@monotykamary/localterm-server 2.56.3 → 2.58.0

package/dist/index.js

@@ -21,11 +21,13 @@ import { detectWithExplicitPort } from "./cdp/discover-explicit-endpoint.js";
 import { DaemonConfigStore } from "./daemon-config-store.js";
 import { formatCandidates, resolveCandidates, resolveCompletionContext, } from "./completion/index.js";
 import { z } from "zod";
-import { ACTIVITY_DIRNAME, ACTIVITY_REFRESH_DEBOUNCE_MS, ACTIVITY_WATCHED_PROGRAMS, AUTOMATION_EVENT_DEBOUNCE_MS, AUTOMATION_RECONCILE_MIN_DOWNTIME_MS, AUTOMATION_RUN_QUERY_PARAM, AUTOMATION_WATCH_DEBOUNCE_MS, AUTOMATION_WATCH_POST_RUN_GRACE_MS, AUTOMATION_WEBHOOK_DEBOUNCE_MS, DEFAULT_HOST, DEFAULT_PORT, FRIENDLY_HOSTNAME, GIT_DIRTY_THROTTLE_MS, GIT_MAX_REF_LENGTH, HTTP_STATUS_ACCEPTED, HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_CONFLICT, HTTP_STATUS_CREATED, HTTP_STATUS_NOT_FOUND, MAX_AUTOMATIONS, MAX_PROCESSES, MAX_SECRETS, MS_PER_MINUTE, PROCESSES_FILENAME, SECRETS_FILENAME, THEMES_FILENAME, SECRETS_SHIMS_DIRNAME, SECRET_EXPORT_SCRYPT_WORK_FACTOR, AUTOMATION_AGENT_SESSIONS_DIRNAME, SERVER_STOP_GRACE_MS, SESSION_ID_QUERY_PARAM, SESSION_ACTIVITY_WINDOW_MS, WINDOW_ID_QUERY_PARAM, WAIT_DEFAULT_TIMEOUT_MS, WS_BACKPRESSURE_THRESHOLD_BYTES, WS_CLOSE_BACKPRESSURE, WS_CLOSE_CAPACITY_REACHED, WS_CLOSE_POLICY_VIOLATION, WS_HEARTBEAT_GRACE_MS, WS_HEARTBEAT_INTERVAL_MS, WS_HEARTBEAT_TIMEOUT_MS, WS_READY_STATE_OPEN, AUTH_SECRET_FILENAME, AUTH_COOKIE_NAME, } from "./constants.js";
+import { ACTIVITY_DIRNAME, ACTIVITY_REFRESH_DEBOUNCE_MS, ACTIVITY_WATCHED_PROGRAMS, AUTOMATION_EVENT_DEBOUNCE_MS, AUTOMATION_RECONCILE_MIN_DOWNTIME_MS, AUTOMATION_RUN_QUERY_PARAM, AUTOMATION_WATCH_DEBOUNCE_MS, AUTOMATION_WATCH_POST_RUN_GRACE_MS, AUTOMATION_WEBHOOK_DEBOUNCE_MS, DEFAULT_HOST, DEFAULT_PORT, FRIENDLY_HOSTNAME, GIT_DIRTY_THROTTLE_MS, GIT_MAX_REF_LENGTH, HTTP_STATUS_ACCEPTED, HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_CONFLICT, HTTP_STATUS_CREATED, HTTP_STATUS_NOT_FOUND, MAX_AUTOMATIONS, MAX_PROCESSES, MAX_SECRETS, MS_PER_MINUTE, PROCESSES_FILENAME, SECRETS_FILENAME, THEMES_FILENAME, FONTS_FILENAME, SECRETS_SHIMS_DIRNAME, SECRET_EXPORT_SCRYPT_WORK_FACTOR, AUTOMATION_AGENT_SESSIONS_DIRNAME, SERVER_STOP_GRACE_MS, SESSION_ID_QUERY_PARAM, SESSION_ACTIVITY_WINDOW_MS, WINDOW_ID_QUERY_PARAM, WAIT_DEFAULT_TIMEOUT_MS, WS_BACKPRESSURE_THRESHOLD_BYTES, WS_CLOSE_BACKPRESSURE, WS_CLOSE_CAPACITY_REACHED, WS_CLOSE_POLICY_VIOLATION, WS_HEARTBEAT_GRACE_MS, WS_HEARTBEAT_INTERVAL_MS, WS_HEARTBEAT_TIMEOUT_MS, WS_READY_STATE_OPEN, AUTH_SECRET_FILENAME, AUTH_COOKIE_NAME, UPDATE_CHECK_FILENAME, } from "./constants.js";
 import { getDefaultShell, listKnownShells, resolveShellOverride } from "./default-shell.js";
 import { resolveWindowId } from "./utils/resolve-window-id.js";
 import { shellPathForUserShell } from "./utils/shell-path.js";
 import { openChromeInspect } from "./utils/open-chrome-inspect.js";
+import { readServerVersion } from "./utils/read-server-version.js";
+import { UpdateCheckStore } from "./update-check-store.js";
 import { ServerErrorException, serverError } from "./errors.js";
 import { AutomationGitWatcher } from "./automation-git-watcher.js";
 import { FolderWatchManager } from "./folder-watch-manager.js";
