@someonegg/agent-hub 0.0.0-stage → 0.7.0

package/dist/server/server/updates/session-updates-service.js

@@ -0,0 +1,151 @@
+export const UPDATES_PROBE_INTERVAL_MS = 1_500;
+export const UPDATES_WAIT_TIMEOUT_MS = 25_000;
+export const MAX_UPDATES_WAITERS = 100;
+export const MAX_UPDATES_WAITERS_PER_SESSION = 10;
+export class SessionUpdatesError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "SessionUpdatesError";
+    }
+}
+/**
+ * Bounded long-poll waiting for message reads. Plain (non-waiting) reads bypass
+ * this service and call the session reader directly.
+ */
+export class SessionUpdatesService {
+    sessions;
+    #probeIntervalMs;
+    #waitTimeoutMs;
+    #maxWaiters;
+    #maxWaitersPerSession;
+    #groups = new Map();
+    #waiterCount = 0;
+    #closed = false;
+    constructor(sessions, options = {}) {
+        this.sessions = sessions;
+        this.#probeIntervalMs = options.probeIntervalMs ?? UPDATES_PROBE_INTERVAL_MS;
+        this.#waitTimeoutMs = options.waitTimeoutMs ?? UPDATES_WAIT_TIMEOUT_MS;
+        this.#maxWaiters = options.maxWaiters ?? MAX_UPDATES_WAITERS;
+        this.#maxWaitersPerSession = options.maxWaitersPerSession ?? MAX_UPDATES_WAITERS_PER_SESSION;
+    }
+    async wait(sessionId, query, signal) {
+        if (this.#closed || signal?.aborted)
+            throw abortError();
+        let group = this.#groups.get(sessionId);
+        if (this.#waiterCount >= this.#maxWaiters ||
+            (group?.waiters.size ?? 0) >= this.#maxWaitersPerSession)
+            throw new SessionUpdatesError("updates_capacity_exceeded", "Too many automatic update requests are already waiting");
+        if (!group) {
+            group = { waiters: new Set(), pending: null };
+            this.#groups.set(sessionId, group);
+        }
+        const current = group;
+        this.#waiterCount++;
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const cleanup = () => {
+                settled = true;
+                clearTimeout(timeout);
+                signal?.removeEventListener("abort", abort);
+                current.waiters.delete(waiter);
+                this.#waiterCount--;
+                if (current.waiters.size === 0) {
+                    clearTimeout(current.timer);
+                    if (this.#groups.get(sessionId) === current)
+                        this.#groups.delete(sessionId);
+                }
+            };
+            const waiter = {
+                query,
+                finish: (value) => {
+                    if (!settled) {
+                        cleanup();
+                        resolve(value);
+                    }
+                },
+                fail: (error) => {
+                    if (!settled) {
+                        cleanup();
+                        reject(error);
+                    }
+                },
+            };
+            const abort = () => waiter.fail(abortError());
+            const timeout = setTimeout(() => waiter.finish(null), this.#waitTimeoutMs);
+            current.waiters.add(waiter);
+            signal?.addEventListener("abort", abort, { once: true });
+            // Only in-flight initial reads are reused, never completed runtime results.
+            void this.#read(sessionId, current).then((read) => {
+                if (current.waiters.has(waiter))
+                    this.#evaluate(waiter, read);
+                this.#schedule(sessionId, current);
+            }, (error) => waiter.fail(error));
+        });
+    }
+    #evaluate(waiter, read) {
+        try {
+            const result = read(waiter.query);
+            if (waiter.query.stateRevision === undefined ||
+                result.stateRevision !== waiter.query.stateRevision ||
+                result.items.length > 0 ||
+                result.hasMore)
+                waiter.finish(result);
+        }
+        catch (error) {
+            waiter.fail(error);
+        }
+    }
+    #read(sessionId, group) {
+        if (group.pending)
+            return group.pending;
+        const pending = this.sessions.readMessages(sessionId).then((read) => {
+            if (!read)
+                throw new SessionUpdatesError("session_not_found", "Session not found");
+            return read.page;
+        });
+        group.pending = pending;
+        const clearPending = () => {
+            group.pending = null;
+        };
+        void pending.then(clearPending, clearPending);
+        return pending;
+    }
+    #schedule(sessionId, group) {
+        if (this.#closed || !group.waiters.size || group.timer !== undefined || group.pending)
+            return;
+        group.timer = setTimeout(async () => {
+            group.timer = undefined;
+            // Requests joining during this read share its immutable snapshot.
+            const waiters = [...group.waiters];
+            try {
+                const read = await this.#read(sessionId, group);
+                for (const waiter of waiters)
+                    if (group.waiters.has(waiter))
+                        this.#evaluate(waiter, read);
+            }
+            catch (error) {
+                for (const waiter of waiters)
+                    waiter.fail(error);
+            }
+            finally {
+                this.#schedule(sessionId, group);
+            }
+        }, this.#probeIntervalMs);
+    }
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        for (const group of this.#groups.values()) {
+            clearTimeout(group.timer);
+            for (const waiter of group.waiters)
+                waiter.fail(abortError());
+        }
+    }
+}
+function abortError() {
+    return new DOMException("The operation was aborted", "AbortError");
+}
+//# sourceMappingURL=session-updates-service.js.map

