@runweave/server-linux-x64 0.1.11 → 0.1.12

package/manifest.json

@@ -6,8 +6,8 @@
     "protocolVersion": 1,
     "entry": "pty-host/index.cjs"
   },
-  "version": "0.1.11",
-  "sourceRevision": "7578c0782181a4db7b089ce1955082ecf8b53fcb",
+  "version": "0.1.12",
+  "sourceRevision": "2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6",
   "platform": "linux",
   "arch": "x64",
   "nodeModuleAbi": "127",
@@ -30,7 +30,7 @@
     {
       "path": "app-server/build-info.json",
       "size": 286,
-      "sha256": "bbb0b4273c1f90b6f3577e33ea7da89d6f91b9596f5a6e9aedd2c560f720dd0e"
+      "sha256": "c702c8fd4632749a3ce27aa0f7e3a66fb0129017b37f7876efb37665551c461e"
     },
     {
       "path": "app-server/configuration-compatibility.json",
@@ -40,7 +40,7 @@
     {
       "path": "app-server/index.cjs",
       "size": 1991601,
-      "sha256": "51c5d8d6d0dcd308b4682ecb08ad681410bef9ff9d15f7cf1f26fb78ad1b0acc"
+      "sha256": "64e03d0435f018c50d94975eb46713c1540f79581dd26e0a0cb759a9511dccd6"
     },
     {
       "path": "app-server/index.cjs.map",
@@ -55,7 +55,7 @@
     {
       "path": "backend/build-info.json",
       "size": 286,
-      "sha256": "42555f54ba0b0546c76b8bedb9edbc46a68dd816151deab1608e10310dd903a1"
+      "sha256": "3511fdc3647f318b6400f7e9e2292da567fa5ea5df89ce6b66f4a89ec9d4264b"
     },
     {
       "path": "backend/dev-resources/control.cjs",
@@ -69,8 +69,8 @@
     },
     {
       "path": "backend/index.cjs",
-      "size": 5746488,
-      "sha256": "37c4df8a5e14a0fe94d3572fb7f6ddfbd0635a88b017710471b0ee90b68e2256"
+      "size": 5748904,
+      "sha256": "b77195be61f40ef783fea4f7a1d5553b87a6d4866734b1af3b9e7485308f2f33"
     },
     {
       "path": "backend/ios-simulators/device_shutdown.py",
@@ -505,12 +505,12 @@
     {
       "path": "frontend/dist/build-info.json",
       "size": 286,
-      "sha256": "3bf893d05786880a4e9ee41f559595360ff1177a2f1714b7c4512814ed97322a"
+      "sha256": "01065e5cb1381b3ea289e128d9d1e23da843832590bd950451b1a7e21f19ef35"
     },
     {
       "path": "frontend/dist/companion.html",
       "size": 822,
-      "sha256": "ff5dd3f246e8a17291f12f00b563aed5041782edf9d025fbbe470220091f458c"
+      "sha256": "19a85b076b2a17d4ecfe30606c44b8338e9197f96bb0bfb576097cb4fb9c0233"
     },
     {
       "path": "frontend/dist/icons/apple-touch-icon.png",
@@ -535,7 +535,7 @@
     {
       "path": "frontend/dist/index.html",
       "size": 1028,
-      "sha256": "eedae45687039503548caa713d5e4f03dcb7457e5f59f34323c567aaed4a269d"
+      "sha256": "61ba75aadb6b23c6440af75d9875adee493fda7ea166bfb435ba9b215c50e360"
     },
     {
       "path": "frontend/dist/manifest.webmanifest",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runweave/server-linux-x64",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "license": "MIT",
   "repository": {
     "type": "git",

package/payload/app-server/build-info.json

@@ -1,8 +1,8 @@
 {
   "version": "0.1.0",
-  "buildId": "20261109T095851541Z-7578c078",
-  "sourceRevision": "7578c0782181a4db7b089ce1955082ecf8b53fcb",
+  "buildId": "20261109T114447447Z-2137d8fa",
+  "sourceRevision": "2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6",
   "sourceDirty": false,
-  "builtAt": "2026-11-09T09:58:51.541Z",
+  "builtAt": "2026-11-09T11:44:47.447Z",
   "contentSha256": "ee24c2adfe7a38b0f7698d68d8493b560042b699baba92c63e79961518d9a9af"
 }