@@ -37,15 +39,17 @@ import { createDefaultSecretBackend } from "./secret-backend.js";
 import { SecretStore } from "./secret-store.js";
 import { ProcessStore } from "./process-store.js";
 import { ThemeStore } from "./theme-store.js";
+import { FontStore } from "./font-store.js";
 import { parseImportedTheme } from "./theme-parser.js";
 import { isBuiltinThemeId, BUILTIN_THEME_IDS } from "./terminal-themes.js";
+import { isBuiltinFontId } from "./terminal-fonts.js";
 import { regenerateShims } from "./secret-shims.js";
 import { encryptSecretExport, decryptSecretExport } from "./secret-export.js";
 import { ProcessActivityWatcher } from "./process-activity-watcher.js";
 import { parseCronExpression } from "./cron-expression.js";
 import { createGitWorktree, listGitWorktrees, removeGitWorktree } from "./git-worktrees.js";
 import { defaultSnapshotListeners, isSessionDescendantPid, listSessionListeningPorts, } from "./listening-ports.js";
-import { clientToServerMessageSchema, createAutomationInputSchema, createSessionInputSchema, createWorktreeInputSchema, execInputSchema, execOneShotInputSchema, launchInputSchema, resetAutomationInputSchema, secretEntrySchema, secretSetInputSchema, secretExportRequestSchema, secretImportRequestSchema, sessionInputSchema, sessionResizeSchema, processNameSchema, processSetInputSchema, importThemeInputSchema, setActiveThemeInputSchema, migrateThemesInputSchema, updateAutomationInputSchema, updateDaemonConfigInputSchema, updateSessionInputSchema, updateWorktreeConfigInputSchema, worktreeIncludeFileInputSchema, waitInputSchema, mouseInputSchema, } from "./schemas.js";
+import { clientToServerMessageSchema, createAutomationInputSchema, createSessionInputSchema, createWorktreeInputSchema, execInputSchema, execOneShotInputSchema, launchInputSchema, resetAutomationInputSchema, secretEntrySchema, secretSetInputSchema, secretExportRequestSchema, secretImportRequestSchema, sessionInputSchema, sessionResizeSchema, processNameSchema, processSetInputSchema, importThemeInputSchema, setActiveThemeInputSchema, migrateThemesInputSchema, updateFontsInputSchema, migrateFontsInputSchema, updateAutomationInputSchema, updateDaemonConfigInputSchema, updateSessionInputSchema, updateWorktreeConfigInputSchema, worktreeIncludeFileInputSchema, waitInputSchema, mouseInputSchema, updateStatusSchema, } from "./schemas.js";
 import { createNetworkPolicyMiddleware, isAllowedSourceIp, isLoopbackHost } from "./security.js";
 import { createIdentityProvider } from "./identity/factory.js";
 import { loadOrCreateAuthSecret, signSessionToken } from "./identity/session-cookie.js";
@@ -180,7 +184,7 @@ const normalizeMouseAction = (input) => {
 };
 const buildApiRoutes = (ctx) => {
     const api = new Hono();
-    const { registry, ownerFor, cdpClient, secretBackend, secretExportScryptWorkFactor, secretStore, shimsDir, processStore, themeStore, syncSecretShims, automationStore, broadcastAutomations, syncFolderWatchers, syncSessionEventListeners, webhookTriggerManager, worktreeConfigStore, portsSnapshotProcesses, portsSnapshotListeners, toAutomationWithNextRun, listAutomationsWithNextRun, tryLaunch, getCdpPort, applyCdpPort, getGraceSeconds, applyGraceSeconds, connectCdpNow, buildTabUrl, mintViewerCookie, stateDirectory, broadcastThemes, } = ctx;
