@ai-workbench/network 0.4.8 → 0.4.9

package/lib/private.d.ts

@@ -1,3 +1,3 @@
-export declare function privateFile(path: string, write?: boolean): Promise<import("fs/promises").FileHandle>;
+export declare function privateFile(path: string, write?: boolean, onDiscardCloseFailure?: () => void): Promise<import("fs/promises").FileHandle>;
 export declare function privateSocket(path: string): Promise<void>;
 export declare function verifyExecutable(path: string, sha256: string): Promise<void>;

package/lib/private.js

@@ -2,7 +2,7 @@ import { constants } from 'node:fs';
 import { open, lstat } from 'node:fs/promises';
 import { isAbsolute, dirname } from 'node:path';
 import { createHash } from 'node:crypto';
-export async function privateFile(path, write = false) {
+export async function privateFile(path, write = false, onDiscardCloseFailure) {
     if (!isAbsolute(path))
         throw new Error('LOCAL_PATH_INVALID');
     await privateDirectory(dirname(path));
@@ -13,8 +13,12 @@ export async function privateFile(path, write = false) {
             throw new Error('LOCAL_PERMISSION_DENIED');
         return f;
     }
+    // Optional diagnostic callers discard invalid handles without waiting on cleanup.
     catch (e) {
-        await f.close();
+        if (onDiscardCloseFailure)
+            void f.close().catch(onDiscardCloseFailure);
+        else
+            await f.close();
         throw e;
     }
 }

package/lib/settings-host.js

@@ -1,6 +1,6 @@
 import { createPolicyEditor, registerPolicyRoutes } from "./policy-management.js";
 export const name = 'ai-workbench-network-settings';
-// 伴生行不持有入网身份，目标 runtime 正常重载时保留保存应答路径。
+// 伴生行不持有入网身份，只读取官方配置及当前状态，不提供保存入口。
 export function apply(ctx) {
     ctx.inject(['webServer', 'connection', 'configEditor'], host => {
         host.effect(() => registerPolicyRoutes(host.get('webServer'), host.get('connection'), createPolicyEditor(host.get('configEditor'), () => {

package/lib/settings.d.ts

@@ -1,13 +1,13 @@
 import type { PluginSettings, HelperConfig } from './api.ts';
-export declare const helperPolicyFields: readonly ["statusRefreshIntervalSeconds", "dialTimeoutSeconds", "headerTimeoutSeconds", "enrollmentObservationSeconds", "httpMaxHeaderBytes", "httpMaxResponseHeaderBytes"];
+export declare const helperPolicyFields: readonly ["statusRefreshIntervalSeconds", "dialTimeoutSeconds", "headerTimeoutSeconds", "enrollmentObservationSeconds", "httpMaxHeaderBytes"];
 export declare const recoveryPolicyFields: readonly ["helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds"];
 export declare const helperRecoveryDefaults: Readonly<{
     helperRecoveryMaxAttempts: 3;
     helperRecoveryDelaySeconds: 1;
     helperRecoveryStableSeconds: 60;
 }>;
-export declare const pluginPolicyFields: readonly ["startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "downloadMaxRedirects", "helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds"];
-export declare const settingsFields: readonly ["configFile", "helperLogFile", "startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "downloadMaxRedirects", "helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds", "statusRefreshIntervalSeconds", "dialTimeoutSeconds", "headerTimeoutSeconds", "enrollmentObservationSeconds", "httpMaxHeaderBytes", "httpMaxResponseHeaderBytes"];
+export declare const pluginPolicyFields: readonly ["startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds"];
+export declare const settingsFields: readonly ["configFile", "helperLogFile", "startupObservationSeconds", "shutdownObservationSeconds", "controlResponseMaxBytes", "helperRecoveryMaxAttempts", "helperRecoveryDelaySeconds", "helperRecoveryStableSeconds", "statusRefreshIntervalSeconds", "dialTimeoutSeconds", "headerTimeoutSeconds", "enrollmentObservationSeconds", "httpMaxHeaderBytes"];
 export declare const timerSeconds: (v: unknown) => v is number;
 export declare const positiveInteger: (v: unknown) => v is number;
 export declare function validRecoveryPolicy(settings: PluginSettings): boolean;

