@cjhyy/code-shell-server 0.9.35 → 0.9.37

package/dist/project-runtime/account-binding.d.ts

@@ -0,0 +1,12 @@
+/** Explicit single-operator adoption; account display names never confer ownership. */
+export interface CloudAccountBinding {
+    version: 1;
+    accountOrigin: string;
+    accountId: string;
+    ownerId: string;
+    managementEpoch: string;
+    createdAt: number;
+}
+export declare const CLOUD_ADOPTION_PENDING = "account-adoption-pending.json";
+export declare function isCloudAccountOrigin(value: unknown): value is string;
+export declare function isCloudAccountBinding(value: unknown): value is CloudAccountBinding;

package/dist/project-runtime/account-binding.js

@@ -0,0 +1,33 @@
+export const CLOUD_ADOPTION_PENDING = "account-adoption-pending.json";
+const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+export function isCloudAccountOrigin(value) {
+    if (typeof value !== "string" || value.length > 2048)
+        return false;
+    try {
+        const url = new URL(value);
+        return (url.origin === value &&
+            !url.username &&
+            !url.password &&
+            (url.protocol === "https:" ||
+                (url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))));
+    }
+    catch {
+        return false;
+    }
+}
+export function isCloudAccountBinding(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const row = value;
+    return (Object.keys(row).sort().join() ===
+        ["version", "accountOrigin", "accountId", "ownerId", "managementEpoch", "createdAt"]
+            .sort()
+            .join() &&
+        row.version === 1 &&
+        isCloudAccountOrigin(row.accountOrigin) &&
+        UUID.test(row.accountId) &&
+        UUID.test(row.ownerId) &&
+        UUID.test(row.managementEpoch) &&
+        Number.isSafeInteger(row.createdAt) &&
+        row.createdAt >= 0);
+}

package/dist/project-runtime/backup.d.ts

@@ -1,3 +1,5 @@
+import { fsyncSync } from "node:fs";
+import { rm } from "node:fs/promises";
 export interface ProjectBackupOptions {
     dataDir: string;
     destination: string;
@@ -8,6 +10,11 @@ export interface ProjectRestoreOptions {
     source: string;
     destination: string;
     helperImage: string;
+    /** Fault injection for offline restore durability tests. */
+    io?: {
+        fsync?: typeof fsyncSync;
+        removeMarker?: typeof rm;
+    };
 }
 /** Offline, owner-only backup. It never stops projects or modifies their volumes. */
 export declare function backupProjectInstallation(options: ProjectBackupOptions): Promise<{

