@addai/node 0.29.1 → 0.30.0

package/dist/desktop/learn/recorder.mjs

@@ -1,151 +1,151 @@
-// The CDP recorder. Runs INSIDE the desktop container, next to the browser.
-//
-//   node /conf/learn/recorder.mjs
-//
-// Writes NDJSON on stdout, one event per line, `t` in ms since it attached.
-// The daemon reads that stream directly — no file, no polling — and batches it
-// into the lesson row.
-//
-// Nothing is installed to make this work: the image already has node 22, whose
-// global WebSocket is enough for CDP, and Chrome, which the browser wrapper has
-// already given a debug port. If the port is not there (a browser opened before
-// the wrapper existed) it says so in one line and exits 3, and the lesson goes
-// on without the browser track rather than failing.
-import { injectedSource } from './injected.mjs';
-
-const PORT = Number(process.env.ADDAI_LEARN_PORT || 9222);
-const t0 = Date.now();
-
-const emit = (o) => {
-  try { process.stdout.write(JSON.stringify({ t: Date.now() - t0, ...o }) + '\n'); }
-  catch { /* the daemon went away; nothing to do about it from here */ }
-};
-
-async function version() {
-  // A browser that is starting up refuses for a moment. Three tries over ~3s
-  // covers the case where a lesson begins in the same breath as the browser.
-  for (let i = 0; i < 3; i++) {
-    try {
-      const r = await fetch(`http://127.0.0.1:${PORT}/json/version`);
-      if (r.ok) return await r.json();
-    } catch { /* not up yet */ }
-    await new Promise((r) => setTimeout(r, 1000));
-  }
-  return null;
-}
-
-function client(url) {
-  const ws = new WebSocket(url);
-  let next = 1;
-  const pending = new Map();
-  const handlers = [];
-
-  const send = (method, params = {}, sessionId) =>
-    new Promise((resolve) => {
-      const id = next++;
-      pending.set(id, resolve);
-      const msg = { id, method, params };
-      if (sessionId) msg.sessionId = sessionId;
-      try { ws.send(JSON.stringify(msg)); } catch { pending.delete(id); resolve(null); }
-    });
-
-  ws.addEventListener('message', (ev) => {
-    let m;
-    try { m = JSON.parse(ev.data); } catch { return; }
-    if (m.id && pending.has(m.id)) { pending.get(m.id)(m.result ?? null); pending.delete(m.id); return; }
-    for (const h of handlers) h(m);
-  });
-
-  return {
-    ws,
-    send,
-    on: (fn) => handlers.push(fn),
-    ready: new Promise((resolve, reject) => {
-      ws.addEventListener('open', resolve);
-      ws.addEventListener('error', () => reject(new Error('cdp socket refused')));
-    }),
-  };
-}
-
-async function main() {
-  const v = await version();
-  if (!v || !v.webSocketDebuggerUrl) {
-    emit({ kind: 'no_port' });
-    process.exit(3);
-  }
-
-  const cdp = client(v.webSocketDebuggerUrl);
-  await cdp.ready;
-
-  const source = injectedSource();
-  const attached = new Set();
-
-  const arm = async (sessionId) => {
-    if (attached.has(sessionId)) return;
-    attached.add(sessionId);
-    await cdp.send('Runtime.enable', {}, sessionId);
-    await cdp.send('Page.enable', {}, sessionId);
-    // The binding is how the page talks back. Added before the script that
-    // calls it, or the first click on an already-open page is lost.
-    await cdp.send('Runtime.addBinding', { name: '__addaiLearn' }, sessionId);
-    await cdp.send('Page.addScriptToEvaluateOnNewDocument', { source }, sessionId);
-    // …and once for the document that is already loaded, which the line above
-    // does not cover.
-    await cdp.send('Runtime.evaluate', { expression: source }, sessionId);
-  };
-
-  cdp.on(async (m) => {
-    const s = m.sessionId;
-    if (m.method === 'Target.targetCreated' && m.params?.targetInfo?.type === 'page') {
-      await cdp.send('Target.attachToTarget', { targetId: m.params.targetInfo.targetId, flatten: true });
