@cjhyy/code-shell-server 0.8.0

package/dist/sessions-service.js

@@ -0,0 +1,303 @@
+/**
+ * List session files persisted by the agent worker.
+ * Uses core's canonical session root so CODE_SHELL_HOME matches the worker.
+ */
+import { SessionManager, sessionsRoot } from "@cjhyy/code-shell-core";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+const SAFE_ID = /^[A-Za-z0-9_.-]+$/;
+const QUICK_CHAT_SESSION_PREFIX = "qchat-";
+function isQuickChatSessionId(id) {
+    return id.startsWith(QUICK_CHAT_SESSION_PREFIX);
+}
+export async function listSessions(baseDir = sessionsRoot()) {
+    try {
+        const entries = await fs.readdir(baseDir, { withFileTypes: true });
+        const summaries = [];
+        for (const e of entries) {
+            if (!e.isFile())
+                continue;
+            if (!e.name.endsWith(".jsonl") && !e.name.endsWith(".json"))
+                continue;
+            const id = e.name.replace(/\.jsonl?$/, "");
+            if (isQuickChatSessionId(id))
+                continue;
+            const full = path.join(baseDir, e.name);
+            try {
+                const st = await fs.stat(full);
+                summaries.push({
+                    id,
+                    file: full,
+                    size: st.size,
+                    createdAt: st.birthtimeMs || st.mtimeMs,
+                    updatedAt: st.mtimeMs,
+                });
+            }
+            catch {
+                // Skip files we cannot stat (race with delete, permissions).
+            }
+        }
+        summaries.sort((a, b) => b.updatedAt - a.updatedAt);
+        return summaries;
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return [];
+        throw e;
+    }
+}
+/**
+ * Remove a session's on-disk data. Modern sessions are a directory
+ * `<sessionsDir>/<id>/` (transcript.jsonl + state.json — see core
+ * session-manager.ts:93,141). Pre-directory sessions were flat
+ * `<id>.jsonl`/`<id>.json` files; we remove those too for back-compat.
+ * `baseDir` is overridable for tests. Unsafe ids (slashes / "." / "..")
+ * are rejected without any filesystem access.
+ */
+export async function deleteSessionDir(id, baseDir = sessionsRoot()) {
+    if (!SAFE_ID.test(id) || id === "." || id === "..")
+        return;
+    // Directory form (current).
+    await fs.rm(path.join(baseDir, id), { recursive: true, force: true });
+    // Legacy flat files.
+    for (const ext of [".jsonl", ".json"]) {
+        try {
+            await fs.unlink(path.join(baseDir, `${id}${ext}`));
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+    }
+}
+/** @deprecated retained for the existing IPC handler; delegates to deleteSessionDir. */
+export async function deleteSession(id) {
+    await deleteSessionDir(id);
+}
+/**
+ * Reap quick-chat data left by an unclean prior desktop exit. This must run
+ * before a new renderer/worker can claim a qchat id; normal live cleanup is
+ * coordinated by QuickChatOwnershipRegistry instead.
+ */
+export async function cleanupStaleQuickChatSessions(baseDir = sessionsRoot()) {
+    let entries;
+    try {
+        entries = await fs.readdir(baseDir, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return [];
+        throw e;
+    }
+    const ids = new Set();
+    const stagingDirs = [];
+    for (const entry of entries) {
+        if (entry.isDirectory() && SAFE_ID.test(entry.name) && isQuickChatSessionId(entry.name)) {
+            ids.add(entry.name);
+            continue;
+        }
+        if (entry.isDirectory() && entry.name.startsWith(".pending-fork-")) {
+            try {
+                const state = JSON.parse(await fs.readFile(path.join(baseDir, entry.name, "state.json"), "utf8"));
+                if (state.ephemeral === true &&
+                    typeof state.sessionId === "string" &&
+                    isQuickChatSessionId(state.sessionId)) {
+                    stagingDirs.push(entry.name);
+                }
+            }
+            catch {
+                // Missing, malformed, or unreadable state cannot prove ephemeral
+                // ownership, so fail closed and leave the staging directory intact.
