@ran-sh/dsh-crew 0.3.7 → 0.3.8

package/src/install/official-web.mjs

@@ -0,0 +1,132 @@
+import {
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { ensurePluginRegistration, removeCrewPluginRegistration } from '../dsh-cli-runtime.mjs';
+
+export const OFFICIAL_BRIDGE_PACKAGE = '@ran-sh/dsh-crew-web-bridge';
+const STATE_FILENAME = 'official-web.json';
+
+export function officialWebProfileDir({ home = homedir() } = {}) {
+  return join(home, '.dsh', 'profiles', 'web');
+}
+
+export function officialWebIntegrationStateFile({ home = homedir() } = {}) {
+  return join(home, '.config', 'dsh-crew', STATE_FILENAME);
+}
+
+function readState(home) {
+  try {
+    const value = JSON.parse(readFileSync(officialWebIntegrationStateFile({ home }), 'utf8'));
+    return value && typeof value === 'object' ? value : null;
+  } catch { return null; }
+}
+
+function writeState(home, value) {
+  const file = officialWebIntegrationStateFile({ home });
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(value, null, 2) + '\n');
+}
+
+function validOfficialManifest(file) {
+  if (!existsSync(file)) return { ok: false, code: 'OFFICIAL_WEB_PROFILE_NOT_FOUND' };
+  try {
+    const raw = readFileSync(file, 'utf8');
+    const manifest = JSON.parse(raw);
+    if (!manifest || typeof manifest !== 'object'
+      || (manifest.dependencies !== undefined && (!manifest.dependencies || typeof manifest.dependencies !== 'object' || Array.isArray(manifest.dependencies)))
+      || !Array.isArray(manifest.dsh?.profile?.bundles)) {
+      return { ok: false, code: 'OFFICIAL_WEB_PROFILE_INVALID' };
+    }
+    return { ok: true, raw, manifest };
+  } catch { return { ok: false, code: 'OFFICIAL_WEB_PROFILE_INVALID' }; }
+}
+
+function makeBackup({ home, profileManifest, previous }) {
+  if (previous?.backup_file && existsSync(previous.backup_file)) return previous.backup_file;
+  const backupDir = join(home, '.config', 'dsh-crew', 'backups');
+  mkdirSync(backupDir, { recursive: true });
+  const backupFile = join(backupDir, `official-web-package-${Date.now()}.json`);
+  copyFileSync(profileManifest, backupFile);
+  return backupFile;
+}
+
+export function ensureOfficialWebIntegration({ home = homedir(), releaseDir } = {}) {
+  let resolvedRelease;
+  try { resolvedRelease = realpathSync(releaseDir); } catch { return { ok: false, code: 'RELEASE_NOT_FOUND' }; }
+  const bridgeRoot = join(resolvedRelease, 'official-web-bridge');
+  const profileRoot = officialWebProfileDir({ home });
+  const profileManifest = join(profileRoot, 'package.json');
+  const profile = validOfficialManifest(profileManifest);
+  if (!profile.ok) return profile;
+  const previous = readState(home);
+  const backupFile = makeBackup({ home, profileManifest, previous });
+  const registration = ensurePluginRegistration({
+    profileRoot,
+    root: bridgeRoot,
+    name: OFFICIAL_BRIDGE_PACKAGE,
+    createProfile: false,
+  });
+  if (!registration.ok) {
+    return { ok: false, code: registration.code === 'CREW_PROFILE_METADATA_INVALID' ? 'OFFICIAL_WEB_PROFILE_INVALID' : registration.code };
+  }
+  const stateChanged = previous?.enabled !== true || previous?.release_dir !== resolvedRelease || previous?.backup_file !== backupFile;
+  writeState(home, {
+    enabled: true,
+    release_dir: resolvedRelease,
+    backup_file: backupFile,
+    package: OFFICIAL_BRIDGE_PACKAGE,
+  });
+  return { ...registration, changed: registration.changed || stateChanged, backupFile };
+}
+
+export function officialWebIntegrationStatus({ home = homedir(), releaseDir } = {}) {
+  const state = readState(home);
+  if (state?.enabled !== true) return { enabled: false, healthy: false, state };
+  const expectedRelease = releaseDir ?? state.release_dir;
+  let expectedBridge;
+  try { expectedBridge = realpathSync(join(expectedRelease, 'official-web-bridge')); } catch {
+    return { enabled: true, healthy: false, code: 'BRIDGE_RELEASE_MISSING', state };
+  }
+  const profileRoot = officialWebProfileDir({ home });
+  const profile = validOfficialManifest(join(profileRoot, 'package.json'));
+  if (!profile.ok) return { enabled: true, healthy: false, code: profile.code, state };
+  const dependency = profile.manifest.dependencies?.[OFFICIAL_BRIDGE_PACKAGE];
+  const bundled = profile.manifest.dsh.profile.bundles.includes(OFFICIAL_BRIDGE_PACKAGE);
+  const linkPath = join(profileRoot, 'node_modules', ...OFFICIAL_BRIDGE_PACKAGE.split('/'));
+  let linked = false;
+  try { linked = lstatSync(linkPath).isSymbolicLink() && realpathSync(linkPath) === expectedBridge; } catch {}
+  return { enabled: true, healthy: Boolean(dependency && bundled && linked), state, linkPath, expectedBridge };
+}
+
+export function removeOfficialWebIntegration({ home = homedir(), remember = true, preserveIntent = false } = {}) {
+  const profileRoot = officialWebProfileDir({ home });
+  const profileManifest = join(profileRoot, 'package.json');
+  const profile = validOfficialManifest(profileManifest);
+  if (!profile.ok && profile.code !== 'OFFICIAL_WEB_PROFILE_NOT_FOUND') return profile;
+  let removed = false;
+  if (profile.ok) {
+    const result = removeCrewPluginRegistration({ home, name: OFFICIAL_BRIDGE_PACKAGE, profileRoot });
+    if (!result.ok) return { ok: false, code: result.code === 'CREW_PROFILE_METADATA_INVALID' ? 'OFFICIAL_WEB_PROFILE_INVALID' : result.code };
+    removed = result.removed;
+  }
+  const previous = readState(home);
+  if (remember) writeState(home, {
+    ...(previous ?? {}),
+    enabled: preserveIntent ? previous?.enabled === true : false,
+    package: OFFICIAL_BRIDGE_PACKAGE,
+  });
+  else {
+    const stateFile = officialWebIntegrationStateFile({ home });
+    if (existsSync(stateFile)) unlinkSync(stateFile);
+  }
+  return { ok: true, removed };
+}

