@cjhyy/code-shell-server 0.8.8 → 0.8.10

package/dist/mobile-remote/trusted-device-store.js

@@ -1,6 +1,12 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 import { randomUUID, timingSafeEqual } from "node:crypto";
+import { acquireFileLock } from "@cjhyy/code-shell-core/internal";
+const MAX_DEVICE_ID_LENGTH = 512;
+const MAX_DEVICE_NAME_LENGTH = 512;
+const MAX_DEVICE_SECRET_LENGTH = 4_096;
+const MAX_TRUSTED_DEVICE_ROWS = 4_096;
+const MAX_TRUSTED_DEVICE_FILE_BYTES = 32 * 1024 * 1024;
 /**
  * Constant-time compare for a device's bearer credential (secretHash), so
  * authentication doesn't leak hash bytes through compare-timing (Y-3).
@@ -22,89 +28,212 @@ export class TrustedDeviceStore {
         this.filePath = filePath;
     }
     addDevice(input) {
-        const devices = this.readAll();
-        // Get-or-create by secretHash. A phone's secret is stable per browser
-        // (persisted in localStorage as cs.deviceSecret), so re-scanning the QR
-        // code — which the client always prefers over re-auth when the URL carries
-        // a fresh pairing token — used to mint a BRAND-NEW device every time, piling
-        // up trusted devices unboundedly. Reuse the existing row instead, refreshing
-        // its name + lastSeenAt. (mobile-remote device accumulation)
-        const existing = devices.find((d) => d.secretHash === input.secretHash && !d.revokedAt);
-        if (existing) {
-            existing.name = input.name;
-            existing.lastSeenAt = Date.now();
-            this.writeAll(devices);
-            return this.toPublic(existing);
-        }
-        const device = {
-            id: randomUUID(),
-            name: input.name,
-            secretHash: input.secretHash,
-            createdAt: Date.now(),
-        };
-        devices.push(device);
-        this.writeAll(devices);
-        return this.toPublic(device);
+        const name = normalizeDeviceName(input.name);
+        if (!name)
+            throw new Error("Invalid trusted device name");
+        if (!isBoundedOpaqueString(input.secretHash, MAX_DEVICE_SECRET_LENGTH)) {
+            throw new Error("Invalid trusted device secret");
+        }
+        return this.mutate((devices) => {
+            // Get-or-create by secretHash. A phone's secret is stable per browser
+            // (persisted in localStorage as cs.deviceSecret), so re-scanning the QR
+            // code must reuse its live row rather than accumulating duplicates.
+            const existing = devices.find((d) => d.secretHash === input.secretHash && !d.revokedAt);
+            if (existing) {
+                existing.name = name;
+                existing.lastSeenAt = Date.now();
+                return { result: this.toPublic(existing), changed: true };
+            }
+            if (devices.length >= MAX_TRUSTED_DEVICE_ROWS) {
+                throw new Error("Trusted device limit reached");
+            }
+            const device = {
+                id: randomUUID(),
+                name,
+                secretHash: input.secretHash,
+                createdAt: Date.now(),
+            };
+            devices.push(device);
+            return { result: this.toPublic(device), changed: true };
+        });
     }
     listDevices() {
         return this.readAll().map((device) => this.toPublic(device));
     }
     authenticate(id, secretHash) {
-        const devices = this.readAll();
-        const device = devices.find((item) => item.id === id && !item.revokedAt && secretHashEquals(item.secretHash, secretHash));
-        if (!device)
+        if (!isBoundedOpaqueString(id, MAX_DEVICE_ID_LENGTH) ||
+            !isBoundedOpaqueString(secretHash, MAX_DEVICE_SECRET_LENGTH)) {
             return undefined;
-        device.lastSeenAt = Date.now();
-        this.writeAll(devices);
-        return this.toPublic(device);
+        }
+        return this.mutate((devices) => {
+            const device = devices.find((item) => item.id === id && !item.revokedAt && secretHashEquals(item.secretHash, secretHash));
+            if (!device)
+                return { result: undefined, changed: false };
+            device.lastSeenAt = Date.now();
+            return { result: this.toPublic(device), changed: true };
+        });
     }
     revoke(id) {
-        const devices = this.readAll();
-        const device = devices.find((item) => item.id === id && !item.revokedAt);
-        if (!device)
+        if (!isBoundedOpaqueString(id, MAX_DEVICE_ID_LENGTH))
             return false;
-        device.revokedAt = Date.now();
-        this.writeAll(devices);
-        return true;
+        return this.mutate((devices) => {
+            const device = devices.find((item) => item.id === id && !item.revokedAt);
+            if (!device)
+                return { result: false, changed: false };
+            device.revokedAt = Date.now();
+            return { result: true, changed: true };
