@volter/editor-core 0.5.57

package/server/recent-projects-store.ts

@@ -0,0 +1,98 @@
+/**
+ * The launcher's recent-projects list (`~/.vgai/recent-projects.json`) and the
+ * slug rule every project-derived filename shares.
+ *
+ * User-global, not project state: a session that is nobody's launcher does not
+ * write here at all (`recordsRecentProjects`).
+ */
+
+import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { canonicalProjectRoot } from './canonical-path';
+import { readProjectView } from './project-view';
+
+interface RecentProject {
+  name: string;
+  path: string;
+  lastOpened: string;
+  thumbnail?: string;
+}
+
+export const RECENT_PROJECTS_PATH = join(homedir(), '.vgai', 'recent-projects.json');
+const MAX_RECENT_PROJECTS = 20;
+
+export async function loadRecentProjects(path = RECENT_PROJECTS_PATH): Promise<RecentProject[]> {
+  try {
+    const raw = await readFile(path, 'utf-8');
+    const projects = JSON.parse(raw) as RecentProject[];
+    // Filter out projects whose paths no longer exist, populate thumbnails
+    const valid: RecentProject[] = [];
+    const seen = new Set<string>();
+    for (const p of projects) {
+      const canonicalPath = canonicalProjectRoot(p.path);
+      if (seen.has(canonicalPath)) continue;
+      // A folder with a valid v2 manifest is a project; readProjectView is
+      // the one place this rule lives.
+      const view = await readProjectView(canonicalPath);
+      if (!view) continue; // Path no longer exists / neither file describes it — skip
+      seen.add(canonicalPath);
+      // Check for thumbnail
+      try {
+        await stat(join(canonicalPath, '.vgai', 'thumbnail.png'));
+        p.thumbnail = `/__editor/project-thumbnail?path=${encodeURIComponent(canonicalPath)}`;
+      } catch {
+        delete p.thumbnail;
+      }
+      valid.push({ ...p, path: canonicalPath });
+    }
+    return valid;
+  } catch {
+    return [];
+  }
+}
+
+export async function saveRecentProjects(
+  projects: RecentProject[],
+  path = RECENT_PROJECTS_PATH,
+): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, JSON.stringify(projects, null, 2), 'utf-8');
+}
+
+export async function addToRecentProjects(
+  name: string,
+  projectPath: string,
+  path = RECENT_PROJECTS_PATH,
+): Promise<void> {
+  const canonicalPath = canonicalProjectRoot(projectPath);
+  const projects = await loadRecentProjects(path);
+  // Remove existing entry for this path
+  const filtered = projects.filter((p) => p.path !== canonicalPath);
+  // Add at the front
+  filtered.unshift({ name, path: canonicalPath, lastOpened: new Date().toISOString() });
+  // Trim to max
+  await saveRecentProjects(filtered.slice(0, MAX_RECENT_PROJECTS), path);
+}
+
+// The naming scheme moved to `src/play-log/log-naming.ts` so the browser
+// tier mints byte-identical filenames; re-exported here for the existing
+// server importers.
+export { playLogFilename, playRunSlug, slugify } from './support/project/log-naming';
+
+/**
+ * How long a coding agent stays the attributed author of host filesystem
+ * writes after its turn was last OBSERVED running.
+ *
+ * This is a LEASE, not a latch. The window used to be opened with
+ * `Number.POSITIVE_INFINITY` and closed only by the matching turn-ended
+ * observation, so a harness that died mid-turn — crash, kill, closed terminal —
+ * left every later host write in the project credited forever to an agent that
+ * was no longer there. The lease is renewed by each FRESH harness snapshot that
+ * still reports a running turn (`syncHarnessParticipant`), which is precisely
+ * the signal a dead harness stops producing. It is deliberately NOT renewed
+ * from a cached snapshot on a timer: the last snapshot of a dead harness still
+ * says `running`, so a poller reading it would renew forever and reinstate the
+ * bug the lease exists to kill.
+ */
+export const AGENT_AUTHOR_LEASE_MS = 60_000;