package/dist/project-runtime/backup.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
-import { constants, createWriteStream } from "node:fs";
+import { closeSync, constants, createWriteStream, fsyncSync, fstatSync, lstatSync, openSync, writeFileSync, } from "node:fs";
 import { lstat, mkdir, open, readdir, realpath, rm, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -381,6 +381,7 @@ function validateManifest(value) {
             path.split("/").some((part) => !part || part === "." || part === "..") ||
             /[\0\r\n]/.test(path) ||
             path === "restore-in-progress" ||
+            ["project-runtime-secrets", "administrator-setup.txt", "environment.json"].some((obsolete) => path.startsWith(obsolete + "/")) ||
             path.startsWith("project-control.lock/") ||
             path === "project-control.lock" ||
             !entry ||
@@ -425,21 +426,48 @@ export async function restoreProjectInstallation(options) {
         same(digest(await controlBytes(join(source, "control"), path)), expected);
     await docker(["image", "inspect", options.helperImage]);
     const destination = await exclusiveDestination(source, resolve(options.destination));
+    const marker = join(destination, "restore-in-progress");
+    const directories = new Set([destination]);
+    const sync = (path) => {
+        const before = lstatSync(path);
+        if (before.isSymbolicLink() || (!before.isFile() && !before.isDirectory()))
+            throw new Error("Restore durability requires ordinary files and directories.");
+        const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const current = fstatSync(fd);
+            if (current.dev !== before.dev || current.ino !== before.ino)
+                throw new Error("Restore storage changed while opening.");
+            (options.io?.fsync ?? fsyncSync)(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    const persistMarker = (rearm = false) => {
+        try {
+            writeFileSync(marker, "1\n", { mode: 0o600, flag: "wx" });
+        }
+        catch (error) {
+            if (!rearm || error.code !== "EEXIST")
+                throw error;
+        }
+        sync(marker);
+        sync(destination);
+        sync(dirname(destination));
+    };
     const created = [];
     let registry;
     try {
-        await writeFile(join(destination, "restore-in-progress"), "1\n", {
-            mode: 0o600,
-            flag: "wx",
-            flush: true,
-        });
+        persistMarker();
         for (const [path, expected] of Object.entries(manifest.control)) {
             const bytes = await controlBytes(join(source, "control"), path);
             same(digest(bytes), expected);
             await mkdir(dirname(join(destination, path)), { recursive: true, mode: 0o700 });
+            for (let parent = dirname(join(destination, path)); parent !== destination; parent = dirname(parent))
+                directories.add(parent);
             await writeFile(join(destination, path), bytes, { mode: 0o600, flag: "wx", flush: true });
         }
-        registry = new ProjectRegistry(destination);
+        registry = new ProjectRegistry(destination, Date.now, { fsync: options.io?.fsync });
         const rows = registry.all();
         if (registry.installationId !== manifest.installationId ||
             rows.some((p) => p.status !== "stopped") ||
@@ -450,6 +478,10 @@ export async function restoreProjectInstallation(options) {
         if (!auth.isInitialized())
             throw new Error("Backup administrator is not initialized.");
         auth.revokeAllSessions();
+        // HubAuthStore publishes by rename. Persist the replacement and its directory
+        // before a new namespace or removal of the restore barrier can become visible.
+        sync(join(destination, "hub/auth.json"));
+        sync(join(destination, "hub"));
         registry.renewInstallationForRestore();
         const installationId = registry.installationId;
         for (const volume of manifest.volumes) {
@@ -472,7 +504,12 @@ export async function restoreProjectInstallation(options) {
         for (const path of ["project-runtime-secrets", "administrator-setup.txt", "environment.json"])
             await rm(join(destination, path), { recursive: true, force: true });
         registry.all();
-        await rm(join(destination, "restore-in-progress"));
+        // Copied file bytes were flushed individually; their new directory entries
+        // must also survive a crash before the installation is advertised as usable.
+        for (const path of [...directories].sort((a, b) => b.length - a.length))
+            sync(path);
+        await (options.io?.removeMarker ?? rm)(marker);
+        sync(destination);
         return {
             destination,
             installationId,
@@ -482,6 +519,15 @@ export async function restoreProjectInstallation(options) {
         };
     }
     catch (error) {
+        let barrierError;
+        try {
+            // In particular, unlink may have succeeded before its directory fsync
+            // failed. Re-establish and persist the barrier before any cleanup awaits.
+            persistMarker(true);
+        }
+        catch (failure) {
+            barrierError = failure;
+        }
         // Only delete volumes created by this restore and still carrying its exact labels.
         for (const { name, expected } of created.reverse()) {
             try {
@@ -492,6 +538,8 @@ export async function restoreProjectInstallation(options) {
                 /* Preserve a busy/changed volume for operator inspection. */
             }
         }
+        if (barrierError)
+            throw new AggregateError([error, barrierError], `Restore failed and its durable barrier could not be confirmed; keep ${destination} offline.`, { cause: error });
         throw error; // Keep the marked offline directory as recovery evidence; never advertise success.
     }
     finally {

