@konglx/rotom 2.21.0

package/dist/master/share-tokens.js

@@ -0,0 +1,56 @@
+/**
+ * Digital Employee Mesh — Share Token Store
+ *
+ * Ephemeral, in-memory only. Powers the dashboard's "Share" / visitor mode:
+ * any Dashboard user can mint a `share_<hex>` token bound to a single group,
+ * copy the resulting URL, and grant a third-party read-only access to the
+ * group's messages / issues / artifacts / notes — without exposing the agent
+ * token and without persisting anything.
+ *
+ * Lifetime: process memory only. All tokens vanish on Master restart.
+ * Tokens can also be revoked explicitly via `revoke()`. No expiry by default
+ * (per requirement: "in-memory only, no persistence"); if a TTL is desired
+ * later, add it here without changing the public interface.
+ */
+import { randomBytes } from "node:crypto";
+export class ShareTokenStore {
+    tokens = new Map();
+    /** Mint a new share token bound to `groupId`, created by `createdBy`. */
+    create(groupId, createdBy) {
+        const token = `share_${randomBytes(16).toString("hex")}`;
+        const record = {
+            token,
+            groupId,
+            createdBy,
+            createdAt: Date.now(),
+        };
+        this.tokens.set(token, record);
+        return record;
+    }
+    /** Look up a token. Returns undefined if unknown / revoked. */
+    resolve(token) {
+        return this.tokens.get(token);
+    }
+    /** Revoke a token. Returns true if a token was removed. */
+    revoke(token) {
+        return this.tokens.delete(token);
+    }
+    /** List all tokens a given creator has minted (for UI / cleanup). */
+    listByCreator(createdBy) {
+        const out = [];
+        for (const r of this.tokens.values()) {
+            if (r.createdBy === createdBy)
+                out.push(r);
+        }
+        return out;
+    }
+    /** List all tokens currently bound to a group. */
+    listByGroup(groupId) {
+        const out = [];
+        for (const r of this.tokens.values()) {
+            if (r.groupId === groupId)
+                out.push(r);
+        }
+        return out;
+    }
+}

