@dadigua/web-terminal 0.0.0-stage → 0.1.4

package/dist-server/app-3OE4ER7S.js

@@ -0,0 +1,772 @@
+import {
+  serviceName,
+  serviceProtocol,
+  serviceVersion
+} from "./chunk-TD3NJESY.js";
+
+// src/server/app.ts
+import express from "express";
+import { createServer } from "node:http";
+import { mkdirSync, chmodSync } from "node:fs";
+import { join as join3, resolve as resolve2 } from "node:path";
+import { WebSocketServer } from "ws";
+import multer from "multer";
+import sharp2 from "sharp";
+
+// src/server/auth.ts
+import { createHash, timingSafeEqual } from "node:crypto";
+function validToken(candidate, token) {
+  if (typeof candidate !== "string" || candidate.length > 1024) return false;
+  const hash = (v) => createHash("sha256").update(v).digest();
+  return timingSafeEqual(hash(candidate), hash(token));
+}
+function authenticate(token) {
+  const failures = /* @__PURE__ */ new Map();
+  return (req, res, next) => {
+    res.setHeader("Cache-Control", "no-store");
+    const key = req.socket.remoteAddress || "unknown";
+    const now = Date.now();
+    for (const [ip, failure2] of failures) if (failure2.until < now) failures.delete(ip);
+    const failure = failures.get(key);
+    if (failure && failure.count >= 30) {
+      res.status(429).json({ error: "\u5C1D\u8BD5\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u518D\u8BD5" });
+      return;
+    }
+    if (!validToken(req.headers.authorization?.match(/^Bearer (.+)$/)?.[1], token)) {
+      failures.set(key, { count: (failure?.count || 0) + 1, until: failure?.until || now + 6e4 });
+      res.status(401).json({ error: "token \u65E0\u6548\uFF0C\u8BF7\u91CD\u65B0\u8F93\u5165" });
+      return;
+    }
+    failures.delete(key);
+    next();
+  };
+}
+
+// src/server/files.ts
+import { constants } from "node:fs";
+import { mkdir, readdir, open, realpath, unlink, writeFile, appendFile, readFile, rm } from "node:fs/promises";
+import { resolve, basename, dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { parse, stringify } from "yaml";
+import sharp from "sharp";
+var HttpError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+var Files = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  async directory(path) {
+    const canonical = await realpath(resolve(path));
+    const handle = await open(canonical, constants.O_RDONLY);
+    try {
+      if (!(await handle.stat()).isDirectory()) throw new HttpError(400, "\u5DE5\u4F5C\u76EE\u5F55\u65E0\u6548");
+    } finally {
+      await handle.close();
+    }
+    return canonical;
+  }
+  async directories(path) {
+    const cwd = await this.directory(path);
+    const entries = await readdir(cwd, { withFileTypes: true });
+    const folders = await Promise.all(entries.filter((entry) => entry.isDirectory() || entry.isSymbolicLink()).map(async (entry) => {
+      try {
+        return { name: entry.name, path: await this.directory(join(cwd, entry.name)) };
+      } catch {
+        return null;
+      }
+    }));
+    const parent = dirname(cwd);
+    return {
+      path: cwd,
+      parent: parent !== cwd ? parent : null,
+      entries: folders.filter((entry) => entry !== null).sort((a, b) => a.name.localeCompare(b.name))
+    };
+  }
+  async read(cwd, path, base) {
+    if (!path || path.includes("\0") || path.length > 8192) throw new HttpError(400, "\u6587\u4EF6\u8DEF\u5F84\u65E0\u6548");
+    const expanded = path.startsWith("~/") ? join(process.env.HOME || cwd, path.slice(2)) : path;
+    const canonical = await realpath(resolve(base || cwd, expanded));
+    const handle = await open(canonical, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+      const stat = await handle.stat();
+      if (!stat.isFile()) throw new HttpError(400, "\u53EA\u80FD\u9884\u89C8\u666E\u901A\u6587\u4EF6");
+      const head = Buffer.alloc(16);
+      await handle.read(head, 0, 16, 0);
+      const mime = imageMime(head);
+      const info = { path: canonical, name: basename(canonical), size: stat.size, mime: mime || "application/octet-stream", isImage: !!mime };