package/payload/app-server/index.cjs

@@ -1,4 +1,4 @@
-/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T095851541Z-7578c078","sourceRevision":"7578c0782181a4db7b089ce1955082ecf8b53fcb","sourceDirty":false,"builtAt":"2026-11-09T09:58:51.541Z","contentSha256":"ee24c2adfe7a38b0f7698d68d8493b560042b699baba92c63e79961518d9a9af"};
+/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T114447447Z-2137d8fa","sourceRevision":"2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6","sourceDirty":false,"builtAt":"2026-11-09T11:44:47.447Z","contentSha256":"ee24c2adfe7a38b0f7698d68d8493b560042b699baba92c63e79961518d9a9af"};
 const __IMPORT_META_URL__ = require('url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;

package/payload/backend/build-info.json

@@ -1,8 +1,8 @@
 {
   "version": "0.1.0",
-  "buildId": "20261109T095851036Z-7578c078",
-  "sourceRevision": "7578c0782181a4db7b089ce1955082ecf8b53fcb",
+  "buildId": "20261109T114446842Z-2137d8fa",
+  "sourceRevision": "2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6",
   "sourceDirty": false,
-  "builtAt": "2026-11-09T09:58:51.036Z",
-  "contentSha256": "594e17077399e80b4363f9e842cbedd629e811d5e8779f22aa6fc4b9aa4128f1"
+  "builtAt": "2026-11-09T11:44:46.842Z",
+  "contentSha256": "170984239a9c787cca301a61b3656704c8500945c978db6f3b97a5f716b40682"
 }

package/payload/backend/index.cjs

@@ -1,4 +1,4 @@
-/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T095851036Z-7578c078","sourceRevision":"7578c0782181a4db7b089ce1955082ecf8b53fcb","sourceDirty":false,"builtAt":"2026-11-09T09:58:51.036Z","contentSha256":"594e17077399e80b4363f9e842cbedd629e811d5e8779f22aa6fc4b9aa4128f1"};
+/* runweave:build-info */var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T114446842Z-2137d8fa","sourceRevision":"2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6","sourceDirty":false,"builtAt":"2026-11-09T11:44:46.842Z","contentSha256":"170984239a9c787cca301a61b3656704c8500945c978db6f3b97a5f716b40682"};
 const __IMPORT_META_URL__ = require('url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;
@@ -71985,10 +71985,7 @@ var PtyHostClient = class _PtyHostClient {
     });
     this.socket.on("close", () => {
       this.connected = false;
-      for (const request2 of this.pending.values()) {
-        clearTimeout(request2.timer);
-        request2.reject(new Error("HOST_CONNECTION_LOST"));
-      }
+      for (const request2 of this.pending.values()) request2.reject(new Error("HOST_CONNECTION_LOST"));
       this.pending.clear();
       for (const listener of this.disconnected) listener();
     });
@@ -71997,8 +71994,6 @@ var PtyHostClient = class _PtyHostClient {
       if (message2.requestId) {
         const request2 = this.pending.get(message2.requestId);
         if (!request2) return;
-        clearTimeout(request2.timer);
-        this.pending.delete(message2.requestId);
         if (message2.error) request2.reject(new Error(message2.error));
         else request2.resolve(message2.result);
       } else if (message2.type) for (const listener of this.events) listener(value);
@@ -72030,16 +72025,38 @@ var PtyHostClient = class _PtyHostClient {
       throw error2;
     }
   }
-  request(action, body2 = {}) {
+  /** Aborting only releases this caller's wait; it does not cancel or replay Host operations. */
+  request(action, body2 = {}, signal) {
+    if (signal?.aborted) return Promise.reject(new Error("HOST_REQUEST_ABORTED"));
     if (!this.connected) return Promise.reject(new Error("HOST_CONNECTION_LOST"));
     const requestId = (0, import_node_crypto14.randomUUID)();
     return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => {
+      const cleanup = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", abort);
         this.pending.delete(requestId);
-        reject(new Error("HOST_REQUEST_UNCERTAIN"));
-      }, 15e3);
-      this.pending.set(requestId, { resolve: (value) => resolve(value), reject, timer });
-      sendJson(this.socket, { requestId, token: this.token, hostInstanceId: this.descriptor.hostInstanceId, action, body: body2 });
+      };
+      const request2 = {
+        resolve: (value) => {
+          cleanup();
+          resolve(value);
+        },
+        reject: (error2) => {
+          cleanup();
+          reject(error2);
+        }
+      };
+      const abort = () => request2.reject(new Error("HOST_REQUEST_ABORTED"));
+      const timer = setTimeout(() => request2.reject(new Error("HOST_REQUEST_UNCERTAIN")), 15e3);
+      this.pending.set(requestId, request2);
+      signal?.addEventListener("abort", abort, { once: true });
+      try {
+        if (!sendJson(this.socket, { requestId, token: this.token, hostInstanceId: this.descriptor.hostInstanceId, action, body: body2 })) {
+          request2.reject(new Error("HOST_CONNECTION_LOST"));
+        }
+      } catch (error2) {
+        request2.reject(error2);
+      }
     });
   }
   close() {
@@ -112240,9 +112257,6 @@ function registerDesktopNetworkRoutes(app, requireAuth) {
     });
 }
 
