@cjhyy/code-shell-server 0.8.0

package/dist/mobile-remote/mobile-chat-turn.js

@@ -0,0 +1,67 @@
+import { markAttachmentsSent } from "../attachment-service.js";
+import { stablePromptHash } from "../client-message-id.js";
+import { materializeMobileAttachments } from "./mobile-attachments.js";
+import { injectMobileRunAndAwaitAcceptance } from "./mobile-run-dispatch.js";
+async function settleClaims(uploads, deviceId, claims, action) {
+    await Promise.allSettled(claims.map((claim) => uploads[action](deviceId, claim.uploadId, claim.claimId)));
+}
+/** Transaction boundary for mobile chat: workspace → canonical stage → worker ack → finalize. */
+export async function dispatchMobileChatTurn(input) {
+    let cwd;
+    try {
+        cwd = await input.resolveWorkspace(input.sessionId, input.fallbackCwd);
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    let materialized;
+    try {
+        materialized = await materializeMobileAttachments({
+            deviceId: input.deviceId,
+            cwd,
+            sessionId: input.sessionId,
+            attachments: input.attachments,
+            uploads: input.uploads,
+        });
+    }
+    catch (error) {
+        return { ok: false, message: error instanceof Error ? error.message : String(error) };
+    }
+    const text = input.text.trim();
+    if (!text && materialized.metas.length === 0) {
+        await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
+        return { ok: false, message: "消息必须包含文字或图片" };
+    }
+    const attachmentHash = materialized.metas.map((meta) => meta.sha256).join(":");
+    const suppliedClientMessageId = input.clientMessageId?.trim();
+    if (suppliedClientMessageId && suppliedClientMessageId.length > 200) {
+        await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
+        return { ok: false, message: "clientMessageId is too long" };
+    }
+    const clientMessageId = suppliedClientMessageId ||
+        `mobile:${input.sessionId}:${input.runId}:${stablePromptHash(`${text}\0${attachmentHash}`)}`;
+    const acceptance = await injectMobileRunAndAwaitAcceptance(input.bridge, {
+        id: input.runId,
+        params: {
+            task: text,
+            cwd,
+            sessionId: input.sessionId,
+            clientMessageId,
+            attachments: materialized.metas,
+            ...(input.permissionMode ? { permissionMode: input.permissionMode } : {}),
+        },
+    });
+    if (!acceptance.ok) {
+        await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
+        return { ok: false, message: acceptance.message };
+    }
+    await (input.markSent ?? markAttachmentsSent)(cwd, input.sessionId, materialized.metas).catch(() => undefined);
+    await settleClaims(input.uploads, input.deviceId, materialized.claims, "finalize");
+    return {
+        ok: true,
+        cwd,
+        clientMessageId,
+        metas: materialized.metas,
+        summaries: materialized.summaries,
+    };
+}

package/dist/mobile-remote/mobile-history.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Build a session's history as a flat list of events the phone's streamReducer
+ * understands. We REUSE the desktop's transcript reader (transcriptToFoldItems
+ * via its getSessionTranscript) so there is one transcript parser, then project
+ * its FoldItems into reducer events:
+ *   - { kind: "stream", event }  → the raw StreamEvent (reducer eats it directly)
+ *   - { kind: "user", text }     → a synthetic { type: "user_message", text }
+ *
+ * The phone feeds these through the SAME reducer used for the live stream, so
+ * replay and live are identical (design §4).
+ *
+ * The transcript reader itself stays in the desktop package (it depends on
+ * renderer FoldItem types), so it is injected here instead of imported.
+ */
+/** Structural projection of the desktop's FoldItem — only what we consume. */
+export interface TranscriptHistoryItem {
+    kind: string;
+    text?: unknown;
+    event?: unknown;
+}
+export type SessionTranscriptReader = (sessionId: string) => Promise<readonly TranscriptHistoryItem[]>;
+export declare function buildSessionHistory(sessionId: string, getTranscript: SessionTranscriptReader): Promise<unknown[]>;