+      if (mime && stat.size <= 50 * 1024 * 1024) {
+        const bytes = await handle.readFile();
+        const metadata = await sharp(bytes, { limitInputPixels: 64e6 }).metadata();
+        info.width = metadata.width;
+        info.height = metadata.height;
+        return { handle, info, bytes };
+      }
+      return { handle, info, bytes: void 0 };
+    } catch (error) {
+      await handle.close();
+      throw error;
+    }
+  }
+  async upload(sessionId, temporary, originalName) {
+    try {
+      const handle = await open(temporary, "r");
+      let bytes;
+      try {
+        bytes = await handle.readFile();
+      } finally {
+        await handle.close();
+      }
+      const mime = imageMime(bytes);
+      if (!mime) throw new HttpError(415, "\u652F\u6301 PNG\u3001JPEG\u3001WebP \u548C GIF \u56FE\u7247");
+      const meta = await sharp(bytes, { limitInputPixels: 64e6 }).metadata().catch(() => {
+        throw new HttpError(415, "\u56FE\u7247\u65E0\u6CD5\u89E3\u7801\u6216\u50CF\u7D20\u6570\u8D85\u8FC7\u9650\u5236");
+      });
+      if (!meta.width || !meta.height) throw new HttpError(415, "\u56FE\u7247\u65E0\u6CD5\u89E3\u7801");
+      const folder = join(this.config.dataDir, "uploads", sessionId);
+      await mkdir(folder, { recursive: true, mode: 448 });
+      await mkdir(this.config.uploadDir, { recursive: true, mode: 448 });
+      const ext = { "image/png": ".png", "image/jpeg": ".jpg", "image/webp": ".webp", "image/gif": ".gif" }[mime];
+      let path;
+      for (; ; ) {
+        path = join(this.config.uploadDir, `${randomBytes(6).toString("hex")}${ext}`);
+        try {
+          await writeFile(path, bytes, { flag: "wx", mode: 384 });
+          break;
+        } catch (error) {
+          if (error.code !== "EEXIST") throw error;
+        }
+      }
+      try {
+        await appendFile(join(folder, "files.yaml"), stringify([path]), { mode: 384 });
+      } catch (error) {
+        await unlink(path);
+        throw error;
+      }
+      return { path, name: basename(originalName).replace(/[\x00-\x1f\x7f]/g, "").slice(0, 160) || basename(path), size: bytes.length, mime, isImage: true, width: meta.width, height: meta.height };
+    } finally {
+      await unlink(temporary).catch(() => {
+      });
+    }
+  }
+  async removeUploads(sessionId) {
+    const folder = join(this.config.dataDir, "uploads", sessionId);
+    let paths;
+    try {
+      paths = parse(await readFile(join(folder, "files.yaml"), "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (Array.isArray(paths)) {
+      await Promise.all(paths.filter((path) => typeof path === "string" && /^[a-f0-9]{12}\.(?:png|jpg|webp|gif)$/.test(basename(path))).map((path) => rm(path, { force: true })));
+    }
+    await rm(folder, { recursive: true, force: true });
+  }
+};
+function imageMime(bytes) {
+  if (bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) return "image/png";
+  if (bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
+  if (/^GIF8[79]a/.test(bytes.subarray(0, 6).toString())) return "image/gif";
+  if (bytes.subarray(0, 4).toString() === "RIFF" && bytes.subarray(8, 12).toString() === "WEBP") return "image/webp";
+}
+
+// src/server/sessions.ts
+import { readFileSync, writeFileSync, renameSync, existsSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { randomUUID } from "node:crypto";
+import { parse as parse2, stringify as stringify2 } from "yaml";
+import * as pty from "node-pty";
+
+// src/shared/terminalInput.ts
+function pasteText(text, bracketedPaste) {
+  const normalized = text.replace(/\r?\n/g, "\r");
+  return bracketedPaste ? `\x1B[200~${normalized}\x1B[201~` : normalized;
+}
+
+// src/server/processInfo.ts
+import { readFile as readFile2, readlink } from "node:fs/promises";
+import { basename as basename2 } from "node:path";
+async function foregroundInfo(pid, fallback) {
+  let foreground = pid;
+  try {
+    const stat = await readFile2(`/proc/${pid}/stat`, "utf8");
+    const group = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[5]);
+    if (Number.isInteger(group) && group > 0) foreground = group;
