@vibe80/vibe80 0.1.1

package/server/src/runAs.js

@@ -0,0 +1,458 @@
+import { spawn } from "child_process";
+import os from "os";
+import path from "path";
+import { GIT_HOOKS_DIR } from "./config.js";
+
+const RUN_AS_HELPER = process.env.VIBE80_RUN_AS_HELPER || "/usr/local/bin/vibe80-run-as";
+const SUDO_PATH = process.env.VIBE80_SUDO_PATH || "sudo";
+const DEPLOYMENT_MODE = process.env.DEPLOYMENT_MODE;
+const IS_MONO_USER = DEPLOYMENT_MODE === "mono_user";
+const WORKSPACE_ROOT_DIRECTORY = process.env.WORKSPACE_ROOT_DIRECTORY || "/workspaces";
+const ALLOWED_ENV_KEYS = new Set([
+  "GIT_SSH_COMMAND",
+  "GIT_CONFIG_GLOBAL",
+  "GIT_TERMINAL_PROMPT",
+  "TERM",
+  "TMPDIR",
+  "CLAUDE_CODE_TMPDIR",
+]);
+export const DEFAULT_ALLOW_RO = [
+  "/bin",
+  "/etc",
+  "/lib",
+  "/lib64",
+  "/usr",
+  "/proc",
+  GIT_HOOKS_DIR,
+];
+export const DEFAULT_ALLOW_RW = [
+  "/dev",
+  "/tmp",
+];
+
+let ensureWorkspaceUserExistsRef = null;
+
+const ensureWorkspaceUserExistsCached = async (workspaceId) => {
+  if (IS_MONO_USER) {
+    return;
+  }
+  if (!ensureWorkspaceUserExistsRef) {
+    const mod = await import("./services/workspace.js");
+    ensureWorkspaceUserExistsRef = mod.ensureWorkspaceUserExists;
+  }
+  await ensureWorkspaceUserExistsRef(workspaceId);
+};
+
+const normalizePaths = (paths = []) => {
+  const seen = new Set();
+  const result = [];
+  for (const entry of paths) {
+    if (!entry) {
+      continue;
+    }
+    const resolved = path.resolve(entry);
+    if (seen.has(resolved)) {
+      continue;
+    }
+    seen.add(resolved);
+    result.push(resolved);
+  }
+  return result;
+};
+
+export const buildSandboxArgs = (options = {}) => {
+  const homeDir = options.homeDir || (options.workspaceId
+    ? getWorkspaceHome(options.workspaceId)
+    : null);
+  const workspaceRootDir = options.workspaceRootDir || (options.workspaceId
+    ? getWorkspaceRoot(options.workspaceId)
+    : null);
+  const allowRo = normalizePaths([
+    ...(options.allowRo || DEFAULT_ALLOW_RO),
+    ...(options.extraAllowRo || []),
+  ]);
+  const allowRw = normalizePaths([
+    ...(options.allowRw || DEFAULT_ALLOW_RW),
+    ...(options.extraAllowRw || []),
+    homeDir,
+    options.repoDir,
+    options.cwd,
+    options.attachmentsDir,
+    options.tmpDir,
+  ]);
+  const allowRoFiles = normalizePaths([
+    ...(options.allowRoFiles || []),
+    ...(options.extraAllowRoFiles || []),
+  ]);
+  const allowRwFiles = normalizePaths([
+    ...(options.allowRwFiles || []),
+    ...(options.extraAllowRwFiles || []),
+  ]);
+  const args = [];
+  if (allowRo.length) {
+    args.push("--allow-ro", allowRo.join(","));
+  }
+  if (allowRw.length) {
+    args.push("--allow-rw", allowRw.join(","));
+  }
+  if (allowRoFiles.length) {
+    args.push("--allow-ro-file", allowRoFiles.join(","));
+  }
+  if (allowRwFiles.length) {
+    args.push("--allow-rw-file", allowRwFiles.join(","));
+  }
+  const netMode = options.netMode
+    ?? (options.internetAccess === false ? "none" : "tcp:22,53,443");
+  args.push("--net", netMode);
+  args.push("--seccomp", options.seccomp || "default");
+  return args;
+};
+
+const collectEnvPairs = (env = {}) =>
+  Object.entries(env)
+    .filter(([key]) => ALLOWED_ENV_KEYS.has(key))
+    .map(([key, value]) => `${key}=${value}`);
+
+const buildRunAsArgs = (workspaceId, command, args, options = {}) => {
+  const result = ["--workspace-id", workspaceId];
