@lelouchhe/webagent 0.4.0 → 0.6.0

package/lib/routes.js

@@ -17,6 +17,7 @@ const slog = rlog.scope("session");
 const mlog = rlog.scope("msg");
 import { signAttachmentUrl, verifyAttachmentSig, reSignAttachmentUrlsInJson, } from "./auth.js";
 import { buildContentDisposition, classifyKind, isInlineMime, mimeToExt, normalizeDisplayName, sniffMime, } from "./attachments.js";
+import { readImageDimensions } from "./image-dimensions.js";
 const IS_WIN = process.platform === "win32";
 const SAFE_ID = /^[a-zA-Z0-9_-]+$/;
 const MIME = {
@@ -30,6 +31,8 @@ const MIME = {
     ".jpeg": "image/jpeg",
     ".gif": "image/gif",
     ".webp": "image/webp",
+    ".woff2": "font/woff2",
+    ".wasm": "application/wasm",
 };
 /**
  * HTML entrypoints served by this app. Any new HTML page MUST be registered
@@ -51,7 +54,10 @@ export const HTML_ENTRYPOINTS = [
  *
  *  - default-src 'self': everything same-origin only
  *  - img-src adds data: + blob: for image-upload preview
- *  - script-src 'self' (no inline; theme bootstrap is /theme-init.js)
+ *  - script-src 'self' 'wasm-unsafe-eval' (no inline; theme bootstrap is
+ *    /theme-init.js. 'wasm-unsafe-eval' is the narrow CSP3 token that
+ *    permits WebAssembly.instantiate() WITHOUT re-enabling eval()/Function;
+ *    needed by any wasm consumer.)
  *  - style-src 'self' (no inline; login styles live in /styles.css)
  *  - object-src 'none', frame-ancestors 'none', base-uri 'self', form-action 'self'
  *  - connect-src 'self' for fetch + EventSource
@@ -59,7 +65,7 @@ export const HTML_ENTRYPOINTS = [
 export const CSP_POLICY = [
     "default-src 'self'",
     "img-src 'self' data: blob:",
-    "script-src 'self'",
+    "script-src 'self' 'wasm-unsafe-eval'",
     "style-src 'self'",
     "connect-src 'self'",
     "object-src 'none'",
@@ -91,6 +97,20 @@ function getClientOpId(req) {
         return v;
     return null;
 }
+function logPromptRejectBeforeSave(fields) {
+    plog.warn("rejected before save", {
+        sessionId: fields.sessionId.slice(0, 8),
+        status: fields.status,
+        reason: fields.reason,
+        ...(fields.opId ? { opId: fields.opId } : {}),
+        ...(fields.textLength != null ? { textLength: fields.textLength } : {}),
+        ...(fields.attachmentCount != null
+            ? { attachmentCount: fields.attachmentCount }
+            : {}),
+        ...(fields.busyKind ? { busyKind: fields.busyKind } : {}),
+        ...(fields.error ? { error: fields.error } : {}),
+    });
+}
 function tryReplayClientOp(req, res, store, sessionId) {
     const opId = getClientOpId(req);
     if (!opId)
@@ -317,6 +337,7 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
                             finalPath = join(dir, `${uploadId}.${fileExt}`);
                         }
                     }
+                    const imageDimensions = kind === "image" ? readImageDimensions(head) : null;
                     await rename(tmpPath, finalPath);
                     const rp = await realpath(finalPath);
                     const row = store.insertAttachment({
@@ -327,6 +348,8 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
                         mime: fileMime,
                         size: bytesWritten,
                         realpath: rp,
+                        width: imageDimensions?.width ?? null,
+                        height: imageDimensions?.height ?? null,
                     });
                     // Invalidate the per-session attachment label cache so the
                     // next egress (SSE broadcast or replay) sees this new row.
@@ -344,6 +367,8 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
                         displayName: row.name,
                         mimeType: row.mime,
                         size: row.size,
+                        width: row.width,
+                        height: row.height,
                         kind: row.kind,
                         path: `sessions/${sessionId}/attachments/${fileName}`,
                         url: fileUrl,
@@ -779,17 +804,36 @@ export function createRequestHandler(deps) {
             const promptMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/prompt\/?(\?.*)?$/);
             if (promptMatch && req.method === "POST") {
                 const sessionId = decodeURIComponent(promptMatch[1]);
+                const requestOpId = getClientOpId(req);
                 const session = store.getSession(sessionId);
                 if (!session) {
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: 404,
+                        reason: "session_not_found",
+                        opId: requestOpId,
+                    });
                     json(res, 404, { error: "Session not found" });
                     return;
                 }
                 const bridge = getBridge?.();
                 if (!bridge) {
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: 503,
+                        reason: "agent_not_ready",
+                        opId: requestOpId,
+                    });
                     json(res, 503, { error: "Agent not ready yet" });
                     return;
                 }
                 if (!sessions) {
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: 503,
+                        reason: "session_manager_unavailable",
+                        opId: requestOpId,
+                    });
                     json(res, 503, { error: "Session manager not available" });
                     return;
                 }
@@ -801,6 +845,13 @@ export function createRequestHandler(deps) {
                     await sessions.ensureResumed(bridge, sessionId);
                 }
                 catch (err) {
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: 500,
+                        reason: "resume_failed",
+                        opId,
