@linkshell/gateway 0.3.9 → 0.4.0

package/src/index.ts

@@ -1,7 +1,6 @@
 import { createServer } from "node:http";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { randomUUID } from "node:crypto";
-import { monitorEventLoopDelay } from "node:perf_hooks";
 import { WebSocketServer } from "ws";
 import type WebSocket from "ws";
 import {
@@ -10,7 +9,7 @@ import {
   PROTOCOL_VERSION,
 } from "@linkshell/protocol";
 import { z, ZodError } from "zod";
-import { DeviceManager } from "./sessions.js";
+import { SessionManager } from "./sessions.js";
 import { PairingManager } from "./pairings.js";
 import { TokenManager } from "./tokens.js";
 import { createSupabaseStateStore } from "./state-store.js";
@@ -42,16 +41,14 @@ function log(level: "debug" | "info" | "warn" | "error", msg: string): void {
 }
 
 const stateStore = createSupabaseStateStore();
-const sessionManager = new DeviceManager();
+const sessionManager = new SessionManager();
 const pairingManager = new PairingManager(stateStore);
 const tokenManager = new TokenManager(stateStore);
 await Promise.all([pairingManager.hydrate(), tokenManager.hydrate()]);
 
 const PING_INTERVAL = 20_000;
 const MAX_BODY_SIZE = 4096;
-const MAX_WS_MESSAGE_SIZE = Number(
-  process.env.MAX_WS_MESSAGE_SIZE ?? 16 * 1024 * 1024,
-);
+const MAX_WS_MESSAGE_SIZE = 50 * 1024 * 1024; // 50MB (supports base64 image uploads)
 const PAIRING_RATE_LIMIT_MAX = Number(process.env.PAIRING_RATE_LIMIT_MAX ?? 30);
 const PAIRING_RATE_LIMIT_WINDOW_MS = Number(
   process.env.PAIRING_RATE_LIMIT_WINDOW_MS ?? 60_000,
@@ -62,9 +59,6 @@ const WS_CONNECT_RATE_LIMIT_MAX = Number(
 const WS_CONNECT_RATE_LIMIT_WINDOW_MS = Number(
   process.env.WS_CONNECT_RATE_LIMIT_WINDOW_MS ?? 60_000,
 );
-const DETAILED_HEALTH = process.env.DETAILED_HEALTH === "true";
-const eventLoopDelay = monitorEventLoopDelay({ resolution: 20 });
-eventLoopDelay.enable();
 
 // ── Rate limiter ────────────────────────────────────────────────────
 
@@ -133,12 +127,10 @@ function setCors(res: ServerResponse): void {
 
 // ── HTTP API ────────────────────────────────────────────────────────
 
-const createPairingBody = z.object({ hostDeviceId: z.string().min(1) });
+const createPairingBody = z.object({ sessionId: z.string().optional() });
 const claimPairingBody = z.object({
   pairingCode: z.string().length(6),
   deviceToken: z.string().min(1).optional(),
-  clientDeviceId: z.string().min(1).optional(),
-  clientName: z.string().min(1).optional(),
 });
 
 const server = createServer(async (req, res) => {
@@ -156,7 +148,7 @@ const server = createServer(async (req, res) => {
     if (err instanceof ZodError) {
       json(res, 400, {
         error: "invalid_message",
-        message: err.issues[0]?.message ?? "Validation failed",
+        message: err.errors[0]?.message ?? "Validation failed",
       });
     } else if (err instanceof BodyTooLargeError) {
       json(res, 413, {
@@ -185,54 +177,31 @@ async function handleRequest(
 
   // Health check
   if (method === "GET" && url.pathname === "/healthz") {
-    const memory = process.memoryUsage();
-    const detailed = DETAILED_HEALTH || url.searchParams.get("detail") === "1" || url.searchParams.get("detailed") === "true";
-    json(res, 200, {
-      ok: true,
-      uptime: Math.round(process.uptime()),
-      memory: {
-        rss: memory.rss,
-        heapUsed: memory.heapUsed,
-        heapTotal: memory.heapTotal,
-        external: memory.external,
-      },
-      sessions: sessionManager.getStats(),
-      ...(detailed ? {
-        eventLoop: {
-          delayMeanMs: Number((eventLoopDelay.mean / 1_000_000).toFixed(2)),
-          delayMaxMs: Number((eventLoopDelay.max / 1_000_000).toFixed(2)),
-          delayP99Ms: Number((eventLoopDelay.percentile(99) / 1_000_000).toFixed(2)),
-        },
-        websocket: {
-          maxPayloadBytes: MAX_WS_MESSAGE_SIZE,
-          perMessageDeflate: false,
-        },
-      } : {}),
-    });
+    json(res, 200, { ok: true });
     return;
   }
 
