@cjhyy/code-shell-server 0.8.20 → 0.9.1

package/dist/mobile-remote/mobile-chat-turn.d.ts

@@ -2,17 +2,21 @@ import { markAttachmentsSent, type InputAttachmentMeta } from "../attachment-ser
 import { type MobileRunBridge } from "./mobile-run-dispatch.js";
 import type { MobileUploadService } from "./mobile-upload-service.js";
 import type { MobileAttachmentSummary, MobileImageAttachment, PermissionMode } from "./types.js";
+import type { WorkerFrameMeta } from "../worker-bridge-core.js";
 type ChatTurnUploads = Pick<MobileUploadService, "claim" | "release" | "finalize">;
 export interface DispatchMobileChatTurnInput {
     deviceId: string;
     sessionId: string;
     fallbackCwd: string;
+    projectId?: string;
+    rootId?: string;
     text: string;
     attachments?: MobileImageAttachment[];
     clientMessageId?: string;
     permissionMode?: PermissionMode;
     runId: string;
     bridge: MobileRunBridge;
+    meta: WorkerFrameMeta;
     uploads: ChatTurnUploads;
     resolveWorkspace: (sessionId: string, fallbackCwd: string) => Promise<string>;
     markSent?: typeof markAttachmentsSent;

package/dist/mobile-remote/mobile-chat-turn.js

@@ -46,11 +46,13 @@ export async function dispatchMobileChatTurn(input) {
             task: text,
             cwd,
             sessionId: input.sessionId,
+            ...(input.projectId ? { projectId: input.projectId } : {}),
+            ...(input.rootId ? { rootId: input.rootId } : {}),
             clientMessageId,
             attachments: materialized.metas,
             ...(input.permissionMode ? { permissionMode: input.permissionMode } : {}),
         },
-    });
+    }, input.meta);
     if (!acceptance.ok) {
         await settleClaims(input.uploads, input.deviceId, materialized.claims, "release");
         return { ok: false, message: acceptance.message };

package/dist/mobile-remote/mobile-client-event-validator.js

@@ -46,9 +46,13 @@ export function parseMobileClientEvent(value) {
             break;
         case "session.create":
             valid =
-                (event.cwd === undefined ||
-                    event.cwd === null ||
-                    boundedPath(event.cwd)) &&
+                (event.cwd === undefined || event.cwd === null || boundedPath(event.cwd)) &&
+                    (event.projectId === undefined ||
+                        event.projectId === null ||
+                        boundedString(event.projectId, MAX_ID_LENGTH)) &&
+                    optionalBoundedString(event.rootId, MAX_ID_LENGTH) &&
+                    (event.rootId === undefined || typeof event.projectId === "string") &&
+                    !(event.projectId === null && event.rootId !== undefined) &&
                     optionalBoundedString(event.name, MAX_NAME_LENGTH);
             break;
         case "run.stop":
@@ -71,8 +75,7 @@ export function parseMobileClientEvent(value) {
             break;
         case "session.sync":
             valid =
-                boundedString(event.sessionId, MAX_ID_LENGTH) &&
-                    optionalNonNegativeInteger(event.sinceSeq);
+                boundedString(event.sessionId, MAX_ID_LENGTH) && optionalNonNegativeInteger(event.sinceSeq);
             break;
         case "permission.setMode":
             valid =
@@ -114,8 +117,7 @@ export function parseMobileClientEvent(value) {
             break;
         case "room.history":
             valid =
-                boundedString(event.roomId, MAX_ID_LENGTH) &&
-                    optionalNonNegativeInteger(event.sinceSeq);
+                boundedString(event.roomId, MAX_ID_LENGTH) && optionalNonNegativeInteger(event.sinceSeq);
             break;
         case "ccRoom.probe":
             valid =
@@ -202,9 +204,7 @@ function isBoundedHistoryLimit(value) {
 }
 function optionalAttachments(value) {
     return (value === undefined ||
-        (Array.isArray(value) &&
-            value.length <= MAX_MOBILE_ATTACHMENTS &&
-            value.every(isAttachment)));
+        (Array.isArray(value) && value.length <= MAX_MOBILE_ATTACHMENTS && value.every(isAttachment)));
 }
 function isAttachment(value) {
     if (!isRecord(value) ||
@@ -223,8 +223,9 @@ function isApprovalDecision(value) {
     if (!isRecord(value))
         return false;
     if (value.behavior === "allow") {
-        return ((value.answer === undefined || boundedOptionalEmptyString(value.answer, MAX_MESSAGE_LENGTH)) &&
+        return ((value.answer === undefined ||
+            boundedOptionalEmptyString(value.answer, MAX_MESSAGE_LENGTH)) &&
             (value.updatedInput === undefined || isRecord(value.updatedInput)));
     }
-    return (value.behavior === "deny" && boundedOptionalEmptyString(value.message, MAX_MESSAGE_LENGTH));
+    return value.behavior === "deny" && boundedOptionalEmptyString(value.message, MAX_MESSAGE_LENGTH);
 }