package/dist/mobile-remote/mobile-history.js

@@ -0,0 +1,27 @@
+/**
+ * Build a session's history as a flat list of events the phone's streamReducer
+ * understands. We REUSE the desktop's transcript reader (transcriptToFoldItems
+ * via its getSessionTranscript) so there is one transcript parser, then project
+ * its FoldItems into reducer events:
+ *   - { kind: "stream", event }  → the raw StreamEvent (reducer eats it directly)
+ *   - { kind: "user", text }     → a synthetic { type: "user_message", text }
+ *
+ * The phone feeds these through the SAME reducer used for the live stream, so
+ * replay and live are identical (design §4).
+ *
+ * The transcript reader itself stays in the desktop package (it depends on
+ * renderer FoldItem types), so it is injected here instead of imported.
+ */
+export async function buildSessionHistory(sessionId, getTranscript) {
+    const items = await getTranscript(sessionId);
+    const events = [];
+    for (const item of items) {
+        if (item.kind === "user") {
+            events.push({ type: "user_message", text: item.text });
+        }
+        else if (item.kind === "stream") {
+            events.push(item.event);
+        }
+    }
+    return events;
+}

package/dist/mobile-remote/mobile-run-dispatch.d.ts

@@ -0,0 +1,17 @@
+export interface MobileRunBridge {
+    subscribeOutbound(listener: (line: string) => void): () => void;
+    injectWorkerMessage(line: string): void;
+}
+export interface MobileRunRequest {
+    id: string;
+    params: Record<string, unknown>;
+}
+export type MobileRunAcceptance = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+    code?: number;
+};
+/** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
+export declare function injectMobileRunAndAwaitAcceptance(bridge: MobileRunBridge, request: MobileRunRequest, timeoutMs?: number): Promise<MobileRunAcceptance>;

package/dist/mobile-remote/mobile-run-dispatch.js

@@ -0,0 +1,56 @@
+/** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
+export function injectMobileRunAndAwaitAcceptance(bridge, request, timeoutMs = 5_000) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let timer;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            unsubscribe();
+            resolve(result);
+        };
+        const unsubscribe = bridge.subscribeOutbound((line) => {
+            try {
+                const message = JSON.parse(line);
+                if (message.method === "agent/runAccepted" && message.params?.requestId === request.id) {
+                    finish({ ok: true });
+                    return;
+                }
+                if (message.id !== request.id)
+                    return;
+                if (message.error) {
+                    finish({
+                        ok: false,
+                        message: typeof message.error.message === "string"
+                            ? message.error.message
+                            : "worker rejected the run",
+                        ...(typeof message.error.code === "number" ? { code: message.error.code } : {}),
+                    });
+                }
+                else if ("result" in message) {
+                    // Compatibility fallback if an older/embedded worker completes before
+                    // emitting the explicit acknowledgement.
+                    finish({ ok: true });
+                }
+            }
+            catch {
+                // Not JSON or not part of this request.
+            }
+        });
+        timer = setTimeout(() => finish({ ok: false, message: "worker did not acknowledge the run" }), timeoutMs);
+        try {
+            bridge.injectWorkerMessage(JSON.stringify({
+                jsonrpc: "2.0",
+                id: request.id,
+                method: "agent/run",
+                params: request.params,
+            }));
+        }
+        catch (error) {
+            finish({ ok: false, message: error instanceof Error ? error.message : String(error) });
+        }
+    });
+}

