@mininglamp-oss/octo-runtime 0.0.0-stage → 1.0.0

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/dist/index.js

@@ -0,0 +1,425 @@
+import { createServer } from "node:http";
+import { randomUUID, randomBytes } from "node:crypto";
+import { mkdir, realpath, readdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { resolve, isAbsolute, join, extname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { InvokeInput, INVOKE_REQUEST_MAX_BYTES, CONTEXT_SCHEMA, assertContextEnvelope } from "@mininglamp-oss/octo-runtime-protocol";
+import { mergeConfiguredContexts } from "@mininglamp-oss/octo-runtime-daemon";
+import { SessionStore, validMessages, validBinding } from "./store.js";
+export const name = "webui";
+export default function load(ctx, config) {
+    return () => initialize(ctx, config);
+}
+async function initialize(ctx, config) {
+    const configuredPort = config.port ?? 13888;
+    const port = typeof configuredPort === "number" ? configuredPort : 0;
+    const host = "127.0.0.1";
+    const errors = [];
+    const active = new Map();
+    const tasks = new Set();
+    const deleting = new Set();
+    let clearing = false;
+    const secret = randomBytes(32).toString("hex");
+    const server = createServer((req, res) => {
+        const task = handle(req, res).catch((error) => {
+            if (res.headersSent)
+                res.destroy();
+            else
+                json(res, error instanceof HttpError ? error.status : 500, {
+                    error: error instanceof HttpError
+                        ? error.message
+                        : error instanceof Error && error.message === "WEBUI_STORE_TOO_LARGE"
+                            ? "WEBUI_STORE_TOO_LARGE"
+                            : "WEBUI_REQUEST_FAILED"
+                });
+        });
+        tasks.add(task);
+        void task.finally(() => tasks.delete(task));
+    });
+    ctx.onStatus(() => ({
+        listening: server.listening,
+        host,
+        port: typeof port === "number" ? port : 13888,
+        activeRequests: active.size,
+        errors
+    }));
+    ctx.onDispose(async () => {
+        for (const run of active.values())
+            run.controller.abort();
+        const closed = new Promise((accept, reject) => server.close((error) => !error || error.code === "ERR_SERVER_NOT_RUNNING"
+            ? accept()
+            : reject(error)));
+        server.closeAllConnections();
+        await Promise.all([closed, ...tasks]);
+    });
+    if (!Number.isInteger(port) || Number(port) < 1 || Number(port) > 65535) {
+        errors.push("WEBUI_PORT_INVALID");
+        return;
+    }
+    if (typeof config.sessionStorePath !== "string" || !isAbsolute(config.sessionStorePath)) {
+        errors.push("WEBUI_STORE_PATH_REQUIRED");
+        return;
+    }
+    let configuredContext;
+    try {
+        const value = config.context ?? { schema: CONTEXT_SCHEMA, items: [] };
+        assertContextEnvelope(value);
+        configuredContext = value;
+    }
+    catch {
+        errors.push("WEBUI_CONTEXT_INVALID");
+        return;
+    }
+    const store = new SessionStore(config.sessionStorePath);
+    try {
+        await store.open();
+    }
+    catch {
+        errors.push("WEBUI_STORE_INVALID");
+        return;
+    }
+    const defaultProject = typeof config.defaultProjectPath === "string"
+        ? resolve(config.defaultProjectPath)
+        : join(homedir(), "octo-runtime-workspace");
+    await mkdir(defaultProject, { recursive: true });
+    const defaultProjectPath = await realpath(defaultProject);
+    const staticRoot = fileURLToPath(new URL("./web/", import.meta.url));
+    ctx.signal.throwIfAborted();
+    try {
+        await new Promise((accept, reject) => {
+            server.once("error", reject);
