@linkshell/gateway 0.3.9 → 0.4.0

package/dist/gateway/src/index.js

@@ -1,16 +1,15 @@
 import { createServer } from "node:http";
 import { randomUUID } from "node:crypto";
-import { monitorEventLoopDelay } from "node:perf_hooks";
 import { WebSocketServer } from "ws";
 import { createEnvelope, serializeEnvelope, PROTOCOL_VERSION, } from "@linkshell/protocol";
 import { z, ZodError } from "zod";
-import { DeviceManager } from "./sessions.js";
+import { SessionManager } from "./sessions.js";
 import { PairingManager } from "./pairings.js";
 import { TokenManager } from "./tokens.js";
 import { createSupabaseStateStore } from "./state-store.js";
 import { handleSocketMessage } from "./relay.js";
 import { agentPermissionHttpBodySchema, forwardAgentPermissionHttp, } from "./agent-permission-http.js";
-import { parseTunnelPath, parseTunnelCookie, handleTunnelRequest, cleanupSessionTunnels, } from "./tunnel.js";
+import { parseTunnelPath, parseTunnelCookie, handleTunnelRequest, } from "./tunnel.js";
 import { AUTH_REQUIRED, requireAuth, checkWsAuth, validateRequest, checkSubscriptionByUserId } from "./auth-middleware.js";
 const port = Number(process.env.PORT ?? 8787);
 const logLevel = (process.env.LOG_LEVEL ?? "info");
@@ -21,20 +20,17 @@ function log(level, msg) {
     }
 }
 const stateStore = createSupabaseStateStore();
-const sessionManager = new DeviceManager();
+const sessionManager = new SessionManager();
 const pairingManager = new PairingManager(stateStore);
 const tokenManager = new TokenManager(stateStore);
 await Promise.all([pairingManager.hydrate(), tokenManager.hydrate()]);
 const PING_INTERVAL = 20_000;
 const MAX_BODY_SIZE = 4096;
-const MAX_WS_MESSAGE_SIZE = Number(process.env.MAX_WS_MESSAGE_SIZE ?? 16 * 1024 * 1024);
+const MAX_WS_MESSAGE_SIZE = 50 * 1024 * 1024; // 50MB (supports base64 image uploads)
 const PAIRING_RATE_LIMIT_MAX = Number(process.env.PAIRING_RATE_LIMIT_MAX ?? 30);
 const PAIRING_RATE_LIMIT_WINDOW_MS = Number(process.env.PAIRING_RATE_LIMIT_WINDOW_MS ?? 60_000);
 const WS_CONNECT_RATE_LIMIT_MAX = Number(process.env.WS_CONNECT_RATE_LIMIT_MAX ?? 20);
 const WS_CONNECT_RATE_LIMIT_WINDOW_MS = Number(process.env.WS_CONNECT_RATE_LIMIT_WINDOW_MS ?? 60_000);
-const DETAILED_HEALTH = process.env.DETAILED_HEALTH === "true";
-const eventLoopDelay = monitorEventLoopDelay({ resolution: 20 });
-eventLoopDelay.enable();
 // ── Rate limiter ────────────────────────────────────────────────────
 class RateLimiter {
     maxHits;
@@ -87,12 +83,10 @@ function setCors(res) {
     res.setHeader("Access-Control-Max-Age", "86400");
 }
 // ── HTTP API ────────────────────────────────────────────────────────
-const createPairingBody = z.object({ hostDeviceId: z.string().min(1) });
+const createPairingBody = z.object({ sessionId: z.string().optional() });
 const claimPairingBody = z.object({
     pairingCode: z.string().length(6),
     deviceToken: z.string().min(1).optional(),
-    clientDeviceId: z.string().min(1).optional(),
-    clientName: z.string().min(1).optional(),
 });
 const server = createServer(async (req, res) => {
     setCors(res);
@@ -108,7 +102,7 @@ const server = createServer(async (req, res) => {
         if (err instanceof ZodError) {
             json(res, 400, {
                 error: "invalid_message",
-                message: err.issues[0]?.message ?? "Validation failed",
+                message: err.errors[0]?.message ?? "Validation failed",
             });
         }
         else if (err instanceof BodyTooLargeError) {
@@ -135,52 +129,29 @@ async function handleRequest(req, res) {
     const ip = getClientIp(req);
     // Health check
     if (method === "GET" && url.pathname === "/healthz") {
-        const memory = process.memoryUsage();
-        const detailed = DETAILED_HEALTH || url.searchParams.get("detail") === "1" || url.searchParams.get("detailed") === "true";
-        json(res, 200, {
-            ok: true,
-            uptime: Math.round(process.uptime()),
-            memory: {
-                rss: memory.rss,
-                heapUsed: memory.heapUsed,
-                heapTotal: memory.heapTotal,
-                external: memory.external,
-            },
-            sessions: sessionManager.getStats(),
-            ...(detailed ? {
-                eventLoop: {
-                    delayMeanMs: Number((eventLoopDelay.mean / 1_000_000).toFixed(2)),