+    const { registry, ownerFor, cdpClient, secretBackend, secretExportScryptWorkFactor, secretStore, shimsDir, processStore, themeStore, fontStore, syncSecretShims, automationStore, broadcastAutomations, syncFolderWatchers, syncSessionEventListeners, webhookTriggerManager, worktreeConfigStore, portsSnapshotProcesses, portsSnapshotListeners, toAutomationWithNextRun, listAutomationsWithNextRun, tryLaunch, getCdpPort, applyCdpPort, getGraceSeconds, applyGraceSeconds, connectCdpNow, buildTabUrl, mintViewerCookie, stateDirectory, broadcastThemes, broadcastFonts, updateCheckStore, } = ctx;
     // Headless SGR-1006 fallback for `mouse` when no CDP tab is reachable:
     // encode the gesture as SGR bytes and write them straight to the PTY. Closes
     // over `registry` so the automation layer stays CDP-agnostic. Coords arrive
@@ -211,6 +215,20 @@ const buildApiRoutes = (ctx) => {
             }
             : null,
     }));
+    // The daemon's cached npm update check. By default returns the non-blocking
+    // cache and kicks a background refresh when stale — so a poll from every open
+    // tab can't wedge on the registry. `?wait=1` (the CLI banner path) awaits a
+    // fresh fetch when the cache is stale so `localterm start`/`status` can print
+    // an accurate line (bounded by UPDATE_CHECK_HTTP_TIMEOUT_MS). Auth-gated like
+    // the rest of /api/*; the CLI injects the operator bearer token, the browser
+    // tab carries its session cookie.
+    api.get("/update-status", async (context) => {
+        if (context.req.query("wait") === "1") {
+            return context.json(updateStatusSchema.parse(await updateCheckStore.getFreshStatus()));
+        }
+        updateCheckStore.refreshIfStaleBackground();
+        return context.json(updateStatusSchema.parse(updateCheckStore.getStatus()));
+    });
     // Completion fast path: the shell scripts curl this with the command line
     // (repeated `argv=` query params) so the daemon resolves candidates
     // in-process — no Node startup per <Tab>. Auth-gated like the rest of /api/*
@@ -779,6 +797,58 @@ const buildApiRoutes = (ctx) => {
         broadcastThemes();
         return context.json({ activeThemeId });
     });
+    // Terminal fonts: the active font id + the user-entered custom family + the
+    // Nerd Font / ligatures toggles, stored in ~/.localterm/fonts.json so the
+    // `localterm font` CLI and every browser tab share one source of truth
+    // (replacing the per-browser localStorage the UI used to keep). GET returns
+    // the full state in one read so the client reconciles its localStorage cache
+    // in a single round-trip.
+    api.get("/fonts", (context) => context.json({
+        activeFontId: fontStore.getActive(),
+        customFontFamily: fontStore.getCustomFontFamily(),
+        nerdFontEnabled: fontStore.getNerdFontEnabled(),
+        ligaturesEnabled: fontStore.getLigaturesEnabled(),
+        initialized: fontStore.isInitialized(),
+    }));
+    // One-time migration of the browser's legacy localStorage font state. No-ops
+    // once the store is initialized (the CLI or another tab wrote first) and
+    // returns the current state so the caller can reconcile regardless.
