@ai-projector/ide 0.0.0-stage → 0.11.0

package/packages/server/modules/agent/request.js

@@ -0,0 +1,132 @@
+import { loadProjects } from "../projects/index.js";
+import { resolveAgentBackend } from "./registry.js";
+import { selectionFrom } from "./controls.js";
+import { worktreeCwd, createWorktree } from "./worktrees.js";
+import { asString } from "../transport/index.js";
+import { normalizeJudgeOverride } from "../../../core/modules/agent-judge/index.js";
+import { normalizeRoleSnapshot } from "../../../core/modules/agent-role/index.js";
+/** Calls an earlier answer made; malformed ones are dropped, sizes bounded. */
+export function historyTools(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.slice(0, 100).flatMap((item) => {
+        if (!item || typeof item !== "object")
+            return [];
+        const row = item;
+        const id = asString(row.id);
+        const name = asString(row.name);
+        if (!id || !name)
+            return [];
+        return [
+            {
+                id: id.slice(0, 200),
+                name: name.slice(0, 100),
+                ...(typeof row.input === "string" ? { input: row.input.slice(0, 20_000) } : {}),
+                output: asString(row.output).slice(0, 20_000),
+                ...(row.failed === true ? { failed: true } : {}),
+            },
+        ];
+    });
+}
+/** A line range from a chip; malformed values are dropped, the file itself is kept. */
+function rangeFrom(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const range = value;
+    const from = range.from;
+    const to = range.to;
+    if (typeof from !== "number" ||
+        typeof to !== "number" ||
+        !Number.isInteger(from) ||
+        !Number.isInteger(to) ||
+        from < 1 ||
+        to < from ||
+        to > 10_000_000)
+        return undefined;
+    return { from, to };
+}
+/** The chips of a message; anything that is not a well-formed part is dropped. */
+function partsFrom(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const parts = value.flatMap((item) => {
+        if (!item || typeof item !== "object")
+            return [];
+        const part = item;
+        if (part.type === "text" && typeof part.text === "string")
+            return [{ type: "text", text: part.text }];
+        if (part.type === "file" && typeof part.path === "string" && part.path)
+            return [
+                {
+                    type: "file",
+                    path: part.path,
+                    directory: part.directory === true || undefined,
+                    range: rangeFrom(part.range),
+                },
+            ];
+        if (part.type === "command" && typeof part.name === "string" && part.name)
+            return [{ type: "command", name: part.name }];
+        if (part.type === "image" &&
+            typeof part.id === "string" &&
+            typeof part.name === "string" &&
+            typeof part.mime === "string")
+            return [{ type: "image", id: part.id, name: part.name, mime: part.mime }];
+        return [];
+    });
+    return parts.some((part) => part.type !== "text") ? parts.slice(0, 200) : undefined;
+}
+/** A new request from the body of `POST /api/agent`. */
+export async function requestFrom(body) {
+    const message = asString(body.message);
+    if (!message)
+        throw new Error("Напишите сообщение агенту");
+    const projectId = asString(body.projectId);
+    const project = projectId
+        ? (await loadProjects()).find((item) => item.id === projectId)
+        : undefined;
+    if (projectId && !project)
+        throw new Error("Проект не найден");
+    let folder = project?.path;
+    let worktree;
+    const reused = asString(body.worktree);
+    if (project && reused)
+        folder = await worktreeCwd(project.id, reused, project.path);
+    else if (project && body.isolate === true && !asString(body.sessionId)) {
+        const copy = await createWorktree(project.id, project.path);
+        folder = copy.cwd;
+        worktree = { id: copy.id, branch: copy.branch };
+    }
+    const history = Array.isArray(body.history)
+        ? body.history.flatMap((item) => {
+            if (!item || typeof item !== "object")
+                return [];
+            const row = item;
+            const role = row.role === "assistant" ? "assistant" : row.role === "user" ? "user" : null;
+            const content = asString(row.content);
+            const tools = historyTools(row.tools);
+            if (!role || (!content && !tools.length))
+                return [];
+            return [{ role, content, ...(tools.length ? { tools } : {}) }];
+        })
+        : [];
+    const request = {
+        message,
+        parts: partsFrom(body.parts),
+        history,
+        backend: resolveAgentBackend(body.backend),
+        permissionMode: asString(body.permissionMode) || undefined,
+        selection: selectionFrom(body.selection),
+        role: normalizeRoleSnapshot(body.role),
+        sessionId: asString(body.sessionId) || undefined,
+        messageId: asString(body.messageId) || undefined,
+        tail: asString(body.tail) || undefined,
+        features: Array.isArray(body.features)
+            ? body.features.filter((id) => typeof id === "string").slice(0, 50)
+            : undefined,
+        judge: normalizeJudgeOverride(body.judge),
+        projectId: projectId || undefined,
+        cwd: folder,
+        providerId: asString(body.providerId) || undefined,
+    };
+    return { request, worktree };
+}

