@hajimism/dek 0.4.0 → 0.5.1

package/src/core/voice.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 import type { VoiceDict } from "./cue.ts";
 import { deckPaths } from "./deck-paths.ts";
 import { DekError } from "./error.ts";
+import { compareCodeUnits } from "./order.ts";
 import { cacheDir, deckProjectRoot } from "./path.ts";
 import { readDeckFile } from "./resolve.ts";
 import { writeInside } from "./safe-fs.ts";
@@ -184,7 +185,7 @@ export function loadVoiceDict(deckDir: string): VoiceDict {
 export function writeVoiceDict(deckDir: string, dict: VoiceDict): string {
   const path = deckPaths(deckDir).voiceDict;
   const body = Object.entries(dict)
-    .sort(([a], [b]) => a.localeCompare(b))
+    .sort(([a], [b]) => compareCodeUnits(a, b))
     .map(([key, entry]) => {
       const accent = entry.accent !== undefined ? `\naccent = ${entry.accent}` : "";
       return `[${escapeTomlKey(key)}]\nkana = ${JSON.stringify(entry.kana)}${accent}\n`;

package/src/server/auth.ts

@@ -78,6 +78,27 @@ function forbidden(reason: string): Response {
   return new Response(`Forbidden: ${reason}\n`, { status: 403 });
 }
 
+/**
+ * What every answer tells the browser: take its type as given, hand it to no other origin's
+ * page, and show it in no other origin's frame. Another site can still make the browser ask, but
+ * gets nothing to play, apply as a stylesheet, tell apart by whether it loaded, or frame. The
+ * frame rule goes on every answer, not only pages: the voice or a listing opened in a frame is
+ * a page too.
+ */
+const SAME_ORIGIN_ONLY = {
+  "x-content-type-options": "nosniff",
+  "cross-origin-resource-policy": "same-origin",
+  "content-security-policy": "frame-ancestors 'self'",
+} as const;
+
+/** `response` with SAME_ORIGIN_ONLY set; the server passes every answer through it. */
+export function keepToOwnOrigin(response: Response): Response {
+  for (const [name, value] of Object.entries(SAME_ORIGIN_ONLY)) {
+    response.headers.set(name, value);
+  }
+  return response;
+}
+
 /**
  * Who may read a response. The audience sees the slides as they are shown; the presenter also
  * sees what they are made from, and may move the deck.

package/src/server/dev.ts

@@ -6,6 +6,7 @@ import { locateDeck, type Project } from "../core/resolve.ts";
 import { annotateScript, livePlayerScript, liveReloadScript } from "../runtime/player.ts";
 import {
   clearance,
+  keepToOwnOrigin,
   mayRead,
   pairingResponse,
   ROUTE_EXPOSURE,
@@ -75,9 +76,9 @@ export async function startDevServer(options: DevServerOptions): Promise<DevServ
   if (options.deck !== undefined && isRefName(options.deck)) {
     throw refReadOnlyError(options.deck);
   }
-  // Before the port and the watchers; writing the lock checks again, for a server that raced us.
-  assertNoDevServer(project.root);
   const { scopedDeckName, deckDir } = serverScope(project, options);
+  // Before the port and the watchers; writing the lock checks again, for a server that raced us.
+  assertNoDevServer(project.root, scopedDeckName);
   const access = accessFor(options);
   const embed = {
     playerScript: await livePlayerScript(),
@@ -199,10 +200,17 @@ function listen(port: number | undefined, access: Access, routes: ServedRoutes)
     port: port ?? 0,
     // Never Bun's development error page: it shows the source and absolute paths to anyone.
     development: false,
-    fetch: (req, server) => answer(req, server, access, routes),
+    // Every answer dek writes leaves through one of these two, so none goes without
+    // keepToOwnOrigin. Bun answers a few requests itself before either runs: one its parser
+    // refuses (a bad request line, no Host, a body or headers too large) and an upgrade it
+    // cannot take; none of those has a body a page could use.
+    fetch: async (req, server) => {
+      const response = await answer(req, server, access, routes);
+      return response && keepToOwnOrigin(response);
+    },
     error(error) {
       console.error(error);
-      return new Response("Internal Server Error\n", { status: 500 });
+      return keepToOwnOrigin(new Response("Internal Server Error\n", { status: 500 }));
     },
     websocket: roomSockets(routes.rooms),
   });
@@ -233,7 +241,7 @@ function answer(req: Request, server: Bun.Server<WsData>, access: Access, routes
 }
 
