@code-yeongyu/senpi 2026.7.5-2 → 2026.7.9

package/dist/modes/app-server/transports/unix-socket.js

@@ -0,0 +1,119 @@
+import { access, chmod, mkdir, unlink } from "node:fs/promises";
+import { createServer } from "node:http";
+import { createConnection } from "node:net";
+import { dirname, join } from "node:path";
+import { getAgentDir } from "../../../config.js";
+import { ServerCore } from "../server/server-core.js";
+import { resolveWebSocketListenerAuth } from "./websocket-auth.js";
+import { closeServer, createAppServerWebSocketConnectionHandler } from "./websocket-connection-handler.js";
+const SOCKET_PATH_BYTE_LIMIT = 100;
+export class AppServerUnixSocketListenError extends Error {
+    constructor(message) {
+        super(message);
+        this.exitCode = 2;
+        this.name = "AppServerUnixSocketListenError";
+    }
+}
+export async function startAppServerUnixSocketListener(options = {}) {
+    const defaultSocketPath = join(getAgentDir(), "app-server", "app-server.sock");
+    const socketPath = options.socketPath ?? defaultSocketPath;
+    validateSocketPath(socketPath);
+    await prepareSocketPath(socketPath, socketPath === defaultSocketPath && (options.auth === undefined || options.auth.kind === "off"));
+    const auth = await resolveWebSocketListenerAuth({
+        auth: options.auth,
+        stderr: options.stderr ?? process.stderr,
+        tokenLogLabel: "app-server unix socket websocket token",
+    });
+    const core = options.core ?? new ServerCore();
+    const handler = createAppServerWebSocketConnectionHandler({
+        core,
+        auth,
+        transportKind: "unix",
+        connectionIdPrefix: "unix",
+        outboundQueueBytes: options.outboundQueueBytes,
+    });
+    const server = createServer();
+    server.on("upgrade", handler.handleUpgrade);
+    await listen(server, socketPath);
+    return {
+        socketPath,
+        core,
+        tokenFile: auth.kind === "bearer" ? auth.path : undefined,
+        get connectionCount() {
+            return handler.connectionCount;
+        },
+        async close() {
+            handler.terminateConnections();
+            await closeServer(server);
+            await handler.close();
+            await removeSocketPath(socketPath);
+        },
+    };
+}
+function validateSocketPath(socketPath) {
+    if (Buffer.byteLength(socketPath) <= SOCKET_PATH_BYTE_LIMIT) {
+        return;
+    }
+    throw new AppServerUnixSocketListenError(`Unix socket path is too long for portable app-server startup: ${socketPath}. pass a shorter unix:///path.`);
+}
+async function prepareSocketPath(socketPath, enforceOwnerOnlyDirectory) {
+    const socketDirectory = dirname(socketPath);
+    await mkdir(socketDirectory, { recursive: true, mode: 0o700 });
+    if (enforceOwnerOnlyDirectory) {
+        await chmod(socketDirectory, 0o700);
+    }
+    try {
+        await access(socketPath);
+    }
+    catch (error) {
+        if (isNodeErrorCode(error, "ENOENT")) {
+            return;
+        }
+        throw error;
+    }
+    if (await probeLiveSocket(socketPath)) {
+        throw new AppServerUnixSocketListenError(`${socketPath}: address already in use by a live server.`);
+    }
+    await unlink(socketPath);
+}
+function probeLiveSocket(socketPath) {
+    return new Promise((resolve) => {
+        const socket = createConnection(socketPath);
+        let settled = false;
+        const settle = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            socket.destroy();
+            resolve(result);
+        };
+        socket.once("connect", () => settle(true));
+        socket.once("error", () => settle(false));
+        socket.setTimeout(1_000, () => settle(false));
+    });
+}
+function listen(server, socketPath) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(socketPath, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+}
+async function removeSocketPath(socketPath) {
+    try {
+        await unlink(socketPath);
+    }
+    catch (error) {
+        if (isNodeErrorCode(error, "ENOENT")) {
+            return;
+        }
+        throw error;
+    }
+}
+function isNodeErrorCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+//# sourceMappingURL=unix-socket.js.map

