@flame0510/project-aether 1.6.1 → 1.7.0

package/lib/agent-images.ts

@@ -226,6 +226,13 @@ export async function remoteSupportedVersions(): Promise<string[] | null> {
 /**
  * Runs `docker <args>`, streaming output lines; rejects with the last error line.
  *
+ * A signal that is already aborted rejects before anything is spawned: an `abort`
+ * listener added to an aborted signal never fires, so the process would otherwise run
+ * to completion even though its caller has been cancelled.
+ *
+ * Lines are reassembled across output chunks — a chunk can end mid-line — and `\r` is
+ * treated as a line break too, since docker redraws progress with it.
+ *
  * `env` is for container environment on `docker run`: each name is inserted as `-e KEY`
  * right after the subcommand, and the value reaches docker through its own
  * environment, so secrets stay out of the process table.
@@ -235,6 +242,10 @@ export function runDocker(
   opts: { onLine?: (line: string) => void; signal?: AbortSignal; timeoutMs: number; env?: Record<string, string> },
 ): Promise<void> {
   return new Promise((resolve, reject) => {
+    if (opts.signal?.aborted) {
+      reject(new Error(`docker ${args[0]} aborted`));
+      return;
+    }
     const envNames = Object.keys(opts.env ?? {});
     const argv = envNames.length ? [args[0], ...envNames.flatMap((k) => ['-e', k]), ...args.slice(1)] : args;
     const child = spawn('docker', argv, {
@@ -243,17 +254,28 @@ export function runDocker(
     });
     let lastError = '';
     let firstError = '';
-    const onData = (isErr: boolean) => (chunk: Buffer) => {
-      for (const line of chunk.toString().split(/\r?\n/)) {
-        if (!line.trim()) continue;
-        if (isErr) {
-          // Docker prints the cause first and "Run 'docker run --help' …" last; keep
-          // both ends so the rejection can carry the cause, not the usage pointer.
-          firstError ||= line.trim();
-          lastError = line.trim();
-        }
-        opts.onLine?.(line);
+    const emit = (line: string, isErr: boolean) => {
+      if (!line.trim()) return;
+      if (isErr) {
+        // Docker prints the cause first and "Run 'docker run --help' …" last; keep
+        // both ends so the rejection can carry the cause, not the usage pointer.
+        firstError ||= line.trim();
+        lastError = line.trim();
       }
+      opts.onLine?.(line);
+    };
+    // The unfinished tail of the last chunk, per stream, completed by the next one.
+    const pending = { out: '', err: '' };
+    const onData = (isErr: boolean) => (chunk: Buffer) => {
+      const key = isErr ? 'err' : 'out';
+      const parts = (pending[key] + chunk.toString()).split(/\r\n|\n|\r/);
+      pending[key] = parts.pop() ?? '';
+      for (const line of parts) emit(line, isErr);
+    };
+    const flush = () => {
+      emit(pending.out, false);
+      emit(pending.err, true);
+      pending.out = pending.err = '';
     };
     child.stdout.on('data', onData(false));
     child.stderr.on('data', onData(true));
@@ -271,6 +293,7 @@ export function runDocker(
       reject(err);
     });
     child.on('close', (code) => {
+      flush();
       clearTimeout(timer);
       opts.signal?.removeEventListener('abort', kill);
       if (code === 0) resolve();
@@ -281,8 +304,9 @@ export function runDocker(
 
 /**
  * Pull `<registry>:<version>` and tag it `openclaw-agent-base:<version>`. The registry
- * reference is removed afterwards (an untag, the layers stay), so local images list
- * under the version tag only.
+ * reference is removed afterwards, so local images list under the version tag only: after
+ * a successful tag that is an untag (the layers stay); when the tag failed or was
+ * cancelled it is the image's only name, and the pulled image is deleted with it.
  */
 export async function pullAgentImage(
   version: string,
@@ -291,8 +315,13 @@ export async function pullAgentImage(
   if (!isSupportedVersion(version)) throw new Error(`OpenClaw ${version} is not supported by this Rev4a`);
   const remote = `${registryRepository()}:${version}`;
   await runDocker(['pull', remote], { ...opts, timeoutMs: PULL_TIMEOUT_MS });
-  await runDocker(['tag', remote, localImageRef(version)], { ...opts, timeoutMs: 30_000 });
-  await runDocker(['rmi', remote], { timeoutMs: 30_000 }).catch(() => {});
+  try {
+    await runDocker(['tag', remote, localImageRef(version)], { ...opts, timeoutMs: 30_000 });
+  } finally {
+    // Also when the tag failed or was cancelled: left behind, the registry reference
+    // is a full image under a name neither the listing nor retention looks at.
+    await runDocker(['rmi', remote], { timeoutMs: 30_000 }).catch(() => {});
+  }
 }
 
