chore: bump version to 0.1654

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -35,7 +35,7 @@ When user says "COM":
 1. Increment version in BOTH `package.json` AND `CLAUDE.md` (verify they match with `grep version package.json && grep Version CLAUDE.md`)
 2. Run: `git add -A && git commit -m "chore: bump version to X.XXXX" && git push && npm run build && systemctl --user restart codeman-web`
 
-**Version**: 0.1653 (must match `package.json`)
+**Version**: 0.1654 (must match `package.json`)
 
 ## Project Overview
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeman",
-  "version": "0.1653",
+  "version": "0.1654",
   "description": "The missing control plane for AI coding agents - run 20 autonomous agents with real-time monitoring and session persistence",
   "type": "module",
   "main": "dist/index.js",

scripts/codeman-web.service

@@ -4,7 +4,7 @@ After=network.target
 
 [Service]
 Type=simple
-WorkingDirectory=/home/arkon/default/codeman
+WorkingDirectory=/home/arkon/default/claudeman
 ExecStart=/usr/bin/node dist/index.js web --https
 Restart=always
 RestartSec=5

scripts/postinstall.js

@@ -5,7 +5,7 @@
  * Runs after `npm install` to check environment readiness
  */
 
-import { execSync } from 'child_process';
+import { execSync, spawn } from 'child_process';
 import { chmodSync, existsSync } from 'fs';
 import { homedir, platform } from 'os';
 import { join } from 'path';
@@ -60,6 +60,37 @@ function commandExists(cmd) {
     }
 }
 
+/**
+ * Check if a TCP port is already in use
+ */
+async function isPortBusy(port) {
+    const net = await import('node:net');
+    return new Promise((resolve) => {
+        const srv = net.createServer();
+        srv.once('error', () => resolve(true));
+        srv.once('listening', () => { srv.close(); resolve(false); });
+        srv.listen(port, '127.0.0.1');
+    });
+}
+
+/**
+ * Wait for a server to start accepting connections
+ */
+async function waitForServer(port, timeoutMs = 15000) {
+    const net = await import('node:net');
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+        const ok = await new Promise((resolve) => {
+            const conn = net.createConnection({ port, host: '127.0.0.1' });
+            conn.once('connect', () => { conn.destroy(); resolve(true); });
+            conn.once('error', () => resolve(false));
+        });
+        if (ok) return true;
+        await new Promise(r => setTimeout(r, 500));
+    }
+    return false;
+}
+
 /**
  * Get install instructions for tmux based on platform
  */
@@ -221,6 +252,8 @@ if (isGlobalInstall) {
         const require = createRequire(import.meta.url);
         const xtermDir = join(require.resolve('xterm'), '..', '..');
         const fitDir = join(require.resolve('xterm-addon-fit'), '..', '..');
+        const webglDir = join(require.resolve('xterm-addon-webgl'), '..', '..');
+        const unicode11Dir = join(require.resolve('xterm-addon-unicode11'), '..', '..');
         const vendorDir = join(srcDir, 'web', 'public', 'vendor');
 
         const { mkdirSync, copyFileSync } = await import('fs');
@@ -231,13 +264,18 @@ if (isGlobalInstall) {
         try {
             execSync(`npx esbuild "${join(xtermDir, 'lib', 'xterm.js')}" --minify --outfile="${join(vendorDir, 'xterm.min.js')}"`, { stdio: 'pipe' });
             execSync(`npx esbuild "${join(fitDir, 'lib', 'xterm-addon-fit.js')}" --minify --outfile="${join(vendorDir, 'xterm-addon-fit.min.js')}"`, { stdio: 'pipe' });
+            execSync(`npx esbuild "${join(unicode11Dir, 'lib', 'xterm-addon-unicode11.js')}" --minify --outfile="${join(vendorDir, 'xterm-addon-unicode11.min.js')}"`, { stdio: 'pipe' });
             console.log(colors.green('✓ xterm vendor files copied to src/web/public/vendor/'));
         } catch {
             // Fallback: copy unminified
             copyFileSync(join(xtermDir, 'lib', 'xterm.js'), join(vendorDir, 'xterm.min.js'));
             copyFileSync(join(fitDir, 'lib', 'xterm-addon-fit.js'), join(vendorDir, 'xterm-addon-fit.min.js'));
+            copyFileSync(join(unicode11Dir, 'lib', 'xterm-addon-unicode11.js'), join(vendorDir, 'xterm-addon-unicode11.min.js'));
             console.log(colors.green('✓ xterm vendor files copied') + colors.dim(' (unminified — esbuild not available)'));
         }
+
+        // WebGL addon: copy unminified (matches build script behavior)
+        copyFileSync(join(webglDir, 'lib', 'xterm-addon-webgl.js'), join(vendorDir, 'xterm-addon-webgl.min.js'));
     } catch (err) {
         hasWarnings = true;
         console.log(colors.yellow('⚠ Failed to copy xterm vendor files'));
@@ -247,7 +285,7 @@ if (isGlobalInstall) {
 }
 