package/dist/master/terminal-hub.js

@@ -0,0 +1,300 @@
+/**
+ * Web terminal hub — bridges browser xterm.js to a node-pty shell rooted in
+ * the group's working directory.
+ *
+ * Wire protocol (JSON over WS):
+ *   client → server  {type:"input",  data:string}
+ *                    {type:"resize", cols:number, rows:number}
+ *   server → client  {type:"output", data:string}
+ *                    {type:"exit",   code:number|null, signal:number|null}
+ *                    {type:"error",  message:string}
+ *
+ * Mounted on /api/terminal via httpServer 'upgrade' so it shares the master's
+ * single port without touching the agent-protocol WSHub.
+ *
+ * node-pty is loaded lazily. If it isn't installed (optionalDependency), the
+ * hub starts in a disabled state and rejects upgrades with 503 — keeping the
+ * rest of the master functional.
+ */
+import { URL } from "node:url";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { WebSocketServer, WebSocket } from "ws";
+import { resolveGroupArtifactRoot } from "./group-paths.js";
+import { decodeJson } from "../shared/json-codec.js";
+const TERMINAL_PATH = "/api/terminal";
+const DEFAULT_COLS = 80;
+const DEFAULT_ROWS = 24;
+async function loadPty(logger) {
+    try {
+        // Built as a runtime expression so tsc doesn't try to resolve the
+        // optional `node-pty` package at build time. The module ships with
+        // its own bundled .d.ts which we don't depend on (PtyModule above
+        // captures the surface we actually use).
+        const moduleName = "node-pty";
+        const mod = (await import(moduleName));
+        return mod.default ?? mod;
+    }
+    catch (err) {
+        logger.warn("[terminal] node-pty unavailable; web terminal disabled. " +
+            "Run `pnpm install` (or `npm i node-pty`) to enable.", err instanceof Error ? err.message : err);
+        return null;
+    }
+}
+export class TerminalHub {
+    httpServer;
+    db;
+    logger;
+    wss = null;
+    pty = null;
+    upgradeHandler = null;
+    delegatedUpgradeListeners = [];
+    sessions = new Set();
+    constructor(httpServer, db, logger) {
+        this.httpServer = httpServer;
+        this.db = db;
+        this.logger = logger;
+    }
+    async start() {
+        this.pty = await loadPty(this.logger);
+        // WSHub constructs `WebSocketServer({ server, path: "/ws" })`, which adds
+        // its own upgrade listener that aborts handshakes for any path other
+        // than /ws. If we just `httpServer.on('upgrade', …)` alongside it, both
+        // listeners fire — and WSHub's `abortHandshake` destroys our socket
+        // milliseconds after we accept it. To avoid touching WSHub, we capture
+        // the existing upgrade listeners, take over as the sole listener, and
+        // delegate non-terminal paths back to them.
+        this.delegatedUpgradeListeners = this.httpServer
+            .listeners("upgrade")
+            .slice();
+        this.httpServer.removeAllListeners("upgrade");
+        if (!this.pty) {
+            this.upgradeHandler = (req, socket, head) => {
+                if (this.matchPath(req)) {
+                    this.rejectUpgrade(socket, 503, "node-pty not installed");
+                    return;
+                }
+                this.delegateUpgrade(req, socket, head);
+            };
+            this.httpServer.on("upgrade", this.upgradeHandler);
+            return;
+        }
+        this.wss = new WebSocketServer({ noServer: true });
+        this.upgradeHandler = (req, socket, head) => {
+            if (!this.matchPath(req)) {
+                this.delegateUpgrade(req, socket, head);
+                return;
+            }
+            const parsed = this.parseTarget(req);
+            if (!parsed) {
+                this.rejectUpgrade(socket, 400, "missing groupId or cwd");
+                return;
+            }
+            // Standalone (cwd) mode skips the group lookup entirely; groupId mode
+            // still resolves through the db so it picks up the group's working_dir
+            // override (or the default ~/.rotom/artifacts/<groupId>).
+            const cwd = parsed.kind === "cwd"
+                ? parsed.cwd
+                : resolveGroupArtifactRoot(this.db, parsed.groupId);
+            const label = parsed.kind === "cwd" ? "standalone" : parsed.groupId;
+            this.wss.handleUpgrade(req, socket, head, (ws) => {
+                this.handleConnection(ws, label, cwd);
+            });
+        };
+        this.httpServer.on("upgrade", this.upgradeHandler);
+        this.logger.info(`[terminal] hub ready at ws path ${TERMINAL_PATH}`);
+    }
+    stop() {
+        if (this.upgradeHandler) {
+            this.httpServer.off("upgrade", this.upgradeHandler);
+            this.upgradeHandler = null;
+            // Restore the listeners we hijacked so other subsystems keep working
+            // if the process keeps running after a TerminalHub-only stop.
+            for (const fn of this.delegatedUpgradeListeners) {
+                this.httpServer.on("upgrade", fn);
+            }
+            this.delegatedUpgradeListeners = [];
+        }
+        if (this.wss) {
+            this.wss.close();
+            this.wss = null;
+        }
+    }
+    delegateUpgrade(req, socket, head) {
+        if (this.delegatedUpgradeListeners.length === 0) {
+            // No other handler registered → match Node's default and 400 the
+            // unsolicited upgrade rather than leaving the socket open.
+            this.rejectUpgrade(socket, 400, "no upgrade handler");
+            return;
+        }
+        for (const fn of this.delegatedUpgradeListeners) {
+            try {
+                fn.call(this.httpServer, req, socket, head);
+            }
+            catch (err) {
+                this.logger.warn("[terminal] delegated upgrade listener threw:", err);
+            }
+        }
+    }
+    matchPath(req) {
+        if (!req.url)
+            return false;