package/dist/mobile-remote/mobile-run-dispatch.d.ts

@@ -1,6 +1,7 @@
+import type { WorkerFrameMeta } from "../worker-bridge-core.js";
 export interface MobileRunBridge {
     subscribeOutbound(listener: (line: string) => void): () => void;
-    injectWorkerMessage(line: string): void;
+    injectWorkerMessage(line: string, meta: WorkerFrameMeta): void;
 }
 export interface MobileRunRequest {
     id: string;
@@ -14,4 +15,4 @@ export type MobileRunAcceptance = {
     code?: number;
 };
 /** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
-export declare function injectMobileRunAndAwaitAcceptance(bridge: MobileRunBridge, request: MobileRunRequest, timeoutMs?: number): Promise<MobileRunAcceptance>;
+export declare function injectMobileRunAndAwaitAcceptance(bridge: MobileRunBridge, request: MobileRunRequest, meta: WorkerFrameMeta, timeoutMs?: number): Promise<MobileRunAcceptance>;

package/dist/mobile-remote/mobile-run-dispatch.js

@@ -1,5 +1,5 @@
 /** Inject agent/run and wait for its request-correlated validation/queue acknowledgement. */
-export function injectMobileRunAndAwaitAcceptance(bridge, request, timeoutMs = 5_000) {
+export function injectMobileRunAndAwaitAcceptance(bridge, request, meta, timeoutMs = 5_000) {
     return new Promise((resolve) => {
         let settled = false;
         let timer;
@@ -47,7 +47,7 @@ export function injectMobileRunAndAwaitAcceptance(bridge, request, timeoutMs = 5
                 id: request.id,
                 method: "agent/run",
                 params: request.params,
-            }));
+            }), meta);
         }
         catch (error) {
             finish({ ok: false, message: error instanceof Error ? error.message : String(error) });

package/dist/mobile-remote/mobile-static.d.ts

@@ -27,7 +27,23 @@ export declare function mobileAssetPath(reqUrl: string): string;
 export declare function mobileEntryRedirect(reqUrl: string): string | null;
 /** Resolve an asset sub-path to an absolute file inside `root`, or null if it
  *  would escape the root (traversal) or does not resolve to a regular file. An
- *  empty sub-path resolves to index.html (SPA entry). */
+ *  empty sub-path resolves to index.html (SPA entry).
+ *
+ *  Containment is checked on the REAL paths (both sides `realpathSync`d), not on
+ *  the lexical path: `statSync` follows symlinks, so a link sitting inside the
+ *  root but pointing outside it — e.g. a `node_modules` link left by a packaging
+ *  step — used to pass a string-prefix check and serve the target's contents.
+ *  This covers symlinks (including chains and symlinked directories) but NOT
+ *  hardlinks: a hardlink IS a real name inside the root, so no path-level check
+ *  can see through it. Guarding that would need inode/device policy, and anyone
+ *  able to hardlink into the served root can already write files there.
+ *
+ *  The returned path is the REQUESTED one, not the realpath: callers stream it
+ *  directly and the resolved-name contract is relied on elsewhere (on macOS the
+ *  realpath of a /var root is /private/var, which would change every result).
+ *  That leaves the same synchronous stat-then-read window this module always
+ *  had; closing it properly needs an open-then-fstat rework of both callers,
+ *  which is out of scope for this fix. */
 export declare function resolveSafe(root: string, subPath: string): string | null;
 export interface MobileStaticOptions {
     /** Absolute path to the built mobile app (out/mobile). */

