@hyperdrive.bot/paseo-server 0.2.6

package/dist/server/server/push/web-worker.d.ts

@@ -0,0 +1,44 @@
+import type pino from "pino";
+import type { PushTriggerEmitter } from "./triggers.js";
+import type { PushSubscriptionStore, WebPushSubscriptionJSON } from "./subscriptions.js";
+import type { VapidKeys } from "./vapid-keys.js";
+/**
+ * Story PASEO-CHAT-ACTIONS-V1-story-1.004 — Web Push delivery worker.
+ *
+ * Subscribes to the pushTrigger emitter (Story 1.1) and fans out to every
+ * registered Web Push subscription (Story 1.2). VAPID-signed via the keys
+ * from vapid-keys.ts. Honors PASEO_PUSH_ENABLED=false as the kill switch
+ * (mirrors expo-worker). Never crashes on dispatch failure.
+ */
+export interface WebSubscriptionStore {
+    list(): {
+        type: string;
+    }[];
+    removeWebSubscription(endpoint: string): void;
+}
+export interface WebWorkerEnv {
+    PASEO_PUSH_ENABLED?: string;
+}
+export interface WebPushClient {
+    sendNotification(subscription: WebPushSubscriptionJSON, payload: string, options: {
+        vapidDetails: {
+            subject: string;
+            publicKey: string;
+            privateKey: string;
+        };
+    }): Promise<unknown>;
+}
+export interface StartWebPushWorkerOptions {
+    pushTrigger: PushTriggerEmitter;
+    subscriptionStore: PushSubscriptionStore;
+    vapidKeys: VapidKeys;
+    logger: pino.Logger;
+    env?: WebWorkerEnv;
+    /** Override for tests. Production uses the `web-push` library default. */
+    client?: WebPushClient;
+}
+export interface WebPushWorker {
+    stop(): void;
+}
+export declare function startWebPushWorker(options: StartWebPushWorkerOptions): WebPushWorker;
+//# sourceMappingURL=web-worker.d.ts.map

package/dist/server/server/push/web-worker.js

@@ -0,0 +1,99 @@
+import webpush, { WebPushError } from "web-push";
+const TITLE_BY_KIND = {
+    completed: "Agent finished",
+    permission_needed: "Agent needs permission",
+    input_required: "Agent waiting for input",
+};
+export function startWebPushWorker(options) {
+    const { pushTrigger, subscriptionStore, vapidKeys, logger } = options;
+    const env = options.env ?? process.env;
+    const workerLogger = logger.child({ component: "web-push-worker" });
+    if (env.PASEO_PUSH_ENABLED === "false") {
+        workerLogger.info("web push worker disabled by PASEO_PUSH_ENABLED=false");
+        return { stop() { } };
+    }
+    const client = options.client ?? {
+        sendNotification: (sub, payload, opts) => webpush.sendNotification(sub, payload, opts),
+    };
+    workerLogger.info("web push worker started");
+    const unsubscribe = pushTrigger.on((payload) => {
+        void dispatch(payload).catch((err) => {
+            workerLogger.error({ err, sessionId: payload.sessionId, kind: payload.kind }, "web push dispatch failed");
+        });
+    });
+    async function dispatch(payload) {
+        const subs = subscriptionStore.list().filter((s) => s.type === "web");
+        if (subs.length === 0)
+            return;
+        const messageJson = JSON.stringify({
+            title: TITLE_BY_KIND[payload.kind],
+            body: payload.agentTitle,
+            data: {
+                deepLink: payload.deepLink,
+                webPath: payload.webPath,
+                serverId: payload.serverId,
+                kind: payload.kind,
+                agentId: payload.agentId,
+                sessionId: payload.sessionId,
+            },
+        });
+        await Promise.all(subs.map((sub) => sendOne(sub.subscription, messageJson, payload)));
+    }
+    async function sendOne(subscription, messageJson, payload) {
+        try {
+            await client.sendNotification(subscription, messageJson, {
+                vapidDetails: {
+                    subject: vapidKeys.subject,
+                    publicKey: vapidKeys.publicKey,
+                    privateKey: vapidKeys.privateKey,
+                },
+            });
+            workerLogger.debug({
+                vendor: vendorFromEndpoint(subscription.endpoint),
+                sessionId: payload.sessionId,
+                kind: payload.kind,
+            }, "[web-push] dispatched");
+        }
+        catch (error) {
+            handleSendError(error, subscription.endpoint, payload);
+        }
+    }
+    function handleSendError(error, endpoint, payload) {
+        const vendor = vendorFromEndpoint(endpoint);
+        const status = error instanceof WebPushError ? error.statusCode : undefined;