package/dist/modes/app-server/transports/unix-socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unix-socket.js","sourceRoot":"","sources":["../../../../src/modes/app-server/transports/unix-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAA8B,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,MAAM,mCAAmC,CAAC;AAkB3G,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAGxD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHP,aAAQ,GAAG,CAAC,CAAC;QAIrB,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC9C,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACrD,OAAO,GAA8B,EAAE;IAEvC,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAC3D,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,iBAAiB,CACtB,UAAU,EACV,UAAU,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAC/F,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC;QAC/C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;QACxC,aAAa,EAAE,wCAAwC;KACvD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,yCAAyC,CAAC;QACzD,IAAI;QACJ,IAAI;QACJ,aAAa,EAAE,MAAM;QACrB,kBAAkB,EAAE,MAAM;QAC1B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC9C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAE9B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAE5C,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEjC,OAAO;QACN,UAAU;QACV,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzD,IAAI,eAAe;YAClB,OAAO,OAAO,CAAC,eAAe,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,KAAK;YACV,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAC7D,OAAO;IACR,CAAC;IACD,MAAM,IAAI,8BAA8B,CACvC,iEAAiE,UAAU,gCAAgC,CAC3G,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,yBAAkC;IACtF,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,IAAI,yBAAyB,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO;QACR,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,IAAI,MAAM,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,8BAA8B,CAAC,GAAG,UAAU,4CAA4C,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAe,EAAQ,EAAE;YACxC,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,UAAkB;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO;QACR,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACpD,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzE,CAAC","sourcesContent":["import { access, chmod, mkdir, unlink } from \"node:fs/promises\";\nimport { createServer, type Server } from \"node:http\";\nimport { createConnection } from \"node:net\";\nimport { dirname, join } from \"node:path\";\nimport { getAgentDir } from \"../../../config.ts\";\nimport { ServerCore } from \"../server/server-core.ts\";\nimport { resolveWebSocketListenerAuth, type WebSocketListenerAuth } from \"./websocket-auth.ts\";\nimport { closeServer, createAppServerWebSocketConnectionHandler } from \"./websocket-connection-handler.ts\";\n\nexport interface UnixSocketListenerOptions {\n\treadonly socketPath?: string;\n\treadonly auth?: WebSocketListenerAuth;\n\treadonly core?: ServerCore;\n\treadonly stderr?: Pick<NodeJS.WriteStream, \"write\">;\n\treadonly outboundQueueBytes?: number;\n}\n\nexport interface UnixSocketListenerHandle {\n\treadonly socketPath: string;\n\treadonly core: ServerCore;\n\treadonly tokenFile: string | undefined;\n\treadonly connectionCount: number;\n\tclose(): Promise<void>;\n}\n\nconst SOCKET_PATH_BYTE_LIMIT = 100;\n\nexport class AppServerUnixSocketListenError extends Error {\n\treadonly exitCode = 2;\n\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"AppServerUnixSocketListenError\";\n\t}\n}\n\nexport async function startAppServerUnixSocketListener(\n\toptions: UnixSocketListenerOptions = {},\n): Promise<UnixSocketListenerHandle> {\n\tconst defaultSocketPath = join(getAgentDir(), \"app-server\", \"app-server.sock\");\n\tconst socketPath = options.socketPath ?? defaultSocketPath;\n\tvalidateSocketPath(socketPath);\n\tawait prepareSocketPath(\n\t\tsocketPath,\n\t\tsocketPath === defaultSocketPath && (options.auth === undefined || options.auth.kind === \"off\"),\n\t);\n\n\tconst auth = await resolveWebSocketListenerAuth({\n\t\tauth: options.auth,\n\t\tstderr: options.stderr ?? process.stderr,\n\t\ttokenLogLabel: \"app-server unix socket websocket token\",\n\t});\n\tconst core = options.core ?? new ServerCore();\n\tconst handler = createAppServerWebSocketConnectionHandler({\n\t\tcore,\n\t\tauth,\n\t\ttransportKind: \"unix\",\n\t\tconnectionIdPrefix: \"unix\",\n\t\toutboundQueueBytes: options.outboundQueueBytes,\n\t});\n\tconst server = createServer();\n\n\tserver.on(\"upgrade\", handler.handleUpgrade);\n\n\tawait listen(server, socketPath);\n\n\treturn {\n\t\tsocketPath,\n\t\tcore,\n\t\ttokenFile: auth.kind === \"bearer\" ? auth.path : undefined,\n\t\tget connectionCount() {\n\t\t\treturn handler.connectionCount;\n\t\t},\n\t\tasync close() {\n\t\t\thandler.terminateConnections();\n\t\t\tawait closeServer(server);\n\t\t\tawait handler.close();\n\t\t\tawait removeSocketPath(socketPath);\n\t\t},\n\t};\n}\n\nfunction validateSocketPath(socketPath: string): void {\n\tif (Buffer.byteLength(socketPath) <= SOCKET_PATH_BYTE_LIMIT) {\n\t\treturn;\n\t}\n\tthrow new AppServerUnixSocketListenError(\n\t\t`Unix socket path is too long for portable app-server startup: ${socketPath}. pass a shorter unix:///path.`,\n\t);\n}\n\nasync function prepareSocketPath(socketPath: string, enforceOwnerOnlyDirectory: boolean): Promise<void> {\n\tconst socketDirectory = dirname(socketPath);\n\tawait mkdir(socketDirectory, { recursive: true, mode: 0o700 });\n\tif (enforceOwnerOnlyDirectory) {\n\t\tawait chmod(socketDirectory, 0o700);\n\t}\n\ttry {\n\t\tawait access(socketPath);\n\t} catch (error: unknown) {\n\t\tif (isNodeErrorCode(error, \"ENOENT\")) {\n\t\t\treturn;\n\t\t}\n\t\tthrow error;\n\t}\n\n\tif (await probeLiveSocket(socketPath)) {\n\t\tthrow new AppServerUnixSocketListenError(`${socketPath}: address already in use by a live server.`);\n\t}\n\tawait unlink(socketPath);\n}\n\nfunction probeLiveSocket(socketPath: string): Promise<boolean> {\n\treturn new Promise((resolve) => {\n\t\tconst socket = createConnection(socketPath);\n\t\tlet settled = false;\n\t\tconst settle = (result: boolean): void => {\n\t\t\tif (settled) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tsettled = true;\n\t\t\tsocket.destroy();\n\t\t\tresolve(result);\n\t\t};\n\t\tsocket.once(\"connect\", () => settle(true));\n\t\tsocket.once(\"error\", () => settle(false));\n\t\tsocket.setTimeout(1_000, () => settle(false));\n\t});\n}\n\nfunction listen(server: Server, socketPath: string): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tserver.once(\"error\", reject);\n\t\tserver.listen(socketPath, () => {\n\t\t\tserver.off(\"error\", reject);\n\t\t\tresolve();\n\t\t});\n\t});\n}\n\nasync function removeSocketPath(socketPath: string): Promise<void> {\n\ttry {\n\t\tawait unlink(socketPath);\n\t} catch (error: unknown) {\n\t\tif (isNodeErrorCode(error, \"ENOENT\")) {\n\t\t\treturn;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nfunction isNodeErrorCode(error: unknown, code: string): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === code;\n}\n"]}

package/dist/modes/app-server/transports/websocket-auth.d.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage } from "node:http";
+export type WebSocketListenerAuth = {
+    readonly kind: "off";
+} | {
+    readonly kind: "token-file";
+    readonly path: string;
+} | {
+    readonly kind: "token-value";
+    readonly token: string;
+};
+export type ResolvedWebSocketListenerAuth = {
+    readonly kind: "off";
+} | {
+    readonly kind: "bearer";
+    readonly token: string;
+    readonly path?: string;
+};
+export declare function resolveWebSocketListenerAuth(options: {
+    readonly auth?: WebSocketListenerAuth;
+    readonly stderr: Pick<NodeJS.WriteStream, "write">;
+    readonly defaultTokenPath?: string;
+    readonly tokenLogLabel: string;
+}): Promise<ResolvedWebSocketListenerAuth>;
+export declare function isWebSocketRequestAuthorized(request: IncomingMessage, auth: ResolvedWebSocketListenerAuth): boolean;
+//# sourceMappingURL=websocket-auth.d.ts.map

