@seele00/seele 0.1.60

package/scripts/deploy/start.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT_DIR"
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "node is required. Install Node.js 24 LTS before starting Seele." >&2
+  exit 1
+fi
+node -e 'const major = Number(process.versions.node.split(".")[0]); if (major !== 24) { console.error(`Node.js 24 LTS is required. Current: ${process.version}`); process.exit(1); }'
+
+ENV_FILE=""
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --env)
+      ENV_FILE="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      echo "Usage: ./scripts/deploy/start.sh [--env PATH]"
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [ -n "$ENV_FILE" ]; then
+  if [ ! -f "$ENV_FILE" ]; then
+    echo "Environment file not found: $ENV_FILE" >&2
+    exit 1
+  fi
+  set -a
+  # shellcheck disable=SC1090
+  . "$ENV_FILE"
+  set +a
+fi
+
+if [ -z "${SEELE_ROOT:-}" ]; then
+  echo "SEELE_ROOT is required." >&2
+  echo "Set it in seele.env to the confirmed Seele root directory." >&2
+  exit 1
+fi
+export SEELE_ROOT
+RUNTIME_DIR="${SEELE_RUNTIME_DIR:-$SEELE_ROOT/.runtime}"
+export SEELE_RUNTIME_DIR="$RUNTIME_DIR"
+export CODEX_HOME="${CODEX_HOME:-$RUNTIME_DIR/codex-home}"
+export CODEX_INSTALL_DIR="$RUNTIME_DIR/bin"
+export SEELE_CODEX_HOST="${SEELE_CODEX_HOST:-0.0.0.0}"
+export SEELE_CODEX_PORT="${SEELE_CODEX_PORT:-3000}"
+export SEELE_CODEX_WORKSPACE_ROOT="${SEELE_CODEX_WORKSPACE_ROOT:-$SEELE_ROOT/workspaces}"
+export SEELE_CODEX_WEB_DIST="${SEELE_CODEX_WEB_DIST:-$ROOT_DIR/web/dist}"
+export PATH="$CODEX_INSTALL_DIR:$PATH"
+
+export NO_PROXY="${NO_PROXY:-127.0.0.1,localhost,.svc,.cluster.local}"
+export no_proxy="$NO_PROXY"
+
+if [ ! -x "$CODEX_INSTALL_DIR/codex" ]; then
+  echo "Seele-managed Codex CLI was not found at $CODEX_INSTALL_DIR/codex." >&2
+  echo "Run ./scripts/deploy/bootstrap.sh before starting Seele." >&2
+  exit 1
+fi
+
+if [ ! -f "$ROOT_DIR/server/dist/server.js" ] || [ ! -f "$SEELE_CODEX_WEB_DIST/index.html" ]; then
+  echo "Build output is missing. Run ./scripts/deploy/bootstrap.sh first." >&2
+  exit 1
+fi
+
+# Prepare the local no-auth proxy entrypoint when an upstream proxy with
+# credentials is configured. Codex's models-refresh / MCP HTTP clients send a
+# bare HTTP CONNECT without proxy credentials; an authenticated upstream then
+# replies 407 and resets the stream. prepare-proxy.sh runs a local no-auth
+# listener (SEELE_PROXY) that forwards to the credentialed upstream
+# (SEELE_UPSTREAM_PROXY). It is idempotent, so a restart re-syncs it.
+# Skipped when SEELE_UPSTREAM_PROXY is unset (legacy single-proxy mode).
+if [ -n "${SEELE_UPSTREAM_PROXY:-}" ]; then
+  echo "Preparing local no-auth proxy entrypoint (SEELE_UPSTREAM_PROXY is set)..."
+  PREPARE_PROXY="$ROOT_DIR/scripts/deploy/prepare-proxy.sh"
+  if [ ! -x "$PREPARE_PROXY" ]; then
+    echo "prepare-proxy.sh not found or not executable at $PREPARE_PROXY" >&2
+    exit 1
+  fi
+  if [ -n "$ENV_FILE" ]; then
+    "$PREPARE_PROXY" --env "$ENV_FILE"
+  else
+    "$PREPARE_PROXY"
+  fi
+fi
+
+mkdir -p "$CODEX_HOME"
+mkdir -p "$SEELE_CODEX_WORKSPACE_ROOT"
+
+echo "Starting Seele Codex on http://$SEELE_CODEX_HOST:$SEELE_CODEX_PORT"
+echo "Codex home: $CODEX_HOME"
+echo "Workspace root: $SEELE_CODEX_WORKSPACE_ROOT"
+
+exec node "$ROOT_DIR/server/dist/server.js"

