@cordfuse/crosstalk 8.2.0 → 8.3.1

package/src/web/chat-pty.ts

@@ -1,254 +0,0 @@
-// chat-pty.ts — WebSocket bridge from xterm.js in the browser to a pty
-// running an agent CLI (or $SHELL) on the host.
-//
-// Lifecycle contract (Steve's directive: 'when the user exits, kill
-// the interactive agent'):
-//
-//   client connects WS /ws/chat?agent=<name>
-//     ↓
-//   server spawns a pty running the named agent (or 'bash' for --shell)
-//     ↓
-//   pty stdout → WS text frames (browser xterm.js writes them in)
-//     ↑                                                     ↓
-//   pty stdin ← WS text frames                          operator types
-//     ↓                                                     ↓
-//   when client disconnects (tab close, /exit typed by operator):
-//     pty.kill(SIGTERM) → SIGKILL 1s later if still alive
-//
-// Async-by-design contract: NO persistent session. Each WS attach
-// spawns a fresh agent. There's no detach + reattach. If you want
-// durable state, send messages on a channel (the dispatcher replies).
-
-import type { Server as HttpServer } from 'http';
-import type { Duplex } from 'stream';
-import { WebSocketServer, type WebSocket } from 'ws';
-import { spawn as ptySpawn, type IPty } from 'node-pty';
-import { spawnSync } from 'child_process';
-import { hostname } from 'os';
-import { statSync } from 'fs';
-
-// node-pty's native bindings load under bun, but tmux/SIGHUP semantics
-// break at runtime (parallels the llmuxd 'must launch under node' issue).
-// Production is safe — commands/daemon.js spawns the dispatch loop with
-// process.execPath = node. This guard fires loudly if someone tries to
-// load the chat-pty module under bun (e.g. via `bun test` importing
-// src/api.ts, or `bun bin/crosstalk.js daemon dispatch` directly), so
-// the failure mode is a clear message instead of a mysterious tmux hang.
-declare const Bun: unknown;
-if (typeof Bun !== 'undefined') {
-  throw new Error(
-    'src/web/chat-pty.ts cannot load under bun — node-pty pty operations ' +
-    'fail at runtime (tmux/SIGHUP). Run under node instead. ' +
-    '(Production daemon already does — this guard catches test/dev mis-invocations.)',
-  );
-}
-
-/**
- * Set of agent binary names crosstalk knows how to PTY-wrap. Matches
- * the static list in chat.js — keep them in sync if a new agent is
- * added to the catalog.
- */
-const KNOWN_AGENT_BINARIES = ['claude', 'codex', 'gemini', 'qwen', 'opencode', 'agy'];
-
-interface AttachOptions {
-  agent: string;     // 'bash' (for --shell) or an entry in KNOWN_AGENT_BINARIES
-  cwd?: string;
-  cols?: number;
-  rows?: number;
-}
-
-function isOnPath(bin: string): boolean {
-  const r = spawnSync('which', [bin], { encoding: 'utf-8' });
-  return r.status === 0;
-}
-
-function resolveBinary(agent: string): string | null {
-  if (agent === 'bash') {
-    // Use $SHELL when present, fall back to bash. Matches the CLI
-    // chat --shell behavior we added in v8-native.
-    const shell = process.env['SHELL'];
-    return shell || 'bash';
-  }
-  if (!KNOWN_AGENT_BINARIES.includes(agent)) return null;
-  return isOnPath(agent) ? agent : null;
-}
-
-function safeKill(pty: IPty): void {
-  try { pty.kill('SIGTERM'); } catch { /* already gone */ }
-  setTimeout(() => {
-    try { pty.kill('SIGKILL'); } catch { /* expected if SIGTERM took */ }
-  }, 1000);
-}
-
-/**
- * Mount the chat WebSocket onto an existing http server. Wires
- * /ws/chat?agent=<name>&cols=<n>&rows=<n> to a pty spawn.
- *
- * Trust model: same as the rest of the API — engine binds 127.0.0.1,
- * so anyone reaching the WS is on the host (or coming via the
- * operator's tailscale-serve front). v8 auth: the upgrade handshake
- * checks the crosstalk_session cookie via the auth middleware so a
- * browser without a valid session can't open a chat panel even via
- * the loopback bind.
- */
-export interface MountChatPtyOptions {
-  /** Validates the upgrade request's auth (cookie). Returns true to
-   *  allow, false to reject (results in 401 close). When undefined,
-   *  the WS is open — caller must ensure the bind address is the
-   *  security boundary. */
-  authorize?: (req: import('http').IncomingMessage) => Promise<boolean>;
-}
-
-export function mountChatPty(server: HttpServer, opts: MountChatPtyOptions = {}): WebSocketServer {
-  // `noServer: true` so we drive the upgrade handshake ourselves and
-  // can write a proper auth rejection. With `server: server`, ws would
-  // accept the upgrade unconditionally.
-  const wss = new WebSocketServer({ noServer: true });
-
-  server.on('upgrade', async (req, socket, head) => {
-    try {
-      const url = new URL(req.url ?? '/', 'http://localhost');
-      if (url.pathname !== '/ws/chat') {
-        // Not our route — let the default 404 fall through.