package/dist/modes/app-server/transports/websocket-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-auth.d.ts","sourceRoot":"","sources":["../../../../src/modes/app-server/transports/websocket-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD,MAAM,MAAM,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,6BAA6B,GACtC;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAC/B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAczC;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAQnH"}

package/dist/modes/app-server/transports/websocket-auth.js

@@ -0,0 +1,63 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+export async function resolveWebSocketListenerAuth(options) {
+    const { auth, defaultTokenPath, stderr, tokenLogLabel } = options;
+    if (auth?.kind === "off" || (auth === undefined && defaultTokenPath === undefined))
+        return { kind: "off" };
+    if (auth?.kind === "token-value")
+        return { kind: "bearer", token: auth.token };
+    const path = auth?.kind === "token-file" ? auth.path : defaultTokenPath;
+    if (path === undefined)
+        return { kind: "off" };
+    const token = auth?.kind === "token-file" ? await readTokenFile(path) : await ensureTokenFile(path);
+    // Fail closed: an empty token would authorize any `Authorization: Bearer `
+    // request. Never start a listener with a blank expected token.
+    if (token.length === 0) {
+        throw new Error(`app-server ws auth token file is empty: ${path}`);
+    }
+    stderr.write(`${tokenLogLabel}: ${path}\n`);
+    return { kind: "bearer", token, path };
+}
+export function isWebSocketRequestAuthorized(request, auth) {
+    if (auth.kind === "off")
+        return true;
+    // Defense in depth: an empty expected token must never authorize anything,
+    // regardless of how it was produced.
+    if (auth.token.length === 0)
+        return false;
+    const header = request.headers.authorization;
+    if (typeof header !== "string" || !header.startsWith("Bearer "))
+        return false;
+    return tokensEqual(header.slice("Bearer ".length), auth.token);
+}
+async function readTokenFile(path) {
+    return (await readFile(path, "utf8")).trim();
+}
+async function ensureTokenFile(path) {
+    try {
+        const existing = await readTokenFile(path);
+        // A truncated/empty auto-managed token file (e.g. a crashed prior write)
+        // self-heals by regenerating rather than failing the daemon startup.
+        if (existing.length > 0)
+            return existing;
+    }
+    catch (error) {
+        if (!isNodeErrorCode(error, "ENOENT"))
+            throw error;
+    }
+    const token = randomBytes(32).toString("hex");
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${token}\n`, { mode: 0o600 });
+    await chmod(path, 0o600);
+    return token;
+}
+function tokensEqual(actual, expected) {
+    const actualBuffer = Buffer.from(actual);
+    const expectedBuffer = Buffer.from(expected);
+    return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
+}
+function isNodeErrorCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+//# sourceMappingURL=websocket-auth.js.map

package/dist/modes/app-server/transports/websocket-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-auth.js","sourceRoot":"","sources":["../../../../src/modes/app-server/transports/websocket-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAErE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAKlD;IACA,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAClE,IAAI,IAAI,EAAE,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC3G,IAAI,IAAI,EAAE,IAAI,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACxE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IACpG,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAwB,EAAE,IAAmC;IACzG,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACrC,2EAA2E;IAC3E,qCAAqC;IACrC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAAgB;IACpD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,YAAY,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAY;IACpD,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACzE,CAAC","sourcesContent":["import { randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { chmod, mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport type { IncomingMessage } from \"node:http\";\nimport { dirname } from \"node:path\";\n\nexport type WebSocketListenerAuth =\n\t| { readonly kind: \"off\" }\n\t| { readonly kind: \"token-file\"; readonly path: string }\n\t| { readonly kind: \"token-value\"; readonly token: string };\n\nexport type ResolvedWebSocketListenerAuth =\n\t| { readonly kind: \"off\" }\n\t| { readonly kind: \"bearer\"; readonly token: string; readonly path?: string };\n\nexport async function resolveWebSocketListenerAuth(options: {\n\treadonly auth?: WebSocketListenerAuth;\n\treadonly stderr: Pick<NodeJS.WriteStream, \"write\">;\n\treadonly defaultTokenPath?: string;\n\treadonly tokenLogLabel: string;\n}): Promise<ResolvedWebSocketListenerAuth> {\n\tconst { auth, defaultTokenPath, stderr, tokenLogLabel } = options;\n\tif (auth?.kind === \"off\" || (auth === undefined && defaultTokenPath === undefined)) return { kind: \"off\" };\n\tif (auth?.kind === \"token-value\") return { kind: \"bearer\", token: auth.token };\n\tconst path = auth?.kind === \"token-file\" ? auth.path : defaultTokenPath;\n\tif (path === undefined) return { kind: \"off\" };\n\tconst token = auth?.kind === \"token-file\" ? await readTokenFile(path) : await ensureTokenFile(path);\n\t// Fail closed: an empty token would authorize any `Authorization: Bearer `\n\t// request. Never start a listener with a blank expected token.\n\tif (token.length === 0) {\n\t\tthrow new Error(`app-server ws auth token file is empty: ${path}`);\n\t}\n\tstderr.write(`${tokenLogLabel}: ${path}\\n`);\n\treturn { kind: \"bearer\", token, path };\n}\n\nexport function isWebSocketRequestAuthorized(request: IncomingMessage, auth: ResolvedWebSocketListenerAuth): boolean {\n\tif (auth.kind === \"off\") return true;\n\t// Defense in depth: an empty expected token must never authorize anything,\n\t// regardless of how it was produced.\n\tif (auth.token.length === 0) return false;\n\tconst header = request.headers.authorization;\n\tif (typeof header !== \"string\" || !header.startsWith(\"Bearer \")) return false;\n\treturn tokensEqual(header.slice(\"Bearer \".length), auth.token);\n}\n\nasync function readTokenFile(path: string): Promise<string> {\n\treturn (await readFile(path, \"utf8\")).trim();\n}\n\nasync function ensureTokenFile(path: string): Promise<string> {\n\ttry {\n\t\tconst existing = await readTokenFile(path);\n\t\t// A truncated/empty auto-managed token file (e.g. a crashed prior write)\n\t\t// self-heals by regenerating rather than failing the daemon startup.\n\t\tif (existing.length > 0) return existing;\n\t} catch (error: unknown) {\n\t\tif (!isNodeErrorCode(error, \"ENOENT\")) throw error;\n\t}\n\tconst token = randomBytes(32).toString(\"hex\");\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, `${token}\\n`, { mode: 0o600 });\n\tawait chmod(path, 0o600);\n\treturn token;\n}\n\nfunction tokensEqual(actual: string, expected: string): boolean {\n\tconst actualBuffer = Buffer.from(actual);\n\tconst expectedBuffer = Buffer.from(expected);\n\treturn actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);\n}\n\nfunction isNodeErrorCode(error: unknown, code: string): boolean {\n\treturn error instanceof Error && \"code\" in error && error.code === code;\n}\n"]}