-      return;
-    }
-    if (m.method === 'Target.attachedToTarget') {
-      const info = m.params?.targetInfo ?? {};
-      if (info.type !== 'page') return;
-      emit({ kind: 'tab_open', url: info.url ?? null });
-      await arm(m.params.sessionId);
-      return;
-    }
-    if (m.method === 'Target.detachedFromTarget') {
-      attached.delete(m.params?.sessionId);
-      emit({ kind: 'tab_close' });
-      return;
-    }
-    if (m.method === 'Runtime.bindingCalled' && m.params?.name === '__addaiLearn') {
-      let ev;
-      try { ev = JSON.parse(m.params.payload); } catch { return; }
-      emit(ev);
-      return;
-    }
-    if (m.method === 'Page.frameNavigated' && !m.params?.frame?.parentId) {
-      emit({ kind: 'url', url: m.params.frame.url ?? null, title: null });
-      // A navigation replaces the execution context; re-arming is cheap and
-      // idempotent, and skipping it loses every click on the new page.
-      if (s) { attached.delete(s); await arm(s); }
-      return;
-    }
-    if (m.method === 'Page.loadEventFired' && s) {
-      const r = await cdp.send('Runtime.evaluate',
-        { expression: 'document.title', returnByValue: true }, s);
-      emit({ kind: 'load', title: r?.result?.value ?? null });
-      return;
-    }
-    if (m.method === 'Page.javascriptDialogOpening') {
-      emit({ kind: 'dialog', dtype: m.params?.type ?? null, message: m.params?.message ?? null });
-    }
-  });
-
-  await cdp.send('Target.setDiscoverTargets', { discover: true });
-  emit({ kind: 'watching' });
-
-  const bye = () => { try { cdp.ws.close(); } catch { /* already gone */ } process.exit(0); };
-  process.on('SIGTERM', bye);
-  process.on('SIGINT', bye);
-  cdp.ws.addEventListener('close', () => process.exit(0));
-}
-
-main().catch((e) => {
-  emit({ kind: 'recorder_error', message: String(e && e.message ? e.message : e) });
-  process.exit(1);
-});
+// The CDP recorder. Runs INSIDE the desktop container, next to the browser.
+//
+//   node /conf/learn/recorder.mjs
+//
+// Writes NDJSON on stdout, one event per line, `t` in ms since it attached.
+// The daemon reads that stream directly — no file, no polling — and batches it
+// into the lesson row.
+//
+// Nothing is installed to make this work: the image already has node 22, whose
+// global WebSocket is enough for CDP, and Chrome, which the browser wrapper has
+// already given a debug port. If the port is not there (a browser opened before
+// the wrapper existed) it says so in one line and exits 3, and the lesson goes
+// on without the browser track rather than failing.
+import { injectedSource } from './injected.mjs';
+
+const PORT = Number(process.env.ADDAI_LEARN_PORT || 9222);
+const t0 = Date.now();
+
+const emit = (o) => {
+  try { process.stdout.write(JSON.stringify({ t: Date.now() - t0, ...o }) + '\n'); }
+  catch { /* the daemon went away; nothing to do about it from here */ }
+};
+
+async function version() {
+  // A browser that is starting up refuses for a moment. Three tries over ~3s
+  // covers the case where a lesson begins in the same breath as the browser.
+  for (let i = 0; i < 3; i++) {
+    try {
+      const r = await fetch(`http://127.0.0.1:${PORT}/json/version`);
+      if (r.ok) return await r.json();
+    } catch { /* not up yet */ }
+    await new Promise((r) => setTimeout(r, 1000));
+  }
+  return null;
+}
+
+function client(url) {
+  const ws = new WebSocket(url);
+  let next = 1;
+  const pending = new Map();
+  const handlers = [];
+
+  const send = (method, params = {}, sessionId) =>
+    new Promise((resolve) => {
+      const id = next++;
+      pending.set(id, resolve);
+      const msg = { id, method, params };
+      if (sessionId) msg.sessionId = sessionId;
