@cjhyy/code-shell-server 0.9.8 → 0.9.10

package/dist/hub/uploads.js

@@ -0,0 +1,241 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, readdir, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { markAttachmentsSent, stageFileBytes, stageImageBytes, } from "../attachment-service.js";
+const MAX_BYTES = 20 * 1024 * 1024;
+const TTL_MS = 15 * 60 * 1000;
+const SAFE_ID = /^[a-zA-Z0-9_-]{8,80}$/;
+const emptyUploads = () => ({
+    attachments: [],
+    commit: async () => { },
+    release: () => { },
+});
+export function hubJson(res, status, body) {
+    if (res.writableEnded || res.destroyed)
+        return;
+    res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+    });
+    res.end(JSON.stringify(body));
+}
+/** Temporary, device-owned spools. Only the host can turn IDs into staged attachment paths. */
+export class HubUploads {
+    root;
+    cwd;
+    uploads = new Map();
+    active = new Set();
+    closed = false;
+    constructor(root, cwd) {
+        this.root = root;
+        this.cwd = cwd;
+    }
+    async ready() {
+        await mkdir(this.root, { recursive: true, mode: 0o700 });
+        const info = await lstat(this.root);
+        if (!info.isDirectory() || info.isSymbolicLink())
+            throw new Error("unsafe upload directory");
+        await chmod(this.root, 0o700);
+        // A pending draft cannot survive a restart; staged attachments live in the workspace.
+        for (const name of await readdir(this.root)) {
+            if (/^[a-f0-9-]{36}\.upload$/.test(name))
+                await rm(join(this.root, name), { force: true });
+        }
+    }
+    async accept(id, owner, req, res, stillAuthorized) {
+        const reject = (status, error) => {
+            hubJson(res, status, { error });
+            req.resume();
+        };
+        if (!SAFE_ID.test(id))
+            return reject(400, "invalid upload id");
+        if (this.closed)
+            return reject(503, "server is shutting down");
+        await this.sweep();
+        if (this.uploads.has(id))
+            return reject(409, "upload id already exists");
+        if (this.active.size >= 4 ||
+            this.uploads.size >= 32 ||
+            [...this.uploads.values()].filter((entry) => entry.owner === owner).length >= 16) {
+            return reject(429, "too many uploads; send the current attachments first");
+        }
+        const size = Number(req.headers["content-length"]);
+        if (!req.headers["content-length"])
+            return reject(411, "content length required");
+        if (!Number.isSafeInteger(size) || size <= 0)
+            return reject(400, "empty or invalid upload");
+        if (size > MAX_BYTES)
+            return reject(413, "attachment exceeds 20 MiB");
+        if ([...this.uploads.values()].reduce((sum, entry) => sum + entry.size, size) >
+            128 * 1024 * 1024) {
+            return reject(429, "upload storage quota exceeded");
+        }
+        let name;
+        try {
+            name = decodeURIComponent(String(req.headers["x-file-name"] ?? "attachment"));
+        }
+        catch {
+            return reject(400, "invalid file name");
+        }
+        if (!name.trim() || name.length > 255 || /[\x00-\x1f/\\]/.test(name)) {
+            return reject(400, "invalid file name");
+        }
+        const mimeType = String(req.headers["content-type"] ?? "application/octet-stream")
+            .split(";", 1)[0]
+            .trim()
+            .toLowerCase();
+        if (mimeType.length > 128 || !/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/.test(mimeType)) {
+            return reject(400, "invalid content type");
+        }
+        const upload = {
+            id,
+            owner,
+            name,
+            mimeType,
+            size,
+            path: join(this.root, `${randomUUID()}.upload`),
+            createdAt: Date.now(),
+            status: "receiving",
+        };
+        this.uploads.set(id, upload);
+        this.active.add(req);
+        let handle;
+        const deadline = setTimeout(() => req.destroy(new Error("upload timed out")), 30_000);
+        deadline.unref?.();
+        try {
+            // Recheck the managed root: a workspace tool must not redirect the upload writer via symlink.
+            if (!(await lstat(this.root)).isDirectory() || (await lstat(this.root)).isSymbolicLink()) {
+                throw new Error("unsafe upload directory");
+            }
+            handle = await open(upload.path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            let received = 0;
+            for await (const chunk of req) {
+                received += chunk.length;
+                if (received > size || received > MAX_BYTES)