+        // url is /api/terminal?groupId=...; strip query
+        const idx = req.url.indexOf("?");
+        const pathname = idx >= 0 ? req.url.slice(0, idx) : req.url;
+        return pathname === TERMINAL_PATH;
+    }
+    parseTarget(req) {
+        try {
+            const url = new URL(req.url || "", "http://localhost");
+            const cwdParam = url.searchParams.get("cwd");
+            if (cwdParam) {
+                // Accept any absolute path the master process can actually open.
+                // The shell already has full local-user privileges, so this isn't
+                // a privilege boundary — we just reject obviously-malformed input
+                // so we don't hand node-pty something unusable.
+                const trimmed = cwdParam.trim();
+                if (!trimmed || trimmed.length > 1024)
+                    return null;
+                if (!path.isAbsolute(trimmed))
+                    return null;
+                return { kind: "cwd", cwd: trimmed };
+            }
+            const id = url.searchParams.get("groupId");
+            if (id && /^[A-Za-z0-9_-]+$/.test(id)) {
+                return { kind: "group", groupId: id };
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    rejectUpgrade(socket, status, reason) {
+        const text = `HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\n\r\n`;
+        try {
+            socket.write(text);
+        }
+        catch {
+            /* ignore */
+        }
+        socket.destroy();
+    }
+    handleConnection(ws, sessionLabel, cwd) {
+        if (!this.pty) {
+            ws.close(1011, "pty unavailable");
+            return;
+        }
+        const sessionId = `${sessionLabel}:${Date.now()}:${Math.random().toString(36).slice(2, 8)}`;
+        this.sessions.add(sessionId);
+        // posix_spawnp from node-pty fails with a opaque "posix_spawnp failed"
+        // when cwd doesn't exist. The group's working_dir or the default
+        // ~/.rotom/artifacts/<groupId> may have never been created. Make sure
+        // we hand the pty a real, traversable directory.
+        let spawnCwd = cwd;
+        try {
+            fs.mkdirSync(spawnCwd, { recursive: true });
+        }
+        catch (err) {
+            this.logger.warn(`[terminal] cannot create cwd ${spawnCwd}, falling back to $HOME:`, err);
+            spawnCwd = os.homedir();
+        }
+        if (!fs.existsSync(spawnCwd))
+            spawnCwd = os.homedir();
+        const shell = process.env.SHELL || "/bin/bash";
+        let term;
+        try {
+            term = this.pty.spawn(shell, ["-l"], {
+                name: "xterm-color",
+                cols: DEFAULT_COLS,
+                rows: DEFAULT_ROWS,
+                cwd: spawnCwd,
+                env: { ...process.env, TERM: "xterm-256color" },
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.logger.error(`[terminal] spawn failed for session=${sessionLabel} shell=${shell} cwd=${spawnCwd}: ${msg}`);
+            try {
+                ws.send(JSON.stringify({
+                    type: "error",
+                    message: `spawn failed (shell=${shell}, cwd=${spawnCwd}): ${msg}`,
+                }));
+            }
+            catch { /* ignore */ }
+            ws.close(1011, "spawn failed");
+            this.sessions.delete(sessionId);
+            return;
+        }
+        this.logger.info(`[terminal] session ${sessionId} pid=${term.pid} cwd=${spawnCwd}`);
+        const dataSub = term.onData((data) => {
+            if (ws.readyState !== WebSocket.OPEN)
+                return;
+            try {
+                ws.send(JSON.stringify({ type: "output", data }));
+            }
+            catch (err) {
+                this.logger.warn(`[terminal] send failed for ${sessionId}:`, err);
+            }
+        });
+        const exitSub = term.onExit(({ exitCode, signal }) => {
+            try {
+                if (ws.readyState === WebSocket.OPEN) {
+                    ws.send(JSON.stringify({ type: "exit", code: exitCode, signal: signal ?? null }));
+                }
+            }
+            catch { /* ignore */ }
+            try {
+                ws.close(1000, "pty exit");
+            }
+            catch { /* ignore */ }
+        });
+        ws.on("message", (raw) => {
+            const m = decodeJson(raw);
+            if (!m || typeof m !== "object")
+                return;
+            if (m.type === "input" && typeof m.data === "string") {
+                try {
+                    term.write(m.data);
+                }
+                catch (err) {
+                    this.logger.warn(`[terminal] write failed for ${sessionId}:`, err);
+                }
+            }
+            else if (m.type === "resize" && typeof m.cols === "number" && typeof m.rows === "number") {
+                const cols = Math.max(1, Math.min(500, Math.floor(m.cols)));
+                const rows = Math.max(1, Math.min(200, Math.floor(m.rows)));
+                try {
+                    term.resize(cols, rows);
+                }
+                catch (err) {
+                    this.logger.warn(`[terminal] resize failed for ${sessionId}:`, err);
+                }
+            }
+        });
+        const cleanup = () => {
+            if (!this.sessions.has(sessionId))
+                return;
+            this.sessions.delete(sessionId);
+            try {
+                dataSub.dispose();
+            }
+            catch { /* ignore */ }
+            try {
+                exitSub.dispose();
+            }
+            catch { /* ignore */ }
+            try {
+                term.kill();
+            }
+            catch { /* ignore */ }
+            this.logger.info(`[terminal] session ${sessionId} closed`);
+        };
+        ws.on("close", cleanup);
+        ws.on("error", (err) => {
+            this.logger.warn(`[terminal] ws error for ${sessionId}:`, err);
+            cleanup();
+        });
+    }
+}

