@ai-projector/ide 0.0.0-stage → 0.11.0

package/packages/server/app/features.js

@@ -0,0 +1,35 @@
+import { registerAgentFeature, registerFeatureAgent } from "../modules/agent-features/index.js";
+import { listAgentBackends } from "../modules/agent/index.js";
+import { widgetCatalog } from "../modules/agents/projector/index.js";
+/** What the widgets are for: the components themselves come from the catalog at call time. */
+const WIDGETS_INTRO = "Отчёты, дашборды, сводки, графики, калькуляторы и формы выбора в ответе — это не разработка кода проекта: собирай их сам и не отсылай к другому агенту. Вставляй Vue-компоненты прямо в markdown, когда это нагляднее текста (цифры, динамика, сравнения, настройки, выбор). Обычные вопросы компонентами не загромождай.";
+/**
+ * The IDE commands are one MCP server with three tools, not one tool per feature: the live
+ * catalog is the source of truth, exactly as it is for the built-in Projector agent.
+ */
+const IDE_INTRO = "Управление IDE. В этом чате доступны команды Projector: `list_commands`, `describe_command` и `execute_command` (у внешних агентов они приходят через MCP-сервер `projector-ide`). Не выдумывай команды и аргументы: сначала `list_commands` (пустой query — весь каталог проекта), затем `describe_command` для выбранной пары command и scope, и только потом `execute_command` с теми же command и scope. Изменяющие команды Projector спрашивают подтверждение в окне Projector. Открывай файлы и вкладки, работай с Git, настройками, терминалами и чатами командами Projector, а не дублируй их shell-командами, если подходящая команда есть.";
+/**
+ * The optional abilities the chat can give to an agent. The composition is the only place that
+ * names them, like the widgets; `registerBuiltinWidgetDefinitions` has to run first, because the
+ * instruction reads the live catalog.
+ */
+export function registerBuiltinAgentFeatures() {
+    const backends = listAgentBackends();
+    for (const agent of backends)
+        registerFeatureAgent({ id: agent.id, label: agent.label });
+    registerAgentFeature({
+        id: "widgets",
+        title: "Виджеты в ответах",
+        summary: "Графики, показатели, вкладки и формы прямо в markdown-ответе.",
+        defaults: backends.filter(({ builtin }) => builtin).map(({ id }) => id),
+        instruction: () => `Виджеты в ответах. ${WIDGETS_INTRO}\n\n${widgetCatalog.guide()}`,
+    });
+    registerAgentFeature({
+        id: "ide",
+        title: "Команды IDE через MCP",
+        summary: "Агент открывает файлы и вкладки, работает с Git и настройками командами Projector.",
+        // Off until the user asks for it: the server can change files, Git and Projector itself.
+        defaults: [],
+        instruction: () => `Команды IDE. ${IDE_INTRO}`,
+    });
+}

