@agentrific/server 0.5.0 → 0.5.2

package/index.js

@@ -1,27 +1,7 @@
-// src/warnings.ts
-var handlers = process.rawListeners("warning");
-process.removeAllListeners("warning");
-process.on("warning", (warning) => {
-  if (warning.name === "ExperimentalWarning" && warning.message === "SQLite is an experimental feature and might change at any time")
-    return;
-  for (const handler of handlers) handler.call(process, warning);
-});
-
-// src/push.ts
-import {
-  generateKeyPairSync,
-  createPrivateKey,
-  createPublicKey,
-  sign,
-  randomUUID
-} from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import { Effect } from "effect";
-
 // ../../packages/contracts/src/push.ts
 import { z } from "zod";
 var PUSH_API_URL = "https://api.agentrific.com";
+var PUSH_SANDBOX_API_URL = "https://sandbox-api.agentrific.com";
 var PushKindSchema = z.enum([
   "started",
   "completed",
@@ -85,7 +65,26 @@ function pushSigningText(installationId, operation, request) {
   ].join("\n");
 }
 
+// src/warnings.ts
+var handlers = process.rawListeners("warning");
+process.removeAllListeners("warning");
+process.on("warning", (warning) => {
+  if (warning.name === "ExperimentalWarning" && warning.message === "SQLite is an experimental feature and might change at any time")
+    return;
+  for (const handler of handlers) handler.call(process, warning);
+});
+
 // src/push.ts
+import {
+  generateKeyPairSync,
+  createPrivateKey,
+  createPublicKey,
+  sign,
+  randomUUID
+} from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { Effect } from "effect";
 function pushKind(session, previous) {
   if (session.gitDelivery?.status === "pr_opened" && previous?.gitDelivery?.status !== "pr_opened")
     return "pr_created";
@@ -957,7 +956,7 @@ function attachEventServer(app2, security2, origins, snapshot) {
 }
 
 // src/security.ts
-import { createHash, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { createHash as createHash2, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
 import { Effect as Effect4 } from "effect";
 import { z as z6 } from "zod";
 
@@ -967,10 +966,23 @@ import qrcode from "qrcode-terminal";
 
 // src/control.ts
 import { createServer, createConnection } from "node:net";
-import { chmod, mkdir as mkdir2, readFile as readFile2, unlink, writeFile } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, lstat, readFile as readFile2, unlink, writeFile } from "node:fs/promises";
 import path3 from "node:path";
 import { Effect as Effect3 } from "effect";
 import { z as z4 } from "zod";
+
+// ../../packages/contracts/src/control-socket.ts
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+function controlSocketPath(directory, uid = process.getuid?.()) {
+  const direct = join(resolve(directory), "control.sock");
+  if (Buffer.byteLength(direct) < 100) return direct;
+  if (uid === void 0) throw new Error("Local control sockets require macOS or Linux.");
+  const digest2 = createHash("sha256").update(resolve(directory)).digest("hex").slice(0, 32);
+  return join("/tmp", `agentrific-${uid}`, `${digest2}.sock`);
+}
+
+// src/control.ts
 var MaintenanceSchema = z4.object({
   active: z4.boolean(),
   drained: z4.boolean(),
@@ -979,6 +991,7 @@ var MaintenanceSchema = z4.object({
 var ControlStatusSchema = z4.object({
   serverId: z4.string().uuid(),
   publicUrl: z4.string().optional(),
+  localUrl: z4.string().optional(),
   serverVersion: z4.string().optional(),
   connectedDevices: z4.number().optional(),
   connectedSockets: z4.number().optional(),
@@ -996,12 +1009,14 @@ var ControlResultSchema = z4.union([
   DeviceSchema.array(),
   ControlStatusSchema,
   z4.object({ revoked: z4.boolean() }),
+  z4.object({ shutdown: z4.literal(true) }),
   MaintenanceSchema
 ]);
 var ControlRequest = z4.discriminatedUnion("command", [
   z4.object({ command: z4.literal("pair") }),
   z4.object({ command: z4.literal("devices") }),
   z4.object({ command: z4.literal("status") }),
+  z4.object({ command: z4.literal("shutdown") }),
   z4.object({ command: z4.literal("revoke"), id: z4.string().uuid() }),
   z4.object({
     command: z4.literal("maintenance"),
@@ -1050,8 +1065,14 @@ async function acquireServerLock(directory) {
       await unlink(filename);
   };
 }
-async function startControl(directory, security2, status, maintenance2) {
-  const filename = path3.join(directory, "control.sock");
+async function startControl(directory, security2, status, maintenance2, shutdown) {
+  const filename = controlSocketPath(directory);
+  const socketDirectory = path3.dirname(filename);
+  await mkdir2(socketDirectory, { recursive: true, mode: 448 });
+  const metadata = await lstat(socketDirectory);
+  if (!metadata.isDirectory() || metadata.uid !== process.getuid?.())
+    throw new Error("Local control directory must be private and owned by this user.");
+  await chmod(socketDirectory, 448);
   await unlink(filename).catch((error) => {
     if (!z4.object({ code: z4.literal("ENOENT") }).safeParse(error).success) throw error;
   });
@@ -1071,6 +1092,13 @@ async function startControl(directory, security2, status, maintenance2) {
           const request = ControlRequest.parse(JSON.parse(buffer.split("\n")[0]));
           let result;
           switch (request.command) {
+            case "shutdown":
+              if (!shutdown || !maintenance2?.status().drained)
+                throw new Error("Drain the server before shutdown");
+              socket.end(JSON.stringify({ result: { shutdown: true } }) + "\n", () => {
+                setImmediate(() => void shutdown());
+              });
+              return;
             case "pair":
               result = security2.createPairing();
               break;
@@ -1097,14 +1125,14 @@ async function startControl(directory, security2, status, maintenance2) {
     });
     socket.on("error", () => socket.destroy());
   });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve2, reject) => {
     server.once("error", reject);
-    server.listen(filename, resolve);
+    server.listen(filename, resolve2);
   });
   await chmod(filename, 384);
   return async () => {
     await new Promise(
-      (resolve, reject) => server.close((error) => error ? reject(error) : resolve())
+      (resolve2, reject) => server.close((error) => error ? reject(error) : resolve2())
     );
   };
 }
@@ -1112,7 +1140,7 @@ async function startControl(directory, security2, status, maintenance2) {
 // package.json
 var package_default = {
   name: "@agentrific/server",
-  version: "0.5.0",
+  version: "0.5.2",
   description: "Self-hosted control plane for long-running coding agents",
   keywords: [
     "agentrific",
@@ -1188,7 +1216,7 @@ function pairingOrigin(url) {
 
