chore(release): 0.39.8 [skip ci]

## [0.39.8](https://github.com/sasjs/server/compare/v0.39.7...v0.39.8) (2026-07-15)

### Bug Fixes

* **api:** return 200 with embedded log on SAS session failure instead of 400 ([8506950](https://github.com/sasjs/server/commit/850695024f4b7102982c197ec64b5bb45e7d5f90))

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/build.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:
@@ -28,7 +28,7 @@ jobs:
         run: npm run lint-web
 
   build-api:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:
@@ -66,7 +66,7 @@ jobs:
           CI: true
 
   build-web:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:

.npmrc

@@ -0,0 +1 @@
+ignore-scripts=true

.vscode/settings.json

@@ -1,5 +1,3 @@
 {
-  "cSpell.words": [
-    "autoexec"
-  ]
+  "cSpell.words": ["autoexec", "initialising"]
 }

CHANGELOG.md

@@ -1,3 +1,93 @@
+## [0.39.8](https://github.com/sasjs/server/compare/v0.39.7...v0.39.8) (2026-07-15)
+
+
+### Bug Fixes
+
+* **api:** return 200 with embedded log on SAS session failure instead of 400 ([8506950](https://github.com/sasjs/server/commit/850695024f4b7102982c197ec64b5bb45e7d5f90))
+
+## [0.39.7](https://github.com/sasjs/server/compare/v0.39.6...v0.39.7) (2026-07-14)
+
+
+### Bug Fixes
+
+* **jsonwebtoken:** bumped version to avoid vulnerability ([1473925](https://github.com/sasjs/server/commit/1473925896db0e4472c9ef5ba64955527a1be2de))
+
+## [0.39.6](https://github.com/sasjs/server/compare/v0.39.5...v0.39.6) (2026-07-14)
+
+
+### Bug Fixes
+
+* **api:** isolate drive.spec.ts's files folder from the real drive ([dec5191](https://github.com/sasjs/server/commit/dec51914911c10b66b43ebe95f77b0af63e2d03e))
+* **api:** stop overwriting a failed JS/PY/R session back to completed ([4858245](https://github.com/sasjs/server/commit/4858245372fa19929b6e59c28148f5d004239c9d))
+
+## [0.39.5](https://github.com/sasjs/server/compare/v0.39.4...v0.39.5) (2026-07-14)
+
+
+### Bug Fixes
+
+* **api:** harden mock SAS executable and timeouts for CI ([67fce47](https://github.com/sasjs/server/commit/67fce475a3c53b3c20919902edb45dce809dffb9))
+* **api:** return prompt error response instead of hanging when a SAS session fails ([f84af4a](https://github.com/sasjs/server/commit/f84af4ac0639625fee4508e764f0eed07d7b4e8a))
+* fix code.spec.ts failing on a fresh checkout (CI) ([0af6b63](https://github.com/sasjs/server/commit/0af6b63ffa770bfa2b77505d74778be517f8d631))
+
+## [0.39.4](https://github.com/sasjs/server/compare/v0.39.3...v0.39.4) (2025-12-21)
+
+
+### Bug Fixes
+
+* **deps:** bump dependencies and resolve audit issues ([4f78202](https://github.com/sasjs/server/commit/4f782025dbcdfcbae6ca1fabb42ce1bc385e0162))
+
+## [0.39.3](https://github.com/sasjs/server/compare/v0.39.2...v0.39.3) (2025-11-25)
+
+
+### Bug Fixes
+
+* (deps) bump @sasjs/core to 4.59.7 ([ab96653](https://github.com/sasjs/server/commit/ab966535642d08d4e8e984007b98c8fdffbe30f7))
+* (deps) rerun npm i to sync ([225f381](https://github.com/sasjs/server/commit/225f381bdf8ad5aa2af8d75648df1dd5175e12e0))
+
+## [0.39.2](https://github.com/sasjs/server/compare/v0.39.1...v0.39.2) (2025-09-25)
+
+
+### Bug Fixes
+
+* addressing test fail ([e51b204](https://github.com/sasjs/server/commit/e51b20421adc1598ea267c79b1fb4dbc085f97b9))
+* packages missmatch ([379ea60](https://github.com/sasjs/server/commit/379ea604bcb5686b5299fae6a32f759c45b275ea))
+* type libs ([6d123c3](https://github.com/sasjs/server/commit/6d123c3e23628c1d703eaa13142c77f0da970a55))
+* typescript errors ([631e956](https://github.com/sasjs/server/commit/631e95604b64b1a96f2abade659348618f3b00b2))
+* typescript errors ([198cd79](https://github.com/sasjs/server/commit/198cd79354254511c21ac1acfbf7b6bcfdab2af7))
+
+## [0.39.1](https://github.com/sasjs/server/compare/v0.39.0...v0.39.1) (2025-03-13)
+
+
+### Bug Fixes
+
+* extra bit of sleep for file recognition ([f4768bf](https://github.com/sasjs/server/commit/f4768bffd3dbb2fe243966572ba74002024d96e1)), closes [#381](https://github.com/sasjs/server/issues/381)
+
+# [0.39.0](https://github.com/sasjs/server/compare/v0.38.0...v0.39.0) (2024-10-31)
+
+
+### Bug Fixes
+
+* **api:** fixed condition in processProgram ([48a9a4d](https://github.com/sasjs/server/commit/48a9a4dd0e31f84209635382be4ec4bb2c3a9c0c))
+
+
+### Features
+
+* **api:** added session state endpoint ([6b6546c](https://github.com/sasjs/server/commit/6b6546c7ad0833347f8dc4cdba6ad19132f7aaef))
+
+# [0.38.0](https://github.com/sasjs/server/compare/v0.37.0...v0.38.0) (2024-10-30)
+
+
+### Features
+
+* **api:** enabled query params in stp/trigger endpoint ([5cda9cd](https://github.com/sasjs/server/commit/5cda9cd5d8623b7ea2ecd989d7808f47ec866672))
+
+# [0.37.0](https://github.com/sasjs/server/compare/v0.36.0...v0.37.0) (2024-10-29)
+
+
+### Features
+
+* **stp:** added trigger endpoint ([b0723f1](https://github.com/sasjs/server/commit/b0723f14448d60ffce4f2175cf8a73fc4d4dd0ee))
+
 # [0.36.0](https://github.com/sasjs/server/compare/v0.35.4...v0.36.0) (2024-10-29)
 
 

api/docs/diagrams/code-execution-overview.md

@@ -0,0 +1,39 @@
+# Code execution & session diagrams
+
+Mermaid diagrams describing how `@sasjs/server` executes submitted code
+(SAS/JS/PY/R) against pooled "sessions". Written for fast context-loading by
+an AI coding agent: each diagram is self-contained, node/edge labels carry
+the actual file:line references, and prose is kept to the minimum needed to
+disambiguate the diagram.
+
+| File | Covers |
+|---|---|
+| [session-lifecycle.md](session-lifecycle.md) | `SessionState` state machine; how it differs between the SAS runtime and the JS/PY/R runtimes |
+| [sas-execution-handshake.md](sas-execution-handshake.md) | The SYSIN/AUTOEXEC file-swap mechanism a SAS session uses to turn one long-lived `sas` process into a single-use execution slot |
+| [request-execution-flow.md](request-execution-flow.md) | End-to-end flowchart from HTTP request to response, covering session-pool acquisition and both runtime branches (SAS vs JS/PY/R) |
+
+## Core concept
+
+A "session" is not a request-scoped object. It is a pooled, reusable
+execution slot with a filesystem folder (`session.path`) and a state
+(`SessionState`). For the SAS runtime specifically, a session also owns one
+real OS process, spawned at session-*creation* time and consumed by exactly
+one code submission (see `sas-execution-handshake.md`). For JS/PY/R, a
+session is just an ID + folder; the actual interpreter process is spawned
+fresh per request inside `processProgram`.
+
+## Key source files
+
+- `api/src/controllers/internal/Session.ts` — session pool + lifecycle
+  (`SessionController`, `SASSessionController`), `SessionState` transitions.
+- `api/src/controllers/internal/processProgram.ts` — writes the submitted
+  code into the session and drives it to completion/failure, per runtime.
+- `api/src/controllers/internal/Execution.ts` — `ExecutionController`,
+  the entry point controllers call; acquires a session, calls
+  `processProgram`, reads back `log.log`/`webout.txt`/headers, and builds
+  the HTTP response. A failed session (any runtime) is embedded in that
+  same response, not thrown as a separate error.
+- `api/src/controllers/internal/create{SAS,JS,Python,R}Program.ts` —
+  per-runtime code templating (wraps the user's submitted code with
+  boilerplate: variable injection, `_webout` redirection, etc).
+- `api/src/types/Session.ts` — `SessionState` enum and `Session` interface.