+      try { ws.send(JSON.stringify(msg)); } catch { pending.delete(id); resolve(null); }
+    });
+
+  ws.addEventListener('message', (ev) => {
+    let m;
+    try { m = JSON.parse(ev.data); } catch { return; }
+    if (m.id && pending.has(m.id)) { pending.get(m.id)(m.result ?? null); pending.delete(m.id); return; }
+    for (const h of handlers) h(m);
+  });
+
+  return {
+    ws,
+    send,
+    on: (fn) => handlers.push(fn),
+    ready: new Promise((resolve, reject) => {
+      ws.addEventListener('open', resolve);
+      ws.addEventListener('error', () => reject(new Error('cdp socket refused')));
+    }),
+  };
+}
+
+async function main() {
+  const v = await version();
+  if (!v || !v.webSocketDebuggerUrl) {
+    emit({ kind: 'no_port' });
+    process.exit(3);
+  }
+
+  const cdp = client(v.webSocketDebuggerUrl);
+  await cdp.ready;
+
+  const source = injectedSource();
+  const attached = new Set();
+
+  const arm = async (sessionId) => {
+    if (attached.has(sessionId)) return;
+    attached.add(sessionId);
+    await cdp.send('Runtime.enable', {}, sessionId);
+    await cdp.send('Page.enable', {}, sessionId);
+    // The binding is how the page talks back. Added before the script that
+    // calls it, or the first click on an already-open page is lost.
+    await cdp.send('Runtime.addBinding', { name: '__addaiLearn' }, sessionId);
+    await cdp.send('Page.addScriptToEvaluateOnNewDocument', { source }, sessionId);
+    // …and once for the document that is already loaded, which the line above
+    // does not cover.
+    await cdp.send('Runtime.evaluate', { expression: source }, sessionId);
+  };
+
+  cdp.on(async (m) => {
+    const s = m.sessionId;
+    if (m.method === 'Target.targetCreated' && m.params?.targetInfo?.type === 'page') {
+      await cdp.send('Target.attachToTarget', { targetId: m.params.targetInfo.targetId, flatten: true });
+      return;
+    }
+    if (m.method === 'Target.attachedToTarget') {
+      const info = m.params?.targetInfo ?? {};
+      if (info.type !== 'page') return;
+      emit({ kind: 'tab_open', url: info.url ?? null });
+      await arm(m.params.sessionId);
+      return;
+    }
+    if (m.method === 'Target.detachedFromTarget') {
+      attached.delete(m.params?.sessionId);
+      emit({ kind: 'tab_close' });
+      return;
+    }
+    if (m.method === 'Runtime.bindingCalled' && m.params?.name === '__addaiLearn') {
+      let ev;
+      try { ev = JSON.parse(m.params.payload); } catch { return; }
+      emit(ev);
+      return;
+    }
+    if (m.method === 'Page.frameNavigated' && !m.params?.frame?.parentId) {
+      emit({ kind: 'url', url: m.params.frame.url ?? null, title: null });
+      // A navigation replaces the execution context; re-arming is cheap and
+      // idempotent, and skipping it loses every click on the new page.
+      if (s) { attached.delete(s); await arm(s); }
+      return;
+    }
+    if (m.method === 'Page.loadEventFired' && s) {
+      const r = await cdp.send('Runtime.evaluate',
+        { expression: 'document.title', returnByValue: true }, s);
+      emit({ kind: 'load', title: r?.result?.value ?? null });
+      return;
+    }
+    if (m.method === 'Page.javascriptDialogOpening') {
+      emit({ kind: 'dialog', dtype: m.params?.type ?? null, message: m.params?.message ?? null });
+    }
+  });
+
+  await cdp.send('Target.setDiscoverTargets', { discover: true });
+  emit({ kind: 'watching' });
+
+  const bye = () => { try { cdp.ws.close(); } catch { /* already gone */ } process.exit(0); };
+  process.on('SIGTERM', bye);
+  process.on('SIGINT', bye);
+  cdp.ws.addEventListener('close', () => process.exit(0));
+}
+
+main().catch((e) => {
+  emit({ kind: 'recorder_error', message: String(e && e.message ? e.message : e) });
+  process.exit(1);
+});

