Something pulling at your attention? Park it here so it's out of your head — deal with it later, not now.
+ + +Every step you log lands here, newest first. Starting counts. Small wins count.
+ + +progress saves to a file your AI partner can read · 🔥 built with Ember
+board.html asset is missing.
"; } + let canonicalHost = null; + + const server = createServer(async (req, res) => { + try { + // Host pin first: reject anything not addressed to the exact loopback + // authority we bound (defeats DNS rebinding for reads and writes alike). + if (canonicalHost && !isCanonicalHost(req, canonicalHost)) { + res.writeHead(403, JSON_HEADERS); + res.end(JSON.stringify({ ok: false, error: "bad_host" })); + return; + } + const url = new URL(req.url, `http://${req.headers.host}`); + + // Every /api/* route (read AND write) requires the capability token, so + // GET /api/state can't leak task data and POSTs can't be forged. Writes + // additionally reject cross-site browser requests. + if (url.pathname.startsWith("/api/")) { + if (!hasToken(req, token)) { + res.writeHead(403, JSON_HEADERS); + res.end(JSON.stringify({ ok: false, error: "missing_capability_token" })); + return; + } + if (req.method === "POST" && isCrossSiteRequest(req)) { + res.writeHead(403, JSON_HEADERS); + res.end(JSON.stringify({ ok: false, error: "cross_site_blocked" })); + return; + } + } + + if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/index.html")) { + res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }); + res.end(boardHtml); + return; + } + if (req.method === "GET" && url.pathname === "/api/state") { + const doc = await loadDoc(stateFile); + res.writeHead(200, JSON_HEADERS); + res.end(JSON.stringify({ ok: true, state: doc })); + return; + } + if (req.method === "POST" && url.pathname.startsWith("/api/")) { + const body = await readBody(req); + const result = await handleApi(stateFile, url.pathname.slice(5), body); + res.writeHead(result && result.error ? 400 : 200, JSON_HEADERS); + res.end(JSON.stringify(result)); + return; + } + res.writeHead(404, JSON_HEADERS); + res.end(JSON.stringify({ ok: false, error: "not_found" })); + } catch { + if (!res.headersSent) { res.writeHead(500, JSON_HEADERS); res.end(JSON.stringify({ ok: false, error: "internal_error" })); } + else { try { res.end(); } catch { /* already gone */ } } + } + }); + + await new Promise((resolve, reject) => { + const onError = (err) => { server.removeListener("listening", onListening); reject(err); }; + const onListening = () => { server.removeListener("error", onError); resolve(); }; + server.once("error", onError); + server.once("listening", onListening); + server.listen(0, "127.0.0.1"); + }); + const addr = server.address(); + const port = addr && typeof addr === "object" ? addr.port : 0; + canonicalHost = `127.0.0.1:${port}`; + return { server, url: `http://127.0.0.1:${port}/`, token }; +} + +// --- state file resolution + demo seed -------------------------------------- + +export function demoSeed() { + return { + name: "", + dateKey: todayKey(), + tasks: [ + { id: "steps", emoji: "🚶", title: "Walk 10,000 steps", goal: 10000, start: 0, inc: 1000, unit: "steps", tag: "body", tagc: "new" }, + { id: "deep", emoji: "⚙️", title: "Two hours of deep work", sub: "the thing that moves the needle", tag: "anchor", tagc: "deadline" }, + { id: "read", emoji: "📖", title: "Read a chapter", tag: "mind" }, + ], + }; +} + +// Resolve the state file path from (untrusted-ish) input. Defaults to a +// date-scoped file in cwd so reopening the board tomorrow starts a fresh day +// instead of silently reusing today's date/tasks/progress; an explicit path is +// used as-is (the caller owns its lifecycle). If an existing directory is given, +// place a date-scoped file inside it. +export async function resolveStateFile(p) { + if (typeof p === "string" && p.trim()) { + let file = isAbsolute(p) ? p : join(process.cwd(), p); + try { const s = await stat(file); if (s.isDirectory()) file = join(file, `focus-board-${todayKey()}.json`); } catch { /* not yet created */ } + return file; + } + return join(process.cwd(), `focus-board-${todayKey()}.json`); +} + +// A parsed value we're willing to treat as an existing board — so we never adopt +// (and then overwrite on first mutation) an unrelated file the caller pointed at. +export function looksLikeBoard(o) { + return !!o && typeof o === "object" && !Array.isArray(o) + && (o.kind === BOARD_MARKER || (Array.isArray(o.tasks) && !!o.progress && typeof o.progress === "object")); +} + +// Create + seed the state file if it doesn't exist yet. If it DOES exist, refuse +// to use it unless it's clearly one of our boards (a marker or the board schema), +// so an externally supplied stateFile can't cause us to clobber an unrelated file. +export async function ensureStateFile(inputPath, seed) { + const file = await resolveStateFile(inputPath); + if (existsSync(file)) { + let parsed; + try { parsed = JSON.parse(await readFile(file, "utf-8")); } + catch { throw new Error(`refusing to use existing non-JSON file as a focus board: ${file}`); } + if (!looksLikeBoard(parsed)) throw new Error(`refusing to use an existing file that is not a daily-focus-board: ${file}`); + return file; + } + const doc = normalize(seed && typeof seed === "object" ? seed : demoSeed()); + doc.updatedAt = new Date().toISOString(); + await mkdir(dirname(file), { recursive: true }).catch(() => {}); + await atomicWrite(file, doc); + return file; +} diff --git a/extensions/daily-focus-board/extension.mjs b/extensions/daily-focus-board/extension.mjs new file mode 100644 index 00000000..65cbfce8 --- /dev/null +++ b/extensions/daily-focus-board/extension.mjs @@ -0,0 +1,175 @@ +// Extension: daily-focus-board +// Renders the daily focus board as a GHCP canvas, backed by a JSON state file +// that both the canvas UI and the AI partner read and write. All the real logic +// (server, state, mutations, recap) lives in board-core.mjs so it can be tested +// without the SDK; this file only wires the canvas/session lifecycle + actions. + +import { joinSession, createCanvas } from "@github/copilot-sdk/extension"; +import { + startServer, ensureStateFile, loadDoc, mutate, recapMarkdown, + opStatus, opNote, opCount, opCarry, opFocus, opAddTask, +} from "./board-core.mjs"; + +// instanceId -> { server, url, stateFile } +const servers = new Map(); + +// Run a mutation for the canvas instance and return { ok, state } / { error }. +async function act(ctx, fn) { + const entry = servers.get(ctx.instanceId); + if (!entry) return { error: "Board not open" }; + return await mutate(entry.stateFile, fn); +} +async function read(ctx) { + const entry = servers.get(ctx.instanceId); + if (!entry) return null; + return await loadDoc(entry.stateFile); +} + +const session = await joinSession({ + canvases: [ + createCanvas({ + id: "daily-focus-board", + displayName: "Daily Focus Board", + description: "A warm, executive-function-friendly daily focus board backed by a JSON file you and your AI partner both read and write. Tasks (to-do -> in progress -> done) with progress notes, numeric counters, Focus mode, kind 'not today' carryover, a brain-dump box, reduced motion, and a live clock.", + inputSchema: { + type: "object", + properties: { + stateFile: { + type: "string", + description: "Absolute path to the board's JSON state file. Seeded if it doesn't exist yet. Defaults to a date-scoped focus-board-Just notice where you're arriving — no wrong answer.
+Something pulling at your attention? Park it here so it's out of your head — deal with it later, not now.
+ + +Every step you log lands here, newest first. Starting counts. Small wins count.
+ + +Save the day's progress — keep the recap, or paste it to Ember to journal today and plan tomorrow.
+progress saves automatically in this browser · 🔥 built with Ember
+