+            }
+            continue;
+        }
+        if (!entry.isFile() || (!entry.name.endsWith(".jsonl") && !entry.name.endsWith(".json"))) {
+            continue;
+        }
+        const id = entry.name.replace(/\.jsonl?$/, "");
+        if (SAFE_ID.test(id) && isQuickChatSessionId(id))
+            ids.add(id);
+    }
+    for (const id of ids)
+        await deleteSessionDir(id, baseDir);
+    for (const stagingDir of stagingDirs) {
+        await fs.rm(path.join(baseDir, stagingDir), { recursive: true, force: true });
+    }
+    return [...ids, ...stagingDirs];
+}
+function encodeDiskSessionCursor(cursor) {
+    return `v1:${cursor.mtime}:${cursor.id}`;
+}
+function decodeDiskSessionCursor(value) {
+    if (!value)
+        return 0;
+    // Keep accepting the old numeric offset during upgrades. New responses use
+    // a stable tuple so deleting an item from an earlier page cannot shift and
+    // skip a later session.
+    if (/^\d+$/.test(value))
+        return Number(value);
+    const match = /^v1:([^:]+):([A-Za-z0-9._-]+)$/.exec(value);
+    if (!match)
+        return null;
+    const mtime = Number(match[1]);
+    return Number.isFinite(mtime) ? { mtime, id: match[2] } : null;
+}
+/**
+ * List top-level (non-sub-agent) sessions from disk, newest first, paginated.
+ * Filter on state.json `parentSessionId`:
+ *   - key absent  → legacy → skip (存量 not auto-rebuilt)
+ *   - null / ""   → top-level → show
+ *   - non-empty   → sub-agent → filter out
+ */
+export async function listDiskSessions(opts, baseDir = sessionsRoot()) {
+    // Async fs throughout: this is an IPC handler on the Electron main thread
+    // (sessions:listDisk). The previous synchronous statSync/readFileSync loops
+    // never yielded the event loop and froze the UI while enumerating sessions.
+    let entries;
+    try {
+        entries = await fs.readdir(baseDir, { withFileTypes: true });
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return { sessions: [], nextCursor: null };
+        throw e;
+    }
+    const candidates = entries.filter((e) => e.isDirectory() && SAFE_ID.test(e.name) && !isQuickChatSessionId(e.name));
+    const stats = await Promise.all(candidates.map(async (e) => {
+        try {
+            return { id: e.name, mtime: (await fs.stat(path.join(baseDir, e.name))).mtimeMs };
+        }
+        catch {
+            return null; // skip unreadable
+        }
+    }));
+    const dirs = stats.filter((d) => d !== null);
+    dirs.sort((a, b) => b.mtime - a.mtime || a.id.localeCompare(b.id));
+    const decodedCursor = decodeDiskSessionCursor(opts.cursor);
+    if (decodedCursor === null)
+        return { sessions: [], nextCursor: null };
+    const start = typeof decodedCursor === "number"
+        ? Math.max(0, decodedCursor)
+        : (() => {
+            const index = dirs.findIndex((entry) => entry.mtime < decodedCursor.mtime ||
+                (entry.mtime === decodedCursor.mtime && entry.id > decodedCursor.id));
+            return index < 0 ? dirs.length : index;
+        })();
+    const sessions = [];
+    // Cache cwd existence across the loop — many sessions share one project root,
+    // and we must not re-stat it per session (nor block on a sync existsSync,
+    // which the async-throughout rewrite above was meant to eliminate).
