@agentrific/server 0.5.1 → 0.5.2

package/index.js

@@ -956,7 +956,7 @@ function attachEventServer(app2, security2, origins, snapshot) {
 }
 
 // src/security.ts
-import { createHash, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { createHash as createHash2, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
 import { Effect as Effect4 } from "effect";
 import { z as z6 } from "zod";
 
@@ -966,10 +966,23 @@ import qrcode from "qrcode-terminal";
 
 // src/control.ts
 import { createServer, createConnection } from "node:net";
-import { chmod, mkdir as mkdir2, readFile as readFile2, unlink, writeFile } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, lstat, readFile as readFile2, unlink, writeFile } from "node:fs/promises";
 import path3 from "node:path";
 import { Effect as Effect3 } from "effect";
 import { z as z4 } from "zod";
+
+// ../../packages/contracts/src/control-socket.ts
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+function controlSocketPath(directory, uid = process.getuid?.()) {
+  const direct = join(resolve(directory), "control.sock");
+  if (Buffer.byteLength(direct) < 100) return direct;
+  if (uid === void 0) throw new Error("Local control sockets require macOS or Linux.");
+  const digest2 = createHash("sha256").update(resolve(directory)).digest("hex").slice(0, 32);
+  return join("/tmp", `agentrific-${uid}`, `${digest2}.sock`);
+}
+
+// src/control.ts
 var MaintenanceSchema = z4.object({
   active: z4.boolean(),
   drained: z4.boolean(),
@@ -978,6 +991,7 @@ var MaintenanceSchema = z4.object({
 var ControlStatusSchema = z4.object({
   serverId: z4.string().uuid(),
   publicUrl: z4.string().optional(),
+  localUrl: z4.string().optional(),
   serverVersion: z4.string().optional(),
   connectedDevices: z4.number().optional(),
   connectedSockets: z4.number().optional(),
@@ -995,12 +1009,14 @@ var ControlResultSchema = z4.union([
   DeviceSchema.array(),
   ControlStatusSchema,
   z4.object({ revoked: z4.boolean() }),
+  z4.object({ shutdown: z4.literal(true) }),
   MaintenanceSchema
 ]);
 var ControlRequest = z4.discriminatedUnion("command", [
   z4.object({ command: z4.literal("pair") }),
   z4.object({ command: z4.literal("devices") }),
   z4.object({ command: z4.literal("status") }),
+  z4.object({ command: z4.literal("shutdown") }),
   z4.object({ command: z4.literal("revoke"), id: z4.string().uuid() }),
   z4.object({
     command: z4.literal("maintenance"),
@@ -1049,8 +1065,14 @@ async function acquireServerLock(directory) {
       await unlink(filename);
   };
 }
-async function startControl(directory, security2, status, maintenance2) {
-  const filename = path3.join(directory, "control.sock");
+async function startControl(directory, security2, status, maintenance2, shutdown) {
+  const filename = controlSocketPath(directory);
+  const socketDirectory = path3.dirname(filename);
+  await mkdir2(socketDirectory, { recursive: true, mode: 448 });
+  const metadata = await lstat(socketDirectory);
+  if (!metadata.isDirectory() || metadata.uid !== process.getuid?.())
+    throw new Error("Local control directory must be private and owned by this user.");
+  await chmod(socketDirectory, 448);
   await unlink(filename).catch((error) => {
     if (!z4.object({ code: z4.literal("ENOENT") }).safeParse(error).success) throw error;
   });
@@ -1070,6 +1092,13 @@ async function startControl(directory, security2, status, maintenance2) {
           const request = ControlRequest.parse(JSON.parse(buffer.split("\n")[0]));
           let result;
           switch (request.command) {
+            case "shutdown":
+              if (!shutdown || !maintenance2?.status().drained)
+                throw new Error("Drain the server before shutdown");
+              socket.end(JSON.stringify({ result: { shutdown: true } }) + "\n", () => {
+                setImmediate(() => void shutdown());
+              });
+              return;
             case "pair":
               result = security2.createPairing();
               break;
@@ -1096,14 +1125,14 @@ async function startControl(directory, security2, status, maintenance2) {
     });
     socket.on("error", () => socket.destroy());
   });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve2, reject) => {
     server.once("error", reject);
-    server.listen(filename, resolve);
+    server.listen(filename, resolve2);
   });
   await chmod(filename, 384);
   return async () => {
     await new Promise(
-      (resolve, reject) => server.close((error) => error ? reject(error) : resolve())
+      (resolve2, reject) => server.close((error) => error ? reject(error) : resolve2())
     );
   };
 }
@@ -1111,7 +1140,7 @@ async function startControl(directory, security2, status, maintenance2) {
 // package.json
 var package_default = {
   name: "@agentrific/server",
-  version: "0.5.1",
+  version: "0.5.2",
   description: "Self-hosted control plane for long-running coding agents",
   keywords: [
     "agentrific",
@@ -1187,7 +1216,7 @@ function pairingOrigin(url) {
 