package/packages/server/app/plugin.js

@@ -0,0 +1,140 @@
+import { bindHub } from "../modules/hub/index.js";
+import { findProject, loadProjects } from "../modules/projects/index.js";
+import { bindWorkspaceEvents } from "../modules/workspace/index.js";
+import { handleApi } from "./api.js";
+import { clearInstance, writeInstance } from "../modules/instance/index.js";
+import { APP_PORT, appUrl, startServerLogRotation, } from "../../core/modules/app-paths/index.js";
+import { os } from "../../core/modules/os/index.js";
+import { CLAUDE_SESSION_ENV } from "../modules/agents/claude-code/index.js";
+import { openLauncher, startTray } from "../modules/window/index.js";
+import { attachTerminalServer, listTerminalSessions } from "../modules/terminal/index.js";
+import { pruneRuns, recoverJobs, bindAgentEventStreams } from "../modules/agent/index.js";
+import { registerBuiltinAgents } from "./agents.js";
+import { registerBuiltinWidgetDefinitions } from "./widgets.js";
+import { registerBuiltinAgentFeatures } from "./features.js";
+import { ensureIdeMcpToken, bindIdeCommandEvents } from "../modules/ide/index.js";
+import { reconcileOnStartup } from "../modules/environments/index.js";
+import { attachSharedTerminalServer, attachTerminalControlServer, terminalControl, } from "../modules/terminal-control/index.js";
+import { authorizeHttp, accessAllowed } from "../modules/access/index.js";
+import { handleProxyHost, isProxyHost } from "../modules/browser/index.js";
+/** Process hooks must survive Vite's config reload without retaining old module closures. */
+const runtime = globalThis;
+function listenAddress(address) {
+    if (address && typeof address === "object") {
+        return `http://localhost:${address.port}`;
+    }
+    return appUrl();
+}
+function bindHooks() {
+    if (runtime.projectorExitHook)
+        process.off("exit", runtime.projectorExitHook);
+    runtime.projectorExitHook = clearInstance;
+    process.on("exit", runtime.projectorExitHook);
+}
+/** Общая часть dev, preview и standalone: режим, сокеты терминалов, запись instance, окно. */
+export function bindRuntime(httpServer, mode, handlers = getRuntimeHandlers) {
+    // The daemon owns its log file: keep it bounded while dev warnings write megabytes.
+    startServerLogRotation();
+    // Регистрация при вызове, а не при импорте: импорт конфига Vite не должен трогать агентов.
+    registerBuiltinAgents();
+    registerBuiltinWidgetDefinitions();
+    registerBuiltinAgentFeatures();
+    void ensureIdeMcpToken().catch((error) => console.error("Ключ IDE MCP:", error instanceof Error ? error.message : error));
+    // Сервер, запущенный из сессии Claude Code, иначе передаёт её метки каждому терминалу и агенту.
+    os.clearSessionEnv(CLAUDE_SESSION_ENV);
+    runtime.projectorRuntimeMode = mode;
+    const subscriptions = [bindAgentEventStreams(), bindIdeCommandEvents(), bindWorkspaceEvents()];
+    const deactivate = () => subscriptions.forEach((off) => off());
+    if (!httpServer)
+        return deactivate;
+    const allowed = (...args) => handlers().accessAllowed(...args);
+    const operations = {
+        allowed,
+        control: (...args) => handlers().terminalControl(...args),
+        sessions: (...args) => handlers().terminalSessions(...args),
+        project: (...args) => handlers().findProject(...args),
+    };
+    const transports = [
+        attachTerminalServer(httpServer, {
+            allowed,
+            projects: (...args) => handlers().loadProjects(...args),
+        }),
+        attachTerminalControlServer(httpServer, operations),
+        attachSharedTerminalServer(httpServer, operations),
+    ];
+    const stopHub = bindHub({
+        handle(req, res) {
+            void handlers()
+                .handleHttp(req, res, () => res.writeHead(404).end())
+                .catch(() => {
+                if (!res.headersSent)
+                    res.writeHead(500);
+                res.end();
+            });
+        },
+        attach(server) {
+            const disposers = [
+                attachTerminalServer(server, {
+                    allowed,
+                    projects: (...args) => handlers().loadProjects(...args),
+                }),
+                attachTerminalControlServer(server, operations),
+                attachSharedTerminalServer(server, operations),
+            ];
+            return () => disposers.forEach((dispose) => dispose?.());
+        },
+    });
+    const listening = () => {
+        const address = httpServer.address();
+        const port = address && typeof address === "object" ? address.port : APP_PORT;
+        void writeInstance(port);
+        bindHooks();
+        // Jobs first: they rejoin the runs that the cleanup keeps for them.
+        void recoverJobs()
+            .catch((error) => console.error("Фоновые агенты:", error.message))
+            .then(() => pruneRuns())
+            .catch(() => { });
+        void reconcileOnStartup().catch((error) => console.error("Очистка контейнеров:", error.message));
+        const url = listenAddress(address);
+        // Child agents and their MCP servers reach this exact address, even on a non-default port.
+        process.env.PROJECTOR_URL = url;
+        if (process.env.PROJECTOR_WINDOW === "1") {
+            void openLauncher(url).catch(console.error);
+        }
+        else if (os.supported) {
+            // `vp dev` не открывает палитру, но хоткей и иконка должны быть сразу.
+            void startTray(url).catch((error) => console.warn("Трей недоступен:", error instanceof Error ? error.message : error));
+        }
+    };
+    if (httpServer.listening)
+        bindHooks();
+    else
+        httpServer.once("listening", listening);
+    return () => {
+        httpServer.off("listening", listening);
+        stopHub();
+        for (const dispose of transports)
+            dispose?.();
+        deactivate();
+    };
+}
+/** A complete request/operation generation; no resource is recreated while constructing it. */
+export function getRuntimeHandlers() {
+    return {
+        async handleHttp(req, res, next) {
+            if (isProxyHost(req)) {
+                await handleProxyHost(req, res);
+                return;
+            }
+            if (!authorizeHttp(req, res, true))
+                return;
+            if (!(await handleApi(req, res)))
+                next();
+        },
+        terminalControl,
+        terminalSessions: listTerminalSessions,
+        accessAllowed,
+        findProject,
+        loadProjects,
+    };
+}

