@saluzi/saluzi-edu 0.2.63 → 0.2.64

package/packages/remote-control-server/src/services/environment.ts

@@ -1,4 +1,5 @@
 import { config } from '../config'
+import { log } from '../logger'
 import {
   storeCreateEnvironment,
   storeCreateSession,
@@ -14,7 +15,10 @@ import {
   storeClaimEnvironment,
   storeSetEnvironmentClaim,
   storeBindEnvSessionsToUser,
+  storeListWorkItems,
+  storeUpdateWorkItem,
 } from '../store'
+import { isSessionClosedStatus } from './session'
 import type {
   RegisterEnvironmentRequest,
   EnvironmentResponse,
@@ -42,6 +46,11 @@ function toResponse(
     team_id: row.teamId ?? null,
     team_name: row.teamName ?? null,
     owner_user_id: row.ownerUserId ?? null,
+    attach_waiting:
+      row.sessionMode === 'attach' &&
+      !storeListSessionsByEnvironment(row.id).some(
+        s => !isSessionClosedStatus(s.status),
+      ),
   }
 }
 
@@ -64,10 +73,13 @@ export function registerEnvironment(
     teamId?: string | null
     claimToken?: string | null
     claimExpiresAt?: Date | null
+    session_mode?: string | null
   },
 ): RegisterEnvironmentResult {
   const secret = config.apiKeys[0] || ''
   const workerType = req.worker_type || req.metadata?.worker_type
+  // Session Attach wait mode: only 'attach' is meaningful today.
+  const sessionMode = req.session_mode === 'attach' ? 'attach' : null
 
   // Idempotent re-registration: the CLI echoes back a backend-issued
   // environment_id on restart (bridge pointer / --session-id resume).
@@ -85,6 +97,7 @@ export function registerEnvironment(
         machineName: req.machine_name,
         maxSessions: req.max_sessions,
         capabilities: req.capabilities ?? null,
+        sessionMode,
       })
       // Ownership is backfill-only: a restart must not reassign the env
       // (the route layer already gated reattach on admin/owner/unowned).
@@ -201,6 +214,7 @@ export function registerEnvironment(
     ownerUserId: req.ownerUserId,
     claimToken: req.claimToken,
     claimExpiresAt: req.claimExpiresAt,
+    sessionMode,
   })
 
   let sessionId: string | undefined
@@ -240,6 +254,19 @@ export function registerEnvironment(
 
 export function deregisterEnvironment(envId: string) {
   storeUpdateEnvironment(envId, { status: 'deregistered' })
+  // Complete the env's open work items. Without this, a clean CLI exit
+  // leaves the acked item behind and isSessionOccupied keeps reporting
+  // session_busy (the reclaim path only covers dispatched items on a LIVE
+  // env). kill -9 crashes skip this — the env-status check in
+  // isSessionOccupied is the recovery path for those.
+  for (const item of storeListWorkItems()) {
+    if (item.environmentId === envId && item.state !== 'completed') {
+      storeUpdateWorkItem(item.id, { state: 'completed' })
+      log(
+        `[RCS] Completed orphaned work item ${item.id} (session=${item.sessionId}) on deregistered env ${envId}`,
+      )
+    }
+  }
 }
 
 export function getEnvironment(envId: string) {

package/packages/remote-control-server/src/store.ts

@@ -24,6 +24,14 @@ export interface EnvironmentRecord {
   lastPollAt: Date | null
   createdAt: Date
   updatedAt: Date
+  /**
+   * Session Attach (P2): 'attach' marks a worker that registered in
+   * wait-for-assignment mode — it created no session and is polling for the
+   * Web UI to bind one. Surfaced as `attach_waiting` on GET /web/environments
+   * so the Web UI can enumerate "waiting CLIs" to bind sessions to. Null =
+   * default create-mode behavior.
+   */
+  sessionMode?: string | null
 }
 
 export interface SessionRecord {
@@ -119,6 +127,7 @@ export function storeCreateEnvironment(req: {
   ownerUserId?: string | null
   claimToken?: string | null
   claimExpiresAt?: Date | null
+  sessionMode?: string | null
 }): EnvironmentRecord {
   const id = `env_${randomUUID().replace(/-/g, '')}`
   const now = new Date()
@@ -138,14 +147,15 @@ export function storeCreateEnvironment(req: {
     lastPollAt: now,
     createdAt: now,
     updatedAt: now,
+    sessionMode: req.sessionMode ?? null,
   }
   environments.set(id, record)
   try {
     const db = getDb()
     const secretHash = createHash('sha256').update(record.secret).digest('hex')
     db.query(
-      `INSERT OR REPLACE INTO environments (id, secret_hash, machine_name, worker_type, status, last_poll_at, created_at, owner_user_id, claim_token, claim_expires_at)
-       VALUES ($id, $sh, $mn, $wt, $st, $lp, $ca, $ou, $ct, $ce)`,
+      `INSERT OR REPLACE INTO environments (id, secret_hash, machine_name, worker_type, status, last_poll_at, created_at, owner_user_id, claim_token, claim_expires_at, session_mode)
+       VALUES ($id, $sh, $mn, $wt, $st, $lp, $ca, $ou, $ct, $ce, $sm)`,
     ).run({
       $id: id,
       $sh: secretHash,
@@ -157,6 +167,7 @@ export function storeCreateEnvironment(req: {
       $ou: req.ownerUserId ?? null,
       $ct: req.claimToken ?? null,
       $ce: req.claimExpiresAt?.toISOString() ?? null,
+      $sm: record.sessionMode ?? null,
     })
   } catch (err) {
     console.error('[store] DB write failed in storeCreateEnvironment:', err)
@@ -181,6 +192,7 @@ export function storeUpdateEnvironment(
       | 'machineName'
       | 'maxSessions'
       | 'bridgeId'
+      | 'sessionMode'
     >
   >,
 ): boolean {
@@ -204,6 +216,10 @@ export function storeUpdateEnvironment(
       sets.push('machine_name = $machineName')
       params.$machineName = patch.machineName
     }
+    if (patch.sessionMode !== undefined) {
+      sets.push('session_mode = $sessionMode')
+      params.$sessionMode = patch.sessionMode
+    }
 