+        if (status === 404 || status === 410) {
+            subscriptionStore.removeWebSubscription(endpoint);
+            workerLogger.warn({ vendor, status, sessionId: payload.sessionId, kind: payload.kind }, "[web-push] subscription gone — removed from store");
+            return;
+        }
+        workerLogger.error({
+            err: error,
+            vendor,
+            status,
+            sessionId: payload.sessionId,
+            kind: payload.kind,
+        }, "[web-push] dispatch error");
+    }
+    return {
+        stop() {
+            unsubscribe();
+            workerLogger.info("web push worker stopped");
+        },
+    };
+}
+function vendorFromEndpoint(endpoint) {
+    try {
+        const host = new URL(endpoint).host;
+        if (host.includes("fcm.googleapis.com"))
+            return "chrome";
+        if (host.includes("web.push.apple.com"))
+            return "safari";
+        if (host.includes("mozilla.com"))
+            return "firefox";
+        return host;
+    }
+    catch {
+        return "unknown";
+    }
+}
+//# sourceMappingURL=web-worker.js.map

package/dist/server/server/relay-transport.d.ts

@@ -0,0 +1,31 @@
+import type pino from "pino";
+import { type KeyPair } from "@hyperdrive.bot/paseo-relay/e2ee";
+import type { ExternalSocketMetadata } from "./websocket-server.js";
+interface RelayTransportOptions {
+    logger: pino.Logger;
+    attachSocket: (ws: RelaySocketLike, metadata?: ExternalSocketMetadata) => Promise<void>;
+    relayEndpoint: string;
+    relayUseTls: boolean;
+    serverId: string;
+    daemonKeyPair?: KeyPair;
+    createWebSocket?: RelayWebSocketFactory;
+}
+export interface RelayTransportController {
+    stop: () => Promise<void>;
+}
+interface RelaySocketLike {
+    readyState: number;
+    send: (data: string | Uint8Array | ArrayBuffer) => void;
+    close: (code?: number, reason?: string) => void;
+    on: (event: "message" | "close" | "error", listener: (...args: unknown[]) => void) => void;
+    once: (event: "close" | "error", listener: (...args: unknown[]) => void) => void;
+}
+interface RelayWebSocketLike extends RelaySocketLike {
+    terminate: () => void;
+    ping: () => void;
+    on: (event: "open" | "message" | "close" | "error" | "pong", listener: (...args: unknown[]) => void) => void;
+}
+type RelayWebSocketFactory = (url: string) => RelayWebSocketLike;
+export declare function startRelayTransport({ logger, attachSocket, relayEndpoint, relayUseTls, serverId, daemonKeyPair, createWebSocket, }: RelayTransportOptions): RelayTransportController;
+export {};
+//# sourceMappingURL=relay-transport.d.ts.map

package/dist/server/server/relay-transport.js

@@ -0,0 +1,514 @@
+/// <reference lib="dom" />
+import { EventEmitter } from "node:events";
+import { WebSocket } from "ws";
+import { createDaemonChannel, } from "@hyperdrive.bot/paseo-relay/e2ee";
+import { buildRelayWebSocketUrl } from "@hyperdrive.bot/paseo-protocol/daemon-endpoints";
+const CONTROL_PING_INTERVAL_MS = 10000;
+const CONTROL_STALE_TIMEOUT_MS = 30000;
+const CONTROL_READY_TIMEOUT_MS = 8000;
+const RELAY_WEBSOCKET_OPTIONS = { handshakeTimeout: 10000, perMessageDeflate: false };
+function createDefaultRelayWebSocket(url) {
+    return new WebSocket(url, RELAY_WEBSOCKET_OPTIONS);
+}
+function normalizeRelaySendPayload(data) {
+    if (typeof data === "string")
+        return data;
+    if (data instanceof ArrayBuffer)
+        return data;
+    if (ArrayBuffer.isView(data)) {
+        const view = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+        const out = new Uint8Array(view.byteLength);
+        out.set(view);
+        return out.buffer;
+    }
+    return String(data);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function tryParseControlMessage(raw) {
+    try {
+        let text;
+        if (typeof raw === "string") {
+            text = raw;
+        }
+        else if (Buffer.isBuffer(raw)) {
+            text = raw.toString("utf8");
+        }
+        else {
+            text = String(raw);
+        }
+        const parsed = JSON.parse(text);
+        if (!isRecord(parsed))
+            return null;
+        if (parsed.type === "ping")
+            return { type: "ping" };
+        if (parsed.type === "pong")
+            return { type: "pong" };
+        if (parsed.type === "sync" && Array.isArray(parsed.connectionIds)) {
+            const connectionIds = parsed.connectionIds.filter((id) => typeof id === "string" && id.trim().length > 0);