+                    throw new Error("upload exceeds declared length");
+                await handle.writeFile(chunk);
+            }
+            if (received !== size)
+                throw new Error("incomplete upload");
+            if (this.closed || !(await stillAuthorized())) {
+                hubJson(res, 401, { error: "session expired" });
+                throw new Error("session expired");
+            }
+            await handle.close();
+            handle = undefined;
+            upload.status = "ready";
+            hubJson(res, 201, { id, name, mimeType, size, path: id });
+        }
+        catch (error) {
+            this.uploads.delete(id);
+            await handle?.close().catch(() => { });
+            await rm(upload.path, { force: true });
+            hubJson(res, 400, { error: error instanceof Error ? error.message : "upload failed" });
+        }
+        finally {
+            clearTimeout(deadline);
+            this.active.delete(req);
+        }
+    }
+    async prepare(ids, owner, sessionId) {
+        if (ids === undefined)
+            return emptyUploads();
+        if (!Array.isArray(ids) ||
+            ids.length > 16 ||
+            new Set(ids).size !== ids.length ||
+            ids.some((id) => typeof id !== "string" || !SAFE_ID.test(id))) {
+            throw new Error("invalid upload ids");
+        }
+        if (!ids.length)
+            return emptyUploads();
+        if (typeof sessionId !== "string" || !/^[a-zA-Z0-9_-]{1,128}$/.test(sessionId)) {
+            throw new Error("valid sessionId required for attachments");
+        }
+        const records = ids.map((id) => {
+            const record = this.uploads.get(id);
+            if (!record ||
+                record.owner !== owner ||
+                record.status !== "ready" ||
+                Date.now() - record.createdAt >= TTL_MS)
+                throw new Error("upload not found or expired");
+            return record;
+        });
+        for (const record of records)
+            record.status = "claiming";
+        try {
+            const result = [];
+            for (const record of records) {
+                const handle = await open(record.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+                let bytes;
+                try {
+                    const info = await handle.stat();
+                    if (!info.isFile() || info.size !== record.size || info.size > MAX_BYTES)
+                        throw new Error("upload changed");
+                    bytes = await handle.readFile();
+                }
+                finally {
+                    await handle.close();
+                }
+                const input = {
+                    cwd: this.cwd,
+                    sessionId,
+                    name: record.name,
+                    mime: record.mimeType,
+                    bytes,
+                    origin: "mobile",
+                };
+                result.push(record.mimeType.startsWith("image/") && record.mimeType !== "image/svg+xml"
+                    ? await stageImageBytes(input)
+                    : await stageFileBytes(input));
+            }
+            let settled = false;
+            return {
+                attachments: result,
+                commit: async () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    for (const record of records)
+                        this.uploads.delete(record.id);
+                    try {
+                        await markAttachmentsSent(this.cwd, sessionId, result);
+                    }
+                    finally {
+                        for (const record of records)
+                            await rm(record.path, { force: true });
+                    }
+                },
+                release: () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    for (const record of records)
+                        record.status = "ready";
+                },
+            };
+        }
+        catch (error) {
+            for (const record of records)
+                record.status = "ready";
+            throw error;
+        }
+    }
+    async sweep() {
+        for (const [id, record] of this.uploads) {
+            if (record.status === "ready" && Date.now() - record.createdAt >= TTL_MS) {
+                this.uploads.delete(id);
+                await rm(record.path, { force: true });
+            }
+        }
+    }
+    async close() {
+        this.closed = true;
+        for (const req of this.active)
+            req.destroy();
+        for (const record of this.uploads.values())
+            await rm(record.path, { force: true });
+        this.uploads.clear();
+    }
+}