package/dist/modes/app-server/transports/websocket-connection-handler.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage, Server } from "node:http";
+import type { Duplex } from "node:stream";
+import { WebSocketServer } from "ws";
+import type { TransportKind } from "../server/connection.ts";
+import type { ServerCore } from "../server/server-core.ts";
+import { type ResolvedWebSocketListenerAuth } from "./websocket-auth.ts";
+export type AppServerWebSocketConnectionHandler = {
+    readonly connectionCount: number;
+    handleUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer): void;
+    terminateConnections(): void;
+    close(): Promise<void>;
+};
+export declare function createAppServerWebSocketConnectionHandler(options: {
+    readonly core: ServerCore;
+    readonly auth: ResolvedWebSocketListenerAuth;
+    readonly transportKind: TransportKind;
+    readonly connectionIdPrefix: string;
+    readonly outboundQueueBytes?: number;
+}): AppServerWebSocketConnectionHandler;
+export declare function closeServer(server: Pick<Server | WebSocketServer, "close">): Promise<void>;
+//# sourceMappingURL=websocket-connection-handler.d.ts.map

package/dist/modes/app-server/transports/websocket-connection-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-connection-handler.d.ts","sourceRoot":"","sources":["../../../../src/modes/app-server/transports/websocket-connection-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAkB,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAGhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAgC,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAKvG,MAAM,MAAM,mCAAmC,GAAG;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E,oBAAoB,IAAI,IAAI,CAAC;IAC7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AAEF,wBAAgB,yCAAyC,CAAC,OAAO,EAAE;IAClE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC,GAAG,mCAAmC,CAmEtC;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1F"}

package/dist/modes/app-server/transports/websocket-connection-handler.js

@@ -0,0 +1,119 @@
+import WebSocket, { WebSocketServer } from "ws";
+import { parseNdjsonLine, serializeNdjsonMessage } from "../rpc/ndjson.js";
+import { isWebSocketRequestAuthorized } from "./websocket-auth.js";
+const DEFAULT_OUTBOUND_QUEUE_BYTES = 16 * 1024 * 1024;
+const WEBSOCKET_RETRY_LATER = 1013;
+export function createAppServerWebSocketConnectionHandler(options) {
+    const webSocketServer = new WebSocketServer({ noServer: true });
+    const connections = new Set();
+    let nextConnectionId = 1;
+    const handleUpgrade = (request, socket, head) => {
+        if (hasOrigin(request)) {
+            rejectUpgrade(socket, 403, "Forbidden");
+            return;
+        }
+        if (request.url !== "/") {
+            rejectUpgrade(socket, 400, "Bad Request");
+            return;
+        }
+        if (!isWebSocketRequestAuthorized(request, options.auth)) {
+            rejectUpgrade(socket, 401, "Unauthorized");
+            return;
+        }
+        webSocketServer.handleUpgrade(request, socket, head, (websocket) => {
+            const connectionId = `${options.connectionIdPrefix}-${nextConnectionId}`;
+            nextConnectionId += 1;
+            connections.add(websocket);
+            options.core.addConnection({
+                id: connectionId,
+                transportKind: options.transportKind,
+                send: (message) => sendWebSocketMessage(websocket, message, options.outboundQueueBytes),
+                close: () => websocket.close(WEBSOCKET_RETRY_LATER, "slow-client"),
+            });
+            websocket.on("message", (data, isBinary) => {
+                if (isBinary)
+                    return;
+                const parsed = parseNdjsonLine(data.toString("utf8"));
+                if (parsed.kind === "parse-error") {
+                    sendWebSocketMessage(websocket, parsed.message, options.outboundQueueBytes).catch((error) => {
+                        terminateOnTransportError(websocket, error);
+                    });
+                    return;
+                }
+                // A rejected dispatch (e.g. the response send failing on a dying socket)
+                // must not surface as an unhandled rejection that kills the server.
+                options.core.receive(connectionId, parsed).catch((error) => {
+                    terminateOnTransportError(websocket, error);
+                });
+            });
+            websocket.on("error", (error) => {
+                // A socket-level error with no listener throws and can crash the
+                // server; isolate the fault to this connection instead.
+                const message = error instanceof Error ? error.message : String(error);
+                process.stderr.write(`app-server websocket connection error: ${message}\n`);
+                websocket.terminate();
+            });
+            websocket.on("close", () => {
+                connections.delete(websocket);
+                options.core.removeConnection(connectionId);
+            });
+        });
+    };
+    return {
+        get connectionCount() {
+            return connections.size;
+        },
+        handleUpgrade,
+        terminateConnections() {
+            for (const websocket of connections)
+                websocket.terminate();
+        },
+        close() {
+            return closeServer(webSocketServer);
+        },
+    };
+}
+export function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error)
+                return reject(error);
+            resolve();
+        });
+    });
+}
+function sendWebSocketMessage(websocket, message, outboundQueueBytes = DEFAULT_OUTBOUND_QUEUE_BYTES) {
+    const payload = serializeNdjsonMessage(message).trimEnd();
+    if (websocket.bufferedAmount + Buffer.byteLength(payload) > outboundQueueBytes) {
+        const closed = waitForSocketClose(websocket);
+        websocket.close(WEBSOCKET_RETRY_LATER, "slow-client");
+        return closed;
+    }
+    return new Promise((resolve, reject) => {
+        websocket.send(payload, (error) => {
+            if (error)
+                return reject(error);
+            resolve();
+        });
+    });
+}
+function terminateOnTransportError(websocket, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`app-server websocket transport error: ${message}\n`);
+    websocket.terminate();
+}
+function waitForSocketClose(websocket) {
+    if (websocket.readyState === WebSocket.CLOSED)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        websocket.once("close", () => resolve());
+    });
+}
+function hasOrigin(request) {
+    return request.headers.origin !== undefined;
+}
+function rejectUpgrade(socket, statusCode, reason) {
+    socket.write(`HTTP/1.1 ${statusCode} ${reason}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    socket.destroy();
+}
+//# sourceMappingURL=websocket-connection-handler.js.map