-// backend/src/remote/routes.ts
-var import_node_crypto57 = require("node:crypto");
-
 // packages/shared/src/remote/index.ts
 function isRemoteBrowserProfileState(value) {
   if (!value || typeof value !== "object") return false;
@@ -112569,13 +112583,63 @@ function registerRemoteCapabilitiesRoute(app, requireTunnelAuth, requireAuth, br
   });
 }
 
-// backend/src/remote/routes.ts
-function matchesHookToken(value, expected) {
-  if (typeof value !== "string" || !expected) return false;
+// backend/src/remote/terminal-hook-auth.ts
+var import_node_crypto57 = require("node:crypto");
+function matchesToken2(value, expected) {
+  if (!expected) return false;
   const supplied = Buffer.from(value);
   const actual = Buffer.from(expected);
   return supplied.length === actual.length && (0, import_node_crypto57.timingSafeEqual)(supplied, actual);
 }
+async function authenticatesTerminal(value, terminalId, sessions, signal) {
+  signal.throwIfAborted();
+  if (typeof value !== "string" || !value) return false;
+  if (matchesToken2(value, process.env.RUNWEAVE_HOOK_TOKEN)) return true;
+  if (!usesPtyHost()) return false;
+  const session = sessions.getSession(terminalId);
+  const binding = session?.ptyHost;
+  if (!binding || session.status !== "running") return false;
+  const host = await getPtyHost();
+  signal.throwIfAborted();
+  if (host.descriptor.hostInstanceId !== binding.hostInstanceId) return false;
+  const hosted = (await host.request("listSessions", {}, signal)).find(
+    (item) => item.terminalSessionId === terminalId && item.hostInstanceId === binding.hostInstanceId && item.sessionInstanceId === binding.sessionInstanceId
+  );
+  return hosted?.status === "running" && matchesToken2(value, hosted.gatewayToken);
+}
+function createRequireTerminalHook(sessions) {
+  return async (req, res, next) => {
+    if (res.destroyed) return;
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    const aborted2 = new Promise((_resolve, reject) => {
+      controller.signal.onabort = () => reject(new Error("Terminal authentication aborted"));
+    });
+    const timeout = setTimeout(cancel, 4e3);
+    res.once("close", cancel);
+    try {
+      const authenticated = await Promise.race([
+        authenticatesTerminal(req.headers["x-runweave-hook-token"], String(req.params.id), sessions, controller.signal),
+        aborted2
+      ]);
+      controller.signal.throwIfAborted();
+      if (res.destroyed) return;
+      if (!authenticated) {
+        res.sendStatus(401);
+        return;
+      }
+      next();
+    } catch {
+      if (!res.destroyed) res.status(503).json({ code: "DESKTOP_UNAVAILABLE", message: "Terminal runtime authentication is unavailable" });
+    } finally {
+      clearTimeout(timeout);
+      res.off("close", cancel);
+      controller.signal.onabort = null;
+    }
+  };
+}
+
+// backend/src/remote/routes.ts
 function sendError(res, error2) {
   if (error2 instanceof RemoteBrowserError) {
     res.status(error2.status).json({ code: error2.code, message: error2.message });
@@ -112586,14 +112650,11 @@ function sendError(res, error2) {
 function registerRemoteBrowserRoutes(app, auth, sessions, requireTunnelAuth, browserProfileDir, backendId) {
   const bindings = new DesktopBrowserBindings(sessions);
   const requireAuth = createRequireAuth(auth);
+  const requireTerminalHook = createRequireTerminalHook(sessions);
   registerDesktopNetworkRoutes(app, requireAuth);
   registerRemoteCapabilitiesRoute(app, requireTunnelAuth, requireAuth, browserProfileDir, backendId);
-  app.get("/api/terminal/session/:id/runtime-identity", (req, res) => {
-    if (!matchesHookToken(req.headers["x-runweave-hook-token"], process.env.RUNWEAVE_HOOK_TOKEN)) {
-      res.sendStatus(401);
-      return;
-    }
-    const session = sessions.getSession(req.params.id);
+  app.get("/api/terminal/session/:id/runtime-identity", requireTerminalHook, (req, res) => {
+    const session = sessions.getSession(String(req.params.id));
     if (!session) {
       res.status(404).json({ code: "terminal_session_not_found" });
       return;
@@ -112650,18 +112711,14 @@ function registerRemoteBrowserRoutes(app, auth, sessions, requireTunnelAuth, bro
       sendError(res, error2);
     }
   });
-  app.post("/api/terminal/session/:id/browser/capability", (req, res) => {
-    if (!matchesHookToken(req.headers["x-runweave-hook-token"], process.env.RUNWEAVE_HOOK_TOKEN)) {
-      res.sendStatus(401);
-      return;
-    }
+  app.post("/api/terminal/session/:id/browser/capability", requireTerminalHook, (req, res) => {
     const projectId = req.body?.projectId;
     if (typeof projectId !== "string") {
       res.sendStatus(400);
       return;
     }
     try {
-      res.json({ capability: bindings.issueCapability(req.params.id, projectId), expiresIn: 3600 });
+      res.json({ capability: bindings.issueCapability(String(req.params.id), projectId), expiresIn: 3600 });
     } catch (error2) {
       sendError(res, error2);
     }