package/dist/project-runtime/cloud-account-auth.d.ts

@@ -0,0 +1,23 @@
+import { type CloudAccountBinding } from "./account-binding.js";
+import type { CloudAccountAuthority, CloudManagementSession, ProjectControlAuthority } from "./control-authority.js";
+export declare const CLOUD_MANAGEMENT_AUTHORITY_VERSION = 2;
+export declare const CLOUD_MANAGEMENT_COOKIE = "cs_cloud_management";
+export declare function cloudManagementSessionView(session: CloudManagementSession): {
+    id: string;
+    kind: "cloud-management";
+    audience: string;
+    installationId: string;
+    accountOrigin: string;
+    accountId: string;
+    managementEpoch: string;
+    expiresAt: number;
+};
+/** An explicitly bound Account controls one existing single-operator installation. */
+export declare function createCloudAccountAuth(options: {
+    binding: CloudAccountBinding;
+    installationId: string;
+    publicOrigin: string;
+    authority: CloudAccountAuthority;
+    onRevoke(sessionId: string): void;
+    now?: () => number;
+}): ProjectControlAuthority;

package/dist/project-runtime/cloud-account-auth.js

@@ -0,0 +1,287 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { isCloudAccountOrigin } from "./account-binding.js";
+import { ProjectRegistryError } from "./registry.js";
+export const CLOUD_MANAGEMENT_AUTHORITY_VERSION = 2;
+export const CLOUD_MANAGEMENT_COOKIE = "cs_cloud_management";
+const TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+const hash = (token) => createHash("sha256").update(token).digest("hex");
+export function cloudManagementSessionView(session) {
+    const { ownerId: _ownerId, ...view } = session;
+    return view;
+}
+function principalValid(value) {
+    return (value &&
+        Object.keys(value).sort().join() ===
+            ["accountOrigin", "accountId", "sessionId", "rootSessionId", "authorityEpoch", "expiresAt"]
+                .sort()
+                .join() &&
+        isCloudAccountOrigin(value.accountOrigin) &&
+        UUID.test(value.accountId) &&
+        UUID.test(value.sessionId) &&
+        value.sessionId === value.rootSessionId &&
+        UUID.test(value.authorityEpoch) &&
+        Number.isSafeInteger(value.expiresAt));
+}
+/** An explicitly bound Account controls one existing single-operator installation. */
+export function createCloudAccountAuth(options) {
+    const now = options.now ?? Date.now;
+    if (!isCloudAccountOrigin(options.publicOrigin) ||
+        options.authority.accountOrigin !== options.binding.accountOrigin ||
+        !UUID.test(options.installationId))
+        throw new Error("Cloud authority configuration does not match explicit ownership.");
+    const sessions = new Map();
+    const reading = new Set();
+    let closed = false;
+    let exchanging = 0;
+    let attempts = { until: now() + 60_000, count: 0 };
+    function revoke(entry) {
+        if (entry.revoked)
+            return;
+        entry.revoked = true;
+        options.onRevoke(entry.session.id);
+    }
+    function entryFor(session) {
+        if (closed || !("kind" in session))
+            return;
+        const entry = sessions.get(session.id);
+        if (!entry || entry.revoked || entry.session.expiresAt <= now()) {
+            if (entry)
+                revoke(entry);
+            return;
+        }
+        // Do not let a caller change owner, epoch or deadline using an existing id.
+        if (JSON.stringify(entry.session) !== JSON.stringify(session))
+            return;
+        return entry;
+    }
+    async function revalidate(session) {
+        const entry = entryFor(session);
+        if (!entry)
+            throw new ProjectRegistryError(401, "Cloud 管理登录已失效。");
+        try {
+            const current = await options.authority.validate({ ...entry.principal }, options.installationId);
+            if (!principalValid(current) ||
+                Object.keys(current).some((key) => current[key] !==
+                    entry.principal[key]) ||
+                !entryFor(session))
+                throw new Error("Cloud Account authority changed.");
+        }
+        catch {
+            revoke(entry);
+            throw new ProjectRegistryError(401, "Cloud 管理授权已失效，请重新登录云账号。");
+        }
+    }
+    function requestToken(req) {
+        let authorizations = 0;
+        for (let i = 0; i < req.rawHeaders.length; i += 2)
+            if (req.rawHeaders[i].toLowerCase() === "authorization")
+                authorizations++;