package/dist/master/uploads.js

@@ -0,0 +1,108 @@
+/**
+ * Image upload storage helpers.
+ *
+ * Uploads land under `~/.rotom/uploads/<YYYY-MM>/<groupId>/<file>` so that:
+ *   • per-month top-level buckets make "delete everything older than X" a
+ *     single `rm -rf` on a date-prefixed directory
+ *   • per-group subdirectory keeps a single upload dir from filling up and
+ *     gives the URL a natural groupId segment for auth/scoping
+ *   • filename embeds `YYYYMMDD-HHmmss` so files remain sortable/cleanable
+ *     even if someone flattens the month buckets later
+ *
+ * URL → disk mapping is `/api/uploads/<groupId>/<filename>` (no DB lookup).
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+import { toBeijingCompact, toBeijingYearMonth } from "../shared/time.js";
+export const UPLOADS_ROOT = path.join(os.homedir(), ".rotom", "uploads");
+/** Hard ceiling on a single upload's decoded byte length (matches express.json
+ *  limit in server.ts — keep them in sync). */
+export const MAX_UPLOAD_BYTES = 15 * 1024 * 1024;
+const MIME_TO_EXT = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/gif": "gif",
+    "image/webp": "webp",
+};
+const EXT_TO_MIME = {
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+};
+export function extFromMime(mimeType) {
+    return MIME_TO_EXT[mimeType.toLowerCase()] ?? null;
+}
+export function mimeFromExt(ext) {
+    return EXT_TO_MIME[ext.toLowerCase().replace(/^\./, "")] ?? null;
+}
+export function isAllowedMime(mimeType) {
+    return mimeType.toLowerCase() in MIME_TO_EXT;
+}
+/** Validate an inbound upload. Returns a normalised mimeType + ext on success. */
+export function validateUpload(fileName, mimeType, sizeBytes) {
+    if (typeof fileName !== "string" || !fileName.trim()) {
+        return { ok: false, error: "fileName is required" };
+    }
+    if (typeof mimeType !== "string" || !isAllowedMime(mimeType)) {
+        return {
+            ok: false,
+            error: `mimeType not supported (allowed: ${Object.keys(MIME_TO_EXT).join(", ")})`,
+        };
+    }
+    if (!Number.isFinite(sizeBytes) || sizeBytes <= 0) {
+        return { ok: false, error: "size must be > 0" };
+    }
+    if (sizeBytes > MAX_UPLOAD_BYTES) {
+        return {
+            ok: false,
+            error: `file too large: ${sizeBytes} bytes > ${MAX_UPLOAD_BYTES} bytes`,
+        };
+    }
+    const ext = extFromMime(mimeType);
+    return { ok: true, mimeType: mimeType.toLowerCase(), ext };
+}
+/** `<YYYYMMDD-HHmmss>-<rand6hex>.<ext>` — sortable + collision-resistant. */
+export function generateUploadFileName(ext) {
+    const stamp = toBeijingCompact();
+    const rand = randomBytes(3).toString("hex");
+    return `${stamp}-${rand}.${ext}`;
+}
+/**
+ * Resolve the on-disk directory for a (groupId, now) tuple, creating it.
+ * Returns `{ dir, monthDir }` so callers can build the absolute path.
+ */
+export function resolveUploadDir(groupId) {
+    const monthDir = toBeijingYearMonth();
+    const dir = path.join(UPLOADS_ROOT, monthDir, groupId);
+    fs.mkdirSync(dir, { recursive: true });
+    return { dir, monthDir };
+}
+/**
+ * Resolve and verify an absolute path for an inbound (groupId, fileName)
+ * GET request. Returns null when the path would escape the group's upload
+ * directory or when fileName is malformed.
+ */
+export function safeResolveUploadPath(groupId, fileName) {
+    if (!fileName || fileName.includes("/") || fileName.includes("\\"))
+        return null;
+    if (fileName.startsWith("."))
+        return null;
+    // Walk every <YYYY-MM> bucket — uploads historically lived under any month.
+    // Cheap operation: typically <100 month buckets.
+    if (!fs.existsSync(UPLOADS_ROOT))
+        return null;
+    for (const entry of fs.readdirSync(UPLOADS_ROOT)) {
+        const candidate = path.join(UPLOADS_ROOT, entry, groupId, fileName);
+        const resolved = path.resolve(candidate);
+        const groupRoot = path.resolve(path.join(UPLOADS_ROOT, entry, groupId));
+        if (!resolved.startsWith(groupRoot + path.sep))
+            continue;
+        if (fs.existsSync(resolved))
+            return resolved;
+    }
+    return null;
+}