api/docs/diagrams/request-execution-flow.md

@@ -0,0 +1,69 @@
+# Request execution flow (end-to-end)
+
+Full path from an inbound HTTP request to the HTTP response, covering
+session-pool acquisition and the two structurally different runtime
+branches: SAS (reuses a parked long-lived process) vs JS/PY/R (spawns a
+fresh interpreter process per request).
+
+```mermaid
+flowchart TD
+    A["HTTP request<br/>POST /SASjsApi/code/execute<br/>or /SASjsApi/stp/execute"] --> B["Controller<br/>code.ts / stp.ts<br/>try/catch wrapper"]
+    B --> C["ExecutionController.executeProgram<br/>or .executeFile<br/>Execution.ts:40-77"]
+    C --> D{"session already provided?<br/>(e.g. file-upload flow)"}
+    D -- no --> E["getSessionController(runTime).getSession()<br/>Session.ts:59-69"]
+    D -- yes --> F["use provided session"]
+    E --> G{"pending session<br/>available in pool?"}
+    G -- yes --> H["reuse it"]
+    G -- no --> I["createSession()<br/>SAS: spawns a real sas process, see<br/>sas-execution-handshake.md<br/>JS/PY/R: cheap - folder + id only"]
+    H --> J["pre-warm: if pool has fewer<br/>than 3 pending, fire off more<br/>createSession() calls (not awaited)<br/>Session.ts:66"]
+    I --> J
+    F --> K
+    J --> K["session.state = running<br/>Execution.ts:78"]
+    K --> L["write webout.txt (empty),<br/>reqHeaders.txt<br/>Execution.ts:85-89"]
+    L --> M["processProgram(...)<br/>Execution.ts:96-107"]
+
+    M --> N{"runTime?"}
+
+    N -- SAS --> O["createSASProgram():<br/>wrap user code with _webout<br/>filename, macro vars, autoexec"]
+    O --> P["write code.sas via .bkp + rename<br/>processProgram.ts:48-49"]
+    P --> Q["poll: while state !== completed<br/>AND state !== failed<br/>processProgram.ts:58-63"]
+    Q --> R["processProgram() resolves either way -<br/>state was set by the session's own<br/>process exit handler in Session.ts,<br/>see sas-execution-handshake.md"]
+
+    N -- "JS / PY / R" --> T["createJSProgram / createPythonProgram /<br/>createRProgram: wrap user code similarly"]
+    T --> U["write code file; spawn interpreter<br/>fresh via execFile; pipe stdout/stderr<br/>into a log.log write stream<br/>processProgram.ts:117-124"]
+    U -- "exit 0" --> Uc["session.state = completed<br/>processProgram.ts:126"]
+    U -- "exit non-zero" --> Uf["session.state = failed<br/>session.failureReason = err.toString()<br/>processProgram.ts:131-133"]
+    Uc --> R
+    Uf --> R
+
+    R --> V["read log.log, webout.txt,<br/>stpsrv_header.txt<br/>Execution.ts:109-113, 121-125"]
+    V --> W["guard: if state !== failed,<br/>set state = completed<br/>(don't overwrite a failed session)<br/>Execution.ts:127-137"]
+    W --> X["build httpHeaders + result;<br/>embed log in result if<br/>isDebugOn(vars) or<br/>session.failureReason is set<br/>Execution.ts:139-164"]
+    X --> Y["Controller: res.send(result)<br/>HTTP 200<br/>(log embedded if the session failed -<br/>same shape as a successful run)"]
+```
+
+## Notes
+
+- **Session pool is per-runtime.** SAS sessions and JS/PY/R sessions live in
+  separate controllers/pools (`process.sasSessionController` vs
+  `process.sessionController`, `Session.ts:239-253`) - a pending SAS session
+  is never handed out for a JS request or vice versa.
+- **The SAS branch and the JS/PY/R branch converge** on the same
+  success/failure signal shape: `session.state` becomes `completed` or
+  `failed` either way, and both paths flow through the same log/webout
+  reading logic in `Execution.ts` afterward. The mechanics of *how* that
+  state gets set differ substantially (see `session-lifecycle.md`).
+- **A failed session never throws.** `processProgram()` resolves normally
+  whether the session completed or failed - a failed session (e.g. SAS
+  `%abort;`, or a non-zero JS/PY/R exit) is a normal outcome of running
+  arbitrary user code, not a request-shape/server problem. There is no
+  separate error path: the same `Execution.ts:139-164` logic that embeds
+  the log for a debug-mode successful run also embeds it when
+  `session.failureReason` is set, and the controller always responds 200.
+- **`includePrintOutput`** (SAS only) additionally appends `output.lst`
+  content to the result when debug mode is on - omitted above for brevity;
+  see `Execution.ts:149-156`.
+- **`triggerProgram`/`triggerCode`** (fire-and-forget variants, not shown)
+  call the same `ExecutionController` methods without awaiting them and
+  immediately return `{ sessionId }`; the client polls
+  `GET /SASjsApi/session/{sessionId}/state` separately.

api/docs/diagrams/sas-execution-handshake.md

@@ -0,0 +1,81 @@
+# SAS session execution handshake
+
+How one long-lived `sas` process is turned into a single-use execution slot
+via a SYSIN file-swap trick. This is the mechanism specific to
+`RunTimeType.SAS`; JS/PY/R sessions spawn a fresh interpreter process per
+request instead (see `request-execution-flow.md`).
+
+```mermaid
+sequenceDiagram
+    participant Client as HTTP client
+    participant Ctrl as Controller<br/>(code.ts / stp.ts)
+    participant Exec as ExecutionController<br/>(Execution.ts)
+    participant Pool as SASSessionController<br/>(Session.ts)
+    participant FS as Filesystem<br/>(session.path)
+    participant SAS as spawned "sas" process
+
+    Note over Pool,SAS: SESSION CREATION - happens ahead of any request,<br/>pool pre-warms up to 3 sessions (Session.ts:59-69)
+    Pool->>FS: createFile(code.sas, "") - empty dummy SYSIN (Session.ts:117-118)
+    Pool->>FS: readFile(sysInitCompiledPath) - compiled system-init<br/>macros, produced by `npm run compileSysInit` (Session.ts:105)
+    Note over Pool: throws if this file doesn't exist yet -<br/>session creation never reaches execFile below
+    Pool->>FS: createFile(autoexec.sas, autoExecContent) (Session.ts:108-114)
+    Pool->>SAS: execFile(sasLoc, -SYSIN code.sas -AUTOEXEC autoexec.sas -LOG log.log ...) (Session.ts:127-147)
+    activate SAS
+    Note right of SAS: process stays active (this box)<br/>from spawn until it finally exits below
+    SAS->>FS: autoexec step 1: delete code.sas, the dummy SYSIN (Session.ts:257-261)
+    Pool->>FS: waitForSession() polls fileExists(code.sas) (Session.ts:175-192)
+    FS-->>Pool: code.sas no longer exists
+    Pool->>Pool: session.state = pending (Session.ts:190)
+    SAS->>SAS: autoexec step 2: busy-wait for code.sas to reappear,<br/>up to 15 minutes (Session.ts:263-274)
+    Note over SAS: process is now idle, parked mid-autoexec,<br/>waiting on the filesystem.<br/>Counts as "pending" in the pool.
+
+    Note over Client,SAS: REQUEST ARRIVES - reuses the parked process above
+    Client->>Ctrl: POST .../execute { code, runTime: sas }
+    Ctrl->>Exec: executeProgram({ program, runTime: SAS, ... })
+    Exec->>Pool: getSession() returns the pending session (Session.ts:59-69)
+    Exec->>Exec: session.state = running (Execution.ts:78)
+    Exec->>FS: createFile(webout.txt, "") and createFile(reqHeaders.txt, ...) (Execution.ts:85-89)
+    Exec->>Pool: processProgram(program, session, ...) (Execution.ts:96-107)
+    Pool->>FS: createSASProgram() wraps user code with macro vars,<br/>_webout filename, autoexec injection (createSASProgram.ts)
+    Pool->>FS: write code.sas.bkp, then rename to code.sas (processProgram.ts:48-49)
+    Note over FS: write-then-rename, not a direct write,<br/>so SAS never reads a partial file
+
+    FS-->>SAS: code.sas exists again
+    SAS->>SAS: autoexec step 2 loop exits, sleeps 0.01s, autoexec ends (Session.ts:267-271)
+    Note over SAS: -SYSIN has pointed at code.sas from the start,<br/>so SAS now executes ITS CONTENT as the main job
+    SAS->>FS: writes log.log, output.lst, webout.txt while running
+
+    Pool->>Pool: processProgram poll loop:<br/>while state !== completed AND state !== failed (processProgram.ts:58-63)
+
+    alt program reaches EOF normally
+        SAS->>SAS: exits with code 0
+        SAS-->>Pool: execFilePromise resolves - .then() (Session.ts:148-152)
+        Pool->>Pool: session.state = completed
+    else program aborts (e.g. %abort, fatal error, license failure, hard STOP)
+        SAS->>SAS: exits with non-zero code
+        SAS-->>Pool: execFilePromise rejects - .catch() (Session.ts:153-163)
+        Pool->>Pool: session.state = failed<br/>session.failureReason = err.toString()
+    end
+    deactivate SAS
+    Note over Pool,Exec: either way processProgram() just RESOLVES here -<br/>a failed session is a normal outcome of running user<br/>code, not a request-shape/server problem, so it never throws<br/>(processProgram.ts:58-63, same as the JS/PY/R branch below)
+
+    Exec->>FS: read log.log, webout.txt, stpsrv_header.txt (Execution.ts:109-112, 121-125)
+    Note over Exec: if session.failureReason is set, the log is folded into<br/>result the same way isDebugOn(vars) already does for a<br/>successful run - no separate error shape (Execution.ts:158-164)
+    Exec-->>Ctrl: { httpHeaders, result }
+    Ctrl-->>Client: 200 + result<br/>(log embedded in result if the session failed)
+```
+
+## Why this design
+
+- SAS has meaningful startup cost (loading the engine, running system init
+  macros). Spawning a fresh `sas` process per request would pay that cost
+  every time. Instead, a process is spawned once and parked, ready to run
+  exactly one job the moment code shows up at a path it's already watching.
+- The pool (`SessionController.getSession`, `Session.ts:59-69`) keeps up to
+  3 such parked processes ready, so most requests get an instant handoff
+  instead of waiting through the ~15-minute autoexec spin-wait or a cold
+  start.
+- A session is single-use: once its process consumes the real SYSIN content
+  and exits (success or failure), that process is gone. The session object
+  itself is deleted later by `scheduleSessionDestroy` (`Session.ts:204-236`),
+  not reused for a second job.