package/dist/desktop/manager.d.ts

@@ -17,8 +17,21 @@ export declare function setStatus(id: string, fields: {
      *  but not recorded means "password check failed" at the RFB handshake. */
     vnc_password?: string | null;
 }): Promise<void>;
-/** A free loopback port for this desktop's VNC. Asking the OS for port 0 and
- *  reading back what it bound is the only race-free way to pick one. */
+/** A free loopback port for this desktop — and, at a fixed offset from it, a
+ *  free one for its xpra channel too.
+ *
+ *  ⚠️ BOTH are checked, because only ONE is stored.
+ *
+ *  The row carries a single port and the xpra port is computed from it (see
+ *  XPRA_PORT_OFFSET), so a base whose partner is already taken would give a
+ *  desktop whose windows channel quietly dials some other service on the
+ *  machine. Binding the second proves it free at the moment of choosing.
+ *
+ *  Nothing holds either port between here and `docker run` — that is the same
+ *  race the single-port version always had, and sequential allocation by the
+ *  OS makes it vanishingly unlikely. Several attempts rather than one because
+ *  a busy machine can hand back a base whose partner happens to be in use,
+ *  and retrying costs nothing next to failing to create the desktop. */
 export declare function allocateVncPort(): Promise<number>;
 export declare function ensureDirs(desktopId: string): {
     confDir: string;

package/dist/desktop/manager.js

@@ -111,18 +111,50 @@ async function setStatus(id, fields) {
         console.error('[desktops] status update failed:', err.message);
     }
 }
-/** A free loopback port for this desktop's VNC. Asking the OS for port 0 and
- *  reading back what it bound is the only race-free way to pick one. */
-function allocateVncPort() {
+/** Bind a loopback port and read back what was actually bound. Port 0 asks the
+ *  OS to choose, which is the only race-free way to pick a free one. */
+function reserve(port) {
     return new Promise((resolve, reject) => {
         const srv = net.createServer();
         srv.once('error', reject);
-        srv.listen(0, '127.0.0.1', () => {
-            const port = srv.address().port;
-            srv.close(() => resolve(port));
+        srv.listen(port, '127.0.0.1', () => {
+            const got = srv.address().port;
+            srv.close(() => resolve(got));
         });
     });
 }
+/** A free loopback port for this desktop — and, at a fixed offset from it, a
+ *  free one for its xpra channel too.
+ *
+ *  ⚠️ BOTH are checked, because only ONE is stored.
+ *
+ *  The row carries a single port and the xpra port is computed from it (see
+ *  XPRA_PORT_OFFSET), so a base whose partner is already taken would give a
+ *  desktop whose windows channel quietly dials some other service on the
+ *  machine. Binding the second proves it free at the moment of choosing.
+ *
+ *  Nothing holds either port between here and `docker run` — that is the same
+ *  race the single-port version always had, and sequential allocation by the
+ *  OS makes it vanishingly unlikely. Several attempts rather than one because
+ *  a busy machine can hand back a base whose partner happens to be in use,
+ *  and retrying costs nothing next to failing to create the desktop. */
+async function allocateVncPort() {
+    let lastErr = null;
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+        const base = await reserve(0);
+        try {
+            await reserve(base + spec_1.XPRA_PORT_OFFSET);
+            return base;
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    // Every attempt found the partner taken. Saying so beats handing back a port
+    // whose second half belongs to something else.
+    throw new Error('could not find a free port pair for this desktop after 8 tries: '
+        + (lastErr?.message ?? 'unknown'));
+}
 function ensureDirs(desktopId) {
     const confDir = (0, spec_1.confDirFor)(desktopId);
     const workDir = (0, spec_1.workDirFor)(desktopId);