package/dist/server/server/updates/update-revision.js

@@ -0,0 +1,22 @@
+import { createHash } from "node:crypto";
+export const createUpdateRevision = ({ updatedAt, ...session }, interaction) => createHash("sha256")
+    .update(canonicalJson({ session, interaction }))
+    .digest("base64url");
+export function withUpdateRevision(value, createRevision) {
+    return {
+        ...value,
+        stateRevision: createRevision(value.session, value.interaction),
+    };
+}
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=update-revision.js.map

package/dist/server/server/uploads/store.js

@@ -0,0 +1,304 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, open, readdir, readFile, realpath, rename, rm, writeFile, } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
+import sharp from "sharp";
+import { supportsUploadThumbnail } from "../../shared/uploads.js";
+import { isOpaqueId } from "../security/opaque-id.js";
+const ATTACHMENT_ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
+export function validAttachmentId(id) {
+    return ATTACHMENT_ID_PATTERN.test(id);
+}
+export class UploadStore {
+    directory;
+    constructor(directory) {
+        this.directory = directory;
+    }
+    thumbnails = new Map();
+    thumbnailQueue = Promise.resolve();
+    async thumbnail(id, attachmentId) {
+        const attachment = await this.get(id, attachmentId);
+        if (!attachment || !supportsUploadThumbnail(attachment.type))
+            return null;
+        const path = join(this.folder(id), attachmentId + ".thumb.webp");
+        const existing = this.thumbnails.get(path);
+        if (existing)
+            return existing;
+        const task = (async () => {
+            await this.safeFile(path, this.folder(id));
+            try {
+                return await readFile(path);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            const generation = this.thumbnailQueue.then(async () => {
+                // Revalidate after waiting in the queue: deletion must not resurrect files.
+                const current = await this.get(id, attachmentId);
+                if (!current)
+                    return null;
+                let data;
+                try {
+                    data = await sharp(current.path, { limitInputPixels: 40_000_000 })
+                        .rotate()
+                        .resize(360, 280, { fit: "inside", withoutEnlargement: true })
+                        .webp({ quality: 80 })
+                        .toBuffer();
+                }
+                catch {
+                    return null;
+                }
+                const temporary = path + ".pending";
+                try {
+                    await writeFile(temporary, data, { mode: 0o600, flag: "wx" });
+                    await rename(temporary, path);
+                }
+                finally {
+                    await rm(temporary, { force: true });
+                }
+                return data;
+            });
+            this.thumbnailQueue = generation.catch(() => undefined);
+            return generation;
+        })();
+        this.thumbnails.set(path, task);
+        try {
+            return await task;
+        }
+        finally {
+            if (this.thumbnails.get(path) === task)
+                this.thumbnails.delete(path);
+        }
+    }
+    async waitForThumbnails(id, attachmentId) {
+        const folder = this.folder(id);
+        await Promise.allSettled([...this.thumbnails]
+            .filter(([path]) => attachmentId
+            ? path === join(folder, attachmentId + ".thumb.webp")
+            : dirname(path) === folder)
+            .map(([, task]) => task));
+    }
+    folder(id) {
+        if (!isOpaqueId(id))
+            throw new Error("Invalid session ID");
+        return resolve(this.directory, id);
+    }
+    async cleanup(id) {
+        const folder = this.folder(id);
+        await this.safeFolder(folder);
+        const tombstone = folder + ".deleting";
+        await this.safeFolder(tombstone);
+        await rename(folder, tombstone).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+        await this.waitForThumbnails(id);
+        await rm(tombstone, { recursive: true, force: true });
+    }
+    async upload(id, filename, type, chunks) {
+        const folder = this.folder(id);
+        await mkdir(folder, { recursive: true, mode: 0o700 });
+        await this.safeFolder(folder);
+        const attachmentId = randomUUID();
+        const extension = extname(filename);
+        const path = join(folder, attachmentId + (/^\.[a-zA-Z0-9]{1,16}$/.test(extension) ? extension : ""));
+        const file = await open(path, "wx", 0o600);
+        let complete = false;
+        try {
+            let size = 0;
+            for await (const chunk of chunks) {
+                size += chunk.byteLength;
+                await file.writeFile(chunk);
+            }
+            await file.sync();
+            await file.close();
+            const attachment = {
+                id: attachmentId,
+                sessionId: id,
+                filename,
+                size,
+                type,
+                uploadedAt: new Date().toISOString(),
+                path,
+            };
+            const temporary = join(folder, attachmentId + ".meta.pending");
+            await writeFile(temporary, JSON.stringify(attachment), { mode: 0o600 });
+            await rename(temporary, join(folder, attachmentId + ".meta.json"));
+            complete = true;
+            if (supportsUploadThumbnail(type)) {
+                void this.thumbnail(id, attachmentId).catch(() => undefined);
+            }
+            return attachment;
+        }
+        finally {
+            if (!complete) {
+                await file.close().catch(() => undefined);
+                await rm(path, { force: true });
+                await rm(join(folder, attachmentId + ".meta.pending"), { force: true });
+            }
+        }
+    }