+        });
     }
     /** Hard-delete a device row entirely (no revoked zombie left behind). */
     remove(id) {
-        const devices = this.readAll();
-        const next = devices.filter((item) => item.id !== id);
-        if (next.length === devices.length)
+        if (!isBoundedOpaqueString(id, MAX_DEVICE_ID_LENGTH))
             return false;
-        this.writeAll(next);
-        return true;
+        return this.mutate((devices) => {
+            const index = devices.findIndex((item) => item.id === id);
+            if (index < 0)
+                return { result: false, changed: false };
+            devices.splice(index, 1);
+            return { result: true, changed: true };
+        });
     }
     /** Rename a device's display label. Rejects blank names and unknown ids. */
     rename(id, name) {
-        const trimmed = name.trim();
-        if (!trimmed)
+        if (!isBoundedOpaqueString(id, MAX_DEVICE_ID_LENGTH))
             return false;
-        const devices = this.readAll();
-        const device = devices.find((item) => item.id === id);
-        if (!device)
+        const trimmed = normalizeDeviceName(name);
+        if (!trimmed)
             return false;
-        device.name = trimmed;
-        this.writeAll(devices);
-        return true;
+        return this.mutate((devices) => {
+            const device = devices.find((item) => item.id === id);
+            if (!device)
+                return { result: false, changed: false };
+            device.name = trimmed;
+            return { result: true, changed: true };
+        });
+    }
+    /** Serialize read-modify-write across desktop/server processes. */
+    mutate(mutation) {
+        this.ensurePrivateParent();
+        const release = acquireFileLock(this.filePath);
+        try {
+            // Crucially reload INSIDE the lock; atomic rename alone cannot prevent
+            // two writers that both read revision N from losing one update.
+            const devices = this.readAll();
+            const { result, changed } = mutation(devices);
+            if (changed)
+                this.writeAll(devices);
+            return result;
+        }
+        finally {
+            release();
+        }
     }
     readAll() {
-        if (!existsSync(this.filePath))
-            return [];
-        return JSON.parse(readFileSync(this.filePath, "utf-8"));
+        let descriptor;
+        try {
+            const pathInfo = lstatSync(this.filePath);
+            if (pathInfo.isSymbolicLink() ||
+                !pathInfo.isFile() ||
+                pathInfo.size > MAX_TRUSTED_DEVICE_FILE_BYTES) {
+                throw new Error("Trusted device store is corrupt");
+            }
+            descriptor = openSync(this.filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+            const opened = fstatSync(descriptor);
+            if (!opened.isFile() || opened.size > MAX_TRUSTED_DEVICE_FILE_BYTES) {
+                throw new Error("Trusted device store is corrupt");
+            }
+        }
+        catch (error) {
+            if (descriptor !== undefined) {
+                closeSync(descriptor);
+            }
+            if (error.code === "ENOENT")
+                return [];
+            if (error instanceof Error && error.message === "Trusted device store is corrupt") {
+                throw error;
+            }
+            throw new Error("Trusted device store is corrupt", { cause: error });
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(descriptor, "utf-8"));
+        }
+        catch (error) {
+            throw new Error("Trusted device store is corrupt", { cause: error });
+        }
+        finally {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+        }
+        if (!Array.isArray(parsed) ||
+            parsed.length > MAX_TRUSTED_DEVICE_ROWS ||
+            !parsed.every(isTrustedDevice)) {
+            throw new Error("Trusted device store is corrupt");
+        }
+        const ids = new Set();
+        for (const device of parsed) {
+            if (ids.has(device.id))
+                throw new Error("Trusted device store is corrupt");
+            ids.add(device.id);
+        }
+        return parsed;
     }
     writeAll(devices) {
-        mkdirSync(dirname(this.filePath), { recursive: true });
+        this.ensurePrivateParent();
+        const serialized = JSON.stringify(devices, null, 2);
+        if (Buffer.byteLength(serialized, "utf8") > MAX_TRUSTED_DEVICE_FILE_BYTES) {
+            throw new Error("Trusted device store is too large");
+        }
+        try {
+            const target = lstatSync(this.filePath);
+            if (target.isSymbolicLink() || !target.isFile()) {
+                throw new Error("Trusted device store is corrupt");
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
         // 0o600: devices.json holds each device's secretHash (its bearer credential).