package/dist/modes/app-server/transports/websocket-connection-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-connection-handler.js","sourceRoot":"","sources":["../../../../src/modes/app-server/transports/websocket-connection-handler.ts"],"names":[],"mappings":"AAEA,OAAO,SAAS,EAAE,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAAE,4BAA4B,EAAsC,MAAM,qBAAqB,CAAC;AAEvG,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,MAAM,qBAAqB,GAAG,IAAI,CAAC;AASnC,MAAM,UAAU,yCAAyC,CAAC,OAMzD;IACA,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAa,CAAC;IACzC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY,EAAQ,EAAE;QACtF,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YACxC,OAAO;QACR,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACzB,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QACD,eAAe,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;YAClE,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,kBAAkB,IAAI,gBAAgB,EAAE,CAAC;YACzE,gBAAgB,IAAI,CAAC,CAAC;YACtB,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC1B,EAAE,EAAE,YAAY;gBAChB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC;gBACvF,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,EAAE,aAAa,CAAC;aAClE,CAAC,CAAC;YACH,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAC1C,IAAI,QAAQ;oBAAE,OAAO;gBACrB,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACnC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;wBACpG,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;oBAC7C,CAAC,CAAC,CAAC;oBACH,OAAO;gBACR,CAAC;gBACD,yEAAyE;gBACzE,oEAAoE;gBACpE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACnE,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE;gBACxC,iEAAiE;gBACjE,wDAAwD;gBACxD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,OAAO,IAAI,CAAC,CAAC;gBAC5E,SAAS,CAAC,SAAS,EAAE,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC1B,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACN,IAAI,eAAe;YAClB,OAAO,WAAW,CAAC,IAAI,CAAC;QACzB,CAAC;QACD,aAAa;QACb,oBAAoB;YACnB,KAAK,MAAM,SAAS,IAAI,WAAW;gBAAE,SAAS,CAAC,SAAS,EAAE,CAAC;QAC5D,CAAC;QACD,KAAK;YACJ,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA+C;IAC1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtB,IAAI,KAAK;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC5B,SAAoB,EACpB,OAAoB,EACpB,kBAAkB,GAAG,4BAA4B;IAEjD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1D,IAAI,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC7C,SAAS,CAAC,KAAK,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,IAAI,KAAK;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAoB,EAAE,KAAc;IACtE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,OAAO,IAAI,CAAC,CAAC;IAC3E,SAAS,CAAC,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAoB;IAC/C,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACxE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAwB;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,UAA2B,EAAE,MAAc;IACjF,MAAM,CAAC,KAAK,CAAC,YAAY,UAAU,IAAI,MAAM,oDAAoD,CAAC,CAAC;IACnG,MAAM,CAAC,OAAO,EAAE,CAAC;AAClB,CAAC","sourcesContent":["import type { IncomingMessage, Server } from \"node:http\";\nimport type { Duplex } from \"node:stream\";\nimport WebSocket, { WebSocketServer } from \"ws\";\nimport type { RpcEnvelope } from \"../rpc/envelope.ts\";\nimport { parseNdjsonLine, serializeNdjsonMessage } from \"../rpc/ndjson.ts\";\nimport type { TransportKind } from \"../server/connection.ts\";\nimport type { ServerCore } from \"../server/server-core.ts\";\nimport { isWebSocketRequestAuthorized, type ResolvedWebSocketListenerAuth } from \"./websocket-auth.ts\";\n\nconst DEFAULT_OUTBOUND_QUEUE_BYTES = 16 * 1024 * 1024;\nconst WEBSOCKET_RETRY_LATER = 1013;\n\nexport type AppServerWebSocketConnectionHandler = {\n\treadonly connectionCount: number;\n\thandleUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer): void;\n\tterminateConnections(): void;\n\tclose(): Promise<void>;\n};\n\nexport function createAppServerWebSocketConnectionHandler(options: {\n\treadonly core: ServerCore;\n\treadonly auth: ResolvedWebSocketListenerAuth;\n\treadonly transportKind: TransportKind;\n\treadonly connectionIdPrefix: string;\n\treadonly outboundQueueBytes?: number;\n}): AppServerWebSocketConnectionHandler {\n\tconst webSocketServer = new WebSocketServer({ noServer: true });\n\tconst connections = new Set<WebSocket>();\n\tlet nextConnectionId = 1;\n\tconst handleUpgrade = (request: IncomingMessage, socket: Duplex, head: Buffer): void => {\n\t\tif (hasOrigin(request)) {\n\t\t\trejectUpgrade(socket, 403, \"Forbidden\");\n\t\t\treturn;\n\t\t}\n\t\tif (request.url !