits.some((c) => new Date(c.date) > sevenDaysAgo);
+    // Weighted score: pipeline 35pts, coverage pass 25pts, recent activity 25pts, any coverage 15pts
+    let score = 0;
+    if (hasCoverage)
+        score += 15;
+    if (coverageGood)
+        score += 25;
+    if (pipelineHealthy)
+        score += 35;
+    if (hasRecentActivity)
+        score += 25;
+    return {
+        score: Math.min(100, score),
+        factors: { hasCoverage, coverageGood, pipelineHealthy, hasRecentActivity },
+    };
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+function getProjectMetrics(projectPath, db) {
+    const coverage = readCoverage(projectPath);
+    const recentCommits = getGitCommits(projectPath, 10);
+    const pipeline = getPipelineStatus(db);
+    const { score, factors } = computeHealthScore(coverage, pipeline, recentCommits);
+    const failurePatterns = getFailurePatterns(db);
+    return {
+        coverage,
+        healthScore: score,
+        healthFactors: factors,
+        recentCommits,
+        pipeline,
+        failurePatterns,
+    };
+}

package/server/dist/mobile/index.js

@@ -0,0 +1,16 @@
+"use strict";
+// Mobile Gateway — public surface. The gateway is a second HTTPS+WSS listener in
+// the same Node process (default :4202, OFF by default) that pairs phones by QR +
+// desktop approval and exposes a redacted, deny-by-default allow-list of the
+// desktop API over per-device tokens. The main server at 127.0.0.1:4200 is never
+// exposed.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MOBILE_ALLOWLIST = exports.getMobileEventBus = exports.createMobileAdminRouter = exports.MobileGateway = void 0;
+var mobile_gateway_1 = require("./mobile-gateway");
+Object.defineProperty(exports, "MobileGateway", { enumerable: true, get: function () { return mobile_gateway_1.MobileGateway; } });
+var mobile_admin_router_1 = require("./mobile-admin-router");
+Object.defineProperty(exports, "createMobileAdminRouter", { enumerable: true, get: function () { return mobile_admin_router_1.createMobileAdminRouter; } });
+var mobile_event_bus_1 = require("./mobile-event-bus");
+Object.defineProperty(exports, "getMobileEventBus", { enumerable: true, get: function () { return mobile_event_bus_1.getMobileEventBus; } });
+var mobile_router_1 = require("./mobile-router");
+Object.defineProperty(exports, "MOBILE_ALLOWLIST", { enumerable: true, get: function () { return mobile_router_1.MOBILE_ALLOWLIST; } });

package/server/dist/mobile/mobile-admin-router.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMobileAdminRouter = createMobileAdminRouter;
+const express_1 = require("express");
+const mobile_devices_1 = require("./mobile-devices");
+const DEVICE_ID_RE = /^[A-Za-z0-9-]{1,64}$/;
+function createMobileAdminRouter(deps) {
+    const router = (0, express_1.Router)();
+    const { gateway, desktopDb } = deps;
+    router.get('/status', (_req, res) => {
+        res.json(gateway.status());
+    });
+    router.post('/enable', async (_req, res) => {
+        try {
+            const status = await gateway.setEnabled(true);
+            res.json(status);
+        }
+        catch (err) {
+            // EADDRINUSE etc — keep the flag off and report, never crash.
+            res.status(409).json({ error: err instanceof Error ? err.message : 'Failed to start gateway' });
+        }
+    });
+    router.post('/disable', async (_req, res) => {
+        await gateway.setEnabled(false);
+        res.json(gateway.status());
+    });
+    // —— Pairing session ——
+    router.post('/pairing-session', (_req, res) => {
+        if (!gateway.running || !gateway.pairing) {
+            res.status(409).json({ error: 'Enable mobile access first' });
+            return;
+        }
+        res.json({ qr: gateway.pairing.createSession() });
+    });
+    router.get('/pairing-session', (_req, res) => {
+        if (!gateway.pairing) {
+            res.json({ status: 'none' });
+            return;
+        }
+        res.json(gateway.pairing.getDesktopState() ?? { status: 'none' });
+    });
+    router.post('/pairing-session/approve', (_req, res) => {
+        if (!gateway.pairing) {
+            res.status(409).json({ error: 'No pairing session' });
+            return;
+        }
+        const result = gateway.pairing.approve();
+        if (!result.ok) {
+            res.status(409).json({ error: result.reason });
+            return;
+        }
+        res.json({ ok: true });
+    });
+    router.post('/pairing-session/deny', (_req, res) => {
+        gateway.pairing?.deny();
+        res.json({ ok: true });
+    });
+    router.delete('/pairing-session', (_req, res) => {
+        gateway.pairing?.cancel();
+        res.json({ ok: true });
+    });
+    // —— Devices ——
+    router.get('/devices', (_req, res) => {
+        res.json({ devices: (0, mobile_devices_1.listDevices)(desktopDb) });
+    });
+    router.delete('/devices/:id', (req, res) => {
+        const id = typeof req.params.id === 'string' ? req.params.id : '';
+        if (!DEVICE_ID_RE.test(id)) {
+            res.status(400).json({ error: 'Invalid device id' });
+            return;
+        }
+        const changed = (0, mobile_devices_1.revokeDevice)(desktopDb, id);
+        if (changed) {
+            gateway.bridge?.closeForDevice(id);
+            deps.broadcast({ type: 'mobile.device_revoked', deviceId: id, timestamp: new Date().toISOString() });
+        }
+        res.json({ ok: changed });
+    });
+    router.post('/cert/rotate', async (_req, res) => {
+        const status = await gateway.rotateCert();
+        res.json(status);
+    });
+    return router;
+}

