@cjhyy/code-shell-server 0.9.47 → 0.9.49

package/dist/serve/headless-server.js

@@ -17,15 +17,15 @@ import { describeEnvironment, environmentIdentity } from "../environment-identit
 // server restart spawns a fresh worker on the first inbound frame and the
 // browser re-lists sessions over the same protocol.
 import { createServer } from "node:http";
-import { readFileSync, existsSync } from "node:fs";
-import { basename, dirname, extname, join, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
 import { WebSocketServer } from "ws";
 import { CONTRACTS, SessionManager, SettingsManager } from "@cjhyy/code-shell-core";
 import { SessionOutputCoverageStore, readOutputJournal, readOutputJournalLegacyBase, } from "@cjhyy/code-shell-core/internal";
 import { AccessPasscode } from "../mobile-remote/access-passcode.js";
 import { resolveSafe } from "../mobile-remote/mobile-static.js";
-import { contentTypeFor } from "../static-files.js";
+import { streamStaticFile } from "../static-files.js";
 import { createHubAuth } from "../hub/auth-http.js";
 import { ApprovalLeases } from "../hub/approval-lease.js";
 import { HubUploads, hubJson } from "../hub/uploads.js";
@@ -611,7 +611,7 @@ export async function startHeadlessServer(opts) {
             isAuthorized: configurationOptions.isAuthorized,
         })
         : undefined;
-    const serveStatic = (req, res) => {
+    const serveStatic = async (req, res) => {
         const root = opts.staticRootDir;
         if (!root) {
             res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
@@ -635,27 +635,24 @@ export async function startHeadlessServer(opts) {
                 res.end("not found");
                 return;
             }
-            filePath = join(root, "index.html");
-            if (!existsSync(filePath)) {
+            filePath = resolveSafe(root, "index.html");
+            if (!filePath) {
                 res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
                 res.end("web app not built");
                 return;
             }
         }
-        try {
-            const body = readFileSync(filePath);
-            res.writeHead(200, {
-                "content-type": contentTypeFor(extname(filePath)),
-                "cache-control": "no-cache",
-            });
-            res.end(body);
-        }
-        catch {
-            res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-            res.end("not found");
-        }
+        await streamStaticFile(req, res, {
+            rootDir: root,
+            filePath,
+            cacheControl: "no-cache",
+        });
     };
     const handleHttp = async (req, res) => {
+        if (closing) {
+            hubJson(res, 503, { error: "server is closing" });
+            return;
+        }
         const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
         res.setHeader("x-content-type-options", "nosniff");
         res.setHeader("referrer-policy", "no-referrer");
@@ -678,14 +675,16 @@ export async function startHeadlessServer(opts) {
             return;
         }
         if (hubAuth) {
-            if (await links?.handlePublic(req, res))
+            if ((await links?.handlePublic(req, res)) || closing || res.destroyed)
                 return;
-            if (await panels?.handleAssets(req, res))
+            if ((await panels?.handleAssets(req, res)) || closing || res.destroyed)
                 return;
-            if (await hubAuth.handle(req, res))
+            if ((await hubAuth.handle(req, res)) || closing || res.destroyed)
                 return;
             if (pathname.startsWith("/api/")) {
                 const session = await hubAuth.authenticate(req);
+                if (closing || res.destroyed)
+                    return;
                 if (!session) {
                     hubJson(res, 401, { error: "login required" });
                     return;
@@ -694,10 +693,6 @@ export async function startHeadlessServer(opts) {
                     hubJson(res, 403, { error: "origin rejected" });
                     return;
                 }
-                if (closing) {
-                    hubJson(res, 503, { error: "server is closing" });
-                    return;
-                }
                 responses.track(session.id, res);
                 if (pathname === "/api/v1/environment" && req.method === "GET") {
                     hubJson(res, 200, environment);