api/docs/diagrams/session-lifecycle.md

@@ -0,0 +1,77 @@
+# Session lifecycle (`SessionState`)
+
+Enum defined in `api/src/types/Session.ts`. A `Session` is `{ id, state,
+path, creationTimeStamp, deathTimeStamp, expiresAfterMins?, failureReason? }`.
+Sessions live in an in-memory array on a per-runtime singleton controller
+(`process.sasSessionController` for SAS, `process.sessionController` shared
+by JS/PY/R — see `getSessionController()` in `Session.ts:239-253`).
+
+```mermaid
+stateDiagram-v2
+    [*] --> initialising: SAS runtime<br/>SASSessionController.createSession()<br/>Session.ts:77-95
+    [*] --> pending: JS/PY/R runtime, no process yet<br/>SessionController.createSession()<br/>Session.ts:30-57
+
+    initialising --> pending: dummy SYSIN file deleted<br/>by SAS's autoexec<br/>waitForSession(), Session.ts:175-192
+    initialising --> failed: spawned SAS process exits<br/>before handshake completes<br/>Session.ts:153-163, 184-188
+
+    pending --> running: session picked for a request<br/>executeProgram(), Execution.ts:76-78
+
+    running --> completed: process exits 0<br/>SAS: Session.ts:148-152 (original process)<br/>JS/PY/R: processProgram.ts:124-129 (fresh process)
+    running --> failed: process exits non-zero<br/>SAS: Session.ts:153-163<br/>JS/PY/R: processProgram.ts:130-135<br/>failureReason = err.toString()<br/>neither branch throws - see request-execution-flow.md
+
+    completed --> [*]: deleteSession()<br/>scheduleSessionDestroy(), Session.ts:194-236
+    failed --> [*]: deleteSession()<br/>scheduleSessionDestroy()
+
+    note right of initialising
+        SAS only. The real sas
+        executable is already
+        running, spin-waiting
+        inside its AUTOEXEC for
+        real code to arrive.
+        See sas-execution-handshake.md
+    end note
+
+    note right of pending
+        Session sits in the pool,
+        reusable. Pre-warmed up to
+        3 pending sessions per
+        runtime (getSession(),
+        Session.ts:59-69)
+    end note
+
+    note right of running
+        SAS: no new process spawned
+        here, request just feeds
+        code to the already-running
+        process.
+        JS/PY/R: a brand new
+        interpreter process is
+        spawned right now.
+    end note
+```
+
+## Consumers of `state`
+
+| Reader | Location | Watches for |
+|---|---|---|
+| `waitForSession` | `Session.ts:175-192` | `failed` (breaks early) or the dummy SYSIN file disappearing (implies session survived init) |
+| `processProgram` (SAS branch poll loop) | `processProgram.ts:58-63` | `completed` or `failed` - either just stops the loop and returns normally; `failed` does **not** throw. `Execution.ts` reads `session.failureReason` afterward to fold the log into a normal (200) result, same as it already does for JS/PY/R. |
+| `scheduleSessionDestroy` | `Session.ts:204-236` | `running` (extends death timer instead of destroying) |
+
+## Asymmetry between runtimes
+
+- **SAS**: one OS process per session, spawned once at `createSession()`
+  time and reused for exactly one job (see `sas-execution-handshake.md`).
+  `running`/`completed`/`failed` are all driven by that *same* process's
+  eventual exit.
+- **JS/PY/R**: a session is cheap (folder + id, no process). The interpreter
+  process is spawned fresh, per request, inside `processProgram.ts:124` and
+  its exit drives `completed`/`failed` directly in the same function - there
+  is no separate poll loop for these runtimes (SAS needs one because it's
+  polling a state change happening in a process spawned earlier, at session
+  creation; JS/PY/R just `await` the process they spawn right there).
+- **Both runtimes resolve `processProgram()` normally on `failed`, they
+  never throw for it** - a failed session (any runtime) is a normal outcome
+  of running arbitrary user code, not a request-shape/server problem. See
+  `request-execution-flow.md` for how `Execution.ts` turns that into a
+  response.

api/package.json

@@ -6,11 +6,9 @@
   "scripts": {
     "initial": "npm run swagger && npm run compileSysInit && npm run copySASjsCore && npm run downloadMacros",
     "prestart": "npm run initial",
-    "prebuild": "npm run initial",
     "start": "NODE_ENV=development nodemon ./src/server.ts",
     "start:prod": "node ./build/src/server.js",
-    "build": "rimraf build && tsc",
-    "postbuild": "npm run copy:files",
+    "build": "npm run initial && rimraf build && tsc && npm run copy:files",
     "swagger": "tsoa spec",
     "prepare": "[ -d .git ] && git config core.hooksPath ./.git-hooks || true",
     "test": "mkdir -p tmp && mkdir -p ../web/build && jest --silent --coverage",
@@ -18,10 +16,10 @@
     "lint": "npx prettier --check \"src/**/*.{ts,tsx,js,jsx,html,css,sass,less,yml,md,graphql}\"",
     "exe": "npm run build && pkg .",
     "copy:files": "npm run public:copy && npm run sasjsbuild:copy && npm run sas:copy && npm run web:copy",
-    "public:copy": "cp -r ./public/ ./build/public/",
-    "sasjsbuild:copy": "cp -r ./sasjsbuild/ ./build/sasjsbuild/",
-    "sas:copy": "cp -r ./sas/ ./build/sas/",
-    "web:copy": "rimraf web && mkdir web && cp -r ../web/build/ ./web/build/",
+    "public:copy": "cpr ./public/ ./build/public/",
+    "sasjsbuild:copy": "cpr ./sasjsbuild/ ./build/sasjsbuild/",
+    "sas:copy": "cpr ./sas/ ./build/sas/",
+    "web:copy": "rimraf web && mkdir web && cpr ../web/build/ ./web/build/",
     "compileSysInit": "ts-node ./scripts/compileSysInit.ts",
     "copySASjsCore": "ts-node ./scripts/copySASjsCore.ts",
     "downloadMacros": "ts-node ./scripts/downloadMacros.ts"
@@ -48,25 +46,25 @@
   },
   "author": "4GL Ltd",
   "dependencies": {
-    "@sasjs/core": "^4.40.1",
-    "@sasjs/utils": "3.2.0",
+    "@sasjs/core": "^4.59.10",
+    "@sasjs/utils": "^3.5.6",
     "bcryptjs": "^2.4.3",
-    "connect-mongo": "^4.6.0",
-    "cookie-parser": "^1.4.6",
+    "connect-mongo": "^5.1.0",
+    "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "express": "^4.17.1",
-    "express-session": "^1.17.2",
+    "express": "^4.21.2",
+    "express-session": "^1.18.2",
     "helmet": "^5.0.2",
     "joi": "^17.4.2",
-    "jsonwebtoken": "^8.5.1",
+    "jsonwebtoken": "^9.0.3",
     "ldapjs": "2.3.3",
-    "mongoose": "^6.0.12",
-    "morgan": "^1.10.0",
+    "mongoose": "^6.13.8",
+    "morgan": "^1.10.1",
     "multer": "^1.4.5-lts.1",
     "rate-limiter-flexible": "2.4.1",
     "rotating-file-stream": "^3.0.4",
     "swagger-ui-express": "4.3.0",
-    "unzipper": "^0.10.11",
+    "unzipper": "^0.12.3",
     "url": "^0.10.3"
   },
   "devDependencies": {
@@ -76,32 +74,33 @@
     "@types/cors": "^2.8.12",
     "@types/express": "^4.17.12",
     "@types/express-session": "^1.17.4",
-    "@types/jest": "^26.0.24",
+    "@types/jest": "^29.5.0",
     "@types/jsonwebtoken": "^8.5.5",
     "@types/ldapjs": "^2.2.4",
     "@types/morgan": "^1.9.3",
     "@types/multer": "^1.4.7",
-    "@types/node": "^15.12.2",
+    "@types/node": "^20.0.0",
     "@types/supertest": "^2.0.11",
     "@types/swagger-ui-express": "^4.1.3",
     "@types/unzipper": "^0.10.5",
     "adm-zip": "^0.5.9",
-    "axios": "0.27.2",
+    "axios": "1.12.2",
+    "cpr": "^3.0.1",
     "csrf": "^3.1.0",
     "dotenv": "^16.0.1",
     "http-headers-validation": "^0.0.1",
-    "jest": "^27.0.6",
+    "jest": "^29.7.0",
     "mongodb-memory-server": "8.11.4",
     "nodejs-file-downloader": "4.10.2",
-    "nodemon": "^2.0.7",
+    "nodemon": "^3.0.0",
     "pkg": "5.6.0",
-    "prettier": "^2.3.1",
+    "prettier": "^3.0.3",
     "rimraf": "^3.0.2",
     "supertest": "^6.1.3",
-    "ts-jest": "^27.0.3",
+    "ts-jest": "^29.1.0",
     "ts-node": "^10.0.0",
     "tsoa": "3.14.1",
-    "typescript": "^4.3.2"
+    "typescript": "^5.0.0"
   },
   "nodemonConfig": {
     "ignore": [