package/dist/mobile-remote/mobile-static.js

@@ -1,5 +1,5 @@
-import { createReadStream, existsSync, statSync } from "node:fs";
-import { join, normalize, resolve, sep, extname } from "node:path";
+import { createReadStream, existsSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, normalize, relative, resolve, sep, extname } from "node:path";
 import { request as httpRequest } from "node:http";
 import { contentTypeFor } from "../static-files.js";
 /**
@@ -41,9 +41,32 @@ export function mobileEntryRedirect(reqUrl) {
         return "/mobile/" + suffix;
     return null;
 }
+/** True when `target` is `root` itself or sits underneath it. Uses `relative`
+ *  rather than a `startsWith` prefix compare so a sibling directory sharing the
+ *  root's name prefix (`/srv/app-old` vs `/srv/app`) can't slip through. */
+function isContained(root, target) {
+    const rel = relative(root, target);
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
 /** Resolve an asset sub-path to an absolute file inside `root`, or null if it
  *  would escape the root (traversal) or does not resolve to a regular file. An
- *  empty sub-path resolves to index.html (SPA entry). */
+ *  empty sub-path resolves to index.html (SPA entry).
+ *
+ *  Containment is checked on the REAL paths (both sides `realpathSync`d), not on
+ *  the lexical path: `statSync` follows symlinks, so a link sitting inside the
+ *  root but pointing outside it — e.g. a `node_modules` link left by a packaging
+ *  step — used to pass a string-prefix check and serve the target's contents.
+ *  This covers symlinks (including chains and symlinked directories) but NOT
+ *  hardlinks: a hardlink IS a real name inside the root, so no path-level check
+ *  can see through it. Guarding that would need inode/device policy, and anyone
+ *  able to hardlink into the served root can already write files there.
+ *
+ *  The returned path is the REQUESTED one, not the realpath: callers stream it
+ *  directly and the resolved-name contract is relied on elsewhere (on macOS the
+ *  realpath of a /var root is /private/var, which would change every result).
+ *  That leaves the same synchronous stat-then-read window this module always
+ *  had; closing it properly needs an open-then-fstat rework of both callers,
+ *  which is out of scope for this fix. */
 export function resolveSafe(root, subPath) {
     const rootResolved = resolve(root);
     const rel = normalize(subPath || "index.html");
@@ -52,10 +75,19 @@ export function resolveSafe(root, subPath) {
         return null;
     }
     const full = resolve(join(rootResolved, rel));
-    if (full !== rootResolved && !full.startsWith(rootResolved + sep))
+    if (!isContained(rootResolved, full))
         return null;
     if (!existsSync(full) || !statSync(full).isFile())
         return null;
+    // realpathSync throws on a dangling link or a race-deleted file; a missing
+    // target is a 404 through the normal contract, never a 500.
+    try {
+        if (!isContained(realpathSync(rootResolved), realpathSync(full)))
+            return null;
+    }
+    catch {
+        return null;
+    }
     return full;
 }
 /** True when the request is a browser navigation (accepts text/html), used to

package/dist/serve/headless-server.js

@@ -232,7 +232,7 @@ export async function startHeadlessServer(opts) {
                 // Spawn-on-first-frame (idempotent): the browser's first request wakes
                 // the worker, mirroring the renderer's spawn-on-agent/run semantics.
                 bridge.ensureWorker(opts.cwd);
-                bridge.injectWorkerMessage(workerLine);
+                bridge.injectWorkerMessage(workerLine, { origin: "serve", producer: "serve-ws" });
             });
             ws.on("close", () => {
                 tabs.delete(ws);

