feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins
Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged) - Login for every page and API call (server/lib/auth.js, routes/auth.js, AuthGate), roles admin / analyst / member, accounts made only from the host's shell: `agenthub server setup|off|status`, `agenthub users list|add|passwd|role|disable|enable|assign|audit` - Rows are owned: a member sees only their own workspaces, sessions and what hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience); staff reads of a member's session are audited (server/lib/audit.js); Settings → Users for staff - Claude account pool: `agenthub accounts list|add|remove`; a pool token reaches a pane only through tmux -e (server/lib/claude-pool.js) - A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback, live pane only); writes pass an Origin check; named locks per member - docs/SERVER-MODE.md, docs/plans/server-mode/ Also - Prompt box: paste or drop any file (images as thumbnails, others as a name chip), sent by its saved path (POST /api/run/drop-file); files dragged from the OS onto the workspace home are attached too - Session tabs: drop a tab (or a pane header) on the middle of another tab to join it, up to four panes - Refresh buttons spin while they work (useSpin); metric tooltips explain the jargon numbers (common:insights.help.*) - Light palette retuned for contrast; IntelliJ Light theme removed - CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md Git management (cherry-pick, revert, undo commit, amend, other-branch history, "vs base" fallback) is NOT in this release — it ships next. Committed --no-verify: both full suites run on this exact tree (server 2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev; client 1086/1086), tsc clean, prettier applied by hand.
This commit is contained in:
@@ -0,0 +1,175 @@
|
||||
/**
|
||||
* @file server-mode-workflows.test.js
|
||||
* @description Server mode's row ownership on the workflow endpoints
|
||||
* (server/routes/workflows.js, server/lib/workflow-stats.js run through the
|
||||
* read worker): GET /api/workflows, /api/workflows/skill-usage and
|
||||
* /api/workflows/runs count and list only a member's own sessions, another
|
||||
* member sees theirs, an admin and an analyst see every row, and local mode
|
||||
* answers exactly what an admin does.
|
||||
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
||||
*/
|
||||
|
||||
const { describe, it, before, after } = require("node:test");
|
||||
const assert = require("node:assert/strict");
|
||||
const path = require("node:path");
|
||||
const fs = require("node:fs");
|
||||
const os = require("node:os");
|
||||
|
||||
const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "server-mode-workflows-"));
|
||||
process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
|
||||
process.env.DASHBOARD_LIVENESS_PROBE = "0";
|
||||
|
||||
const { createApp, startServer } = require("../index");
|
||||
const { db } = require("../db");
|
||||
const auth = require("../lib/auth");
|
||||
|
||||
let server;
|
||||
let BASE;
|
||||
const cookies = {};
|
||||
|
||||
async function get(p, cookie) {
|
||||
const res = await fetch(BASE + p, { headers: cookie ? { cookie } : {} });
|
||||
return { status: res.status, body: await res.json() };
|
||||
}
|
||||
|
||||
async function loginAs(username, password) {
|
||||
const res = await fetch(BASE + "/api/auth/login", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ username, password }),
|
||||
});
|
||||
assert.equal(res.status, 200);
|
||||
return res.headers.get("set-cookie").split(";")[0];
|
||||
}
|
||||
|
||||
/** One session with a main agent, a Skill call, a Bash call and a workflow run. */
|
||||
function seedSession(id, laneId, skill, wfStatus) {
|
||||
db.prepare(
|
||||
`INSERT INTO sessions (id, name, status, cwd, lane_id, started_at, ended_at)
|
||||
VALUES (?, ?, 'completed', '/w', ?, '2026-10-01T00:00:00.000Z', '2026-10-01T00:10:00.000Z')`
|
||||
).run(id, id, laneId);
|
||||
db.prepare(
|
||||
"INSERT INTO agents (id, session_id, name, type, status) VALUES (?, ?, 'Main', 'main', 'completed')"
|
||||
).run(`${id}-main`, id);
|
||||
const ev = db.prepare(
|
||||
"INSERT INTO events (session_id, event_type, tool_name, data) VALUES (?, 'PreToolUse', ?, ?)"
|
||||
);
|
||||
ev.run(id, "Skill", JSON.stringify({ tool_input: { skill } }));
|
||||
ev.run(id, "Bash", null);
|
||||
db.prepare(
|
||||
"INSERT INTO workflows (run_id, session_id, name, status, started_at) VALUES (?, ?, ?, ?, '2026-10-01T00:00:00.000Z')"
|
||||
).run(`wf-${id}`, id, id, wfStatus);
|
||||
}
|
||||
|
||||
before(async () => {
|
||||
server = await startServer(createApp(), 0);
|
||||
BASE = `http://127.0.0.1:${server.address().port}`;
|
||||
const mia = await auth.createUser("mia", "member-pass-1", "member");
|
||||
const max = await auth.createUser("max", "member-pass-2", "member");
|
||||
await auth.createUser("boss", "admin-pass-1", "admin");
|
||||
await auth.createUser("ana", "analyst-pass-1", "analyst");
|
||||
|
||||
const lane = db.prepare("INSERT INTO lanes (cwd, tool, owner_id) VALUES (?, 'claude', ?)");
|
||||
const miaLane = lane.run("/w/mia", mia.id).lastInsertRowid;
|
||||
const maxLane = lane.run("/w/max", max.id).lastInsertRowid;
|
||||
seedSession("m1", miaLane, "mia:one", "completed");
|
||||
seedSession("m2", null, "mia:two", "running"); // not stamped: held by mia's run
|
||||
db.prepare(
|
||||
"INSERT INTO dashboard_runs (id, session_id, mode, cwd, status, lane_id) VALUES (?, 'm2', 'interactive', '/w', 'running', ?)"