+    async initialize() {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        for (const folder of await readdir(this.directory, { withFileTypes: true })) {
+            if (!folder.isDirectory())
+                continue;
+            try {
+                if (folder.name.endsWith(".deleting") && isOpaqueId(folder.name.slice(0, -9))) {
+                    await this.safeFolder(join(this.directory, folder.name));
+                    await rm(join(this.directory, folder.name), { recursive: true, force: true });
+                }
+                else if (isOpaqueId(folder.name)) {
+                    await this.recover(join(this.directory, folder.name));
+                }
+            }
+            catch (error) {
+                // Recovery is best effort and must not prevent startup.
+                console.error("Upload recovery failed", error);
+            }
+        }
+    }
+    async recover(folder) {
+        await this.safeFolder(folder);
+        const names = await readdir(folder);
+        for (const name of names) {
+            if (name.endsWith(".meta.deleting")) {
+                await this.finishDeletion(join(folder, name));
+            }
+            else if (name.endsWith(".thumb.webp.pending") ||
+                (name.endsWith(".thumb.webp") && !names.includes(name.slice(0, 36) + ".meta.json")) ||
+                name.endsWith(".meta.pending") ||
+                (/^[a-f0-9-]{36}(?:\.[a-zA-Z0-9]{1,16})?$/.test(name) &&
+                    !names.includes(name.slice(0, 36) + ".meta.json") &&
+                    !names.includes(name.slice(0, 36) + ".meta.deleting"))) {
+                await rm(join(folder, name), { force: true });
+            }
+        }
+    }
+    async list(id) {
+        const folder = this.folder(id);
+        await this.safeFolder(folder);
+        const names = await readdir(folder).catch((error) => {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        });
+        const entries = [];
+        for (const name of names) {
+            if (!name.endsWith(".meta.json"))
+                continue;
+            try {
+                entries.push(await this.metadata(join(folder, name), id, name.slice(0, -10)));
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        entries.sort((a, b) => b.uploadedAt.localeCompare(a.uploadedAt) || b.id.localeCompare(a.id));
+        return entries;
+    }
+    async get(id, attachmentId) {
+        const folder = this.folder(id);
+        if (!validAttachmentId(attachmentId))
+            throw new Error("Invalid attachment ID");
+        try {
+            return await this.metadata(join(folder, attachmentId + ".meta.json"), id, attachmentId);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async delete(id, attachmentId) {
+        const folder = this.folder(id);
+        if (!validAttachmentId(attachmentId))
+            throw new Error("Invalid attachment ID");
+        await this.get(id, attachmentId);
+        const metadata = join(folder, attachmentId + ".meta.json");
+        const tombstone = join(folder, attachmentId + ".meta.deleting");
+        await rename(metadata, tombstone).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+        await this.waitForThumbnails(id, attachmentId);
+        await this.finishDeletion(tombstone);
+    }
+    async safeFolder(folder) {
+        let root;
+        try {
+            root = await realpath(this.directory);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        if (dirname(resolve(folder)) !== resolve(this.directory))
+            throw new Error("Invalid upload directory");
+        try {
+            const stat = await lstat(folder);
+            if (!stat.isDirectory() || stat.isSymbolicLink() || dirname(await realpath(folder)) !== root)
+                throw new Error("Unsafe upload directory");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    async safeFile(path, folder) {
+        await this.safeFolder(folder);
+        if (dirname(resolve(path)) !== resolve(folder))
+            throw new Error("Invalid upload path");
+        try {
+            const stat = await lstat(path);
+            if (!stat.isFile() ||
+                stat.isSymbolicLink() ||
+                dirname(await realpath(path)) !== (await realpath(folder)))
+                throw new Error("Unsafe upload file");
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    async metadata(path, id, attachmentId) {
+        const folder = this.folder(id);
+        if (!validAttachmentId(attachmentId))
+            throw new Error("Invalid attachment metadata ID");
+        await this.safeFile(path, folder);
+        const value = JSON.parse(await readFile(path, "utf8"));
+        if (!value ||
+            value.id !== attachmentId ||
+            value.sessionId !== id ||
+            typeof value.filename !== "string" ||
+            typeof value.type !== "string" ||
+            !Number.isSafeInteger(value.size) ||
+            value.size < 0 ||
+            typeof value.uploadedAt !== "string" ||
+            !Number.isFinite(Date.parse(value.uploadedAt)) ||
+            typeof value.path !== "string" ||
+            !isAbsolute(value.path) ||
+            dirname(resolve(value.path)) !== folder ||
+            !new RegExp("^" + attachmentId + "(?:\\.[a-zA-Z0-9]{1,16})?$").test(basename(value.path)))
+            throw new Error("Corrupt upload metadata");
+        await this.safeFile(value.path, folder);
+        return value;
+    }
+    async finishDeletion(tombstone) {
+        let attachment;
+        try {
+            attachment = await this.metadata(tombstone, basename(dirname(tombstone)), basename(tombstone).replace(/\.meta\.deleting$/, ""));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        await rm(attachment.path, { force: true });
+        await rm(join(dirname(tombstone), attachment.id + ".thumb.webp"), { force: true });
+        await rm(tombstone, { force: true });
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/server/server/version.js