 /** Each socket joins its deck's room; only a presenter's socket may move it or point in it. */
-function roomSockets(rooms: RouteContext["rooms"]): Bun.WebSocketHandler<WsData> {
+export function roomSockets(rooms: RouteContext["rooms"]): Bun.WebSocketHandler<WsData> {
   return {
     // A position or a point is a few dozen bytes; anything near this is neither.
     maxPayloadLength: 4 * 1024,

package/src/server/lock.ts

@@ -1,7 +1,8 @@
-import { existsSync, unlinkSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { DekError } from "../core/error.ts";
-import { readSourceIfExists, writeInside } from "../core/safe-fs.ts";
+import { isDeckName } from "../core/path.ts";
+import { readSourceIfExists, removeInside, writeInside } from "../core/safe-fs.ts";
 
 export type DevServerLock = {
   url: string;
@@ -88,30 +89,59 @@ export function readDevServerLock(root: string): DevServerLock | undefined {
   return undefined;
 }
 
-/** The URL of each root a server in this process holds, which two racing servers both see. */
-const claimedRoots = new Map<string, string>();
+/** The server each root a server in this process holds, which two racing servers both see. */
+const claimedRoots = new Map<string, Omit<DevServerLock, "password">>();
 
-/** Throw when a live server, in this process or another, already holds `root`. */
-export function assertNoDevServer(root: string): void {
+/**
+ * Throw when a live server, in this process or another, already holds `root`. `deck` is the one
+ * deck the server about to start would serve, none for the whole project.
+ */
+export function assertNoDevServer(root: string, deck?: string): void {
   const existing = readDevServerLock(root);
   const running =
-    claimedRoots.get(root) ?? (existing && isPidAlive(existing.pid) ? existing.url : undefined);
+    claimedRoots.get(root) ?? (existing && isPidAlive(existing.pid) ? existing : undefined);
   if (running !== undefined) {
-    throw new DekError(`dev server already running at ${running}`, {
+    throw new DekError(`dev server already running at ${running.url}`, {
       path: serverLockPath(root),
-      hint: `open ${running}`,
+      hint: runningServerHint(root, running, deck),
     });
   }
 }
 
+/**
+ * Where the running server shows what was asked for, or, when it serves one other deck only, how
+ * to get one that serves both: `dekc` started inside a deck's folder serves that deck alone.
+ */
+function runningServerHint(
+  root: string,
+  running: Omit<DevServerLock, "password">,
+  deck: string | undefined,
+): string {
+  if (running.deck === deck) {
+    return `open ${running.url}`;
+  }
+  if (running.deck === undefined && deck !== undefined) {
+    return `open ${running.url}decks/${encodeURIComponent(deck)}/`;
+  }
+  // The lock is a file a repository could bring along: name only a deck this project has.
+  const named =
+    running.deck !== undefined &&
+    isDeckName(running.deck) &&
+    existsSync(join(root, "decks", running.deck, "script.md"))
+      ? `decks/${running.deck}`
+      : "one deck";
+  const wanted = deck === undefined ? "the whole project" : `decks/${deck}`;
+  return `it serves only ${named}; to serve ${wanted}, stop it (pid ${running.pid}) and run \`dekc\` at the project root, which serves every deck`;
+}
+
 export function writeDevServerLock(
   root: string,
   url: string,
   password?: string,
   deck?: string,
 ): void {
-  assertNoDevServer(root);
-  claimedRoots.set(root, url);
+  assertNoDevServer(root, deck);
+  claimedRoots.set(root, { url, pid: process.pid, ...(deck ? { deck } : {}) });
   try {
     // A fresh file renamed into place, so it may hold the --remote password: its owner's only.
     writeInside(
@@ -133,8 +163,8 @@ export function removeDevServerLock(root: string): void {
     return;
   }
   try {
-    unlinkSync(serverLockPath(root));
+    removeInside(serverLockPath(root), root);
   } catch {
-    /* already gone */
+    /* a lock left behind names a process that is gone, which the next server sees */
   }
 }

package/src/server/serial.ts

@@ -1,3 +1,9 @@
+/**
+ * Runs `run` one at a time: a call while it runs queues one more run after it, however many
+ * calls come. Each caller's `run` reports its own failures, as diagnostics or a line on stderr;
+ * one that still throws is a bug, logged to the dev server's stderr as Bun.serve's error handler
+ * logs one, and the queued run still runs.
+ */
 export function createSerialTask(run: () => Promise<void>): () => void {
   let running = false;
   let queued = false;
@@ -13,8 +19,8 @@ export function createSerialTask(run: () => Promise<void>): () => void {
           queued = false;
           try {
             await run();
-          } catch {
-            /* keep draining the trailing run */
+          } catch (error) {
+            console.error(error);
           }
         } while (queued);
       } finally {

package/src/video/mux.ts

@@ -1,3 +1,4 @@
+// biome-ignore lint/style/noRestrictedImports: mkdtempSync, rmSync, and writeFileSync, for ffmpeg's frame list in a folder of its own in the system's temp folder.
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -5,16 +6,39 @@ import { DekError } from "../core/error.ts";
 import { runPiped, workerCommand } from "../core/spawn.ts";
 import type { VideoFrame } from "./recorder.ts";
 