package/packages/server/app/projector-runner.js

@@ -0,0 +1,15 @@
+// One answer of the Projector assistant, held by its own process so that a server restart or a hot
+// reload leaves it going: the model request, the tools and the shell commands they started all
+// continue, and the restarted server rejoins them through the host's trace.
+//
+// Usage: node projector-runner.ts <run directory>
+import { registerAgentBackend, runHostedRunner } from "../modules/agent/index.js";
+import { projectorBackend, runProjector } from "../modules/agents/projector/index.js";
+import { registerBuiltinWidgetDefinitions } from "./widgets.js";
+import { registerBuiltinAgentFeatures } from "./features.js";
+// The server registers these when it starts; the system prompt of the answer lists them. This
+// process runs one agent, so it registers that backend before the features ask for the catalog.
+registerAgentBackend(projectorBackend, { asDefault: true });
+registerBuiltinWidgetDefinitions();
+registerBuiltinAgentFeatures();
+runHostedRunner(runProjector);

package/packages/server/app/runtime-contract.js

@@ -0,0 +1 @@
+export {};

package/packages/server/app/standalone.js

@@ -0,0 +1,42 @@
+import { createServer } from "node:http";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { handleApi } from "./api.js";
+import { bindRuntime } from "./plugin.js";
+import { serveStatic } from "./static.js";
+import { APP_PORT, readNetworkMode } from "../../core/modules/app-paths/index.js";
+import { networkHost } from "../../core/modules/network-mode/index.js";
+import { authorizeHttp } from "../modules/access/index.js";
+import { handleProxyHost, isProxyHost } from "../modules/browser/index.js";
+/** Prod-сервер без Vite: собранный `dist` и API Projector на чистом Node. */
+const root = fileURLToPath(new URL("../../../dist", import.meta.url));
+if (!existsSync(root + "/index.html")) {
+    console.error("dist не найден: выполните vp build");
+    process.exit(1);
+}
+const server = createServer((req, res) => {
+    if (isProxyHost(req)) {
+        void handleProxyHost(req, res);
+        return;
+    }
+    if (!authorizeHttp(req, res, true))
+        return;
+    void handleApi(req, res)
+        .then((handled) => (handled ? undefined : serveStatic(root, req, res)))
+        .catch((error) => {
+        console.error(error);
+        if (!res.headersSent)
+            res.writeHead(500);
+        res.end();
+    });
+});
+bindRuntime(server, "prod");
+server.on("error", (error) => {
+    console.error(error);
+    process.exit(1);
+});
+const host = networkHost(readNetworkMode());
+const port = Number(process.env.PROJECTOR_PORT) || APP_PORT;
+server.listen(port, host, () => console.log(`Projector (prod): http://localhost:${port}`));
+for (const signal of ["SIGINT", "SIGTERM"])
+    process.on(signal, () => process.exit(0));