package/dist/master/util/fs.js

@@ -0,0 +1,100 @@
+/**
+ * File-tree walking + content-read helpers shared by artifact endpoints.
+ *
+ * Previously duplicated between `api/artifacts.ts` (statSync-based, follows
+ * symlinks — needed so extraRepo mountPath symlinks walk as directories) and
+ * `api/share.ts` (older Dirent-based copy that missed symlinked dirs). The
+ * shared `walkDir` keeps the statSync behaviour; the share endpoint now
+ * benefits from the same symlink handling.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { toBeijing } from "../../shared/time.js";
+/** Files we serve back as base64 (everything else is read as utf-8 text). */
+export const BINARY_EXTS = new Set([
+    ".png", ".jpg", ".jpeg", ".gif", ".ico",
+    ".woff", ".woff2", ".ttf", ".eot",
+    ".pdf", ".zip",
+]);
+/** Single-file content cap. Larger files are returned as a placeholder string. */
+export const MAX_CONTENT_SIZE = 500 * 1024;
+/**
+ * Recursive directory walk. Skips dotfiles and `node_modules`. Uses
+ * `fs.statSync` (follows symlinks) so symlinked directories are walked into
+ * rather than reported as files. Sorts directories-first, then by name.
+ */
+export function walkDir(dir, base) {
+    const entries = [];
+    let items;
+    try {
+        items = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return entries;
+    }
+    for (const item of items) {
+        if (item.name.startsWith("."))
+            continue;
+        if (item.name === "node_modules")
+            continue;
+        const fullPath = path.join(dir, item.name);
+        const relPath = path.relative(base, fullPath);
+        let stat;
+        try {
+            stat = fs.statSync(fullPath);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isDirectory()) {
+            entries.push({
+                name: item.name,
+                path: relPath,
+                absPath: fullPath,
+                size: 0,
+                modifiedTime: toBeijing(stat.mtime),
+                type: "directory",
+                children: walkDir(fullPath, base),
+            });
+        }
+        else if (stat.isFile()) {
+            entries.push({
+                name: item.name,
+                path: relPath,
+                absPath: fullPath,
+                size: stat.size,
+                modifiedTime: toBeijing(stat.mtime),
+                type: "file",
+            });
+        }
+    }
+    entries.sort((a, b) => {
+        if (a.type !== b.type)
+            return a.type === "directory" ? -1 : 1;
+        return a.name.localeCompare(b.name);
+    });
+    return entries;
+}
+/**
+ * Resolve `relPath` against `baseDir`, enforce containment, and read the
+ * file as either utf-8 text or base64 (per `BINARY_EXTS`). Files larger than
+ * `MAX_CONTENT_SIZE` are reported as `too-large` so the caller can return the
+ * placeholder text the dashboard expects.
+ */
+export function readFileSafely(baseDir, relPath) {
+    const resolved = path.resolve(baseDir, relPath);
+    if (!resolved.startsWith(path.resolve(baseDir)))
+        return { kind: "outside-base" };
+    if (!fs.existsSync(resolved))
+        return { kind: "missing" };
+    const stat = fs.statSync(resolved);
+    if (stat.size > MAX_CONTENT_SIZE)
+        return { kind: "too-large", size: stat.size };
+    const ext = path.extname(resolved).toLowerCase();
+    if (BINARY_EXTS.has(ext)) {
+        const buf = fs.readFileSync(resolved);
+        return { kind: "ok", content: buf.toString("base64"), type: "binary", size: stat.size };
+    }
+    const content = fs.readFileSync(resolved, "utf-8");
+    return { kind: "ok", content, type: "text", size: stat.size };
+}

