@logicseek/hello-cc 0.1.9 → 1.0.1

package/lib/web/project-contexts.mjs

@@ -0,0 +1,183 @@
+// Web project context management, extracted from lib/web/runtime-main.mjs.
+// Owns the projectContexts map: normalization, registry-backed discovery,
+// fail-closed path re-resolution, per-project DB connections, and
+// session/peer lookup helpers used by the HTTP and WS layers.
+
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import WebSocket from 'ws';
+import { CliError } from '../shared/errors.mjs';
+import { contextForProject } from '../runtime/paths.mjs';
+import { resolveProjectDatabase } from '../runtime/project-path.mjs';
+import {
+  projectRecord,
+  readProjectRegistry,
+  registerProject,
+  registerProjectActivity
+} from '../runtime/projects.mjs';
+import { nextSessionId } from '../web/runtime.mjs';
+import { tokenMatches } from '../web/http.mjs';
+
+export function createProjectContexts(deps) {
+  const {
+    ctx, sessions,
+    sessionKey, sessionsForProject, resolveSessionPeerId,
+    connect, now, addEvent, tx, touchPeer, upsertPeer, detectBranch,
+    ACTIVE_PEER_TTL, CLI_NAME, DEFAULT_LOCK_TTL,
+    queryInbox, queryOpenTasks, queryTimelineMessages,
+    observePeerEvidence, peerEvidenceFromDb,
+    observeClockSafetyInTransaction,
+    assertTaskOwnerForMutation, claimNextTasksForPeer, takeOverTaskForPeer,
+    positiveIntOpt, sameResolvedPath
+  } = deps;
+
+  const projectContexts = new Map();
+
+  function newSessionActionToken() {
+    return randomBytes(32).toString('base64url');
+  }
+
+  function rememberProject(projectCtx, { activity = false, register = false, nonblocking = false } = {}) {
+    const normalized = contextForProject(projectCtx.root, projectCtx.dbPath, { cwd: projectCtx.cwd, json: ctx.json });
+    const isNew = !projectContexts.has(normalized.root);
+    // Activity refresh is already nonblocking and throttled before it tries the
+    // registry lock. Calling it on each request keeps last_seen_at current
+    // without putting the synchronous lock back on the HTTP hot path.
+    if (activity) registerProjectActivity(normalized);
+    else if (isNew || register) {
+      try {
+        registerProject(normalized, { nonblocking });
+      } catch (error) {
+        if (nonblocking && ['ERR_FILE_LOCK_BUSY', 'ERR_FILE_LOCK_TIMEOUT'].includes(error?.code)) {
+          throw new CliError('REGISTRY_BUSY', 'Project registry is busy; retry the request');
+        }
+        throw error;
+      }
+    }
+    projectContexts.set(normalized.root, normalized);
+    return normalized;
+  }
+
+  function knownProjects() {
+    const rows = readProjectRegistry();
+    if (!rows.some((p) => sameResolvedPath(p.root, ctx.root))) rows.unshift(projectRecord(ctx));
+    for (const project of rows) {
+      if (!projectContexts.has(project.root)) {
+        projectContexts.set(project.root, contextForProject(project.root, project.db, { json: ctx.json }));
+      }
+    }
+    return rows;
+  }
+
+  function resolveWebProjectContext(root, db) {
+    const first = resolveProjectDatabase({ root, db, createStateDir: true });
+    // Re-read every filesystem identity immediately before the returned
+    // context can reach connect(). A path rebound after the first pass fails
+    // closed instead of carrying a stale lexical decision into SQLite.