package/packages/server/app/static.js

@@ -0,0 +1,57 @@
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { extname, join, normalize, sep } from "node:path";
+const TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".webmanifest": "application/manifest+json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".ico": "image/x-icon",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".wasm": "application/wasm",
+    ".map": "application/json",
+};
+async function isFile(path) {
+    return stat(path).then((info) => info.isFile(), () => false);
+}
+/** Отдаёт файл из `root`; неизвестные пути без расширения уходят в index.html (SPA). */
+export async function serveStatic(root, req, res) {
+    if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { Allow: "GET, HEAD" }).end();
+        return;
+    }
+    let pathname;
+    try {
+        pathname = decodeURIComponent(new URL(req.url ?? "/", "http://localhost").pathname);
+    }
+    catch {
+        res.writeHead(400).end();
+        return;
+    }
+    const candidate = normalize(join(root, pathname));
+    let file = candidate === root || candidate.startsWith(root + sep) ? candidate : "";
+    if (!file || !(await isFile(file))) {
+        if (extname(pathname)) {
+            res.writeHead(404).end();
+            return;
+        }
+        file = join(root, "index.html");
+    }
+    const immutable = file.startsWith(join(root, "assets") + sep);
+    res.writeHead(200, {
+        "Content-Type": TYPES[extname(file)] ?? "application/octet-stream",
+        "Cache-Control": immutable ? "public, max-age=31536000, immutable" : "no-cache",
+    });
+    if (req.method === "HEAD")
+        res.end();
+    else
+        createReadStream(file).pipe(res);
+}

package/packages/server/app/widgets-mcp.js

@@ -0,0 +1,36 @@
+// The built-in widget MCP server: one tool over the live catalogue, not one tool per special
+// widget. External agents start this process only while the widgets feature is enabled.
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { registerBuiltinWidgetDefinitions } from "./widgets.js";
+import { widgetCatalog } from "../modules/agents/projector/index.js";
+import { trustedProjectWidgets } from "../modules/project-widgets/index.js";
+registerBuiltinWidgetDefinitions();
+const projectId = process.env.PROJECTOR_PROJECT_ID?.trim() ?? "";
+const projectWidgets = await trustedProjectWidgets(projectId);
+const server = new McpServer({ name: "projector-widgets", version: "1" }, {
+    instructions: "Полные описания виджетов Projector. Для виджетов из разделов «Специальные виджеты» и «Виджеты проекта» вызывай describe_widget перед первым использованием; обычные уже описаны в промпте.",
+});
+server.registerTool("describe_widget", {
+    description: "Полное описание виджета: свойства, ограничения и пример. Для специального виджета вызывай перед первым использованием; для обычного не обязательно — описание уже в промпте.",
+    inputSchema: { name: z.string().describe("Имя виджета") },
+}, async ({ name }) => {
+    try {
+        return {
+            content: [{ type: "text", text: widgetCatalog.describe(name, projectWidgets) }],
+        };
+    }
+    catch (error) {
+        return {
+            isError: true,
+            content: [
+                {
+                    type: "text",
+                    text: error instanceof Error ? error.message : `Не удалось описать виджет ${name}`,
+                },
+            ],
+        };
+    }
+});
+await server.connect(new StdioServerTransport());