-  // Devices owned by authenticated user (before AUTH_REQUIRED guard — uses its own auth)
-  if (method === "GET" && url.pathname === "/devices/mine") {
+  // Sessions owned by authenticated user (before AUTH_REQUIRED guard — uses its own auth)
+  if (method === "GET" && url.pathname === "/sessions/mine") {
     const authResult = await validateRequest(req);
     if (!authResult || !authResult.userId) {
       json(res, 401, { error: "auth_required", message: "Authentication required" });
       return;
     }
-    const devices = sessionManager
+    const sessions = sessionManager
       .listActive()
       .filter((s) => s.userId === authResult.userId)
       .map((s) => sessionManager.getSummary(s.id))
       .filter(Boolean);
-    json(res, 200, { devices });
+    json(res, 200, { sessions });
     return;
   }
 
-  // Delete a host device owned by authenticated user
-  if (method === "DELETE" && /^\/devices\/[^/]+$/.test(url.pathname)) {
-    const hostDeviceId = url.pathname.split("/")[2];
-    if (!hostDeviceId) {
-      json(res, 400, { error: "missing_host_device_id" });
+  // Delete a session owned by authenticated user
+  if (method === "DELETE" && url.pathname.startsWith("/sessions/")) {
+    const sessionId = url.pathname.split("/")[2];
+    if (!sessionId) {
+      json(res, 400, { error: "missing_session_id" });
       return;
     }
     const authResult = await validateRequest(req);
@@ -240,17 +209,17 @@ async function handleRequest(
       json(res, 401, { error: "auth_required", message: "Authentication required" });
       return;
     }
-    const device = sessionManager.get(hostDeviceId);
-    if (!device) {
+    const session = sessionManager.get(sessionId);
+    if (!session) {
       json(res, 404, { error: "not_found" });
       return;
     }
-    if (device.userId && device.userId === authResult.userId) {
-      sessionManager.forceDelete(hostDeviceId);
+    if (session.userId && session.userId === authResult.userId) {
+      sessionManager.forceDelete(sessionId);
       json(res, 200, { ok: true });
       return;
     }
-    json(res, 403, { error: "forbidden", message: "You do not own this device" });
+    json(res, 403, { error: "forbidden", message: "You do not own this session" });
     return;
   }
 
@@ -265,7 +234,7 @@ async function handleRequest(
   const tunnelCookie = parseTunnelCookie(req);
   if (tunnelCookie) {
     const fallbackParsed = {
-      hostDeviceId: tunnelCookie.hostDeviceId,
+      sessionId: tunnelCookie.sessionId,
       port: tunnelCookie.port,
       path: url.pathname,
     };
@@ -280,7 +249,7 @@ async function handleRequest(
     if (!parsed.success) {
       json(res, 400, {
         error: "invalid_payload",
-        message: parsed.error.issues[0]?.message ?? "Invalid permission response payload",
+        message: parsed.error.errors[0]?.message ?? "Invalid permission response payload",
       });
       return;
     }
@@ -295,27 +264,27 @@ async function handleRequest(
       item.terminalId ? `${item.type}:${item.terminalId}` : item.type,
     ).join(",") ?? "none";
     const ack = result.ack ? ` resolved=${result.ack.resolved} delivered=${result.ack.delivered}` : "";
-    log(result.status === 200 ? "info" : "warn", `agent permission respond protocol=${body.protocol} hostDevice=${body.hostDeviceId} request=${body.requestId} status=${result.status} forwarded=${forwarded}${ack}`);
+    log(result.status === 200 ? "info" : "warn", `agent permission respond protocol=${body.protocol} session=${body.sessionId} request=${body.requestId} status=${result.status} forwarded=${forwarded}${ack}`);
     json(res, result.status, result.body);
     return;
   }
 