 // src/security.ts
 var secret = () => randomBytes(32).toString("hex");
-var digest = (value) => createHash("sha256").update(value).digest("hex");
+var digest = (value) => createHash2("sha256").update(value).digest("hex");
 var ServerSecurity = class {
   constructor(store2, serverId) {
     this.store = store2;
@@ -1385,7 +1414,7 @@ var Maintenance = class {
     this.enter();
     const deadline = Date.now() + timeoutMs;
     while (!this.status().drained && Date.now() < deadline)
-      await new Promise((resolve) => setTimeout(resolve, 50));
+      await new Promise((resolve2) => setTimeout(resolve2, 50));
     return this.status();
   }
   attach(app2) {
@@ -3796,7 +3825,7 @@ var SessionStore = class extends Context3.Service()(
 };
 
 // src/worktree-cleanup.ts
-import { lstat, rm as rm2 } from "node:fs/promises";
+import { lstat as lstat2, rm as rm2 } from "node:fs/promises";
 import path8 from "node:path";
 import { Effect as Effect15 } from "effect";
 var WorktreeCleanup = class {
@@ -3811,7 +3840,7 @@ var WorktreeCleanup = class {
   async remove(session, discardChanges = true) {
     if (session.gitFlow?.workspace !== "worktree" || !session.workspacePath) return;
     const workspace = path8.resolve(session.workspacePath);
-    const info = await lstat(workspace).catch((error) => {
+    const info = await lstat2(workspace).catch((error) => {
       if (error.code === "ENOENT") return void 0;
       throw error;
     });
@@ -3939,6 +3968,7 @@ var push = new ServerPush(
 var allowedOrigins = [
   .../* @__PURE__ */ new Set([
     "agentrific-desktop://app",
+    "https://app.agentrific.com",
     ...(process.env.AGENTRIFIC_ALLOWED_ORIGINS ?? "http://localhost:8081,http://127.0.0.1:8081").split(","),
     `http://${host === "::1" ? "[::1]" : host}:${port}`,
     ...process.env.AGENTRIFIC_PUBLIC_URL ? [new URL(process.env.AGENTRIFIC_PUBLIC_URL).origin] : []
@@ -4670,12 +4700,17 @@ attachEventServer(app, security, allowedOrigins, () => ({
   type: "snapshot",
   sessions: Effect17.runSync(store.list())
 }));
+function localServerUrl() {
+  const address = z17.object({ port: z17.number() }).safeParse(app.server.address());
+  return address.success ? `http://${host}:${address.data.port}` : void 0;
+}
 var closeControl = await startControl(
   dataRoot,
   security,
   () => ({
     serverId: security.serverId,
     publicUrl: process.env.AGENTRIFIC_PUBLIC_URL,
+    localUrl: localServerUrl(),
     serverVersion,
     connectedDevices: new Set(security.sockets.values()).size,
     connectedSockets: security.sockets.size,
@@ -4683,7 +4718,11 @@ var closeControl = await startControl(
     activeRuns: activeAgents(Effect17.runSync(store.list())),
     maintenance: maintenance.status()
   }),
-  maintenance
+  maintenance,
+  async () => {
+    await app.close();
+    process.exit(0);
+  }
 );
 push.start();
 app.addHook("onClose", async () => {