npm - @rynx-ai/server - Versions diffs - 0.1.11-beta.5 → 0.2.0-beta.2 - Mend

@rynx-ai/server 0.1.11-beta.5 → 0.2.0-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/dist/control-web/assets/{highlighted-body-OFNGDK62-B4mcMjmm.js → highlighted-body-OFNGDK62-IdclXfSt.js} +1 -1
package/dist/control-web/assets/index-DhsO7WjD.js +709 -0
package/dist/control-web/assets/{mermaid-GHXKKRXX-DnL0iDTi.js → mermaid-GHXKKRXX-BqMPrbIZ.js} +3 -3
package/dist/control-web/index.html +1 -1
package/dist/control-web-dist.d.ts +1 -1
package/dist/control-web-dist.js +4 -2
package/dist/server.d.ts +12 -1
package/dist/server.js +112 -41
package/dist/session-portal.d.ts +42 -0
package/dist/session-portal.js +746 -0
package/dist/terminal-ws.js +8 -6
package/package.json +7 -7
package/dist/control-web/assets/index-D56JQ9oi.js +0 -709

package/dist/control-web/index.html CHANGED Viewed

@@ -7,7 +7,7 @@
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <link rel="icon" type="image/png" href="/favicon.png" />
     <title>rynx · control</title>
-    <script type="module" crossorigin src="/assets/index-D56JQ9oi.js"></script>
+    <script type="module" crossorigin src="/assets/index-DhsO7WjD.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-5n6D-i-c.css">
   </head>
   <body>

package/dist/control-web-dist.d.ts CHANGED Viewed

@@ -3,4 +3,4 @@ import type { Context } from "koa";
 export declare function resolveControlWebDist(): string | null;
 /** Serve a static file from the SPA dir; missing non-asset paths fall back to
  *  index.html (client-side routing), missing assets return 404. */
-export declare function sendSpaFile(ctx: Context, distDir: string, basePath?: string): Promise<void>;
+export declare function sendSpaFile(ctx: Context, distDir: string, basePath?: string, transformIndex?: (html: string) => string): Promise<void>;

package/dist/control-web-dist.js CHANGED Viewed

@@ -37,7 +37,7 @@ export function resolveControlWebDist() {
 }
 /** Serve a static file from the SPA dir; missing non-asset paths fall back to
  *  index.html (client-side routing), missing assets return 404. */
-export async function sendSpaFile(ctx, distDir, basePath = "/") {
+export async function sendSpaFile(ctx, distDir, basePath = "/", transformIndex) {
     const path = basePath !== "/" && ctx.path.startsWith(basePath)
         ? ctx.path.slice(basePath.length) || "/"
         : ctx.path;
@@ -64,5 +64,7 @@ export async function sendSpaFile(ctx, distDir, basePath = "/") {
         }
     }
     ctx.type = CONTENT_TYPES[ext] ?? "application/octet-stream";
-    ctx.body = data;
+    ctx.body = ext === ".html" && transformIndex
+        ? transformIndex(data.toString("utf8"))
+        : data;
 }