-  // Auth check for premium gateway (skip healthz, device-owned endpoints, tunnel)
+  // Auth check for premium gateway (skip healthz, /sessions/mine, tunnel)
   if (AUTH_REQUIRED) {
     const authResult = await requireAuth(req, res);
     if (!authResult) return; // response already sent
   }
 
-  // Create one-time pairing challenge for a host device
+  // Create pairing
   if (method === "POST" && url.pathname === "/pairings") {
     if (!isRateLimitBypassed(ip) && !pairingLimiter.allow(ip)) {
       json(res, 429, { error: "rate_limited", message: "Too many requests" });
       return;
     }
     const body = createPairingBody.parse(await readJson(req));
-    const record = pairingManager.create(body.hostDeviceId);
+    const record = pairingManager.create(body.sessionId);
     json(res, 201, {
-      hostDeviceId: record.hostDeviceId,
+      sessionId: record.sessionId,
       pairingCode: record.pairingCode,
       expiresAt: new Date(record.expiresAt).toISOString(),
     });
@@ -335,62 +304,44 @@ async function handleRequest(
       return;
     }
     const token = tokenManager.register(body.deviceToken);
-    const authorization = tokenManager.authorize(token, result.hostDeviceId, {
-      clientDeviceId: body.clientDeviceId,
-      clientName: body.clientName,
-    });
-    json(res, 200, {
-      hostDeviceId: result.hostDeviceId,
-      deviceToken: token,
-      authorizationId: authorization?.authorizationId,
-    });
+    tokenManager.bind(token, result.sessionId);
+    json(res, 200, { sessionId: result.sessionId, deviceToken: token });
     return;
   }
 
-  // Authorized host device list
-  if (method === "GET" && url.pathname === "/devices") {
+  // Session list
+  if (method === "GET" && url.pathname === "/sessions") {
     const token = extractBearerToken(req);
-    if (!token || !tokenManager.validate(token)) {
-      json(res, 401, {
-        error: "unauthorized",
-        message: "Valid device token required",
-      });
-      return;
-    }
-    const allowedIds = tokenManager.getHostDeviceIds(token);
-    const devices = [...allowedIds].map((hostDeviceId) => {
-      const summary = sessionManager.getSummary(hostDeviceId);
-      return summary ?? {
-        id: hostDeviceId,
-        hostDeviceId,
-        state: "host_disconnected",
-        online: false,
-        hasHost: false,
-        clientCount: 0,
-        controllerId: null,
-        lastActivity: null,
-        createdAt: null,
-        bufferSize: 0,
-        machineId: null,
-        hostname: null,
-        platform: null,
-        cwd: null,
-        capabilities: [],
-        authorizationId: tokenManager.getAuthorizationId(token, hostDeviceId) ?? null,
-      };
-    }).map((device) => ({
-      ...device,
-      authorizationId: tokenManager.getAuthorizationId(token, device.hostDeviceId) ?? null,
-    }));
-    json(res, 200, { devices });
+    const allowedIds = token && tokenManager.validate(token)
+      ? tokenManager.getSessionIds(token)
+      : new Set<string>();
+    const sessions = sessionManager
+      .listActive()
+      .filter((s) => allowedIds.has(s.id))
+      .map((s) => ({
+        id: s.id,
+        state: s.state,
+        hasHost: !!s.host && s.host.socket.readyState === s.host.socket.OPEN,
+        clientCount: s.clients.size,
+        controllerId: s.controllerId ?? null,
+        lastActivity: s.lastActivity,
+        createdAt: s.createdAt,
+        provider: s.provider ?? null,
+        machineId: s.machineId ?? null,
+        hostname: s.hostname ?? null,
+        platform: s.platform ?? null,
+        cwd: s.cwd ?? null,
+        projectName: s.projectName ?? null,
+      }));
+    json(res, 200, { sessions });
     return;
   }
 
-  // Device detail
-  const deviceMatch = url.pathname.match(/^\/devices\/([^/]+)$/);
-  if (method === "GET" && deviceMatch) {
+  // Session detail
+  const sessionMatch = url.pathname.match(/^\/sessions\/([^/]+)$/);
+  if (method === "GET" && sessionMatch) {
     const token = extractBearerToken(req);
-    const targetId = deviceMatch[1]!;
+    const targetId = sessionMatch[1]!;
     if (!token || !tokenManager.owns(token, targetId)) {
       json(res, 401, {
         error: "unauthorized",
@@ -400,51 +351,10 @@ async function handleRequest(
     }
     const summary = sessionManager.getSummary(targetId);
     if (!summary) {
-      json(res, 200, {
-        id: targetId,
-        hostDeviceId: targetId,
-        state: "host_disconnected",
-        online: false,
-        hasHost: false,
-        clientCount: 0,
-        controllerId: null,
-        lastActivity: null,
-        createdAt: null,
-        bufferSize: 0,
-        machineId: null,
-        hostname: null,
-        platform: null,
-        cwd: null,
-        capabilities: [],
-        authorizationId: tokenManager.getAuthorizationId(token, targetId) ?? null,
-      });
+      json(res, 404, { error: "session_not_found" });
       return;
     }
-    json(res, 200, {
-      ...summary,
-      authorizationId: tokenManager.getAuthorizationId(token, targetId) ?? null,
-    });
-    return;
-  }
-
-  const revokeMatch = url.pathname.match(/^\/devices\/([^/]+)\/authorizations\/([^/]+)$/);
-  if (method === "DELETE" && revokeMatch) {
-    const token = extractBearerToken(req);
-    const hostDeviceId = decodeURIComponent(revokeMatch[1]!);
-    const authorizationId = decodeURIComponent(revokeMatch[2]!);
-    if (
-      !token ||
-      tokenManager.getAuthorizationId(token, hostDeviceId) !== authorizationId ||
-      !tokenManager.revoke(token, hostDeviceId, authorizationId)
-    ) {
-      json(res, 401, {
-        error: "unauthorized",
-        message: "Valid device authorization required",
-      });
-      return;
-    }
-    sessionManager.disconnectAuthorization(hostDeviceId, authorizationId);
-    json(res, 200, { ok: true });
+    json(res, 200, summary);
     return;
   }
 
@@ -468,7 +378,6 @@ async function handleRequest(
 const wss = new WebSocketServer({
   noServer: true,
   maxPayload: MAX_WS_MESSAGE_SIZE,
-  perMessageDeflate: false,
 });
 
 server.on("upgrade", (request, socket, head) => {
@@ -496,7 +405,7 @@ server.on("upgrade", (request, socket, head) => {
   const tunnelCookie = parseTunnelCookie(request);
   if (tunnelCookie && url.pathname !== "/ws") {
     const fallbackParsed = {
-      hostDeviceId: tunnelCookie.hostDeviceId,
+      sessionId: tunnelCookie.sessionId,
       port: tunnelCookie.port,
       path: url.pathname,
     };
@@ -550,33 +459,30 @@ server.on("upgrade", (request, socket, head) => {
 wss.on(
   "connection",
   (socket: WebSocket, _request: IncomingMessage, url: URL) => {
-    const hostDeviceId = url.searchParams.get("hostDeviceId");
+    const sessionId = url.searchParams.get("sessionId");
     const role = url.searchParams.get("role") as "host" | "client" | null;
 
-    if (!hostDeviceId || !role || (role !== "host" && role !== "client")) {
-      socket.close(1008, "missing hostDeviceId or role");
+    if (!sessionId || !role || (role !== "host" && role !== "client")) {
+      socket.close(1008, "missing sessionId or role");
       return;
     }
 
     const deviceId = url.searchParams.get("deviceId") ?? randomUUID();
 
-    let clientToken: string | undefined;
-    let clientAuthorizationId: string | undefined;
-
     if (role === "client") {
       const token = url.searchParams.get("token");
       const authResult = (_request as any).__authResult as
         | { userId?: string }
         | undefined;
-      const device = sessionManager.get(hostDeviceId);
+      const session = sessionManager.get(sessionId);
 
