@cjhyy/code-shell-server 0.9.25 → 0.9.27

package/dist/links/types.d.ts

@@ -1,4 +1,4 @@
-export type { LinkAuthorization, LinkConnectionInput, LinkErrorCode, LinkSnapshot, MaskedLinkConnection, TokenConnectionInput, } from "@cjhyy/code-shell-link";
+export type { LinkAuthorization, LinkAuthMode, LinkAuthorizationInput, LinkAuthorizationResponse, LinkAuthorizationStep, LinkConnectionInput, LinkErrorCode, LinkSnapshot, MaskedLinkConnection, TokenConnectionInput, } from "@cjhyy/code-shell-link";
 export interface LinkOperationContext {
     ownerId: string;
     /** Rechecked after every external await and immediately before persistence. */

package/dist/project-runtime/proxy.js

@@ -2,6 +2,7 @@ import { request as httpRequest } from "node:http";
 import { Transform } from "node:stream";
 import { WebSocket, WebSocketServer } from "ws";
 import { HUB_SESSION_COOKIE } from "../hub/auth-http.js";
+import { createLinkBrowserHandoff } from "../links/browser-handoff.js";
 const UUID = "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}";
 const PROJECT_PATH = new RegExp(`^/p/(${UUID})(/.*)$`);
 const API_PATH = /^\/api\/v1\/(?:configuration|mcp|skills|links|panels|panel-assets|files|sessions|uploads)(?:\/|$)/;
@@ -53,6 +54,7 @@ class ProxyError extends Error {
 }
 /** Private runtime credentials and cookies never cross this control-plane boundary. */
 export function createProjectRuntimeProxy(options) {
+    const linkBrowser = createLinkBrowserHandoff();
     const leases = new Map();
     const assets = new Map();
     const revokedOwners = new Set();
@@ -249,10 +251,10 @@ export function createProjectRuntimeProxy(options) {
         }
         return result;
     }
-    async function innerJson(target, path, body, cookie, timeout = 10_000) {
+    async function innerJson(target, path, body, cookie, timeout = 10_000, method = "POST") {
         return await new Promise((resolve, reject) => {
             const request = httpRequest(new URL(path, target.url), {
-                method: "POST",
+                method,
                 headers: {
                     origin: options.publicOrigin(),
                     "content-type": "application/json",
@@ -338,12 +340,24 @@ export function createProjectRuntimeProxy(options) {
                     const renew = req.method === "POST" &&
                         incoming.statusCode === 200 &&
                         /^\/api\/v1\/panels\/runtime\/([A-Za-z0-9_-]+)\/renew$/.exec(route.pathname);
-                    const bytes = prepare || renew ? await readBounded(incoming, MAX_PREPARE_BYTES) : undefined;
+                    const linkCatalog = req.method === "GET" &&
+                        route.pathname === "/api/v1/links" &&
+                        incoming.statusCode === 200;
+                    let bytes = prepare || renew || linkCatalog
+                        ? await readBounded(incoming, MAX_PREPARE_BYTES)
+                        : undefined;
                     if (bytes) {
                         await validate(lease);
                         if (settled)
                             return;
-                        if (prepare)
+                        if (linkCatalog) {
+                            const snapshot = JSON.parse(bytes.toString("utf8"));
+                            if (snapshot.capabilities?.authorizationSteps === 1 &&
+                                snapshot.capabilities?.remoteAuth === true)
+                                snapshot.capabilities.browserHandoff = 1;
+                            bytes = Buffer.from(JSON.stringify(snapshot));
+                        }
+                        else if (prepare)
                             rememberPrepare(lease, bytes);
                         else if (renew) {
                             const { expiresAt } = JSON.parse(bytes.toString("utf8"));
@@ -361,6 +375,8 @@ export function createProjectRuntimeProxy(options) {
                         (incoming.statusCode ?? 500) < 300)
                         forgetAssets(lease, route.pathname.split("/").at(-1));
                     for (const name of RESPONSE_HEADERS) {
+                        if (linkCatalog && name === "content-length")
+                            continue;
                         const value = incoming.headers[name];
                         if (value !== undefined)