         // Owner-only, same hardening as settings.json/credentials.json/cookie leases.
-        // (Y-3 partial: this closes the world-readable file; the non-timing-safe `===`
-        // compare stays in the §2.4 mobile-remote-hardening bucket for the user.)
-        writeFileSync(this.filePath, JSON.stringify(devices, null, 2), { encoding: "utf-8", mode: 0o600 });
+        const tempPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            writeFileSync(tempPath, serialized, {
+                encoding: "utf-8",
+                flag: "wx",
+                mode: 0o600,
+            });
+            renameSync(tempPath, this.filePath);
+            try {
+                chmodSync(this.filePath, 0o600);
+            }
+            catch {
+                // Best effort: tighten an existing file on platforms that support it.
+            }
+        }
+        finally {
+            try {
+                rmSync(tempPath, { force: true });
+            }
+            catch {
+                // Never hide the original write/rename error with cleanup failure.
+            }
+        }
+    }
+    ensurePrivateParent() {
+        const parent = dirname(this.filePath);
+        mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const metadata = lstatSync(parent);
+        if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+            throw new Error("Trusted device store parent must be a real directory");
+        }
         try {
-            chmodSync(this.filePath, 0o600);
+            chmodSync(parent, 0o700);
         }
-        catch { /* best-effort: tighten an existing file */ }
+        catch {
+            // Best effort on platforms/filesystems without POSIX permissions.
+        }
+        return parent;
     }
     toPublic(device) {
         return {
@@ -116,3 +245,31 @@ export class TrustedDeviceStore {
         };
     }
 }
+function isTrustedDevice(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const device = value;
+    return (isBoundedOpaqueString(device.id, MAX_DEVICE_ID_LENGTH) &&
+        typeof device.name === "string" &&
+        device.name.length <= MAX_DEVICE_NAME_LENGTH &&
+        !device.name.includes("\0") &&
+        isBoundedOpaqueString(device.secretHash, MAX_DEVICE_SECRET_LENGTH) &&
+        isTimestamp(device.createdAt) &&
+        (device.lastSeenAt === undefined || isTimestamp(device.lastSeenAt)) &&
+        (device.revokedAt === undefined || isTimestamp(device.revokedAt)));
+}
+function isTimestamp(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isBoundedOpaqueString(value, maxLength) {
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        value.length <= maxLength &&
+        !value.includes("\0"));
+}
+function normalizeDeviceName(value) {
+    if (typeof value !== "string" || value.includes("\0"))
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 && trimmed.length <= MAX_DEVICE_NAME_LENGTH ? trimmed : undefined;
+}

package/dist/serve/headless-server.d.ts

@@ -13,6 +13,11 @@ export interface HeadlessServeOptions {
     workerEntryPath: string;
     /** Session root override for tests/relocated workers. Defaults to core's canonical root. */
     sessionRootDir?: string;
+    /**
+     * Isolated data root passed to the stdio worker. Defaults to `<dataDir>/worker`.
+     * When `sessionRootDir` is supplied without this option, its parent is used.
+     */
+    workerDataRoot?: string;
     /** Runtime binary for the worker; defaults to process.execPath. */
     execPath?: string;
     /** Built web app root; when absent the server is WS/API-only. */

package/dist/serve/headless-server.js

@@ -10,18 +10,17 @@
 //   - WorkerBridgeCore      spawns/drives ONE agent-server-stdio worker.
 //   - resolveSafe           path-traversal-safe static file resolution.
 //
-// The browser speaks the CORE protocol (agent/run, agent/approve,
-// agent/streamEvent, …) as a first-party front end: this module is a thin
-// WS ↔ worker-stdio pipe, NOT a re-implementation of the desktop mobile
-// orchestrator. Every authenticated tab sees the identical line stream
-// (same semantics as AgentBridge's renderer fan-out).
+// The browser uses a deliberately small CORE-protocol projection: the host
+// answers session list/detail itself and forwards only run/approve/cancel after
+// workspace/session authorization. Per-tab request IDs are translated so
+// responses return only to their origin; notifications fan out to all tabs.