package/server/dist/auth/session.js

@@ -0,0 +1,71 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+const COOKIE_NAME = "seele_session";
+export function readSessionPayload(request, secret) {
+    const token = parseCookies(request.headers.cookie)[COOKIE_NAME];
+    if (!token) {
+        return null;
+    }
+    const [encodedPayload, signature] = token.split(".");
+    if (!encodedPayload || !signature) {
+        return null;
+    }
+    if (!safeEqual(signature, sign(encodedPayload, secret))) {
+        return null;
+    }
+    try {
+        const payload = JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8"));
+        if (typeof payload.userId !== "string" ||
+            !Number.isInteger(payload.sessionVersion) ||
+            !Number.isFinite(payload.expiresAt) ||
+            payload.expiresAt <= Date.now()) {
+            return null;
+        }
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+export function setSessionCookie(response, request, input) {
+    const payload = Buffer.from(JSON.stringify({
+        userId: input.userId,
+        sessionVersion: input.sessionVersion,
+        expiresAt: Date.now() + input.ttlSeconds * 1000,
+    })).toString("base64url");
+    const token = `${payload}.${sign(payload, input.secret)}`;
+    const secure = isSecureRequest(request) ? "; Secure" : "";
+    response.setHeader("Set-Cookie", `${COOKIE_NAME}=${token}; Path=${input.path}; HttpOnly; SameSite=Strict; Max-Age=${input.ttlSeconds}${secure}`);
+}
+export function clearSessionCookie(response, request, path) {
+    const secure = isSecureRequest(request) ? "; Secure" : "";
+    response.setHeader("Set-Cookie", `${COOKIE_NAME}=; Path=${path}; HttpOnly; SameSite=Strict; Max-Age=0${secure}`);
+}
+function sign(value, secret) {
+    return createHmac("sha256", secret).update(value).digest("base64url");
+}
+function safeEqual(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return (leftBuffer.length === rightBuffer.length &&
+        timingSafeEqual(leftBuffer, rightBuffer));
+}
+function parseCookies(header) {
+    if (!header) {
+        return {};
+    }
+    return Object.fromEntries(header.split(";").flatMap((part) => {
+        const separator = part.indexOf("=");
+        if (separator < 0) {
+            return [];
+        }
+        const key = part.slice(0, separator).trim();
+        const value = part.slice(separator + 1).trim();
+        return key ? [[key, value]] : [];
+    }));
+}
+function isSecureRequest(request) {
+    const forwardedProto = request.headers["x-forwarded-proto"];
+    const protocol = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
+    return (protocol?.split(",")[0]?.trim() === "https" ||
+        Boolean(request.socket.encrypted));
+}