package/server/dist/mobile/mobile-auth.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractBearer = extractBearer;
+exports.resolveDevice = resolveDevice;
+exports.createMobileAuthMiddleware = createMobileAuthMiddleware;
+const mobile_devices_1 = require("./mobile-devices");
+function extractBearer(req) {
+    const h = req.headers['authorization'];
+    if (typeof h === 'string' && h.startsWith('Bearer ')) {
+        const t = h.slice(7).trim();
+        return t.length > 0 ? t : null;
+    }
+    return null;
+}
+/** Resolve a device from a raw token against the current cert fingerprint, or
+ *  null. Shared by the REST middleware and the WS upgrade check. */
+function resolveDevice(db, token, currentFingerprint) {
+    if (!token)
+        return null;
+    const row = (0, mobile_devices_1.getActiveDeviceByTokenHash)(db, (0, mobile_devices_1.hashToken)(token));
+    if (!row)
+        return null;
+    if (row.cert_fingerprint !== currentFingerprint)
+        return null;
+    return row;
+}
+function createMobileAuthMiddleware(opts) {
+    const ratePerMinute = opts.ratePerMinute ?? 600;
+    const clock = opts.clock ?? (() => Date.now());
+    const lastTouch = new Map();
+    const ipHits = new Map();
+    return function mobileAuth(req, res, next) {
+        // 1. Refuse browser-origin requests outright.
+        if (req.headers['origin']) {
+            res.status(403).json({ error: 'Forbidden: origin not allowed' });
+            return;
+        }
+        // 2. Coarse per-IP rate limit.
+        const ip = req.socket?.remoteAddress ?? 'unknown';
+        const now = clock();
+        const hits = (ipHits.get(ip) ?? []).filter((t) => now - t < 60_000);
+        hits.push(now);
+        ipHits.set(ip, hits);
+        if (hits.length > ratePerMinute) {
+            res.status(429).json({ error: 'Too many requests' });
+            return;
+        }
+        // 3. Token → device, fingerprint-bound.
+        const device = resolveDevice(opts.db, extractBearer(req), opts.currentFingerprint());
+        if (!device) {
+            res.status(401).json({ error: 'Unauthorized' });
+            return;
+        }
+        // 4. Throttled last-seen update (≤1/min per device).
+        const prev = lastTouch.get(device.id) ?? 0;
+        if (now - prev > 60_000) {
+            lastTouch.set(device.id, now);
+            try {
+                (0, mobile_devices_1.touchDevice)(opts.db, device.id, ip);
+            }
+            catch { /* non-fatal */ }
+        }
+        ;
+        req.mobileDevice = device;
+        next();
+    };
+}