package/server/redact-secrets.ts

@@ -0,0 +1,71 @@
+/**
+ * The ONE redaction pass for values recorded to a project's on-disk ledgers
+ * (`.vgai/provenance.json`, `.vgai/generations.json`).
+ *
+ * Secret-shaped keys, signed URL queries, inline data-URLs and binary bodies
+ * are replaced before a byte reaches disk. This lives in exactly one module
+ * because two copies of a redaction regex agree only until someone tightens
+ * one of them — at which point the other ledger silently keeps leaking the
+ * newly-recognized secret. Both writers import THIS; neither carries its own
+ * spelling of what counts as a secret.
+ */
+
+import { createHash } from 'node:crypto';
+
+const SECRET_FIELD = /(authorization|credential|password|secret|token|api.?key|fal.?key)/i;
+const SIGNED_URL_PARAMETER = /(signature|credential|token|expires|x-amz-)/i;
+
+function sanitizeString(value: string): unknown {
+  const dataUrl = /^data:([^;,]+)(?:;[^,]*)?;base64,([A-Za-z0-9+/=\s]+)$/.exec(value);
+  if (dataUrl?.[1] && dataUrl[2]) {
+    const bytes = Buffer.from(dataUrl[2], 'base64');
+    return {
+      mediaType: dataUrl[1],
+      bytes: bytes.byteLength,
+      sha256: createHash('sha256').update(bytes).digest('hex'),
+      encoding: 'data-url-omitted',
+    };
+  }
+  try {
+    const url = new URL(value);
+    if (
+      (url.protocol === 'http:' || url.protocol === 'https:') &&
+      [...url.searchParams.keys()].some((key) => SIGNED_URL_PARAMETER.test(key))
+    ) {
+      return `${url.origin}${url.pathname}?[redacted signed query]`;
+    }
+  } catch {
+    // Most recorded strings are labels, ids, prompts, or paths rather than URLs.
+  }
+  return value;
+}
+
+function isBinaryValue(value: object): boolean {
+  return (
+    value instanceof ArrayBuffer ||
+    ArrayBuffer.isView(value) ||
+    (typeof Blob !== 'undefined' && value instanceof Blob)
+  );
+}
+
+/** Redact `value` recursively; returns a JSON-safe structure. */
+export function sanitizeRecordedValue(value: unknown, seen = new WeakSet<object>()): unknown {
+  if (typeof value === 'string') return sanitizeString(value);
+  if (value === null || typeof value === 'boolean' || typeof value === 'number') return value;
+  if (value === undefined) return undefined;
+  if (typeof value !== 'object') return `[omitted ${typeof value}]`;
+  if (isBinaryValue(value)) return '[binary omitted]';
+  if (seen.has(value)) return '[circular omitted]';
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((entry) => sanitizeRecordedValue(entry, seen) ?? null);
+  const output: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (SECRET_FIELD.test(key)) {
+      output[key] = '[redacted]';
+      continue;
+    }
+    const next = sanitizeRecordedValue(entry, seen);
+    if (next !== undefined) output[key] = next;
+  }
+  return output;
+}