 // ----------------------------------------------------------------------------
-// Print Summary and Next Steps
+// Summary
 // ----------------------------------------------------------------------------
 
 console.log('');
@@ -257,19 +295,96 @@ if (hasErrors) {
     process.exit(1);
 }
 
+if (hasWarnings) {
+    console.log(colors.yellow('Note: Resolve warnings above for full functionality.'));
+    console.log('');
+}
+
+// ----------------------------------------------------------------------------
+// Auto-start Codeman web server
+// ----------------------------------------------------------------------------
+
+const port = parseInt(process.env.PORT || '3000', 10);
+const projectRoot = join(import.meta.dirname, '..');
+
+if (process.env.CI || process.env.CODEMAN_NO_AUTOSTART) {
+    // CI or explicit opt-out — just print next steps
     console.log(colors.bold('Next steps:'));
     if (isGlobalInstall) {
         console.log(colors.dim('  1. Start:  ') + colors.cyan('codeman web'));
-    console.log(colors.dim('  2. Open:   ') + colors.cyan('http://localhost:3000'));
+        console.log(colors.dim('  2. Open:   ') + colors.cyan(`http://localhost:${port}`));
     } else {
         console.log(colors.dim('  1. Build:  ') + colors.cyan('npm run build'));
-    console.log(colors.dim('  2. Start:  ') + colors.cyan('codeman web'));
-    console.log(colors.dim('  3. Open:   ') + colors.cyan('http://localhost:3000'));
+        console.log(colors.dim('  2. Start:  ') + colors.cyan('npx codeman web'));
+        console.log(colors.dim('  3. Open:   ') + colors.cyan(`http://localhost:${port}`));
+    }
+    console.log('');
+} else {
+    // Auto-start the server
+    const portInUse = await isPortBusy(port);
+
+    if (portInUse) {
+        console.log(colors.green('✓ Codeman appears to be already running'));
+        console.log('');
+        console.log(colors.bold('  ┌──────────────────────────────────────────┐'));
+        console.log(colors.bold(`  │  ${colors.cyan(`→ http://localhost:${port}`)}${' '.repeat(Math.max(0, 21 - String(port).length))}│`));
+        console.log(colors.bold('  └──────────────────────────────────────────┘'));
+        console.log('');
+    } else {
+        // Build if dist/ doesn't exist (local install only)
+        const distEntry = join(projectRoot, 'dist', 'index.js');
+        let buildOk = existsSync(distEntry);
+
+        if (!buildOk && !isGlobalInstall) {
+            const hasTsc = existsSync(join(projectRoot, 'node_modules', '.bin', 'tsc'));
+            if (hasTsc) {
+                console.log(colors.dim('  Building Codeman...'));
+                try {
+                    execSync('npm run build', {
+                        stdio: ['ignore', 'pipe', 'pipe'],
+                        timeout: 180000,
+                        cwd: projectRoot,
+                    });
+                    console.log(colors.green('✓ Build complete'));
+                    buildOk = true;
+                } catch {
+                    console.log(colors.yellow('⚠ Build failed — start manually: npm run build && npx codeman web'));
+                }
+            } else {
+                console.log(colors.yellow('⚠ TypeScript not found — run: npm run build'));
+            }
         }
 
-if (hasWarnings) {
+        if (buildOk) {
+            console.log(colors.dim('  Starting Codeman web server...'));
+            try {
+                const child = spawn('node', [join(projectRoot, 'dist', 'index.js'), 'web'], {
+                    detached: true,
+                    stdio: 'ignore',
+                    cwd: projectRoot,
+                    env: { ...process.env, NODE_ENV: 'production' },
+                });
+                child.unref();
+
+                const ready = await waitForServer(port);
+
                 console.log('');
-    console.log(colors.yellow('Note: Resolve warnings above for full functionality.'));
+                if (ready) {
+                    console.log(colors.green('✓ Codeman is running'));
+                } else {
+                    console.log(colors.yellow('⚠ Server may still be starting...'));
                 }
 
                 console.log('');
+                console.log(colors.bold('  ┌──────────────────────────────────────────┐'));
+                console.log(colors.bold(`  │  ${colors.cyan(`→ http://localhost:${port}`)}${' '.repeat(Math.max(0, 21 - String(port).length))}│`));
+                console.log(colors.bold('  └──────────────────────────────────────────┘'));
+                console.log('');
+            } catch (err) {
+                console.log(colors.yellow(`⚠ Could not auto-start: ${err.message}`));
+                console.log(colors.dim('  Start manually: npx codeman web'));
+                console.log('');
+            }
+        }
+    }
+}