+            return { type: "sync", connectionIds };
+        }
+        if (parsed.type === "connected" &&
+            typeof parsed.connectionId === "string" &&
+            parsed.connectionId.trim()) {
+            return { type: "connected", connectionId: parsed.connectionId.trim() };
+        }
+        if (parsed.type === "disconnected" &&
+            typeof parsed.connectionId === "string" &&
+            parsed.connectionId.trim()) {
+            return { type: "disconnected", connectionId: parsed.connectionId.trim() };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function startRelayTransport({ logger, attachSocket, relayEndpoint, relayUseTls, serverId, daemonKeyPair, createWebSocket = createDefaultRelayWebSocket, }) {
+    const relayLogger = logger.child({ module: "relay-transport" });
+    let stopped = false;
+    let controlWs = null;
+    let reconnectTimeout = null;
+    let reconnectAttempt = 0;
+    const dataSockets = new Map(); // connectionId -> ws
+    let controlKeepaliveInterval = null;
+    let controlReadyTimeout = null;
+    let controlLastSeenAt = 0;
+    let controlConnectionSeq = 0;
+    const stop = async () => {
+        stopped = true;
+        if (reconnectTimeout) {
+            clearTimeout(reconnectTimeout);
+            reconnectTimeout = null;
+        }
+        if (controlKeepaliveInterval) {
+            clearInterval(controlKeepaliveInterval);
+            controlKeepaliveInterval = null;
+        }
+        if (controlReadyTimeout) {
+            clearTimeout(controlReadyTimeout);
+            controlReadyTimeout = null;
+        }
+        if (controlWs) {
+            try {
+                controlWs.close();
+            }
+            catch {
+                // ignore
+            }
+            controlWs = null;
+        }
+        for (const ws of dataSockets.values()) {
+            try {
+                ws.close();
+            }
+            catch {
+                // ignore
+            }
+        }
+        dataSockets.clear();
+    };
+    const connectControl = () => {
+        if (stopped)
+            return;
+        const connectionId = ++controlConnectionSeq;
+        const url = buildRelayWebSocketUrl({
+            endpoint: relayEndpoint,
+            useTls: relayUseTls,
+            serverId,
+            role: "server",
+        });
+        const socket = createWebSocket(url);
+        controlWs = socket;
+        let controlConnected = false;
+        const markControlReady = () => {
+            if (controlWs !== socket)
+                return;
+            if (controlConnected)
+                return;
+            controlConnected = true;
+            reconnectAttempt = 0;
+            if (controlReadyTimeout) {
+                clearTimeout(controlReadyTimeout);
+                controlReadyTimeout = null;
+            }
+            relayLogger.info({ connectionId }, "relay_control_connected");
+        };
+        socket.on("open", () => {
+            if (controlWs !== socket)
+                return;
+            controlLastSeenAt = Date.now();
+            if (controlKeepaliveInterval) {
+                clearInterval(controlKeepaliveInterval);
+                controlKeepaliveInterval = null;
+            }
+            if (controlReadyTimeout) {
+                clearTimeout(controlReadyTimeout);
+                controlReadyTimeout = null;
+            }
+            controlReadyTimeout = setTimeout(() => {
+                if (stopped)
+                    return;
+                if (controlWs !== socket)
+                    return;
+                if (controlConnected)
+                    return;
+                relayLogger.warn({ url, connectionId, waitedMs: CONTROL_READY_TIMEOUT_MS }, "relay_control_ready_timeout_terminating");
+                try {
+                    socket.terminate();
+                }
+                catch {
+                    // ignore
+                }
+            }, CONTROL_READY_TIMEOUT_MS);
+            controlKeepaliveInterval = setInterval(() => {
+                if (stopped)
+                    return;
+                if (controlWs !== socket)
+                    return;
+                if (socket.readyState !== WebSocket.OPEN)
+                    return;
+                const now = Date.now();
+                const staleForMs = now - controlLastSeenAt;
+                // If the control socket is half-open or silently dropped, ws may never emit "close".