@@ -0,0 +1,21 @@
+import { readFile } from "node:fs/promises";
+export async function packageVersion() {
+    let directory = new URL("./", import.meta.url);
+    while (true) {
+        try {
+            const manifest = JSON.parse(await readFile(new URL("package.json", directory), "utf8"));
+            if (manifest.name === "@someonegg/agent-hub" && typeof manifest.version === "string") {
+                return manifest.version;
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const parent = new URL("../", directory);
+        if (parent.href === directory.href)
+            throw new Error("Cannot locate the Hub package version");
+        directory = parent;
+    }
+}
+//# sourceMappingURL=version.js.map

package/dist/server/shared/api-contract.js

@@ -0,0 +1,2 @@
+export * from "./interaction.js";
+//# sourceMappingURL=api-contract.js.map

package/dist/server/shared/diff.js

@@ -0,0 +1,158 @@
+const pathEscapes = {
+    a: "\x07",
+    b: "\b",
+    f: "\f",
+    v: "\v",
+    n: "\n",
+    t: "\t",
+    r: "\r",
+};
+/** Git quotes paths as C strings, including octal-escaped UTF-8 bytes. */
+function decodePath(value) {
+    if (!value.startsWith('"'))
+        return value;
+    const bytes = [];
+    const inner = value.slice(1, value.lastIndexOf('"'));
+    for (let i = 0; i < inner.length; i++) {
+        if (inner[i] === "\\") {
+            const octal = /^[0-7]{1,3}/.exec(inner.slice(i + 1));
+            if (octal) {
+                bytes.push(parseInt(octal[0], 8));
+                i += octal[0].length;
+                continue;
+            }
+            const escape = inner[++i];
+            bytes.push(...new TextEncoder().encode(pathEscapes[escape] ?? escape));
+        }
+        else {
+            const point = String.fromCodePoint(inner.codePointAt(i));
+            bytes.push(...new TextEncoder().encode(point));
+            i += point.length - 1;
+        }
+    }
+    return new TextDecoder().decode(new Uint8Array(bytes));
+}
+function pathName(value) {
+    return decodePath(value).replace(/^[ab]\//, "");
+}
+/** Only repeated paths can be inferred reliably without extended headers. */
+function headerPath(value) {
+    const quoted = /^"(?:[^"\\]|\\.)*" /.exec(value);
+    let oldPath;
+    let newPath;
+    if (quoted) {
+        oldPath = value.slice(0, quoted[0].length - 1);
+        newPath = value.slice(quoted[0].length);
+    }
+    else {
+        const quotedNew = / ("(?:[^"\\]|\\.)*")$/.exec(value);
+        // Unquoted, identical paths have equal lengths, regardless of embedded spaces.
+        const separator = quotedNew?.index ?? (value.length - 1) / 2;
+        if (!Number.isInteger(separator) || value[separator] !== " ")
+            return null;
+        oldPath = value.slice(0, separator);
+        newPath = value.slice(separator + 1);
+    }
+    const oldName = decodePath(oldPath);
+    const newName = decodePath(newPath);
+    return oldName.startsWith("a/") &&
+        newName.startsWith("b/") &&
+        oldName.slice(2) === newName.slice(2)
+        ? newName.slice(2)
+        : null;
+}
+export function parseDiff(raw) {
+    const files = [];
+    let file;
+    let pathResolved = false;
+    let oldLine = 0;
+    let newLine = 0;
+    let oldRemaining = 0;
+    let newRemaining = 0;
+    let inHunk = false;
+    let warning = false;
+    const finishHunk = () => {
+        if (oldRemaining || newRemaining)
+            warning = true;
+        inHunk = false;