-export function ffmpegResolved(): boolean {
+/** `ffmpeg -version` prints and exits at once; one that takes longer is stuck. */
+const FFMPEG_PROBE_TIMEOUT_MS = 10_000;
+
+/**
+ * True when ffmpeg is there to run: DEK_FFMPEG names one, or `ffmpeg -version` on PATH exits 0.
+ * An ffmpeg that does not answer within `timeoutMs` is killed, and is an error that says so.
+ */
+export function ffmpegResolved(timeoutMs = FFMPEG_PROBE_TIMEOUT_MS): boolean {
   if (process.env.DEK_FFMPEG) {
     return true;
   }
+  let result: Bun.SyncSubprocess<"ignore", "ignore">;
   try {
-    const result = Bun.spawnSync(["ffmpeg", "-version"], { stdout: "pipe", stderr: "pipe" });
-    return result.exitCode === 0;
+    // The environment as it is now, as runPiped passes it: left out, Bun passes the one dek
+    // started with. Nothing is piped, so a process it leaves behind cannot hold dek.
+    // biome-ignore lint/nursery/noJsRestrictedProperties: ffmpegResolved is synchronous, for tests too; the probe has its own timeout and SIGKILL, and the encode runs through runPiped.
+    result = Bun.spawnSync(["ffmpeg", "-version"], {
+      stdin: "ignore",
+      stdout: "ignore",
+      stderr: "ignore",
+      env: process.env,
+      timeout: timeoutMs,
+      killSignal: "SIGKILL",
+    });
   } catch {
     return false;
   }
+  if (result.exitedDueToTimeout) {
+    throw new DekError(`ffmpeg did not answer \`ffmpeg -version\` within ${timeoutMs / 1000}s`, {
+      hint: "check the ffmpeg on PATH, or set DEK_FFMPEG to an ffmpeg that runs, then run the command again",
+    });
+  }
+  return result.exitCode === 0;
 }
 
 function ffmpegCommand(args: string[]): string[] {

package/src/video/recorder.ts

@@ -1,7 +1,8 @@
 import { DekError } from "../core/error.ts";
 import { moduleFilePath } from "../core/path.ts";
 import { playwrightResolved } from "../core/playwright.ts";
-import { runJsonWorker, workerCommand } from "../core/spawn.ts";
+import { runDrawingWorker } from "../core/sandbox.ts";
+import { workerCommand } from "../core/spawn.ts";
 import type { Position } from "../core/step.ts";
 import { playbackSchedule, type Timeline } from "../core/timeline.ts";
 
@@ -85,7 +86,7 @@ function spawnVideoRunner(
   request: VideoCaptureRequest,
   options: { timeoutMs?: number },
 ): Promise<VideoCaptureResponse> {
-  return runJsonWorker(workerCommand(bin), request, parseVideoResponse, {
+  return runDrawingWorker(workerCommand(bin), request, parseVideoResponse, {
     label: "video capture failed",
     hint: "install Playwright or set DEK_VIDEO",
     ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),

package/src/video/worker.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+// biome-ignore lint/style/noRestrictedImports: mkdirSync, in a worker, for the folder its parent made with outputDir, which Chromium writes into.
 import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 import type { Browser } from "playwright";

package/src/voice/engine.ts

@@ -37,41 +37,78 @@ export function engineBaseUrl(engine: string): string {
   return `http://127.0.0.1:${resolved}`;
 }
 