+                        error: errorMessage(err),
+                    });
                     json(res, 500, {
                         error: `Failed to resume session: ${err instanceof Error ? err.message : String(err)}`,
                     });
@@ -809,6 +860,13 @@ export function createRequestHandler(deps) {
                 // Check if session is busy
                 const busyKind = sessions.getBusyKind(sessionId);
                 if (busyKind) {
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: 409,
+                        reason: "session_busy",
+                        opId,
+                        busyKind,
+                    });
                     json(res, 409, { error: "Session is busy", busyKind });
                     return;
                 }
@@ -817,10 +875,26 @@ export function createRequestHandler(deps) {
                     body = JSON.parse(await readBody(req));
                 }
                 catch {
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: 400,
+                        reason: "invalid_json",
+                        opId,
+                    });
                     json(res, 400, { error: "Invalid JSON" });
                     return;
                 }
                 if (!body.text) {
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: 400,
+                        reason: "missing_text",
+                        opId,
+                        textLength: 0,
+                        attachmentCount: Array.isArray(body.attachments)
+                            ? body.attachments.length
+                            : undefined,
+                    });
                     json(res, 400, { error: "Missing required field: text" });
                     return;
                 }
@@ -830,6 +904,13 @@ export function createRequestHandler(deps) {
                 const attachments = body.attachments;
                 if (attachments) {
                     if (!Array.isArray(attachments)) {
+                        logPromptRejectBeforeSave({
+                            sessionId,
+                            status: 400,
+                            reason: "attachments_not_array",
+                            opId,
+                            textLength: body.text.length,
+                        });
                         json(res, 400, { error: "attachments must be an array" });
                         return;
                     }
@@ -841,14 +922,32 @@ export function createRequestHandler(deps) {
                             typeof att.attachmentId !== "string" ||
                             typeof att.displayName !== "string" ||
                             typeof att.mimeType !== "string") {
+                            logPromptRejectBeforeSave({
+                                sessionId,
+                                status: 400,
+                                reason: "invalid_attachment_entry",
+                                opId,
+                                textLength: body.text.length,
+                                attachmentCount: attachments.length,
+                            });
                             json(res, 400, { error: "Invalid attachment entry" });
                             return;
                         }
                         if (typeof att.uri === "string" ||
                             typeof att.data === "string" ||
-                            typeof att.path === "string") {
+                            typeof att.path === "string" ||
+                            typeof att.width === "number" ||
+                            typeof att.height === "number") {
+                            logPromptRejectBeforeSave({
+                                sessionId,
+                                status: 400,
+                                reason: "client_supplied_attachment_data",
+                                opId,
+                                textLength: body.text.length,
+                                attachmentCount: attachments.length,
+                            });
                             json(res, 400, {
-                                error: "Client must not supply uri/data/path",
+                                error: "Client must not supply uri/data/path/width/height",
                             });
                             return;
                         }
@@ -873,6 +972,9 @@ export function createRequestHandler(deps) {
                             displayName: a.displayName,
                             mimeType: a.mimeType,
                             path: `/api/v1/sessions/${sessionId}/attachments/${fileName}`,
+                            ...(row.width != null && row.height != null
+                                ? { width: row.width, height: row.height }
+                                : {}),
                         },
                     ];
                 });
@@ -1043,11 +1145,14 @@ export function createRequestHandler(deps) {
                 return;
             }
             // --- PUT /api/v1/sessions/:id/{model,mode,reasoning-effort} ---
-            const configPutMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/(model|mode|reasoning-effort)\/?$/);
+            // --- PUT /api/v1/sessions/:id/config/:configId ---
+            const legacyConfigPutMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/(model|mode|reasoning-effort)\/?$/);
+            const genericConfigPutMatch = url.match(/^\/api\/v1\/sessions\/([^/]+)\/config\/([^/]+)\/?$/);
+            const configPutMatch = legacyConfigPutMatch ?? genericConfigPutMatch;
             if (configPutMatch && req.method === "PUT") {
                 const sessionId = decodeURIComponent(configPutMatch[1]);
-                const configPath = configPutMatch[2];