+  } catch {
+  }
+  let processName = basename2(fallback).replace(/^-/, "");
+  let cwd;
+  try {
+    cwd = await readlink(`/proc/${foreground}/cwd`);
+  } catch {
+  }
+  try {
+    const executable = await readlink(`/proc/${foreground}/exe`);
+    if (/\/claude\/versions\//.test(executable)) processName = "claude";
+    else if (basename2(executable) === "codex") processName = "codex";
+    else if (/^(node|nodejs|bun)$/.test(basename2(executable))) {
+      const argv = (await readFile2(`/proc/${foreground}/cmdline`, "utf8")).split("\0", 2);
+      if (/[/\\](?:@anthropic-ai[/\\]claude-code|claude-code)[/\\]/.test(argv[1] || "")) processName = "claude";
+      else if (/[/\\]@openai[/\\]codex[/\\]/.test(argv[1] || "")) processName = "codex";
+    }
+  } catch {
+  }
+  return { processName, cwd };
+}
+
+// src/server/escapeTail.ts
+var EscapeTail = class {
+  state = "text";
+  osc = false;
+  escaped = false;
+  tail = "";
+  overflow = false;
+  push(data) {
+    for (const char of data) {
+      if (char === "" || char === "") {
+        this.reset();
+        continue;
+      }
+      if (this.state === "text") {
+        if (char === "\x1B") {
+          this.state = "escape";
+          this.tail = char;
+        } else if (char === "\x9B") {
+          this.state = "csi";
+          this.tail = char;
+        } else if (["\x90", "\x9D", "\x98", "\x9E", "\x9F"].includes(char)) {
+          this.state = "string";
+          this.osc = char === "\x9D";
+          this.tail = char;
+        }
+        continue;
+      }
+      if (this.tail.length < 65536) this.tail += char;
+      else this.overflow = true;
+      if (this.state === "string") {
+        if (char === "\x9C" || this.osc && char === "\x07" || this.escaped && char === "\\") this.reset();
+        else this.escaped = char === "\x1B";
+      } else if (char === "\x1B") {
+        this.state = "escape";
+        this.tail = char;
+        this.overflow = false;
+      } else if (this.state === "escape") {
+        if (char === "[") this.state = "csi";
+        else if ("]PX^_".includes(char)) {
+          this.state = "string";
+          this.osc = char === "]";
+        } else if (char >= "0" && char <= "~") this.reset();
+      } else if (char >= "@" && char <= "~") this.reset();
+    }
+  }
+  value() {
+    if (this.overflow) throw new Error("\u63A7\u5236\u5E8F\u5217\u5C1A\u672A\u7ED3\u675F\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8FDE");
+    return this.tail;
+  }
+  reset() {
+    this.state = "text";
+    this.tail = "";
+    this.osc = false;
+    this.escaped = false;
+    this.overflow = false;
+  }
+};
+
+// src/server/terminalScreen.ts
+import headless from "@xterm/headless";
+import serialize from "@xterm/addon-serialize";
+var TerminalScreen = class {
+  terminal = new headless.Terminal({ cols: 100, rows: 30, scrollback: 2e3, allowProposedApi: true });
+  tail = new EscapeTail();
+  serializer = new serialize.SerializeAddon();
+  queue = Promise.resolve();
+  closed = false;
+  cursorVisible = true;
+  mouseEncoding = 0;
+  margins = [1, 30];
+  constructor(onTitle, onResponse) {
+    this.terminal.loadAddon(this.serializer);
+    this.terminal.onTitleChange((title) => onTitle(title.replace(/[\x00-\x1f\x7f]/g, "").slice(0, 512)));
+    this.terminal.onData(onResponse);
+    for (const [code, color] of [[10, "d8d8/e3e3/e8e8"], [11, "1010/1818/2121"]]) {
+      this.terminal.parser.registerOscHandler(code, (data) => {
+        if (data !== "?") return false;
+        onResponse(`\x1B]${code};rgb:${color}\x1B\\`);
+        return true;
+      });
+    }
+    for (const final of ["h", "l"]) this.terminal.parser.registerCsiHandler({ prefix: "?", final }, (params) => {
+      if (params.includes(25)) this.cursorVisible = final === "h";
+      for (const mode of params) if (mode === 1006 || mode === 1016) this.mouseEncoding = final === "h" ? mode : 0;
+      return false;
+    });
+    this.terminal.parser.registerCsiHandler({ final: "r" }, (params) => {