package/lib/settings.js

@@ -1,7 +1,7 @@
-export const helperPolicyFields = ['statusRefreshIntervalSeconds', 'dialTimeoutSeconds', 'headerTimeoutSeconds', 'enrollmentObservationSeconds', 'httpMaxHeaderBytes', 'httpMaxResponseHeaderBytes'];
+export const helperPolicyFields = ['statusRefreshIntervalSeconds', 'dialTimeoutSeconds', 'headerTimeoutSeconds', 'enrollmentObservationSeconds', 'httpMaxHeaderBytes'];
 export const recoveryPolicyFields = ['helperRecoveryMaxAttempts', 'helperRecoveryDelaySeconds', 'helperRecoveryStableSeconds'];
 export const helperRecoveryDefaults = Object.freeze({ helperRecoveryMaxAttempts: 3, helperRecoveryDelaySeconds: 1, helperRecoveryStableSeconds: 60 });
-export const pluginPolicyFields = ['startupObservationSeconds', 'shutdownObservationSeconds', 'controlResponseMaxBytes', 'downloadMaxRedirects', ...recoveryPolicyFields];
+export const pluginPolicyFields = ['startupObservationSeconds', 'shutdownObservationSeconds', 'controlResponseMaxBytes', ...recoveryPolicyFields];
 export const settingsFields = ['configFile', 'helperLogFile', ...pluginPolicyFields, ...helperPolicyFields];
 export const timerSeconds = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0.001 && v * 1000 <= 2147483647;
 export const positiveInteger = (v) => Number.isSafeInteger(v) && Number(v) > 0;
@@ -17,7 +17,7 @@ export function validHelperPolicy(settings) {
         const v = settings[key];
         if (v === undefined)
             return true;
-        if (key === 'httpMaxHeaderBytes' || key === 'httpMaxResponseHeaderBytes')
+        if (key === 'httpMaxHeaderBytes')
             return positiveInteger(v);
         if (key === 'dialTimeoutSeconds' || key === 'statusRefreshIntervalSeconds')
             return timerSeconds(v);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-workbench/network",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "type": "module",
   "engines": {
     "node": ">=24.13.1"

package/lib/download.d.ts

@@ -1,2 +0,0 @@
-import type { LoginProxyLease, Result } from './api.ts';
-export declare function downloadThroughProxy(source: string, lease: LoginProxyLease, signal: AbortSignal, maxRedirects: number, seconds: number, maxHeaderBytes: number): Promise<Result<Response>>;