+  const envPairs = collectEnvPairs(options.env || {});
+  if (options.cwd) {
+    result.push("--cwd", options.cwd);
+  }
+  if (envPairs.length) {
+    envPairs.forEach((pair) => {
+      result.push("--env", pair);
+    });
+  }
+  if (options.sandbox) {
+    result.push(...buildSandboxArgs(options));
+  }
+  result.push("--", command, ...args);
+  return { args: result, envPairs };
+};
+
+const buildRunEnv = (options = {}) => {
+  const env = { ...process.env };
+  if (options.env) {
+    for (const [key, value] of Object.entries(options.env)) {
+      if (!ALLOWED_ENV_KEYS.has(key)) {
+        continue;
+      }
+      env[key] = value;
+    }
+  }
+  return env;
+};
+
+export const getWorkspaceHome = (workspaceId) => {
+  const homeBase = process.env.WORKSPACE_HOME_BASE || "/home";
+  return IS_MONO_USER ? os.homedir() : path.join(homeBase, workspaceId);
+};
+
+export const getWorkspaceRoot = (workspaceId) =>
+  (IS_MONO_USER
+    ? path.join(os.homedir(), "vibe80_workspace")
+    : path.join(WORKSPACE_ROOT_DIRECTORY, workspaceId));
+
+const validateCwd = (workspaceId, cwd) => {
+  const resolved = path.resolve(cwd);
+  const homeDir = getWorkspaceHome(workspaceId);
+  if (
+    resolved !== homeDir &&
+    !resolved.startsWith(homeDir + path.sep)
+  ) {
+    throw new Error("cwd outside workspace");
+  }
+};
+
+export const runCommand = (command, args, options = {}) =>
+  new Promise((resolve, reject) => {
+    const proc = spawn(command, args, { stdio: ["pipe", "ignore", "pipe"], ...options });
+    let stderr = "";
+
+    proc.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+
+    if (options.input) {
+      if (typeof options.input.pipe === "function") {
+        options.input.pipe(proc.stdin);
+      } else {
+        proc.stdin.write(options.input);
+        proc.stdin.end();
+      }
+    } else {
+      proc.stdin.end();
+    }
+
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(new Error(stderr.trim() || `${command} exited with ${code}`));
+    });
+  });
+
+export const runCommandOutput = (command, args, options = {}) =>
+  new Promise((resolve, reject) => {
+    const proc = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], ...options });
+    const stdoutChunks = [];
+    let stderr = "";
+
+    proc.stdout.on("data", (chunk) => {
+      stdoutChunks.push(chunk);
+    });
+
+    proc.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+
+    if (options.input) {
+      if (typeof options.input.pipe === "function") {
+        options.input.pipe(proc.stdin);
+      } else {
+        proc.stdin.write(options.input);
+        proc.stdin.end();
+      }
+    } else {
+      proc.stdin.end();
+    }
+
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      if (code === 0) {
+        const output = Buffer.concat(stdoutChunks);
+        resolve(options.binary ? output : output.toString("utf8"));
+        return;
+      }
+      reject(new Error(stderr.trim() || `${command} exited with ${code}`));
+    });
+  });
+
+export const runCommandOutputWithStatus = (command, args, options = {}) =>
+  new Promise((resolve, reject) => {
+    const proc = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], ...options });
+    const stdoutChunks = [];
+    const stderrChunks = [];
+
+    proc.stdout.on("data", (chunk) => {
+      stdoutChunks.push(chunk);
+    });
+
+    proc.stderr.on("data", (chunk) => {
+      stderrChunks.push(chunk);
+    });
+
+    if (options.input) {
+      if (typeof options.input.pipe === "function") {
+        options.input.pipe(proc.stdin);
+      } else {
+        proc.stdin.write(options.input);
+        proc.stdin.end();
+      }
+    } else {
+      proc.stdin.end();
+    }
+
+    proc.on("error", reject);
+    proc.on("close", (code) => {
+      const stdout = Buffer.concat(stdoutChunks);
+      const stderr = Buffer.concat(stderrChunks);
+      if (options.binary) {
+        resolve({ output: Buffer.concat([stdout, stderr]), code });
+        return;
+      }
+      let output = stdout.toString("utf8");
+      const stderrText = stderr.toString("utf8");
+      if (stderrText) {
+        if (output && !output.endsWith("\n")) {
+          output += "\n";
+        }
+        output += stderrText;
+      }
+      resolve({ output, code });
+    });
+  });
+
+export const runAsCommand = (workspaceId, command, args, options = {}) =>
+  (IS_MONO_USER
+    ? (validateCwd(workspaceId, options.cwd || getWorkspaceHome(workspaceId)),
+      runCommand(command, args, {
+        cwd: options.cwd || getWorkspaceHome(workspaceId),
+        env: buildRunEnv(options),
+        input: options.input,
+      }))
+    : (() => {
+        const { args: runArgs, envPairs } = buildRunAsArgs(
+          workspaceId,
+          command,
+          args,
+          options
+        );
+        return ensureWorkspaceUserExistsCached(workspaceId).then(() =>
+          runCommand(
+            SUDO_PATH,
+            ["-n", RUN_AS_HELPER, ...runArgs],
+            {
+              env: process.env,
+              input: options.input,
+            }
+          )
+        ).catch((error) => {
+          const details = [
+            "run-as failed",
+            `mode=${DEPLOYMENT_MODE || "unknown"}`,
+            `sudo=${SUDO_PATH}`,
+            `helper=${RUN_AS_HELPER}`,
+            `workspace=${workspaceId}`,
+            `command=${command}`,
+            `args=${JSON.stringify(args || [])}`,
+            envPairs?.length ? `env=${JSON.stringify(envPairs)}` : null,
+            `error=${error?.message || error}`,
+          ]
+            .filter(Boolean)
+            .join(" ");
+          throw new Error(details);
+        });
+      })()
+  ).catch((error) => {
+    const envPairs = collectEnvPairs(options.env || {});
+    const details = [
+      "run-as failed",
+      `mode=${DEPLOYMENT_MODE || "unknown"}`,
+      IS_MONO_USER ? null : `sudo=${SUDO_PATH}`,
+      IS_MONO_USER ? null : `helper=${RUN_AS_HELPER}`,
+      `workspace=${workspaceId}`,
+      `command=${command}`,
+      `args=${JSON.stringify(args || [])}`,
+      envPairs.length ? `env=${JSON.stringify(envPairs)}` : null,
+      `error=${error?.message || error}`,
+    ]
+      .filter(Boolean)
+      .join(" ");
+    throw new Error(details);
+  });
+
+export const runAsCommandOutput = (workspaceId, command, args, options = {}) =>
+  (IS_MONO_USER
+    ? (validateCwd(workspaceId, options.cwd || getWorkspaceHome(workspaceId)),
+      runCommandOutput(command, args, {
+        cwd: options.cwd || getWorkspaceHome(workspaceId),
+        env: buildRunEnv(options),
+        input: options.input,
+        binary: options.binary,
+      }))
+    : (() => {
+        const { args: runArgs, envPairs } = buildRunAsArgs(
+          workspaceId,
+          command,
+          args,
+          options
+        );
+        return ensureWorkspaceUserExistsCached(workspaceId).then(() =>
+          runCommandOutput(
+            SUDO_PATH,
+            ["-n", RUN_AS_HELPER, ...runArgs],
+            {
+              env: process.env,
+              input: options.input,
+              binary: options.binary,
+            }
+          )
+        ).catch((error) => {
+          const details = [
+            "run-as output failed",
+            `mode=${DEPLOYMENT_MODE || "unknown"}`,
+            `sudo=${SUDO_PATH}`,
+            `helper=${RUN_AS_HELPER}`,
+            `workspace=${workspaceId}`,
+            `command=${command}`,
+            `args=${JSON.stringify(args || [])}`,
+            envPairs?.length ? `env=${JSON.stringify(envPairs)}` : null,
+            `error=${error?.message || error}`,
+          ]
+            .filter(Boolean)
+            .join(" ");
+          throw new Error(details);
+        });
+      })()
+  ).catch((error) => {
+    const envPairs = collectEnvPairs(options.env || {});
+    const details = [
+      "run-as output failed",
+      `mode=${DEPLOYMENT_MODE || "unknown"}`,
+      IS_MONO_USER ? null : `sudo=${SUDO_PATH}`,
+      IS_MONO_USER ? null : `helper=${RUN_AS_HELPER}`,
+      `workspace=${workspaceId}`,
+      `command=${command}`,
+      `args=${JSON.stringify(args || [])}`,
+      envPairs.length ? `env=${JSON.stringify(envPairs)}` : null,
+      `error=${error?.message || error}`,
+    ]
+      .filter(Boolean)
+      .join(" ");
+    throw new Error(details);
+  });
+
+export const runAsCommandOutputWithStatus = (workspaceId, command, args, options = {}) =>
+  (IS_MONO_USER
+    ? (validateCwd(workspaceId, options.cwd || getWorkspaceHome(workspaceId)),
+      runCommandOutputWithStatus(command, args, {
+        cwd: options.cwd || getWorkspaceHome(workspaceId),
+        env: buildRunEnv(options),
+        input: options.input,
+        binary: options.binary,
+      }))
+    : (() => {
+        const { args: runArgs, envPairs } = buildRunAsArgs(
+          workspaceId,
+          command,
+          args,
+          options
+        );
+        return ensureWorkspaceUserExistsCached(workspaceId).then(() =>
+          runCommandOutputWithStatus(
+            SUDO_PATH,
+            ["-n", RUN_AS_HELPER, ...runArgs],
+            {
+              env: process.env,
+              input: options.input,
+              binary: options.binary,
+            }
+          )
+        ).catch((error) => {
+          const details = [
+            "run-as output failed",
+            `mode=${DEPLOYMENT_MODE || "unknown"}`,
+            `sudo=${SUDO_PATH}`,
+            `helper=${RUN_AS_HELPER}`,
+            `workspace=${workspaceId}`,
+            `command=${command}`,
+            `args=${JSON.stringify(args || [])}`,
+            envPairs?.length ? `env=${JSON.stringify(envPairs)}` : null,
+            `error=${error?.message || error}`,
+          ]
+            .filter(Boolean)
+            .join(" ");
+          throw new Error(details);
+        });
+      })()
+  ).catch((error) => {
+    const envPairs = collectEnvPairs(options.env || {});
+    const details = [
+      "run-as output failed",
+      `mode=${DEPLOYMENT_MODE || "unknown"}`,
+      IS_MONO_USER ? null : `sudo=${SUDO_PATH}`,
+      IS_MONO_USER ? null : `helper=${RUN_AS_HELPER}`,
+      `workspace=${workspaceId}`,
+      `command=${command}`,
+      `args=${JSON.stringify(args || [])}`,
+      envPairs.length ? `env=${JSON.stringify(envPairs)}` : null,
+      `error=${error?.message || error}`,