package/src/official-web-bridge.mjs

@@ -0,0 +1,196 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { crewDshHome } from './install/install.mjs';
+import { crewDshRuntimeModule } from './dsh-cli-runtime.mjs';
+
+export const CREW_BRIDGE_PREFIX = '/_dsh/dsh-crew';
+export const CREW_BRIDGE_TARGET = 'http://127.0.0.1:3210';
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+const HOP_BY_HOP = new Set([
+  'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+  'te', 'trailer', 'transfer-encoding', 'upgrade', 'host', 'content-length',
+]);
+
+export function isLoopbackAddress(address) {
+  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
+}
+
+function isLocalHostname(hostname) {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1';
+}
+
+export function isTrustedLocalRequest(req) {
+  if (!isLoopbackAddress(req?.socket?.remoteAddress)) return false;
+  const host = typeof req?.headers?.host === 'string' ? req.headers.host.trim().toLowerCase() : '';
+  if (!host) return false;
+  let authority;
+  try { authority = new URL(`http://${host}`); } catch { return false; }
+  if (!isLocalHostname(authority.hostname.toLowerCase())) return false;
+  const fetchSite = String(req?.headers?.['sec-fetch-site'] ?? '').toLowerCase();
+  if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'none') return false;
+  const origin = req?.headers?.origin;
+  if (origin !== undefined) {
+    if (typeof origin !== 'string') return false;
+    let parsedOrigin;
+    try { parsedOrigin = new URL(origin); } catch { return false; }
+    if (!isLocalHostname(parsedOrigin.hostname.toLowerCase()) || parsedOrigin.host.toLowerCase() !== host) return false;
+  }
+  return true;
+}
+
+function safeHeaders(source) {
+  const result = {};
+  for (const [rawName, rawValue] of Object.entries(source ?? {})) {
+    const name = rawName.toLowerCase();
+    if (HOP_BY_HOP.has(name) || rawValue === undefined) continue;
+    result[name] = Array.isArray(rawValue) ? rawValue.join(', ') : String(rawValue);
+  }
+  return result;
+}
+
+function sendJson(res, status, value) {
+  const body = Buffer.from(JSON.stringify(value));
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'content-length': String(body.length),
+    'cache-control': 'no-store',
+    'x-content-type-options': 'nosniff',
+    'x-dsh-crew-bridge': '3080-to-3210',
+  });
+  res.end(body);
+}
+
+async function readBoundedBody(req, limit = MAX_BODY_BYTES) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += value.length;
+    if (size > limit) throw Object.assign(new Error('request too large'), { code: 'BODY_TOO_LARGE' });
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks);
+}
+
+async function defaultHealthCheck(fetchImpl = globalThis.fetch) {
+  try {
+    const response = await fetchImpl(`${CREW_BRIDGE_TARGET}${CREW_BRIDGE_PREFIX}/ping`, {
+      signal: AbortSignal.timeout(1_500),
+      headers: { accept: 'application/json' },
+    });
+    return response.ok;
+  } catch { return false; }
+}
+
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export function createCrewSidecarSupervisor({
+  home = homedir(),
+  exists = existsSync,
+  healthCheck = () => defaultHealthCheck(),
+  spawnImpl = spawn,
+  wait = delay,
+  maxAttempts = 120,
+  pollInterval = 250,
+} = {}) {
+  let starting = null;
+  let runningChild = null;
+  const runtime = crewDshRuntimeModule({ home });
+  const dshHome = crewDshHome({ home });
+
+  async function start() {
+    if (await healthCheck()) return { ok: true, started: false };
+    if (!exists(runtime)) return { ok: false, code: 'CREW_RUNTIME_NOT_INSTALLED' };
+    const childAlive = runningChild && runningChild.killed !== true && runningChild.exitCode == null;