package/packages/server/modules/agent/role-store.js

@@ -0,0 +1,21 @@
+import { normalizeRoleSnapshot, } from "../../../core/modules/agent-role/index.js";
+import { historyDatabase } from "./history-store.js";
+/** The role a chat was started with; absent means it has no role of its own. */
+export function readChatRole(chat) {
+    const row = historyDatabase().prepare("SELECT role FROM chats WHERE id = ?").get(chat);
+    if (!row?.role)
+        return undefined;
+    try {
+        return normalizeRoleSnapshot(JSON.parse(row.role));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Replaces the chat's role snapshot; `null` removes it. */
+export function saveChatRole(chat, role) {
+    historyDatabase()
+        .prepare(`INSERT INTO chats (id, role) VALUES (?, ?)
+       ON CONFLICT (id) DO UPDATE SET role = excluded.role`)
+        .run(chat, role ? JSON.stringify(role) : null);
+}

package/packages/server/modules/agent/run-hub.js

@@ -0,0 +1,105 @@
+import { isBridgeRequestPending } from "./command-bridge.js";
+/** Events only one page may act on: a command must run once, not in every viewer. */
+const ACTIONS = new Set(["command-request"]);
+/** Requests waiting for the user: a page that joins late still sees the unanswered ones. */
+const WAITING = new Set([
+    "command-request",
+    "permission-request",
+    "question-request",
+    "secret-request",
+]);
+// Vite reloads API modules without closing open answers: keep the runs across reloads.
+const host = globalThis;
+const runs = (host.projectorRunHub ??= new Map());
+const idOf = (entry) => String(entry.data?.id ?? "");
+/** An unanswered request from the agent: the user has not acted on it yet. */
+const waiting = (entry) => WAITING.has(entry.event) && isBridgeRequestPending(idOf(entry));
+/** Register the server's own answer for a run; every page watching it subscribes through `joinRun`. */
+export function driveRun(id, owner) {
+    const run = {
+        viewers: new Set([owner]),
+        owner,
+        events: [],
+        ended: false,
+        delivered: false,
+    };
+    runs.set(id, run);
+    return {
+        publish(event, data) {
+            if (run.ended)
+                return;
+            const entry = { event, data };
+            run.events.push(entry);
+            if (event === "done" || event === "error")
+                run.delivered ||= run.viewers.size > 0;
+            if (ACTIONS.has(event))
+                run.owner?.emit(event, data);
+            else
+                for (const viewer of run.viewers)
+                    viewer.emit(event, data);
+        },
+        finish() {
+            if (run.ended)
+                return;
+            run.ended = true;
+            runs.delete(id);
+            for (const viewer of [...run.viewers])
+                viewer.close();
+            run.viewers.clear();
+            run.owner = undefined;
+        },
+        leave: () => leave(run, owner),
+        delivered: () => run.delivered,
+    };
+}
+/**
+ * Follow a run this server is already answering: the whole answer is replayed, then its events
+ * come live. Returns how to stop watching, or `undefined` when no such run is being driven here
+ * (the page then attaches to the host, and this server takes the run over).
+ */
+export function joinRun(id, viewer) {
+    const run = runs.get(id);
+    if (!run)
+        return undefined;
+    // A page that reconnects takes its old subscription's place; an abandoned stream must not keep
+    // receiving the run's commands or count as the owner.
+    const previous = viewer.key === undefined ? undefined : [...run.viewers].find((item) => item.key === viewer.key);
+    if (previous) {
+        run.viewers.delete(previous);
+        if (run.owner === previous)
+            run.owner = undefined;
+    }
+    for (const entry of run.events) {
+        // Commands stay with their owner; unanswered questions are shown to the new page too.
+        if (ACTIONS.has(entry.event))
+            continue;
+        if (WAITING.has(entry.event) && !waiting(entry))
+            continue;
+        viewer.emit(entry.event, entry.data);
+    }
+    run.viewers.add(viewer);
+    if (!run.owner) {
+        run.owner = viewer;
+        replayActions(run, viewer);
+    }
+    return () => leave(run, viewer);
+}
+/** Whether this server is already answering the run. */
+export function isRunDriven(id) {
+    return runs.has(id);
+}
+/** A command asked while nobody owned the run: the first page that joins answers it. */
+function replayActions(run, viewer) {
+    for (const entry of run.events)
+        if (ACTIONS.has(entry.event) && waiting(entry))
+            viewer.emit(entry.event, entry.data);
+}
+function leave(run, viewer) {
+    if (!run.viewers.delete(viewer))
+        return;
+    if (run.owner !== viewer)
+        return;
+    run.owner = run.viewers.values().next().value;
+    if (run.owner)
+        replayActions(run, run.owner);
+}