api/public/swagger.yaml

@@ -113,8 +113,8 @@ components:
             properties:
                 sessionId:
                     type: string
-                    description: "The SessionId is the name of the temporary folder used to store the outputs.\nFor SAS, this would be the SASWORK folder. Can be used to poll job status.\nThis session ID should be used to poll job status."
-                    example: '{ sessionId: ''20241028074744-54132-1730101664824'' }'
+                    description: "`sessionId` is the ID of the session and the name of the temporary folder\nused to store code outputs.<br><br>\nFor SAS, this would be the location of the SASWORK folder.<br><br>\n`sessionId` can be used to poll session state using the\nGET /SASjsApi/session/{sessionId}/state endpoint."
+                    example: 20241028074744-54132-1730101664824
             required:
                 - sessionId
             type: object
@@ -585,6 +585,14 @@ components:
                 - needsToUpdatePassword
             type: object
             additionalProperties: false
+        SessionState:
+            enum:
+                - initialising
+                - pending
+                - running
+                - completed
+                - failed
+            type: string
         ExecutePostRequestPayload:
             properties:
                 _program:
@@ -593,6 +601,16 @@ components:
                     example: /Public/somefolder/some.file
             type: object
             additionalProperties: false
+        TriggerProgramResponse:
+            properties:
+                sessionId:
+                    type: string
+                    description: "`sessionId` is the ID of the session and the name of the temporary folder\nused to store program outputs.<br><br>\nFor SAS, this would be the location of the SASWORK folder.<br><br>\n`sessionId` can be used to poll session state using the\nGET /SASjsApi/session/{sessionId}/state endpoint."
+                    example: 20241028074744-54132-1730101664824
+            required:
+                - sessionId
+            type: object
+            additionalProperties: false
         LoginPayload:
             properties:
                 username:
@@ -1831,6 +1849,30 @@ paths:
                 -
                     bearerAuth: []
             parameters: []
+    '/SASjsApi/session/{sessionId}/state':
+        get:
+            operationId: SessionState
+            responses:
+                '200':
+                    description: Ok
+                    content:
+                        application/json:
+                            schema:
+                                $ref: '#/components/schemas/SessionState'
+            description: "The polling endpoint is currently implemented for single-server deployments only.<br>\nLoad balanced / grid topologies will be supported in a future release.<br>\nIf your site requires this, please reach out to SASjs Support."
+            summary: 'Get session state (initialising, pending, running, completed, failed).'
+            tags:
+                - Session
+            security:
+                -
+                    bearerAuth: []
+            parameters:
+                -
+                    in: path
+                    name: sessionId
+                    required: true
+                    schema:
+                        type: string
     /SASjsApi/stp/execute:
         get:
             operationId: ExecuteGetRequest
@@ -1901,6 +1943,50 @@ paths:
                     application/json:
                         schema:
                             $ref: '#/components/schemas/ExecutePostRequestPayload'
+    /SASjsApi/stp/trigger:
+        post:
+            operationId: TriggerProgram
+            responses:
+                '200':
+                    description: Ok
+                    content:
+                        application/json:
+                            schema:
+                                $ref: '#/components/schemas/TriggerProgramResponse'
+            description: 'Trigger Program on the Specified Runtime.'
+            summary: 'Triggers program and returns SessionId immediately - does not wait for program completion.'
+            tags:
+                - STP
+            security:
+                -
+                    bearerAuth: []
+            parameters:
+                -
+                    description: 'Location of code in SASjs Drive.'
+                    in: query
+                    name: _program
+                    required: true
+                    schema:
+                        type: string
+                    example: /Projects/myApp/some/program
+                -
+                    description: 'Optional query param for setting debug mode.'
+                    in: query
+                    name: _debug
+                    required: false
+                    schema:
+                        format: double
+                        type: number
+                    example: 131
+                -
+                    description: 'Optional query param for setting amount of minutes after the completion of the program when the session must be destroyed.'
+                    in: query
+                    name: expiresAfterMins
+                    required: false
+                    schema:
+                        format: double
+                        type: number
+                    example: 15
     /:
         get:
             operationId: Home

api/src/controllers/auth.ts

@@ -234,9 +234,10 @@ const verifyAuthCode = async (
     jwt.verify(code, process.secrets.AUTH_CODE_SECRET, (err, data) => {
       if (err) return resolve(undefined)
 
+      const payload = data as InfoJWT
       const clientInfo: InfoJWT = {
-        clientId: data?.clientId,
-        userId: data?.userId
+        clientId: payload?.clientId,
+        userId: payload?.userId
       }
       if (clientInfo.clientId === clientId) {
         return resolve(clientInfo)

api/src/controllers/code.ts

@@ -42,10 +42,12 @@ interface TriggerCodePayload {
 
 interface TriggerCodeResponse {
   /**
-   * The SessionId is the name of the temporary folder used to store the outputs.
-   * For SAS, this would be the SASWORK folder. Can be used to poll job status.
-   * This session ID should be used to poll job status.
-   * @example "{ sessionId: '20241028074744-54132-1730101664824' }"
+   * `sessionId` is the ID of the session and the name of the temporary folder
+   * used to store code outputs.<br><br>
+   * For SAS, this would be the location of the SASWORK folder.<br><br>
+   * `sessionId` can be used to poll session state using the
+   * GET /SASjsApi/session/{sessionId}/state endpoint.
+   * @example "20241028074744-54132-1730101664824"
    */
   sessionId: string
 }
@@ -120,7 +122,7 @@ const executeCode = async (
 const triggerCode = async (
   req: express.Request,
   { code, runTime, expiresAfterMins }: TriggerCodePayload
-): Promise<{ sessionId: string }> => {
+): Promise<TriggerCodeResponse> => {
   const { user } = req
   const userAutoExec =
     process.env.MODE === ModeType.Server

api/src/controllers/internal/Execution.ts

@@ -2,7 +2,7 @@ import path from 'path'
 import fs from 'fs'
 import { getSessionController, processProgram } from './'
 import { readFile, fileExists, createFile, readFileBinary } from '@sasjs/utils'
-import { PreProgramVars, Session, TreeNode } from '../../types'
+import { PreProgramVars, Session, TreeNode, SessionState } from '../../types'
 import {
   extractHeaders,
   getFilesFolder,
@@ -75,8 +75,7 @@ export class ExecutionController {
 
     const session =
       sessionByFileUpload ?? (await sessionController.getSession())
-    session.inUse = true
-    session.consumed = true
+    session.state = SessionState.running
 
     const logPath = path.join(session.path, 'log.log')
     const headersPath = path.join(session.path, 'stpsrv_header.txt')
@@ -89,6 +88,11 @@ export class ExecutionController {
       preProgramVariables?.httpHeaders.join('\n') ?? ''
     )
 
+    // A failed session (e.g. SAS via %abort;, or a non-zero JS/PY/R exit)
+    // is a normal outcome of running arbitrary user code, not a
+    // request-shape/server problem - processProgram resolves rather than
+    // throwing in that case, and the session.failureReason check below
+    // folds the log into the same result shape a successful run returns.
     await processProgram(
       program,
       preProgramVariables,
@@ -121,7 +125,16 @@ export class ExecutionController {
       : ''
 
     // it should be deleted by scheduleSessionDestroy
-    session.inUse = false
+    //
+    // Guarded: for JS/PY/R, processProgram sets state to `failed` itself
+    // (without throwing) when the interpreter process exits non-zero - if
+    // we unconditionally set `completed` here we'd silently overwrite that,
+    // and anything downstream inspecting session.state (e.g.
+    // scheduleSessionDestroy's expiresAfterMins branch in Session.ts) would
+    // see a crashed session mis-reported as successful.
+    if ((session.state as SessionState) !== SessionState.failed) {
+      session.state = SessionState.completed
+    }
 
     const resultParts = []
 
@@ -145,7 +158,9 @@ export class ExecutionController {
     return {
       httpHeaders,
       result:
-        isDebugOn(vars) || session.crashed ? resultParts.join(`\n`) : webout
+        isDebugOn(vars) || session.failureReason
+          ? resultParts.join(`\n`)
+          : webout
     }
   }
 

api/src/controllers/internal/FileUploadController.ts

@@ -2,11 +2,8 @@ import { Request, RequestHandler } from 'express'
 import multer from 'multer'
 import { uuidv4 } from '@sasjs/utils'
 import { getSessionController } from '.'
-import {
-  executeProgramRawValidation,
-  getRunTimeAndFilePath,
-  RunTimeType
-} from '../../utils'
+import { executeProgramRawValidation, getRunTimeAndFilePath } from '../../utils'
+import { SessionState } from '../../types'
 
 export class FileUploadController {
   private storage = multer.diskStorage({
@@ -56,9 +53,8 @@ export class FileUploadController {
     }
 
     const session = await sessionController.getSession()
-    // marking consumed true, so that it's not available
-    // as readySession for any other request
-    session.consumed = true
+    // change session state to 'running', so that it's not available for any other request
+    session.state = SessionState.running
 
     req.sasjsSession = session
 

api/src/controllers/internal/Session.ts

@@ -1,5 +1,5 @@
 import path from 'path'
-import { Session } from '../../types'
+import { Session, SessionState } from '../../types'
 import { promisify } from 'util'
 import { execFile } from 'child_process'
 import {
@@ -23,7 +23,9 @@ export class SessionController {
   protected sessions: Session[] = []
 
   protected getReadySessions = (): Session[] =>
-    this.sessions.filter((sess: Session) => sess.ready && !sess.consumed)
+    this.sessions.filter(
+      (session: Session) => session.state === SessionState.pending
+    )
 
   protected async createSession(): Promise<Session> {
     const sessionId = generateUniqueFileName(generateTimestamp())
@@ -39,19 +41,18 @@ export class SessionController {
 
     const session: Session = {
       id: sessionId,
-      ready: true,
-      inUse: true,
-      consumed: false,
-      completed: false,
+      state: SessionState.pending,
       creationTimeStamp,
       deathTimeStamp,
       path: sessionFolder
     }
 
     const headersPath = path.join(session.path, 'stpsrv_header.txt')
+
     await createFile(headersPath, 'content-type: text/html; charset=utf-8')
 
     this.sessions.push(session)
+
     return session
   }
 
@@ -66,6 +67,10 @@ export class SessionController {
 
     return session
   }
+
+  public getSessionById(id: string) {
+    return this.sessions.find((session) => session.id === id)
+  }
 }
 
 export class SASSessionController extends SessionController {
@@ -83,10 +88,7 @@ export class SASSessionController extends SessionController {
 
     const session: Session = {
       id: sessionId,
-      ready: false,
-      inUse: false,
-      consumed: false,
-      completed: false,
+      state: SessionState.initialising,
       creationTimeStamp,
       deathTimeStamp,
       path: sessionFolder
@@ -144,13 +146,20 @@ ${autoExecContent}`
       process.sasLoc!.endsWith('sas.exe') ? session.path : ''
     ])
       .then(() => {
-        session.completed = true
+        session.state = SessionState.completed
+
         process.logger.info('session completed', session)
       })
       .catch((err) => {
-        session.completed = true
-        session.crashed = err.toString()
-        process.logger.error('session crashed', session.id, session.crashed)
+        session.state = SessionState.failed
+
+        session.failureReason = err.toString()
+
+        process.logger.error(
+          'session crashed',
+          session.id,
+          session.failureReason
+        )
       })
 
