@cjhyy/code-shell-server 0.9.1 → 0.9.3

package/dist/serve/headless-server.d.ts

@@ -31,6 +31,10 @@ export interface HeadlessServeOptions {
      */
     passcode?: string;
     log?: WorkerBridgeLog;
+    /** Test/host tuning; production defaults to 60 seconds. */
+    pendingWorkerResponseTtlMs?: number;
+    /** Test/host tuning; production defaults to a 5-second sweep. */
+    pendingWorkerResponseReaperMs?: number;
 }
 export interface HeadlessServer {
     url: string;
@@ -42,6 +46,8 @@ export interface HeadlessServer {
     bridge: WorkerBridgeCore;
     /** Live authenticated tab count (for tests/status). */
     tabCount(): number;
+    /** Outstanding browser→worker RPC count (for status/tests). */
+    pendingResponseCount(): number;
     close(): Promise<void>;
 }
 export declare function startHeadlessServer(opts: HeadlessServeOptions): Promise<HeadlessServer>;

package/dist/serve/headless-server.js

@@ -40,6 +40,14 @@ export async function startHeadlessServer(opts) {
         throw new Error(`sessionRootDir must equal <workerDataRoot>/sessions (${expectedSessionRootDir}) so the host and worker authorize the same session store`);
     }
     const sessionManager = new SessionManager(sessionRootDir);
+    const pendingResponseTtlMs = opts.pendingWorkerResponseTtlMs ?? 60_000;
+    const pendingResponseReaperMs = opts.pendingWorkerResponseReaperMs ?? 5_000;
+    if (!Number.isSafeInteger(pendingResponseTtlMs) ||
+        pendingResponseTtlMs <= 0 ||
+        !Number.isSafeInteger(pendingResponseReaperMs) ||
+        pendingResponseReaperMs <= 0) {
+        throw new Error("pending worker response timeouts must be positive safe integers");
+    }
     const passcode = new AccessPasscode({ filePath: join(opts.dataDir, "access.json") });
     let generatedPasscode;
     if (opts.passcode) {
@@ -51,22 +59,65 @@ export async function startHeadlessServer(opts) {
     }
     const tabs = new Set();
     const pendingWorkerResponses = new Map();
+    const pendingResponsesByTab = new Map();
     let nextTabId = 1;
     let nextWorkerRequestId = 1;
+    const sendToTab = (tab, line, context) => {
+        if (tab.readyState !== tab.OPEN)
+            return false;
+        try {
+            tab.send(line);
+            return true;
+        }
+        catch (error) {
+            // readyState can change between the guard and send. A dead browser must
+            // never crash the shared worker router or its timeout reaper.
+            log("tab.send_failed", {
+                context,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+    };
     const broadcast = (line) => {
         for (const tab of tabs) {
-            if (tab.readyState === tab.OPEN)
-                tab.send(line);
+            sendToTab(tab, line, "broadcast");
+        }
+    };
+    const deletePendingWorkerResponse = (requestId) => {
+        const route = pendingWorkerResponses.get(requestId);
+        if (!route)
+            return;
+        pendingWorkerResponses.delete(requestId);
+        const remaining = (pendingResponsesByTab.get(route.tabId) ?? 1) - 1;
+        if (remaining > 0)
+            pendingResponsesByTab.set(route.tabId, remaining);
+        else
+            pendingResponsesByTab.delete(route.tabId);
+    };
+    const clearPendingWorkerResponsesForTab = (tabId) => {
+        for (const [requestId, route] of pendingWorkerResponses) {
+            if (route.tabId === tabId)
+                deletePendingWorkerResponse(requestId);
         }
     };
     const failPendingWorkerResponses = (message) => {
         for (const { tab, originalId } of pendingWorkerResponses.values()) {
-            if (tab.readyState !== tab.OPEN)
-                continue;
-            tab.send(hostQueryError(originalId, -32000, message));
+            sendToTab(tab, hostQueryError(originalId, -32000, message), "worker-exit");
         }
         pendingWorkerResponses.clear();
+        pendingResponsesByTab.clear();
     };
+    const pendingResponseReaper = setInterval(() => {
+        const now = Date.now();
+        for (const [requestId, route] of pendingWorkerResponses) {
+            if (now - route.insertedAt < pendingResponseTtlMs)
+                continue;
+            deletePendingWorkerResponse(requestId);
+            sendToTab(route.tab, hostQueryError(route.originalId, -32000, "agent worker response timed out"), "worker-timeout");
+        }
+    }, pendingResponseReaperMs);
+    pendingResponseReaper.unref?.();
     // Notifications describe shared agent state and are broadcast. Correlated
     // JSON-RPC responses must return only to the tab that issued the request;
     // browser tabs all start their local counters at `web-1`, so broadcasting a
@@ -89,10 +140,8 @@ export async function startHeadlessServer(opts) {
             log("worker.response_dropped", { reason: "unknown request id", id: message.id });
             return;
         }
-        pendingWorkerResponses.delete(String(message.id));
-        if (route.tab.readyState !== route.tab.OPEN)
-            return;
-        route.tab.send(JSON.stringify({ ...message, id: route.originalId }));
+        deletePendingWorkerResponse(String(message.id));