package/dist/mobile-remote/mobile-static.d.ts

@@ -0,0 +1,43 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+/**
+ * Serves the built mobile web app (out/mobile) as static assets for the
+ * `/mobile` route family, replacing the old inline `mobileRemoteHtml()` string.
+ *
+ * Two modes:
+ *  - prod: read files from `out/mobile` (resolved relative to the bundled main).
+ *  - dev:  proxy to the mobile vite dev server (MOBILE_DEV_URL) for HMR.
+ *
+ * The app is built/served with vite base "/mobile/" (vite.mobile.config.ts), so
+ * BOTH the built bundle's asset URLs and vite's dev HMR/module URLs live under
+ * the `/mobile` prefix — a single prefix route serves prod and dev, with no
+ * root-level asset shim or whole-server dev proxy.
+ *
+ * Security (design §5): only files INSIDE out/mobile are served. The request
+ * path is normalized and re-resolved; anything that escapes the root → 404.
+ * This closes the path-traversal hole the beta1 sweep fixed elsewhere.
+ */
+/** Strip `/mobile` (and an optional trailing slash) off the request URL, drop
+ *  any query/hash, and return the asset sub-path. `/mobile` → "", `/mobile/` →
+ *  "", `/mobile/assets/x.js` → "assets/x.js". */
+export declare function mobileAssetPath(reqUrl: string): string;
+/** If `reqUrl` is the bare `/mobile` entry (optionally with a query/hash but no
+ *  trailing slash), return the canonical `/mobile/`-prefixed target (query/hash
+ *  preserved) for a redirect. Returns null for `/mobile/` and any sub-path,
+ *  which need no redirect. */
+export declare function mobileEntryRedirect(reqUrl: string): string | null;
+/** Resolve an asset sub-path to an absolute file inside `root`, or null if it
+ *  would escape the root (traversal) or does not resolve to a regular file. An
+ *  empty sub-path resolves to index.html (SPA entry). */
+export declare function resolveSafe(root: string, subPath: string): string | null;
+export interface MobileStaticOptions {
+    /** Absolute path to the built mobile app (out/mobile). */
+    rootDir: string;
+    /** When set, dev mode: proxy /mobile/* to this base URL instead of disk. */
+    devUrl?: string;
+}
+/**
+ * Handle a `/mobile`-prefixed request. Returns true if it handled the response
+ * (wrote a status), false if the caller should fall through (it never does for
+ * /mobile — callers check the prefix first, so this always handles).
+ */
+export declare function serveMobile(req: IncomingMessage, res: ServerResponse, opts: MobileStaticOptions): void;