== \"/\") {\n\t\t\trejectUpgrade(socket, 400, \"Bad Request\");\n\t\t\treturn;\n\t\t}\n\t\tif (!isWebSocketRequestAuthorized(request, options.auth)) {\n\t\t\trejectUpgrade(socket, 401, \"Unauthorized\");\n\t\t\treturn;\n\t\t}\n\t\twebSocketServer.handleUpgrade(request, socket, head, (websocket) => {\n\t\t\tconst connectionId = `${options.connectionIdPrefix}-${nextConnectionId}`;\n\t\t\tnextConnectionId += 1;\n\t\t\tconnections.add(websocket);\n\t\t\toptions.core.addConnection({\n\t\t\t\tid: connectionId,\n\t\t\t\ttransportKind: options.transportKind,\n\t\t\t\tsend: (message) => sendWebSocketMessage(websocket, message, options.outboundQueueBytes),\n\t\t\t\tclose: () => websocket.close(WEBSOCKET_RETRY_LATER, \"slow-client\"),\n\t\t\t});\n\t\t\twebsocket.on(\"message\", (data, isBinary) => {\n\t\t\t\tif (isBinary) return;\n\t\t\t\tconst parsed = parseNdjsonLine(data.toString(\"utf8\"));\n\t\t\t\tif (parsed.kind === \"parse-error\") {\n\t\t\t\t\tsendWebSocketMessage(websocket, parsed.message, options.outboundQueueBytes).catch((error: unknown) => {\n\t\t\t\t\t\tterminateOnTransportError(websocket, error);\n\t\t\t\t\t});\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\t// A rejected dispatch (e.g. the response send failing on a dying socket)\n\t\t\t\t// must not surface as an unhandled rejection that kills the server.\n\t\t\t\toptions.core.receive(connectionId, parsed).catch((error: unknown) => {\n\t\t\t\t\tterminateOnTransportError(websocket, error);\n\t\t\t\t});\n\t\t\t});\n\t\t\twebsocket.on(\"error\", (error: unknown) => {\n\t\t\t\t// A socket-level error with no listener throws and can crash the\n\t\t\t\t// server; isolate the fault to this connection instead.\n\t\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\t\tprocess.stderr.write(`app-server websocket connection error: ${message}\\n`);\n\t\t\t\twebsocket.terminate();\n\t\t\t});\n\t\t\twebsocket.on(\"close\", () => {\n\t\t\t\tconnections.delete(websocket);\n\t\t\t\toptions.core.removeConnection(connectionId);\n\t\t\t});\n\t\t});\n\t};\n\treturn {\n\t\tget connectionCount() {\n\t\t\treturn connections.size;\n\t\t},\n\t\thandleUpgrade,\n\t\tterminateConnections() {\n\t\t\tfor (const websocket of connections) websocket.terminate();\n\t\t},\n\t\tclose() {\n\t\t\treturn closeServer(webSocketServer);\n\t\t},\n\t};\n}\n\nexport function closeServer(server: Pick<Server | WebSocketServer, \"close\">): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tserver.close((error) => {\n\t\t\tif (error) return reject(error);\n\t\t\tresolve();\n\t\t});\n\t});\n}\n\nfunction sendWebSocketMessage(\n\twebsocket: WebSocket,\n\tmessage: RpcEnvelope,\n\toutboundQueueBytes = DEFAULT_OUTBOUND_QUEUE_BYTES,\n): Promise<void> {\n\tconst payload = serializeNdjsonMessage(message).trimEnd();\n\tif (websocket.bufferedAmount + Buffer.byteLength(payload) > outboundQueueBytes) {\n\t\tconst closed = waitForSocketClose(websocket);\n\t\twebsocket.close(WEBSOCKET_RETRY_LATER, \"slow-client\");\n\t\treturn closed;\n\t}\n\treturn new Promise((resolve, reject) => {\n\t\twebsocket.send(payload, (error) => {\n\t\t\tif (error) return reject(error);\n\t\t\tresolve();\n\t\t});\n\t});\n}\n\nfunction terminateOnTransportError(websocket: WebSocket, error: unknown): void {\n\tconst message = error instanceof Error ? error.message : String(error);\n\tprocess.stderr.write(`app-server websocket transport error: ${message}\\n`);\n\twebsocket.terminate();\n}\n\nfunction waitForSocketClose(websocket: WebSocket): Promise<void> {\n\tif (websocket.readyState === WebSocket.CLOSED) return Promise.resolve();\n\treturn new Promise((resolve) => {\n\t\twebsocket.once(\"close\", () => resolve());\n\t});\n}\n\nfunction hasOrigin(request: IncomingMessage): boolean {\n\treturn request.headers.origin !== undefined;\n}\n\nfunction rejectUpgrade(socket: Duplex, statusCode: 400 | 401 | 403, reason: string): void {\n\tsocket.write(`HTTP/1.1 ${statusCode} ${reason}\\r\\nConnection: close\\r\\nContent-Length: 0\\r\\n\\r\\n`);\n\tsocket.destroy();\n}\n"]}