                             res.setHeader(name, value);
@@ -383,6 +399,8 @@ export function createProjectRuntimeProxy(options) {
         });
     }
     async function handle(req, res) {
+        if (await linkBrowser.handle(req, res))
+            return true;
         if (!(req.url ?? "").startsWith("/p/"))
             return false;
         try {
@@ -394,6 +412,43 @@ export function createProjectRuntimeProxy(options) {
                 : await acquire(req, route.projectId);
             if (req.aborted || res.destroyed)
                 return true;
+            const handoff = /^\/api\/v1\/links\/authorizations\/([a-f0-9-]{36})\/browser$/.exec(route.pathname);
+            if (handoff && req.method === "POST") {
+                const input = JSON.parse((await readBounded(req, 1024)).toString("utf8"));
+                if (!input ||
+                    Array.isArray(input) ||
+                    typeof input !== "object" ||
+                    Object.keys(input).length)
+                    throw new ProxyError(400, "Invalid browser authorization");
+                const target = `/api/v1/links/authorizations/${handoff[1]}`;
+                const readJob = async () => {
+                    await validate(lease);
+                    const result = await innerJson(lease.target, target, "", lease.cookie, 10_000, "GET");
+                    await validate(lease);
+                    const job = JSON.parse(result.bytes.toString("utf8"));
+                    if (job.id !== handoff[1] || job.state !== "pending")
+                        throw new ProxyError(409, "Authorization is no longer pending");
+                    return job;
+                };
+                const launch = linkBrowser.create(await readJob(), {
+                    check: async () => {
+                        await readJob();
+                    },
+                    complete: async (callbackUrl) => {
+                        await validate(lease);
+                        const result = await innerJson(lease.target, target + "/complete", JSON.stringify({ callbackUrl }), lease.cookie, 30_000);
+                        await validate(lease);
+                        return JSON.parse(result.bytes.toString("utf8"));
+                    },
+                    cancel: async () => {
+                        await validate(lease);
+                        return innerJson(lease.target, target, "", lease.cookie, 10_000, "DELETE");
+                    },
+                }, options.publicOrigin());
+                res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                res.end(JSON.stringify(launch));
+                return true;
+            }
             await forwardHttp(req, res, route, lease);
         }
         catch (error) {
@@ -588,6 +643,7 @@ export function createProjectRuntimeProxy(options) {
         revokeProject,
         async close() {
             closed = true;
+            linkBrowser.close();
             clearInterval(timer);
             for (const cancel of upgrades)
                 cancel();

package/dist/serve/headless-server.js

@@ -450,6 +450,7 @@ export async function startHeadlessServer(opts) {
     links = hubAuth
         ? createLinkHttp({
             ...configurationOptions,
+            browserHandoff: !opts.publicPathPrefix,
             remoteLink: () => remoteLink,
             onChanged: () => notify("serve/configurationChanged", {}),
         })
@@ -563,6 +564,8 @@ export async function startHeadlessServer(opts) {
             return;
         }
         if (hubAuth) {
+            if (await links?.handlePublic(req, res))
+                return;
             if (await panels?.handleAssets(req, res))
                 return;
             if (await hubAuth.handle(req, res))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,13 +60,13 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.25",
-    "@cjhyy/code-shell-core": "0.9.25",
-    "@cjhyy/code-shell-web": "0.9.25",
+    "@cjhyy/code-shell-capability-coding": "0.9.27",
+    "@cjhyy/code-shell-core": "0.9.27",
+    "@cjhyy/code-shell-web": "0.9.27",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0",
-    "@cjhyy/code-shell-link": "0.9.25"
+    "@cjhyy/code-shell-link": "0.9.27"
   },
   "engines": {
     "node": ">=20.10"