Fix datetime picker and supervisor review regressions

Author: pallyoung

packages/server/src/__tests__/supervisor-manager.test.ts

@@ -540,6 +540,28 @@ describe("SupervisorManager cycle triggers", () => {
     expect(manager.get(supervisor.id)?.scheduledAt).toBeUndefined();
   });
 
+  it("consumes an overdue scheduledAt when turn_completed runs first", async () => {
+    const supervisor = await manager.create({
+      sessionId: "sess-overdue-turn-completed",
+      workspaceId: "ws-1",
+      objective: "Ship the fix",
+      evaluatorProviderId: "codex",
+      scheduledAt: Date.now() - 1_000,
+    });
+
+    const managerInternals = getManagerInternals();
+    const evaluate = vi.spyOn(managerInternals.evaluator, "evaluate");
+
+    const first = await managerInternals.runEvaluation(supervisor.id, "turn_completed");
+    const second = await managerInternals.runEvaluation(supervisor.id, "scheduled");
+
+    expect(first?.trigger).toBe("turn_completed");
+    expect(second).toBeNull();
+    expect(manager.get(supervisor.id)?.scheduledAt).toBeUndefined();
+    expect(manager.get(supervisor.id)?.cycles).toHaveLength(1);
+    expect(evaluate).toHaveBeenCalledTimes(1);
+  });
+
   it("retries a due scheduled run until the session becomes runnable", async () => {
     vi.useFakeTimers();
     let sessionState: Session["state"] = "starting";

packages/server/src/app-routing.test.ts

@@ -46,7 +46,10 @@ describe("app routing", () => {
     rmSync(tempDir, { recursive: true, force: true });
   });
 
-  const createApp = async (authEnabled = false): Promise<FastifyInstance> => {
+  const createApp = async (
+    authEnabled = false,
+    extraConfig: Record<string, unknown> = {}
+  ): Promise<FastifyInstance> => {
     const eventBus = new EventBus();
     const fencingMgr = new FencingManager();
     const config = {
@@ -60,6 +63,7 @@ describe("app routing", () => {
         enabled: authEnabled,
         password: authEnabled ? "sekrit" : undefined,
       },
+      ...extraConfig,
     };
     const wsHub = new WsHub({
       eventBus,
@@ -173,6 +177,20 @@ describe("app routing", () => {
     expect(response.body).toContain('<div id="root">shell</div>');
   });
 
+  it("does not emit a CSP header for the built entrypoint response", async () => {
+    const instance = await createApp();
+
+    const response = await instance.inject({
+      method: "GET",
+      url: "/index.html",
+      headers: {
+        accept: "text/html",
+      },
+    });
+
+    expect(response.headers["content-security-policy"]).toBeUndefined();
+  });
+
   it("serves headers for the built entrypoint on HEAD /index.html", async () => {
     const instance = await createApp();
 

packages/server/src/app.ts

@@ -87,34 +87,6 @@ export async function buildFastifyApp(deps: AppDeps): Promise<FastifyInstance> {
     })
   );
 
-  // CSP Header Injection (optional, controlled by `relaxCsp` config)
-  //
-  // xterm.js and Monaco Editor internally use `eval` and `new Function` for
-  // performance optimizations (e.g., JIT-compiled rendering loops). When a
-  // browser extension (e.g., uBlock Origin, AdGuard) injects a strict CSP,
-  // these libraries silently fail:
-  // - xterm.js: terminal shows only "[Process exited with code 0]"
-  // - Monaco Editor: code editor panel renders blank
-  //
-  // When `relaxCsp: true`, we inject a permissive CSP header that allows
-  // 'unsafe-eval' and 'unsafe-inline', plus WebSocket connections (ws:/wss:).
-  // This is intended for local development scenarios where browser extensions
-  // interfere. For production, leave this disabled and configure CSP at the
-  // reverse proxy level.
-  if (deps.config.relaxCsp) {
-    app.addHook("onRequest", async (_request, reply) => {
-      reply.header(
-        "Content-Security-Policy",
-        "default-src 'self'; " +
-          "script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
-          "style-src 'self' 'unsafe-inline'; " +
-          "connect-src 'self' ws: wss:; " +
-          "img-src 'self' data: blob:; " +
-          "font-src 'self' data:;"
-      );
-    });
-  }
-
   await app.register(compress);
 
   await app.register(multipart, {

packages/server/src/config.ts

@@ -18,7 +18,6 @@ export interface ServerConfig {
   dataDir: string;
   uploadsDir: string;
   logLevel: "trace" | "debug" | "info" | "warn" | "error";
-  relaxCsp: boolean;
   webRoot?: string;
   appVersion?: string;
   auth: {
@@ -122,7 +121,6 @@ export function parseServerConfig(overrides?: Partial<ServerConfig>): ServerConf
     dataDir,
     uploadsDir,
     logLevel: overrides?.logLevel ?? parseLogLevel(process.env.LOG_LEVEL) ?? "info",
-    relaxCsp: overrides?.relaxCsp ?? process.env.RELAX_CSP === "true",
     webRoot: overrides?.webRoot,
     appVersion:
       overrides?.appVersion ?? process.env.CODER_STUDIO_APP_VERSION ?? resolveDefaultAppVersion(),

packages/server/src/supervisor/manager.ts

@@ -620,10 +620,17 @@ export class SupervisorManager {
         return null;
       }
 
+      const shouldConsumeScheduledAt =
+        trigger === "scheduled" ||
+        (trigger === "turn_completed" &&
+          supervisor.scheduledAt !== undefined &&
+          supervisor.scheduledAt !== null &&
+          supervisor.scheduledAt <= Date.now());
+
       const evaluatingSupervisor = this.attachCycles(
         this.deps.supervisorRepo.update(supervisor.id, {
           state: "evaluating",
-          scheduledAt: trigger === "scheduled" ? null : (supervisor.scheduledAt ?? undefined),
+          scheduledAt: shouldConsumeScheduledAt ? null : (supervisor.scheduledAt ?? undefined),
           stopReason: null,
           errorReason: null,
           updatedAt: Date.now(),