package/dist/modes/app-server/transports/websocket.d.ts

@@ -0,0 +1,25 @@
+import { ServerCore } from "../server/server-core.ts";
+import { type WebSocketListenerAuth } from "./websocket-auth.ts";
+export type { WebSocketListenerAuth } from "./websocket-auth.ts";
+export type WebSocketListenerOptions = {
+    readonly host: string;
+    readonly port: number;
+    readonly auth?: WebSocketListenerAuth;
+    readonly core?: ServerCore;
+    readonly stderr?: Pick<NodeJS.WriteStream, "write">;
+    readonly outboundQueueBytes?: number;
+};
+export type WebSocketListenerHandle = {
+    readonly host: string;
+    readonly port: number;
+    readonly core: ServerCore;
+    readonly tokenFile: string | undefined;
+    readonly connectionCount: number;
+    close(): Promise<void>;
+};
+export declare class AppServerWebSocketListenError extends Error {
+    readonly exitCode = 2;
+    constructor(message: string);
+}
+export declare function startAppServerWebSocketListener(options: WebSocketListenerOptions): Promise<WebSocketListenerHandle>;
+//# sourceMappingURL=websocket.d.ts.map

package/dist/modes/app-server/transports/websocket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../../../../src/modes/app-server/transports/websocket.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG/F,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACpD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AAEF,qBAAa,6BAA8B,SAAQ,KAAK;IACvD,QAAQ,CAAC,QAAQ,KAAK;IAEtB,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAED,wBAAsB,+BAA+B,CACpD,OAAO,EAAE,wBAAwB,GAC/B,OAAO,CAAC,uBAAuB,CAAC,CA6ClC"}

package/dist/modes/app-server/transports/websocket.js

@@ -0,0 +1,86 @@
+import { createServer } from "node:http";
+import { isIP } from "node:net";
+import { join } from "node:path";
+import { getAgentDir } from "../../../config.js";
+import { ServerCore } from "../server/server-core.js";
+import { resolveWebSocketListenerAuth } from "./websocket-auth.js";
+import { closeServer, createAppServerWebSocketConnectionHandler } from "./websocket-connection-handler.js";
+export class AppServerWebSocketListenError extends Error {
+    constructor(message) {
+        super(message);
+        this.exitCode = 2;
+        this.name = "AppServerWebSocketListenError";
+    }
+}
+export async function startAppServerWebSocketListener(options) {
+    const auth = await resolveWebSocketListenerAuth({
+        auth: options.auth,
+        stderr: options.stderr ?? process.stderr,
+        defaultTokenPath: join(getAgentDir(), "app-server", "ws-token"),
+        tokenLogLabel: "app-server websocket token",
+    });
+    if (auth.kind === "off" && !isLoopbackHost(options.host)) {
+        throw new AppServerWebSocketListenError("Refusing unauthenticated app-server websocket on non-loopback host.");
+    }
+    const core = options.core ?? new ServerCore();
+    const handler = createAppServerWebSocketConnectionHandler({
+        core,
+        auth,
+        transportKind: "websocket",
+        connectionIdPrefix: "ws",
+        outboundQueueBytes: options.outboundQueueBytes,
+    });
+    let accepting = true;
+    const server = createServer((request, response) => handleHttpRequest(request, response, accepting));
+    server.on("upgrade", handler.handleUpgrade);
+    await listen(server, options.host, options.port);
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new AppServerWebSocketListenError("Websocket listener did not bind to a TCP address.");
+    }
+    return {
+        host: options.host,
+        port: address.port,
+        core,
+        tokenFile: auth.kind === "bearer" ? auth.path : undefined,
+        get connectionCount() {
+            return handler.connectionCount;
+        },
+        async close() {
+            accepting = false;
+            handler.terminateConnections();
+            await closeServer(server);
+            await handler.close();
+        },
+    };
+}
+function handleHttpRequest(request, response, accepting) {
+    if (hasOrigin(request)) {
+        writeText(response, 403, "forbidden\n");
+        return;
+    }
+    if ((request.url === "/readyz" || request.url === "/healthz") && accepting) {
+        writeText(response, 200, "ok\n");
+        return;
+    }
+    writeText(response, 400, "websocket upgrade required\n");
+}
+function hasOrigin(request) {
+    return request.headers.origin !== undefined;
+}
+function writeText(response, statusCode, body) {
+    response.writeHead(statusCode, { "content-type": "text/plain; charset=utf-8" }).end(body);
+}
+function listen(server, host, port) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+}
+function isLoopbackHost(host) {
+    return host === "::1" || (isIP(host) === 4 && host.startsWith("127."));
+}
+//# sourceMappingURL=websocket.js.map