+        if (authorizations > 1)
+            return;
+        const bearer = req.headers.authorization;
+        const cookie = req.headers.cookie
+            ?.split(";")
+            .map((part) => part.trim())
+            .filter((part) => part.startsWith(`${CLOUD_MANAGEMENT_COOKIE}=`));
+        if (bearer !== undefined && cookie?.length)
+            return;
+        if (bearer !== undefined)
+            return /^Bearer ([A-Za-z0-9_-]{43})$/.exec(bearer)?.[1];
+        if (cookie?.length === 1)
+            return cookie[0].slice(CLOUD_MANAGEMENT_COOKIE.length + 1);
+    }
+    function isOriginAllowed(req) {
+        let hosts = 0;
+        for (let i = 0; i < req.rawHeaders.length; i += 2)
+            if (req.rawHeaders[i].toLowerCase() === "host")
+                hosts++;
+        if (hosts !== 1 ||
+            req.headers.host !== new URL(options.publicOrigin).host ||
+            req.headers["sec-fetch-site"] === "cross-site")
+            return false;
+        return req.headers.origin === undefined || req.headers.origin === options.publicOrigin;
+    }
+    async function authenticate(req) {
+        if (!isOriginAllowed(req))
+            return null;
+        const token = requestToken(req);
+        if (!token || !TOKEN.test(token))
+            return null;
+        const entry = [...sessions.values()].find((row) => row.hash === hash(token));
+        if (!entry || !entryFor(entry.session))
+            return null;
+        await revalidate(entry.session);
+        return { ...entry.session };
+    }
+    function json(res, status, value) {
+        res.writeHead(status, {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+            "X-Content-Type-Options": "nosniff",
+        });
+        res.end(JSON.stringify(value));
+    }
+    async function readBody(req) {
+        if (!/^application\/json(?:\s*;|$)/i.test(req.headers["content-type"] ?? ""))
+            throw new ProjectRegistryError(415, "请使用 JSON 提交。");
+        const chunks = [];
+        let size = 0;
+        const timer = setTimeout(() => req.destroy(), 5000);
+        timer.unref();
+        reading.add(req);
+        try {
+            for await (const chunk of req) {
+                size += chunk.length;
+                if (size > 4096)
+                    throw new ProjectRegistryError(413, "请求过大。");
+                chunks.push(Buffer.from(chunk));
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            reading.delete(req);
+        }
+        try {
+            const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            if (body && typeof body === "object" && !Array.isArray(body))
+                return body;
+        }
+        catch {
+            /* fixed public error below */
+        }
+        throw new ProjectRegistryError(400, "请求格式无效。");
+    }
+    async function handle(req, res) {
+        const path = (req.url ?? "/").split("?", 1)[0];
+        if (!path.startsWith("/api/v1/cloud-management/") && !path.startsWith("/api/v1/auth/"))
+            return false;
+        if (!isOriginAllowed(req))
+            throw new ProjectRegistryError(403, "请求来源无效。");
+        if (closed)
+            throw new ProjectRegistryError(503, "Cloud 管理服务正在关闭。");
+        if (req.url !== path)
+            throw new ProjectRegistryError(400, "请求参数无效。");
+        if (path === "/api/v1/cloud-management/capabilities" && req.method === "GET") {
+            json(res, 200, {
+                version: CLOUD_MANAGEMENT_AUTHORITY_VERSION,
+                mode: "cloud-account",
+                cloudOrigin: options.publicOrigin,
+                installationId: options.installationId,
+                accountOrigin: options.binding.accountOrigin,
+            });
+            return true;
+        }
+        if (path === "/api/v1/cloud-management/session" && req.method === "POST") {
+            // Main sends an Account-issued target-bound single-use ticket, never its root credential.
+            if (req.headers.origin !== undefined ||
+                req.headers.cookie !== undefined ||
+                req.headers.authorization !== undefined ||
+                req.headers["sec-fetch-site"] !== undefined)
+                throw new ProjectRegistryError(403, "请从桌面 Cloud 管理器登录。");
+            if (now() >= attempts.until)
+                attempts = { until: now() + 60_000, count: 0 };
+            if (++attempts.count > 60 || exchanging >= 4)
+                throw new ProjectRegistryError(429, "Cloud 管理登录请求过多。");