package/packages/server/app/widgets.js

@@ -0,0 +1,54 @@
+import { registerWidgetDefinition } from "../modules/agents/projector/index.js";
+import { barsWidget } from "../../core/modules/agent-widgets/bars/index.js";
+import { buttonWidget } from "../../core/modules/agent-widgets/button/index.js";
+import { cardWidget } from "../../core/modules/agent-widgets/card/index.js";
+import { checksWidget } from "../../core/modules/agent-widgets/checks/index.js";
+import { chipsWidget } from "../../core/modules/agent-widgets/chips/index.js";
+import { columnsWidget } from "../../core/modules/agent-widgets/columns/index.js";
+import { donutWidget } from "../../core/modules/agent-widgets/donut/index.js";
+import { fieldWidget } from "../../core/modules/agent-widgets/field/index.js";
+import { formWidget } from "../../core/modules/agent-widgets/form/index.js";
+import { gitInfoWidget } from "../../core/modules/agent-widgets/git-info/index.js";
+import { imageWidget } from "../../core/modules/agent-widgets/image/index.js";
+import { inlineIconWidget } from "../../core/modules/agent-widgets/inline-icon/index.js";
+import { inputWidget } from "../../core/modules/agent-widgets/input/index.js";
+import { intelligentFormWidget } from "../../core/modules/agent-widgets/intelligent-form/index.js";
+import { lineWidget } from "../../core/modules/agent-widgets/line/index.js";
+import { rowWidget } from "../../core/modules/agent-widgets/row/index.js";
+import { safeSecretShowWidget } from "../../core/modules/agent-widgets/safe-secret-show/index.js";
+import { sliderWidget } from "../../core/modules/agent-widgets/slider/index.js";
+import { statWidget } from "../../core/modules/agent-widgets/stat/index.js";
+import { stepsWidget } from "../../core/modules/agent-widgets/steps/index.js";
+import { tabWidget } from "../../core/modules/agent-widgets/tab/index.js";
+import { tabsWidget } from "../../core/modules/agent-widgets/tabs/index.js";
+/**
+ * The components the assistant may use in an answer. The client registers the same set with its
+ * implementations (`src/app/widgets.ts`); a test keeps the two lists and the definitions in step.
+ */
+export function registerBuiltinWidgetDefinitions() {
+    for (const definition of [
+        barsWidget,
+        buttonWidget,
+        cardWidget,
+        checksWidget,
+        chipsWidget,
+        columnsWidget,
+        donutWidget,
+        fieldWidget,
+        formWidget,
+        gitInfoWidget,
+        imageWidget,
+        inlineIconWidget,
+        inputWidget,
+        intelligentFormWidget,
+        lineWidget,
+        rowWidget,
+        safeSecretShowWidget,
+        sliderWidget,
+        statWidget,
+        stepsWidget,
+        tabWidget,
+        tabsWidget,
+    ])
+        registerWidgetDefinition(definition);
+}

package/packages/server/middlewares/local-origin.js

@@ -0,0 +1,4 @@
+import { authorizeHttp } from "../modules/access/index.js";
+export function localOrigin({ req, res }) {
+    return authorizeHttp(req, res);
+}