src/web/server.ts

@@ -19,7 +19,7 @@ import { fileURLToPath } from 'node:url';
 import { existsSync, statSync, mkdirSync, writeFileSync, readdirSync, readFileSync, rmSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import { execSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { homedir, totalmem, freemem, loadavg, cpus } from 'node:os';
 import { EventEmitter } from 'node:events';
 import { Session, ClaudeMessage, type BackgroundTask, type RalphTrackerState, type RalphTodoItem, type ActiveBashTool } from '../session.js';
@@ -637,10 +637,15 @@ export class WebServer extends EventEmitter {
       this.app.addHook('onRequest', (req, reply, done) => {
         // Hook events come from local Claude Code hooks (curl from localhost) — no auth headers available.
         // Safe: validated by HookEventSchema, only triggers broadcasts.
+        // Security: restrict bypass to localhost only — prevents forged hook events via tunnel/LAN.
         if (req.url === '/api/hook-event' && req.method === 'POST') {
+          const ip = req.ip;
+          if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') {
             done();
             return;
           }
+          // Non-localhost hook requests fall through to normal auth
+        }
 
         const clientIp = req.ip;
 
@@ -652,15 +657,18 @@ export class WebServer extends EventEmitter {
         }
 
         // Check session cookie first (avoids re-sending credentials on every request)
+        // Use get() instead of has() so refreshOnGet extends the TTL on active sessions
         const sessionToken = req.cookies[AUTH_COOKIE_NAME];
-        if (sessionToken && this.authSessions!.has(sessionToken)) {
+        if (sessionToken && this.authSessions!.get(sessionToken) !== undefined) {
           done();
           return;
         }
 
-        // Check Basic Auth header
+        // Check Basic Auth header (timing-safe comparison to prevent side-channel attacks)
         const auth = req.headers.authorization;
-        if (auth === expectedHeader) {
+        const authBuf = Buffer.from(auth ?? '');
+        const expectedBuf = Buffer.from(expectedHeader);
+        if (authBuf.length === expectedBuf.length && timingSafeEqual(authBuf, expectedBuf)) {
           // Issue session token cookie so browser doesn't need to re-send credentials
           const token = randomBytes(32).toString('hex');
 
@@ -5420,6 +5428,13 @@ NOW: Generate the implementation plan for the task above. Think step by step.`;
     const protocol = this.https ? 'https' : 'http';
     console.log(`Codeman web interface running at ${protocol}://localhost:${this.port}`);
 
+    // Security warning: server binds to 0.0.0.0 (all interfaces) — warn if no auth configured
+    if (!process.env.CODEMAN_PASSWORD) {
+      console.warn('\n⚠  WARNING: No CODEMAN_PASSWORD set — server is accessible without authentication.');
+      console.warn('   Anyone on your network can access and control Claude sessions.');
+      console.warn('   Set CODEMAN_PASSWORD environment variable to enable auth.\n');
+    }
+
     // Set API URL for child processes (MCP server, spawned sessions)
     process.env.CODEMAN_API_URL = `${protocol}://localhost:${this.port}`;
 