+                // Use a WebSocket protocol ping to detect staleness and force a reconnect.
+                // Cloudflare's runtime auto-responds to protocol pings at the edge without waking the
+                // hibernated relay Durable Object, so this keepalive does not incur DO CPU billing.
+                if (staleForMs > CONTROL_STALE_TIMEOUT_MS) {
+                    relayLogger.warn({ url, staleForMs, connectionId, staleTimeoutMs: CONTROL_STALE_TIMEOUT_MS }, "relay_control_stale_terminating");
+                    try {
+                        socket.terminate();
+                    }
+                    catch {
+                        // ignore
+                    }
+                    return;
+                }
+                try {
+                    socket.ping();
+                }
+                catch (error) {
+                    relayLogger.warn({ err: error, connectionId }, "relay_control_ping_send_failed");
+                    try {
+                        socket.terminate();
+                    }
+                    catch {
+                        // ignore
+                    }
+                }
+            }, CONTROL_PING_INTERVAL_MS);
+            try {
+                socket.ping();
+            }
+            catch (error) {
+                relayLogger.warn({ err: error, connectionId }, "relay_control_ping_send_failed");
+                try {
+                    socket.terminate();
+                }
+                catch {
+                    // ignore
+                }
+            }
+            relayLogger.debug({ connectionId }, "relay_control_open_waiting_for_ready");
+        });
+        socket.on("close", (code, reason) => {
+            if (controlWs !== socket)
+                return;
+            relayLogger.warn({ code, reason: reason?.toString?.(), url, connectionId }, "relay_control_disconnected");
+            controlWs = null;
+            if (controlKeepaliveInterval) {
+                clearInterval(controlKeepaliveInterval);
+                controlKeepaliveInterval = null;
+            }
+            if (controlReadyTimeout) {
+                clearTimeout(controlReadyTimeout);
+                controlReadyTimeout = null;
+            }
+            scheduleReconnect();
+        });
+        socket.on("error", (err) => {
+            if (controlWs !== socket)
+                return;
+            relayLogger.warn({ err, connectionId }, "relay_error");
+            // close event will schedule reconnect
+        });
+        socket.on("pong", () => {
+            if (controlWs !== socket)
+                return;
+            controlLastSeenAt = Date.now();
+            relayLogger.debug({ connectionId }, "relay_control_pong_received");
+        });
+        socket.on("message", (data) => {
+            if (controlWs !== socket)
+                return;
+            controlLastSeenAt = Date.now();
+            const msg = tryParseControlMessage(data);
+            if (msg) {
+                markControlReady();
+            }
+            if (!msg)
+                return;
+            if (msg.type === "ping") {
+                try {
+                    socket.send(JSON.stringify({ type: "pong", ts: Date.now() }));
+                }
+                catch {
+                    // ignore
+                }
+                return;
+            }
+            if (msg.type === "pong")
+                return;
+            if (msg.type === "sync") {
+                for (const clientConnectionId of msg.connectionIds) {
+                    ensureClientDataSocket(clientConnectionId);
+                }
+                return;
+            }
+            if (msg.type === "connected") {
+                ensureClientDataSocket(msg.connectionId);
+                return;
+            }
+            if (msg.type === "disconnected") {
+                const existing = dataSockets.get(msg.connectionId);
+                if (existing) {
+                    try {
+                        existing.close(1001, "Client disconnected");
+                    }
+                    catch {
+                        // ignore
+                    }
+                    dataSockets.delete(msg.connectionId);
+                }
+            }
+        });
+    };
+    const scheduleReconnect = () => {
+        if (stopped)
+            return;