package/dist/server.d.ts CHANGED Viewed

@@ -18,6 +18,9 @@ import { type ControlPlaneDeps, type LocalSessionResourceHost, type SessionResou
 import type { MachineSessionService } from "./machine-session-service.js";
 import type { DaemonRuntimeHost } from "./remote-runtime.js";
 import { type AttachDesktopBrowserHostServerOptions } from "./desktop-browser-host.js";
+import { type SessionPortalAuthorizationPorts } from "./session-portal.js";
+export { createSessionPortalApp, startSessionPortal } from "./session-portal.js";
+export type { SessionPortalAuthorization, SessionPortalAuthorizationPorts, SessionPortalOptions, SessionPortalServer, } from "./session-portal.js";
 import { SessionRuntimeIndex } from "./session-runtime-index.js";
 import type { SessionEmulatorService } from "./session-emulator-service.js";
 import { type SessionTerminalHost } from "./session-terminal-host.js";
@@ -132,6 +135,9 @@ export interface StartServerOptions {
     providerClis?: ProviderCliManagementHost;
     /** Private resident-app Browser Host socket, authenticated by daemonManagement. */
     desktopBrowserHost?: Omit<AttachDesktopBrowserHostServerOptions, "managementToken">;
+    /** Hashed ticket/grant authority for the native Session Portal. Required
+     * when RYNX_SESSION_PORTAL_PORT enables that listener. */
+    sessionPortalAuthorization?: SessionPortalAuthorizationPorts;
 }
 export interface SessionRuntimeServices {
     sessionStore: CodexSessionStore;
@@ -163,6 +169,11 @@ export interface PluginRuntimeHostServices {
      * closed, but cannot provision Sessions or begin Turns. */
     admissionOpen?: () => boolean;
     admissionReserve?: () => AdmissionReservation | undefined;
+    sessionPortal?: {
+        scheme: "http" | "https";
+        bindHost: string;
+        port: number;
+    };
 }
 export interface PluginRuntimeLifecycle {
     bindHostServices(services: PluginRuntimeHostServices): void;
@@ -434,4 +445,4 @@ export declare function createSessionRuntimeServices(input: {
  * no agent request / response / SSE endpoints are exposed here.
  */
 export declare function createApp({ config, control }?: CreateAppOptions): Koa<Koa.DefaultState, Koa.DefaultContext>;
-export declare function startServer({ config, control, sessionLog, sessionRegistry, pluginRuntime, daemonManagement, remoteRuntime, remoteRuntimeAdmin, runtimeTargetControl, runtimeConnectionResolver, localSessionResources, localMachineSessions, sessionEmulators, sessionRuntimeServices, sessionLifecycle, sessionTerminals, runtimeLocalBrowser, providerClis, desktopBrowserHost, }?: StartServerOptions): Promise<RynxServer>;
+export declare function startServer({ config, control, sessionLog, sessionRegistry, pluginRuntime, daemonManagement, remoteRuntime, remoteRuntimeAdmin, runtimeTargetControl, runtimeConnectionResolver, localSessionResources, localMachineSessions, sessionEmulators, sessionRuntimeServices, sessionLifecycle, sessionTerminals, runtimeLocalBrowser, providerClis, desktopBrowserHost, sessionPortalAuthorization, }?: StartServerOptions): Promise<RynxServer>;