@@ -738,20 +733,37 @@ export async function startHeadlessServer(opts) {
                 return;
             }
             // Public static shell contains no user data and supplies the setup/login page.
-            serveStatic(req, res);
+            await serveStatic(req, res);
             return;
         }
         if (!passcode.gate(req, res))
             return;
-        serveStatic(req, res);
+        await serveStatic(req, res);
     };
     const server = createServer((req, res) => {
         void handleHttp(req, res).catch(() => hubJson(res, 500, { error: "server request failed" }));
     });
+    // HTTP closeAllConnections excludes an upgrade awaiting authentication.
+    // Own accepted sockets until close or a completed transfer to WebSocket.
+    const connections = new Set();
+    server.on("connection", (socket) => {
+        connections.add(socket);
+        socket.once("close", () => connections.delete(socket));
+        if (closing)
+            socket.destroy();
+    });
     const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 });
     const upgrade = async (req, socket, head) => {
+        if (closing || socket.destroyed) {
+            socket.destroy();
+            return;
+        }
         const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
         const session = hubAuth ? await hubAuth.authenticate(req) : undefined;
+        if (closing || socket.destroyed) {
+            socket.destroy();
+            return;
+        }
         const allowed = hubAuth
             ? !!session && hubAuth.isOriginAllowed(req)
             : passcode.allows(req);
@@ -767,6 +779,7 @@ export async function startHeadlessServer(opts) {
         }
         const tabId = nextTabId++;
         wss.handleUpgrade(req, socket, head, (ws) => {
+            connections.delete(socket);
             tabs.add(ws);
             if (session)
                 tabAuth.set(ws, { sessionId: session.id, request: req });
@@ -792,7 +805,7 @@ export async function startHeadlessServer(opts) {
                     ws.close(1009, "payload too large");
                     return;
                 }
-                if (closing) {
+                if (closing || ws.readyState !== ws.OPEN) {
                     ws.close(1012, "server stopping");
                     return;
                 }
@@ -943,9 +956,13 @@ export async function startHeadlessServer(opts) {
                             sendToTab(ws, hostQueryError(parsed.id ?? null, -32602, error.message), "attachments");
                             return;
                         }
-                        if (ws.readyState !== ws.OPEN || !(await hubAuth.authenticate(req)))
+                        if (closing || ws.readyState !== ws.OPEN)
+                            return;
+                        if (!(await hubAuth.authenticate(req)))
                             return;
                     }
+                    if (closing || ws.readyState !== ws.OPEN)
+                        return;
                     // Recheck after asynchronous staging/authentication; other tabs may
                     // have filled the runtime's capacity while this request was suspended.
                     if (hubAuth && parsed.method === "agent/run" && runningSessions.size >= 64) {
@@ -1060,6 +1077,8 @@ export async function startHeadlessServer(opts) {
                     const workerLine = JSON.stringify(workerMessage);
                     // Spawn-on-first-frame (idempotent): the browser's first request wakes
                     // the worker, mirroring the renderer's spawn-on-agent/run semantics.
+                    if (closing || ws.readyState !== ws.OPEN)
+                        return;
                     bridge.ensureWorker(opts.cwd);
                     if (!bridge.canSend()) {
                         workerUnavailable("agent worker is unavailable");
@@ -1114,6 +1133,58 @@ export async function startHeadlessServer(opts) {
     server.on("upgrade", (req, socket, head) => {
         void upgrade(req, socket, head).catch(() => socket.destroy());
     });
+    let closePromise;
+    const close = () => {
+        if (closePromise)
+            return closePromise;
+        closing = true;
+        closePromise = Promise.resolve().then(async () => {
+            // Stop admission before any asynchronous resource/worker cleanup. A
+            // reconnect during a slow worker exit must not prolong server shutdown.