 // src/security.ts
 var secret = () => randomBytes(32).toString("hex");
-var digest = (value) => createHash("sha256").update(value).digest("hex");
+var digest = (value) => createHash2("sha256").update(value).digest("hex");
 var ServerSecurity = class {
   constructor(store2, serverId) {
     this.store = store2;
@@ -1386,7 +1414,7 @@ var Maintenance = class {
     this.enter();
     const deadline = Date.now() + timeoutMs;
     while (!this.status().drained && Date.now() < deadline)
-      await new Promise((resolve) => setTimeout(resolve, 50));
+      await new Promise((resolve2) => setTimeout(resolve2, 50));
     return this.status();
   }
   attach(app2) {
@@ -3797,7 +3825,7 @@ var SessionStore = class extends Context3.Service()(
 };
 
 // src/worktree-cleanup.ts
-import { lstat, rm as rm2 } from "node:fs/promises";
+import { lstat as lstat2, rm as rm2 } from "node:fs/promises";
 import path8 from "node:path";
 import { Effect as Effect15 } from "effect";
 var WorktreeCleanup = class {
@@ -3812,7 +3840,7 @@ var WorktreeCleanup = class {
   async remove(session, discardChanges = true) {
     if (session.gitFlow?.workspace !== "worktree" || !session.workspacePath) return;
     const workspace = path8.resolve(session.workspacePath);
-    const info = await lstat(workspace).catch((error) => {
+    const info = await lstat2(workspace).catch((error) => {
       if (error.code === "ENOENT") return void 0;
       throw error;
     });
@@ -3924,13 +3952,23 @@ var releaseLock = await acquireServerLock(dataRoot);
 var effects = ManagedRuntime.make(SessionStore.layer(path9.join(dataRoot, "sessions.sqlite")));
 var store = await effects.runPromise(SessionStore);
 var security = new ServerSecurity(store, await Effect17.runPromise(store.serverIdentity()));
+var sandboxPushUrl = process.env.AGENTRIFIC_PUSH_SANDBOX === "1" ? PUSH_SANDBOX_API_URL : void 0;
+if (sandboxPushUrl && process.env.AGENTRIFIC_TEST_MODE !== "1")
+  throw new Error("Sandbox push requires explicit test mode.");
 var testPushUrl = process.env.AGENTRIFIC_PUSH_TEST_URL;
 if (testPushUrl && (process.env.AGENTRIFIC_TEST_MODE !== "1" || !new URL(testPushUrl).hostname.endsWith(".ts.net") || new URL(testPushUrl).protocol !== "https:"))
   throw new Error("Test relay requires explicit test mode and Tailscale HTTPS.");
-var push = new ServerPush(store, security.serverId, dataRoot, fetch, testPushUrl);
+var push = new ServerPush(
+  store,
+  security.serverId,
+  dataRoot,
+  fetch,
+  testPushUrl ?? sandboxPushUrl
+);
 var allowedOrigins = [
   .../* @__PURE__ */ new Set([
     "agentrific-desktop://app",
+    "https://app.agentrific.com",
     ...(process.env.AGENTRIFIC_ALLOWED_ORIGINS ?? "http://localhost:8081,http://127.0.0.1:8081").split(","),
     `http://${host === "::1" ? "[::1]" : host}:${port}`,
     ...process.env.AGENTRIFIC_PUBLIC_URL ? [new URL(process.env.AGENTRIFIC_PUBLIC_URL).origin] : []
@@ -4662,12 +4700,17 @@ attachEventServer(app, security, allowedOrigins, () => ({
   type: "snapshot",
   sessions: Effect17.runSync(store.list())
 }));
+function localServerUrl() {
+  const address = z17.object({ port: z17.number() }).safeParse(app.server.address());
+  return address.success ? `http://${host}:${address.data.port}` : void 0;
+}
 var closeControl = await startControl(
   dataRoot,
   security,
   () => ({
     serverId: security.serverId,
     publicUrl: process.env.AGENTRIFIC_PUBLIC_URL,
+    localUrl: localServerUrl(),
     serverVersion,
     connectedDevices: new Set(security.sockets.values()).size,
     connectedSockets: security.sockets.size,
@@ -4675,7 +4718,11 @@ var closeControl = await startControl(
     activeRuns: activeAgents(Effect17.runSync(store.list())),
     maintenance: maintenance.status()
   }),
-  maintenance
+  maintenance,
+  async () => {
+    await app.close();
+    process.exit(0);
+  }
 );
 push.start();
 app.addHook("onClose", async () => {