 /**

package/lib/buildAgentImage.ts

@@ -11,8 +11,9 @@
  * instead — development without registry access. Any other version cannot be built
  * from here, so its download fails.
  *
- * One download at a time (in-process lock). Output goes to
- * /tmp/rev4a-download-<timestamp>.log so it survives page refreshes and modal closes.
+ * One download at a time (in-process lock). Docker's output also goes to
+ * /tmp/rev4a-download-<timestamp>.log (mode 0600, kept 24 h) for diagnosis — nothing in the
+ * UI reads it; the banner gets its percent and status line from `getDownloadProgress()`.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -26,6 +27,36 @@ const BUILD_TIMEOUT_MS = 60 * 60 * 1000;
 /** The version being downloaded; `pending` while the default version is being resolved. */
 let downloadingVersion: string | null = null;
 let downloadLogPath: string | null = null;
+/** Owns the running pull/build process; `cancelDownload()` aborts it. One at a time, like the download itself. */
+let downloadController: AbortController | null = null;
+/** `docker pull` layer ids seen, by state — the source of the real percent below. */
+const pullLayers = new Map<string, 'pending' | 'done'>();
+/** Set once a layer starts transferring: from then on the layer list is complete. */
+let pullTransferStarted = false;
+let downloadPercent: number | null = null;
+/** The latest line of docker's output, shown under the percent (or alone when there is none). */
+let downloadMessage: string | null = null;
+
+export interface DownloadOutcome {
+  version: string;
+  result: 'succeeded' | 'failed' | 'canceled';
+  source?: 'present' | 'registry' | 'build';
+  message: string;
+  at: number;
+}
+
+/**
+ * The last download's outcome, same idea as `finished` in lib/cold-backup.ts: a client
+ * that was not mounted for the live `downloading: true → false` transition (navigated
+ * away, reloaded, opened the page late) would otherwise see nothing at all once the
+ * download is done — this is what it reads instead. Overwritten by the next download,
+ * never cleared on its own; the client decides how long "recently" still means something.
+ */
+let lastDownloadResult: DownloadOutcome | null = null;
+
+export function getLastDownloadResult(): DownloadOutcome | null {
+  return lastDownloadResult;
+}
 
 /** Checks if a download is already running (in-process flag only). */
 export function getIsDownloading(): boolean {
@@ -36,6 +67,63 @@ export function getDownloadingVersion(): string | null {
   return downloadingVersion === 'pending' ? null : downloadingVersion;
 }
 