     // we have a triggered session - add to array
@@ -167,15 +176,19 @@ ${autoExecContent}`
     const codeFilePath = path.join(session.path, 'code.sas')
 
     // TODO: don't wait forever
-    while ((await fileExists(codeFilePath)) && !session.crashed) {}
+    while (
+      (await fileExists(codeFilePath)) &&
+      session.state !== SessionState.failed
+    ) {}
 
-    if (session.crashed)
+    if (session.state === SessionState.failed) {
       process.logger.error(
         'session crashed! while waiting to be ready',
-        session.crashed
+        session.failureReason
       )
-
-    session.ready = true
+    } else {
+      session.state = SessionState.pending
+    }
   }
 
   private async deleteSession(session: Session) {
@@ -191,7 +204,7 @@ ${autoExecContent}`
   private scheduleSessionDestroy(session: Session) {
     setTimeout(
       async () => {
-        if (session.inUse) {
+        if (session.state === SessionState.running) {
           // adding 10 more minutes
           const newDeathTimeStamp =
             parseInt(session.deathTimeStamp) + 10 * 60 * 1000
@@ -202,7 +215,7 @@ ${autoExecContent}`
           const { expiresAfterMins } = session
 
           // delay session destroy if expiresAfterMins present
-          if (expiresAfterMins && !expiresAfterMins.used) {
+          if (expiresAfterMins && session.state !== SessionState.completed) {
             // calculate session death time using expiresAfterMins
             const newDeathTimeStamp =
               parseInt(session.deathTimeStamp) +
@@ -247,9 +260,16 @@ data _null_;
   rc=filename(fname,getoption('SYSIN') );
   if rc = 0 and fexist(fname) then rc=fdelete(fname);
   rc=filename(fname);
-  /* now wait for the real SYSIN */
-  slept=0;
-  do until ( fileexist(getoption('SYSIN')) or slept>(60*15) );
+  /* now wait for the real SYSIN (location of code.sas) */
+  slept=0;fname='';
+  do until (slept>(60*15));
+    rc=filename(fname,getoption('SYSIN'));
+    if rc = 0 and fexist(fname) then do;
+      putlog fname=;
+      rc=filename(fname);
+      rc=sleep(0.01,1); /* wait just a little more */
+      stop;
+    end;
     slept=slept+sleep(0.01,1);
   end;
   stop;

api/src/controllers/internal/processProgram.ts

@@ -3,7 +3,7 @@ import { WriteStream, createWriteStream } from 'fs'
 import { execFile } from 'child_process'
 import { once } from 'stream'
 import { createFile, moveFile } from '@sasjs/utils'
-import { PreProgramVars, Session } from '../../types'
+import { PreProgramVars, Session, SessionState } from '../../types'
 import { RunTimeType } from '../../utils'
 import {
   ExecutionVars,
@@ -48,8 +48,17 @@ export const processProgram = async (
     await createFile(codePath + '.bkp', program)
     await moveFile(codePath + '.bkp', codePath)
 
-    // we now need to poll the session status
-    while (!session.completed) {
+    // we now need to poll the session status. A failed session (e.g. from
+    // %abort;) is not a request-shape/server problem - it's a normal
+    // outcome of running arbitrary user code, same as a SAS ERROR: in the
+    // log without %abort;. So we just stop polling rather than throwing;
+    // Execution.ts already knows how to turn session.failureReason into a
+    // 200 response with the log embedded, matching how JS/PY/R (the else
+    // branch below) has always handled a failed session.
+    while (
+      session.state !== SessionState.completed &&
+      session.state !== SessionState.failed
+    ) {
       await delay(50)
     }
   } else {
@@ -114,13 +123,20 @@ export const processProgram = async (
 
     await execFilePromise(executablePath, [codePath], writeStream)
       .then(() => {
-        session.completed = true
+        session.state = SessionState.completed
+
         process.logger.info('session completed', session)
       })
       .catch((err) => {
-        session.completed = true
-        session.crashed = err.toString()
-        process.logger.error('session crashed', session.id, session.crashed)
+        session.state = SessionState.failed
+
+        session.failureReason = err.toString()
+
+        process.logger.error(
+          'session crashed',
+          session.id,
+          session.failureReason
+        )
       })
 
     // copy the code file to log and end write stream

api/src/controllers/internal/spec/Execution.spec.ts

@@ -0,0 +1,126 @@
+import path from 'path'
+import os from 'os'
+import { createFile, deleteFolder, generateTimestamp } from '@sasjs/utils'
+import * as ProcessProgramModule from '../processProgram'
+import { ExecutionController } from '../Execution'
+import { Session, SessionState, PreProgramVars } from '../../../types'
+import { RunTimeType } from '../../../utils'
+
+const preProgramVariables: PreProgramVars = {
+  username: 'testUser',
+  userId: 1,
+  displayName: 'Test User',
+  serverUrl: 'http://localhost:5000',
+  httpHeaders: []
+}
+
+describe('ExecutionController.executeProgram', () => {
+  let session: Session
+
+  beforeEach(() => {
+    const sessionId = `test-session-${generateTimestamp()}`
+    session = {
+      id: sessionId,
+      state: SessionState.pending,
+      creationTimeStamp: '0',
+      deathTimeStamp: '0',
+      path: path.join(os.tmpdir(), sessionId)
+    }
+  })
+
+  afterEach(async () => {
+    jest.restoreAllMocks()
+    await deleteFolder(session.path)
+  })
+
+  // Regression coverage: for JS/PY/R, processProgram sets session.state to
+  // `failed` itself (without throwing) on a non-zero interpreter exit.
+  // ExecutionController.executeProgram used to unconditionally overwrite
+  // that back to `completed` right after processProgram returned, silently
+  // losing the failure for anything downstream that inspects session.state.
+  describe('JS/PY/R failure path', () => {
+    it('does not overwrite a failed session state back to completed', async () => {
+      // mirrors processProgram's real JS/PY/R branch on a non-zero exit:
+      // it sets state/failureReason itself and resolves - it does not throw
+      jest
+        .spyOn(ProcessProgramModule, 'processProgram')
+        .mockImplementation(async () => {
+          session.state = SessionState.failed
+          session.failureReason = 'Error: process exited with code 1'
+        })
+
+      const controller = new ExecutionController()
+
+      await controller.executeProgram({
+        program: 'throw new Error("boom")',
+        preProgramVariables,
+        vars: {},
+        session,
+        runTime: RunTimeType.JS
+      })
+
+      expect(session.state).toBe(SessionState.failed)
+    })
+
+    it('still marks a genuinely successful session as completed', async () => {
+      jest
+        .spyOn(ProcessProgramModule, 'processProgram')
+        .mockImplementation(async () => {
+          session.state = SessionState.completed
+        })
+
+      const controller = new ExecutionController()
+
+      await controller.executeProgram({
+        program: 'console.log("hello")',
+        preProgramVariables,
+        vars: {},
+        session,
+        runTime: RunTimeType.JS
+      })
+
+      expect(session.state).toBe(SessionState.completed)
+    })
+  })
+
+  // A failed SAS session (e.g. from %abort;) is a normal outcome of
+  // running arbitrary user code, not a request-shape/server problem - the
+  // same way a plain SAS ERROR: in the log (without %abort;) already
+  // returns 200 with the log embedded. This mirrors the JS/PY/R failure
+  // path above: resolve normally, don't throw, and let the existing
+  // session.failureReason check below produce the same result shape as a
+  // successful run.
+  describe('SAS failure path', () => {
+    it('returns the complete log embedded in a normal result instead of throwing, when the session fails', async () => {
+      const logPath = path.join(session.path, 'log.log')
+      const logContent =
+        'NOTE: SAS session\nERROR: SAS session terminated. See log for details.\n'
+
+      await createFile(logPath, logContent)
+
+      jest
+        .spyOn(ProcessProgramModule, 'processProgram')
+        .mockImplementation(async () => {
+          // mirrors the real SAS branch after the fix: sets
+          // state/failureReason and resolves, exactly like the JS/PY/R
+          // branch already does - it does not throw
+          session.state = SessionState.failed
+          session.failureReason =
+            'ERROR: SAS session terminated. See log for details.'
+        })
+
+      const controller = new ExecutionController()
+
+      const { result } = await controller.executeProgram({
+        program: '%abort;',
+        preProgramVariables,
+        vars: {},
+        session,
+        runTime: RunTimeType.SAS
+      })
+
+      expect(session.state).toBe(SessionState.failed)
+      expect(result).toEqual(expect.stringContaining(logContent))
+    })
+  })
+})