+      const top = Number(params[0]) || 1, bottom = Number(params[1]) || this.terminal.rows;
+      if (top < bottom && bottom <= this.terminal.rows) this.margins = [top, bottom];
+      return false;
+    });
+    this.terminal.parser.registerEscHandler({ final: "c" }, () => {
+      this.cursorVisible = true;
+      this.mouseEncoding = 0;
+      this.margins = [1, this.terminal.rows];
+      return false;
+    });
+  }
+  run(operation) {
+    const task = this.queue.then(() => {
+      if (!this.closed) return operation();
+    });
+    this.queue = task.catch(() => {
+    });
+    return task;
+  }
+  write(data, after) {
+    return this.run(() => new Promise((resolve3, reject) => this.terminal.write(data, () => {
+      try {
+        this.tail.push(data);
+        after();
+        resolve3();
+      } catch (error) {
+        reject(error);
+      }
+    })));
+  }
+  resize(cols, rows) {
+    this.terminal.resize(cols, rows);
+    this.margins = [1, rows];
+  }
+  snapshot() {
+    const term = this.terminal;
+    const row = term.buffer.active.cursorY + 1 - (term.modes.originMode ? this.margins[0] - 1 : 0);
+    const col = term.buffer.active.cursorX + 1;
+    return {
+      cols: term.cols,
+      rows: term.rows,
+      data: this.serializer.serialize() + (this.mouseEncoding ? `\x1B[?${this.mouseEncoding}h` : "") + (this.margins[0] !== 1 || this.margins[1] !== term.rows ? `\x1B[${this.margins[0]};${this.margins[1]}r\x1B[${row};${col}H` : "") + `\x1B[?25${this.cursorVisible ? "h" : "l"}` + this.tail.value()
+    };
+  }
+  async dispose() {
+    await this.queue;
+    this.closed = true;
+    this.terminal.dispose();
+  }
+};
+
+// src/server/sessions.ts
+function send(ws, message) {
+  if (ws.readyState !== 1) return;
+  if (ws.bufferedAmount > 4 * 1024 * 1024) {
+    ws.close(1013, "\u7EC8\u7AEF\u8F93\u51FA\u8FC7\u5FEB\uFF0C\u8BF7\u91CD\u65B0\u8FDE\u63A5");
+    return;
+  }
+  ws.send(JSON.stringify(message));
+}
+var Sessions = class {
+  constructor(config, files) {
+    this.config = config;
+    this.files = files;
+    const saved = join2(config.dataDir, "sessions.yaml");
+    if (existsSync(saved)) {
+      const records = parse2(readFileSync(saved, "utf8"));
+      if (!Array.isArray(records)) throw new Error("sessions.yaml \u683C\u5F0F\u65E0\u6548");
+      for (const record of records) {
+        if (!/^[a-f0-9-]{36}$/.test(record.id)) continue;
+        const { id, name, cwd, createdAt } = record;
+        const info = { id, name, cwd, createdAt, running: false };
+        this.entries.set(info.id, this.makeSession(info));
+      }
+    }
+  }
+  config;
+  files;
+  entries = /* @__PURE__ */ new Map();
+  shuttingDown = false;
+  makeSession(info) {
+    const session = { info, clients: /* @__PURE__ */ new Map(), pendingBytes: 0, screen: new TerminalScreen(
+      (title) => {
+        info.title = title;
+      },
+      (data) => session.process?.write(data)
+    ) };
+    return session;
+  }
+  save() {
+    const file = join2(this.config.dataDir, "sessions.yaml");
+    writeFileSync(`${file}.tmp`, stringify2([...this.entries.values()].map((s) => s.info)), { mode: 384 });
+    renameSync(`${file}.tmp`, file);
+  }
+  get(id) {
+    const session = this.entries.get(id);
+    if (!session) throw new HttpError(404, "\u4F1A\u8BDD\u4E0D\u5B58\u5728");
+    return session;
+  }
+  async current(id) {
+    const session = this.get(id);
+    if (session.info.running) {
+      try {
+        const foreground = await foregroundInfo(session.process.pid, session.process.process);
+        if (foreground.cwd) session.info.cwd = foreground.cwd;
+        session.info.processName = foreground.processName;
+      } catch {
+      }
+    }
+    return { ...session.info };
+  }
+  async list() {
+    return Promise.all([...this.entries.keys()].map((id) => this.current(id)));
+  }
+  async create(name, cwd) {
+    if (this.entries.size >= 32) throw new HttpError(409, "\u6700\u591A\u4FDD\u7559 32 \u4E2A\u4F1A\u8BDD\uFF0C\u8BF7\u7ED3\u675F\u4E0D\u9700\u8981\u7684\u4F1A\u8BDD");