+        oldRemaining = newRemaining = 0;
+    };
+    const finishFile = () => {
+        finishHunk();
+        if (file && !pathResolved)
+            warning = true;
+    };
+    const lines = raw.split("\n");
+    if (lines.at(-1) === "")
+        lines.pop();
+    for (const text of lines) {
+        if (text.startsWith("diff --git ")) {
+            finishFile();
+            const path = headerPath(text.slice(11));
+            pathResolved = path !== null;
+            file = {
+                path: path ?? text.slice(11),
+                lines: [],
+                additions: 0,
+                deletions: 0,
+            };
+            files.push(file);
+        }
+        if (!file) {
+            if (text.trim())
+                warning = true;
+            continue;
+        }
+        const hunk = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(text);
+        if (hunk) {
+            finishHunk();
+            oldLine = Number(hunk[1]);
+            newLine = Number(hunk[3]);
+            oldRemaining = Number(hunk[2] ?? 1);
+            newRemaining = Number(hunk[4] ?? 1);
+            inHunk = true;
+            file.lines.push({ text, kind: "meta" });
+            continue;
+        }
+        if (inHunk && (oldRemaining || newRemaining) && /^[ +\-]/.test(text)) {
+            const kind = text[0] === "+" ? "add" : text[0] === "-" ? "remove" : "context";
+            const line = { text: text.slice(1), kind };
+            if (kind !== "add") {
+                line.old = oldLine++;
+                oldRemaining--;
+            }
+            if (kind !== "remove") {
+                line.next = newLine++;
+                newRemaining--;
+            }
+            if (oldRemaining < 0 || newRemaining < 0)
+                warning = true;
+            if (kind === "add")
+                file.additions++;
+            if (kind === "remove")
+                file.deletions++;
+            file.lines.push(line);
+            continue;
+        }
+        if (/^(\+\+\+|---) /.test(text)) {
+            const path = text.slice(4);
+            if (path !== "/dev/null") {
+                file.path = pathName(path.replace(/\t$/, ""));
+                pathResolved = true;
+            }
+        }
+        const renamed = /^(?:rename|copy) to (.*)$/.exec(text);
+        if (renamed) {
+            file.path = decodePath(renamed[1]);
+            pathResolved = true;
+        }
+        if (!/^(diff --git |index |--- |\+\+\+ |new file mode |deleted file mode |old mode |new mode |similarity index |dissimilarity index |rename from |rename to |copy from |copy to |Binary files .* differ$|\$)/.test(text))
+            warning = true;
+        if (inHunk && /^[+\- ]/.test(text))
+            warning = true;
+        file.lines.push({ text, kind: "meta" });
+    }
+    finishFile();
+    return { files, warning: warning || files.length === 0 };
+}
+//# sourceMappingURL=diff.js.map

package/dist/server/shared/domain.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=domain.js.map

package/dist/server/shared/interaction.js

@@ -0,0 +1,22 @@
+export const MAX_INTERACTION_MESSAGE_BYTES = 256 * 1024;
+export const MAX_INTERACTION_KEY_SEQUENCE_LENGTH = 64;
+export const INTERACTION_KEYS = [
+    "enter",
+    "up",
+    "down",
+    "left",
+    "right",
+    "interrupt",
+    "BTab",
+    "0",
+    "1",
+    "2",
+    "3",
+    "4",
+    "5",
+    "6",
+    "7",
+    "8",
+    "9",
+];
+//# sourceMappingURL=interaction.js.map