+        if (reconnectTimeout)
+            return;
+        reconnectAttempt += 1;
+        const delayMs = Math.min(30000, 1000 * reconnectAttempt);
+        reconnectTimeout = setTimeout(() => {
+            reconnectTimeout = null;
+            connectControl();
+        }, delayMs);
+    };
+    const ensureClientDataSocket = (connectionId) => {
+        if (stopped)
+            return;
+        if (!connectionId)
+            return;
+        if (dataSockets.has(connectionId))
+            return;
+        const url = buildRelayWebSocketUrl({
+            endpoint: relayEndpoint,
+            useTls: relayUseTls,
+            serverId,
+            role: "server",
+            connectionId,
+        });
+        const socket = createWebSocket(url);
+        dataSockets.set(connectionId, socket);
+        let attached = false;
+        const openTimeout = setTimeout(() => {
+            if (stopped)
+                return;
+            if (socket.readyState === WebSocket.OPEN)
+                return;
+            relayLogger.warn({ connectionId }, "relay_data_open_timeout_terminating");
+            try {
+                socket.terminate();
+            }
+            catch {
+                // ignore
+            }
+        }, 15000);
+        socket.on("open", () => {
+            clearTimeout(openTimeout);
+            relayLogger.info({ connectionId }, "relay_data_connected");
+            if (attached)
+                return;
+            attached = true;
+            const externalMetadata = {
+                transport: "relay",
+                externalSessionKey: `session:${connectionId}`,
+                relayConnectionId: connectionId,
+            };
+            if (daemonKeyPair) {
+                void attachEncryptedSocket(socket, daemonKeyPair, relayLogger.child({ connectionId }), attachSocket, externalMetadata);
+            }
+            else {
+                void attachSocket(socket, externalMetadata);
+            }
+        });
+        socket.on("close", (code, reason) => {
+            clearTimeout(openTimeout);
+            relayLogger.warn({ code, reason: reason?.toString?.(), url, connectionId }, "relay_data_disconnected");
+            if (dataSockets.get(connectionId) === socket) {
+                dataSockets.delete(connectionId);
+            }
+        });
+        socket.on("error", (err) => {
+            relayLogger.warn({ err, connectionId }, "relay_data_error");
+        });
+    };
+    connectControl();
+    return { stop };
+}
+async function attachEncryptedSocket(socket, daemonKeyPair, logger, attachSocket, metadata) {
+    try {
+        const relayTransport = createRelayTransportAdapter(socket, logger);
+        const emitter = new EventEmitter();
+        const pendingMessages = [];
+        let attached = false;
+        const emitMessage = (data) => {
+            if (attached) {
+                emitter.emit("message", data);
+                return;
+            }
+            pendingMessages.push(data);
+        };
+        const channel = await createDaemonChannel(relayTransport, daemonKeyPair, {
+            onmessage: emitMessage,
+            onclose: (code, reason) => emitter.emit("close", code, reason),
+            onerror: (error) => {
+                logger.warn({ err: error }, "relay_e2ee_error");
+                emitter.emit("error", error);
+            },
+        });
+        const encryptedSocket = createEncryptedSocket(channel, emitter);
+        await attachSocket(encryptedSocket, metadata);
+        attached = true;
+        for (const message of pendingMessages) {
+            emitter.emit("message", message);
+        }
+        pendingMessages.length = 0;
+    }
+    catch (error) {
+        logger.warn({ err: error }, "relay_e2ee_handshake_failed");
+        try {
+            socket.close(1011, "E2EE handshake failed");
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+function createRelayTransportAdapter(socket, logger) {
+    const relayTransport = {
+        send: (data) => {
+            try {
+                socket.send(data);
+            }
+            catch (err) {
+                // Socket likely transitioned to closed between checks; let onclose/onerror
+                // drive cleanup. Without this guard the synchronous throw would propagate
+                // up as an uncaughtException and take down the daemon.