-                    delayMaxMs: Number((eventLoopDelay.max / 1_000_000).toFixed(2)),
-                    delayP99Ms: Number((eventLoopDelay.percentile(99) / 1_000_000).toFixed(2)),
-                },
-                websocket: {
-                    maxPayloadBytes: MAX_WS_MESSAGE_SIZE,
-                    perMessageDeflate: false,
-                },
-            } : {}),
-        });
+        json(res, 200, { ok: true });
         return;
     }
-    // Devices owned by authenticated user (before AUTH_REQUIRED guard — uses its own auth)
-    if (method === "GET" && url.pathname === "/devices/mine") {
+    // Sessions owned by authenticated user (before AUTH_REQUIRED guard — uses its own auth)
+    if (method === "GET" && url.pathname === "/sessions/mine") {
         const authResult = await validateRequest(req);
         if (!authResult || !authResult.userId) {
             json(res, 401, { error: "auth_required", message: "Authentication required" });
             return;
         }
-        const devices = sessionManager
+        const sessions = sessionManager
             .listActive()
             .filter((s) => s.userId === authResult.userId)
             .map((s) => sessionManager.getSummary(s.id))
             .filter(Boolean);
-        json(res, 200, { devices });
+        json(res, 200, { sessions });
         return;
     }
-    // Delete a host device owned by authenticated user
-    if (method === "DELETE" && /^\/devices\/[^/]+$/.test(url.pathname)) {
-        const hostDeviceId = url.pathname.split("/")[2];
-        if (!hostDeviceId) {
-            json(res, 400, { error: "missing_host_device_id" });
+    // Delete a session owned by authenticated user
+    if (method === "DELETE" && url.pathname.startsWith("/sessions/")) {
+        const sessionId = url.pathname.split("/")[2];
+        if (!sessionId) {
+            json(res, 400, { error: "missing_session_id" });
             return;
         }
         const authResult = await validateRequest(req);
@@ -188,17 +159,17 @@ async function handleRequest(req, res) {
             json(res, 401, { error: "auth_required", message: "Authentication required" });
             return;
         }
-        const device = sessionManager.get(hostDeviceId);
-        if (!device) {
+        const session = sessionManager.get(sessionId);
+        if (!session) {
             json(res, 404, { error: "not_found" });
             return;
         }
-        if (device.userId && device.userId === authResult.userId) {
-            sessionManager.forceDelete(hostDeviceId);
+        if (session.userId && session.userId === authResult.userId) {
+            sessionManager.forceDelete(sessionId);
             json(res, 200, { ok: true });
             return;
         }
-        json(res, 403, { error: "forbidden", message: "You do not own this device" });
+        json(res, 403, { error: "forbidden", message: "You do not own this session" });
         return;
     }
     // Tunnel HTTP proxy (explicit path) — before AUTH_REQUIRED, tunnel has its own auth
@@ -211,7 +182,7 @@ async function handleRequest(req, res) {
     const tunnelCookie = parseTunnelCookie(req);
     if (tunnelCookie) {
         const fallbackParsed = {
-            hostDeviceId: tunnelCookie.hostDeviceId,
+            sessionId: tunnelCookie.sessionId,
             port: tunnelCookie.port,
             path: url.pathname,
         };
@@ -225,7 +196,7 @@ async function handleRequest(req, res) {
         if (!parsed.success) {
             json(res, 400, {
                 error: "invalid_payload",
-                message: parsed.error.issues[0]?.message ?? "Invalid permission response payload",
+                message: parsed.error.errors[0]?.message ?? "Invalid permission response payload",
             });
             return;
         }
@@ -238,26 +209,26 @@ async function handleRequest(req, res) {
         });
         const forwarded = result.forwarded?.map((item) => item.terminalId ? `${item.type}:${item.terminalId}` : item.type).join(",") ?? "none";
         const ack = result.ack ? ` resolved=${result.ack.resolved} delivered=${result.ack.delivered}` : "";
-        log(result.status === 200 ? "info" : "warn", `agent permission respond protocol=${body.protocol} hostDevice=${body.hostDeviceId} request=${body.requestId} status=${result.status} forwarded=${forwarded}${ack}`);