+            const webSocketsClosed = new Promise((resolve) => wss.close(() => resolve()));
+            // Finish WebSocket teardown before the HTTP close callback, including on
+            // Bun where closing HTTP before its upgraded sockets can strand it.
+            const httpClosed = webSocketsClosed.then(() => new Promise((resolve) => {
+                server.closeAllConnections?.();
+                server.close(() => resolve());
+            }));
+            for (const tab of tabs)
+                tab.terminate();
+            for (const socket of connections)
+                socket.destroy();
+            tabs.clear();
+            responses.clear();
+            clearInterval(pendingResponseReaper);
+            if (authReaper)
+                clearInterval(authReaper);
+            // A failed cleanup must not leave the remaining services or worker alive.
+            const errors = [];
+            const clean = async (action) => {
+                try {
+                    await action();
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+            };
+            await clean(() => panelAutomations?.close());
+            await clean(() => {
+                hostRuntime.stop();
+            });
+            await clean(() => uploads?.close());
+            await clean(() => skills?.close());
+            await clean(() => mcp?.close());
+            await clean(() => configuration?.close());
+            await clean(() => links?.close());
+            await clean(() => panels?.close());
+            await clean(() => files?.close());
+            await clean(() => bridge.stopAndWait());
+            await Promise.all([httpClosed, webSocketsClosed]);
+            if (errors.length)
+                throw new AggregateError(errors, "Headless server shutdown failed");
+        });
+        return closePromise;
+    };
     try {
         if (hubAuth) {
             automationWorker = createHubAutomationWorker({
@@ -1187,23 +1258,18 @@ export async function startHeadlessServer(opts) {
         });
     }
     catch (error) {
-        closing = true;
-        responses.clear();
-        await panelAutomations?.close();
-        clearInterval(pendingResponseReaper);
-        hostRuntime.stop();
-        if (authReaper)
-            clearInterval(authReaper);
-        await uploads?.close();
-        await skills?.close();
-        await mcp?.close();
-        configuration?.close();
-        links?.close();
-        await panels?.close();
-        files?.close();
-        await bridge.stopAndWait();
-        wss.close();
-        server.close();
+        const failures = [error];
+        try {
+            await close();
+        }
+        catch (cleanupError) {
+            failures.push(cleanupError);
+        }
+        if (failures.length > 1) {
+            throw new AggregateError(failures, "Headless server startup and shutdown failed", {
+                cause: error,
+            });
+        }
         throw error;
     }
     const address = server.address();
@@ -1220,39 +1286,7 @@ export async function startHeadlessServer(opts) {
         bridge,
         tabCount: () => tabs.size,
         pendingResponseCount: () => pendingWorkerResponses.size,
-        close: async () => {
-            closing = true;
-            responses.clear();
-            await panelAutomations?.close();
-            clearInterval(pendingResponseReaper);
-            if (authReaper)
-                clearInterval(authReaper);
-            await uploads?.close();
-            await skills?.close();
-            await mcp?.close();
-            configuration?.close();
-            links?.close();
-            await panels?.close();
-            files?.close();
-            for (const tab of tabs) {
-                try {
-                    tab.terminate();
-                }
-                catch {
-                    /* ignore */
-                }
-            }
-            tabs.clear();
-            await bridge.stopAndWait();
-            await new Promise((resolve) => {
-                wss.close(() => {
-                    server.close(() => resolve());
-                });
-                // server.close() alone waits out keep-alive HTTP sockets forever;
-                // drop them so shutdown is prompt.
-                server.closeAllConnections?.();
-            });
-        },
+        close,
     };
 }
 function webSocketPayloadBytes(data) {