+/** Real progress from `docker pull`'s own per-layer lines; `percent` is null until it can be computed (see `trackPullLayer`). */
+export function getDownloadProgress(): { percent: number | null; message: string | null } {
+  return { percent: downloadPercent, message: downloadMessage };
+}
+
+/**
+ * Cancel the running download, if any: the docker process is killed, or never started
+ * when the cancel arrives first (`runDocker` refuses an already-aborted signal). The
+ * download rejects with a distinct 'canceled' error so the caller can tell it apart from
+ * a real failure. Returns false when nothing is running.
+ */
+export function cancelDownload(): boolean {
+  if (!downloadController) return false;
+  downloadController.abort();
+  return true;
+}
+
+/**
+ * Whether the last finished download ended as cancelled. Derived from its recorded
+ * outcome, not from the request: a cancel that arrives after the image is already tagged
+ * changes nothing, and must not make a successful download read as cancelled.
+ */
+export function wasDownloadCanceled(): boolean {
+  return lastDownloadResult?.result === 'canceled';
+}
+
+/**
+ * Track `docker pull`'s per-layer lines to compute a real percent: the fraction of
+ * layers finished. A layer is finished at `Pull complete` (downloaded *and* extracted) or
+ * `Already exists` — not at `Download complete`, which still has the extraction ahead.
+ *
+ * Not byte-exact (layers differ in size and run in parallel), and deliberately withheld
+ * until the first layer starts transferring: docker lists every layer up front, and a
+ * percent computed before the list is complete jumps high on a cached first layer and
+ * then falls (99 → 50 → 33 → 25 was reproduced). It also never goes down, and stays
+ * below 100 — completion is reported by the download's outcome, not by a percent.
+ */
+function trackPullLayer(line: string): void {
+  const m = /^([0-9a-f]{12}):\s+(.+)$/.exec(line.trim());
+  if (!m) return;
+  const [, id, state] = m;
+  if (/^(Pulling fs layer|Waiting)/.test(state)) {
+    if (!pullLayers.has(id)) pullLayers.set(id, 'pending');
+  } else if (/^(Pull complete|Already exists)/.test(state)) {
+    pullLayers.set(id, 'done');
+  } else if (/^(Downloading|Verifying Checksum|Download complete|Extracting)/.test(state)) {
+    if (!pullLayers.has(id)) pullLayers.set(id, 'pending');
+    pullTransferStarted = true;
+  } else {
+    return;
+  }
+  if (!pullTransferStarted || pullLayers.size === 0) return;
+  const done = [...pullLayers.values()].filter((v) => v === 'done').length;
+  const percent = Math.min(99, Math.round((done / pullLayers.size) * 100));
+  downloadPercent = Math.max(downloadPercent ?? 0, percent);
+}
+
 function appendLog(msg: string): void {
   if (!downloadLogPath) return;
   try {
@@ -96,53 +184,101 @@ export async function downloadAgentImage(opts: DownloadOptions = {}): Promise<Do
   if (!dockerAvailable()) throw new Error('Docker is not available — please install Docker and try again');
   if (downloadingVersion !== null) throw new Error('A download is already in progress');
   downloadingVersion = opts.version ?? 'pending';
+  pullLayers.clear();
+  pullTransferStarted = false;
+  downloadPercent = null;
+  downloadMessage = null;
   downloadLogPath = `/tmp/rev4a-download-${Date.now()}.log`;
+  try {
+    // Owner-only, and 'wx' refuses a path that already exists (a planted file or link).
+    fs.writeFileSync(downloadLogPath, '', { mode: 0o600, flag: 'wx' });
+  } catch {
+    downloadLogPath = null;
+  }
+
+  // Owns the child process for this run. A caller's own signal (the setup wizard's SSE
+  // stream closing) aborts it too, same as cancelDownload() — both end up here, so
+  // `signal.aborted` below is the one place that tells "stopped" from "failed".
+  const controller = new AbortController();
+  downloadController = controller;
+  const onCallerAbort = () => controller.abort();
+  if (opts.signal?.aborted) controller.abort();
+  else opts.signal?.addEventListener('abort', onCallerAbort, { once: true });
+  const { signal } = controller;
+  // Between awaits a cancel can arrive with no process to kill yet; stop at the next step.
+  const stopIfCanceled = () => { if (signal.aborted) throw new Error('canceled'); };
 
   try {
     const version = opts.version ?? (await defaultDownloadVersion());
+    stopIfCanceled();
     if (!isSupportedVersion(version)) throw new Error(`OpenClaw ${version} is not supported by this Rev4a`);
     downloadingVersion = version;
 
-    if (await localVersionExists(version)) {
+    const present = await localVersionExists(version);
+    stopIfCanceled();
+    if (present) {
       event('complete', `OpenClaw ${version} image already downloaded`);
+      lastDownloadResult = { version, result: 'succeeded', source: 'present', message: `OpenClaw ${version} image already downloaded`, at: Date.now() };
       return { version, source: 'present' };
     }
 
     event('status', `Downloading OpenClaw ${version} image…`);
     try {
       await pullAgentImage(version, {
-        signal: opts.signal,
+        signal,
         onLine: (line) => {
           appendLog(line);
+          downloadMessage = line;
+          trackPullLayer(line);
           if (/Download|Extract|Pull/.test(line)) opts.onEvent?.(JSON.stringify({ type: 'progress', message: line }));
         },
       });
       event('complete', `OpenClaw ${version} image downloaded`);
+      lastDownloadResult = { version, result: 'succeeded', source: 'registry', message: `OpenClaw ${version} image downloaded`, at: Date.now() };
       return { version, source: 'registry' };
     } catch (e) {
       appendLog(`Registry download failed: ${(e as Error).message}`);
-      if (opts.signal?.aborted || dockerfileVersion() !== version) {
+      if (signal.aborted) throw new Error('canceled');
+      if (dockerfileVersion() !== version) {
         throw new Error(`Could not download OpenClaw ${version}: ${(e as Error).message}`);
       }
     }
 