package/dist/server.js CHANGED Viewed

@@ -10,6 +10,8 @@ import { attachBrowserSurfaceWs } from "./browser-surface-ws.js";
 import { attachEmulatorSurfaceWs } from "./emulator-surface-ws.js";
 import { attachDesktopBrowserHostServer, } from "./desktop-browser-host.js";
 import { resolveControlWebDist, sendSpaFile } from "./control-web-dist.js";
+import { startSessionPortal, } from "./session-portal.js";
+export { createSessionPortalApp, startSessionPortal } from "./session-portal.js";
 import { SessionRuntimeIndex } from "./session-runtime-index.js";
 import { createRunnerSessionTerminalHost, } from "./session-terminal-host.js";
 import { runtimeWebAccessPolicyForBindHost, } from "./runtime-web-auth.js";
@@ -137,7 +139,7 @@ export function createApp({ config = loadConfig(), control } = {}) {
     }
     return app;
 }
-export async function startServer({ config = loadConfig(), control, sessionLog, sessionRegistry, pluginRuntime, daemonManagement, remoteRuntime, remoteRuntimeAdmin, runtimeTargetControl, runtimeConnectionResolver, localSessionResources, localMachineSessions, sessionEmulators, sessionRuntimeServices, sessionLifecycle, sessionTerminals, runtimeLocalBrowser, providerClis, desktopBrowserHost, } = {}) {
+export async function startServer({ config = loadConfig(), control, sessionLog, sessionRegistry, pluginRuntime, daemonManagement, remoteRuntime, remoteRuntimeAdmin, runtimeTargetControl, runtimeConnectionResolver, localSessionResources, localMachineSessions, sessionEmulators, sessionRuntimeServices, sessionLifecycle, sessionTerminals, runtimeLocalBrowser, providerClis, desktopBrowserHost, sessionPortalAuthorization, } = {}) {
     const runtimeWebAccess = runtimeWebAccessPolicyForBindHost(config.HOST);
     const desktopBrowserManagementToken = desktopBrowserHost
         ? requireDaemonManagementToken(daemonManagement)
@@ -160,6 +162,46 @@ export async function startServer({ config = loadConfig(), control, sessionLog,
                 return { cwd: session.workspace.cwd };
             },
         });
+    const controlShutdown = new AbortController();
+    const controlSurface = control
+        ? {
+            deps: control,
+            runtime: conversationRuntime,
+            sessionBus,
+            sessionLog,
+            runnerManager,
+            sessionStore,
+            pluginRuntimeStatus: pluginRuntime
+                ? () => pluginRuntime.statusSnapshot()
+                : undefined,
+            daemonManagement,
+            remoteRuntime,
+            remoteRuntimeAdmin,
+            runtimeTargetControl,
+            runtimeConnectionResolver,
+            localSessionResources,
+            localMachineSessions,
+            sessionEmulators,
+            shutdownSignal: controlShutdown.signal,
+            sessionRuntimeIndex,
+            sessionLifecycle,
+            runtimeLocalBrowser,
+            providerClis,
+        }
+        : undefined;
+    const sessionPortalConfig = config.RYNX_SESSION_PORTAL_PORT !== undefined
+        ? (() => {
+            if (runtimeWebAccess.mode !== "loopback") {
+                throw new Error("Session Portal requires the ordinary Control listener to bind loopback only");
+            }
+            const controlWebDist = resolveControlWebDist();
+            if (!sessionPortalAuthorization || !controlSurface || !controlWebDist) {
+                throw new Error("Session Portal requires authorization, Control services, and the native Control Web build");
+            }
+            return { authorization: sessionPortalAuthorization, controlWebDist };
+        })()
+        : undefined;
+    let sessionPortalServer;
     if (pluginRuntime) {
         if (!sessionRegistry)
             throw new Error("plugin runtime requires a machine session registry");
@@ -183,6 +225,15 @@ export async function startServer({ config = loadConfig(), control, sessionLog,
             interruptSession: (sessionId) => runnerManager.interruptLiveSession(sessionId),
             terminateSession: (sessionId) => runnerManager.terminateLiveSession(sessionId),
             resolveSessionInteraction: (sessionId, interactionId, resolution) => runnerManager.resolveInteraction(sessionId, interactionId, resolution),
+            ...(sessionPortalConfig
+                ? {
+                    sessionPortal: {
+                        scheme: "http",
+                        bindHost: config.RYNX_SESSION_PORTAL_HOST,
+                        port: config.RYNX_SESSION_PORTAL_PORT,
+                    },
+                }
+                : {}),
         });
     }
     // Provider TUI `/clear`·`/fork` uses the same publication boundary as an
@@ -198,38 +249,32 @@ export async function startServer({ config = loadConfig(), control, sessionLog,
             kind: r.kind,
         });
     });
-    const controlShutdown = new AbortController();
     const app = createApp({
         config,
-        control: control
-            ? {
-                deps: control,
-                runtime: conversationRuntime,
-                sessionBus,
-                sessionLog,
-                runnerManager,
-                sessionStore,
-                pluginRuntimeStatus: pluginRuntime
-                    ? () => pluginRuntime.statusSnapshot()
-                    : undefined,
-                daemonManagement,
-                remoteRuntime,
-                remoteRuntimeAdmin,
-                runtimeTargetControl,
-                runtimeConnectionResolver,
-                localSessionResources,
-                localMachineSessions,
-                sessionEmulators,
-                shutdownSignal: controlShutdown.signal,
-                sessionRuntimeIndex,
-                sessionLifecycle,
-                runtimeLocalBrowser,
-                providerClis,
-            }
-            : undefined,
+        control: controlSurface,
     });
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
+        let startupWebSocketServers = [];
+        const rejectBeforeListening = (error) => reject(error);
         const server = app.listen(config.PORT, config.HOST, () => {
+            server.off("error", rejectBeforeListening);
+            void finishStartup(server).catch(async (error) => {
+                controlShutdown.abort(asError(error));
+                sessionPortalServer?.stopAccepting();
+                server.closeAllConnections?.();
+                await Promise.allSettled([
+                    closeWebSocketServers(startupWebSocketServers),
+                    sessionPortalServer?.shutdown() ?? Promise.resolve(),
+                    new Promise((done) => server.close(() => done())),
+                    Promise.resolve(daemonManagement?.pluginManagement?.dispose?.()),
+                    Promise.resolve(pluginRuntime?.dispose()),
+                    runnerManager.stop(),
+                ]);
+                reject(error);
+            });
+        });
+        server.once("error", rejectBeforeListening);
+        const finishStartup = async (server) => {
             console.log(JSON.stringify({
                 level: config.LOG_LEVEL,
                 msg: "Harness agent server listening",
@@ -238,15 +283,6 @@ export async function startServer({ config = loadConfig(), control, sessionLog,
                 runtime: config.DEFAULT_RUNTIME,
                 model: resolveRuntimeModel(config, config.DEFAULT_RUNTIME),
             }));
-            const startup = pluginRuntime?.startPluginRuntimes() ?? Promise.resolve();
-            void startup.catch((error) => {
-                console.error(JSON.stringify({
-                    level: "error",
-                    type: "plugin-runtime",
-                    event: "startup_failed",
-                    error: error instanceof Error ? error.message : String(error),
-                }));
-            });
             const webSocketServers = [
                 attachTerminalWs(server, {
                     runtimeConnectionResolver,
@@ -265,9 +301,36 @@ export async function startServer({ config = loadConfig(), control, sessionLog,
             if (control?.emulator) {
                 webSocketServers.push(attachEmulatorTouchWs(server, { emulator: control.emulator }));
             }
+            startupWebSocketServers = webSocketServers;
+            if (sessionPortalConfig) {
+                sessionPortalServer = await startSessionPortal({
+                    host: config.RYNX_SESSION_PORTAL_HOST,
+                    port: config.RYNX_SESSION_PORTAL_PORT,
+                    scheme: "http",
+                    authorization: sessionPortalConfig.authorization,
+                    controlOrigin: listeningHttpOrigin(server),
+                    controlWebDist: sessionPortalConfig.controlWebDist,
+                    shutdownSignal: controlShutdown.signal,
+                });
+            }
+            const startup = pluginRuntime?.startPluginRuntimes() ?? Promise.resolve();
+            void startup.catch((error) => {
+                console.error(JSON.stringify({
+                    level: "error",
+                    type: "plugin-runtime",
+                    event: "startup_failed",
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+            });
             resolve(bindServerLifecycle(server, {
-                fence: () => controlShutdown.abort(new Error("Rynx server is shutting down")),
-                closeUpgrades: () => closeWebSocketServers(webSocketServers),
+                fence: () => {
+                    controlShutdown.abort(new Error("Rynx server is shutting down"));
+                    sessionPortalServer?.stopAccepting();
+                },
+                closeUpgrades: () => Promise.all([
+                    closeWebSocketServers(webSocketServers),
+                    sessionPortalServer?.shutdown() ?? Promise.resolve(),
+                ]).then(() => undefined),
                 cleanup: async () => runCleanupSteps([
                     () => startup.catch(() => undefined),
                     () => Promise.resolve(daemonManagement?.pluginManagement?.dispose?.()),
@@ -275,9 +338,17 @@ export async function startServer({ config = loadConfig(), control, sessionLog,
                     () => runnerManager.stop(),
                 ]),
             }));
-        });
+        };
     });
 }
+function listeningHttpOrigin(server) {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Control listener did not expose an HTTP address");
+    }
+    const host = address.address.includes(":") ? `[${address.address}]` : address.address;
+    return `http://${host}:${address.port}`;
+}
 function requireDaemonManagementToken(host) {
     const token = host?.managementToken;
     const bytes = typeof token === "string" ? Buffer.byteLength(token, "utf8") : 0;