+    const final = resolveProjectDatabase({
+      root: first.root,
+      db: first.db,
+      createStateDir: true
+    });
+    return contextForProject(final.root, final.db, { cwd: final.root, json: ctx.json });
+  }
+
+  function connectWebProject(projectCtx, options = {}) {
+    const final = resolveProjectDatabase({
+      root: projectCtx.root,
+      db: projectCtx.dbPath,
+      createStateDir: options.create !== false
+    });
+    return connect(contextForProject(final.root, final.db, {
+      cwd: final.root,
+      json: projectCtx.json
+    }), options);
+  }
+
+  function projectFromRequest(req, url) {
+    const requestedRoot = url.searchParams.get('root') ||
+      url.searchParams.get('project') ||
+      req.headers['x-hcc-root'] ||
+      ctx.root;
+    const requestedDb = url.searchParams.get('db') ||
+      req.headers['x-hcc-db'] ||
+      path.join(requestedRoot, '.hello-cc', 'mesh.db');
+    return rememberProject(
+      resolveWebProjectContext(requestedRoot, requestedDb),
+      { activity: true }
+    );
+  }
+
+  function getSession(projectCtx, id, db = null) {
+    const direct = sessions.get(sessionKey(projectCtx, id));
+    if (direct) return direct;
+    for (const session of sessionsForProject(projectCtx)) {
+      if (session.peerId === id) return session;
+    }
+    if (db) {
+      for (const session of sessionsForProject(projectCtx)) {
+        if (resolveSessionPeerId(db, session) === id) return session;
+      }
+    }
+    return null;
+  }
+
+  function readActionToken(input, req) {
+    const headerToken = req.headers["x-hcc-session-token"];
+    return String(input.action_token || input.actionToken || headerToken || "").trim();
+  }
+
+  function resolveWebActionSession(projectCtx, peer, input, req) {
+    const db = connectWebProject(projectCtx);
+    let session;
+    try {
+      session = getSession(projectCtx, peer, db);
+    } finally {
+      db.close();
+    }
+    if (!session || session.status !== "running") {
+      throw new CliError("PEER_IDENTITY_REQUIRED", "Web peer action requires a running managed session for " + peer, { peer });
+    }
+    const actorPeer = session.peerId || peer;
+    if (actorPeer !== peer && session.id !== peer) {
+      throw new CliError("PEER_IDENTITY_MISMATCH", "Web peer action target " + peer + " does not match managed session " + actorPeer, {
+        peer, actor_peer: actorPeer, session_id: session.id
+      });
+    }
+    const provided = readActionToken(input, req);
+    const authorized = Boolean(provided) && [...(session.actionTokens || [])]
+      .some((candidate) => {
+        if (!tokenMatches(provided, candidate)) return false;
+        const socket = session.actionTokenSockets?.get(candidate);
+        return socket?.readyState === WebSocket.OPEN;
+      });
+    if (!authorized) {
+      throw new CliError("PEER_IDENTITY_REQUIRED", "Web peer action for " + peer + " requires the managed session action token", { peer });
+    }
+    return actorPeer;
+  }
+
+  function knownPeerIds(projectCtx) {
+    const db = connectWebProject(projectCtx);
+    try {
+      return db.prepare("SELECT id FROM peers").all().map((row) => row.id);
+    } finally {
+      db.close();
+    }
+  }
+
+  function nextProjectSessionId(projectCtx, kind) {
+    return nextSessionId([
+      ...sessionsForProject(projectCtx).map((session) => session.id),
+      ...knownPeerIds(projectCtx)
+    ], kind);
+  }
+
+  return {
+    projectContexts,
+    newSessionActionToken, rememberProject, knownProjects,
+    resolveWebProjectContext, connectWebProject, projectFromRequest,
+    getSession, readActionToken, resolveWebActionSession,
+    knownPeerIds, nextProjectSessionId
+  };
+}

package/lib/web/pty-sessions.mjs

@@ -0,0 +1,203 @@
+// PTY-backed web sessions, extracted from lib/web/runtime-main.mjs.
+// startPtySession spawns node-pty children as tracked peers; the input
+// normalization helpers (options, peer id, backend choice) feed both the
+// PTY and tmux session factories.
+
+import path from 'node:path';
+import { CliError } from '../shared/errors.mjs';
+import process from 'node:process';
+import {
+  buildPeerCommand,
+  defaultSessionCommand,
+  hasResumeOpts
+} from '../integrations/providers.mjs';
+import { providerSessionPeerId } from '../core/peers/session.mjs';
+import { childSessionEnv } from '../core/sessions/launch.mjs';
+import { detectBranch } from '../project-context.mjs';
+
+export function createPtySessions(deps) {
+  const {
+    pty, ctx, sessions,
+    broadcast, closeSessionClients, sessionKey,
+    connectWebProject, nextProjectSessionId,
+    startTmuxManagedSession,
+    now, addEvent, auditPayload, refreshPeerIoHeartbeat,
+    upsertPeer, upsertCanonicalPeerBinding,
+    requestActorPeer, requestSource
+  } = deps;
+
+  function startPtySession(input) {
+    const pctx = input.projectCtx || ctx;
+    const kind = input.kind || 'shell';
+    const id = input.id || nextProjectSessionId(pctx, kind);
+    const actorPeer = requestActorPeer(input, id);
+    const auditSource = requestSource(input, 'web');
+    const key = sessionKey(pctx, id);
+    if (sessions.has(key) && sessions.get(key).status === 'running') {
+      return sessions.get(key);
+    }
+    const role = input.role || 'peer';
+    const command = input.command || defaultSessionCommand(kind);