+    if (name !== void 0 && (typeof name !== "string" || name.length > 80)) throw new HttpError(400, "\u4F1A\u8BDD\u540D\u79F0\u6700\u591A 80 \u5B57\u7B26");
+    if (cwd !== void 0 && typeof cwd !== "string") throw new HttpError(400, "\u5DE5\u4F5C\u76EE\u5F55\u65E0\u6548");
+    const dir = await this.files.directory(cwd || this.config.defaultCwd);
+    const id = randomUUID();
+    const info = { id, name: name?.trim() || `\u7EC8\u7AEF ${this.entries.size + 1}`, cwd: dir, createdAt: (/* @__PURE__ */ new Date()).toISOString(), running: true };
+    const session = this.makeSession(info);
+    try {
+      this.entries.set(id, session);
+      this.ensureProcess(session);
+    } catch (error) {
+      this.entries.delete(id);
+      void session.screen.dispose();
+      throw error;
+    }
+    this.save();
+    return info;
+  }
+  spawnTerminal(command, args, cwd, cols, rows) {
+    const env = {};
+    for (const [key, value] of Object.entries(process.env)) if (value !== void 0 && !["WEB_TERMINAL_TOKEN", "TMUX", "TMUX_PANE"].includes(key)) env[key] = value;
+    env.TERM = "xterm-256color";
+    env.COLORTERM = "truecolor";
+    return pty.spawn(command, args, { name: "xterm-256color", cols, rows, cwd, env });
+  }
+  dimensions(cols, rows) {
+    if (!Number.isInteger(cols) || !Number.isInteger(rows) || cols < 2 || rows < 2) throw new HttpError(400, "\u7EC8\u7AEF\u5C3A\u5BF8\u65E0\u6548");
+    return { cols: Math.min(500, cols), rows: Math.min(300, rows) };
+  }
+  ensureProcess(session) {
+    if (session.process || !session.info.running) return;
+    const shellArgs = /(?:^|[/\\])(?:powershell|pwsh)(?:\.exe)?$/i.test(this.config.shell) ? ["-NoLogo"] : /(?:^|[/\\])cmd(?:\.exe)?$/i.test(this.config.shell) ? ["/Q"] : ["-l"];
+    const terminalProcess = this.spawnTerminal(this.config.shell, shellArgs, session.info.cwd, 100, 30);
+    session.process = terminalProcess;
+    terminalProcess.onData((data) => {
+      session.pendingBytes += data.length;
+      if (session.pendingBytes > 256 * 1024) terminalProcess.pause();
+      void session.screen.write(data, () => {
+        for (const ws of session.clients.keys()) send(ws, { type: "output", data });
+        session.pendingBytes -= data.length;
+        if (session.pendingBytes < 64 * 1024) terminalProcess.resume();
+      }).catch((error) => console.error("\u7EC8\u7AEF\u753B\u9762\u66F4\u65B0\u5931\u8D25", error));
+    });
+    terminalProcess.onExit(({ exitCode }) => {
+      session.process = void 0;
+      if (this.shuttingDown) return;
+      void session.screen.run(() => {
+        session.info.running = false;
+        this.save();
+        for (const ws of session.clients.keys()) {
+          send(ws, { type: "exit", exitCode });
+          ws.close(4404, "\u4F1A\u8BDD\u5DF2\u7ED3\u675F");
+        }
+        session.clients.clear();
+        session.controller = void 0;
+      });
+    });
+  }
+  snapshot(session, ws) {
+    try {
+      send(ws, { type: "snapshot", ...session.screen.snapshot(), controller: ws === session.controller });
+    } catch {
+      send(ws, { type: "error", message: "\u753B\u9762\u5C1A\u672A\u5C31\u7EEA\uFF0C\u6B63\u5728\u91CD\u65B0\u8FDE\u63A5" });
+      ws.close(1013, "\u753B\u9762\u5C1A\u672A\u5C31\u7EEA");
+    }
+  }
+  applySize(session, cols, rows) {
+    const term = session.screen.terminal;
+    if (term.cols === cols && term.rows === rows) return;
+    session.screen.resize(cols, rows);
+    session.process?.resize(cols, rows);
+    for (const ws of session.clients.keys()) this.snapshot(session, ws);
+  }
+  async attach(id, ws, cols, rows) {
+    const session = this.get(id), size = this.dimensions(cols, rows);
+    if (!session.info.running) throw new HttpError(409, "\u4F1A\u8BDD\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u65B0\u5EFA\u7EC8\u7AEF");
+    ws.once("close", () => {
+      void session.screen.run(() => {
+        session.clients.delete(ws);
+        if (session.controller !== ws) return;
+        session.controller = session.clients.keys().next().value;
+        if (session.controller) {