+    if (!childAlive) {
+      runningChild = spawnImpl(process.execPath, [
+        runtime, '--profile', 'dsh-crew', '--host', '127.0.0.1', '--port', '3210',
+      ], {
+        cwd: dshHome,
+        env: { ...process.env, DSH_HOME: dshHome },
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: true,
+      });
+      const ownedChild = runningChild;
+      ownedChild.once?.('exit', () => { if (runningChild === ownedChild) runningChild = null; });
+      ownedChild.unref?.();
+    }
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+      if (await healthCheck()) return { ok: true, started: true };
+      await wait(pollInterval);
+    }
+    return { ok: false, code: 'CREW_BACKEND_START_TIMEOUT' };
+  }
+
+  return {
+    ensure() {
+      if (!starting) starting = start().finally(() => { starting = null; });
+      return starting;
+    },
+  };
+}
+
+const processSupervisor = createCrewSidecarSupervisor();
+
+export async function proxyCrewRequest(req, res, {
+  fetchImpl = globalThis.fetch,
+  ensureBackend = () => processSupervisor.ensure(),
+} = {}) {
+  if (!isTrustedLocalRequest(req)) {
+    sendJson(res, 403, { ok: false, code: 'LOCAL_SAME_ORIGIN_ONLY' });
+    return;
+  }
+  let pathname;
+  try { pathname = new URL(req.url, 'http://127.0.0.1:3080').pathname; } catch { pathname = ''; }
+  if (pathname !== CREW_BRIDGE_PREFIX && !pathname.startsWith(`${CREW_BRIDGE_PREFIX}/`)) {
+    sendJson(res, 404, { ok: false, code: 'NOT_FOUND' });
+    return;
+  }
+  try {
+    const backend = await ensureBackend();
+    if (backend?.ok === false) throw new Error('backend unavailable');
+    const method = String(req.method ?? 'GET').toUpperCase();
+    const bodyBuffer = method === 'GET' || method === 'HEAD' ? null : await readBoundedBody(req);
+    const response = await fetchImpl(`${CREW_BRIDGE_TARGET}${req.url}`, {
+      method,
+      headers: safeHeaders(req.headers),
+      body: bodyBuffer === null ? undefined : new Blob([bodyBuffer]),
+      signal: AbortSignal.timeout(120_000),
+    });
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    const headers = safeHeaders(Object.fromEntries(response.headers.entries()));
+    headers['content-length'] = String(responseBody.length);
+    headers['x-dsh-crew-bridge'] = '3080-to-3210';
+    res.writeHead(response.status, headers);
+    res.end(responseBody);
+  } catch (error) {
+    if (error?.code === 'BODY_TOO_LARGE') sendJson(res, 413, { ok: false, code: 'REQUEST_TOO_LARGE' });
+    else sendJson(res, 503, { ok: false, code: 'CREW_BACKEND_UNAVAILABLE' });
+  }
+}
+
+export function registerOfficialWebBridge(ctx, options = {}) {
+  return ctx.inject(['webServer'], (webCtx) => {
+    const disposeStatus = webCtx.webServer.register({
+      kind: 'exact',
+      path: `${CREW_BRIDGE_PREFIX}/bridge-status`,
+      handler: (req, res) => {
+        if (!isTrustedLocalRequest(req)) return sendJson(res, 403, { ok: false, code: 'LOCAL_SAME_ORIGIN_ONLY' });
+        return sendJson(res, 200, { ok: true, mode: 'official-3080-isolated-3210' });
+      },
+    });
+    const disposeProxy = webCtx.webServer.register({
+      kind: 'prefix',
+      path: CREW_BRIDGE_PREFIX,
+      handler: (req, res) => proxyCrewRequest(req, res, options),
+    });
+    return () => { disposeProxy?.(); disposeStatus?.(); };
+  });
+}
+
+export async function apply(ctx) {
+  registerOfficialWebBridge(ctx);
+}

package/src/runtime-identity.mjs

@@ -8,7 +8,7 @@
 // Keep this module pure and dependency-free so Hub, MCP and tests all use the
 // exact same compatibility rules.
 
-export const RUNTIME_VERSION = '0.3.7';
+export const RUNTIME_VERSION = '0.3.8';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([