package/dist/desktop/provider.js

@@ -29,6 +29,15 @@ function buildCreateArgs(row, opts) {
         // Loopback ONLY. Binding 0.0.0.0 would expose a logged-in desktop to the
         // whole LAN; the relay reaches it from the daemon on the same host.
         '-p', `127.0.0.1:${opts.vncPort}:${spec_1.VNC_PORT_IN_CONTAINER}`,
+        // The same desktop's windows, one at a time, over xpra. Published at a
+        // fixed offset from the port above because the row stores only that one —
+        // see XPRA_PORT_OFFSET, and allocateVncPort, which reserves the pair.
+        //
+        // Harmless on an image built before xpra existed: nothing listens inside,
+        // the publish still succeeds, and a viewer asking for the windows channel
+        // gets a refused connection that the bridge reports as "lost the desktop
+        // connection" rather than leaving them on a frozen frame.
+        '-p', `127.0.0.1:${opts.vncPort + spec_1.XPRA_PORT_OFFSET}:${spec_1.XPRA_PORT_IN_CONTAINER}`,
         '-v', `${opts.confDir}:${spec_1.CONF_ROOT}`,
     ];
     if (opts.workDir)

package/dist/desktop/relay-client.js

@@ -49,14 +49,17 @@ exports.stopRelayClient = stopRelayClient;
 // whose socket is down; this is the fast path, not the only path.
 //
 // Two kinds of traffic share it:
-//   - RAW RFB bytes for desktop viewers. The container serves RFB directly
-//     (no websockify), so noVNC in the browser speaks RFB across it unchanged.
+//   - RAW bytes for desktop viewers, on whichever channel they asked for: RFB
+//     for the whole screen, xpra for its windows one at a time. The bridge
+//     never parses either — it is a byte pipe, and that is what lets a second
+//     protocol ride it without this file learning anything about it.
 //   - `wake` control frames, which cost nothing when idle and turn a ten
 //     second wait into a round trip.
 const ws_1 = __importDefault(require("ws"));
 const net = __importStar(require("net"));
 const store_1 = require("../store");
 const manager_1 = require("./manager");
+const spec_1 = require("./spec");
 // The deployed relay. Overridable so a node can be pointed at a local one.
 const RELAY_URL = process.env.AINODE_RELAY_URL
     ?? 'wss://desktop-relay-29522465016.europe-west2.run.app';
@@ -182,9 +185,30 @@ async function connect() {
                 gone(msg.viewerId, 'desktop is not running');
                 return;
             }
-            // Loopback only - the container published its RFB on 127.0.0.1 and this
-            // process is the only thing on the machine that reaches it.
-            const tcp = net.connect(row.vnc_port, '127.0.0.1');
+            // WHICH stream of that desktop.
+            //
+            // 'screen' is the whole framebuffer over RFB, and is what every viewer
+            // asked for before this existed — so an absent or unrecognised channel
+            // means that. An older relay sends no channel at all and gets exactly
+            // the behaviour it always got.
+            //
+            // 'windows' is xpra on the container's second display, delivering each
+            // application window on its own. The bridge below does not care which:
+            // it is a byte pipe, and carries xpra's protocol as blindly as RFB.
+            //
+            // ⚠️ The xpra port is DERIVED, not stored. entity_node_desktops has one
+            // port column, and adding a second would mean a migration plus a fleet
+            // that disagrees with its own schema for the hour it takes to update.
+            // The container publishes 5900 and 14500, and the daemon maps the row's
+            // port to the first — so the second sits at a fixed offset from it.
+            // provider.ts is the other half of this bargain; if the published ports
+            // ever stop being a pair, these two lines are what know about it.
+            const port = msg.channel === 'windows'
+                ? row.vnc_port + spec_1.XPRA_PORT_OFFSET
+                : row.vnc_port;
+            // Loopback only - the container published its ports on 127.0.0.1 and
+            // this process is the only thing on the machine that reaches them.
+            const tcp = net.connect(port, '127.0.0.1');
             tcp.on('data', chunk => {
                 if (sock.readyState === ws_1.default.OPEN) {
                     sock.send(JSON.stringify({