package/packages/server/modules/access/access.js

@@ -0,0 +1,118 @@
+import { isHubRequest, hubAccessAllowed } from "./hub.js";
+import { BlockList, isIP } from "node:net";
+import { readNetworkMode } from "../../../core/modules/app-paths/index.js";
+import { hasLanPassword, verifyLanPassword } from "./password.js";
+import { validLanSession } from "./session.js";
+const LOOPBACK = ["localhost", "127.0.0.1", "[::1]"];
+const loopbackAddresses = new BlockList();
+loopbackAddresses.addSubnet("127.0.0.0", 8, "ipv4");
+loopbackAddresses.addAddress("::1", "ipv6");
+function hostname(req) {
+    try {
+        const host = req.headers.host;
+        if (!host)
+            return "";
+        const url = new URL(`http://${host}`);
+        if (url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+            return "";
+        return url.hostname;
+    }
+    catch {
+        return "";
+    }
+}
+/** Prefix of the API that other applications call; it has its own optional access key. */
+export const GATEWAY_PREFIX = "/api/openai/v1";
+export function isGatewayRequest(req) {
+    const path = (req.url ?? "").split("?")[0];
+    return path === GATEWAY_PREFIX || path.startsWith(`${GATEWAY_PREFIX}/`);
+}
+const guards = globalThis;
+/**
+ * Origin and Host checks apply to the gateway like to the rest of the API, so browser pages of other
+ * sites never reach it. Its owner may authenticate its own requests: `true` admits them
+ * without the LAN password, `false` rejects, `undefined` leaves the default rules.
+ */
+export function registerGatewayGuard(guard) {
+    guards.projectorGatewayGuard = guard;
+}
+const originChecks = globalThis;
+/** The owner of the gateway lists the foreign origins whose pages may call it. */
+export function registerGatewayOrigins(check) {
+    originChecks.projectorGatewayOrigins = check;
+}
+/** A foreign page of a whitelisted origin calling the gateway; every other API has no such origins. */
+export function isGatewayOriginAllowed(req) {
+    const origin = req.headers.origin;
+    return !!origin && isGatewayRequest(req) && !!originChecks.projectorGatewayOrigins?.(origin);
+}
+/** The owner of the gateway turned this request away for a missing or wrong key. */
+export function gatewayKeyRejected(req) {
+    return isGatewayRequest(req) && guards.projectorGatewayGuard?.(req) === false;
+}
+/** Numeric LAN addresses and localhost cannot be rebound by a third-party DNS owner. */
+export function isTrustedHost(req) {
+    const host = hostname(req);
+    return host === "localhost" || !!isIP(host.replace(/^\[|\]$/g, ""));
+}
+function scheme(req) {
+    return "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
+}
+/** Bearer-пароль из заголовка Authorization; `queryToken` — для WebSocket без заголовков. */
+export function lanPassword(req, queryToken) {
+    const header = req.headers.authorization;
+    if (header && header.startsWith("Bearer "))
+        return header.slice("Bearer ".length);
+    return queryToken ?? null;
+}
+/** Запрос пришёл с loopback-интерфейса этой машины. */
+export function isLocalRequest(req) {
+    if (isHubRequest(req))
+        return false;
+    // Test streams and embedded transports may omit the socket.
+    const address = req.socket?.remoteAddress;
+    if (!address)
+        return false;
+    const family = isIP(address);
+    return !!family && loopbackAddresses.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+/**
+ * Общий допуск к API. В local-режиме только loopback; в lan-режиме допускаются
+ * сетевые клиенты, а при заданном пароле — только с корректным Bearer-токеном.
+ * `requireOrigin` запрещает запросы без совпадающего заголовка Origin.
+ */
+export function accessAllowed(req, requireOrigin = true, queryToken) {
+    if (isHubRequest(req))
+        return hubAccessAllowed(req, requireOrigin);
+    const host = hostname(req);
+    const local = isLocalRequest(req);
+    if (!isTrustedHost(req))
+        return false;
+    // Host is a separate DNS rebinding guard, never proof of the client's address.
+    if (readNetworkMode() === "local" && (!local || !LOOPBACK.includes(host)))
+        return false;
+    const origin = req.headers.origin;
+    if (origin && origin !== `${scheme(req)}//${req.headers.host}` && !isGatewayOriginAllowed(req))
+        return false;
+    if (!origin && requireOrigin)
+        return false;
+    if (isGatewayRequest(req)) {
+        const verdict = guards.projectorGatewayGuard?.(req);
+        if (verdict !== undefined)
+            return verdict;
+    }
+    try {
+        if (!local && hasLanPassword()) {
+            if (validLanSession(req))
+                return true;
+            const token = lanPassword(req, queryToken);
+            if (!token || !verifyLanPassword(token))
+                return false;
+        }
+    }
+    catch {
+        // A damaged/unreadable credential file must never turn protected LAN into open LAN.
+        return false;
+    }
+    return true;
+}

package/packages/server/modules/access/connections.js

@@ -0,0 +1,36 @@
+import { accessAllowed, isLocalRequest } from "./access.js";
+import { onLanPasswordChanged } from "./password.js";
+/** Revoke live LAN sockets as well as HTTP sessions when the password changes. */
+export function protectLanSockets(server, sockets, allowed = accessAllowed) {
+    const requests = new Map();
+    sockets.on("connection", (client, req) => {
+        if (isLocalRequest(req))
+            return;
+        requests.set(client, req);
+        client.once("close", () => requests.delete(client));
+    });
+    const unsubscribe = onLanPasswordChanged(() => {
+        for (const client of requests.keys())
+            client.terminate();
+    });
+    const timer = setInterval(() => {
+        for (const [client, req] of requests) {
+            const token = new URL(req.url ?? "/", "http://localhost").searchParams.get("token") ?? undefined;
+            if (!allowed(req, true, token))
+                client.terminate();
+        }
+    }, 30000);
+    timer.unref();
+    let disposed = false;
+    const dispose = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        clearInterval(timer);
+        unsubscribe();
+        requests.clear();
+        server.off?.("close", dispose);
+    };
+    server.once("close", dispose);
+    return dispose;
+}