api/src/controllers/internal/spec/processProgram.spec.ts

@@ -0,0 +1,115 @@
+import path from 'path'
+import os from 'os'
+import { createFile, deleteFolder, generateTimestamp } from '@sasjs/utils'
+import { processProgram } from '../processProgram'
+import { Session, SessionState, PreProgramVars } from '../../../types'
+import {
+  RunTimeType,
+  getSessionsFolder,
+  generateUniqueFileName
+} from '../../../utils'
+
+const preProgramVariables: PreProgramVars = {
+  username: 'testUser',
+  userId: 1,
+  displayName: 'Test User',
+  serverUrl: 'http://localhost:5000',
+  httpHeaders: []
+}
+
+const makeSession = (): Session => {
+  const sessionId = generateUniqueFileName(generateTimestamp())
+  const sessionFolder = path.join(getSessionsFolder(), sessionId)
+  const creationTimeStamp = sessionId.split('-').pop() as string
+  const deathTimeStamp = (
+    parseInt(creationTimeStamp) +
+    15 * 60 * 1000 -
+    1000
+  ).toString()
+
+  return {
+    id: sessionId,
+    state: SessionState.running,
+    creationTimeStamp,
+    deathTimeStamp,
+    path: sessionFolder
+  }
+}
+
+describe('processProgram (SAS runtime)', () => {
+  let session: Session
+  let logPath: string
+  let weboutPath: string
+  let headersPath: string
+  let tokenFile: string
+
+  beforeAll(() => {
+    const root = path.join(
+      os.tmpdir(),
+      `sasjs-processProgram-spec-${generateTimestamp()}`
+    )
+    process.sasjsRoot = root
+    process.driveLoc = path.join(root, 'drive')
+  })
+
+  beforeEach(async () => {
+    session = makeSession()
+    logPath = path.join(session.path, 'log.log')
+    weboutPath = path.join(session.path, 'webout.txt')
+    headersPath = path.join(session.path, 'stpsrv_header.txt')
+    tokenFile = path.join(session.path, 'reqHeaders.txt')
+    await createFile(weboutPath, '')
+  })
+
+  afterEach(async () => {
+    await deleteFolder(session.path)
+  })
+
+  it('resolves instead of hanging when the session fails (e.g. %abort;)', async () => {
+    // mirrors the JS/PY/R branch below: a session failure is a normal
+    // outcome of running arbitrary user code (like a SAS ERROR: in the
+    // log without %abort;), not a server-side/request-shape problem - so
+    // processProgram must not throw here, just stop polling. Execution.ts
+    // is responsible for turning session.failureReason into a 200 response
+    // with the log embedded, the same way it already does for JS/PY/R.
+    setTimeout(() => {
+      session.state = SessionState.failed
+      session.failureReason =
+        'ERROR: SAS session terminated. See log for details.'
+    }, 100)
+
+    await expect(
+      processProgram(
+        '%abort;',
+        preProgramVariables,
+        {},
+        session,
+        weboutPath,
+        headersPath,
+        tokenFile,
+        RunTimeType.SAS,
+        logPath
+      )
+    ).resolves.toBeUndefined()
+  }, 3000)
+
+  it('resolves without throwing when the session completes normally', async () => {
+    setTimeout(() => {
+      session.state = SessionState.completed
+    }, 100)
+
+    await expect(
+      processProgram(
+        '%put hello world;',
+        preProgramVariables,
+        {},
+        session,
+        weboutPath,
+        headersPath,
+        tokenFile,
+        RunTimeType.SAS,
+        logPath
+      )
+    ).resolves.toBeUndefined()
+  }, 3000)
+})

api/src/controllers/session.ts

@@ -1,6 +1,8 @@
 import express from 'express'
 import { Request, Security, Route, Tags, Example, Get } from 'tsoa'
 import { UserResponse } from './user'
+import { getSessionController } from './internal'
+import { SessionState } from '../types'
 
 interface SessionResponse extends UserResponse {
   needsToUpdatePassword: boolean
@@ -26,6 +28,18 @@ export class SessionController {
   ): Promise<SessionResponse> {
     return session(request)
   }
+
+  /**
+   * The polling endpoint is currently implemented for single-server deployments only.<br>
+   * Load balanced / grid topologies will be supported in a future release.<br>
+   * If your site requires this, please reach out to SASjs Support.
+   * @summary Get session state (initialising, pending, running, completed, failed).
+   * @example completed
+   */
+  @Get('/:sessionId/state')
+  public async sessionState(sessionId: string): Promise<SessionState> {
+    return sessionState(sessionId)
+  }
 }
 
 const session = (req: express.Request) => ({
@@ -35,3 +49,23 @@ const session = (req: express.Request) => ({
   isAdmin: req.user!.isAdmin,
   needsToUpdatePassword: req.user!.needsToUpdatePassword
 })
+
+const sessionState = (sessionId: string): SessionState => {
+  for (let runTime of process.runTimes) {
+    // get session controller for each available runTime
+    const sessionController = getSessionController(runTime)
+
+    // get session by sessionId
+    const session = sessionController.getSessionById(sessionId)
+
+    // return session state if session was found
+    if (session) {
+      return session.state
+    }
+  }
+
+  throw {
+    code: 404,
+    message: `Session with ID '${sessionId}' was not found.`
+  }
+}

api/src/controllers/stp.ts

@@ -1,13 +1,16 @@
 import express from 'express'
 import { Request, Security, Route, Tags, Post, Body, Get, Query } from 'tsoa'
-import { ExecutionController, ExecutionVars } from './internal'
+import {
+  ExecutionController,
+  ExecutionVars,
+  getSessionController
+} from './internal'
 import {
   getPreProgramVariables,
   makeFilesNamesMap,
   getRunTimeAndFilePath
 } from '../utils'
 import { MulterFile } from '../types/Upload'
-import { debug } from 'console'
 
 interface ExecutePostRequestPayload {
   /**
@@ -17,6 +20,36 @@ interface ExecutePostRequestPayload {
   _program?: string
 }
 
+interface TriggerProgramPayload {
+  /**
+   * Location of SAS program.
+   * @example "/Public/somefolder/some.file"
+   */
+  _program: string
+  /**
+   * Amount of minutes after the completion of the program when the session must be
+   * destroyed.
+   * @example 15
+   */
+  expiresAfterMins?: number
+  /**
+   * Query param for setting debug mode.
+   */
+  _debug?: number
+}
+
+interface TriggerProgramResponse {
+  /**
+   * `sessionId` is the ID of the session and the name of the temporary folder
+   * used to store program outputs.<br><br>
+   * For SAS, this would be the location of the SASWORK folder.<br><br>
+   * `sessionId` can be used to poll session state using the
+   * GET /SASjsApi/session/{sessionId}/state endpoint.
+   * @example "20241028074744-54132-1730101664824"
+   */
+  sessionId: string
+}
+
 @Security('bearerAuth')
 @Route('SASjsApi/stp')
 @Tags('STP')
@@ -79,6 +112,26 @@ export class STPController {
 
     return execute(request, program!, vars, otherArgs)
   }
+
+  /**
+   * Trigger Program on the Specified Runtime.
+   * @summary Triggers program and returns SessionId immediately - does not wait for program completion.
+   * @param _program Location of code in SASjs Drive.
+   * @param expiresAfterMins Optional query param for setting amount of minutes after the completion of the program when the session must be destroyed.
+   * @param _debug Optional query param for setting debug mode.
+   * @example _program "/Projects/myApp/some/program"
+   * @example _debug 131
+   * @example expiresAfterMins 15
+   */
+  @Post('/trigger')
+  public async triggerProgram(
+    @Request() request: express.Request,
+    @Query() _program: string,
+    @Query() _debug?: number,
+    @Query() expiresAfterMins?: number
+  ): Promise<TriggerProgramResponse> {
+    return triggerProgram(request, { _program, _debug, expiresAfterMins })
+  }
 }
 
 const execute = async (
@@ -117,3 +170,52 @@ const execute = async (
     }
   }
 }
+
+const triggerProgram = async (
+  req: express.Request,
+  { _program, _debug, expiresAfterMins }: TriggerProgramPayload
+): Promise<TriggerProgramResponse> => {
+  try {
+    // put _program query param into vars object
+    const vars: { [key: string]: string | number } = { _program }
+
+    // if present add _debug query param to vars object
+    if (_debug) {
+      vars._debug = _debug
+    }
+
+    // get code path and runTime
+    const { codePath, runTime } = await getRunTimeAndFilePath(_program)
+
+    // get session controller based on runTime
+    const sessionController = getSessionController(runTime)
+
+    // get session
+    const session = await sessionController.getSession()
+
+    // add expiresAfterMins to session if provided
+    if (expiresAfterMins) {
+      // expiresAfterMins.used is set initially to false
+      session.expiresAfterMins = { mins: expiresAfterMins, used: false }
+    }
+
+    // call executeFile method of ExecutionController without awaiting
+    new ExecutionController().executeFile({
+      programPath: codePath,
+      runTime,
+      preProgramVariables: getPreProgramVariables(req),
+      vars,
+      session
+    })
+
+    // return session id
+    return { sessionId: session.id }
+  } catch (err: any) {
+    throw {
+      code: 400,
+      status: 'failure',
+      message: 'Job execution failed.',
+      error: typeof err === 'object' ? err.toString() : err
+    }
+  }
+}

api/src/controllers/web.ts

@@ -106,7 +106,10 @@ const login = async (
   const rateLimiter = RateLimiter.getInstance()
 
   if (!validPass) {
-    const retrySecs = await rateLimiter.consume(req.ip, user?.username)
+    const retrySecs = await rateLimiter.consume(
+      req.ip || 'unknown',
+      user?.username
+    )
     if (retrySecs > 0) throw errors.tooManyRequests(retrySecs)
   }
 