-                const configId = configPath === "reasoning-effort" ? "reasoning_effort" : configPath;
+                const configPath = decodeURIComponent(configPutMatch[2]);
+                const configId = configPath.replace(/-/g, "_");
                 const session = store.getSession(sessionId);
                 if (!session) {
                     json(res, 404, { error: "Session not found" });
@@ -1066,14 +1171,16 @@ export function createRequestHandler(deps) {
                     json(res, 400, { error: "Invalid JSON" });
                     return;
                 }
-                if (!body.value) {
+                if (body.value === undefined) {
                     json(res, 400, { error: "Missing required field: value" });
                     return;
                 }
                 try {
                     const configOptions = await bridge.setConfigOption(sessionId, configId, body.value);
                     for (const opt of configOptions) {
-                        store.updateSessionConfig(sessionId, opt.id, opt.currentValue);
+                        if (typeof opt.currentValue === "string") {
+                            store.updateSessionConfig(sessionId, opt.id, opt.currentValue);
+                        }
                     }
                     sseManager.broadcast({
                         type: "config_option_update",
@@ -1170,7 +1277,9 @@ export function createRequestHandler(deps) {
                                         reasoning_effort: cur.reasoning_effort,
                                     };
                                     const override = stored[opt.id];
-                                    return override ? { ...opt, currentValue: override } : opt;
+                                    return override && "options" in opt
+                                        ? { ...opt, currentValue: override }
+                                        : opt;
                                 });
                                 sseManager.broadcast({
                                     type: "config_option_update",
@@ -1237,7 +1346,9 @@ export function createRequestHandler(deps) {
                                     reasoning_effort: freshSession.reasoning_effort,
                                 };
                                 const override = stored[opt.id];
-                                return override ? { ...opt, currentValue: override } : opt;
+                                return override && "options" in opt
+                                    ? { ...opt, currentValue: override }
+                                    : opt;
                             });
                             return opts;
                         })()
@@ -1885,21 +1996,27 @@ export function createRequestHandler(deps) {
                 else {
                     sessionIdPatch = null;
                 }
-                if (deps.pushService) {
-                    const { becameVisibleForSession } = deps.pushService.updateClient(clientId, {
+                if (deps.clientRegistry) {
+                    // setVisibility no-ops on unknown clients; auto-register here so
+                    // SSE-only clients (which haven't sent /hello yet) still take
+                    // effect. The trust boundary above already gated on identity.
+                    if (!deps.clientRegistry.get(clientId)) {
+                        deps.clientRegistry.register(clientId, { capabilities: [] });
+                    }
+                    const { becameVisibleFor } = deps.clientRegistry.setVisibility(clientId, {
                         visible: body.visible,
-                        sessionId: sessionIdPatch,
+                        active: sessionIdPatch,
                     });
                     // Edge-triggered only: heartbeat refreshes repeat the same
                     // (visible:true, sessionId:X) POST every 15s — firing sendClose
                     // on each would hammer banner recall. Only the first such
                     // transition after a change should recall stale banners.
-                    if (becameVisibleForSession) {
-                        void deps.pushService.sendClose(`sess-${becameVisibleForSession}-done`);
+                    if (becameVisibleFor && deps.pushService) {
+                        void deps.pushService.sendClose(`sess-${becameVisibleFor}-done`);
                         if (sessions) {
                             for (const perm of sessions.pendingPermissions.values()) {
-                                if (perm.sessionId === becameVisibleForSession) {
-                                    void deps.pushService.sendClose(`sess-${becameVisibleForSession}-perm-${perm.requestId}`);
+                                if (perm.sessionId === becameVisibleFor) {
+                                    void deps.pushService.sendClose(`sess-${becameVisibleFor}-perm-${perm.requestId}`);
                                 }
                             }
                         }
@@ -2014,7 +2131,11 @@ export function createRequestHandler(deps) {
             const ext = extname(filePath);
             const base = filePath.slice(filePath.lastIndexOf("/") + 1);
             const isHashedAsset = /\.[A-Za-z0-9_-]{8,}\.(js|css)$/.test(base);
-            const cacheControl = isHashedAsset
+            // `/lib/**` is vendored third-party content pinned by upstream SHA in
+            // package metadata — treat as immutable just like content-hashed bundles.
+            // Avoids re-downloading multi-hundred-KB wasm on every consumer init.
+            const isVendoredLib = staticPath.startsWith("/lib/");
+            const cacheControl = isHashedAsset || isVendoredLib
                 ? "public, max-age=31536000, immutable"
                 : "no-cache";
             const headers = {