package/packages/server/modules/agent/run-request.js

@@ -0,0 +1,208 @@
+import { createApprovalBridge, createCommandBridge, createQuestionBridge, createSecretBridge, } from "./command-bridge.js";
+import { createRun, pruneRuns, readRun, rememberSession, removeRun, schedulePrune, trackRun, } from "./agent-runs.js";
+import { trackEventStream } from "./event-streams.js";
+import { requestFrom } from "./request.js";
+import { isHostedAgent, runAgent } from "./registry.js";
+import { driveRun, isRunDriven, joinRun } from "./run-hub.js";
+import { broadcastEvent, hasEventClient } from "../events/index.js";
+import { asString, json } from "../transport/index.js";
+import { resolveJudgeSettings } from "../../../core/modules/agent-judge/index.js";
+import { createJudgedApproval, readJudgeSettings } from "../judge/index.js";
+/**
+ * Starts an answer, or rejoins one that a hosted process is still producing. A page that opens
+ * the same chat watches the run this server already drives: attaching to the host again would
+ * replace the socket of the page that got there first.
+ */
+export async function handleAgentRun({ res, body, }) {
+    const attachId = asString(body.attach);
+    // A rejoined run repeats the request an earlier server stored; a new one reads it from the body.
+    const stored = attachId ? await readRun(attachId) : null;
+    if (attachId && !stored) {
+        json(res, 404, { error: "Ход агента не найден" });
+        return;
+    }
+    const created = stored ? undefined : await requestFrom(body);
+    // What the client can show is stored with the run: a runner that outlives this request needs it.
+    const request = stored ?? {
+        ...created.request,
+        projectId: asString(body.projectId) || undefined,
+        chat: asString(body.chat) || undefined,
+        approvals: body.approvals === true,
+        commandBridge: body.commandBridge === true,
+    };
+    const backend = request.backend;
+    const hosted = isHostedAgent(backend);
+    const run = hosted
+        ? { id: attachId || (await createRun(request)), attach: !!attachId }
+        : undefined;
+    if (hosted && !attachId)
+        void pruneRuns().catch(() => { });
+    // A page with its own events stream asks for the answer there: the request returns at once and
+    // holds no connection (a browser allows few per origin for all its tabs). Others get an SSE body.
+    const client = asString(body.client);
+    const stream = asString(body.stream);
+    const viaEvents = !!client && !!stream;
+    if (viaEvents) {
+        if (!hasEventClient(client)) {
+            json(res, 409, { error: "Поток событий страницы не открыт" });
+            return;
+        }
+        json(res, 202, { accepted: true, ...(run ? { run: run.id } : {}) });
+    }
+    else
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache, no-transform",
+            Connection: "keep-alive",
+            // The page keeps the id even if the stream breaks before its first event.
+            ...(run ? { "X-Agent-Run": run.id } : {}),
+        });
+    // The newcomer gets the answer so far and then the live events, like the first page sees them.
+    if (run && attachId && isRunDriven(attachId)) {
+        let closed = false;
+        let untrackStream;
+        let release;
+        const stop = () => {
+            if (closed)
+                return;
+            closed = true;
+            untrackStream?.();
+            release?.();
+        };
+        const viewer = {
+            key: viaEvents ? client : undefined,
+            emit(event, data) {
+                if (closed)
+                    return;
+                if (viaEvents)
+                    broadcastEvent("agent", { stream, event, data }, client);
+                else if (!res.writableEnded)
+                    res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+            },
+            close() {
+                if (closed)
+                    return;
+                closed = true;
+                untrackStream?.();
+                if (viaEvents)
+                    broadcastEvent("agent", { stream, event: "end", data: {} }, client);
+                else if (!res.writableEnded)
+                    res.end();
+                release?.();
+            },
+        };
+        const leave = joinRun(attachId, viewer);