-      // Allow if: device token owns host device, OR auth user owns host device
-      const tokenOwns = Boolean(token && tokenManager.owns(token, hostDeviceId));
+      // Allow if: device token owns session, OR auth user owns session
+      const tokenOwns = token && tokenManager.owns(token, sessionId);
       const authOwns =
         AUTH_REQUIRED &&
         authResult?.userId &&
-        device?.userId &&
-        authResult.userId === device.userId;
+        session?.userId &&
+        authResult.userId === session.userId;
 
       if (!tokenOwns && !authOwns) {
         socket.close(4001, "unauthorized");
@@ -584,12 +490,8 @@ wss.on(
       }
       if (!tokenOwns && authOwns && token) {
         tokenManager.register(token);
-        tokenManager.bind(token, hostDeviceId);
-        log("info", `bound authenticated device token to host device ${hostDeviceId}`);
-      }
-      if (token && (tokenOwns || authOwns)) {
-        clientToken = token;
-        clientAuthorizationId = tokenManager.getAuthorizationId(token, hostDeviceId);
+        tokenManager.bind(token, sessionId);
+        log("info", `bound authenticated device token to session ${sessionId}`);
       }
     }
 
@@ -597,33 +499,31 @@ wss.on(
       socket,
       role,
       deviceId,
-      token: clientToken,
-      authorizationId: clientAuthorizationId,
       connectedAt: Date.now(),
     };
 
     if (role === "host") {
       // Check if this is a reconnect (session already exists with clients)
-      const existingSession = sessionManager.get(hostDeviceId);
+      const existingSession = sessionManager.get(sessionId);
       const isReconnect =
         existingSession &&
         existingSession.clients.size > 0 &&
         existingSession.state === "host_disconnected";
-      sessionManager.setHost(hostDeviceId, device);
+      sessionManager.setHost(sessionId, device);
 
       // Associate userId from auth (for AUTH_REQUIRED gateways)
       const authResult = (_request as any).__authResult as
         | { userId?: string }
         | undefined;
       if (authResult?.userId) {
-        const deviceRecord = sessionManager.get(hostDeviceId);
-        if (deviceRecord) deviceRecord.userId = authResult.userId;
+        const session = sessionManager.get(sessionId);
+        if (session) session.userId = authResult.userId;
       }
       if (isReconnect) {
         const notification = serializeEnvelope(
           createEnvelope({
-            type: "device.host_reconnected",
-            hostDeviceId,
+            type: "session.host_reconnected",
+            sessionId,
             payload: {},
           }),
         );
@@ -634,15 +534,15 @@ wss.on(
         }
       }
     } else {
-      sessionManager.addClient(hostDeviceId, device);
+      sessionManager.addClient(sessionId, device);
     }
 
     // Send welcome with protocol version
     socket.send(
       serializeEnvelope(
         createEnvelope({
-          type: "device.connect",
-          hostDeviceId,
+          type: "session.connect",
+          sessionId,
           payload: {
             role,
             clientName: deviceId,
@@ -654,7 +554,7 @@ wss.on(
 
     // If client just joined and host is not connected, notify immediately
     if (role === "client") {
-      const sessionAfterJoin = sessionManager.get(hostDeviceId);
+      const sessionAfterJoin = sessionManager.get(sessionId);
       if (sessionAfterJoin) {
         const hostGone =
           !sessionAfterJoin.host ||
@@ -665,8 +565,8 @@ wss.on(
           socket.send(
             serializeEnvelope(
               createEnvelope({
-                type: "device.host_disconnected",
-                hostDeviceId,
+                type: "session.host_disconnected",
+                sessionId,
                 payload: { reason: "host not connected" },
               }),
             ),
@@ -688,18 +588,18 @@ wss.on(
           socket,
           data.toString(),
           role,
-          hostDeviceId,
+          sessionId,
           deviceId,
           sessionManager,
         );
       } catch (err) {
-        log("error", `unhandled websocket message error for host device ${hostDeviceId}: ${err instanceof Error ? err.message : String(err)}`);
+        log("error", `unhandled websocket message error for session ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
         if (socket.readyState === socket.OPEN) {
           socket.send(
             serializeEnvelope(
               createEnvelope({
-                type: "device.error",
-                hostDeviceId,
+                type: "session.error",
+                sessionId,
                 payload: {
                   code: "invalid_message",
                   message: "Failed to handle message",
@@ -714,14 +614,13 @@ wss.on(
     socket.on("close", () => {
       clearInterval(pingTimer);
       if (role === "host") {
-        const result = sessionManager.removeHost(hostDeviceId);
-        cleanupSessionTunnels(hostDeviceId);
+        const result = sessionManager.removeHost(sessionId);
         // Notify all clients that host disconnected
         if (result) {
           const notification = serializeEnvelope(
             createEnvelope({
-              type: "device.host_disconnected",
-              hostDeviceId,
+              type: "session.host_disconnected",
+              sessionId,
               payload: { reason: "host connection closed" },
             }),
           );
@@ -732,7 +631,7 @@ wss.on(
           }
         }
       } else {
-        sessionManager.removeClient(hostDeviceId, deviceId);
+        sessionManager.removeClient(sessionId, deviceId);
       }
     });
 