package/dist/mobile-remote/mobile-static.js

@@ -0,0 +1,154 @@
+import { createReadStream, existsSync, statSync } from "node:fs";
+import { join, normalize, resolve, sep, extname } from "node:path";
+import { request as httpRequest } from "node:http";
+import { contentTypeFor } from "../static-files.js";
+/**
+ * Serves the built mobile web app (out/mobile) as static assets for the
+ * `/mobile` route family, replacing the old inline `mobileRemoteHtml()` string.
+ *
+ * Two modes:
+ *  - prod: read files from `out/mobile` (resolved relative to the bundled main).
+ *  - dev:  proxy to the mobile vite dev server (MOBILE_DEV_URL) for HMR.
+ *
+ * The app is built/served with vite base "/mobile/" (vite.mobile.config.ts), so
+ * BOTH the built bundle's asset URLs and vite's dev HMR/module URLs live under
+ * the `/mobile` prefix — a single prefix route serves prod and dev, with no
+ * root-level asset shim or whole-server dev proxy.
+ *
+ * Security (design §5): only files INSIDE out/mobile are served. The request
+ * path is normalized and re-resolved; anything that escapes the root → 404.
+ * This closes the path-traversal hole the beta1 sweep fixed elsewhere.
+ */
+/** Strip `/mobile` (and an optional trailing slash) off the request URL, drop
+ *  any query/hash, and return the asset sub-path. `/mobile` → "", `/mobile/` →
+ *  "", `/mobile/assets/x.js` → "assets/x.js". */
+export function mobileAssetPath(reqUrl) {
+    const noQuery = reqUrl.split("?")[0].split("#")[0];
+    let rest = noQuery.slice("/mobile".length); // reqUrl always starts with /mobile here
+    if (rest.startsWith("/"))
+        rest = rest.slice(1);
+    return rest;
+}
+/** If `reqUrl` is the bare `/mobile` entry (optionally with a query/hash but no
+ *  trailing slash), return the canonical `/mobile/`-prefixed target (query/hash
+ *  preserved) for a redirect. Returns null for `/mobile/` and any sub-path,
+ *  which need no redirect. */
+export function mobileEntryRedirect(reqUrl) {
+    const qIdx = reqUrl.search(/[?#]/);
+    const path = qIdx === -1 ? reqUrl : reqUrl.slice(0, qIdx);
+    const suffix = qIdx === -1 ? "" : reqUrl.slice(qIdx);
+    if (path === "/mobile")
+        return "/mobile/" + suffix;
+    return null;
+}
+/** Resolve an asset sub-path to an absolute file inside `root`, or null if it
+ *  would escape the root (traversal) or does not resolve to a regular file. An
+ *  empty sub-path resolves to index.html (SPA entry). */
+export function resolveSafe(root, subPath) {
+    const rootResolved = resolve(root);
+    const rel = normalize(subPath || "index.html");
+    // Reject absolute paths and any normalized path still containing `..`.
+    if (rel.startsWith("..") || rel.includes(`..${sep}`) || rel.startsWith(sep)) {
+        return null;
+    }
+    const full = resolve(join(rootResolved, rel));
+    if (full !== rootResolved && !full.startsWith(rootResolved + sep))
+        return null;
+    if (!existsSync(full) || !statSync(full).isFile())
+        return null;
+    return full;
+}
+/** True when the request is a browser navigation (accepts text/html), used to
+ *  decide whether a path that doesn't resolve to a file should fall back to the
+ *  SPA shell. Asset/module fetches send `*\/*` or a specific type and must NOT
+ *  fall back (so a missing asset 404s instead of returning HTML). */
+function acceptsHtml(req) {
+    const accept = req.headers.accept;
+    return typeof accept === "string" && accept.includes("text/html");
+}
+/**
+ * Handle a `/mobile`-prefixed request. Returns true if it handled the response
+ * (wrote a status), false if the caller should fall through (it never does for
+ * /mobile — callers check the prefix first, so this always handles).
+ */
+export function serveMobile(req, res, opts) {
+    // Canonicalize the entry URL to a trailing slash. The pairing URL is
+    // `/mobile?pairing=...` (no slash); without the slash the served HTML's base
+    // is `/`, so a relative ref would escape the routed prefix. Redirect the bare
+    // entry → `/mobile/` (preserving the query) so the app always loads under
+    // `/mobile/`. Sub-paths (/mobile/assets/*) are left untouched.
+    const redirect = mobileEntryRedirect(req.url ?? "/mobile");
+    if (redirect) {
+        res.writeHead(308, { location: redirect });
+        res.end();
+        return;
+    }
+    if (opts.devUrl) {
+        proxyToDev(req, res, opts.devUrl);
+        return;
+    }
+    const sub = mobileAssetPath(req.url ?? "/mobile");
+    let file = resolveSafe(opts.rootDir, sub);
+    // SPA fallback: a navigation to an unknown client route → index.html so the
+    // React router can take over. Gate on the request ACCEPTing html (the browser
+    // sends `Accept: text/html` for navigations, `*/*` or a specific type for
+    // asset/module fetches), NOT on the absence of a file extension — a route
+    // segment containing a dot (e.g. a version or dotted id) must still fall back,
+    // and a genuinely-missing .js/.css must still 404 (returning HTML for a module
+    // request would break module loading).
+    if (!file && sub && acceptsHtml(req)) {
+        file = resolveSafe(opts.rootDir, "index.html");
+    }
+    if (!file) {
+        res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+        res.end("not found");
+        return;
+    }
+    const type = contentTypeFor(extname(file));
+    // Hashed bundles under /assets are content-addressed → cache forever. The
+    // entry HTML (index.html, served for "" or the SPA fallback) must NOT be
+    // cached: after an app upgrade ships a new bundle with new hashed filenames, a
+    // stale index.html would reference deleted assets → 404 → blank page until a
+    // hard refresh.
+    const isHtml = type.startsWith("text/html");
+    res.writeHead(200, {
+        "content-type": type,
+        "cache-control": isHtml
+            ? "no-store"
+            : sub.startsWith("assets/")
+                ? "public, max-age=31536000, immutable"
+                : "no-cache",
+    });
+    createReadStream(file).pipe(res);
+}
+/** Dev-only: forward the request to the mobile vite dev server. The mobile vite
+ *  config sets base "/mobile/", so vite serves its HMR client, module graph, and
+ *  asset URLs UNDER that prefix (/mobile/@vite/client, /mobile/src/main.tsx). We
+ *  therefore forward the request path UNCHANGED — stripping /mobile would ask
+ *  vite for /@vite/client, which a base-"/mobile/" server 404s, breaking HMR so
+ *  the phone never live-updates. The /mobile prefix belongs to vite here (its
+ *  base), not to us — only prod static serving strips it (files live flat under
+ *  out/mobile). */
+function proxyToDev(req, res, devUrl) {
+    const target = new URL(devUrl);
+    const proxyReq = httpRequest({
+        hostname: target.hostname,
+        port: target.port,
+        method: req.method,
+        path: req.url ?? "/mobile/",
+        headers: { ...req.headers, host: target.host },
+    }, (proxyRes) => {
+        // Never let a phone cache the DEV page/assets. Otherwise a stale static
+        // build's HTML (hash-named assets) survives in the browser cache and its
+        // asset requests hit the vite dev server, which has no hash files → 404.
+        // no-store on every dev response keeps the phone in lockstep with vite.
+        const headers = { ...proxyRes.headers, "cache-control": "no-store" };
+        res.writeHead(proxyRes.statusCode ?? 502, headers);
+        proxyRes.pipe(res);
+    });
+    proxyReq.on("error", () => {
+        res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+        res.end("mobile dev server unavailable");
+    });
+    req.pipe(proxyReq);
+}