     // bridgeId, maxSessions, capabilities, updatedAt are in-memory only —
     // the environments table has no corresponding columns.
@@ -561,6 +577,43 @@ export function storeListSessionsByEnvironment(envId: string): SessionRecord[] {
   return [...sessions.values()].filter(s => s.environmentId === envId)
 }
 
+/**
+ * Re-point a session to a different environment (Session Attach).
+ *
+ * Only mutates environment_id + updated_at — session_owners (user/team) are
+ * deliberately untouched: attach transfers *driving* of the session, never
+ * ownership. The sessions.environment_id column predates this function;
+ * storeUpdateSession's patch type intentionally excludes environment_id
+ * because ownership-binding flows must never re-point a session as a side
+ * effect. Attach is the one flow with an explicit re-bind contract.
+ */
+export function storeRebindSessionEnvironment(
+  sessionId: string,
+  environmentId: string,
+): boolean {
+  const rec = sessions.get(sessionId)
+  if (!rec) return false
+  rec.environmentId = environmentId
+  rec.updatedAt = new Date()
+  try {
+    const db = getDb()
+    db.query(
+      'UPDATE sessions SET environment_id = $envId, updated_at = $ua WHERE id = $id',
+    ).run({
+      $envId: environmentId,
+      $ua: rec.updatedAt.toISOString(),
+      $id: sessionId,
+    })
+  } catch (err) {
+    console.error(
+      '[store] DB write failed in storeRebindSessionEnvironment:',
+      err,
+    )
+    throw err
+  }
+  return true
+}
+
 export function storeDeleteSession(id: string): boolean {
   sessionWorkers.delete(id)
   const deleted = sessions.delete(id)
@@ -941,6 +994,57 @@ export function storeMarkAcpAgentOnline(id: string): boolean {
   return true
 }
 
+// ---------- Session Attach codes ----------
+
+export interface AttachCodeRecord {
+  code: string
+  sessionId: string
+  expiresAt: Date
+}
+
+const attachCodes = new Map<string, AttachCodeRecord>()
+
+/**
+ * Issue a one-time, short-TTL attach code for a session (P3). The Web UI
+ * session manager calls POST /web/sessions/:id/attach-code and hands the
+ * code to a CLI operator (`/rc --attach atc_...`); the code is the attach
+ * authorization — the CLI needs no manage rights of its own.
+ *
+ * In-memory only (no DB table): codes are single-use with a 15-minute TTL,
+ * so losing them on a server restart is acceptable — the user just clicks
+ * "copy attach code" again.
+ */
+export function storeIssueAttachCode(
+  sessionId: string,
+  ttlMs = 15 * 60 * 1000,
+): AttachCodeRecord {
+  const code = `atc_${randomUUID().replace(/-/g, '')}`
+  const record: AttachCodeRecord = {
+    code,
+    sessionId,
+    expiresAt: new Date(Date.now() + ttlMs),
+  }
+  attachCodes.set(code, record)
+  return record
+}
+
+/**
+ * Consume an attach code: single-use — returns the record and deletes it.
+ * Expired or unknown codes return null.
+ */
+export function storeConsumeAttachCode(code: string): AttachCodeRecord | null {
+  const record = attachCodes.get(code)
+  if (!record) return null
+  attachCodes.delete(code)
+  if (record.expiresAt.getTime() <= Date.now()) return null
+  return record
+}
+
+/** Test helper — drop all attach codes. */
+export function storeResetAttachCodes() {
+  attachCodes.clear()
+}
+
 // ---------- Reset (for tests) ----------
 
 export function storeReset() {
@@ -950,6 +1054,7 @@ export function storeReset() {
   sessions.clear()
   workItems.clear()
   sessionWorkers.clear()
+  storeResetAttachCodes()
   try {
     const db = getDb()
     // Delete in FK-safe order: child tables before parent tables

package/packages/remote-control-server/src/types/api.ts

@@ -142,6 +142,8 @@ export interface EnvironmentResponse {
   team_id: string | null
   team_name: string | null
   owner_user_id: string | null
+  /** Session Attach wait mode: registered to be assigned a session, none bound yet. */
+  attach_waiting?: boolean
 }
 
 export interface ServerInfoResponse {