package/dist/index.d.ts

@@ -8,3 +8,6 @@ export * from "./index.storage.js";
 export * from "./index.worker.js";
 export * from "./index.mobile-remote.js";
 export * from "./index.serve.js";
+export * from "./index.desktop-web.js";
+export * from "./index.links.js";
+export * from "./index.panels.js";

package/dist/index.desktop-web.d.ts

@@ -0,0 +1,2 @@
+/** Shared Web business HTTP API hosted by Desktop's existing remote listener. */
+export * from "./desktop-web/http-api.js";

package/dist/index.desktop-web.js

@@ -0,0 +1,2 @@
+/** Shared Web business HTTP API hosted by Desktop's existing remote listener. */
+export * from "./desktop-web/http-api.js";

package/dist/index.js

@@ -8,3 +8,6 @@ export * from "./index.storage.js";
 export * from "./index.worker.js";
 export * from "./index.mobile-remote.js";
 export * from "./index.serve.js";
+export * from "./index.desktop-web.js";
+export * from "./index.links.js";
+export * from "./index.panels.js";

package/dist/index.links.d.ts

@@ -0,0 +1,6 @@
+/** Pure Node Link management shared by Desktop and standalone hosts. */
+export * from "./links/catalog.js";
+export * from "./links/device-oauth.js";
+export * from "./links/service.js";
+export * from "./links/types.js";
+export * from "./links/http.js";

package/dist/index.links.js

@@ -0,0 +1,6 @@
+/** Pure Node Link management shared by Desktop and standalone hosts. */
+export * from "./links/catalog.js";
+export * from "./links/device-oauth.js";
+export * from "./links/service.js";
+export * from "./links/types.js";
+export * from "./links/http.js";

package/dist/index.panels.d.ts

@@ -0,0 +1,9 @@
+export { createPanelHttp } from "./panels/http.js";
+export { createPanelManagement, PanelManagementError } from "./panels/management.js";
+export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
+export { PanelRuntimeServices } from "./panels/runtime-services.js";
+export * from "./panels/process-service.js";
+export * from "./panels/agent-task-service.js";
+export * from "./panels/agent-task-models.js";
+export * from "./panels/agent-task-host.js";
+export type * from "./panels/types.js";

package/dist/index.panels.js

@@ -0,0 +1,8 @@
+export { createPanelHttp } from "./panels/http.js";
+export { createPanelManagement, PanelManagementError } from "./panels/management.js";
+export { createPanelRuntime, panelWebCompatibility } from "./panels/runtime.js";
+export { PanelRuntimeServices } from "./panels/runtime-services.js";
+export * from "./panels/process-service.js";
+export * from "./panels/agent-task-service.js";
+export * from "./panels/agent-task-models.js";
+export * from "./panels/agent-task-host.js";

package/dist/index.serve.d.ts

@@ -1,3 +1,4 @@
 /** Ready-made headless HTTP/WebSocket host and CLI composition helpers. */
 export * from "./serve/headless-server.js";
+export { startProjectControlServer, type ProjectControlServerOptions, } from "./project-runtime/control-server.js";
 export { parseServeArgs, resolveWebAppRoot, resolveWorkerCapabilityModules, resolveWorkerEntry, runServeCli, } from "./serve/cli.js";

package/dist/index.serve.js

@@ -1,3 +1,4 @@
 /** Ready-made headless HTTP/WebSocket host and CLI composition helpers. */
 export * from "./serve/headless-server.js";
+export { startProjectControlServer, } from "./project-runtime/control-server.js";
 export { parseServeArgs, resolveWebAppRoot, resolveWorkerCapabilityModules, resolveWorkerEntry, runServeCli, } from "./serve/cli.js";

package/dist/index.storage.d.ts

@@ -8,3 +8,5 @@ export * from "./attachment-service.js";
 export * from "./client-message-id.js";
 export * from "./image-byte-probe.js";
 export * from "./sessions-service.js";
+export * from "./session-titles-store.js";
+export * from "./panels/storage-store.js";

package/dist/index.storage.js

@@ -8,3 +8,5 @@ export * from "./attachment-service.js";
 export * from "./client-message-id.js";
 export * from "./image-byte-probe.js";
 export * from "./sessions-service.js";
+export * from "./session-titles-store.js";
+export * from "./panels/storage-store.js";

package/dist/links/catalog.d.ts

@@ -0,0 +1,10 @@
+import { type LinkProviderManifest } from "@cjhyy/code-shell-link";
+import { type LocalLinkProviderSummary } from "@cjhyy/code-shell-core";
+export type DesktopLinkProviderView = LinkProviderManifest & Pick<LocalLinkProviderSummary, "tokenLabel" | "tokenPlaceholder" | "actions">;
+/**
+ * The independent Link package owns portable provider/auth metadata; Core owns
+ * trusted executors. Desktop is the host boundary that validates and combines
+ * them before any manifest reaches the renderer.
+ */
+export declare function composeLinkProviderCatalog(manifests: readonly LinkProviderManifest[], executors: readonly LocalLinkProviderSummary[]): DesktopLinkProviderView[];
+export declare function listDesktopLinkProviders(): DesktopLinkProviderView[];