package/packages/server/modules/access/http.js

@@ -0,0 +1,93 @@
+import { isHubRequest } from "./hub.js";
+import { randomBytes } from "node:crypto";
+import { readNetworkMode } from "../../../core/modules/app-paths/index.js";
+import { accessAllowed, isLocalRequest, isGatewayOriginAllowed, isGatewayRequest, isTrustedHost, gatewayKeyRejected, } from "./access.js";
+import { hasLanPassword } from "./password.js";
+import { rememberLanSession } from "./session.js";
+/** Shared boundary for API and Vite/static resources. */
+export function authorizeHttp(req, res, allowLogin = false) {
+    const gateway = isGatewayRequest(req);
+    if (gateway && isGatewayOriginAllowed(req)) {
+        allowOrigin(res, req.headers.origin);
+        if (req.method === "OPTIONS") {
+            // A preflight carries no credentials, so it cannot be held to a key or password.
+            res.writeHead(isTrustedHost(req) ? 204 : 403).end();
+            return false;
+        }
+    }
+    if (accessAllowed(req, false)) {
+        try {
+            // A gateway key must never be turned into a session for the rest of the API.
+            if (!gateway && !isLocalRequest(req) && !isHubRequest(req))
+                rememberLanSession(req, res);
+        }
+        catch {
+            res.writeHead(503).end();
+            return false;
+        }
+        return true;
+    }
+    const scheme = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
+    const originAllowed = !req.headers.origin ||
+        req.headers.origin === `${scheme}//${req.headers.host}` ||
+        isGatewayOriginAllowed(req);
+    let status = 403;
+    if (readNetworkMode() === "lan" && !isLocalRequest(req) && isTrustedHost(req) && originAllowed) {
+        try {
+            if (hasLanPassword())
+                status = 401;
+        }
+        catch {
+            status = 503;
+        }
+    }
+    res.setHeader("Cache-Control", "no-store");
+    if (isTrustedHost(req) && gatewayKeyRejected(req)) {
+        res.setHeader("WWW-Authenticate", "Bearer");
+        res.writeHead(401, { "Content-Type": "application/json; charset=utf-8" });
+        res.end(JSON.stringify({
+            error: {
+                message: "Неверный или отсутствующий ключ доступа",
+                type: "authentication_error",
+                param: null,
+                code: "invalid_api_key",
+            },
+        }));
+        return false;
+    }
+    if (status === 401 &&
+        allowLogin &&
+        req.method === "GET" &&
+        req.headers.accept?.includes("text/html")) {
+        sendLogin(res);
+    }
+    else {
+        if (status === 401)
+            res.setHeader("WWW-Authenticate", 'Bearer realm="Projector LAN"');
+        res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+        res.end(JSON.stringify({
+            error: status === 503 ? "Не удалось прочитать пароль LAN" : "Доступ запрещён",
+        }));
+    }
+    return false;
+}
+function allowOrigin(res, origin) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, OpenAI-Organization");
+    res.setHeader("Access-Control-Allow-Private-Network", "true");
+    res.setHeader("Access-Control-Max-Age", "600");
+}
+function sendLogin(res) {
+    const nonce = randomBytes(16).toString("base64");
+    res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "X-Content-Type-Options": "nosniff",
+        "Content-Security-Policy": `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`,
+    });
+    res.end(`<!doctype html><html lang="ru"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Projector — вход</title>
+<style nonce="${nonce}">body{background:#151515;color:#eee;font:16px system-ui;display:grid;place-items:center;min-height:100vh;margin:0}form{width:min(320px,85vw);display:grid;gap:16px}h1{font-size:24px;margin:0}input,button{font:inherit;padding:10px;border:1px solid #555;border-radius:6px;background:#252525;color:inherit}p{min-height:1.5em;margin:0;color:#ef9999}</style>
+<form><h1>Projector</h1><label for="password">Пароль доступа</label><input id="password" type="password" maxlength="1024" autocomplete="current-password" required autofocus><button>Войти</button><p role="alert"></p></form>
+<script nonce="${nonce}">document.querySelector('form').addEventListener('submit',async event=>{event.preventDefault();const input=document.querySelector('input');const button=document.querySelector('button');const error=document.querySelector('p');button.disabled=true;error.textContent='';try{const response=await fetch('/api/app/network',{headers:{Authorization:'Bearer '+input.value}});if(!response.ok)throw new Error(response.status===401?'Неверный пароль':'Доступ запрещён');input.value='';location.reload()}catch(e){error.textContent=e.message;button.disabled=false}})</script></html>`);
+}