+    const cwdExists = new Map();
+    const pathExists = async (cwdStr) => {
+        const cached = cwdExists.get(cwdStr);
+        if (cached !== undefined)
+            return cached;
+        const ok = await fs
+            .access(cwdStr)
+            .then(() => true)
+            .catch(() => false);
+        cwdExists.set(cwdStr, ok);
+        return ok;
+    };
+    let i = start;
+    for (; i < dirs.length && sessions.length < opts.limit; i++) {
+        const { id, mtime } = dirs[i];
+        let state;
+        try {
+            state = JSON.parse(await fs.readFile(path.join(baseDir, id, "state.json"), "utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (state.ephemeral === true)
+            continue;
+        if (state.kind === "pet")
+            continue;
+        if (!("parentSessionId" in state))
+            continue; // legacy → skip
+        if (state.parentSessionId)
+            continue; // sub-agent (non-empty) → filter
+        // Only desktop + automation belong in the desktop sidebar. tui / missing
+        // origin are filtered out (tui shares ~/.code-shell; legacy has no origin).
+        const origin = state.origin;
+        if (origin !== "desktop" && origin !== "automation")
+            continue;
+        // Skip sessions whose project root has been deleted. Listing them led the
+        // renderer's disk-rebuild to call createRepoForCwd → the deleted project
+        // reappeared in the sidebar, and any subsequent write under that cwd
+        // resurrected it on disk as an empty shell. An empty cwd (no-repo session)
+        // is intentionally NOT filtered here — the renderer handles that via
+        // isNoRepoCwd. (deleted-project resurrection)
+        const cwdStr = typeof state.cwd === "string" ? state.cwd : "";
+        if (cwdStr && !(await pathExists(cwdStr)))
+            continue;
+        // Archived sessions are hidden from the default catalog. Filtering happens
+        // before the push (like every other skip above), so the mtime cursor —
+        // derived from the dirs[] position, not from how many rows we kept — keeps
+        // advancing across archived rows: a page may return fewer than `limit`
+        // sessions, but no live session is skipped and the cursor never stalls.
+        const archivedAt = typeof state.archivedAt === "number" ? state.archivedAt : undefined;
+        if (archivedAt !== undefined && !opts.includeArchived)
+            continue;
+        sessions.push({
+            id,
+            engineSessionId: id,
+            cwd: typeof state.cwd === "string" ? state.cwd : "",
+            // Prefer the LLM-generated title (now persisted to state); fall back to
+            // the raw first-message summary, then the id. This lets the disk rebuild
+            // surface the real title after a localStorage wipe.
+            title: (typeof state.title === "string" && state.title ? state.title : undefined) ??
+                (typeof state.summary === "string" && state.summary ? state.summary : id),
+            updatedAt: mtime,
+            origin,
+            status: state.status === "active" || state.status === "paused" || state.status === "completed"
+                ? state.status
+                : state.status === "aborted_streaming" || state.status === "aborted_tools"
+                    ? "cancelled"
+                    : typeof state.status === "string"
+                        ? "failed"
+                        : undefined,
+            ...(state.status === "completed" &&
+                (state.lastCompletionKind === "background_wait" ||
+                    state.lastCompletionKind === "goal_control_stop" ||
+                    state.lastCompletionKind === "limit_stop")
+                ? { completionKind: state.lastCompletionKind }
+                : {}),
+            ...(archivedAt !== undefined ? { archivedAt } : {}),
+            ...(typeof state.workspaceProfile === "string" && state.workspaceProfile
+                ? { workspaceProfile: state.workspaceProfile }
+                : {}),
+        });
+    }
+    return {
+        sessions,
+        nextCursor: i < dirs.length && i > 0 ? encodeDiskSessionCursor(dirs[i - 1]) : null,
+    };
+}
+/**
+ * Set (number) or clear (undefined) a session's durable archival marker on
+ * disk, then atomically replace `state.json`. This is the main-process writer
+ * counterpart to `listDiskSessions`' `archivedAt` filter: main has no live
+ * Engine/SessionManager handle, so it mutates the same `state.json` the worker
+ * persists. The rest of the state is preserved verbatim; only `archivedAt` is
+ * added or removed. Unsafe ids and missing sessions throw.
+ */
+export async function archiveDiskSession(id, archivedAt, baseDir = sessionsRoot()) {
+    if (!SAFE_ID.test(id) || id === "." || id === "..") {
+        throw new Error(`archiveDiskSession: unsafe session id ${JSON.stringify(id)}`);
+    }
+    // Route through Core's SessionManager instead of hand-rolling the write.