+            server.listen(port, host, () => {
+                server.off("error", reject);
+                accept();
+            });
+        });
+    }
+    catch (error) {
+        errors.push(error.code === "EADDRINUSE"
+            ? "WEBUI_ADDRESS_IN_USE"
+            : "WEBUI_LISTEN_FAILED");
+        return;
+    }
+    server.on("error", () => {
+        errors.push("WEBUI_LISTEN_FAILED");
+        server.close();
+    });
+    const origin = `http://${host}:${port}`;
+    async function stop(sessionId) {
+        const runs = [...active.values()].filter((run) => !sessionId || run.sessionId === sessionId);
+        for (const run of runs)
+            run.controller.abort();
+        await Promise.all(runs.map((run) => run.done));
+    }
+    async function handle(req, res) {
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.setHeader("Referrer-Policy", "no-referrer");
+        if (req.headers.host !== `${host}:${port}` || req.headers["sec-fetch-site"] === "cross-site")
+            throw new HttpError(403, "WEBUI_ORIGIN_REJECTED");
+        const url = new URL(req.url ?? "/", origin);
+        if (!url.pathname.startsWith("/api/")) {
+            if (req.method !== "GET")
+                throw new HttpError(405, "GET_REQUIRED");
+            const path = url.pathname === "/" ? "index.html" : url.pathname.slice(1);
+            if (!/^(index\.html|assets\/[a-zA-Z0-9_.-]+)$/.test(path))
+                throw new HttpError(404, "NOT_FOUND");
+            let bytes;
+            try {
+                bytes = await readFile(join(staticRoot, path));
+            }
+            catch {
+                throw new HttpError(404, "NOT_FOUND");
+            }
+            if (path === "index.html")
+                res.setHeader("Set-Cookie", `octo_webui=${secret}; HttpOnly; SameSite=Strict; Path=/`);
+            res.setHeader("Content-Type", {
+                ".html": "text/html; charset=utf-8",
+                ".js": "text/javascript",
+                ".css": "text/css"
+            }[extname(path)] ?? "application/octet-stream");
+            res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'");
+            res.end(bytes);
+            return;
+        }
+        if (!req.headers.cookie?.split(";").some((value) => value.trim() === `octo_webui=${secret}`))
+            throw new HttpError(401, "WEBUI_SESSION_REQUIRED");
+        if (req.method !== "GET" &&
+            (req.headers.origin !== origin || req.headers["x-webui-token"] !== secret))
+            throw new HttpError(403, "WEBUI_ORIGIN_REJECTED");
+        if (req.method === "GET" && url.pathname === "/api/bootstrap")
+            return json(res, 200, { token: secret, defaultProjectPath });
+        if (req.method === "GET" && url.pathname === "/api/adapters") {
+            if (!ctx.adapterHost.list)
+                throw new HttpError(503, "ADAPTER_LIST_UNAVAILABLE");
+            const adapters = await ctx.adapterHost.list();
+            return json(res, 200, adapters.map((adapter) => ({
+                providerType: adapter.type,
+                available: adapter.available === true,
+                providerVersion: adapter.providerVersion,
+                unavailableReason: adapter.unavailableReason
+            })));
+        }
+        if (req.method === "GET" && url.pathname === "/api/directories") {
+            const path = await directory(url.searchParams.get("path") ?? defaultProjectPath);
+            const entries = await readdir(path, { withFileTypes: true });
+            return json(res, 200, {
+                path,
+                parent: resolve(path, ".."),
+                directories: entries
+                    .filter((entry) => entry.isDirectory() && !entry.name.startsWith("."))