@@ -771,18 +670,18 @@ if (AUTH_REQUIRED) {
       if (!session.userId || !session.host) continue;
       const subscription = await checkSubscriptionByUserId(session.userId);
       if (subscription.status === "unknown") {
-        log("warn", `subscription check unknown for user ${session.userId}, keeping host device ${session.id}${subscription.reason ? ` (${subscription.reason})` : ""}`);
+        log("warn", `subscription check unknown for user ${session.userId}, keeping session ${session.id}${subscription.reason ? ` (${subscription.reason})` : ""}`);
         continue;
       }
       if (subscription.status === "inactive") {
-        log("info", `subscription expired for user ${session.userId}, disconnecting host device ${session.id}`);
+        log("info", `subscription expired for user ${session.userId}, disconnecting session ${session.id}`);
         // Notify host
         try {
           session.host.socket.send(
             serializeEnvelope(
               createEnvelope({
-                type: "device.error",
-                hostDeviceId: session.id,
+                type: "session.error",
+                sessionId: session.id,
                 payload: {
                   code: "subscription_expired",
                   message: "Your Pro subscription has expired. Renew at https://itool.tech",
@@ -798,12 +697,12 @@ if (AUTH_REQUIRED) {
           try {
             client.socket.send(
               serializeEnvelope(
-              createEnvelope({
-                  type: "device.error",
-                  hostDeviceId: session.id,
+                createEnvelope({
+                  type: "session.error",
+                  sessionId: session.id,
                   payload: {
                     code: "subscription_expired",
-                    message: "Host subscription expired. HostDevice ended.",
+                    message: "Host subscription expired. Session ended.",
                   },
                 }),
               ),

package/src/pairings.ts

@@ -1,8 +1,8 @@
-import { randomInt } from "node:crypto";
+import { randomInt, randomUUID } from "node:crypto";
 import type { GatewayStateStore } from "./state-store.js";
 
 export interface PairingRecord {
-  hostDeviceId: string;
+  sessionId: string;
   pairingCode: string;
   expiresAt: number; // unix ms
   claimed: boolean;
@@ -36,10 +36,11 @@ export class PairingManager {
     }
   }
 
-  create(hostDeviceId: string): PairingRecord {
+  create(sessionId?: string): PairingRecord {
+    const id = sessionId ?? randomUUID();
     const code = String(randomInt(100000, 999999));
     const record: PairingRecord = {
-      hostDeviceId,
+      sessionId: id,
       pairingCode: code,
       expiresAt: Date.now() + PAIRING_TTL,
       claimed: false,
@@ -67,7 +68,7 @@ export class PairingManager {
     return record;
   }
 
-  getStatus(pairingCode: string): { status: string; expiresAt: number; hostDeviceId: string } | { error: string; httpStatus: number } {
+  getStatus(pairingCode: string): { status: string; expiresAt: number; sessionId: string } | { error: string; httpStatus: number } {
     const record = this.pairings.get(pairingCode);
     if (!record) {
       return { error: "pairing_not_found", httpStatus: 404 };
@@ -80,7 +81,7 @@ export class PairingManager {
     return {
       status: record.claimed ? "claimed" : "waiting",
       expiresAt: record.expiresAt,
-      hostDeviceId: record.hostDeviceId,
+      sessionId: record.sessionId,
     };
   }