-        rejectUpgrade(socket, 404, 'not found');
-        return;
-      }
-      if (opts.authorize) {
-        const ok = await opts.authorize(req);
-        if (!ok) {
-          rejectUpgrade(socket, 401, 'unauthorized');
-          return;
-        }
-      }
-      wss.handleUpgrade(req, socket, head, (ws) => {
-        const agent = url.searchParams.get('agent') ?? 'bash';
-        const cols = clamp(Number(url.searchParams.get('cols') ?? 80), 20, 500);
-        const rows = clamp(Number(url.searchParams.get('rows') ?? 24), 5, 200);
-        const cwd = url.searchParams.get('cwd') ?? undefined;
-        bridgePty(ws, { agent, cols, rows, cwd: cwd ?? undefined });
-      });
-    } catch (err) {
-      rejectUpgrade(socket, 500, 'upgrade failure');
-      void err;
-    }
-  });
-
-  return wss;
-}
-
-function rejectUpgrade(socket: Duplex, status: number, reason: string): void {
-  try {
-    socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\n\r\n`);
-    socket.destroy();
-  } catch { /* socket already gone */ }
-}
-
-function clamp(n: number, lo: number, hi: number): number {
-  if (!Number.isFinite(n)) return lo;
-  return Math.max(lo, Math.min(hi, Math.floor(n)));
-}
-
-function bridgePty(ws: WebSocket, opts: AttachOptions): void {
-  const bin = resolveBinary(opts.agent);
-  if (!bin) {
-    ws.send(`\r\n\x1b[31mcrosstalk: agent '${opts.agent}' not on PATH or not supported.\x1b[0m\r\n`);
-    ws.close(1003, 'agent unavailable');
-    return;
-  }
-
-  const env: Record<string, string> = {};
-  for (const [k, v] of Object.entries(process.env)) if (v !== undefined) env[k] = v;
-  env.TERM = 'xterm-256color';
-
-  // Resolve cwd. Operator can pass any path via the cwd= query param,
-  // but the engine refuses to spawn into a non-existent or non-dir
-  // path — falls back to $HOME with a warning line so the session
-  // still starts. The engine already runs as the operator's user, so
-  // there's no privilege boundary to enforce beyond fs existence.
-  const home = env['HOME'] ?? '/';
-  let cwd = opts.cwd && opts.cwd.length > 0 ? opts.cwd : home;
-  let cwdWarning: string | null = null;
-  if (cwd !== home) {
-    try {
-      const st = statSync(cwd);
-      if (!st.isDirectory()) {
-        cwdWarning = `crosstalk: '${cwd}' is not a directory, falling back to $HOME (${home})`;
-        cwd = home;
-      }
-    } catch {
-      cwdWarning = `crosstalk: '${cwd}' not accessible, falling back to $HOME (${home})`;
-      cwd = home;
-    }
-  }
-
-  let pty: IPty;
-  try {
-    pty = ptySpawn(bin, [], {
-      name: 'xterm-256color',
-      cols: opts.cols ?? 80,
-      rows: opts.rows ?? 24,
-      cwd,
-      env,
-    });
-  } catch (err) {
-    ws.send(`\r\n\x1b[31mcrosstalk: spawn failed: ${(err as Error).message}\x1b[0m\r\n`);
-    ws.close(1011, 'spawn failed');
-    return;
-  }
-
-  if (cwdWarning) {
-    ws.send(`\r\n\x1b[33m${cwdWarning}\x1b[0m\r\n`);
-  }
-
-  // Greeting so the operator sees something even before the agent's
-  // own TUI renders. Sky-blue branded line + cwd + small hint.
-  const host = (() => { try { return hostname(); } catch { return 'host'; } })();
-  ws.send(`\r\n\x1b[36m── crosstalk chat: ${opts.agent} @ ${host} ────────────────\x1b[0m\r\n`);
-  ws.send(`\x1b[90m  cwd: ${cwd}\r\n  Type /exit to disconnect (or close the tab).\r\n  When you exit, this agent process is terminated.\x1b[0m\r\n\r\n`);
-
-  // pty → ws (output stream)
-  pty.onData((data) => {
-    try { ws.send(data); } catch { /* socket closing */ }
-  });
-
-  // pty exit → close ws
-  pty.onExit(({ exitCode, signal }) => {
-    try {
-      ws.send(`\r\n\x1b[36m── agent exited (code=${exitCode}${signal ? `, signal=${signal}` : ''}) ──\x1b[0m\r\n`);
-      ws.close(1000, 'agent exited');
-    } catch { /* already closed */ }
-  });
-
-  // ws → pty (input)
-  // Two message kinds:
-  //   strings — interpreted as terminal input (typed characters)
-  //   JSON { type: 'resize', cols, rows } — pty resize from the browser
-  //   JSON { type: 'exit' } — explicit operator '/exit' command
-  ws.on('message', (raw) => {
-    const text = typeof raw === 'string' ? raw : raw.toString('utf-8');
-    if (text.startsWith('{')) {
-      try {
-        const msg = JSON.parse(text) as { type?: string; cols?: number; rows?: number };
-        if (msg.type === 'resize' && typeof msg.cols === 'number' && typeof msg.rows === 'number') {
-          try { pty.resize(clamp(msg.cols, 20, 500), clamp(msg.rows, 5, 200)); } catch {}
-          return;
-        }
-        // Two terminations:
-        //   exit — graceful: SIGTERM, then SIGKILL after 1s if the
-        //          process didn't honor the TERM (matches /exit typed
-        //          in the terminal).
-        //   kill — immediate SIGKILL. No grace window. For when an
-        //          agent CLI is wedged and you want it gone NOW.
-        if (msg.type === 'exit') { safeKill(pty); return; }
-        if (msg.type === 'kill') {
-          try { pty.kill('SIGKILL'); } catch { /* already gone */ }
-          return;
-        }
-      } catch { /* fall through to treat as raw input */ }
-    }
-    try { pty.write(text); } catch { /* pty closed */ }
-  });
-
-  ws.on('close', () => safeKill(pty));
-  ws.on('error', () => safeKill(pty));
-}