package/dist/mobile-remote/mobile-upload-service.d.ts

@@ -0,0 +1,57 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { MobileImageBase } from "./types.js";
+export declare const MAX_MOBILE_IMAGE_BYTES: number;
+export declare const MOBILE_UPLOAD_TTL_MS: number;
+export declare const MAX_MOBILE_UPLOAD_TICKETS_PER_DEVICE = 16;
+export declare const MAX_MOBILE_UPLOAD_CLAIM_ATTEMPTS = 3;
+export interface MobileUploadServiceOptions {
+    rootDir: string;
+    now?: () => number;
+    cleanupIntervalMs?: number;
+    uploadTtlMs?: number;
+}
+export interface ClaimedMobileUpload extends MobileImageBase {
+    uploadId: string;
+    claimId: string;
+    path: string;
+    sha256: string;
+}
+/** One-time, device-bound HTTP upload tickets backed by a temporary spool. */
+export declare class MobileUploadService {
+    private readonly opts;
+    private readonly uploads;
+    private readonly activeTransfers;
+    private readonly now;
+    private readonly uploadTtlMs;
+    private readonly startupCleanup;
+    private readonly timer?;
+    private disposed;
+    private disposePromise?;
+    constructor(opts: MobileUploadServiceOptions);
+    /** Wait until startup orphan recovery has completed. */
+    ready(): Promise<void>;
+    begin(deviceId: string, metadata: Omit<MobileImageBase, "mime"> & {
+        mime: string;
+    }): {
+        clientId: string;
+        uploadId: string;
+        putUrl: string;
+        expiresAt: number;
+    };
+    acceptPut(uploadId: string, req: IncomingMessage, res: ServerResponse): Promise<void>;
+    /** Atomically move a ready upload into a request-owned lease. */
+    claim(deviceId: string, uploadId: string): ClaimedMobileUpload;
+    /** Release a failed staging/dispatch attempt for a bounded retry. */
+    release(deviceId: string, uploadId: string, claimId: string): Promise<void>;
+    /** Finalize a successful turn; only the active claim owner may consume it. */
+    finalize(deviceId: string, uploadId: string, claimId: string): Promise<void>;
+    cleanupExpired(): Promise<void>;
+    /** Abort all in-flight transfers and invalidate every outstanding ticket. */
+    cancelActiveTransfers(): Promise<void>;
+    /** Fully await timer shutdown, active aborts, and every spool unlink. */
+    dispose(): Promise<void>;
+    private expire;
+    private cleanupRecordFiles;
+    private cleanupOrphanSpools;
+    private assertClaimOwner;
+}