+    //
+    // This used to read the whole state.json, set/delete `archivedAt`, and rename a
+    // full replacement over it — with no lock and no revision check. A live worker
+    // saving token usage, goal, workspace, title or status at the same instant
+    // meant two full snapshots racing, and only one survived: archiving could roll
+    // back a just-saved field, or a worker save could erase `archivedAt`.
+    //
+    // `setSessionArchived` → `updateSessionState` already does this correctly: it
+    // takes the per-session lock, compares `stateRevision`, re-reads and merges at
+    // field level on a CAS miss, and retries. Archiving is a field-level update, so
+    // it belongs on exactly that path.
+    const manager = new SessionManager(baseDir);
+    manager.setSessionArchived(id, archivedAt);
+}

package/dist/static-files.d.ts

@@ -0,0 +1 @@
+export declare function contentTypeFor(extname: string): string;

package/dist/static-files.js

@@ -0,0 +1,25 @@
+// packages/server/src/static-files.ts
+//
+// Shared static-file primitives for the two HTTP hosts (pairing host's
+// /mobile static root and the headless serve SPA root). Keep this file free
+// of host wiring — MIME map + helpers only.
+const CONTENT_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".ico": "image/x-icon",
+    ".map": "application/json",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+};
+export function contentTypeFor(extname) {
+    return CONTENT_TYPES[extname.toLowerCase()] ?? "application/octet-stream";
+}

package/dist/worker-bridge-core.d.ts

@@ -0,0 +1,154 @@
+/** Truncate a wire line for logs. */
+export declare function previewLine(s: string, max?: number): string;
+export type WorkerBridgeLog = (event: string, data?: Record<string, unknown>) => void;
+export interface WorkerExitInfo {
+    code: number | null;
+    signal: NodeJS.Signals | null;
+    /** true only for code === 0 && signal === null (normal completion). */
+    clean: boolean;
+    /** true when a crash pushed past the restart limit inside the window. */
+    gaveUp: boolean;
+}
+/** Outcome of a correlated JSON-RPC request. Never rejects — callers map. */
+export type WorkerRpcOutcome = {
+    status: "result";
+    result: unknown;
+} | {
+    status: "error";
+    error: {
+        message?: string;
+        code?: number;
+    };
+} | {
+    status: "timeout";
+}
+/** Sending the frame failed (no live worker, or the write threw). */
+ | {
+    status: "sendFailed";
+    error?: unknown;
+}
+/** Worker exited while pending (only for `settleOnExit: true` requests). */
+ | {
+    status: "workerExit";
+};
+export interface WorkerRequestOptions {
+    /** Wire id for the frame. Caller mints it (must be unique while pending). */
+    id: string;
+    timeoutMs: number;
+    /**
+     * true: the matching response line is consumed here and NOT dispatched to
+     * line listeners (host-internal RPC, e.g. pet snapshots). false: the line
+     * is settled AND still dispatched, so downstream mirrors see it unchanged.
+     */
+    consume?: boolean;
+    /** Settle with { status: "workerExit" } when the worker dies while pending. */
+    settleOnExit?: boolean;
+    /** Settle with { status: "sendFailed" } immediately when the frame can't be
+     *  written; otherwise a failed send leaves the request pending until the
+     *  timeout (matches fire-and-forget inject semantics). */
+    failFast?: boolean;
+    /** Spawn the worker on demand (idempotent) before writing the frame. Set for
+     *  requests that are meant to WAKE the worker — e.g. a pet/IM-gateway
+     *  `agent/run` — mirroring the renderer's spawn-on-`agent/run` path. Without
+     *  it a request to a lazily-unspawned worker is dropped and hangs to timeout.