-export async function fetchSpeakers(baseUrl: string): Promise<VoiceSpeaker[]> {
-  const res = await engineFetch(baseUrl, "/speakers");
-  return (await res.json()) as VoiceSpeaker[];
+export type EngineOptions = {
+  /** Covers the whole call, from connecting to the last byte of the answer. */
+  timeoutMs?: number;
+};
+
+/** /speakers and /version answer from what the engine has loaded; a stall this long is a hang. */
+const PROBE_TIMEOUT_MS = 10 * 1000;
+
+/** Reading a sentence's accents takes well under a second; this leaves room for a busy machine. */
+const QUERY_TIMEOUT_MS = 60 * 1000;
+
+/** Synthesis on a CPU can take longer than the sentence lasts; a long one fits inside this. */
+const SYNTHESIS_TIMEOUT_MS = 5 * 60 * 1000;
+
+export async function fetchSpeakers(
+  baseUrl: string,
+  options: EngineOptions = {},
+): Promise<VoiceSpeaker[]> {
+  return engineFetch(
+    baseUrl,
+    "/speakers",
+    options.timeoutMs ?? PROBE_TIMEOUT_MS,
+    (res) => res.json() as Promise<VoiceSpeaker[]>,
+  );
 }
 
-export async function fetchEngineVersion(baseUrl: string): Promise<string> {
-  const res = await engineFetch(baseUrl, "/version");
-  const text = (await res.text()).trim();
-  return text.replace(/^"|"$/g, "");
+export async function fetchEngineVersion(
+  baseUrl: string,
+  options: EngineOptions = {},
+): Promise<string> {
+  const text = await engineFetch(
+    baseUrl,
+    "/version",
+    options.timeoutMs ?? PROBE_TIMEOUT_MS,
+    (res) => res.text(),
+  );
+  return text.trim().replace(/^"|"$/g, "");
 }
 
 export async function fetchAudioQuery(
   baseUrl: string,
   text: string,
   speaker: number,
+  options: EngineOptions = {},
 ): Promise<AudioQuery> {
-  const res = await engineFetch(
+  return engineFetch(
     baseUrl,
     `/audio_query?text=${encodeURIComponent(text)}&speaker=${speaker}`,
+    options.timeoutMs ?? QUERY_TIMEOUT_MS,
+    (res) => res.json() as Promise<AudioQuery>,
     { method: "POST" },
   );
-  return (await res.json()) as AudioQuery;
 }
 
 export async function fetchSynthesis(
   baseUrl: string,
   query: AudioQuery,
   speaker: number,
+  options: EngineOptions = {},
 ): Promise<Buffer> {
-  const res = await engineFetch(baseUrl, `/synthesis?speaker=${speaker}`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(query),
-  });
-  return Buffer.from(await res.arrayBuffer());
+  const body = await engineFetch(
+    baseUrl,
+    `/synthesis?speaker=${speaker}`,
+    options.timeoutMs ?? SYNTHESIS_TIMEOUT_MS,
+    (res) => res.arrayBuffer(),
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(query),
+    },
+  );
+  return Buffer.from(body);
 }
 
 export function resolveStyleId(speakers: VoiceSpeaker[], speaker: string): number {
@@ -161,11 +198,30 @@ export async function withEngine<T>(
   }
 }
 
-async function engineFetch(baseUrl: string, path: string, init?: RequestInit): Promise<Response> {
+/**
+ * What the engine answers at `path`, read by `read` within `timeoutMs`. An engine that cannot be
+ * reached is missing; one that is reached but does not answer in time is stuck, and says so.
+ */
+async function engineFetch<T>(
+  baseUrl: string,
+  path: string,
+  timeoutMs: number,
+  read: (res: Response) => Promise<T>,
+  init?: RequestInit,
+): Promise<T> {
+  const signal = AbortSignal.timeout(timeoutMs);
+  const timedOut = () =>
+    new DekError(`voice engine did not answer ${path.split("?")[0]} within ${timeoutMs / 1000}s`, {
+      hint: "check the engine log, and restart the engine if it is stuck, then run the command again",
+    });
   let res: Response;
   try {
-    res = await fetch(`${baseUrl}${path}`, init);
+    // biome-ignore lint/style/noRestrictedGlobals: signal, an AbortSignal.timeout, bounds the request and read(res).
+    res = await fetch(`${baseUrl}${path}`, { ...init, signal });
   } catch {
+    if (signal.aborted) {
+      throw timedOut();
+    }
     throw engineMissingError(engineNameForUrl(baseUrl) ?? "voice engine", baseUrl);
   }
   if (!res.ok) {
@@ -173,5 +229,12 @@ async function engineFetch(baseUrl: string, path: string, init?: RequestInit): P
       hint: "check the engine log",
     });
   }
-  return res;
+  try {
+    return await read(res);
+  } catch (error) {
+    if (signal.aborted) {
+      throw timedOut();
+    }
+    throw error;
+  }
 }

package/tsconfig.json

@@ -22,5 +22,5 @@
     "noUnusedParameters": false,
     "noPropertyAccessFromIndexSignature": false
   },
-  "include": ["src", "tests"]
+  "include": ["src", "tests", "evals"]
 }