@@ -114,7 +117,7 @@ const login = async (
   if (!validPass) throw errors.invalidPassword
 
   // Reset on successful authorization
-  rateLimiter.resetOnSuccess(req.ip, user.username)
+  rateLimiter.resetOnSuccess(req.ip || 'unknown', user.username)
 
   req.session.loggedIn = true
   req.session.user = {

api/src/middlewares/authenticateToken.ts

@@ -37,10 +37,10 @@ export const authenticateAccessToken: RequestHandler = async (
         if (user.isActive) {
           req.user = user
           return csrfProtection(req, res, nextFunction)
-        } else return res.sendStatus(401)
+        } else return res.status(401).send('Unauthorized')
       }
     }
-    return res.sendStatus(401)
+    return res.status(401).send('Unauthorized')
   }
 
   await authenticateToken(
@@ -118,6 +118,6 @@ const authenticateToken = async (
       return next()
     }
 
-    res.sendStatus(401)
+    res.status(401).send('Unauthorized')
   }
 }

api/src/middlewares/bruteForceProtection.ts

@@ -3,7 +3,7 @@ import { convertSecondsToHms } from '@sasjs/utils'
 import { RateLimiter } from '../utils'
 
 export const bruteForceProtection: RequestHandler = async (req, res, next) => {
-  const ip = req.ip
+  const ip = req.ip || 'unknown'
   const username = req.body.username
 
   const rateLimiter = RateLimiter.getInstance()

api/src/model/Group.ts

@@ -76,7 +76,7 @@ groupSchema.post('save', function (group: IGroup, next: Function) {
 })
 
 // pre remove hook to remove all references of group from users
-groupSchema.pre('remove', async function () {
+groupSchema.pre('remove', async function (this: IGroupDocument) {
   const userIds = this.users
   await Promise.all(
     userIds.map(async (userId) => {

api/src/routes/api/session.ts

@@ -1,16 +1,37 @@
 import express from 'express'
 import { SessionController } from '../../controllers'
+import { sessionIdValidation } from '../../utils'
 
 const sessionRouter = express.Router()
 
+const controller = new SessionController()
+
 sessionRouter.get('/', async (req, res) => {
-  const controller = new SessionController()
   try {
     const response = await controller.session(req)
+
     res.send(response)
   } catch (err: any) {
     res.status(403).send(err.toString())
   }
 })
 
+sessionRouter.get('/:sessionId/state', async (req, res) => {
+  const { error, value: params } = sessionIdValidation(req.params)
+  if (error) return res.status(400).send(error.details[0].message)
+
+  try {
+    const response = await controller.sessionState(params.sessionId)
+
+    res.status(200)
+    res.send(response)
+  } catch (err: any) {
+    const statusCode = err.code
+
+    delete err.code
+
+    res.status(statusCode).send(err)
+  }
+})
+
 export default sessionRouter

api/src/routes/api/spec/code.spec.ts

@@ -0,0 +1,138 @@
+import path from 'path'
+import { createFile, fileExists } from '@sasjs/utils'
+import { Express } from 'express'
+import mongoose, { Mongoose } from 'mongoose'
+import { MongoMemoryServer } from 'mongodb-memory-server'
+import request from 'supertest'
+import {
+  UserController,
+  PermissionController,
+  PermissionType,
+  PermissionSettingForRoute,
+  PrincipalType
+} from '../../../controllers/'
+import {
+  generateAccessToken,
+  saveTokensInDB,
+  RunTimeType,
+  sysInitCompiledPath
+} from '../../../utils'
+
+// Real, unmocked end-to-end test of the SAS execution pipeline (session
+// spawn -> autoexec handshake -> exit code -> HTTP response), using a fake
+// "SAS executable" (mockSas.js) in place of a real SAS install. This is the
+// regression test for issue #388: SAS code that aborts (%abort;) used to
+// hang the request forever instead of returning an error response.
+const mockSasPath = path.join(__dirname, 'files', 'mockSas.js')
+
+const clientId = 'codeSpecClientID'
+
+const user = {
+  displayName: 'Code Spec User',
+  username: 'codeSpecUsername',
+  password: '87654321',
+  isAdmin: false,
+  isActive: true
+}
+
+let app: Express
+let accessToken: string
+
+describe('code', () => {
+  let con: Mongoose
+  let mongoServer: MongoMemoryServer
+  let userController: UserController
+  let permissionController: PermissionController
+
+  beforeAll(async () => {
+    // SASSessionController.createSession() unconditionally reads this file
+    // (Session.ts:105) before it ever spawns the SAS process. It's normally
+    // produced by `npm run compileSysInit` (part of the `initial`/`build`
+    // scripts), which `npm test` does not run - so on a fresh checkout
+    // (e.g. CI, where "Run Unit Tests" happens before "Build Package") it
+    // doesn't exist yet. Content is irrelevant here since mockSas.js never
+    // interprets it; it just needs to exist and be readable.
+    if (!(await fileExists(sysInitCompiledPath))) {
+      await createFile(sysInitCompiledPath, '')
+    }
+
+    mongoServer = await MongoMemoryServer.create()
+    process.env.DB_CONNECT = mongoServer.getUri()
+    process.env.MODE = 'server'
+    process.env.RUN_TIMES = 'sas'
+    process.env.SAS_PATH = mockSasPath
+
+    const appPromise = (await import('../../../app')).default
+    app = await appPromise
+
+    con = await mongoose.connect(mongoServer.getUri())
+
+    userController = new UserController()
+    permissionController = new PermissionController()
+
+    const dbUser = await userController.createUser(user)
+    accessToken = await generateAndSaveToken(dbUser.id)
+
+    await permissionController.createPermission({
+      path: '/SASjsApi/code/execute',
+      type: PermissionType.route,
+      principalType: PrincipalType.user,
+      principalId: dbUser.id,
+      setting: PermissionSettingForRoute.grant
+    })
+
+    process.runTimes = [RunTimeType.SAS]
+    process.sasLoc = mockSasPath
+  }, 30000)
+
+  afterAll(async () => {
+    await con.connection.dropDatabase()
+    await con.connection.close()
+    await mongoServer.stop()
+  })
+
+  describe('execute', () => {
+    it('returns 200 with the mock log when the SAS program completes normally', async () => {
+      const response = await request(app)
+        .post('/SASjsApi/code/execute')
+        .auth(accessToken, { type: 'bearer' })
+        .send({ code: '%put hello world;', runTime: 'sas' })
+        .expect(200)
+
+      expect(response.text).toEqual(
+        expect.stringContaining('mock SAS execution')
+      )
+    }, 30000)
+
+    // A failed SAS session (e.g. %abort;) is a normal outcome of running
+    // arbitrary user code, not a request-shape/server problem - the HTTP
+    // request itself was fine, so this must respond exactly like a
+    // successful run (200, same body shape, no hang), with the log simply
+    // reflecting what happened. Regression test for #388's follow-up: the
+    // original #388 fix stopped the hang but over-corrected into a 400
+    // with a bespoke error shape, which broke Studio's log-tab rendering.
+    it('returns 200 with the same shape as a successful run when the SAS session fails (%abort;), not a hang or an error shape', async () => {
+      const response = await request(app)
+        .post('/SASjsApi/code/execute')
+        .auth(accessToken, { type: 'bearer' })
+        .send({ code: '%abort;', runTime: 'sas' })
+        .expect(200)
+
+      expect(response.text).toEqual(
+        expect.stringContaining('mock SAS execution')
+      )
+      expect(response.text).toEqual(
+        expect.stringContaining('SAS session terminated')
+      )
+    }, 30000)
+  })
+})
+
+const generateAndSaveToken = async (userId: number) => {
+  const accessToken = generateAccessToken({
+    clientId,
+    userId
+  })
+  await saveTokensInDB(userId, clientId, accessToken, 'refreshToken')
+  return accessToken
+}

api/src/routes/api/spec/drive.spec.ts

@@ -28,6 +28,15 @@ jest
   .spyOn(fileUtilModules, 'getUploadsFolder')
   .mockImplementation(() => path.join(tmpFolder, 'uploads'))
 
+// getFilesFolder() resolves via getSasjsDriveFolder()/process.driveLoc, a
+// separate root from getSasjsRootFolder()/process.sasjsRoot above - without
+// this, every test in this file that creates content under the drive (e.g.
+// 'level1', 'my/path/...') writes into the real, shared sasjs_root/drive
+// instead of this run's isolated tmpFolder, leaking state into later runs.
+jest
+  .spyOn(fileUtilModules, 'getFilesFolder')
+  .mockImplementation(() => path.join(tmpFolder, 'drive', 'files'))
+
 import appPromise from '../../../app'
 import {
   UserController,