+    api.post("/fonts/migrate", async (context) => {
+        const parsed = migrateFontsInputSchema.safeParse(await readJsonBody(context));
+        if (!parsed.success)
+            return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
+        fontStore.migrate(parsed.data);
+        broadcastFonts();
+        return context.json({
+            activeFontId: fontStore.getActive(),
+            customFontFamily: fontStore.getCustomFontFamily(),
+            nerdFontEnabled: fontStore.getNerdFontEnabled(),
+            ligaturesEnabled: fontStore.getLigaturesEnabled(),
+            initialized: fontStore.isInitialized(),
+        });
+    });
+    // Update any subset of the font settings. The client pushes only the field
+    // that changed; `activeFontId` is validated against the built-ins (incl.
+    // "custom") so a typo can't select a font that won't resolve (the client
+    // would silently fall back to the default family otherwise). Returns the
+    // full state so the caller reconciles in one read.
+    api.put("/fonts", async (context) => {
+        const parsed = updateFontsInputSchema.safeParse(await readJsonBody(context));
+        if (!parsed.success)
+            return context.json({ error: "invalid_body" }, HTTP_STATUS_BAD_REQUEST);
+        if (parsed.data.activeFontId !== undefined && !isBuiltinFontId(parsed.data.activeFontId)) {
+            return context.json({ error: "not_found" }, HTTP_STATUS_NOT_FOUND);
+        }
+        fontStore.update(parsed.data);
+        broadcastFonts();
+        return context.json({
+            activeFontId: fontStore.getActive(),
+            customFontFamily: fontStore.getCustomFontFamily(),
+            nerdFontEnabled: fontStore.getNerdFontEnabled(),
+            ligaturesEnabled: fontStore.getLigaturesEnabled(),
+            initialized: fontStore.isInitialized(),
+        });
+    });
     // Open dev ports: TCP listening sockets owned by processes descended from a
     // localterm session shell (a dev server run inside a tab). The ports modal
     // polls this while open so a dev server starting/stopping shows up live. The
@@ -1583,6 +1653,7 @@ export const createServer = async (options = {}) => {
     });
     const processStore = new ProcessStore(path.join(stateDirectory, PROCESSES_FILENAME));
     const themeStore = new ThemeStore({ filePath: path.join(stateDirectory, THEMES_FILENAME) });
+    const fontStore = new FontStore({ filePath: path.join(stateDirectory, FONTS_FILENAME) });
     const activityDir = path.join(stateDirectory, ACTIVITY_DIRNAME);
     const syncSecretShims = () => regenerateShims(processStore.list(), secretStore.envVarByName(), shimsDir, secretBackend, activityDir);
     syncSecretShims();
@@ -1803,6 +1874,22 @@ export const createServer = async (options = {}) => {
             safeSend(clientSocket, payload);
         }
     };
+    // Push the full font state to every tab on any mutation (set/family/toggle/
+    // migrate) so open terminals reflect a CLI or other-tab change instantly —
+    // the browser applies the {type:"fonts"} WS message directly, no polling.