package/dist/sessions-service.d.ts

@@ -38,6 +38,8 @@ export interface DiskSessionMeta {
     engineSessionId: string;
     cwd: string;
     title: string;
+    model?: string;
+    provider?: string;
     updatedAt: number;
     /** Durable creation time, when supplied by the engine's state schema. */
     createdAt?: number;
@@ -69,6 +71,8 @@ export interface ListDiskSessionsResult {
 export declare function listDiskSessions(opts: {
     limit: number;
     cursor?: string;
+    /** Display-only project roots filter, applied before pagination. */
+    cwds?: readonly string[];
     includeArchived?: boolean;
     /** Host read models may include children; ordinary sidebar queries stay top-level. */
     includeSubagents?: boolean;

package/dist/sessions-service.js

@@ -217,6 +217,13 @@ export async function listDiskSessions(opts, baseDir = sessionsRoot()) {
     // Preserve the public adapter's explicit relative-root form. Host receives
     // one absolute root; it never guesses a workspace for the caller.
     baseDir = path.resolve(baseDir);
+    const pathKey = (cwd) => {
+        const normalized = path.resolve(cwd);
+        return process.platform === "darwin" || process.platform === "win32"
+            ? normalized.toLocaleLowerCase("en-US")
+            : normalized;
+    };
+    const cwdRoots = opts.cwds?.map(pathKey);
     const dirs = (await scanSessionDirectories(baseDir)).filter(({ id }) => !isInternalEphemeralSessionId(id));
     dirs.sort(compareDiskSessionPosition);
     const decodedCursor = decodeDiskSessionCursor(opts.cursor);
@@ -288,6 +295,14 @@ export async function listDiskSessions(opts, baseDir = sessionsRoot()) {
         // is intentionally NOT filtered here — the renderer handles that via
         // isNoRepoCwd. (deleted-project resurrection)
         const cwdStr = typeof state.cwd === "string" ? state.cwd : "";
+        if (cwdRoots &&
+            (!cwdStr ||
+                !cwdRoots.some((root) => {
+                    const candidate = pathKey(cwdStr);
+                    return (candidate === root ||
+                        candidate.startsWith(root.endsWith(path.sep) ? root : root + path.sep));
+                })))
+            continue;
         // A child transcript remains useful after its temporary worktree is gone;
         // targeted reads do not rebuild projects in the sidebar.
         const childParentId = typeof state.parentSessionId === "string" && state.parentSessionId
@@ -325,6 +340,8 @@ export async function listDiskSessions(opts, baseDir = sessionsRoot()) {
                 ? { clientMessageId: state.clientMessageId }
                 : {}),
             engineSessionId: id,
+            ...(typeof state.model === "string" ? { model: state.model } : {}),
+            ...(typeof state.provider === "string" ? { provider: state.provider } : {}),
             cwd: typeof state.cwd === "string" ? state.cwd : "",
             // Prefer the LLM-generated title (now persisted to state); fall back to
             // the raw first-message summary, then the id. This lets the disk rebuild

package/dist/static-files.d.ts

@@ -1 +1,8 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
 export declare function contentTypeFor(extname: string): string;
+/** Stream a pinned regular file, bounded by its opened size and the response lifetime. */
+export declare function streamStaticFile(req: IncomingMessage, res: ServerResponse, options: {
+    rootDir: string;
+    filePath: string;
+    cacheControl: string;
+}): Promise<void>;