api/src/routes/api/spec/files/mockSas.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+
+// Minimal fake "SAS executable" used by tests in place of a real SAS
+// install. It only fulfils the CLI/filesystem handshake contract that
+// Session.ts / processProgram.ts rely on:
+//
+//   -SYSIN <path>   the file used as a signal channel: it starts out
+//                    containing a dummy (empty) placeholder, we delete it
+//                    to signal "session ready", then wait for it to be
+//                    rewritten with the real submitted program.
+//   -LOG <path>     where we write a fake log so downstream fileExists()/
+//                    readFile() calls have something to find.
+//
+// It does NOT interpret real SAS syntax. Exit code is the only thing that
+// matters to the Node side: 0 mimics a normal SAS termination, non-zero
+// mimics an abnormal one (e.g. %abort;).
+
+const fs = require('fs')
+
+const arg = (flag) => {
+  const idx = process.argv.indexOf(flag)
+
+  return idx === -1 ? undefined : process.argv[idx + 1]
+}
+
+const sysin = arg('-SYSIN')
+const logPath = arg('-LOG')
+
+// Give up waiting for the real program after this long, so an unused
+// pre-warmed session (sasjs pools up to 3 ready sessions) doesn't linger
+// forever and keep a test process alive. Generous rather than tight: CI
+// runners are frequently slower/more contended than a local dev machine
+// (shared CPU, coverage instrumentation on the Node side slowing down the
+// round trip this process is waiting on), and this cost is only ever paid
+// by sessions nothing is actually waiting on - the session actually used
+// by a request gets its real code written far sooner than this in practice.
+const GIVE_UP_AFTER_MS = 8000
+
+const sleepSync = (ms) => {
+  const until = Date.now() + ms
+
+  while (Date.now() < until) {
+    /* busy-wait, mirroring the real autoexec's SAS-side sleep() loop */
+  }
+}
+
+// Any of the filesystem calls below can legitimately race against
+// processProgram's own write-then-rename (e.g. existsSync sees the file,
+// then a rename mid-flight makes the following read miss). Treat that as
+// "not ready yet" and retry a few times, rather than letting an uncaught
+// exception crash this process with a non-zero exit - which would be
+// indistinguishable, to the Node side, from a genuine SAS failure.
+const retry = (fn, attempts = 5, delayMs = 20) => {
+  for (let i = 0; i < attempts; i++) {
+    try {
+      return { ok: true, value: fn() }
+    } catch (err) {
+      if (i === attempts - 1) return { ok: false, error: err }
+
+      sleepSync(delayMs)
+    }
+  }
+}
+
+// 1. remove the dummy SYSIN, signalling "session ready" to waitForSession()
+if (sysin) {
+  retry(() => {
+    if (fs.existsSync(sysin)) fs.unlinkSync(sysin)
+  })
+}
+
+// 2. wait for the real program to be written back to the same path
+const deadline = Date.now() + GIVE_UP_AFTER_MS
+
+while (!sysin || !fs.existsSync(sysin)) {
+  if (Date.now() > deadline) process.exit(0)
+
+  sleepSync(10)
+}
+
+// small settle delay, mirroring the real autoexec's sleep(0.01,1) after
+// detecting the file, so a fast-moving rename isn't read mid-write
+sleepSync(50)
+
+const readResult = retry(() => fs.readFileSync(sysin, 'utf-8'))
+
+if (!readResult.ok) {
+  process.stderr.write(
+    `mockSas.js: failed to read ${sysin}: ${readResult.error}\n`
+  )
+  process.exit(1)
+}
+
+const code = readResult.value
+
+// real SAS writes errors/aborts directly into the log file itself, not
+// just to stderr - mirror that so tests asserting on log content (what
+// the API actually returns to the caller) are meaningful
+const isAbort = code.includes('%abort;')
+const logContent = isAbort
+  ? `NOTE: mock SAS execution\n${code}\nERROR: SAS session terminated. See log for details.\n`
+  : `NOTE: mock SAS execution\n${code}\n`
+
+if (logPath) {
+  retry(() => fs.writeFileSync(logPath, logContent))
+}
+
+if (isAbort) {
+  process.stderr.write('ERROR: SAS session terminated. See log for details.\n')
+  process.exit(1)
+}
+
+process.exit(0)

api/src/routes/api/spec/stp.spec.ts

@@ -25,7 +25,7 @@ import {
   SASSessionController
 } from '../../../controllers/internal'
 import * as ProcessProgramModule from '../../../controllers/internal/processProgram'
-import { Session } from '../../../types'
+import { Session, SessionState } from '../../../types'
 
 const clientId = 'someclientID'
 
@@ -493,10 +493,7 @@ const mockedGetSession = async () => {
 
   const session: Session = {
     id: sessionId,
-    ready: true,
-    inUse: true,
-    consumed: false,
-    completed: false,
+    state: SessionState.pending,
     creationTimeStamp,
     deathTimeStamp,
     path: sessionFolder

api/src/routes/api/spec/web.spec.ts

@@ -277,7 +277,10 @@ const performLogin = async (
     .set('x-xsrf-token', csrfToken)
     .send(credentials)
 
-  return { authCookies: header['set-cookie'].join() }
+  return {
+    authCookies:
+      (header['set-cookie'] as unknown as string[] | undefined)?.join() || ''
+  }
 }
 
 const extractCSRF = (text: string) =>

api/src/routes/api/stp.ts

@@ -1,5 +1,8 @@
 import express from 'express'
-import { executeProgramRawValidation } from '../../utils'
+import {
+  executeProgramRawValidation,
+  triggerProgramValidation
+} from '../../utils'
 import { STPController } from '../../controllers/'
 import { FileUploadController } from '../../controllers/internal'
 
@@ -69,4 +72,28 @@ stpRouter.post(
   }
 )
 
+stpRouter.post('/trigger', async (req, res) => {
+  const { error, value: query } = triggerProgramValidation(req.query)
+
+  if (error) return res.status(400).send(error.details[0].message)
+
+  try {
+    const response = await controller.triggerProgram(
+      req,
+      query._program,
+      query._debug,
+      query.expiresAfterMins
+    )
+
+    res.status(200)
+    res.send(response)
+  } catch (err: any) {
+    const statusCode = err.code
+
+    delete err.code
+
+    res.status(statusCode).send(err)
+  }
+})
+
 export default stpRouter

api/src/types/Session.ts

@@ -1,12 +1,16 @@
+export enum SessionState {
+  initialising = 'initialising', // session is initialising and not ready to be used yet
+  pending = 'pending', // session is ready to be used
+  running = 'running', // session is in use
+  completed = 'completed', // session is completed and can be destroyed
+  failed = 'failed' // session failed
+}
 export interface Session {
   id: string
-  ready: boolean
+  state: SessionState
   creationTimeStamp: string
   deathTimeStamp: string
   path: string
-  inUse: boolean
-  consumed: boolean
-  completed: boolean
-  crashed?: string
   expiresAfterMins?: { mins: number; used: boolean }
+  failureReason?: string
 }

api/src/utils/getTokensFromDB.ts

@@ -1,5 +1,6 @@
 import jwt from 'jsonwebtoken'
 import User from '../model/User'
+import { InfoJWT } from '../types/InfoJWT'
 
 const isValidToken = async (
   token: string,
@@ -11,7 +12,8 @@ const isValidToken = async (
     jwt.verify(token, key, (err, decoded) => {
       if (err) return reject(false)
 
-      if (decoded?.userId === userId && decoded?.clientId === clientId) {
+      const payload = decoded as InfoJWT
+      if (payload?.userId === userId && payload?.clientId === clientId) {
         return resolve(true)
       }
 

api/src/utils/validation.ts

@@ -192,3 +192,17 @@ export const executeProgramRawValidation = (data: any): Joi.ValidationResult =>
   })
     .pattern(/^/, Joi.alternatives(Joi.string(), Joi.number()))
     .validate(data)
+
+export const triggerProgramValidation = (data: any): Joi.ValidationResult =>
+  Joi.object({
+    _program: Joi.string().required(),
+    _debug: Joi.number(),
+    expiresAfterMins: Joi.number().greater(0)
+  })
+    .pattern(/^/, Joi.alternatives(Joi.string(), Joi.number()))
+    .validate(data)
+
+export const sessionIdValidation = (data: any): Joi.ValidationResult =>
+  Joi.object({
+    sessionId: Joi.string().required()
+  }).validate(data)

web/package.json

@@ -4,7 +4,9 @@
   "private": true,
   "scripts": {
     "start": "webpack-dev-server --config webpack.dev.ts --hot",
-    "build": "webpack --config webpack.prod.ts"
+    "build": "webpack --config webpack.prod.ts",
+    "lint": "npx prettier --check \"src/**/*.{ts,tsx,js,jsx,html,css,sass,less,yml,md,graphql}\"",
+    "lint:fix": "npx prettier --write \"src/**/*.{ts,tsx,js,jsx,html,css,sass,less,yml,md,graphql}\""
   },
   "dependencies": {
     "@emotion/react": "^11.4.1",
@@ -19,9 +21,8 @@
     "@types/jest": "^26.0.24",
     "@types/node": "^12.20.28",
     "@types/react": "^17.0.27",
-    "axios": "^0.24.0",
+    "axios": "1.12.2",
     "monaco-editor": "^0.33.0",
-    "monaco-editor-webpack-plugin": "^7.0.1",
     "react": "^17.0.2",
     "react-copy-to-clipboard": "^5.1.0",
     "react-dom": "^17.0.2",
@@ -54,8 +55,9 @@
     "eslint-webpack-plugin": "^3.1.1",
     "file-loader": "^6.2.0",
     "html-webpack-plugin": "5.5.0",
+    "monaco-editor-webpack-plugin": "^7.0.1",
     "path": "0.12.7",
-    "prettier": "^2.4.1",
+    "prettier": "^3.0.3",
     "sass": "^1.44.0",
     "sass-loader": "^12.3.0",
     "style-loader": "^3.3.1",

web/src/index.css

@@ -1,15 +1,15 @@
 body {
   margin: 0;
-  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen',
-    'Ubuntu', 'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue',
-    sans-serif;
+  font-family:
+    -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu',
+    'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif;
   -webkit-font-smoothing: antialiased;
   -moz-osx-font-smoothing: grayscale;
 }
 
 code {
-  font-family: source-code-pro, Menlo, Monaco, Consolas, 'Courier New',
-    monospace;
+  font-family:
+    source-code-pro, Menlo, Monaco, Consolas, 'Courier New', monospace;
 }
 
 .container {