+          const next = session.clients.get(session.controller);
+          send(session.controller, { type: "control", controller: true });
+          this.applySize(session, next.cols, next.rows);
+        }
+      });
+    });
+    await this.current(id);
+    await session.screen.run(() => {
+      if (ws.readyState !== 1) return;
+      if (!session.info.running) throw new HttpError(409, "\u4F1A\u8BDD\u5DF2\u7ED3\u675F");
+      if (!session.controller) {
+        session.controller = ws;
+        this.applySize(session, size.cols, size.rows);
+      }
+      session.clients.set(ws, size);
+      this.snapshot(session, ws);
+      send(ws, { type: "ready", session: session.info });
+    });
+  }
+  input(id, ws, data) {
+    const session = this.get(id);
+    void session.screen.run(() => {
+      if (session.clients.has(ws)) session.process?.write(data);
+    });
+  }
+  paste(id, ws, text, submit) {
+    const session = this.get(id);
+    void session.screen.run(() => {
+      if (session.clients.has(ws)) session.process?.write(pasteText(text, session.screen.terminal.modes.bracketedPasteMode) + (submit ? "\r" : ""));
+    });
+  }
+  resize(id, ws, cols, rows, claim = false) {
+    if (!Number.isInteger(cols) || !Number.isInteger(rows) || cols < 2 || rows < 2) return;
+    const session = this.get(id), size = this.dimensions(cols, rows);
+    void session.screen.run(() => {
+      if (!session.clients.has(ws)) return;
+      session.clients.set(ws, size);
+      if (claim && session.controller !== ws) {
+        session.controller = ws;
+        for (const client of session.clients.keys()) send(client, { type: "control", controller: client === ws });
+      }
+      if (session.controller === ws) this.applySize(session, size.cols, size.rows);
+    });
+  }
+  async remove(id) {
+    const session = this.get(id);
+    session.process?.kill();
+    for (const ws of session.clients.keys()) ws.close(1e3, "\u4F1A\u8BDD\u5DF2\u7ED3\u675F");
+    this.entries.delete(id);
+    this.save();
+    await session.screen.dispose();
+    await this.files.removeUploads(id);
+  }
+  async shutdown() {
+    this.shuttingDown = true;
+    this.save();
+    for (const session of this.entries.values()) {
+      for (const ws of session.clients.keys()) ws.close(1012, "\u670D\u52A1\u91CD\u542F\u4E2D");
+      session.process?.kill();
+    }
+    await Promise.all([...this.entries.values()].map((session) => session.screen.dispose()));
+  }
+};
+
+// src/server/embedding.ts
+var vscodeFrameAncestors = [
+  "'self'",
+  "vscode-webview:",
+  "vscode-file:",
+  "https://*.vscode-cdn.net",
+  "https://vscode.dev",
+  "https://*.vscode.dev",
+  "https://github.dev",
+  "https://*.github.dev"
+].join(" ");
+function embeddingHeaders(path, embed, dev) {
+  const embedded = path === "/" && embed === "vscode";
+  const ancestors = embedded ? vscodeFrameAncestors : "'none'";
+  const headers = {};
+  if (!embedded) headers["X-Frame-Options"] = "DENY";
+  const rules = dev ? [] : [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' blob: data:",
+    "connect-src 'self'",
+    "font-src 'self'",
+    "object-src 'none'",
+    "base-uri 'none'"
+  ];
+  headers["Content-Security-Policy"] = [...rules, `frame-ancestors ${ancestors}`].join("; ");
+  return headers;
+}
+
+// src/server/app.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { fileURLToPath } from "node:url";
+async function createApp(config, options = {}) {
+  mkdirSync(config.dataDir, { recursive: true, mode: 448 });
+  const app = express();
+  const instanceId = randomUUID2();
+  app.disable("x-powered-by");
+  const server = createServer(app);
+  const files = new Files(config);
+  await files.directory(config.defaultCwd);
+  const sessions = new Sessions(config, files);
+  const uploadDir = join3(config.dataDir, "staging");
+  mkdirSync(uploadDir, { recursive: true, mode: 448 });
+  const upload = multer({ dest: uploadDir, limits: { fileSize: config.maxUploadBytes, files: 1, fields: 0 } });
+  app.use((req, res, next) => {