+        log(result.status === 200 ? "info" : "warn", `agent permission respond protocol=${body.protocol} session=${body.sessionId} request=${body.requestId} status=${result.status} forwarded=${forwarded}${ack}`);
         json(res, result.status, result.body);
         return;
     }
-    // Auth check for premium gateway (skip healthz, device-owned endpoints, tunnel)
+    // Auth check for premium gateway (skip healthz, /sessions/mine, tunnel)
     if (AUTH_REQUIRED) {
         const authResult = await requireAuth(req, res);
         if (!authResult)
             return; // response already sent
     }
-    // Create one-time pairing challenge for a host device
+    // Create pairing
     if (method === "POST" && url.pathname === "/pairings") {
         if (!isRateLimitBypassed(ip) && !pairingLimiter.allow(ip)) {
             json(res, 429, { error: "rate_limited", message: "Too many requests" });
             return;
         }
         const body = createPairingBody.parse(await readJson(req));
-        const record = pairingManager.create(body.hostDeviceId);
+        const record = pairingManager.create(body.sessionId);
         json(res, 201, {
-            hostDeviceId: record.hostDeviceId,
+            sessionId: record.sessionId,
             pairingCode: record.pairingCode,
             expiresAt: new Date(record.expiresAt).toISOString(),
         });
@@ -276,60 +247,42 @@ async function handleRequest(req, res) {
             return;
         }
         const token = tokenManager.register(body.deviceToken);
-        const authorization = tokenManager.authorize(token, result.hostDeviceId, {
-            clientDeviceId: body.clientDeviceId,
-            clientName: body.clientName,
-        });
-        json(res, 200, {
-            hostDeviceId: result.hostDeviceId,
-            deviceToken: token,
-            authorizationId: authorization?.authorizationId,
-        });
+        tokenManager.bind(token, result.sessionId);
+        json(res, 200, { sessionId: result.sessionId, deviceToken: token });
         return;
     }
-    // Authorized host device list
-    if (method === "GET" && url.pathname === "/devices") {
+    // Session list
+    if (method === "GET" && url.pathname === "/sessions") {
         const token = extractBearerToken(req);
-        if (!token || !tokenManager.validate(token)) {
-            json(res, 401, {
-                error: "unauthorized",
-                message: "Valid device token required",
-            });
-            return;
-        }
-        const allowedIds = tokenManager.getHostDeviceIds(token);
-        const devices = [...allowedIds].map((hostDeviceId) => {
-            const summary = sessionManager.getSummary(hostDeviceId);
-            return summary ?? {
-                id: hostDeviceId,
-                hostDeviceId,
-                state: "host_disconnected",
-                online: false,
-                hasHost: false,
-                clientCount: 0,
-                controllerId: null,
-                lastActivity: null,
-                createdAt: null,
-                bufferSize: 0,
-                machineId: null,
-                hostname: null,
-                platform: null,
-                cwd: null,
-                capabilities: [],
-                authorizationId: tokenManager.getAuthorizationId(token, hostDeviceId) ?? null,
-            };
-        }).map((device) => ({
-            ...device,
-            authorizationId: tokenManager.getAuthorizationId(token, device.hostDeviceId) ?? null,
+        const allowedIds = token && tokenManager.validate(token)
+            ? tokenManager.getSessionIds(token)
+            : new Set();
+        const sessions = sessionManager
+            .listActive()
+            .filter((s) => allowedIds.has(s.id))
+            .map((s) => ({
+            id: s.id,
+            state: s.state,
+            hasHost: !!s.host && s.host.socket.readyState === s.host.socket.OPEN,
+            clientCount: s.clients.size,
+            controllerId: s.controllerId ?? null,
+            lastActivity: s.lastActivity,
+            createdAt: s.createdAt,
+            provider: s.provider ?? null,
+            machineId: s.machineId ?? null,
+            hostname: s.hostname ?? null,
+            platform: s.platform ?? null,
+            cwd: s.cwd ?? null,