package/server/dist/auth/users.js

@@ -0,0 +1,192 @@
+import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from "node:crypto";
+import path from "node:path";
+import { mkdirSync } from "node:fs";
+import { openSqliteDatabase, } from "../storage/sqlite.js";
+export class UserStore {
+    sessionSecret;
+    db;
+    constructor(databasePath, bootstrap) {
+        mkdirSync(path.dirname(databasePath), { recursive: true });
+        this.db = openSqliteDatabase(databasePath);
+        this.db.exec("pragma journal_mode = WAL");
+        this.initializeSchema();
+        this.sessionSecret = this.ensureSessionSecret();
+        if (this.countUsers() === 0 && bootstrap?.password) {
+            this.createUser({
+                username: bootstrap.username,
+                password: bootstrap.password,
+                role: "admin",
+            });
+        }
+    }
+    get enabled() {
+        return this.countUsers() > 0;
+    }
+    listUsers() {
+        const rows = this.db
+            .prepare("select * from auth_users order by created_at asc")
+            .all();
+        return rows.map(userFromRow);
+    }
+    getUser(id) {
+        const row = this.db
+            .prepare("select * from auth_users where id = ?")
+            .get(id);
+        return row ? userFromRow(row) : null;
+    }
+    getUserByUsername(username) {
+        const row = this.db
+            .prepare("select * from auth_users where username = ? collate nocase")
+            .get(username.trim());
+        return row ? userFromRow(row) : null;
+    }
+    authenticate(username, password) {
+        const row = this.db
+            .prepare("select * from auth_users where username = ? collate nocase")
+            .get(username.trim());
+        if (!row || !row.active || !verifyPassword(password, row.password_hash)) {
+            return null;
+        }
+        return userFromRow(row);
+    }
+    createUser(input) {
+        const username = normalizeUsername(input.username);
+        validatePassword(input.password);
+        const now = new Date().toISOString();
+        const row = {
+            id: randomUUID(),
+            username,
+            password_hash: hashPassword(input.password),
+            role: input.role,
+            active: 1,
+            session_version: 1,
+            created_at: now,
+            updated_at: now,
+        };
+        this.db.prepare(`
+      insert into auth_users (
+        id, username, password_hash, role, active, session_version, created_at, updated_at
+      ) values (
+        @id, @username, @password_hash, @role, @active, @session_version, @created_at, @updated_at
+      )
+    `).run(row);
+        return userFromRow(row);
+    }
+    updateUser(id, input) {
+        const current = this.db
+            .prepare("select * from auth_users where id = ?")
+            .get(id);
+        if (!current) {
+            return null;
+        }
+        const username = input.username === undefined
+            ? current.username
+            : normalizeUsername(input.username);
+        const passwordChanged = input.password !== undefined && input.password.length > 0;
+        if (passwordChanged) {
+            validatePassword(input.password);
+        }
+        const next = {
+            ...current,
+            username,
+            password_hash: passwordChanged ? hashPassword(input.password) : current.password_hash,
+            role: input.role ?? current.role,
+            active: input.active === undefined ? current.active : input.active ? 1 : 0,
+            session_version: passwordChanged || input.active === false
+                ? current.session_version + 1
+                : current.session_version,
+            updated_at: new Date().toISOString(),
+        };
+        this.db.prepare(`
+      update auth_users set
+        username = @username,
+        password_hash = @password_hash,
+        role = @role,
+        active = @active,
+        session_version = @session_version,
+        updated_at = @updated_at
+      where id = @id
+    `).run(next);
+        return userFromRow(next);
+    }
+    deleteUser(id) {
+        return this.db.prepare("delete from auth_users where id = ?").run(id).changes > 0;
+    }
+    countUsers() {
+        const row = this.db.prepare("select count(*) as count from auth_users").get();
+        return row.count;
+    }
+    initializeSchema() {
+        this.db.exec(`
+      create table if not exists auth_users (
+        id text primary key,
+        username text not null unique collate nocase,
+        password_hash text not null,
+        role text not null check (role in ('admin', 'user')),
+        active integer not null default 1,
+        session_version integer not null default 1,
+        created_at text not null,
+        updated_at text not null
+      );
+      create table if not exists auth_metadata (
+        key text primary key,
+        value text not null
+      );
+    `);
+    }
+    ensureSessionSecret() {
+        const existing = this.db
+            .prepare("select value from auth_metadata where key = 'session_secret'")
+            .get();
+        if (existing) {
+            return existing.value;
+        }
+        const value = randomBytes(32).toString("base64url");
+        this.db
+            .prepare("insert into auth_metadata (key, value) values ('session_secret', ?)")
+            .run(value);
+        return value;
+    }
+}
+function userFromRow(row) {
+    return {
+        id: row.id,
+        username: row.username,
+        role: row.role,
+        active: row.active === 1,
+        sessionVersion: row.session_version,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+function normalizeUsername(value) {
+    const username = value.trim();
+    if (!/^[A-Za-z0-9_.-]{2,64}$/.test(username)) {
+        throw new Error("invalid_username");
+    }
+    return username;
+}
+function validatePassword(value) {
+    if (value.length < 8 || value.length > 512) {
+        throw new Error("invalid_password");
+    }
+}
+function hashPassword(password) {
+    const salt = randomBytes(16);
+    const digest = scryptSync(password, salt, 64);
+    return `scrypt:${salt.toString("base64url")}:${digest.toString("base64url")}`;
+}
+function verifyPassword(password, stored) {
+    const [algorithm, encodedSalt, encodedDigest] = stored.split(":");
+    if (algorithm !== "scrypt" || !encodedSalt || !encodedDigest) {
+        return false;
+    }
+    try {
+        const expected = Buffer.from(encodedDigest, "base64url");
+        const actual = scryptSync(password, Buffer.from(encodedSalt, "base64url"), expected.length);
+        return expected.length === actual.length && timingSafeEqual(expected, actual);
+    }
+    catch {
+        return false;
+    }
+}