+        if (leave) {
+            const left = () => {
+                leave();
+                stop();
+            };
+            untrackStream = viaEvents ? trackEventStream(stream, client, left) : undefined;
+            if (!viaEvents) {
+                res.on("close", left);
+                await new Promise((resolve) => (release = resolve));
+            }
+            return;
+        }
+    }
+    // A closed page only detaches from a hosted run, which keeps going and can be rejoined;
+    // other agents stop with their request. Stopping a hosted run is the explicit cancel.
+    const abort = new AbortController();
+    let detached = false;
+    let driver;
+    let untrackStream;
+    const send = (event, data) => {
+        if (viaEvents)
+            broadcastEvent("agent", { stream, event, data }, client);
+        else if (!res.writableEnded)
+            res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+    };
+    const viewer = {
+        key: viaEvents ? client : undefined,
+        emit(event, data) {
+            if (!detached)
+                send(event, data);
+        },
+        close() {
+            untrackStream?.();
+            if (viaEvents)
+                broadcastEvent("agent", { stream, event: "end", data: {} }, client);
+            else if (!res.writableEnded)
+                res.end();
+        },
+    };
+    driver = run ? driveRun(run.id, viewer) : undefined;
+    const detach = () => {
+        if (detached)
+            return;
+        detached = true;
+        driver?.leave();
+        if (!hosted)
+            abort.abort();
+    };
+    untrackStream = viaEvents ? trackEventStream(stream, client, detach) : undefined;
+    if (!viaEvents)
+        res.on("close", detach);
+    const untrack = run ? trackRun(run.id, () => abort.abort()) : undefined;
+    const emit = (event, data) => {
+        // Noted even after the page left: the run goes on, and its session is how it is found again.
+        if (event === "session" && run && !run.attach)
+            void rememberSession(run.id, data.id).catch(() => { });
+        if (driver)
+            driver.publish(event, data);
+        else if (!detached && (!viaEvents || !res.writableEnded))
+            send(event, data);
+    };
+    if (run)
+        emit("run", { id: run.id });
+    if (created?.worktree)
+        emit("worktree", created.worktree);
+    const approval = body.approvals === true ? createApprovalBridge(emit, abort.signal) : undefined;
+    // ACP asks through this server even when its agent process is hosted; Projector and Claude Code
+    // ask inside their own runner, where `hosted-runner.ts` wraps the same approval.
+    const approve = approval
+        ? createJudgedApproval({
+            approve: approval,
+            emit: (event, data) => emit(event, data),
+            settings: resolveJudgeSettings(await readJudgeSettings(), request.judge),
+            cwd: request.cwd,
+            backend,
+            signal: abort.signal,
+        })
+        : approval;
+    try {
+        await runAgent({
+            ...request,
+            backend,
+            run,
+            commands: body.commandBridge === true ? createCommandBridge(emit, abort.signal) : undefined,
+            approve,
+            ask: body.approvals === true ? createQuestionBridge(emit, abort.signal) : undefined,
+            secret: body.approvals === true ? createSecretBridge(emit, abort.signal) : undefined,
+            abort: abort.signal,
+            emit,
+        });
+    }
+    catch (error) {
+        const text = error instanceof Error ? error.message : "Ошибка агента";
+        emit("error", { error: text });
+    }
+    driver?.finish();
+    untrack?.();
+    // The answer reached a page, or the user cancelled it: nothing is left to rejoin.
+    if (run) {
+        const removed = ((driver?.delivered() ?? false) || abort.signal.aborted) &&
+            (await removeRun(run.id).catch(() => false));
+        if (!removed)
+            schedulePrune();
+    }
+    if (!driver) {
+        if (viaEvents) {
+            untrackStream?.();
+            if (!detached)
+                broadcastEvent("agent", { stream, event: "end", data: {} }, client);
+        }
+        else if (!res.writableEnded)
+            res.end();
+    }
+}