     event('log', 'Registry download failed, building the image locally…');
+    downloadPercent = null;
+    stopIfCanceled();
     await runDocker(
       ['build', '--build-arg', `OPENCLAW_VERSION=${version}`, '-t', localImageRef(version), '--progress=plain', DOCKERFILE_DIR],
       {
-        signal: opts.signal,
+        signal,
         timeoutMs: BUILD_TIMEOUT_MS,
         onLine: (line) => {
           appendLog(line);
+          downloadMessage = line;
           if (line.startsWith('#')) opts.onEvent?.(JSON.stringify({ type: 'step', message: line }));
         },
       },
     );
     event('complete', `OpenClaw ${version} image built locally`);
+    lastDownloadResult = { version, result: 'succeeded', source: 'build', message: `OpenClaw ${version} image built locally`, at: Date.now() };
     return { version, source: 'build' };
+  } catch (e) {
+    const version = downloadingVersion === 'pending' ? (opts.version ?? 'unknown') : downloadingVersion;
+    if (signal.aborted) {
+      lastDownloadResult = { version, result: 'canceled', message: `OpenClaw ${version} download canceled`, at: Date.now() };
+      throw new Error('canceled');
+    }
+    lastDownloadResult = { version, result: 'failed', message: (e as Error).message, at: Date.now() };
+    throw e;
   } finally {
+    opts.signal?.removeEventListener('abort', onCallerAbort);
     downloadingVersion = null;
     downloadLogPath = null;
+    downloadController = null;
+    pullLayers.clear();
+    pullTransferStarted = false;
+    downloadPercent = null;
+    downloadMessage = null;
     cleanupOldLogs();
   }
 }

package/lib/patterns/sessionPresentation.ts

@@ -27,11 +27,13 @@ export function shortLabel(sessionId: string): string {
   return sessionId.slice(0, 14);
 }
 
+// The two Italian patterns match prompt prefixes stored in older sessions' data; they
+// are matched, never shown, so they stay as they are.
 function stripTaskBoilerplate(value: string): string {
   return value
     .replace(/^\[Subagent Task\]\s*/i, '')
-    .replace(/^Task richiesto da .*?:\s*/i, '')
-    .replace(/^Sei [^.\n]+\.\s*/i, '')
+    .replace(/^Task richiesto da .*?:\s*/i, '') // lang-ok: matches stored prompt text
+    .replace(/^Sei [^.\n]+\.\s*/i, '') // lang-ok: matches stored prompt text
     .replace(/^Begin\.?\s*/i, '')
     .trim();
 }

package/lib/rev4a-auth.d.ts

@@ -4,3 +4,4 @@ export function requireAuthIfConfigured(request: Request): Promise<NextResponse
 export function getPassword(): string;
 export function getJwtSecret(): string;
 export function isConfigured(): boolean;
+export function secretEquals(supplied: unknown, expected: unknown): boolean;

package/lib/rev4a-auth.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { jwtVerify } from "jose";
 import * as fs from "fs";
+import { createHash, timingSafeEqual } from "crypto";
 import { ENV_FILE } from "@/lib/rev4a-paths";
 
 // ---------------------------------------------------------------------------
@@ -61,14 +62,17 @@ export async function requireAuthJWT(request) {
     } catch { /* fall through to bearer */ }
   }
 
-  const expectedToken = process.env.REV4A_TOKEN || process.env.NEXT_PUBLIC_REV4A_TOKEN || "";
+  // Only the server-side variable: anything named NEXT_PUBLIC_* is inlined into the
+  // browser bundle by Next.js, so accepting one here would hand the API token to every
+  // visitor of the dashboard the moment an operator set it.
+  const expectedToken = process.env.REV4A_TOKEN || "";
   // Without this guard an unset token would make `Bearer ` match an empty
   // expected value. HTTP header normalisation already strips the trailing
   // space so it isn't reachable in practice — the guard makes that safety
   // explicit instead of dependent on it.
   if (expectedToken) {
     const auth = request.headers.get("authorization");
-    if (auth === `Bearer ${expectedToken}`) return null;
+    if (auth && secretEquals(auth, `Bearer ${expectedToken}`)) return null;
   }
 
   return unauthorized();
@@ -82,3 +86,15 @@ export async function requireAuthIfConfigured(request) {
   if (!isConfigured()) return null;
   return requireAuthJWT(request);
 }
+
+/**
+ * Compare a supplied secret with the expected one in constant time. Both are hashed to
+ * a fixed length first, so neither the content nor the length of the expected value
+ * leaks through how long the comparison takes. (The provider gateway's own check in
+ * app/api/provider/auth.ts compares the raw bytes after a length guard instead.)
+ */
+export function secretEquals(supplied, expected) {
+  if (typeof supplied !== "string" || typeof expected !== "string" || !expected) return false;
+  const digest = (value) => createHash("sha256").update(value, "utf8").digest();
+  return timingSafeEqual(digest(supplied), digest(expected));
+}