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.set(embeddingHeaders(req.path, req.query.embed, !!options.dev));
+    next();
+  });
+  app.get("/health", (_req, res) => res.set("Cache-Control", "no-store").json({
+    service: serviceName,
+    version: serviceVersion,
+    protocol: serviceProtocol,
+    instanceId: options.instanceId ?? instanceId,
+    pid: process.pid,
+    managed: options.managed ?? false
+  }));
+  app.use("/api", authenticate(config.token), express.json({ limit: "32kb" }));
+  app.get("/api/auth", (_req, res) => res.json({ ok: true }));
+  app.get("/api/info", (_req, res) => res.json({ machineId: config.machineId, defaultCwd: config.defaultCwd, maxUploadBytes: config.maxUploadBytes }));
+  app.get("/api/directories", async (req, res) => {
+    if (req.query.path !== void 0 && (typeof req.query.path !== "string" || req.query.path.length > 8192 || req.query.path.includes("\0"))) throw new HttpError(400, "\u8DEF\u5F84\u53C2\u6570\u65E0\u6548");
+    res.json(await files.directories(typeof req.query.path === "string" && req.query.path ? req.query.path : config.defaultCwd));
+  });
+  app.get("/api/sessions", async (_req, res) => res.json(await sessions.list()));
+  app.post("/api/sessions", async (req, res) => res.status(201).json(await sessions.create(req.body?.name, req.body?.cwd)));
+  app.delete("/api/sessions/:id", async (req, res) => {
+    await sessions.remove(req.params.id);
+    res.json({ ok: true });
+  });
+  app.post("/api/sessions/:id/uploads", (req, _res, next) => {
+    sessions.get(String(req.params.id));
+    next();
+  }, upload.single("file"), async (req, res) => {
+    if (!req.file) throw new HttpError(400, "\u8BF7\u9009\u62E9\u56FE\u7247");
+    chmodSync(req.file.path, 384);
+    const info = await files.upload(String(req.params.id), req.file.path, req.file.originalname);
+    res.status(201).json(info);
+  });
+  app.get("/api/sessions/:id/files/:action", async (req, res) => {
+    if (req.params.action !== "meta" && req.params.action !== "content") throw new HttpError(404, "\u63A5\u53E3\u4E0D\u5B58\u5728");
+    const session = await sessions.current(req.params.id);
+    if (typeof req.query.path !== "string" || req.query.base !== void 0 && typeof req.query.base !== "string") throw new HttpError(400, "\u8DEF\u5F84\u53C2\u6570\u65E0\u6548");
+    const result = await files.read(session.cwd, req.query.path, req.query.base);
+    if (req.params.action === "meta") {
+      await result.handle.close();
+      res.json(result.info);
+      return;
+    }
+    if (req.query.thumbnail === "1") {
+      await result.handle.close();
+      if (!result.info.isImage) throw new HttpError(415, "\u8BE5\u6587\u4EF6\u4E0D\u662F\u652F\u6301\u9884\u89C8\u7684\u56FE\u7247");
+      if (!result.bytes) throw new HttpError(413, "\u56FE\u7247\u8FC7\u5927\uFF0C\u8BF7\u4E0B\u8F7D\u67E5\u770B");
+      const thumbnail = await sharp2(result.bytes, { limitInputPixels: 64e6 }).rotate().resize({ width: 960, height: 720, fit: "inside", withoutEnlargement: true }).webp({ quality: 82 }).toBuffer();
+      res.type("image/webp").send(thumbnail);
+      return;
+    }
+    res.setHeader("Content-Type", result.info.mime);
+    res.setHeader("Content-Length", result.info.size);
+    if (req.query.download === "1" || !result.info.isImage) res.setHeader("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(result.info.name).replace(/'/g, "%27")}`);
+    const stream = result.handle.createReadStream({ start: 0, autoClose: true });
+    res.on("close", () => stream.destroy());
+    stream.on("error", () => res.destroy());
+    stream.pipe(res);
+  });
+  app.use("/api", (_req, res) => res.status(404).json({ error: "\u63A5\u53E3\u4E0D\u5B58\u5728" }));
+  const wss = new WebSocketServer({ noServer: true, maxPayload: 128 * 1024 });
+  server.on("upgrade", (req, socket, head) => {
+    if (new URL(req.url || "/", "http://localhost").pathname !== "/ws") {
+      if (!options.dev) socket.destroy();
+      return;
+    }
+    const origin = req.headers.origin;
+    try {
+      if (origin && new URL(origin).host !== req.headers.host) {