+            projectName: s.projectName ?? null,
         }));
-        json(res, 200, { devices });
+        json(res, 200, { sessions });
         return;
     }
-    // Device detail
-    const deviceMatch = url.pathname.match(/^\/devices\/([^/]+)$/);
-    if (method === "GET" && deviceMatch) {
+    // Session detail
+    const sessionMatch = url.pathname.match(/^\/sessions\/([^/]+)$/);
+    if (method === "GET" && sessionMatch) {
         const token = extractBearerToken(req);
-        const targetId = deviceMatch[1];
+        const targetId = sessionMatch[1];
         if (!token || !tokenManager.owns(token, targetId)) {
             json(res, 401, {
                 error: "unauthorized",
@@ -339,48 +292,10 @@ async function handleRequest(req, res) {
         }
         const summary = sessionManager.getSummary(targetId);
         if (!summary) {
-            json(res, 200, {
-                id: targetId,
-                hostDeviceId: targetId,
-                state: "host_disconnected",
-                online: false,
-                hasHost: false,
-                clientCount: 0,
-                controllerId: null,
-                lastActivity: null,
-                createdAt: null,
-                bufferSize: 0,
-                machineId: null,
-                hostname: null,
-                platform: null,
-                cwd: null,
-                capabilities: [],
-                authorizationId: tokenManager.getAuthorizationId(token, targetId) ?? null,
-            });
+            json(res, 404, { error: "session_not_found" });
             return;
         }
-        json(res, 200, {
-            ...summary,
-            authorizationId: tokenManager.getAuthorizationId(token, targetId) ?? null,
-        });
-        return;
-    }
-    const revokeMatch = url.pathname.match(/^\/devices\/([^/]+)\/authorizations\/([^/]+)$/);
-    if (method === "DELETE" && revokeMatch) {
-        const token = extractBearerToken(req);
-        const hostDeviceId = decodeURIComponent(revokeMatch[1]);
-        const authorizationId = decodeURIComponent(revokeMatch[2]);
-        if (!token ||
-            tokenManager.getAuthorizationId(token, hostDeviceId) !== authorizationId ||
-            !tokenManager.revoke(token, hostDeviceId, authorizationId)) {
-            json(res, 401, {
-                error: "unauthorized",
-                message: "Valid device authorization required",
-            });
-            return;
-        }
-        sessionManager.disconnectAuthorization(hostDeviceId, authorizationId);
-        json(res, 200, { ok: true });
+        json(res, 200, summary);
         return;
     }
     // Pairing status (for CLI polling)
@@ -400,7 +315,6 @@ async function handleRequest(req, res) {
 const wss = new WebSocketServer({
     noServer: true,
     maxPayload: MAX_WS_MESSAGE_SIZE,
-    perMessageDeflate: false,
 });
 server.on("upgrade", (request, socket, head) => {
     const url = new URL(request.url ?? "/", `http://${request.headers.host}`);
@@ -425,7 +339,7 @@ server.on("upgrade", (request, socket, head) => {
     const tunnelCookie = parseTunnelCookie(request);
     if (tunnelCookie && url.pathname !== "/ws") {
         const fallbackParsed = {
-            hostDeviceId: tunnelCookie.hostDeviceId,
+            sessionId: tunnelCookie.sessionId,
             port: tunnelCookie.port,
             path: url.pathname,
         };
@@ -472,65 +386,57 @@ server.on("upgrade", (request, socket, head) => {
     });
 });
 wss.on("connection", (socket, _request, url) => {
-    const hostDeviceId = url.searchParams.get("hostDeviceId");
+    const sessionId = url.searchParams.get("sessionId");
     const role = url.searchParams.get("role");
-    if (!hostDeviceId || !role || (role !== "host" && role !== "client")) {
-        socket.close(1008, "missing hostDeviceId or role");
+    if (!sessionId || !role || (role !== "host" && role !== "client")) {
+        socket.close(1008, "missing sessionId or role");
         return;
     }
     const deviceId = url.searchParams.get("deviceId") ?? randomUUID();
-    let clientToken;
-    let clientAuthorizationId;
     if (role === "client") {
         const token = url.searchParams.get("token");
         const authResult = _request.__authResult;
-        const device = sessionManager.get(hostDeviceId);
-        // Allow if: device token owns host device, OR auth user owns host device