+                logger.warn({ err }, "relay_socket_send_failed");
+            }
+        },
+        close: (code, reason) => socket.close(code, reason),
+        onmessage: null,
+        onclose: null,
+        onerror: null,
+    };
+    socket.on("message", (data, isBinary) => {
+        relayTransport.onmessage?.(normalizeMessageData(data, isBinary === true));
+    });
+    socket.on("close", (code, reason) => {
+        const closeCode = typeof code === "number" ? code : 1006;
+        relayTransport.onclose?.(closeCode, String(reason ?? ""));
+    });
+    socket.on("error", (err) => {
+        relayTransport.onerror?.(err instanceof Error ? err : new Error(String(err)));
+    });
+    return relayTransport;
+}
+function createEncryptedSocket(channel, emitter) {
+    let readyState = 1;
+    channel.setState("open");
+    const close = (code, reason) => {
+        if (readyState === 3)
+            return;
+        readyState = 3;
+        channel.close(code, reason);
+    };
+    emitter.on("close", () => {
+        if (readyState === 3)
+            return;
+        readyState = 3;
+    });
+    return {
+        get readyState() {
+            return readyState;
+        },
+        send: (data) => {
+            const outbound = normalizeRelaySendPayload(data);
+            void channel.send(outbound).catch((error) => {
+                emitter.emit("error", error);
+            });
+        },
+        close,
+        on: (event, listener) => {
+            emitter.on(event, listener);
+        },
+        once: (event, listener) => {
+            emitter.once(event, listener);
+        },
+    };
+}
+function normalizeMessageData(data, isBinary) {
+    if (!isBinary) {
+        if (typeof data === "string")
+            return data;
+        const buffer = bufferFromWsData(data);
+        if (buffer)
+            return buffer.toString("utf8");
+        return String(data);
+    }
+    if (data instanceof ArrayBuffer)
+        return data;
+    const buffer = bufferFromWsData(data);
+    if (buffer) {
+        const view = new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+        const out = new Uint8Array(view.byteLength);
+        out.set(view);
+        return out.buffer;
+    }
+    return String(data);
+}
+function bufferFromWsData(data) {
+    if (Buffer.isBuffer(data))
+        return data;
+    if (Array.isArray(data)) {
+        const buffers = [];
+        for (const part of data) {
+            if (Buffer.isBuffer(part)) {
+                buffers.push(part);
+            }
+            else if (part instanceof ArrayBuffer) {
+                buffers.push(Buffer.from(part));
+            }
+            else if (ArrayBuffer.isView(part)) {
+                buffers.push(Buffer.from(part.buffer, part.byteOffset, part.byteLength));
+            }
+            else if (typeof part === "string") {
+                buffers.push(Buffer.from(part, "utf8"));
+            }
+            else {
+                return null;
+            }
+        }
+        return Buffer.concat(buffers);
+    }
+    if (data instanceof ArrayBuffer)
+        return Buffer.from(data);
+    if (ArrayBuffer.isView(data)) {
+        return Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+    }
+    return null;
+}
+//# sourceMappingURL=relay-transport.js.map

package/dist/server/server/resolve-workspace-id-for-path.d.ts

@@ -0,0 +1,3 @@
+import type { PersistedWorkspaceRecord } from "./workspace-registry.js";
+export declare function resolveWorkspaceIdForPath(cwd: string, workspaces: Iterable<PersistedWorkspaceRecord>): string | null;
+//# sourceMappingURL=resolve-workspace-id-for-path.d.ts.map