package/dist/static-files.js

@@ -3,6 +3,11 @@
 // Shared static-file primitives for the two HTTP hosts (pairing host's
 // /mobile static root and the headless serve SPA root). Keep this file free
 // of host wiring — MIME map + helpers only.
+import { constants } from "node:fs";
+import { createHash } from "node:crypto";
+import { open, realpath, stat } from "node:fs/promises";
+import { extname, isAbsolute, relative, sep } from "node:path";
+import { pipeline } from "node:stream/promises";
 const CONTENT_TYPES = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
@@ -24,3 +29,112 @@ const CONTENT_TYPES = {
 export function contentTypeFor(extname) {
     return CONTENT_TYPES[extname.toLowerCase()] ?? "application/octet-stream";
 }
+/** RFC 9110 entity-tag lists allow commas inside opaque tags and empty list items. */
+function matchesIfNoneMatch(value, etag) {
+    if (typeof value !== "string")
+        return false;
+    const header = value.replace(/^[ \t]+|[ \t]+$/g, "");
+    if (header === "*")
+        return true;
+    const tag = /(?:W\/)?("[\x21\x23-\x7e\x80-\xff]*")/y;
+    const opaque = etag.slice(2);
+    let position = 0;
+    let matches = false;
+    while (position < header.length) {
+        while (/[ \t,]/.test(header[position] ?? "") && position < header.length)
+            position++;
+        if (position === header.length)
+            break;
+        tag.lastIndex = position;
+        const item = tag.exec(header);
+        if (!item)
+            return false;
+        matches ||= item[1] === opaque;
+        position = tag.lastIndex;
+        while (/[ \t]/.test(header[position] ?? "") && position < header.length)
+            position++;
+        if (position < header.length && header[position++] !== ",")
+            return false;
+    }
+    // Validate the entire field before accepting a match, including later items.
+    return matches;
+}
+/** Stream a pinned regular file, bounded by its opened size and the response lifetime. */
+export async function streamStaticFile(req, res, options) {
+    let handle;
+    try {
+        if (res.destroyed || res.writableEnded)
+            return;
+        const root = await realpath(options.rootDir);
+        const path = await realpath(options.filePath);
+        const contained = (target) => {
+            const rel = relative(root, target);
+            return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+        };
+        if (!contained(path))
+            throw new Error("Static asset is outside its root");
+        // Resolve aliases before opening so valid in-root symlinks remain supported.
+        // O_NONBLOCK avoids hanging on a regular file replaced by a FIFO.
+        handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+        const info = await handle.stat({ bigint: true });
+        if (!info.isFile())
+            throw new Error("Static asset is not a regular file");
+        if (info.size > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new Error("Static asset is too large");
+        const currentPath = await realpath(options.filePath);
+        const current = await stat(currentPath, { bigint: true });
+        if (!contained(currentPath) ||
+            (await realpath(options.rootDir)) !== root ||
+            current.dev !== info.dev ||
+            current.ino !== info.ino ||
+            current.size !== info.size ||
+            current.mtimeNs !== info.mtimeNs ||
+            current.ctimeNs !== info.ctimeNs)
+            throw new Error("Static asset changed while opening");
+        if (res.destroyed || res.writableEnded)
+            return;
+        // A weak validator describes the opened file's metadata, not a byte hash.
+        // Include identity and change time so replacement or an equal-size rewrite
+        // with a restored mtime does not reuse the previous representation's tag.
+        const fingerprint = createHash("sha256")
+            .update(`${info.dev}:${info.ino}:${info.size}:${info.mtimeNs}:${info.ctimeNs}`)
+            .digest("base64url");
+        const etag = `W/"${fingerprint}"`;
+        const headers = {
+            "content-type": contentTypeFor(extname(options.filePath)),
+            "cache-control": options.cacheControl,
+            "x-content-type-options": "nosniff",
+            etag,
+        };
+        if ((req.method === "GET" || req.method === "HEAD") &&
+            matchesIfNoneMatch(req.headers["if-none-match"], etag)) {
+            res.writeHead(304, headers);
+            res.end();
+            return;
+        }
+        res.writeHead(200, { ...headers, "content-length": info.size.toString() });
+        if (req.method === "HEAD" || info.size === 0n) {
+            res.end();
+            return;
+        }
+        // pipeline propagates backpressure and destroys the source on disconnect.
+        // The explicit end prevents a growing file from extending this response.
+        await pipeline(handle.createReadStream({ autoClose: false, start: 0, end: Number(info.size - 1n) }), res);
+    }
+    catch {
+        if (res.destroyed || res.writableEnded)
+            return;
+        if (res.headersSent)
+            res.destroy();
+        else {
+            res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+            res.end("not found");
+        }
+    }
+    finally {
+        await handle?.close().catch(() => {
+            if (!res.destroyed)
+                res.destroy();
+        });
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.47",
+  "version": "0.9.49",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,14 +62,14 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.47",
-    "@cjhyy/code-shell-core": "0.9.47",
-    "@cjhyy/code-shell-web": "0.9.47",
+    "@cjhyy/code-shell-capability-coding": "0.9.49",
+    "@cjhyy/code-shell-core": "0.9.49",
+    "@cjhyy/code-shell-web": "0.9.49",
     "@modelcontextprotocol/sdk": "^1.31.0",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0",
-    "@cjhyy/code-shell-link": "0.9.47",
-    "@cjhyy/code-shell-host": "0.9.47"
+    "@cjhyy/code-shell-link": "0.9.49",
+    "@cjhyy/code-shell-host": "0.9.49"
   },
   "engines": {
     "node": ">=20.10"