|
||||
).run(`agenthub-lane-${miaLane}-1`, miaLane);
|
||||
seedSession("x1", maxLane, "max:one", "failed");
|
||||
seedSession("h1", null, "host:one", "completed"); // nobody's workspace
|
||||
});
|
||||
|
||||
after(() => {
|
||||
delete process.env.AGENTHUB_MODE;
|
||||
server?.close();
|
||||
fs.rmSync(TMP, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
const ALL = ["h1", "m1", "m2", "x1"];
|
||||
|
||||
async function view(cookie) {
|
||||
const wf = await get("/api/workflows?sections=stats,complexity,modelDelegation", cookie);
|
||||
const skills = await get("/api/workflows/skill-usage", cookie);
|
||||
const runs = await get("/api/workflows/runs", cookie);
|
||||
const byStatus = await get("/api/workflows/runs?status=completed", cookie);
|
||||
for (const r of [wf, skills, runs, byStatus]) assert.equal(r.status, 200, JSON.stringify(r));
|
||||
return {
|
||||
wf: wf.body,
|
||||
sessions: wf.body.complexity.map((s) => s.id).sort(),
|
||||
totalSessions: wf.body.stats.totalSessions,
|
||||
totalAgents: wf.body.stats.totalAgents,
|
||||
skills: skills.body.skills.map((s) => s.name).sort(),
|
||||
plugins: skills.body.plugins.map((p) => p.name).sort(),
|
||||
runs: runs.body.runs.map((r) => r.session_id).sort(),
|
||||
total: runs.body.total,
|
||||
counts: runs.body.counts,
|
||||
completed: byStatus.body.runs.map((r) => r.session_id).sort(),
|
||||
completedTotal: byStatus.body.total,
|
||||
};
|
||||
}
|
||||
|
||||
let localView;
|
||||
|
||||
describe("local mode", () => {
|
||||
it("reads every row", async () => {
|
||||
localView = await view();
|
||||
assert.deepEqual(localView.sessions, ALL);
|
||||
assert.equal(localView.totalSessions, 4);
|
||||
assert.equal(localView.totalAgents, 4);
|
||||
assert.deepEqual(localView.skills, ["host:one", "max:one", "mia:one", "mia:two"]);
|
||||
assert.deepEqual(localView.runs, ALL);
|
||||
assert.equal(localView.total, 4);
|
||||
assert.deepEqual(localView.counts, { completed: 2, running: 1, failed: 1 });
|
||||
assert.deepEqual(localView.completed, ["h1", "m1"]);
|
||||
});
|
||||
});
|
||||
|
||||
describe("server mode", () => {
|
||||
before(async () => {
|
||||
process.env.AGENTHUB_MODE = "server";
|
||||
cookies.mia = await loginAs("mia", "member-pass-1");
|
||||
cookies.max = await loginAs("max", "member-pass-2");
|
||||
cookies.boss = await loginAs("boss", "admin-pass-1");
|
||||
cookies.ana = await loginAs("ana", "analyst-pass-1");
|
||||
});
|
||||
|
||||
it("shows a member only their own sessions in every number", async () => {
|
||||
const v = await view(cookies.mia);
|
||||
assert.deepEqual(v.sessions, ["m1", "m2"]);
|
||||
assert.equal(v.totalSessions, 2);
|
||||
assert.equal(v.totalAgents, 2);
|
||||
assert.deepEqual(v.skills, ["mia:one", "mia:two"]);
|
||||
assert.deepEqual(v.plugins, ["mia"]);
|
||||
assert.deepEqual(v.runs, ["m1", "m2"]);
|
||||
assert.equal(v.total, 2);
|
||||
assert.deepEqual(v.counts, { completed: 1, running: 1 });
|
||||
assert.deepEqual(v.completed, ["m1"]);
|
||||
assert.equal(v.completedTotal, 1);
|
||||
});
|
||||
|
||||
it("shows another member theirs", async () => {
|
||||
const v = await view(cookies.max);
|
||||
assert.deepEqual(v.sessions, ["x1"]);
|
||||
assert.equal(v.totalSessions, 1);
|
||||
assert.deepEqual(v.skills, ["max:one"]);
|
||||
assert.deepEqual(v.runs, ["x1"]);
|
||||
assert.deepEqual(v.counts, { failed: 1 });
|
||||
assert.deepEqual(v.completed, []);
|
||||
});
|
||||
|
||||
it("refuses a member another member's session filter", async () => {
|
||||
const r = await get("/api/workflows/runs?session_id=x1", cookies.mia);
|
||||
assert.equal(r.status, 404);
|
||||
});
|
||||
|
||||
it("shows an admin and an analyst exactly what local mode shows", async () => {
|
||||
for (const who of ["boss", "ana"]) {
|
||||
const v = await view(cookies[who]);
|
||||
assert.deepEqual({ ...v, wf: null }, { ...localView, wf: null });
|
||||
assert.deepEqual(v.wf.stats, localView.wf.stats);
|
||||
assert.deepEqual(v.wf.modelDelegation, localView.wf.modelDelegation);
|
||||
}
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user