package/dist/modes/app-server/transports/websocket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket.js","sourceRoot":"","sources":["../../../../src/modes/app-server/transports/websocket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAA8B,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,MAAM,mCAAmC,CAAC;AAsB3G,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAGvD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHP,aAAQ,GAAG,CAAC,CAAC;QAIrB,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC7C,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,OAAiC;IAEjC,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAAC;QAC/C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;QACxC,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC;QAC/D,aAAa,EAAE,4BAA4B;KAC3C,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,6BAA6B,CAAC,qEAAqE,CAAC,CAAC;IAChH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,yCAAyC,CAAC;QACzD,IAAI;QACJ,IAAI;QACJ,aAAa,EAAE,WAAW;QAC1B,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC9C,CAAC,CAAC;IACH,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAEpG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAE5C,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,6BAA6B,CAAC,mDAAmD,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACzD,IAAI,eAAe;YAClB,OAAO,OAAO,CAAC,eAAe,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,KAAK;YACV,SAAS,GAAG,KAAK,CAAC;YAClB,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwB,EAAE,QAAwB,EAAE,SAAkB;IAChG,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QACxC,OAAO;IACR,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,UAAU,CAAC,IAAI,SAAS,EAAE,CAAC;QAC5E,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO;IACR,CAAC;IACD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,OAAwB;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,QAAwB,EAAE,UAAkB,EAAE,IAAY;IAC5E,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IACnC,OAAO,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC","sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\nimport { isIP } from \"node:net\";\nimport { join } from \"node:path\";\nimport { getAgentDir } from \"../../../config.ts\";\nimport { ServerCore } from \"../server/server-core.ts\";\nimport { resolveWebSocketListenerAuth, type WebSocketListenerAuth } from \"./websocket-auth.ts\";\nimport { closeServer, createAppServerWebSocketConnectionHandler } from \"./websocket-connection-handler.ts\";\n\nexport type { WebSocketListenerAuth } from \"./websocket-auth.ts\";\n\nexport type WebSocketListenerOptions = {\n\treadonly host: string;\n\treadonly port: number;\n\treadonly auth?: WebSocketListenerAuth;\n\treadonly core?: ServerCore;\n\treadonly stderr?: Pick<NodeJS.WriteStream, \"write\">;\n\treadonly outboundQueueBytes?: number;\n};\n\nexport type WebSocketListenerHandle = {\n\treadonly host: string;\n\treadonly port: number;\n\treadonly core: ServerCore;\n\treadonly tokenFile: string | undefined;\n\treadonly connectionCount: number;\n\tclose(): Promise<void>;\n};\n\nexport class AppServerWebSocketListenError extends Error {\n\treadonly exitCode = 2;\n\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"AppServerWebSocketListenError\";\n\t}\n}\n\nexport async function startAppServerWebSocketListener(\n\toptions: WebSocketListenerOptions,\n): Promise<WebSocketListenerHandle> {\n\tconst auth = await resolveWebSocketListenerAuth({\n\t\tauth: options.auth,\n\t\tstderr: options.stderr ?? process.stderr,\n\t\tdefaultTokenPath: join(getAgentDir(), \"app-server\", \"ws-token\"),\n\t\ttokenLogLabel: \"app-server websocket token\",\n\t});\n\tif (auth.kind === \"off\" && !isLoopbackHost(options.host)) {\n\t\tthrow new AppServerWebSocketListenError(\"Refusing unauthenticated app-server websocket on non-loopback host.\");\n\t}\n\n\tconst core = options.core ?? new ServerCore();\n\tconst handler = createAppServerWebSocketConnectionHandler({\n\t\tcore,\n\t\tauth,\n\t\ttransportKind: \"websocket\",\n\t\tconnectionIdPrefix: \"ws\",\n\t\toutboundQueueBytes: options.outboundQueueBytes,\n\t});\n\tlet accepting = true;\n\tconst server = createServer((request, response) => handleHttpRequest(request, response, accepting));\n\n\tserver.on(\"upgrade\", handler.handleUpgrade);\n\n\tawait listen(server, options.host, options.port);\n\tconst address = server.address();\n\tif (!address || typeof address === \"string\") {\n\t\tthrow new AppServerWebSocketListenError(\"Websocket listener did not bind to a TCP address.\");\n\t}\n\n\treturn {\n\t\thost: options.host,\n\t\tport: address.port,\n\t\tcore,\n\t\ttokenFile: auth.kind === \"bearer\" ? auth.path : undefined,\n\t\tget connectionCount() {\n\t\t\treturn handler.connectionCount;\n\t\t},\n\t\tasync close() {\n\t\t\taccepting = false;\n\t\t\thandler.terminateConnections();\n\t\t\tawait closeServer(server);\n\t\t\tawait handler.close();\n\t\t},\n\t};\n}\n\nfunction handleHttpRequest(request: IncomingMessage, response: ServerResponse, accepting: boolean): void {\n\tif (hasOrigin(request)) {\n\t\twriteText(response, 403, \"forbidden\\n\");\n\t\treturn;\n\t}\n\tif ((request.url === \"/readyz\" || request.url === \"/healthz\") && accepting) {\n\t\twriteText(response, 200, \"ok\\n\");\n\t\treturn;\n\t}\n\twriteText(response, 400, \"websocket upgrade required\\n\");\n}\n\nfunction hasOrigin(request: IncomingMessage): boolean {\n\treturn request.headers.origin !== undefined;\n}\n\nfunction writeText(response: ServerResponse, statusCode: number, body: string): void {\n\tresponse.writeHead(statusCode, { \"content-type\": \"text/plain; charset=utf-8\" }).end(body);\n}\n\nfunction listen(server: Server, host: string, port: number): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tserver.once(\"error\", reject);\n\t\tserver.listen(port, host, () => {\n\t\t\tserver.off(\"error\", reject);\n\t\t\tresolve();\n\t\t});\n\t});\n}\n\nfunction isLoopbackHost(host: string): boolean {\n\treturn host === \"::1\" || (isIP(host) === 4 && host.startsWith(\"127.\"));\n}\n"]}

package/dist/modes/app-server/turn-adapter.d.ts

@@ -0,0 +1,16 @@
+import type { TurnInterruptParams, TurnStartParams, TurnSteerParams } from "./protocol/index.ts";
+import type { MethodRegistry, RpcRequest } from "./rpc/registry.ts";
+import type { ApprovalBridge } from "./server/approvals.ts";
+import type { NotificationRouter } from "./server/notifications.ts";
+import { ServerCore } from "./server/server-core.ts";
+import type { ThreadRegistry } from "./threads/registry.ts";
+import type { TurnEngineStore, TurnEngineThreadEntry } from "./threads/turns.ts";
+type ModeTurnEntry = TurnEngineThreadEntry;
+export declare function createModeTurnStore(threads: ThreadRegistry): TurnEngineStore<ModeTurnEntry>;
+export declare function turnStartParams(request: RpcRequest): TurnStartParams;
+export declare function turnSteerParams(request: RpcRequest): TurnSteerParams;
+export declare function turnInterruptParams(request: RpcRequest): TurnInterruptParams;
+export declare function createRoutedServerCore(registry: MethodRegistry, notifications: NotificationRouter, approvals: ApprovalBridge, onThreadSubscribersEmpty?: (threadId: string) => void): ServerCore;
+export declare function registerLoadedThreadObjectListHandler(registry: MethodRegistry, threads: ThreadRegistry): void;
+export {};
+//# sourceMappingURL=turn-adapter.d.ts.map

package/dist/modes/app-server/turn-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-adapter.d.ts","sourceRoot":"","sources":["../../../src/modes/app-server/turn-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAa,MAAM,qBAAqB,CAAC;AAE5G,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,KAAK,EAAqB,eAAe,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEpG,KAAK,aAAa,GAAG,qBAAqB,CAAC;AAE3C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe,CAAC,aAAa,CAAC,CAE3F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,eAAe,CAOpE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,eAAe,CAQpE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,GAAG,mBAAmB,CAM5E;AAED,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,kBAAkB,EACjC,SAAS,EAAE,cAAc,EACzB,wBAAwB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GACnD,UAAU,CAEZ;AAED,wBAAgB,qCAAqC,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAgB7G"}