package/dist/master/util/paths.js

@@ -0,0 +1,50 @@
+/**
+ * Filesystem-path validation helpers shared across master/api handlers.
+ *
+ * `validateWorkingDir` was previously duplicated byte-for-byte in
+ * `api/groups.ts` and `api/issues.ts`; both handlers need to coerce a
+ * user-supplied working_dir string into a resolved, accessible directory.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Coerce a user-supplied working_dir string into a resolved, accessible
+ * directory path. Expands `~` / `~/...`, requires an absolute path, and
+ * verifies the path is an existing directory with R+X permissions.
+ */
+export function validateWorkingDir(input) {
+    if (typeof input !== "string")
+        return { ok: false, error: "working_dir must be a string" };
+    const raw = input.trim();
+    if (!raw)
+        return { ok: false, error: "working_dir is empty" };
+    let expanded = raw;
+    if (raw === "~")
+        expanded = os.homedir();
+    else if (raw.startsWith("~/"))
+        expanded = path.join(os.homedir(), raw.slice(2));
+    if (!path.isAbsolute(expanded)) {
+        return { ok: false, error: `working_dir must be an absolute path (got: ${raw})` };
+    }
+    const resolved = path.resolve(expanded);
+    let stat;
+    try {
+        stat = fs.statSync(resolved);
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return { ok: false, error: `工作目录不存在: ${resolved}` };
+        return { ok: false, error: `工作目录无法访问: ${resolved} (${err?.code ?? err?.message ?? "unknown"})` };
+    }
+    if (!stat.isDirectory()) {
+        return { ok: false, error: `工作目录不是一个目录: ${resolved}` };
+    }
+    try {
+        fs.accessSync(resolved, fs.constants.R_OK | fs.constants.X_OK);
+    }
+    catch {
+        return { ok: false, error: `工作目录无读取/进入权限: ${resolved}` };
+    }
+    return { ok: true, path: resolved };
+}

package/dist/master/util/persona.js

@@ -0,0 +1,10 @@
+/**
+ * 群里所有定时任务的人设名。
+ *
+ * 不是 LLM —— 只是一个跑腿的 scheduler:到点检查某 agent 有没有回复,
+ * 有就汇报、没就升级。所有用户可见处(系统消息、Dashboard 列表、#reply 胶囊)
+ * 统一挂这个名字,避免出现 ask-bridge:<uuid> 这种机器脸。
+ *
+ * 名字取自鲁滨逊的仆人"星期五":忠实跑腿、传话、汇报。
+ */
+export const TIMER_PERSONA_NAME = "星期五";