+            exchanging++;
+            try {
+                const body = await readBody(req);
+                if (Object.keys(body).join() !== "ticket" ||
+                    typeof body.ticket !== "string" ||
+                    !TOKEN.test(body.ticket))
+                    throw new ProjectRegistryError(400, "Cloud 管理票据格式无效。");
+                let principal;
+                try {
+                    principal = await options.authority.redeem(body.ticket, options.installationId);
+                }
+                catch {
+                    throw new ProjectRegistryError(401, "云账号验证失败。");
+                }
+                if (closed ||
+                    !principalValid(principal) ||
+                    principal.accountOrigin !== options.binding.accountOrigin ||
+                    principal.accountId !== options.binding.accountId ||
+                    principal.expiresAt <= now())
+                    throw new ProjectRegistryError(403, "此账号没有 Cloud 管理权限。");
+                for (const [id, row] of sessions)
+                    if (row.session.expiresAt + 600_000 <= now())
+                        sessions.delete(id);
+                if (sessions.size >= 128)
+                    throw new ProjectRegistryError(429, "Cloud 管理会话数量已达上限。");
+                const token = randomBytes(32).toString("base64url");
+                const session = {
+                    id: randomUUID(),
+                    kind: "cloud-management",
+                    audience: options.publicOrigin,
+                    installationId: options.installationId,
+                    accountOrigin: principal.accountOrigin,
+                    accountId: principal.accountId,
+                    managementEpoch: options.binding.managementEpoch,
+                    expiresAt: Math.min(now() + 600_000, principal.expiresAt),
+                    ownerId: options.binding.ownerId,
+                };
+                sessions.set(session.id, {
+                    hash: hash(token),
+                    session,
+                    principal: { ...principal },
+                    revoked: false,
+                });
+                json(res, 201, { token, session: cloudManagementSessionView(session) });
+            }
+            finally {
+                exchanging--;
+            }
+            return true;
+        }
+        if (path === "/api/v1/auth/status" && req.method === "GET") {
+            const session = await authenticate(req);
+            json(res, 200, {
+                initialized: true,
+                mode: "cloud-account",
+                authenticated: !!session,
+                ...(session && "kind" in session ? { session: cloudManagementSessionView(session) } : {}),
+            });
+            return true;
+        }
+        if (["/api/v1/cloud-management/logout", "/api/v1/auth/logout"].includes(path) &&
+            req.method === "POST") {
+            const body = await readBody(req);
+            if (Object.keys(body).length)
+                throw new ProjectRegistryError(400, "退出不接受额外参数。");
+            const token = requestToken(req);
+            const entry = token &&
+                TOKEN.test(token) &&
+                [...sessions.values()].find((row) => row.hash === hash(token));
+            if (!entry)
+                throw new ProjectRegistryError(401, "Cloud 管理登录已失效。");
+            revoke(entry);
+            res.setHeader("Set-Cookie", `${CLOUD_MANAGEMENT_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${options.publicOrigin.startsWith("https:") ? "; Secure" : ""}`);
+            json(res, 200, { revoked: true });
+            return true;
+        }
+        throw new ProjectRegistryError(403, "此 Cloud 只接受明确绑定的云账号管理。");
+    }
+    return {
+        cookieName: CLOUD_MANAGEMENT_COOKIE,
+        store: {
+            listSessions: () => [...sessions.values()]
+                .filter((row) => entryFor(row.session))
+                .map((row) => ({ ...row.session })),
+        },
+        handle,
+        authenticate,
+        isOriginAllowed,
+        isActive: (session) => !!entryFor(session),
+        revalidate,
+        close() {
+            closed = true;
+            for (const request of reading)
+                request.destroy();
+            reading.clear();
+            for (const row of sessions.values())
+                revoke(row);
+            sessions.clear();
+        },
+    };
+}