package/payload/frontend/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "version": "0.1.0",
-  "buildId": "20261109T095850254Z-7578c078",
-  "sourceRevision": "7578c0782181a4db7b089ce1955082ecf8b53fcb",
+  "buildId": "20261109T114445902Z-2137d8fa",
+  "sourceRevision": "2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6",
   "sourceDirty": false,
-  "builtAt": "2026-11-09T09:58:50.254Z",
+  "builtAt": "2026-11-09T11:44:45.902Z",
   "contentSha256": "d88edba1ac622f799a43f96f04cacdfb2052f2b959dae733f3feb164b615427b"
 }

package/payload/frontend/dist/companion.html

@@ -1,6 +1,6 @@
 <!doctype html>
 <html lang="zh-CN">
-  <head><script data-runweave-build-info>var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T095850254Z-7578c078","sourceRevision":"7578c0782181a4db7b089ce1955082ecf8b53fcb","sourceDirty":false,"builtAt":"2026-11-09T09:58:50.254Z","contentSha256":"d88edba1ac622f799a43f96f04cacdfb2052f2b959dae733f3feb164b615427b"};</script>
+  <head><script data-runweave-build-info>var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T114445902Z-2137d8fa","sourceRevision":"2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6","sourceDirty":false,"builtAt":"2026-11-09T11:44:45.902Z","contentSha256":"d88edba1ac622f799a43f96f04cacdfb2052f2b959dae733f3feb164b615427b"};</script>
 
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />

package/payload/frontend/dist/index.html

@@ -1,6 +1,6 @@
 <!doctype html>
 <html lang="en">
-  <head><script data-runweave-build-info>var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T095850254Z-7578c078","sourceRevision":"7578c0782181a4db7b089ce1955082ecf8b53fcb","sourceDirty":false,"builtAt":"2026-11-09T09:58:50.254Z","contentSha256":"d88edba1ac622f799a43f96f04cacdfb2052f2b959dae733f3feb164b615427b"};</script>
+  <head><script data-runweave-build-info>var __RUNWEAVE_BUILD_INFO__={"version":"0.1.0","buildId":"20261109T114445902Z-2137d8fa","sourceRevision":"2137d8fa9eae70d0ab4070212c1cb4e8bb9e2fa6","sourceDirty":false,"builtAt":"2026-11-09T11:44:45.902Z","contentSha256":"d88edba1ac622f799a43f96f04cacdfb2052f2b959dae733f3feb164b615427b"};</script>
 
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />