@tsconfigdotjson/vibe-os 0.0.0-stage → 0.1.0

package/server/assets.generated.ts

@@ -0,0 +1,53 @@
+// @ts-nocheck — generated; `with { type: 'file' }` imports are not modelled by tsc.
+// Generated by scripts/gen-assets.ts — do not edit.
+//
+// Maps URL paths to files embedded in the compiled binary. Under `bun run`
+// these resolve to real paths on disk, so the same code serves both modes.
+
+import a0 from "../dist/web/apple-touch-icon.png" with { type: 'file' };
+import a1 from "../dist/web/assets/index-B77Qk8B5.js" with { type: 'file' };
+import a2 from "../dist/web/assets/index-B77Qk8B5.js.br" with { type: 'file' };
+import a3 from "../dist/web/assets/index-B77Qk8B5.js.gz" with { type: 'file' };
+import a4 from "../dist/web/assets/index-CH5Em-Mo.css" with { type: 'file' };
+import a5 from "../dist/web/assets/index-CH5Em-Mo.css.br" with { type: 'file' };
+import a6 from "../dist/web/assets/index-CH5Em-Mo.css.gz" with { type: 'file' };
+import a7 from "../dist/web/icon-192.png" with { type: 'file' };
+import a8 from "../dist/web/icon-512.png" with { type: 'file' };
+import a9 from "../dist/web/icon-app.svg" with { type: 'file' };
+import a10 from "../dist/web/icon-maskable-512.png" with { type: 'file' };
+import a11 from "../dist/web/icon-maskable.svg" with { type: 'file' };
+import a12 from "../dist/web/icon.svg" with { type: 'file' };
+import a13 from "../dist/web/index.html" with { type: 'file' };
+import a14 from "../dist/web/ssh.wasm" with { type: 'file' };
+import a15 from "../dist/web/ssh.wasm.br" with { type: 'file' };
+import a16 from "../dist/web/ssh.wasm.gz" with { type: 'file' };
+import a17 from "../dist/web/sw.js" with { type: 'file' };
+import a18 from "../dist/web/wasm_exec.js" with { type: 'file' };
+import a19 from "../dist/web/wasm_exec.js.br" with { type: 'file' };
+import a20 from "../dist/web/wasm_exec.js.gz" with { type: 'file' };
+
+export const BUILD_ID = "754753f62b6b";
+
+export const EMBEDDED: Record<string, string> = {
+  "/apple-touch-icon.png": a0,
+  "/assets/index-B77Qk8B5.js": a1,
+  "/assets/index-B77Qk8B5.js.br": a2,
+  "/assets/index-B77Qk8B5.js.gz": a3,
+  "/assets/index-CH5Em-Mo.css": a4,
+  "/assets/index-CH5Em-Mo.css.br": a5,
+  "/assets/index-CH5Em-Mo.css.gz": a6,
+  "/icon-192.png": a7,
+  "/icon-512.png": a8,
+  "/icon-app.svg": a9,
+  "/icon-maskable-512.png": a10,
+  "/icon-maskable.svg": a11,
+  "/icon.svg": a12,
+  "/index.html": a13,
+  "/ssh.wasm": a14,
+  "/ssh.wasm.br": a15,
+  "/ssh.wasm.gz": a16,
+  "/sw.js": a17,
+  "/wasm_exec.js": a18,
+  "/wasm_exec.js.br": a19,
+  "/wasm_exec.js.gz": a20,
+};

package/server/attach.ts

@@ -0,0 +1,524 @@
+// Popping a terminal out to a real terminal.
+//
+// A window is a dtach session, and dtach does not care who attaches to it. The
+// browser reaches it through the WASM/bridge/sshd path; someone on the tailnet
+// can reach the same session with plain `ssh`, and land in exactly the same
+// worktree running exactly the same thing — because both ask session.ts for the
+// command rather than composing one of their own.
+//
+// The only rule that has to survive is the one the pop-out already enforces:
+// **one client per session**. dtach lets several attach at once and sizes the
+// pty to whoever most recently arrived, so a desktop window and a full-screen
+// terminal attached together would fight over the size. The browser pop-out
+// solves that by unmounting the desktop's terminal and gossiping over a
+// BroadcastChannel. An SSH client cannot join that conversation, so the handoff
+// is recorded on the window row instead — durable across a reload, and undone
+// by killing the attached client, which is the server-side equivalent of
+// closing the pop-out window.
+//
+// Killing "the client" is safe because of how session.ts starts things: the
+// process that owns the pty is `dtach -n <socket> …` and every attachment is
+// `dtach -a <socket>`. They differ in argv, so the two are never confused.
+
+import { execFile } from "node:child_process";
+import { readdir, rm } from "node:fs/promises";
+import { promisify } from "node:util";
+import { and, desc, eq } from "drizzle-orm";
+import type { AttachInfo, Handoff, SshEndpoint } from "../shared/wire.ts";
+import type { Config } from "./config.ts";
+import {
+  type Db,
+  ID_PATTERN,
+  profiles,
+  projects,
+  windows,
+  workspaces,
+} from "./db.ts";
+import { log } from "./log.ts";
+import { getProfile } from "./profiles.ts";
+import { sessionProcesses, terminate } from "./reaper.ts";
+import { invocation } from "./runtime.ts";
+import { socketPath, windowCommand } from "./session.ts";
+
+const run = promisify(execFile);
+
+/**
+ * How long a handoff nobody ever used is left alone.
+ *
+ * This only applies before the first client shows up. A handoff is made the
+ * moment you pick "SSH session", which is necessarily *before* you have pasted
+ * the command anywhere — so for a while the row says the terminal is out there
+ * and nobody is attached yet. Reaping on that would take the window back
+ * while the command is still on the clipboard, and then the terminal you
+ * eventually paste into becomes a second client, which is the one thing the
+ * handoff exists to prevent.
+ *
+ * Generous, because the case it guards is "I got distracted", and because it
+ * costs nothing: once a client has attached, `handoffSeen` takes over and its
+ * departure is reaped straight away rather than waiting this out.
+ */
+const HANDOFF_GRACE_MS = 15 * 60_000;
+
+/** A ref is `<workspace>-<index>`; the `vibe-` session prefix is optional. */
+const REF = /^(?:vibe-)?([a-z0-9]+(?:-[a-z0-9]+)*)-(\d+)$/;
+
+/**
+ * The dtach session name for a window. `REF` above parses this back, so the two
+ * have to agree; keeping the prefix in one place is what makes that checkable.
+ */
+export const sessionName = (workspace: string, idx: number): string =>
+  `vibe-${workspace}-${idx}`;
+
+/** The same pair as a person types it, without the prefix. */
+export const sessionRef = (workspace: string, idx: number): string =>
+  `${workspace}-${idx}`;
+
+export interface AttachTarget {
+  windowId: string;
+  /** What a person types: `quiet-amber-otter-1`. */
+  ref: string;
+  session: string;
+  cwd: string;
+  profileId: string | null;
+  workspace: string;
+  project: string;
+  /** The role the window was opened as, when it has one. */
+  role: string | null;
+}
+
+// ── resolution ───────────────────────────────────────────────────────────────
+
+/**
+ * Turns a ref or a window id into everything needed to attach.
+ *
+ * Both spellings are accepted because they serve different callers: the UI has
+ * an opaque window id in hand, and a person at a shell prompt has the label off
+ * the title bar. A ref is matched against the workspace name and window index
+ * that produce the session name, so what you type is what the socket is called.
+ */
+/**
+ * The join every attach lookup needs, and the mapping from a row to a target.
+ *
+ * Both were written out twice — same five tables, same seven fields — so a
+ * column added to `AttachTarget` had to be added in two places, and a miss
+ * compiled cleanly in whichever copy happened to leave the field optional.
+ */
+const targetRows = (db: Db) =>
+  db
+    .select({
+      windowId: windows.id,
+      idx: windows.idx,
+      profileId: windows.profileId,
+      workspace: workspaces.name,
+      cwd: workspaces.path,
+      lastOpenedAt: workspaces.lastOpenedAt,
+      project: projects.name,
+      role: profiles.name,
+    })
+    .from(windows)
+    .innerJoin(workspaces, eq(windows.workspaceId, workspaces.id))
+    .innerJoin(projects, eq(workspaces.projectId, projects.id))
+    .leftJoin(profiles, eq(windows.profileId, profiles.id));
+
+type TargetRow = Awaited<
+  ReturnType<ReturnType<typeof targetRows>["all"]>
+>[number];
+
+const toTarget = (r: TargetRow): AttachTarget => ({
+  windowId: r.windowId,
+  ref: sessionRef(r.workspace, r.idx),
+  session: sessionName(r.workspace, r.idx),
+  cwd: r.cwd,
+  profileId: r.profileId,
+  workspace: r.workspace,
+  project: r.project,
+  role: r.role,
+});
+
+export function resolveTarget(
+  db: Db,
+  refOrId: string,
+): AttachTarget | undefined {
+  const rows = targetRows(db);
+
+  /*
+   * The id is tried first, and both are tried — the obvious shape, matching on
+   * whichever pattern the input looks like, is wrong.
+   *
+   * Window ids are UUIDs, and the last group of a UUID is twelve hex digits
+   * that are sometimes all decimal: `…-a716-446655440001` is a perfectly
+   * ordinary id that also parses as the ref "workspace …-a716, window
+   * 446655440001". Choosing by shape would send that id down the ref path,
+   * find nothing, and give up — an intermittent failure in the API, which
+   * passes ids, on roughly one window in two hundred.
+   */
+  const trimmed = refOrId.trim();
+  const match = REF.exec(trimmed);
+  const found =
+    (ID_PATTERN.test(trimmed)
+      ? rows.where(eq(windows.id, trimmed)).all()[0]
+      : undefined) ??
+    (match
+      ? rows
+          .where(
+            and(
+              eq(workspaces.name, match[1]),
+              eq(windows.idx, Number(match[2])),
+            ),
+          )
+          // Workspace names are three random words, so a collision across two
+          // projects is vanishingly unlikely rather than impossible. Preferring
+          // the one you touched most recently beats picking by row order.
+          .orderBy(desc(workspaces.lastOpenedAt))
+          .all()[0]
+      : undefined);
+
+  return found ? toTarget(found) : undefined;
+}
+
+/** Every window that could be attached to, newest workspace first. */
+export function listTargets(db: Db): AttachTarget[] {
+  return targetRows(db)
+    .orderBy(desc(workspaces.lastOpenedAt), windows.idx)
+    .all()
+    .map(toTarget);
+}
+
+/** The session command for a target — the same one the certificate forces. */
+export function commandFor(
+  db: Db,
+  config: Config,
+  target: AttachTarget,
+): string | undefined {
+  const profile = target.profileId
+    ? getProfile(db, target.profileId)
+    : undefined;
+  return windowCommand(target.session, target.cwd, config, profile);
+}
+
+// ── talking to dtach ─────────────────────────────────────────────────────────
+
+/** Sessions with something still holding the other end of their socket. */
+export async function liveSessions(config: Config): Promise<Set<string>> {
+  try {
+    const dir = `${config.stateDir}/sessions`;
+    const names = await readdir(dir);
+    const live = new Set<string>();
+    await Promise.all(
+      names
+        .filter((n) => n.endsWith(".sock"))
+        .map(async (n) => {
+          // Writing nothing to the socket succeeds only if something is still
+          // holding the other end, which is what separates a live session from
+          // a socket a crashed one left behind.
+          const ok = await run("dtach", ["-p", `${dir}/${n}`], {
+            timeout: 10_000,
+          })
+            .then(() => true)
+            .catch(() => false);
+          if (ok) live.add(n.replace(/\.sock$/, ""));
+        }),
+    );
+    return live;
+  } catch {
+    // No sessions directory yet: nothing has ever been opened.
+    return new Set();
+  }
+}
+
+/**
+ * Processes currently attached to a session.
+ *
+ * A client is `dtach -a <socket>`; the process that owns the pty is
+ * `dtach -n <socket> …`. They differ in argv precisely so this can tell them
+ * apart — matching too loosely here would mean "detach the clients" killing the
+ * session along with them.
+ */
+export async function clientsOn(
+  config: Config,
+  session: string,
+): Promise<string[]> {
+  const sock = socketPath(config, session);
+  try {
+    const { stdout } = await run("pgrep", ["-f", `^dtach -a ${sock}`], {
+      timeout: 10_000,
+    });
+    return stdout
+      .split("\n")
+      .map((l) => l.trim())
+      .filter(Boolean);
+  } catch {
+    // pgrep exits non-zero when nothing matches.
+    return [];
+  }
+}
+
+/**
+ * Kicks every client off a session, leaving the session itself running.
+ *
+ * This is what "Bring it back" does to a terminal, and the exact counterpart of
+ * closing a browser pop-out: the attached dtach exits, the forced command it
+ * was running returns, and the ssh session ends. What was running is untouched
+ * — the process that owns the pty is a different process and is left alone.
+ */
+export async function detachClients(
+  config: Config,
+  session: string,
+): Promise<void> {
+  const pids = await clientsOn(config, session);
+  for (const pid of pids) {
+    await run("kill", [pid], { timeout: 10_000 }).catch(() => {
+      // Already gone between listing and killing; that is the desired state.
+    });
+  }
+}
+
+/**
+ * Ends a session outright: the whole process tree, then the socket.
+ *
+ * "Whole tree" is the load-bearing part. This used to pkill exactly the dtach
+ * master, whose death takes the pty and with it the harness — but not the
+ * harness's children, which were reparented to init and ran for a week in
+ * worktrees that no longer existed (#38). `sessionProcesses` resolves
+ * everything the session ever started, by the pty's kernel session id and by
+ * the `VIBE_OS_SOCK` marker stamped on the create command, and `terminate`
+ * gives it TERM, a grace, then KILL.
+ */
+export async function killSession(
+  config: Config,
+  session: string,
+): Promise<void> {
+  const sock = socketPath(config, session);
+  await terminate(await sessionProcesses(sock));
+  await rm(sock, { force: true }).catch(() => {});
+  // The lock file the forced command serialises on. Harmless to leave behind —
+  // `liveSessions` only looks at `.sock` — but it is ours to clean up.
+  await rm(`${sock}.lock`, { force: true }).catch(() => {});
+}
+
+/**
+ * Ends every dtach session belonging to a workspace.
+ *
+ * Call this *before* deleting the window rows. The name of a session is derived
+ * from the workspace name and the window index, so once the rows are gone there
+ * is no way left to name — and therefore no way to reach — the processes still
+ * holding those ptys. Three deletion paths in `projects.ts` used to drop the
+ * rows on their own and strand a dtach process plus its socket each time.
+ */
+export async function killWorkspaceSessions(
+  db: Db,
+  config: Config,
+  workspaceId: string,
+): Promise<void> {
+  const rows = db
+    .select({ idx: windows.idx, workspace: workspaces.name })
+    .from(windows)
+    .innerJoin(workspaces, eq(windows.workspaceId, workspaces.id))
+    .where(eq(windows.workspaceId, workspaceId))
+    .all();
+  await Promise.all(
+    rows.map((r) => killSession(config, sessionName(r.workspace, r.idx))),
+  );
+}
+
+// ── where to point ssh ───────────────────────────────────────────────────────
+
+/**
+ * The endpoint to print in an ssh command.
+ *
+ * `config.sshHost` is the wrong answer and the tempting one: it is where the
+ * *bridge* dials, which is `127.0.0.1` in every recommended deployment. So is
+ * `os.hostname()`, which on a VPS is something like `ubuntu-2gb-fsn1` and
+ * resolves nowhere.
+ *
+ * The right answer is the host the browser is already talking to. If you
+ * reached the desktop at `vibe-os.your-tailnet.ts.net`, ssh to that name works —
+ * it is the same machine, and on a tailnet it is the same name sshd answers on.
+ * `--ssh-advertise` overrides it for the case where the two genuinely differ,
+ * such as a reverse proxy in front of the web port.
+ */
+/** The host a person would type, from the same forwarded headers. */
+export function publicHost(req: Request, url: URL): string {
+  const first = (name: string) => req.headers.get(name)?.split(",")[0].trim();
+  return first("x-forwarded-host") || first("host") || url.host;
+}
+
+export function sshEndpoint(config: Config, requestHost: string): SshEndpoint {
+  const advertised = config.sshAdvertise?.trim();
+  if (advertised) {
+    // Splitting on every colon breaks IPv6: `::1` becomes host "" port "".
+    // A bracketed literal keeps its address, and a trailing `:port` is only a
+    // port when it is one — `--ssh-advertise host:abc` used to render
+    // `ssh -t -p NaN`.
+    const bracketed = /^\[(.+)\](?::(\d+))?$/.exec(advertised);
+    const plain = /^([^:]+)(?::(\d+))?$/.exec(advertised);
+    const m = bracketed ?? plain;
+    const host = m ? m[1] : advertised;
+    const port = m?.[2] ? Number(m[2]) : 22;
+    return { user: config.user, host, port };
+  }
+  // Strips the web port, which is rarely 22 and never relevant to ssh.
+  return {
+    user: config.user,
+    host: requestHost.replace(/:\d+$/, ""),
+    port: 22,
+  };
+}
+
+/**
+ * How to spell "run vibe-os" on the far side of an ssh command.
+ *
+ * `ssh host <command>` runs it through `$SHELL -c`, which is neither a login
+ * shell nor an interactive one, so the PATH is sshd's default rather than the
+ * one `.profile` builds. A binary in `/usr/local/bin` — where the install
+ * instructions put it — is on that PATH and can be named bare. Anywhere else,
+ * and `~/.local/bin` in particular, has to be spelled out in full or the
+ * command fails with "not found" for someone who can run it fine by hand.
+ */
+/** `ssh -t [-p n] user@host …`, with the tail supplied by the caller. */
+function sshPrefix(endpoint: SshEndpoint): string {
+  const port = endpoint.port === 22 ? "" : ` -p ${endpoint.port}`;
+  return `ssh -t${port} ${endpoint.user}@${endpoint.host}`;
+}
+
+/** Everything the UI needs to offer an SSH handoff. */
+export function attachInfo(
+  db: Db,
+  config: Config,
+  refOrId: string,
+  requestHost: string,
+): AttachInfo | undefined {
+  const target = resolveTarget(db, refOrId);
+  if (!target) return undefined;
+  // Not used in the command, but a window with no way to launch anything is not
+  // one worth offering a handoff for.
+  if (!commandFor(db, config, target)) return undefined;
+
+  const endpoint = sshEndpoint(config, requestHost);
+
+  return {
+    ref: target.ref,
+    session: target.session,
+    cwd: target.cwd,
+    workspace: target.workspace,
+    project: target.project,
+    role: target.role,
+    endpoint,
+    command: `${sshPrefix(endpoint)} ${invocation()} attach ${target.ref}`,
+  };
+}
+
+// ── the handoff ──────────────────────────────────────────────────────────────
+
+/**
+ * Records that a window's terminal has been handed to an ssh client — or taken
+ * back, which also kicks whoever is attached.
+ *
+ * Persisted rather than kept in the desktop's memory because the whole point is
+ * that you close the laptop and the terminal keeps running. The browser
+ * pop-out can gossip over a BroadcastChannel because both ends are documents on
+ * one origin; an ssh client has no such channel, so the row is the record.