-        const tokenOwns = Boolean(token && tokenManager.owns(token, hostDeviceId));
+        const session = sessionManager.get(sessionId);
+        // Allow if: device token owns session, OR auth user owns session
+        const tokenOwns = token && tokenManager.owns(token, sessionId);
         const authOwns = AUTH_REQUIRED &&
             authResult?.userId &&
-            device?.userId &&
-            authResult.userId === device.userId;
+            session?.userId &&
+            authResult.userId === session.userId;
         if (!tokenOwns && !authOwns) {
             socket.close(4001, "unauthorized");
             return;
         }
         if (!tokenOwns && authOwns && token) {
             tokenManager.register(token);
-            tokenManager.bind(token, hostDeviceId);
-            log("info", `bound authenticated device token to host device ${hostDeviceId}`);
-        }
-        if (token && (tokenOwns || authOwns)) {
-            clientToken = token;
-            clientAuthorizationId = tokenManager.getAuthorizationId(token, hostDeviceId);
+            tokenManager.bind(token, sessionId);
+            log("info", `bound authenticated device token to session ${sessionId}`);
         }
     }
     const device = {
         socket,
         role,
         deviceId,
-        token: clientToken,
-        authorizationId: clientAuthorizationId,
         connectedAt: Date.now(),
     };
     if (role === "host") {
         // Check if this is a reconnect (session already exists with clients)
-        const existingSession = sessionManager.get(hostDeviceId);
+        const existingSession = sessionManager.get(sessionId);
         const isReconnect = existingSession &&
             existingSession.clients.size > 0 &&
             existingSession.state === "host_disconnected";
-        sessionManager.setHost(hostDeviceId, device);
+        sessionManager.setHost(sessionId, device);
         // Associate userId from auth (for AUTH_REQUIRED gateways)
         const authResult = _request.__authResult;
         if (authResult?.userId) {
-            const deviceRecord = sessionManager.get(hostDeviceId);
-            if (deviceRecord)
-                deviceRecord.userId = authResult.userId;
+            const session = sessionManager.get(sessionId);
+            if (session)
+                session.userId = authResult.userId;
         }
         if (isReconnect) {
             const notification = serializeEnvelope(createEnvelope({
-                type: "device.host_reconnected",
-                hostDeviceId,
+                type: "session.host_reconnected",
+                sessionId,
                 payload: {},
             }));
             for (const [, client] of existingSession.clients) {
@@ -541,12 +447,12 @@ wss.on("connection", (socket, _request, url) => {
         }
     }
     else {
-        sessionManager.addClient(hostDeviceId, device);
+        sessionManager.addClient(sessionId, device);
     }
     // Send welcome with protocol version
     socket.send(serializeEnvelope(createEnvelope({
-        type: "device.connect",
-        hostDeviceId,
+        type: "session.connect",
+        sessionId,
         payload: {
             role,
             clientName: deviceId,
@@ -555,7 +461,7 @@ wss.on("connection", (socket, _request, url) => {
     })));
     // If client just joined and host is not connected, notify immediately
     if (role === "client") {
-        const sessionAfterJoin = sessionManager.get(hostDeviceId);
+        const sessionAfterJoin = sessionManager.get(sessionId);
         if (sessionAfterJoin) {
             const hostGone = !sessionAfterJoin.host ||
                 sessionAfterJoin.state === "host_disconnected" ||
@@ -563,8 +469,8 @@ wss.on("connection", (socket, _request, url) => {
                     sessionAfterJoin.host.socket.OPEN;
             if (hostGone) {
                 socket.send(serializeEnvelope(createEnvelope({
-                    type: "device.host_disconnected",
-                    hostDeviceId,
+                    type: "session.host_disconnected",
+                    sessionId,
                     payload: { reason: "host not connected" },
                 })));
             }
@@ -578,14 +484,14 @@ wss.on("connection", (socket, _request, url) => {
     }, PING_INTERVAL);
     socket.on("message", (data) => {