+     *  Optionally pass the cwd the fresh worker should use. */
+    ensureWorker?: boolean;
+    /** cwd handed to ensureWorker() when it spawns. Ignored unless ensureWorker. */
+    ensureWorkerCwd?: string;
+}
+export interface WorkerBridgeCoreOptions {
+    /** Absolute path of the worker entry script (agent-server-stdio). */
+    entryPath: string;
+    /** Runtime binary; defaults to process.execPath. */
+    execPath?: string;
+    /** Build the spawn env (called per spawn). Defaults to process.env. */
+    buildEnv?: () => NodeJS.ProcessEnv;
+    /** cwd used when ensureWorker() is called without one. */
+    fallbackCwd?: () => string;
+    log?: WorkerBridgeLog;
+    /**
+     * Rewrite/side-effect hook for injectWorkerMessage lines (e.g. agent/run
+     * trust metadata + on-demand spawn). Returns the line to write; `method`
+     * is only used for log context.
+     */
+    prepareInbound?: (line: string) => {
+        line: string;
+        method?: string;
+    };
+    /** A worker successfully spawned with piped stdio. */
+    onWorkerStarted?: (info: {
+        generation: number;
+        pid?: number;
+    }) => void;
+    /** spawn() threw synchronously, or stdio came back unpiped. No child. */
+    onSpawnFailed?: () => void;
+    /** The child emitted 'error' (ENOENT/EACCES/…) — no 'exit' will follow. */
+    onSpawnError?: (error: unknown) => void;
+    onExit?: (info: WorkerExitInfo) => void;
+    onStderr?: (text: string) => void;
+    restartWindowMs?: number;
+    restartLimit?: number;
+}
+export declare class WorkerBridgeCore {
+    private readonly opts;
+    private child;
+    /** Pending lines that arrived before the worker's stdin existed. */
+    private outbox;
+    private restartCount;
+    private restartWindowStart;
+    private generation;
+    private readonly lineListeners;
+    private readonly pendingRequests;
+    private readonly restartWindowMs;
+    private readonly restartLimit;
+    constructor(opts: WorkerBridgeCoreOptions);
+    private log;
+    /** Current worker generation (0 until the first successful spawn). */
+    workerGeneration(): number;
+    hasChild(): boolean;
+    /** stdin exists and is not destroyed — a line write won't be dropped. */
+    canSend(): boolean;
+    hasLiveWorker(): boolean;
+    /**
+     * Spawn the worker if none is alive. `cwd` is the working directory the
+     * Engine will use (i.e. the repo root). Idempotent if a child is alive.
+     */
+    ensureWorker(requestedCwd?: string): void;
+    /** Returns true after >= restartLimit crashes in the current window. */
+    private shouldDeclareGaveUp;
+    /**
+     * If `line` is a response to a pending request(), settle it. Returns true
+     * when the line was consumed (must NOT be dispatched to listeners).
+     */
+    private settleMatchingRequest;
+    private settlePendingOnExit;
+    /**
+     * Register an observer of every worker stdout line that wasn't consumed by
+     * a `consume: true` request. Returns an unsubscribe. A throwing listener
+     * never disrupts the stream.
+     */
+    subscribeLines(listener: (line: string) => void): () => void;
+    /**
+     * Write one JSON-RPC line to the worker's stdin (newline appended). Returns
+     * false when there is no live worker (caller decides drop/fallback). A
+     * stream write error propagates to the caller, matching a direct write.
+     */
+    sendLine(line: string): boolean;
+    /**
+     * Inject a JSON-RPC line into the worker exactly as a first-party front end
+     * would. The host's `prepareInbound` hook runs first (metadata rewriting +
+     * on-demand spawn side effects); the possibly-rewritten line is then
+     * written, or dropped with a log when no worker is alive — identical
+     * semantics for every front end (renderer, mobile remote, orchestrators).
+     */
+    injectWorkerMessage(rawLine: string): void;
+    /**
+     * Send a correlated JSON-RPC request and await its response by id.
+     * `params` is omitted from the frame when undefined. Never rejects — the
+     * outcome union carries error/timeout/send-failure states for the caller
+     * to map onto its own semantics.
+     */
+    request(method: string, params: unknown, options: WorkerRequestOptions): Promise<WorkerRpcOutcome>;
+    /** Graceful shutdown: SIGTERM the worker (no-op when none is alive). */
+    kill(): void;
+}