package/dist/session-portal.d.ts ADDED Viewed

@@ -0,0 +1,42 @@
+import { type IncomingMessage, type Server as HttpServer } from "node:http";
+import type { Duplex } from "node:stream";
+import Koa from "koa";
+export declare const SESSION_PORTAL_HEADER = "x-rynx-session-portal";
+export declare const SESSION_PORTAL_QUERY = "portal";
+export interface SessionPortalAuthorization {
+    portalId: string;
+    pluginId: string;
+    scope: "plugin_sessions" | "single_session";
+    access: "read_only" | "read_write";
+    sessionId?: string;
+    expiresAt: string;
+}
+export interface SessionPortalAuthorizationPorts {
+    redeem(ticket: string): (SessionPortalAuthorization & {
+        secret: string;
+    }) | undefined;
+    authorize(portalId: string, secret: string): SessionPortalAuthorization | undefined;
+    ownsSession(pluginId: string, sessionId: string): boolean;
+}
+export interface SessionPortalOptions {
+    host: string;
+    port: number;
+    scheme: "http" | "https";
+    authorization: SessionPortalAuthorizationPorts;
+    controlOrigin: string;
+    controlWebDist: string;
+    shutdownSignal?: AbortSignal;
+}
+export interface SessionPortalServer {
+    server: HttpServer;
+    stopAccepting(): void;
+    shutdown(): Promise<void>;
+}
+/** Session Portal is a narrow adapter in front of the one Control service. It
+ * serves the native SPA, validates Portal grants, and forwards only authorized
+ * Session HTTP calls to Control; it owns no Session or Runtime handlers. */
+export declare function createSessionPortalApp(options: SessionPortalOptions): Koa;
+export declare function startSessionPortal(options: SessionPortalOptions): Promise<SessionPortalServer>;
+export declare function authorizeSessionPortalWebSocket(request: IncomingMessage, ports: SessionPortalAuthorizationPorts, runtimeSelector: string, sessionId: string): SessionPortalAuthorization | undefined;
+export declare function rejectSessionPortalUpgrade(socket: Duplex): void;
+export declare function scheduleSessionPortalExpiry(expiresAt: string, onExpire: () => void): () => void;