package/dist/worker-bridge-core.d.ts

@@ -1,6 +1,11 @@
 /** Truncate a wire line for logs. */
 export declare function previewLine(s: string, max?: number): string;
 export type WorkerBridgeLog = (event: string, data?: Record<string, unknown>) => void;
+export interface WorkerFrameMeta {
+    origin: "renderer" | "mobile" | "host" | "serve";
+    /** Producer label for logs and audits. It is never an authorization input. */
+    producer: string;
+}
 export interface WorkerExitInfo {
     code: number | null;
     signal: NodeJS.Signals | null;
@@ -55,6 +60,8 @@ export interface WorkerRequestOptions {
     ensureWorker?: boolean;
     /** cwd handed to ensureWorker() when it spawns. Ignored unless ensureWorker. */
     ensureWorkerCwd?: string;
+    /** Main-owned provenance for this frame. */
+    meta: WorkerFrameMeta;
 }
 export interface WorkerBridgeCoreOptions {
     /** Absolute path of the worker entry script (agent-server-stdio). */
@@ -71,7 +78,7 @@ export interface WorkerBridgeCoreOptions {
      * injected or correlated (e.g. agent/run trust metadata + on-demand spawn).
      * Returns the line to write; `method` is only used for log context.
      */
-    prepareInbound?: (line: string) => {
+    prepareInbound?: (line: string, meta: WorkerFrameMeta) => {
         line: string;
         method?: string;
     };
@@ -141,7 +148,7 @@ export declare class WorkerBridgeCore {
      * written, or dropped with a log when no worker is alive — identical
      * semantics for every front end (renderer, mobile remote, orchestrators).
      */
-    injectWorkerMessage(rawLine: string): void;
+    injectWorkerMessage(rawLine: string, meta: WorkerFrameMeta): void;
     /**
      * Send a correlated JSON-RPC request and await its response by id.
      * `params` is omitted from the frame when undefined. Never rejects — the

package/dist/worker-bridge-core.js

@@ -200,9 +200,7 @@ export class WorkerBridgeCore {
         const pending = this.pendingRequests.get(msg.id);
         if (!pending)
             return false;
-        pending.settle(msg.error
-            ? { status: "error", error: msg.error }
-            : { status: "result", result: msg.result });
+        pending.settle(msg.error ? { status: "error", error: msg.error } : { status: "result", result: msg.result });
         return pending.consume;
     }
     settlePendingOnExit() {
@@ -239,18 +237,25 @@ export class WorkerBridgeCore {
      * written, or dropped with a log when no worker is alive — identical
      * semantics for every front end (renderer, mobile remote, orchestrators).
      */
-    injectWorkerMessage(rawLine) {
+    injectWorkerMessage(rawLine, meta) {
         const prep = this.opts.prepareInbound
-            ? this.opts.prepareInbound(rawLine)
+            ? this.opts.prepareInbound(rawLine, meta)
             : { line: rawLine, method: undefined };
         if (!this.canSend()) {
             this.log("inject.dropped", {
                 reason: this.child ? "stdin destroyed" : "no child",
                 method: prep.method,
+                origin: meta.origin,
+                producer: meta.producer,
             });
             return;
         }
-        this.log("inject→worker", { method: prep.method, raw: previewLine(prep.line) });
+        this.log("inject→worker", {
+            method: prep.method,
+            origin: meta.origin,
+            producer: meta.producer,
+            raw: previewLine(prep.line),
+        });
         this.sendLine(prep.line);
     }
     /**
@@ -298,7 +303,7 @@ export class WorkerBridgeCore {
                 // bypassing this hook left the main process unable to route the first
                 // Panel tool call for a restored session.
                 const prepared = this.opts.prepareInbound
-                    ? this.opts.prepareInbound(rawFrame)
+                    ? this.opts.prepareInbound(rawFrame, options.meta)
                     : { line: rawFrame, method: undefined };
                 // Wake a lazily-unspawned worker before writing, so a spawn-triggering
                 // request (pet/IM-gateway agent/run) isn't dropped by sendLine and left
@@ -311,6 +316,17 @@ export class WorkerBridgeCore {
             catch (e) {
                 sendError = e;
             }
+            const rejected = sendError;
+            if (typeof rejected?.code === "number") {
+                settle({
+                    status: "error",
+                    error: {
+                        code: rejected.code,
+                        message: typeof rejected.message === "string" ? rejected.message : "worker frame rejected",
+                    },
+                });
+                return;
+            }
             if (options.failFast && (!sent || sendError !== undefined)) {
                 settle({ status: "sendFailed", error: sendError });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.8.20",
+  "version": "0.9.1",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -39,9 +39,9 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.8.20",
-    "@cjhyy/code-shell-core": "0.8.20",
-    "@cjhyy/code-shell-web": "0.8.20",
+    "@cjhyy/code-shell-capability-coding": "0.9.1",
+    "@cjhyy/code-shell-core": "0.9.1",
+    "@cjhyy/code-shell-web": "0.9.1",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0"
   },