+    ]
+      .filter(Boolean)
+      .join(" ");
+    throw new Error(details);
+  });

package/server/src/runtimeStore.js

@@ -0,0 +1,32 @@
+const runtimeSessions = new Map();
+
+export const getSessionRuntime = (sessionId) => {
+  if (!sessionId) {
+    return null;
+  }
+  let runtime = runtimeSessions.get(sessionId);
+  if (!runtime) {
+    runtime = {
+      sockets: new Set(),
+      clients: {},
+      worktreeClients: new Map(),
+    };
+    runtimeSessions.set(sessionId, runtime);
+  }
+  return runtime;
+};
+
+export const getExistingSessionRuntime = (sessionId) => {
+  if (!sessionId) {
+    return null;
+  }
+  return runtimeSessions.get(sessionId) || null;
+};
+
+export const listSessionRuntimes = () => Array.from(runtimeSessions.values());
+
+export const listSessionRuntimeEntries = () => Array.from(runtimeSessions.entries());
+
+export const deleteSessionRuntime = (sessionId) => {
+  runtimeSessions.delete(sessionId);
+};

package/server/src/services/auth.js

@@ -0,0 +1,157 @@
+import storage from "../storage/index.js";
+import { createWorkspaceToken, accessTokenTtlSeconds } from "../middleware/auth.js";
+import { generateId, hashRefreshToken, generateRefreshToken } from "../helpers.js";
+
+const refreshTokenTtlSeconds =
+  Number(process.env.REFRESH_TOKEN_TTL_SECONDS) || 30 * 24 * 60 * 60;
+const refreshTokenTtlMs = refreshTokenTtlSeconds * 1000;
+const handoffTokenTtlMs =
+  Number(process.env.HANDOFF_TOKEN_TTL_MS) || 120 * 1000;
+const monoAuthTokenTtlMs =
+  Number(process.env.MONO_AUTH_TOKEN_TTL_MS) || 5 * 60 * 1000;
+
+export const handoffTokens = new Map();
+const monoAuthTokens = new Map();
+
+export const issueWorkspaceTokens = async (workspaceId) => {
+  const workspaceToken = createWorkspaceToken(workspaceId);
+  const refreshToken = generateRefreshToken();
+  const tokenHash = hashRefreshToken(refreshToken);
+  const expiresAt = Date.now() + refreshTokenTtlMs;
+  await storage.saveWorkspaceRefreshToken(
+    workspaceId,
+    tokenHash,
+    expiresAt,
+    refreshTokenTtlMs
+  );
+  return {
+    workspaceToken,
+    refreshToken,
+    expiresIn: accessTokenTtlSeconds,
+    refreshExpiresIn: refreshTokenTtlSeconds,
+  };
+};
+
+const buildRefreshError = (code) => {
+  if (code === "refresh_token_expired") {
+    return {
+      status: 401,
+      payload: { error: "Refresh token expired.", code },
+    };
+  }
+  if (code === "refresh_token_reused") {
+    return {
+      status: 401,
+      payload: { error: "Refresh token reused.", code },
+    };
+  }
+  return {
+    status: 401,
+    payload: { error: "Invalid refresh token.", code: "invalid_refresh_token" },
+  };
+};
+
+export const rotateWorkspaceRefreshToken = async (refreshToken) => {
+  const currentTokenHash = hashRefreshToken(refreshToken);
+  const nextRefreshToken = generateRefreshToken();
+  const nextTokenHash = hashRefreshToken(nextRefreshToken);
+  const nextExpiresAt = Date.now() + refreshTokenTtlMs;
+  const result = await storage.rotateWorkspaceRefreshToken(
+    currentTokenHash,
+    nextTokenHash,
+    nextExpiresAt,
+    refreshTokenTtlMs
+  );
+  if (!result?.ok || !result.workspaceId) {
+    const error = buildRefreshError(result?.code || "invalid_refresh_token");
+    return {
+      ok: false,
+      ...error,
+    };
+  }
+  return {
+    ok: true,
+    payload: {
+      workspaceToken: createWorkspaceToken(result.workspaceId),
+      refreshToken: nextRefreshToken,