 //
-// Restart recovery: sessions persist on disk in the worker's data dir; a
+// Restart recovery: sessions persist under the serve-owned worker data root; a
 // server restart spawns a fresh worker on the first inbound frame and the
 // browser re-lists sessions over the same protocol.
 import { createServer } from "node:http";
 import { readFileSync, existsSync } from "node:fs";
-import { extname, join, resolve } from "node:path";
+import { dirname, extname, join, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { WebSocketServer } from "ws";
 import { SessionManager } from "@cjhyy/code-shell-core";
@@ -33,7 +32,14 @@ export async function startHeadlessServer(opts) {
     const host = opts.host ?? "127.0.0.1";
     const log = opts.log ?? (() => { });
     const workspaceCwd = resolve(opts.cwd);
-    const sessionManager = new SessionManager(opts.sessionRootDir);
+    const workerDataRoot = resolve(opts.workerDataRoot ??
+        (opts.sessionRootDir ? dirname(resolve(opts.sessionRootDir)) : join(opts.dataDir, "worker")));
+    const sessionRootDir = resolve(opts.sessionRootDir ?? join(workerDataRoot, "sessions"));
+    const expectedSessionRootDir = resolve(join(workerDataRoot, "sessions"));
+    if (sessionRootDir !== expectedSessionRootDir) {
+        throw new Error(`sessionRootDir must equal <workerDataRoot>/sessions (${expectedSessionRootDir}) so the host and worker authorize the same session store`);
+    }
+    const sessionManager = new SessionManager(sessionRootDir);
     const passcode = new AccessPasscode({ filePath: join(opts.dataDir, "access.json") });
     let generatedPasscode;
     if (opts.passcode) {
@@ -44,19 +50,59 @@ export async function startHeadlessServer(opts) {
         passcode.set(generatedPasscode);
     }
     const tabs = new Set();
+    const pendingWorkerResponses = new Map();
+    let nextTabId = 1;
+    let nextWorkerRequestId = 1;
     const broadcast = (line) => {
         for (const tab of tabs) {
             if (tab.readyState === tab.OPEN)
                 tab.send(line);
         }
     };
+    const failPendingWorkerResponses = (message) => {
+        for (const { tab, originalId } of pendingWorkerResponses.values()) {
+            if (tab.readyState !== tab.OPEN)
+                continue;
+            tab.send(hostQueryError(originalId, -32000, message));
+        }
+        pendingWorkerResponses.clear();
+    };
+    // Notifications describe shared agent state and are broadcast. Correlated
+    // JSON-RPC responses must return only to the tab that issued the request;
+    // browser tabs all start their local counters at `web-1`, so broadcasting a
+    // response lets one tab resolve another tab's promise.
+    const routeWorkerLine = (line) => {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            log("worker.frame_dropped", { reason: "not json", raw: previewLine(line) });
+            return;
+        }
+        if (!message || message.id === undefined || message.method !== undefined) {
+            broadcast(line);
+            return;
+        }
+        const route = pendingWorkerResponses.get(String(message.id));
+        if (!route) {
+            log("worker.response_dropped", { reason: "unknown request id", id: message.id });
+            return;
+        }
+        pendingWorkerResponses.delete(String(message.id));
+        if (route.tab.readyState !== route.tab.OPEN)
+            return;
+        route.tab.send(JSON.stringify({ ...message, id: route.originalId }));
+    };
     const bridge = new WorkerBridgeCore({
         entryPath: opts.workerEntryPath,
         execPath: opts.execPath,
         fallbackCwd: () => opts.cwd,
+        buildEnv: () => ({ ...process.env, CODE_SHELL_DATA_ROOT: workerDataRoot }),
         log,
         onStderr: (text) => log("worker.stderr", { text: previewLine(text) }),
         onExit: (info) => {
+            failPendingWorkerResponses("agent worker stopped");
             // Synthetic serve-level notification so the UI can show "agent worker
             // stopped" without conflating it with in-protocol agent/status.
             broadcast(JSON.stringify({
@@ -66,7 +112,7 @@ export async function startHeadlessServer(opts) {
             }));
         },
     });
-    bridge.subscribeLines(broadcast);
+    bridge.subscribeLines(routeWorkerLine);
     const serveStatic = (req, res) => {
         const root = opts.staticRootDir;
         if (!root) {
@@ -127,6 +173,7 @@ export async function startHeadlessServer(opts) {
             socket.destroy();
             return;
         }
+        const tabId = nextTabId++;
         wss.handleUpgrade(req, socket, head, (ws) => {
             tabs.add(ws);
             log("tab.connected", { tabs: tabs.size });
@@ -151,15 +198,31 @@ export async function startHeadlessServer(opts) {
                     ws.send(hostReply);
                     return;
                 }
+                const policyReply = authorizeServeRequest(parsed, sessionManager, workspaceCwd);
+                if (policyReply) {
+                    ws.send(policyReply);
+                    return;
+                }
                 // This host intentionally exposes one workspace. A browser must not be
                 // able to escape it by supplying another cwd, and a missing cwd must
                 // not silently become the worker's global no-repo conversation.