+    const broadcastFonts = () => {
+        const payload = {
+            type: "fonts",
+            activeFontId: fontStore.getActive(),
+            customFontFamily: fontStore.getCustomFontFamily(),
+            nerdFontEnabled: fontStore.getNerdFontEnabled(),
+            ligaturesEnabled: fontStore.getLigaturesEnabled(),
+            initialized: fontStore.isInitialized(),
+        };
+        for (const clientSocket of clientSockets) {
+            safeSend(clientSocket, payload);
+        }
+    };
     const caffeinateStatePayload = () => ({
         type: "caffeinate",
         supported: caffeinateManager.supported,
@@ -2073,6 +2160,13 @@ export const createServer = async (options = {}) => {
             };
         }
     };
+    const updateCheckStore = new UpdateCheckStore({
+        filePath: path.join(stateDirectory, UPDATE_CHECK_FILENAME),
+        currentVersion: options.currentVersion ?? readServerVersion(),
+        fetcher: options.updateCheckFetcher,
+        enabled: process.env.LOCALTERM_SKIP_UPDATE_CHECK !== "1" &&
+            process.env.LOCALTERM_SKIP_UPDATE_CHECK !== "true",
+    });
     const ctx = {
         registry,
         resolveIdentity,
@@ -2084,6 +2178,7 @@ export const createServer = async (options = {}) => {
         shimsDir,
         processStore,
         themeStore,
+        fontStore,
         syncSecretShims,
         automationStore,
         broadcastAutomations,
@@ -2101,6 +2196,7 @@ export const createServer = async (options = {}) => {
         getGraceSeconds,
         applyGraceSeconds,
         broadcastThemes,
+        broadcastFonts,
         connectCdpNow,
         buildTabUrl: (sessionId) => {
             const url = new URL(localOrigin ?? publicOrigin ?? `http://${FRIENDLY_HOSTNAME}:${actualPort}`);
@@ -2109,6 +2205,7 @@ export const createServer = async (options = {}) => {
         },
         mintViewerCookie,
         stateDirectory,
+        updateCheckStore,
     };
     const api = buildApiRoutes(ctx);
     app.route("/api", api);
@@ -2493,6 +2590,12 @@ export const createServer = async (options = {}) => {
     // Arm folder-watch triggers for the automations loaded at boot.
     syncFolderWatchers();
     syncSessionEventListeners();
+    // Kick the first npm update check + arm the daily refresh so the cache stays
+    // warm for the CLI banner and the browser indicator even while no tab is
+    // open. Fire-and-forget on startup; the `?wait=1` banner path awaits the
+    // in-flight fetch, and here it just primes the cache without blocking boot.
+    updateCheckStore.start();
+    updateCheckStore.refreshIfStaleBackground();
     // Open the persistent CDP connection now, while the user is present at
     // `start` to clear any one-time remote-debugging prompt. Fire-and-forget:
     // failure just means runs fall back to the OS opener.
@@ -2512,6 +2615,7 @@ export const createServer = async (options = {}) => {
         automationScheduler.dispose();
         folderWatchManager.dispose();
         automationGitWatcher.dispose();
+        updateCheckStore.dispose();
         webhookTriggerManager.dispose();
         caffeinateManager.dispose();
         processActivityWatcher?.dispose();
@@ -2563,7 +2667,9 @@ export const createServer = async (options = {}) => {
 export { CaffeinateController } from "./caffeinate-controller.js";
 export { DEFAULT_HOST, DEFAULT_PORT, WS_CLOSE_BACKPRESSURE } from "./constants.js";
 export { isLoopbackHost, isPrivateHost, isAllowedSourceIp } from "./security.js";
-export { healthSchema, cdpHealthSchema, daemonConfigSchema, identityConfigSchema, oidcConfigSchema, passkeyConfigSchema, updateDaemonConfigInputSchema, } from "./schemas.js";
+export { healthSchema, cdpHealthSchema, daemonConfigSchema, identityConfigSchema, oidcConfigSchema, passkeyConfigSchema, updateDaemonConfigInputSchema, updateStatusSchema, } from "./schemas.js";
+export { UpdateCheckStore } from "./update-check-store.js";
+export { NPM_PACKAGE_NAME } from "./constants.js";
 export { createSessionInputSchema, sessionResponseSchema, updateSessionInputSchema, sessionInputSchema, sessionResizeSchema, execInputSchema, execOneShotInputSchema, execResultSchema, capturePaneResponseSchema, sessionsListResponseSchema, } from "./schemas.js";
 export { createDefaultSecretBackend } from "./secret-backend.js";
 export { detectChromiumBrowsers } from "./cdp/detect-chromium.js";