+                    .map((entry) => ({ name: entry.name, path: join(path, entry.name) }))
+                    .sort((a, b) => a.name.localeCompare(b.name))
+                    .slice(0, 1000)
+            });
+        }
+        if (req.method === "GET" && url.pathname === "/api/sessions")
+            return json(res, 200, [...store.records]
+                .sort((a, b) => b.updatedAt - a.updatedAt)
+                .map((session) => ({
+                id: session.id,
+                title: session.title,
+                projectPath: session.projectPath,
+                adapter: session.adapter,
+                model: session.model,
+                effort: session.effort,
+                revision: session.revision,
+                updatedAt: session.updatedAt,
+                active: [...active.values()].some((run) => run.sessionId === session.id)
+            })));
+        const match = /^\/api\/sessions\/([a-f0-9-]+)$/.exec(url.pathname);
+        if (match && req.method === "GET")
+            return json(res, 200, find(match[1]));
+        if (req.method === "POST" && url.pathname === "/api/sessions") {
+            if (clearing)
+                throw new HttpError(409, "WEBUI_CLEARING");
+            const body = await bodyJson(req);
+            const projectPath = await directory(typeof body.projectPath === "string" ? body.projectPath : defaultProjectPath);
+            const session = {
+                id: randomUUID(),
+                projectPath,
+                title: "新对话",
+                updatedAt: Date.now(),
+                revision: 0,
+                adapter: "",
+                model: "",
+                effort: "medium",
+                messages: []
+            };
+            await store.change((records) => {
+                if (records.length >= 100) {
+                    const candidate = [...records]
+                        .filter((s) => ![...active.values()].some((run) => run.sessionId === s.id))
+                        .sort((a, b) => a.updatedAt - b.updatedAt)[0];
+                    if (!candidate)
+                        throw new HttpError(409, "WEBUI_SESSIONS_BUSY");
+                    records.splice(records.findIndex((s) => s.id === candidate.id), 1);
+                }
+                records.push(session);
+            });
+            return json(res, 201, session);
+        }
+        if (match && req.method === "PATCH") {
+            const id = match[1];
+            if (clearing || deleting.has(id))
+                throw new HttpError(409, "WEBUI_CLEARING");
+            const body = await bodyJson(req);
+            if (!validMessages(body.messages) ||
+                typeof body.title !== "string" ||
+                body.title.length > 200 ||
+                !["adapter", "model", "effort"].every((key) => typeof body[key] === "string" && String(body[key]).length < 300))
+                throw new HttpError(400, "WEBUI_SESSION_INVALID");
+            if (body.providerSession !== undefined && !validBinding(body.providerSession))
+                throw new HttpError(400, "WEBUI_BINDING_INVALID");
+            const result = await store.change((records) => {
+                const session = records.find((s) => s.id === id);
+                if (!session)
+                    throw new HttpError(404, "WEBUI_SESSION_NOT_FOUND");
+                if (session.revision !== body.revision)
+                    throw new HttpError(409, "WEBUI_REVISION_CONFLICT");
+                Object.assign(session, {
+                    messages: body.messages,
+                    title: body.title,
+                    adapter: body.adapter,
+                    model: body.model,
+                    effort: body.effort,
+                    ...(body.providerSession ? { providerSession: body.providerSession } : {}),
+                    updatedAt: Date.now(),
+                    revision: session.revision + 1
+                });
+                return session;
+            });
+            return json(res, 200, result);
+        }
+        if (req.method === "DELETE" && (match || url.pathname === "/api/sessions")) {
+            const id = match?.[1];
+            if (id)
+                deleting.add(id);
+            else
+                clearing = true;
+            try {
+                await stop(id);
+                await store.change((records) => {
+                    if (id) {
+                        const index = records.findIndex((s) => s.id === id);
+                        if (index >= 0)
+                            records.splice(index, 1);
+                    }
+                    else
+                        records.splice(0);
+                });
+                return json(res, 200, { cleared: true });
+            }