+ */
+export async function setHandoff(
+  db: Db,
+  config: Config,
+  windowId: string,
+  mode: Handoff,
+): Promise<boolean> {
+  const target = resolveTarget(db, windowId);
+  if (!target) return false;
+
+  if (config.sessions) {
+    /*
+     * Both directions detach every client, and the reason differs.
+     *
+     * Taking it back is the obvious one: the terminal has to let go, and this
+     * is the server-side equivalent of closing a browser pop-out. It happens
+     * before the flag is cleared, so a failure leaves the row saying the
+     * terminal is still out there, which is the honest state.
+     *
+     * Handing it out is the subtle one. The desktop that asked has already
+     * unmounted its terminal — but any *other* desktop showing this workspace
+     * has not heard yet, and until it polls it is still a client. The
+     * terminal would then arrive as a second one and the session would shrink
+     * to whichever is smaller. Broadcasting to sibling tabs closes that for one
+     * browser; only the server can close it for another machine, and it closes
+     * it here to zero rather than to a poll interval. Nothing is lost: a client
+     * detaching is not a session ending, and the browsers reconnect or show the
+     * handoff as soon as they catch up.
+     */
+    await detachClients(config, target.session);
+    log.info(
+      mode === "ssh"
+        ? `handed ${target.session} to a terminal`
+        : `reclaimed ${target.session} from its terminal`,
+    );
+  }
+
+  db.update(windows)
+    .set({ handoff: mode, handoffAt: mode ? Date.now() : null, handoffSeen: 0 })
+    .where(eq(windows.id, windowId))
+    .run();
+  return true;
+}
+
+/**
+ * Clears handoffs whose terminal has gone away.
+ *
+ * Without this a window stays a placeholder forever after you close the ssh
+ * session — the desktop would be waiting for a client that will never come
+ * back, and the only way out is a button you would have to know to press. With
+ * it, closing the terminal hands the window back on the next poll.
+ *
+ * The two cases are deliberately not treated the same, because "nobody has
+ * attached yet" and "the terminal that was attached has gone" look identical
+ * in `list-clients` and mean opposite things. Once a client has been seen the
+ * session is known to have been claimed, so its disappearance is real and gets
+ * reaped at once; before that, an empty list is just someone still finding
+ * their terminal window, and only the grace period settles it.
+ *
+ * Runs on the window list, which the desktop polls while anything is out, and
+ * only ever does session work for windows that are actually handed off.
+ */
+export async function reapStaleHandoffs(db: Db, config: Config): Promise<void> {
+  if (!config.sessions) return;
+  const outstanding = db
+    .select()
+    .from(windows)
+    .where(eq(windows.handoff, "ssh"))
+    .all();
+  if (outstanding.length === 0) return;
+
+  const now = Date.now();
+  for (const row of outstanding) {
+    const target = resolveTarget(db, row.id);
+    if (!target) continue;
+
+    if ((await clientsOn(config, target.session)).length > 0) {
+      // First sighting. From here on, an empty client list means it left.
+      if (!row.handoffSeen) {
+        db.update(windows)
+          .set({ handoffSeen: 1 })
+          .where(eq(windows.id, row.id))
+          .run();
+        log.debug(`${target.session} picked up by a terminal`);
+      }
+      continue;
+    }
+
+    if (!row.handoffSeen && now - (row.handoffAt ?? 0) < HANDOFF_GRACE_MS)
+      continue;
+
+    db.update(windows)
+      .set({ handoff: null, handoffAt: null, handoffSeen: 0 })
+      .where(eq(windows.id, row.id))
+      .run();
+    log.info(
+      row.handoffSeen
+        ? `${target.session} was left by its terminal — handing it back to the desktop`
+        : `${target.session} was never picked up — handing it back to the desktop`,
+    );
+  }
+}
+
+export type { AttachInfo, Handoff, SshEndpoint };