package/dist/links/catalog.js

@@ -0,0 +1,41 @@
+import { LINK_PROVIDER_MANIFESTS } from "@cjhyy/code-shell-link";
+import { listLocalLinkProviders } from "@cjhyy/code-shell-core";
+function unique(values) {
+    return new Set(values).size === values.length;
+}
+/**
+ * The independent Link package owns portable provider/auth metadata; Core owns
+ * trusted executors. Desktop is the host boundary that validates and combines
+ * them before any manifest reaches the renderer.
+ */
+export function composeLinkProviderCatalog(manifests, executors) {
+    const manifestIds = manifests.map((provider) => provider.id);
+    const executorIds = executors.map((provider) => provider.id);
+    if (!unique(manifestIds) || !unique(executorIds)) {
+        throw new Error("Link provider ids must be unique");
+    }
+    if (manifestIds.length !== executorIds.length ||
+        manifestIds.some((providerId) => !executorIds.includes(providerId))) {
+        throw new Error("Link provider manifests and local executors are out of sync");
+    }
+    return manifests.map((manifest) => {
+        const executor = executors.find((candidate) => candidate.id === manifest.id);
+        const declared = manifest.actionIds;
+        const implemented = executor.actions.map((action) => action.id);
+        if (!unique(declared) ||
+            !unique(implemented) ||
+            declared.length !== implemented.length ||
+            declared.some((actionId) => !implemented.includes(actionId))) {
+            throw new Error(`Link provider manifest Actions are out of sync: ${manifest.id}`);
+        }
+        return {
+            ...manifest,
+            tokenLabel: executor.tokenLabel,
+            tokenPlaceholder: executor.tokenPlaceholder,
+            actions: executor.actions,
+        };
+    });
+}
+export function listDesktopLinkProviders() {
+    return composeLinkProviderCatalog(LINK_PROVIDER_MANIFESTS, listLocalLinkProviders());
+}

package/dist/links/device-oauth.d.ts

@@ -0,0 +1,52 @@
+export type LocalBrowserLinkProviderId = "github" | "gitlab";
+export interface LocalBrowserAuthStatus {
+    providerId: LocalBrowserLinkProviderId;
+    configured: boolean;
+    flow: "device-code";
+    configurationCode?: "client_id_missing";
+}
+export interface LocalBrowserAuthPrompt {
+    attemptId: string;
+    providerId: LocalBrowserLinkProviderId;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    expiresAt: string;
+}
+export interface LocalBrowserAuthToken {
+    providerId: LocalBrowserLinkProviderId;
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    refreshTokenExpiresIn?: number;
+    clientId: string;
+    tokenEndpoint: string;
+    tokenType: "Bearer";
+    scope?: string;
+}
+interface LinkDeviceOAuthBrokerOptions {
+    fetch?: typeof fetch;
+    now?: () => number;
+    sleep?: (milliseconds: number, signal: AbortSignal) => Promise<void>;
+    createId?: () => string;
+    clientIds?: Partial<Record<LocalBrowserLinkProviderId, string>>;
+    environment?: Record<string, string | undefined>;
+}
+export declare function isLocalBrowserLinkProvider(value: string): value is LocalBrowserLinkProviderId;
+/** Main-process-only broker. Provider tokens never cross the renderer IPC. */
+export declare class LinkDeviceOAuthBroker {
+    private readonly fetchFn;
+    private readonly now;
+    private readonly sleep;
+    private readonly createId;
+    private readonly clientIds;
+    private readonly environment;
+    private readonly attempts;
+    constructor(options?: LinkDeviceOAuthBrokerOptions);
+    status(providerId: LocalBrowserLinkProviderId): LocalBrowserAuthStatus;
+    start(providerId: LocalBrowserLinkProviderId, signal?: AbortSignal): Promise<LocalBrowserAuthPrompt>;
+    complete(attemptId: string): Promise<LocalBrowserAuthToken>;
+    cancel(attemptId: string): boolean;
+    private clientId;
+}
+export {};