+      expiresIn: accessTokenTtlSeconds,
+      refreshExpiresIn: refreshTokenTtlSeconds,
+    },
+  };
+};
+
+export const createHandoffToken = (session) => {
+  const now = Date.now();
+  const token = generateId("h");
+  const record = {
+    token,
+    sessionId: session.sessionId,
+    workspaceId: session.workspaceId,
+    createdAt: now,
+    expiresAt: now + handoffTokenTtlMs,
+    usedAt: null,
+  };
+  handoffTokens.set(token, record);
+  return record;
+};
+
+export const createMonoAuthToken = (workspaceId = "default") => {
+  const now = Date.now();
+  const token = generateId("m");
+  const record = {
+    token,
+    workspaceId,
+    createdAt: now,
+    expiresAt: now + monoAuthTokenTtlMs,
+    usedAt: null,
+  };
+  monoAuthTokens.set(token, record);
+  return record;
+};
+
+export const consumeMonoAuthToken = (token) => {
+  const record = monoAuthTokens.get(token);
+  if (!record) {
+    return { ok: false, code: "MONO_AUTH_TOKEN_INVALID" };
+  }
+  if (record.usedAt) {
+    monoAuthTokens.delete(token);
+    return { ok: false, code: "MONO_AUTH_TOKEN_USED" };
+  }
+  if (record.expiresAt && record.expiresAt <= Date.now()) {
+    monoAuthTokens.delete(token);
+    return { ok: false, code: "MONO_AUTH_TOKEN_EXPIRED" };
+  }
+  record.usedAt = Date.now();
+  monoAuthTokens.delete(token);
+  return {
+    ok: true,
+    workspaceId: record.workspaceId,
+  };
+};
+
+export const cleanupHandoffTokens = () => {
+  if (handoffTokens.size === 0) return;
+  const now = Date.now();
+  for (const [token, record] of handoffTokens.entries()) {
+    if (record.usedAt || (record.expiresAt && record.expiresAt <= now)) {
+      handoffTokens.delete(token);
+    }
+  }
+};
+
+export const cleanupMonoAuthTokens = () => {
+  if (monoAuthTokens.size === 0) return;
+  const now = Date.now();
+  for (const [token, record] of monoAuthTokens.entries()) {
+    if (record.usedAt || (record.expiresAt && record.expiresAt <= now)) {
+      monoAuthTokens.delete(token);
+    }
+  }
+};
+
+export {
+  hashRefreshToken,
+  refreshTokenTtlMs,
+  refreshTokenTtlSeconds,
+};

package/server/src/services/claudeThreadDirectory.js

@@ -0,0 +1,33 @@
+import path from "path";
+import { getWorkspaceHome, runAsCommand } from "../runAs.js";
+
+export const buildClaudeThreadRelativeDirectory = (cwd) =>
+  String(cwd || "")
+    .trim()
+    .replaceAll("/", "-");
+
+export const resolveClaudeThreadDirectory = (workspaceId, cwd) => {
+  const workspaceHome = getWorkspaceHome(workspaceId);
+  const threadRelativeDirectory = buildClaudeThreadRelativeDirectory(cwd);
+  return path.join(workspaceHome, ".claude", "projects", threadRelativeDirectory);
+};
+
+export const copyClaudeThreadDirectory = async (workspaceId, sourceCwd, targetCwd) => {
+  const sourceThreadDirectory = resolveClaudeThreadDirectory(workspaceId, sourceCwd);
+  const targetThreadDirectory = resolveClaudeThreadDirectory(workspaceId, targetCwd);
+  const targetParent = path.dirname(targetThreadDirectory);
+
+  await runAsCommand(workspaceId, "/bin/mkdir", ["-p", targetParent]);
+  await runAsCommand(workspaceId, "/bin/rm", ["-rf", targetThreadDirectory]);
+  await runAsCommand(workspaceId, "/bin/mkdir", ["-p", targetThreadDirectory]);
+  await runAsCommand(
+    workspaceId,
+    "/bin/cp",
+    ["-a", `${sourceThreadDirectory}/.`, targetThreadDirectory]
+  );
+
+  return {
+    sourceThreadDirectory,
+    targetThreadDirectory,
+  };
+};