package/lib/download.js

@@ -1,128 +0,0 @@
-import http from 'node:http';
-import https from 'node:https';
-import tls from 'node:tls';
-import { isIP } from 'node:net';
-import { Readable } from 'node:stream';
-import { fail, ok } from "./api.js";
-import { ObservationExpired, observationNeed } from "./observation.js";
-function sourceURL(source) { const u = new URL(source); if (u.protocol !== 'https:' || u.username || u.password)
-    throw new Error('DOWNLOAD_SOURCE_INVALID'); return u; }
-async function requestViaProxy(target, lease, signal, seconds, maxHeaderBytes) {
-    const proxy = new URL(lease.credentials.url);
-    if (proxy.protocol !== 'http:' || proxy.hostname !== '127.0.0.1' || proxy.username || proxy.password)
-        throw new Error('CONTROL_PROTOCOL_INVALID');
-    const hostname = target.hostname.replace(/^\[|\]$/g, '');
-    const authority = (isIP(hostname) === 6 ? '[' + hostname + ']' : hostname) + ':' + (target.port || '443');
-    const tunnel = await new Promise((resolve, reject) => {
-        const req = http.request({ hostname: proxy.hostname, port: proxy.port, method: 'CONNECT', path: authority, agent: false, signal, maxHeaderSize: maxHeaderBytes, headers: { 'Proxy-Authorization': 'Basic ' + Buffer.from(lease.credentials.username + ':' + lease.credentials.password).toString('base64') } });
-        const started = performance.now();
-        req.setTimeout(seconds * 1000, () => req.destroy(new ObservationExpired('DOWNLOAD_CONNECT_EXPIRED', 'dialTimeoutSeconds', seconds, started, '主机代理CONNECT响应头', '检查网络组件私有日志、主机SSH状态及代理握手；不重试或改走本机出口')));
-        req.on('connect', (response, socket, head) => { req.setTimeout(0); if (response.statusCode !== 200) {
-            socket.destroy();
-            reject(new Error('HOST_PROXY_REJECTED'));
-            return;
-        } if (head.length)
-            socket.unshift(head); resolve(socket); });
-        req.on('error', reject);
-        req.end();
-    });
-    // The only TCP socket supplied to TLS is the authenticated local proxy tunnel.
-    const agent = new class extends https.Agent {
-        createConnection(options) { return tls.connect({ ...options, socket: tunnel, servername: isIP(hostname) ? undefined : hostname }); }
-    }({ keepAlive: false });
-    try {
-        return await new Promise((resolve, reject) => {
-            const req = https.request(target, { agent, signal, maxHeaderSize: maxHeaderBytes }, response => { req.setTimeout(0); response.once('close', () => agent.destroy()); resolve(response); });
-            const started = performance.now();
-            req.setTimeout(seconds * 1000, () => req.destroy(new ObservationExpired('DOWNLOAD_HEADERS_EXPIRED', 'dialTimeoutSeconds', seconds, started, '经主机下载的TLS握手及HTTP响应头', '检查主机出口、TLS与下载源响应；不重试或静默换源')));
-            req.on('error', reject);
-            req.end();
-        });
-    }
-    catch (error) {
-        tunnel.destroy();
-        agent.destroy();
-        throw error;
-    }
-}
-export async function downloadThroughProxy(source, lease, signal, maxRedirects, seconds, maxHeaderBytes) {
-    let current;
-    try {
-        current = sourceURL(source);
-    }
-    catch {
-        await lease.release();
-        return fail('DOWNLOAD_SOURCE_INVALID', '通过远程主机下载只支持不含凭据的HTTPS地址', '管理员检查下载源');
-    }
-    try {
-        for (let redirects = 0;; redirects++) {
-            signal.throwIfAborted();
-            const response = await requestViaProxy(current, lease, signal, seconds, maxHeaderBytes);
-            if ([301, 302, 303, 307, 308].includes(response.statusCode) && response.headers.location) {
-                response.destroy();
-                if (redirects >= maxRedirects)
-                    throw new Error('DOWNLOAD_REDIRECT_LIMIT');
-                current = sourceURL(new URL(response.headers.location, current).href);
-                continue;
-            }
-            const headers = new Headers();
-            for (const [key, value] of Object.entries(response.headers))
-                if (value !== undefined) {
-                    for (const v of Array.isArray(value) ? value : [value])
-                        headers.append(key, v);
-                }
-            response.once('end', () => void lease.release());
-            response.once('error', () => void lease.release());
-            response.once('close', () => void lease.release());
-            const empty = [204, 205, 304].includes(response.statusCode);
-            let body = null;
-            if (!empty) {
-                const reader = Readable.toWeb(response).getReader();
-                let closed = false;
-                body = new ReadableStream({
-                    async pull(controller) {
-                        try {
-                            const chunk = await reader.read();
-                            if (closed)
-                                return;
-                            if (chunk.done) {
-                                closed = true;
-                                await lease.release();
-                                controller.close();
-                            }
-                            else
-                                controller.enqueue(chunk.value);
-                        }
-                        catch {
-                            await lease.release();
-                            if (!closed) {
-                                closed = true;
-                                controller.error(new Error('HOST_DOWNLOAD_STREAM_FAILED'));
-                            }
-                        }
-                    },
-                    async cancel() { closed = true; try {
-                        await reader.cancel();
-                    }
-                    finally {
-                        await lease.release();
-                    } },
-                });
-            }
-            const result = new Response(body, { status: response.statusCode, headers });
-            if (empty) {
-                response.resume();
-                await lease.release();
-            }
-            return ok(result);
-        }
-    }
-    catch (error) {
-        await lease.release();
-        const observed = observationNeed(error);
-        if (observed)
-            return { ok: false, error: observed };
-        const code = error instanceof Error && ['DOWNLOAD_REDIRECT_LIMIT', 'DOWNLOAD_SOURCE_INVALID'].includes(error.message) ? error.message : 'HOST_DOWNLOAD_FAILED';
-        return fail(code, '经主机下载失败，根因未查明', '检查主机出口、下载源和具名重定向上限；无本机直出替代');
-    }
-}