package/packages/server/modules/agent/secret-show.js

@@ -0,0 +1,108 @@
+import { appUrl } from "../../../core/modules/app-paths/index.js";
+import { os } from "../../../core/modules/os/index.js";
+import { loadProjects } from "../projects/index.js";
+/** Limits shared by the tool, the widget endpoint and the panel event. */
+export const SECRET_SHOW_LIMITS = {
+    secret: 32 * 1024,
+    comment: 1_000,
+    label: 200,
+    script: 8_000,
+};
+/** A script failure. `detail` is for the page only; tool results use `message` alone. */
+export class SecretScriptError extends Error {
+    detail;
+    constructor(message, detail = "") {
+        super(message);
+        this.name = "SecretScriptError";
+        this.detail = detail;
+    }
+}
+const detailOf = (text) => (text ?? "").replaceAll("\0", "").slice(0, 2_000);
+/** The project's folder, for scripts that use relative paths; `undefined` when the chat has none. */
+export async function projectDirectory(projectId) {
+    if (!projectId)
+        return undefined;
+    try {
+        return (await loadProjects()).find((project) => project.id === projectId)?.path;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Runs the agent's script and returns only its stdout. A failure never carries stderr: a script
+ * that printed the secret to the wrong stream must not put it into a tool result.
+ */
+export async function runSecretScript(script, options = {}) {
+    const command = script.trim();
+    if (!command)
+        throw new Error("Укажите скрипт, который вернёт секрет");
+    if (command.length > SECRET_SHOW_LIMITS.script)
+        throw new Error("Скрипт слишком длинный");
+    if (options.signal?.aborted)
+        throw new Error("Запрос остановлен");
+    let result;
+    try {
+        result = await os.tools.runBash(command, {
+            cwd: options.cwd || os.homeDirectory(),
+            ...(options.signal ? { signal: options.signal } : {}),
+        });
+    }
+    catch (error) {
+        if (options.signal?.aborted || (error instanceof Error && /остановлен/.test(error.message)))
+            throw new Error("Запрос остановлен");
+        const stderr = error?.stderr;
+        throw new SecretScriptError("Скрипт не запустился", detailOf(stderr));
+    }
+    if (result.terminated)
+        throw new SecretScriptError("Скрипт не завершился вовремя", detailOf(result.stderr));
+    if (result.exitCode !== 0)
+        throw new SecretScriptError("Скрипт завершился с ошибкой", detailOf(result.stderr));
+    // Only the line ending is dropped: a key or password may legitimately start or end with a space.
+    const secret = result.stdout.replace(/[\r\n]+$/, "");
+    if (!secret.trim())
+        throw new SecretScriptError("Скрипт ничего не вернул", detailOf(result.stderr));
+    if (secret.length > SECRET_SHOW_LIMITS.secret)
+        throw new Error("Секрет слишком длинный");
+    if (secret.includes("\0"))
+        throw new Error("Секрет содержит недопустимый символ");
+    return secret;
+}
+/**
+ * Hands a value to the live page. The value travels only on the server's loopback event stream;
+ * the response says whether a page was open and never repeats the secret.
+ */
+export async function pushSecretToPage(input, baseUrl = process.env.PROJECTOR_URL || appUrl()) {
+    if (!input.secret || input.secret.length > SECRET_SHOW_LIMITS.secret)
+        return { shown: false, delivered: false, error: "Недопустимый секрет" };
+    try {
+        const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/agent/secret-show/push`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                secret: input.secret,
+                ...(input.label ? { label: input.label.slice(0, SECRET_SHOW_LIMITS.label) } : {}),
+                ...(input.comment ? { comment: input.comment.slice(0, SECRET_SHOW_LIMITS.comment) } : {}),
+                ...(input.projectId ? { projectId: input.projectId } : {}),
+                ...(input.session ? { session: input.session } : {}),
+            }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        const data = (await response.json().catch(() => ({})));
+        if (!response.ok)
+            return {
+                shown: false,
+                delivered: false,
+                error: typeof data.error === "string" ? data.error : "Projector не показал секрет",
+            };
+        return {
+            shown: data.shown === true,
+            delivered: data.delivered === true,
+            ...(typeof data.label === "string" && data.label ? { label: data.label } : {}),
+            ...(typeof data.error === "string" && data.error ? { error: data.error } : {}),
+        };
+    }
+    catch {
+        return { shown: false, delivered: false, error: "Projector недоступен" };
+    }
+}