package/server/dist/mobile/mobile-devices.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashToken = hashToken;
+exports.createDevice = createDevice;
+exports.getActiveDeviceByTokenHash = getActiveDeviceByTokenHash;
+exports.listDevices = listDevices;
+exports.toPublic = toPublic;
+exports.revokeDevice = revokeDevice;
+exports.revokeAllDevices = revokeAllDevices;
+exports.touchDevice = touchDevice;
+exports.sweepExpiredDevices = sweepExpiredDevices;
+const crypto_1 = require("crypto");
+// CRUD over desktop.sqlite `mobile_devices` (table created by desktop-db migration 12).
+// Tokens are stored ONLY as sha256 hashes; the plaintext token is shown to the
+// phone exactly once at approval and never persisted.
+function hashToken(token) {
+    return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+}
+function createDevice(db, opts) {
+    const id = (0, crypto_1.randomUUID)();
+    db.prepare(`INSERT INTO mobile_devices (id, name, platform, token_hash, scopes, cert_fingerprint)
+     VALUES (?, ?, ?, ?, 'companion', ?)`).run(id, opts.name, opts.platform, opts.tokenHash, opts.certFingerprint);
+    return db.prepare('SELECT * FROM mobile_devices WHERE id = ?').get(id);
+}
+/** Look up a device by its token hash. Returns undefined if unknown OR revoked —
+ *  a revoked device must behave as if it never existed. */
+function getActiveDeviceByTokenHash(db, tokenHash) {
+    const row = db
+        .prepare('SELECT * FROM mobile_devices WHERE token_hash = ?')
+        .get(tokenHash);
+    if (!row || row.revoked_at)
+        return undefined;
+    return row;
+}
+function listDevices(db) {
+    const rows = db
+        .prepare('SELECT * FROM mobile_devices ORDER BY created_at DESC')
+        .all();
+    return rows.map(toPublic);
+}
+function toPublic(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        platform: row.platform,
+        scopes: row.scopes,
+        createdAt: row.created_at,
+        lastSeenAt: row.last_seen_at,
+        lastIp: row.last_ip,
+        revoked: !!row.revoked_at,
+    };
+}
+/** Mark a device revoked (idempotent). Returns true if a row was affected. */
+function revokeDevice(db, id) {
+    const res = db
+        .prepare("UPDATE mobile_devices SET revoked_at = datetime('now') WHERE id = ? AND revoked_at IS NULL")
+        .run(id);
+    return res.changes > 0;
+}
+/** Revoke EVERY device — used by cert rotation ("Reset mobile identity"). */
+function revokeAllDevices(db) {
+    const res = db
+        .prepare("UPDATE mobile_devices SET revoked_at = datetime('now') WHERE revoked_at IS NULL")
+        .run();
+    return res.changes;
+}
+/** Refresh last_seen_at/last_ip. Callers throttle this to ~1/min per device. */
+function touchDevice(db, id, ip) {
+    db.prepare("UPDATE mobile_devices SET last_seen_at = datetime('now'), last_ip = ? WHERE id = ?").run(ip ?? null, id);
+}
+/** Sliding-expiry sweep: revoke devices unseen for `days` (default 90). Devices
+ *  that have never connected are measured from created_at. Returns count revoked. */
+function sweepExpiredDevices(db, days = 90) {
+    const res = db
+        .prepare(`UPDATE mobile_devices SET revoked_at = datetime('now')
+       WHERE revoked_at IS NULL
+         AND COALESCE(last_seen_at, created_at) < datetime('now', ?)`)
+        .run(`-${days} days`);
+    return res.changes;
+}

package/server/dist/mobile/mobile-event-bus.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMobileEventBus = getMobileEventBus;
+const events_1 = require("events");
+// In-process fan-out of every WS broadcast to the Mobile Gateway.
+//
+// The plan originally had the gateway hold a client WebSocket to
+// ws://127.0.0.1:4200. But the gateway runs in the SAME process, so a loopback
+// socket would be pure overhead AND force the bridge to JSON.parse the whole
+// firehose (a gap the critic flagged). Instead the main `broadcast()` emits each
+// already-structured WsMessage here; the gateway's WS bridge subscribes and does
+// per-subscription filtering + redaction on plain objects. REST still forwards
+// via a real loopback HTTP request (so it re-enters requireAuth and never hits
+// the SPA catch-all) — only the WS path uses this bus.
+class MobileEventBus extends events_1.EventEmitter {
+    /** Emit a broadcast copy to any subscribed gateway sockets. Never throws into
+     *  the caller (the main broadcast loop must not be perturbed by a mobile bug). */
+    publish(msg) {
+        try {
+            this.emit('message', msg);
+        }
+        catch {
+            /* swallow — a misbehaving mobile listener must not break the main bus */
+        }
+    }
+    onMessage(cb) {
+        this.on('message', cb);
+        return () => this.off('message', cb);
+    }
+}
+// EventEmitter defaults to 10 listeners; the gateway attaches one shared listener
+// that fans out to many sockets, so the default is plenty — but lift it anyway
+// to be safe against future multi-listener designs.
+const bus = new MobileEventBus();
+bus.setMaxListeners(64);
+/** Process-wide singleton bus. */
+function getMobileEventBus() {
+    return bus;
+}