+        sendToTab(route.tab, JSON.stringify({ ...message, id: route.originalId }), "worker-response");
     };
     const bridge = new WorkerBridgeCore({
         entryPath: opts.workerEntryPath,
@@ -171,7 +220,7 @@ export async function startHeadlessServer(opts) {
             return;
         serveStatic(req, res);
     });
-    const wss = new WebSocketServer({ noServer: true });
+    const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 });
     server.on("upgrade", (req, socket, head) => {
         const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
         if (pathname !== "/ws" || !passcode.allows(req)) {
@@ -184,6 +233,11 @@ export async function startHeadlessServer(opts) {
             tabs.add(ws);
             log("tab.connected", { tabs: tabs.size });
             ws.on("message", (data) => {
+                if (webSocketPayloadBytes(data) > 1024 * 1024) {
+                    log("tab.frame_dropped", { reason: "payload too large" });
+                    ws.close(1009, "payload too large");
+                    return;
+                }
                 const line = String(data);
                 // Validate framing before touching the worker: a malformed frame from
                 // one tab must never kill the shared pipe.
@@ -220,12 +274,18 @@ export async function startHeadlessServer(opts) {
                     return;
                 }
                 if (workerMessage.id !== undefined) {
+                    if ((pendingResponsesByTab.get(tabId) ?? 0) >= 64) {
+                        ws.send(hostQueryError(workerMessage.id, -32000, "too many pending agent worker requests for this tab"));
+                        return;
+                    }
                     const workerRequestId = `serve-${tabId}-${nextWorkerRequestId++}`;
                     pendingWorkerResponses.set(workerRequestId, {
                         tab: ws,
                         originalId: workerMessage.id,
                         tabId,
+                        insertedAt: Date.now(),
                     });
+                    pendingResponsesByTab.set(tabId, (pendingResponsesByTab.get(tabId) ?? 0) + 1);
                     workerMessage.id = workerRequestId;
                 }
                 const workerLine = JSON.stringify(workerMessage);
@@ -236,24 +296,31 @@ export async function startHeadlessServer(opts) {
             });
             ws.on("close", () => {
                 tabs.delete(ws);
-                for (const [requestId, route] of pendingWorkerResponses) {
-                    if (route.tabId === tabId)
-                        pendingWorkerResponses.delete(requestId);
-                }
+                clearPendingWorkerResponsesForTab(tabId);
                 log("tab.closed", { tabs: tabs.size });
             });
             ws.on("error", () => {
                 tabs.delete(ws);
+                clearPendingWorkerResponsesForTab(tabId);
             });
         });
     });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(opts.port ?? 8790, host, () => {
-            server.off("error", reject);
-            resolve();
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(opts.port ?? 8790, host, () => {
+                server.off("error", reject);
+                resolve();
+            });
         });
-    });
+    }
+    catch (error) {
+        clearInterval(pendingResponseReaper);
+        bridge.kill();
+        wss.close();
+        server.close();
+        throw error;
+    }
     const address = server.address();
     const port = typeof address === "object" && address ? address.port : (opts.port ?? 8790);
     const url = `http://${host}:${port}`;
@@ -266,7 +333,9 @@ export async function startHeadlessServer(opts) {
         passcode,
         bridge,
         tabCount: () => tabs.size,
+        pendingResponseCount: () => pendingWorkerResponses.size,
         close: async () => {
+            clearInterval(pendingResponseReaper);
             for (const tab of tabs) {
                 try {
                     tab.terminate();
@@ -288,6 +357,18 @@ export async function startHeadlessServer(opts) {
         },
     };
 }
+function webSocketPayloadBytes(data) {
+    if (typeof data === "string")
+        return Buffer.byteLength(data, "utf8");
+    if (Array.isArray(data)) {
+        return data.reduce((total, item) => total + (typeof item?.byteLength === "number" ? item.byteLength : 0), 0);
+    }
+    if (data && typeof data === "object" && "byteLength" in data) {
+        const byteLength = data.byteLength;
+        return typeof byteLength === "number" ? byteLength : Number.POSITIVE_INFINITY;
+    }
+    return Buffer.byteLength(String(data), "utf8");
+}
 function replyToHostSessionQuery(message, sessionManager, workspaceCwd) {
     if (message.method !== "agent/query" || message.id === undefined)
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -39,9 +39,9 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.1",
-    "@cjhyy/code-shell-core": "0.9.1",
-    "@cjhyy/code-shell-web": "0.9.1",
+    "@cjhyy/code-shell-capability-coding": "0.9.3",
+    "@cjhyy/code-shell-core": "0.9.3",
+    "@cjhyy/code-shell-web": "0.9.3",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0"
   },