mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-09-30 12:39:42 +02:00
RandalixandClaude Opus 5
1040f6c489
Review round 2 on #439. 1. The bare TCP probe connects to host:port, which a host behind a jump host or SOCKS proxy does not answer even while ssh works. Acting on that verdict drew a permanent banner over a healthy session, replaced a real "needs tmux" error with "not reachable" in quick-start, and - with a wake target - buffered every HTTP input for the life of the session, since the readiness poll could never succeed. `WakeableRemote` now carries `jumpHost`/`socksProxy`/`extraSshOptions`, and `isProbeable()` turns such a host into reachability-UNKNOWN: input is delivered, `checkReachable` / `checkHostReachable` answer `null` (never `false`), `ensureHostAwake` returns `'unprobeable'` (handled like `'no-target'`), the quick-start gate fires on `=== false` only, and `GET …/reachability` reports `reachable: null, probeable: false` so the banner has nothing to key on. A wake target can still be fired for it, blind: no readiness poll, no reattach, no toast - the response says only whether the packet went out. 2. `'remote:'` joins the session-scoped SSE prefixes. The create/attach wake has no session yet, so the registry names the requesting user (`ensureHostAwake({ requestedBy })` -> `username` in the payload) and `deriveSseHint` routes on it; with neither it fails closed to admins. Single-user mode is unaffected. Smaller, from the same review: - A flush write that fails now drops the remaining buffer (logged) instead of retaining it: the wake still resolved and marked the host reachable, so the retained chunk waited for the NEXT wake and was replayed hours later, after everything typed since. Same policy as the oversized paste. - The banner polls on tab activation (a user action) and on its 30 s timer only for a host with a wake target; a timer connecting to a host Codeman cannot wake is the traffic invariant #2 rejects keepalives for. A proxied host is never polled. - `probeRemoteHostReachable`, `runRemoteWakeCommand` and the default UDP socket refuse under VITEST, as remote-files.ts does. The guard caught a leak on the spot: `createDefaultRemoteWakeDeps({ probe })` overrode the probe but still polled readiness with the real one, so the shutdown test had been connecting to a production address. The poll now uses the injected probe. - docs/remote-sessions.md is additions only again (the reformatting is gone); the architecture-invariants overlap resolved itself in the merge. Live, against a throwaway instance with a non-routable ghost host: proxied -> no probe, no wake, the genuine ssh error after 10 s; direct (control) -> probe, magic packet, "did not come back" after the 40 s budget. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdGP4jUTjc9J2RYYykDrCG
57 lines
2.5 KiB
TypeScript
57 lines
2.5 KiB
TypeScript
/**
|
||
* @fileoverview Multi-user routing of the `remote:*` SSE family (server.ts `deriveSseHint`).
|
||
*
|
||
* The wake events carry `hostId`/`label`, which `GET /api/remote-hosts` withholds from
|
||
* non-admins, and their toast fires before any session check on the client — so an
|
||
* event that falls through to the global branch shows every logged-in user "Waking
|
||
* <label>" for a session they do not own. Constructs the server without starting it:
|
||
* the hint is a pure function of the event, the payload and the sessions map.
|
||
*/
|
||
import { describe, expect, it } from 'vitest';
|
||
import { WebServer } from '../src/web/server.js';
|
||
|
||
type Hint = { owner?: string; username?: string; adminOnly?: boolean; sessionScoped?: boolean } | undefined;
|
||
|
||
function hintFor(event: string, payload: Record<string, unknown>, owners: Record<string, string> = {}): Hint {
|
||
const server = new WebServer(3999, false, true) as unknown as {
|
||
sessions: Map<string, { owner?: string }>;
|
||
deriveSseHint(event: string, data: unknown): Hint;
|
||
};
|
||
for (const [id, owner] of Object.entries(owners)) server.sessions.set(id, { owner });
|
||
return server.deriveSseHint(event, payload);
|
||
}
|
||
|
||
describe('deriveSseHint — remote: events are session-scoped', () => {
|
||
it('routes a session wake to that session’s owner', () => {
|
||
expect(hintFor('remote:hostWaking', { sessionId: 's1', hostId: 'h', label: 'H' }, { s1: 'alice' })).toEqual({
|
||
owner: 'alice',
|
||
sessionScoped: true,
|
||
});
|
||
expect(hintFor('remote:sessionReconnected', { sessionId: 's1' }, { s1: 'alice' })).toEqual({
|
||
owner: 'alice',
|
||
sessionScoped: true,
|
||
});
|
||
});
|
||
|
||
it('routes a create/attach wake (no session yet) to the user who asked for it', () => {
|
||
expect(hintFor('remote:hostWaking', { forNewSession: true, username: 'bob', hostId: 'h', label: 'H' })).toEqual({
|
||
username: 'bob',
|
||
sessionScoped: true,
|
||
});
|
||
expect(hintFor('remote:hostWakeFailed', { forNewSession: true, username: 'bob', hostId: 'h' })).toEqual({
|
||
username: 'bob',
|
||
sessionScoped: true,
|
||
});
|
||
});
|
||
|
||
it('fails closed (admins only) when it names neither a session nor a requester', () => {
|
||
const hint = hintFor('remote:hostWaking', { forNewSession: true, hostId: 'h', label: 'H' });
|
||
expect(hint).toEqual({ owner: undefined, sessionScoped: true });
|
||
});
|
||
|
||
it('never lets a wake event reach the global branch', () => {
|
||
expect(hintFor('remote:hostWaking', {})).not.toBeUndefined();
|
||
expect(hintFor('remote:reconnectExhausted', {})).not.toBeUndefined();
|
||
});
|
||
});
|