package/dist/project-runtime/control-authority.d.ts

@@ -0,0 +1,46 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { HubAuth } from "../hub/auth-http.js";
+import type { HubSession } from "../hub/auth-store.js";
+/** Public Account identity; access/refresh credentials never enter project workers. */
+export interface CloudAccountPrincipal {
+    accountOrigin: string;
+    accountId: string;
+    sessionId: string;
+    rootSessionId: string;
+    authorityEpoch: string;
+    expiresAt: number;
+}
+export interface CloudManagementSession {
+    id: string;
+    kind: "cloud-management";
+    audience: string;
+    installationId: string;
+    accountOrigin: string;
+    accountId: string;
+    managementEpoch: string;
+    expiresAt: number;
+    /** Internal owner scope, excluded from every response. */
+    ownerId: string;
+}
+export type ProjectControlSession = HubSession | CloudManagementSession;
+export interface ProjectControlAuthority {
+    bootstrapToken?: string;
+    cookieName: string;
+    store: {
+        listSessions(): ProjectControlSession[];
+    };
+    handle(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    authenticate(req: IncomingMessage): Promise<ProjectControlSession | null>;
+    isOriginAllowed(req: IncomingMessage): boolean;
+    /** Local lifetime check, synchronous so an already revoked transport closes promptly. */
+    isActive(session: ProjectControlSession): boolean;
+    /** Continuous authority check, also called around asynchronous lifecycle work. */
+    revalidate(session: ProjectControlSession): Promise<void>;
+    close?(): void;
+}
+export interface CloudAccountAuthority {
+    accountOrigin: string;
+    redeem(ticket: string, installationId: string): Promise<CloudAccountPrincipal>;
+    validate(principal: CloudAccountPrincipal, installationId: string): Promise<CloudAccountPrincipal>;
+}
+export declare function legacyProjectAuthority(auth: HubAuth): ProjectControlAuthority;

package/dist/project-runtime/control-authority.js

@@ -0,0 +1,15 @@
+export function legacyProjectAuthority(auth) {
+    const isActive = (session) => !("kind" in session) &&
+        auth.store
+            .listSessions()
+            .some((row) => row.id === session.id && row.username === session.username);
+    return {
+        ...auth,
+        cookieName: "cs_hub_session",
+        isActive,
+        async revalidate(session) {
+            if (!isActive(session))
+                throw new Error("Project control authority expired.");
+        },
+    };
+}

package/dist/project-runtime/control-server.d.ts

@@ -1,4 +1,5 @@
 import type { RemoteLinkConfiguration } from "@cjhyy/code-shell-core";
+import { type CloudAccountAuthority } from "./control-authority.js";
 import type { ProjectRuntimeProvider } from "./types.js";
 export interface ProjectControlServerOptions {
     host: string;
@@ -12,6 +13,8 @@ export interface ProjectControlServerOptions {
     runtimeSeccompProfile?: string;
     /** Dependency injection for lifecycle/transport integration tests. */
     provider?: ProjectRuntimeProvider;
+    /** Trusted fixed Account-origin verifier. Requires explicit offline ownership adoption. */
+    accountAuthority?: CloudAccountAuthority;
 }
 /** A small account/project gateway. It never creates a worker, executes tools or mounts cwd. */
 export declare function startProjectControlServer(options: ProjectControlServerOptions): Promise<{