package/lib/server.js

@@ -22,6 +22,7 @@ import { join as pathJoin } from "node:path";
 import { resolveSessionsAnchor } from "./sessions-anchor.js";
 import { runStartupChecks } from "./startup-checks.js";
 import { AttachmentDispatcher } from "./attachment-dispatch.js";
+import { buildBridgeEventHandlerConfig as _buildBridgeEventHandlerConfig } from "./bridge-event-config.js";
 import { createCounters as createAttachmentInterceptorCounters, } from "./attachment-interceptor.js";
 // Prefix all console output with ISO-ish timestamps (YYYY-MM-DD HH:MM:SS)
 for (const method of ["log", "error", "warn"]) {
@@ -75,13 +76,14 @@ setInterval(() => {
         .info("counters", { ...attachmentInterceptorCounters });
 }, ATTACHMENT_INTERCEPTOR_DUMP_MS).unref();
 const sessions = new SessionManager(store, config.default_cwd, config.data_dir);
-const titleService = new TitleService(store, sessions, config.default_cwd, config.title.model);
+const titleService = new TitleService(store, sessions, config.default_cwd, config.title.models);
+const sseManager = new SseManager();
+const clientRegistry = new ClientRegistry();
 const pushService = new PushService(store, config.data_dir, config.push.vapid_subject, {
     globalVisibilitySuppression: config.push.global_visibility_suppression,
+    clientRegistry,
 });
 console.log(`[push] VAPID public key ready`);
-const sseManager = new SseManager();
-const clientRegistry = new ClientRegistry();
 sseManager.onRemove((clientId) => {
     pushService.removeClient(clientId);
     clientRegistry.remove(clientId);
@@ -128,26 +130,20 @@ const server = createServer((req, res) => {
 async function initBridge(agentCmd) {
     const b = new AgentBridge(agentCmd);
     b.setAttachmentDispatcher(attachmentDispatcher);
+    const eventHandlerConfig = _buildBridgeEventHandlerConfig({
+        cancelTimeout: config.limits.cancel_timeout,
+        recentPathsLimit: config.limits.recent_paths,
+        attachmentInterceptorCounters,
+        shouldLogSchemaDrift: () => {
+            const now = Date.now();
+            if (now - lastSchemaDriftAt < SCHEMA_DRIFT_THROTTLE_MS)
+                return false;
+            lastSchemaDriftAt = now;
+            return true;
+        },
+    });
     b.on("event", (event) => {
-        handleAgentEvent(event, sessions, store, b, {
-            cancelTimeout: config.limits.cancel_timeout,
-            recentPathsLimit: config.limits.recent_paths,
-            attachmentInterceptor: {
-                counters: attachmentInterceptorCounters,
-                logger: log.scope("attachment-interceptor"),
-                onSchemaDrift: (ctx) => {
-                    const now = Date.now();
-                    if (now - lastSchemaDriftAt < SCHEMA_DRIFT_THROTTLE_MS)
-                        return;
-                    lastSchemaDriftAt = now;
-                    log
-                        .scope("attachment-interceptor")
-                        .error("schema drift detected — rawInput has no known path key", {
-                        ctx,
-                    });
-                },
-            },
-        }, sseManager, pushService, clientRegistry);
+        handleAgentEvent(event, sessions, store, b, eventHandlerConfig, sseManager, pushService, clientRegistry);
     });
     await b.start();
     bridge = b;
@@ -181,7 +177,7 @@ process.on("SIGHUP", () => {
     });
 });
 // --- Start ---
-server.listen(config.port, "0.0.0.0", () => {
+server.listen(config.port, config.host, () => {
     void (async () => {
         // The auth gate already ran in runStartupChecks (above) — either in
         // this process or in a parent that handed off via WEBAGENT_STARTUP_

package/lib/session-manager.js

@@ -236,7 +236,7 @@ export class SessionManager {
         };
         return configOptions.map((opt) => {
             const override = stored[opt.id];
-            if (override)
+            if (override && "options" in opt)
                 return { ...opt, currentValue: override };
             return opt;
         });

package/lib/startup-checks.js

@@ -44,6 +44,7 @@ export async function runStartupChecks(config) {
         data_dir: config.data_dir,
         agent_cmd: config.agent_cmd,
         port: config.port,
+        host: config.host,
     });
     // 2. Auth bootstrap. Same `[check] auth: ...` style; first-run mint
     //    or refuse-to-serve land here.