test/auth-security.test.ts

@@ -0,0 +1,205 @@
+/**
+ * Auth security tests — verifies critical security fixes:
+ * 1. Timing-safe password comparison (timingSafeEqual)
+ * 2. Hook event endpoint restricted to localhost
+ * 3. Session cookie TTL refresh on access
+ * 4. Startup warning when no password configured
+ *
+ * Port: 3160 (auth tests), 3161 (no-auth tests)
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { WebServer } from '../src/web/server.js';
+
+const AUTH_PORT = 3160;
+const NOAUTH_PORT = 3161;
+const TEST_USER = 'admin';
+const TEST_PASS = 'test-password-12345';
+
+function basicAuthHeader(user: string, pass: string): string {
+  return 'Basic ' + Buffer.from(`${user}:${pass}`).toString('base64');
+}
+
+describe('Auth Security', () => {
+  let server: WebServer;
+  let baseUrl: string;
+
+  beforeAll(async () => {
+    process.env.CODEMAN_PASSWORD = TEST_PASS;
+    process.env.CODEMAN_USERNAME = TEST_USER;
+    server = new WebServer(AUTH_PORT, false, true);
+    await server.start();
+    baseUrl = `http://localhost:${AUTH_PORT}`;
+  });
+
+  afterAll(async () => {
+    await server.stop();
+    delete process.env.CODEMAN_PASSWORD;
+    delete process.env.CODEMAN_USERNAME;
+  });
+
+  describe('Basic Auth', () => {
+    it('should reject requests without credentials', async () => {
+      const res = await fetch(`${baseUrl}/api/status`);
+      expect(res.status).toBe(401);
+    });
+
+    it('should accept correct credentials', async () => {
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
+      });
+      expect(res.status).toBe(200);
+    });
+
+    it('should reject wrong password', async () => {
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: basicAuthHeader(TEST_USER, 'wrong') },
+      });
+      expect(res.status).toBe(401);
+    });
+
+    it('should reject wrong username', async () => {
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: basicAuthHeader('hacker', TEST_PASS) },
+      });
+      expect(res.status).toBe(401);
+    });
+
+    it('should reject empty authorization header', async () => {
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: '' },
+      });
+      expect(res.status).toBe(401);
+    });
+
+    it('should reject malformed authorization header', async () => {
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: 'Bearer some-token' },
+      });
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('Session Cookies', () => {
+    it('should issue session cookie on successful auth', async () => {
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
+      });
+      expect(res.status).toBe(200);
+      const setCookie = res.headers.get('set-cookie');
+      expect(setCookie).toBeTruthy();
+      expect(setCookie).toContain('codeman_session=');
+      expect(setCookie).toContain('HttpOnly');
+      expect(setCookie).toContain('SameSite=Lax');
+    });
+
+    it('should accept requests with valid session cookie', async () => {
+      // First, authenticate to get a cookie
+      const authRes = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
+      });
+      const setCookie = authRes.headers.get('set-cookie')!;
+      const cookieMatch = setCookie.match(/codeman_session=([^;]+)/);
+      expect(cookieMatch).toBeTruthy();
+      const cookie = `codeman_session=${cookieMatch![1]}`;
+
+      // Use the cookie without Basic Auth header
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Cookie: cookie },
+      });
+      expect(res.status).toBe(200);
+    });
+
+    it('should reject requests with invalid session cookie', async () => {
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Cookie: 'codeman_session=invalid-token-value' },
+      });
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('Rate Limiting', () => {
+    it('should block after too many failed attempts', async () => {
+      // Send 10 failed attempts
+      for (let i = 0; i < 10; i++) {
+        await fetch(`${baseUrl}/api/status`, {
+          headers: { Authorization: basicAuthHeader(TEST_USER, 'wrong-' + i) },
+        });
+      }
+
+      // 11th attempt should be rate-limited
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: basicAuthHeader(TEST_USER, 'wrong-again') },
+      });
+      expect(res.status).toBe(429);
+    });
+
+    it('should rate-limit even with correct credentials after lockout', async () => {
+      // After being rate-limited, even correct credentials should fail
+      const res = await fetch(`${baseUrl}/api/status`, {
+        headers: { Authorization: basicAuthHeader(TEST_USER, TEST_PASS) },
+      });
+      // Rate limit is per-IP and the previous test used the same IP
+      // This test verifies rate limiting isn't bypassed by correct creds
+      expect(res.status).toBe(429);
+    });
+  });
+
+  describe('Hook Event Endpoint', () => {
+    it('should allow hook events from localhost without auth', async () => {
+      const res = await fetch(`${baseUrl}/api/hook-event`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          event: 'stop',
+          sessionId: 'nonexistent-session',
+          data: {},
+        }),
+      });
+      // Should pass auth (localhost bypass) but may 404 on session — that's fine
+      // The key assertion is it does NOT return 401
+      expect(res.status).not.toBe(401);
+    });
+
+    it('should reject hook events with invalid schema', async () => {
+      const res = await fetch(`${baseUrl}/api/hook-event`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ invalid: 'data' }),
+      });
+      // Schema validation should catch this
+      expect(res.status).not.toBe(401); // Not an auth error
+    });
+  });
+});
+
+describe('No-Auth Server Warning', () => {
+  let server: WebServer;
+  let consoleWarnSpy: string[] = [];
+  const originalWarn = console.warn;
+
+  beforeAll(async () => {
+    delete process.env.CODEMAN_PASSWORD;
+    delete process.env.CODEMAN_USERNAME;
+    consoleWarnSpy = [];
+    console.warn = (...args: unknown[]) => {
+      consoleWarnSpy.push(args.map(String).join(' '));
+    };
+    server = new WebServer(NOAUTH_PORT, false, true);
+    await server.start();
+  });
+
+  afterAll(async () => {
+    console.warn = originalWarn;
+    await server.stop();
+  });
+
+  it('should warn when no CODEMAN_PASSWORD is set', () => {
+    const hasWarning = consoleWarnSpy.some(msg => msg.includes('No CODEMAN_PASSWORD set'));
+    expect(hasWarning).toBe(true);
+  });
+
+  it('should allow requests without auth when no password configured', async () => {
+    const res = await fetch(`http://localhost:${NOAUTH_PORT}/api/status`);
+    expect(res.status).toBe(200);
+  });
+});