+            finally {
+                if (id)
+                    deleting.delete(id);
+                else
+                    clearing = false;
+            }
+        }
+        if (req.method === "POST" && url.pathname === "/api/invoke") {
+            let input;
+            try {
+                input = InvokeInput.check(await bodyJson(req));
+                // WebUI 是本轮发起方：显式请求同 key 整项覆盖配置，instructions 不暗中拼接默认人设。
+                input = {
+                    ...input,
+                    contexts: {
+                        schema: CONTEXT_SCHEMA,
+                        items: mergeConfiguredContexts(configuredContext.items, input.contexts.items)
+                    }
+                };
+            }
+            catch {
+                throw new HttpError(400, "WEBUI_INVOKE_INVALID");
+            }
+            const session = find(input.sessionId ?? "");
+            if (clearing ||
+                deleting.has(session.id) ||
+                active.size >= 4 ||
+                [...active.values()].some((run) => run.sessionId === session.id))
+                throw new HttpError(409, "WEBUI_SESSION_BUSY");
+            if (input.protocol_mode !== "canonical" ||
+                (await directory(input.workdir ?? "")) !== session.projectPath ||
+                !input.invocationId)
+                throw new HttpError(400, "WEBUI_INVOKE_INVALID");
+            if (clearing ||
+                deleting.has(session.id) ||
+                active.size >= 4 ||
+                [...active.values()].some((run) => run.sessionId === session.id))
+                throw new HttpError(409, "WEBUI_SESSION_BUSY");
+            if (JSON.stringify(input.providerSession) !== JSON.stringify(session.providerSession))
+                throw new HttpError(409, "WEBUI_BINDING_CONFLICT");
+            const id = input.invocationId;
+            if (active.has(id))
+                throw new HttpError(409, "WEBUI_INVOCATION_EXISTS");
+            const controller = new AbortController();
+            const abort = () => controller.abort();
+            res.once("close", abort);
+            ctx.signal.addEventListener("abort", abort, { once: true });
+            let finish;
+            const done = new Promise((accept) => {
+                finish = accept;
+            });
+            active.set(id, { sessionId: session.id, controller, done });
+            res.writeHead(200, {
+                "Content-Type": "text/event-stream; charset=utf-8",
+                "Cache-Control": "no-store"
+            });
+            res.flushHeaders();
+            try {
+                await pipeline(Readable.from((async function* () {
+                    try {
+                        for await (const event of ctx.adapterHost.invoke(input, {
+                            signal: controller.signal
+                        }))
+                            yield `data: ${JSON.stringify(event)}\n\n`;
+                    }
+                    catch {
+                        if (!controller.signal.aborted)
+                            yield 'event: error\ndata: {"error":"HOST_INVOKE_FAILED"}\n\n';
+                    }
+                })()), res, { signal: controller.signal });
+            }
+            catch {
+                res.destroy();
+            }
+            finally {
+                controller.abort();
+                active.delete(id);
+                res.off("close", abort);
+                ctx.signal.removeEventListener("abort", abort);
+                finish();
+            }
+            return;
+        }
+        const runMatch = /^\/api\/invocations\/([a-f0-9-]+)\/(cancel|respond)$/.exec(url.pathname);
+        if (req.method === "POST" && runMatch) {
+            const run = active.get(runMatch[1]);
+            if (!run)
+                throw new HttpError(409, "WEBUI_INVOCATION_INACTIVE");
+            if (runMatch[2] === "cancel") {
+                await ctx.adapterHost.cancel(runMatch[1], "user");
+                return json(res, 200, { requested: true });
+            }
+            await ctx.adapterHost.respondInteraction(runMatch[1], (await bodyJson(req)));
+            return json(res, 200, { submitted: true });
+        }
+        throw new HttpError(404, "NOT_FOUND");
+    }
+    function find(id) {
+        const session = store.records.find((s) => s.id === id);
+        if (!session)
+            throw new HttpError(404, "WEBUI_SESSION_NOT_FOUND");
+        return session;
+    }
+}
+class HttpError extends Error {
+    status;
+    constructor(status, code) {
+        super(code);
+        this.status = status;
+    }
+}
+function json(res, status, value) {
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store"
+    });
+    res.end(JSON.stringify(value));
+}