+        socket.destroy();
+        return;
+      }
+    } catch {
+      socket.destroy();
+      return;
+    }
+    wss.handleUpgrade(req, socket, head, (ws) => wss.emit("connection", ws));
+  });
+  wss.on("connection", (ws) => {
+    let sessionId;
+    const timer = setTimeout(() => ws.close(4401, "\u9700\u8981 token"), 5e3);
+    ws.once("close", () => clearTimeout(timer));
+    ws.on("error", () => {
+    });
+    ws.on("message", (raw, binary) => {
+      try {
+        if (binary) throw new Error("\u6D88\u606F\u683C\u5F0F\u65E0\u6548");
+        const message = JSON.parse(raw.toString());
+        if (!sessionId) {
+          if (message.type !== "auth" || !validToken(message.token, config.token)) {
+            ws.close(4401, "token \u65E0\u6548");
+            return;
+          }
+          if (message.protocol !== 2) {
+            send(ws, { type: "error", message: "\u7EC8\u7AEF\u534F\u8BAE\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0\u9875\u9762" });
+            ws.close(4406, "\u8BF7\u5237\u65B0\u9875\u9762");
+            return;
+          }
+          if (typeof message.sessionId !== "string") throw new Error("\u4F1A\u8BDD\u65E0\u6548");
+          const session = sessions.get(message.sessionId);
+          sessionId = session.info.id;
+          clearTimeout(timer);
+          void sessions.attach(sessionId, ws, message.cols, message.rows).catch((error) => {
+            send(ws, { type: "error", message: error.message });
+            ws.close(4404, "\u4F1A\u8BDD\u4E0D\u53EF\u7528");
+          });
+        } else if (message.type === "input" && typeof message.data === "string") {
+          sessions.input(sessionId, ws, message.data);
+        } else if (message.type === "paste" && typeof message.text === "string" && typeof message.submit === "boolean") {
+          sessions.paste(sessionId, ws, message.text, message.submit);
+        } else if (message.type === "resize" || message.type === "claim") {
+          sessions.resize(sessionId, ws, message.cols, message.rows, message.type === "claim");
+        } else throw new Error("\u6D88\u606F\u683C\u5F0F\u65E0\u6548");
+      } catch (error) {
+        send(ws, { type: "error", message: error instanceof Error ? error.message : "\u8BF7\u6C42\u5931\u8D25" });
+        ws.close(4404, "\u6D88\u606F\u6216\u4F1A\u8BDD\u4E0D\u53EF\u7528");
+      }
+    });
+  });
+  let closeVite;
+  if (options.dev) {
+    const { createServer: createVite } = await import("vite");
+    const vite = await createVite({ server: { middlewareMode: true, hmr: { server } }, appType: "spa" });
+    closeVite = () => vite.close();
+    app.use(vite.middlewares);
+  } else if (options.staticFiles !== false) {
+    const staticDir = options.staticDir || fileURLToPath(new URL("../../dist/", import.meta.url));
+    app.use(express.static(staticDir));
+    app.get("/{*path}", (_req, res) => res.sendFile(resolve2(staticDir, "index.html")));
+  }
+  app.use((error, _req, res, _next) => {
+    if (res.headersSent) {
+      res.destroy();
+      return;
+    }
+    const code = error?.code;
+    const status = error instanceof HttpError ? error.status : error instanceof multer.MulterError ? 413 : code === "ENOENT" ? 404 : code === "EACCES" ? 403 : error instanceof SyntaxError ? 400 : 500;
+    const message = status === 404 ? "\u6587\u4EF6\u6216\u76EE\u5F55\u4E0D\u5B58\u5728" : status === 413 ? "\u56FE\u7247\u8D85\u8FC7 20 MiB \u6216\u4E0A\u4F20\u683C\u5F0F\u65E0\u6548" : status === 500 ? "\u670D\u52A1\u5904\u7406\u5931\u8D25\uFF0C\u8BF7\u67E5\u770B\u670D\u52A1\u65E5\u5FD7" : error.message;
+    if (status === 500) console.error(error);
+    res.status(status).json({ error: message });
+  });
+  return { app, server, sessions, async close() {
+    await sessions.shutdown();
+    for (const ws of wss.clients) ws.terminate();
+    wss.close();
+    await closeVite?.();
+    await new Promise((done, reject) => {
+      server.close((error) => error ? reject(error) : done());
+      server.closeAllConnections();
+    });
+  } };
+}
+export {
+  createApp
+};