         try {
-            handleSocketMessage(socket, data.toString(), role, hostDeviceId, deviceId, sessionManager);
+            handleSocketMessage(socket, data.toString(), role, sessionId, deviceId, sessionManager);
         }
         catch (err) {
-            log("error", `unhandled websocket message error for host device ${hostDeviceId}: ${err instanceof Error ? err.message : String(err)}`);
+            log("error", `unhandled websocket message error for session ${sessionId}: ${err instanceof Error ? err.message : String(err)}`);
             if (socket.readyState === socket.OPEN) {
                 socket.send(serializeEnvelope(createEnvelope({
-                    type: "device.error",
-                    hostDeviceId,
+                    type: "session.error",
+                    sessionId,
                     payload: {
                         code: "invalid_message",
                         message: "Failed to handle message",
@@ -597,13 +503,12 @@ wss.on("connection", (socket, _request, url) => {
     socket.on("close", () => {
         clearInterval(pingTimer);
         if (role === "host") {
-            const result = sessionManager.removeHost(hostDeviceId);
-            cleanupSessionTunnels(hostDeviceId);
+            const result = sessionManager.removeHost(sessionId);
             // Notify all clients that host disconnected
             if (result) {
                 const notification = serializeEnvelope(createEnvelope({
-                    type: "device.host_disconnected",
-                    hostDeviceId,
+                    type: "session.host_disconnected",
+                    sessionId,
                     payload: { reason: "host connection closed" },
                 }));
                 for (const [, client] of result.clients) {
@@ -614,7 +519,7 @@ wss.on("connection", (socket, _request, url) => {
             }
         }
         else {
-            sessionManager.removeClient(hostDeviceId, deviceId);
+            sessionManager.removeClient(sessionId, deviceId);
         }
     });
     socket.on("error", () => {
@@ -646,16 +551,16 @@ if (AUTH_REQUIRED) {
                 continue;
             const subscription = await checkSubscriptionByUserId(session.userId);
             if (subscription.status === "unknown") {
-                log("warn", `subscription check unknown for user ${session.userId}, keeping host device ${session.id}${subscription.reason ? ` (${subscription.reason})` : ""}`);
+                log("warn", `subscription check unknown for user ${session.userId}, keeping session ${session.id}${subscription.reason ? ` (${subscription.reason})` : ""}`);
                 continue;
             }
             if (subscription.status === "inactive") {
-                log("info", `subscription expired for user ${session.userId}, disconnecting host device ${session.id}`);
+                log("info", `subscription expired for user ${session.userId}, disconnecting session ${session.id}`);
                 // Notify host
                 try {
                     session.host.socket.send(serializeEnvelope(createEnvelope({
-                        type: "device.error",
-                        hostDeviceId: session.id,
+                        type: "session.error",
+                        sessionId: session.id,
                         payload: {
                             code: "subscription_expired",
                             message: "Your Pro subscription has expired. Renew at https://itool.tech",
@@ -669,11 +574,11 @@ if (AUTH_REQUIRED) {
                 for (const [, client] of session.clients) {
                     try {
                         client.socket.send(serializeEnvelope(createEnvelope({
-                            type: "device.error",
-                            hostDeviceId: session.id,
+                            type: "session.error",
+                            sessionId: session.id,
                             payload: {
                                 code: "subscription_expired",
-                                message: "Host subscription expired. HostDevice ended.",
+                                message: "Host subscription expired. Session ended.",
                             },
                         })));
                         client.socket.close(4003, "subscription_expired");