package/dist/desktop/spec.d.ts

@@ -34,6 +34,29 @@ export declare const CONF_ROOT = "/conf";
  *  websockify in the container too would mean a WebSocket handshake tunnelled
  *  inside a WebSocket, which no client can read. */
 export declare const VNC_PORT_IN_CONTAINER = 5900;
+/** The container's xpra port, also fixed by the image.
+ *
+ *  The same machine delivered a second way: 5900 is the whole framebuffer,
+ *  this is its application windows one at a time. Raw for the same reason —
+ *  xpra's own protocol carried across the relay's WebSocket, not tunnelled
+ *  inside a second one. */
+export declare const XPRA_PORT_IN_CONTAINER = 14500;
+/** How far a desktop's host xpra port sits from its host VNC port.
+ *
+ *  ⚠️ DERIVED rather than stored, and that is a deliberate trade.
+ *
+ *  entity_node_desktops has one port column. A second would mean a migration,
+ *  a reconciler that fills it, and — because the fleet auto-updates hourly —
+ *  an hour in which some daemons write the new column and others do not, for
+ *  rows both are reading. A fixed offset needs none of that: the pair is
+ *  reserved together and both ends compute the same second number from the
+ *  one value the row already carries.
+ *
+ *  The cost is that the two ports must be allocated together and published
+ *  together, or the offset points at something else's port. allocateVncPort
+ *  and buildCreateArgs are the two halves of that bargain here;
+ *  relay-client.ts is the third, on the far side of the wire. */
+export declare const XPRA_PORT_OFFSET = 100;
 /** Host directory bind-mounted at CONF_ROOT for one desktop. */
 export declare function confDirFor(desktopId: string): string;
 /** Host directory holding the desktop's persistent /work volume. */

package/dist/desktop/spec.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VNC_PORT_IN_CONTAINER = exports.CONF_ROOT = exports.WORK_ROOT = void 0;
+exports.XPRA_PORT_OFFSET = exports.XPRA_PORT_IN_CONTAINER = exports.VNC_PORT_IN_CONTAINER = exports.CONF_ROOT = exports.WORK_ROOT = void 0;
 exports.confDirFor = confDirFor;
 exports.workDirFor = workDirFor;
 // Shapes and paths shared by every desktop module. No I/O here.
@@ -52,6 +52,29 @@ exports.CONF_ROOT = '/conf';
  *  websockify in the container too would mean a WebSocket handshake tunnelled
  *  inside a WebSocket, which no client can read. */
 exports.VNC_PORT_IN_CONTAINER = 5900;
+/** The container's xpra port, also fixed by the image.
+ *
+ *  The same machine delivered a second way: 5900 is the whole framebuffer,
+ *  this is its application windows one at a time. Raw for the same reason —
+ *  xpra's own protocol carried across the relay's WebSocket, not tunnelled
+ *  inside a second one. */
+exports.XPRA_PORT_IN_CONTAINER = 14500;
+/** How far a desktop's host xpra port sits from its host VNC port.
+ *
+ *  ⚠️ DERIVED rather than stored, and that is a deliberate trade.
+ *
+ *  entity_node_desktops has one port column. A second would mean a migration,
+ *  a reconciler that fills it, and — because the fleet auto-updates hourly —
+ *  an hour in which some daemons write the new column and others do not, for
+ *  rows both are reading. A fixed offset needs none of that: the pair is
+ *  reserved together and both ends compute the same second number from the
+ *  one value the row already carries.
+ *
+ *  The cost is that the two ports must be allocated together and published
+ *  together, or the offset points at something else's port. allocateVncPort
+ *  and buildCreateArgs are the two halves of that bargain here;
+ *  relay-client.ts is the third, on the far side of the wire. */
+exports.XPRA_PORT_OFFSET = 100;
 /** Host directory bind-mounted at CONF_ROOT for one desktop. */
 function confDirFor(desktopId) {
     return path.join(paths_1.RUNTIME_HOME, 'desktops', desktopId, 'conf');