+async function directory(path) {
+    try {
+        if (!isAbsolute(path))
+            throw new Error();
+        const result = await realpath(path);
+        if (!(await stat(result)).isDirectory())
+            throw new Error();
+        return result;
+    }
+    catch {
+        throw new HttpError(400, "WEBUI_DIRECTORY_INVALID");
+    }
+}
+async function bodyJson(req) {
+    let size = 0;
+    const chunks = [];
+    for await (const chunk of req) {
+        const bytes = chunk;
+        size += bytes.length;
+        if (size > INVOKE_REQUEST_MAX_BYTES)
+            throw new HttpError(413, "WEBUI_BODY_TOO_LARGE");
+        chunks.push(bytes);
+    }
+    try {
+        const value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new HttpError(400, "WEBUI_JSON_INVALID");
+    }
+}

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/dist/store.d.ts

@@ -0,0 +1,22 @@
+export interface Session {
+    id: string;
+    title: string;
+    projectPath: string;
+    updatedAt: number;
+    revision: number;
+    adapter: string;
+    model: string;
+    effort: string;
+    providerSession?: Record<string, unknown>;
+    messages: unknown[];
+}
+export declare function validMessages(value: unknown): value is unknown[];
+export declare function validBinding(value: unknown): value is Record<string, unknown>;
+export declare class SessionStore {
+    readonly path: string;
+    records: Session[];
+    private queue;
+    constructor(path: string);
+    open(): Promise<void>;
+    change<T>(operation: (records: Session[]) => T): Promise<T>;
+}

package/node_modules/@mininglamp-oss/octo-runtime-extra-webui/dist/store.js

@@ -0,0 +1,80 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+export function validMessages(value) {
+    return (Array.isArray(value) &&
+        value.every((message) => {
+            if (!message || typeof message !== "object" || Array.isArray(message))
+                return false;
+            const row = message;
+            return (typeof row.id === "string" &&
+                typeof row.role === "string" &&
+                ["user", "assistant", "system"].includes(row.role) &&
+                typeof row.content === "string" &&
+                typeof row.createdAt === "number" &&
+                Number.isFinite(row.createdAt));
+        }));
+}
+export function validBinding(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        typeof value.sessionId === "string" &&
+        !!value.sessionId);
+}
+export class SessionStore {
+    path;
+    records = [];
+    queue = Promise.resolve();
+    constructor(path) {
+        this.path = path;
+    }
+    async open() {
+        try {
+            const text = await readFile(this.path, "utf8");
+            if (Buffer.byteLength(text) > 32 * 1024 * 1024)
+                throw new Error("WEBUI_STORE_TOO_LARGE");
+            const data = JSON.parse(text);
+            if (data.version !== 1 ||
+                !Array.isArray(data.sessions) ||
+                data.sessions.length > 100 ||
+                data.sessions.some((s) => typeof s.id !== "string" ||
+                    !/^[a-f0-9-]{36}$/.test(s.id) ||
+                    typeof s.projectPath !== "string" ||
+                    typeof s.title !== "string" ||
+                    !["adapter", "model", "effort"].every((key) => typeof s[key] === "string") ||
+                    !Number.isFinite(s.updatedAt) ||
+                    !validMessages(s.messages) ||
+                    (s.providerSession !== undefined && !validBinding(s.providerSession)) ||
+                    !Number.isSafeInteger(s.revision) ||
+                    s.revision < 0))
+                throw new Error("WEBUI_STORE_INVALID");
+            if (new Set(data.sessions.map((session) => session.id)).size !== data.sessions.length)
+                throw new Error("WEBUI_STORE_INVALID");
+            this.records = data.sessions;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    change(operation) {
+        const task = this.queue
+            .catch(() => undefined)
+            .then(async () => {
+            const next = structuredClone(this.records);
+            const result = operation(next);
+            const text = JSON.stringify({ version: 1, sessions: next });
+            if (Buffer.byteLength(text) > 32 * 1024 * 1024)
+                throw new Error("WEBUI_STORE_TOO_LARGE");
+            await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+            const temporary = `${this.path}.${randomUUID()}.tmp`;
+            await writeFile(temporary, text, { mode: 0o600, flag: "wx" });
+            await rename(temporary, this.path);
+            this.records = next;
+            return result;
+        });
+        this.queue = task;
+        return task;
+    }
+}