-                const workerLine = parsed.method === "agent/run"
-                    ? JSON.stringify({
-                        ...parsed,
-                        params: { ...(parsed.params ?? {}), cwd: workspaceCwd },
-                    })
-                    : line;
+                const workerMessage = parsed.method === "agent/run"
+                    ? { ...parsed, params: { ...(parsed.params ?? {}), cwd: workspaceCwd } }
+                    : parsed;
+                if (workerMessage.id === null) {
+                    ws.send(hostQueryError(null, -32600, "JSON-RPC request id must not be null"));
+                    return;
+                }
+                if (workerMessage.id !== undefined) {
+                    const workerRequestId = `serve-${tabId}-${nextWorkerRequestId++}`;
+                    pendingWorkerResponses.set(workerRequestId, {
+                        tab: ws,
+                        originalId: workerMessage.id,
+                        tabId,
+                    });
+                    workerMessage.id = workerRequestId;
+                }
+                const workerLine = JSON.stringify(workerMessage);
                 // Spawn-on-first-frame (idempotent): the browser's first request wakes
                 // the worker, mirroring the renderer's spawn-on-agent/run semantics.
                 bridge.ensureWorker(opts.cwd);
@@ -167,6 +230,10 @@ export async function startHeadlessServer(opts) {
             });
             ws.on("close", () => {
                 tabs.delete(ws);
+                for (const [requestId, route] of pendingWorkerResponses) {
+                    if (route.tabId === tabId)
+                        pendingWorkerResponses.delete(requestId);
+                }
                 log("tab.closed", { tabs: tabs.size });
             });
             ws.on("error", () => {
@@ -262,6 +329,36 @@ function replyToHostSessionQuery(message, sessionManager, workspaceCwd) {
         return hostQueryError(message.id, -32001, error instanceof Error ? error.message : "Session not found");
     }
 }
+const SERVE_ALLOWED_WORKER_METHODS = new Set(["agent/run", "agent/approve", "agent/cancel"]);
+/**
+ * The no-account Web host deliberately exposes only the methods used by its
+ * bundled SPA. Passcode possession grants control of this workspace, not raw
+ * access to the worker's full local protocol surface.
+ */
+function authorizeServeRequest(message, sessionManager, workspaceCwd) {
+    if (!message.method || !SERVE_ALLOWED_WORKER_METHODS.has(message.method)) {
+        return hostQueryError(message.id ?? null, -32601, "Method is not available in Web serve mode");
+    }
+    const rawSessionId = message.params?.sessionId;
+    const sessionId = typeof rawSessionId === "string" && rawSessionId.length > 0 ? rawSessionId : null;
+    if (message.method === "agent/run" && sessionId === null)
+        return undefined;
+    if (!sessionId) {
+        return hostQueryError(message.id ?? null, -32602, "sessionId is required");
+    }
+    try {
+        const session = sessionManager.resume(sessionId).state;
+        if (resolve(session.cwd) === workspaceCwd)
+            return undefined;
+    }
+    catch {
+        // A caller may choose the id for a brand-new run. Other methods must target
+        // an already-persisted session owned by this workspace.
+        if (message.method === "agent/run")
+            return undefined;
+    }
+    return hostQueryError(message.id ?? null, -32001, "Session not found in this workspace");
+}
 function hostQueryError(id, code, message) {
     return JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.8.8",
+  "version": "0.8.10",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,12 +35,13 @@
   ],
   "scripts": {
     "build": "bun run clean && tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.8.8",
-    "@cjhyy/code-shell-core": "0.8.8",
-    "@cjhyy/code-shell-web": "0.8.8",
+    "@cjhyy/code-shell-capability-coding": "0.8.10",
+    "@cjhyy/code-shell-core": "0.8.10",
+    "@cjhyy/code-shell-web": "0.8.10",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0"
   },