package/lib/store.js

@@ -214,10 +214,22 @@ export class Store {
         size         INTEGER NOT NULL,
         realpath     TEXT NOT NULL,
         upload_seq   INTEGER NOT NULL,
+        width        INTEGER,
+        height       INTEGER,
         created_at   TEXT NOT NULL DEFAULT (strftime('%Y-%m-%d %H:%M:%f', 'now'))
       );
       CREATE INDEX IF NOT EXISTS idx_attachments_session ON attachments(session_id);
     `);
+        const attachmentCols = this.db
+            .prepare("PRAGMA table_info(attachments)")
+            .all();
+        const attachmentColNames = new Set(attachmentCols.map((c) => c.name));
+        if (!attachmentColNames.has("width")) {
+            this.db.exec("ALTER TABLE attachments ADD COLUMN width INTEGER");
+        }
+        if (!attachmentColNames.has("height")) {
+            this.db.exec("ALTER TABLE attachments ADD COLUMN height INTEGER");
+        }
         // owner_prefs — key-value store for owner-scoped defaults (display_name,
         // last /by selection, etc). Single-user model = single owner scope.
         // Stored as plain key/value so we don't grow a new table per pref.
@@ -618,9 +630,9 @@ export class Store {
         const uploadSeq = seqRow.s;
         this.db
             .prepare(`INSERT INTO attachments
-           (id, session_id, kind, name, mime, size, realpath, upload_seq)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-            .run(input.id, input.sessionId, input.kind, input.name, input.mime, input.size, input.realpath, uploadSeq);
+           (id, session_id, kind, name, mime, size, realpath, upload_seq, width, height)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+            .run(input.id, input.sessionId, input.kind, input.name, input.mime, input.size, input.realpath, uploadSeq, input.width ?? null, input.height ?? null);
         return this.db
             .prepare("SELECT * FROM attachments WHERE id = ?")
             .get(input.id);

package/lib/title-service.js

@@ -1,4 +1,5 @@
 import { log } from "./log.js";
+import { pickModelByPatterns } from "./model-picker.js";
 const tlog = log.scope("title");
 export class TitleService {
     titleSessionId = null;
@@ -12,10 +13,7 @@ export class TitleService {
         this.store = store;
         this.sessions = sessions;
         this.defaultCwd = defaultCwd;
-        // Lowercase + drop empty strings for case-insensitive substring match.
-        this.modelPatterns = modelPatterns
-            .map((p) => p.trim().toLowerCase())
-            .filter((p) => p.length > 0);
+        this.modelPatterns = modelPatterns;
     }
     /** Generate a title for the session (non-blocking, fire-and-forget). */
     generate(bridge, userMessage, sessionId, onTitle) {
@@ -83,7 +81,7 @@ export class TitleService {
             // the agent's reported availableModels (`configOptions[id=model].options`).
             // Empty pattern list, no model option, or no match → skip the call and
             // inherit the agent's default model (`currentModelId`).
-            const picked = this.pickTitleModel(configOptions);
+            const picked = pickModelByPatterns(configOptions, this.modelPatterns);
             if (picked) {
                 await bridge.setConfigOption(id, "model", picked).catch(() => []);
             }
@@ -94,18 +92,4 @@ export class TitleService {
             return null;
         }
     }
-    /** Find the first available model whose id matches any pattern (case-insensitive). */
-    pickTitleModel(configOptions) {
-        if (this.modelPatterns.length === 0)
-            return null;
-        const modelOpt = configOptions.find((c) => c.id === "model");
-        if (!modelOpt || modelOpt.options.length === 0)
-            return null;
-        for (const pattern of this.modelPatterns) {
-            const hit = modelOpt.options.find((o) => o.value.toLowerCase().includes(pattern));
-            if (hit)
-                return hit.value;
-        }
-        return null;
-    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lelouchhe/webagent",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "A terminal-style web UI for ACP-compatible agents",
   "type": "module",
   "license": "MIT",
@@ -59,7 +59,7 @@
     ]
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "^0.14.1",
+    "@agentclientprotocol/sdk": "^0.25.0",
     "@types/proper-lockfile": "^4.1.4",
     "@types/web-push": "^3.6.4",
     "better-sqlite3": "^12.6.2",
@@ -70,6 +70,7 @@
     "marked": "^18.0.2",
     "proper-lockfile": "^4.1.2",
     "smol-toml": "^1.6.0",
+    "temml": "^0.13.2",
     "web-push": "^3.6.7",
     "zod": "^4.3.6"
   },