+    const cwd = path.resolve(input.cwd || pctx.root);
+    const callerEnv = input.env && typeof input.env === 'object' ? input.env : process.env;
+    const shell = callerEnv.SHELL || process.env.SHELL || 'bash';
+    const env = childSessionEnv({
+      HCC_PEER: id,
+      HCC_ROOT: pctx.root,
+      HCC_DB: pctx.dbPath,
+      TERM: 'xterm-256color'
+    }, callerEnv);
+    const size = input.size || { cols: 100, rows: 30 };
+    const child = pty.spawn(shell, ['-c', command], {
+      name: 'xterm-256color',
+      cols: size.cols,
+      rows: size.rows,
+      cwd,
+      env
+    });
+    const session = {
+      id,
+      peerId: id,
+      actorPeer,
+      auditSource,
+      actionTokens: new Set(),
+      root: pctx.root,
+      ctx: pctx,
+      kind,
+      role,
+      command,
+      cwd,
+      pid: child.pid,
+      pty: child,
+      status: 'running',
+      createdAt: now(),
+      exitedAt: null,
+      buffer: '',
+      clients: new Set()
+    };
+    sessions.set(key, session);
+    const db = connectWebProject(pctx);
+    try {
+      upsertPeer(db, {
+        id,
+        kind,
+        role,
+        worktree: cwd,
+        branch: detectBranch(cwd),
+        pid: child.pid,
+        status: 'running',
+        capabilities: 'web-pty'
+      });
+      const canonical = upsertCanonicalPeerBinding(db, {
+        peer: id,
+        provider: input.binding?.provider || kind,
+        provider_session_id: input.binding?.provider_session_id || null,
+        provider_session_name: input.binding?.provider_session_name || null,
+        resume_mode: input.binding?.resume_mode || 'new',
+        resume_arg: input.binding?.resume_arg || null,
+        command,
+        transport: 'web-pty',
+        runtime_session_id: id
+      }, Boolean(input.force));
+      session.peerId = canonical.peer;
+      session.binding = { ...canonical.binding };
+      addEvent(db, 'web.session.started', actorPeer, null, auditPayload({
+        actor: actorPeer,
+        target: session.peerId || id,
+        source: auditSource,
+        admin: actorPeer !== (session.peerId || id),
+        command,
+        cwd,
+        pid: child.pid
+      }));
+    } finally {
+      db.close();
+    }
+    child.onData((data) => {
+      session.buffer += data;
+      if (session.buffer.length > 250000) session.buffer = session.buffer.slice(-200000);
+      broadcast(session, { type: 'data', data });
+      refreshPeerIoHeartbeat(session);
+    });
+    child.onExit((event) => {
+      session.status = 'exited';
+      session.exitedAt = now();
+      const db = connectWebProject(pctx);
+      try {
+        db.prepare('UPDATE peers SET status = ?, last_seen_at = ? WHERE id = ?').run('exited', now(), id);
+        addEvent(db, 'web.session.exited', session.actorPeer || id, null, auditPayload({
+          actor: session.actorPeer || id,
+          target: session.peerId || id,
+          source: session.auditSource || 'web',
+          ...event
+        }));
+      } finally {
+        db.close();
+      }
+      broadcast(session, { type: 'exit', event });
+      closeSessionClients(session);
+    });
+    return session;
+  }
+
+  function webSessionBuildOptions(input) {
+    const mode = input.mode || 'new';
+    if (mode === 'new') return {};
+    if (mode === 'resume') {
+      const resume = String(input.resume || '').trim();
+      if (!resume) throw new CliError('BAD_REQUEST', 'resume session required');
+      return { resume };
+    }
+    if (mode === 'last') return { last: true };
+    if (mode === 'continue') return { continue: true };
+    throw new CliError('BAD_REQUEST', `Unsupported session mode: ${mode}`);
+  }
+
+  function webSessionPeerId(projectCtx, kind, opts, input) {
+    if (input.id) return input.id;
+    if (opts.resume) return providerSessionPeerId(kind, opts.resume);
+    return nextProjectSessionId(projectCtx, kind);
+  }
+
+  function normalizeWebSessionInput(input) {
+    const pctx = input.projectCtx || ctx;
+    const kind = input.kind || 'shell';
+    if (!['claude', 'codex', 'shell'].includes(kind)) {
+      throw new CliError('BAD_REQUEST', `Unsupported session kind: ${kind}`);
+    }
+    if (input.command || input.binding) return { ...input, kind, projectCtx: pctx };
+
+    const opts = webSessionBuildOptions(input);
+    if (kind === 'shell' && hasResumeOpts(opts)) {
+      throw new CliError('BAD_REQUEST', 'Resume modes are only supported for codex and claude sessions');
+    }
+    if (kind !== 'claude' && opts.continue) {
+      throw new CliError('BAD_REQUEST', 'continue is only supported for claude sessions');
+    }
+    if (kind !== 'codex' && opts.last) {
+      throw new CliError('BAD_REQUEST', 'last is only supported for codex sessions');
+    }
+
+    const id = webSessionPeerId(pctx, kind, opts, input);
+    const built = buildPeerCommand(id, kind, opts, []);
+    return {
+      ...input,
+      id,
+      kind,
+      command: built.command,
+      binding: built.binding,
+      projectCtx: pctx
+    };
+  }
+
+  function startSession(input) {
+    const normalized = normalizeWebSessionInput(input);
+    if (normalized.backend === 'pty') return startPtySession(normalized);
+    return startTmuxManagedSession(normalized);
+  }
+
+  return {
+    startPtySession, webSessionBuildOptions, webSessionPeerId,
+    normalizeWebSessionInput, startSession
+  };
+}