package/server/repository-presence.ts

@@ -0,0 +1,267 @@
+import {
+  type CollaborationAgentIdentity,
+  type CollaborationSnapshot,
+  collaborationParticipantColor,
+  type ParticipantKind,
+  type ParticipantStatus,
+} from '@volter/editor-sdk/session/collaboration-types';
+import type { EditorSession } from './session-registry';
+
+export interface RepositoryParticipantPresence {
+  participantId: string;
+  displayName: string;
+  kind: ParticipantKind;
+  color: string;
+  status: ParticipantStatus;
+  lastSeenAt: string;
+  agent: { harness: string; conversationId: string } | null;
+  changeCount: number;
+}
+
+export interface RepositorySessionPresence {
+  sessionId: string;
+  repositoryId: string;
+  worktreeId: string;
+  branch: string | null;
+  updatedAt: string;
+  participants: RepositoryParticipantPresence[];
+}
+
+interface SessionIdentityResponse {
+  session?: {
+    sessionId?: unknown;
+    repositoryId?: unknown;
+    worktreeId?: unknown;
+    projectRelativePath?: unknown;
+    branch?: unknown;
+    ephemeral?: unknown;
+  };
+}
+
+function participantProjection(value: unknown): RepositoryParticipantPresence | null {
+  if (!value || typeof value !== 'object') return null;
+  const participant = value as Record<string, unknown>;
+  const kind = participant['kind'];
+  const participantId = participant['participantId'];
+  const presence = participant['presence'];
+  const gesture =
+    presence && typeof presence === 'object'
+      ? (presence as Record<string, unknown>)['gesture']
+      : null;
+  const gestureRecord = gesture && typeof gesture === 'object' ? gesture : null;
+  const agent =
+    kind === 'agent' ? participantAgent(participant['agent'], gestureRecord, participantId) : null;
+  const status = participantStatus(participant['status'], kind, gestureRecord);
+  if (
+    typeof participantId !== 'string' ||
+    typeof participant['displayName'] !== 'string' ||
+    (kind !== 'human' && kind !== 'agent') ||
+    !status ||
+    typeof participant['lastSeenAt'] !== 'string' ||
+    !Number.isFinite(Date.parse(participant['lastSeenAt']))
+  ) {
+    return null;
+  }
+  const color = participant['color'];
+  return {
+    participantId,
+    displayName: kind === 'agent' ? (agent?.harness ?? 'Coding agent') : participant['displayName'],
+    kind,
+    color:
+      typeof color === 'string' && /^#[0-9a-f]{6}$/i.test(color)
+        ? color
+        : collaborationParticipantColor(participantId),
+    status,
+    lastSeenAt: participant['lastSeenAt'],
+    agent,
+    changeCount: 0,
+  };
+}
+
+function participantAgent(
+  value: unknown,
+  gesture: object | null,
+  participantId: unknown,
+): CollaborationAgentIdentity | null {
+  if (value && typeof value === 'object') {
+    const agent = value as Record<string, unknown>;
+    if (typeof agent['harness'] === 'string' && typeof agent['conversationId'] === 'string') {
+      return { harness: agent['harness'], conversationId: agent['conversationId'] };
+    }
+  }
+  const harness = gesture ? (gesture as Record<string, unknown>)['harness'] : undefined;
+  return typeof harness === 'string' && typeof participantId === 'string'
+    ? { harness, conversationId: participantId }
+    : null;
+}
+
+function participantStatus(
+  value: unknown,
+  kind: unknown,
+  gesture: object | null,
+): ParticipantStatus | null {
+  if (value === 'active' || value === 'idle' || value === 'needs-input' || value === 'done') {
+    return value;
+  }
+  if (kind === 'human') return 'active';
+  if (kind !== 'agent') return null;
+  const turn = gesture ? (gesture as Record<string, unknown>)['turn'] : undefined;
+  if (turn === 'idle') return 'idle';
+  if (turn === 'needs-input') return 'needs-input';
+  return 'active';
+}
+
+async function readJson(
+  url: string,
+  fetchImpl: typeof fetch,
+  controlSecret: string | null | undefined,
+): Promise<unknown> {
+  const response = await fetchImpl(url, {
+    cache: 'no-store',
+    signal: AbortSignal.timeout(3_000),
+    ...(controlSecret ? { headers: { 'x-vgai-editor-control': controlSecret } } : {}),
+  });
+  if (!response.ok) throw new Error(`Session presence request failed (${response.status}).`);
+  return response.json();
+}
+
+/** Build an ephemeral, browser-safe directory from live editor sessions. The
+ * session registry supplies reachability; the serving process must repeat its
+ * identity before any participant projection is accepted.
+ *
+ * Scope is the PROJECT — `(repositoryId, projectRelativePath)` — not the
+ * repository alone. A repository id names the Git repo, and one repo can hold
+ * many unrelated projects (this monorepo's template, every example, test
+ * fixtures); matching on repositoryId alone put strangers editing a sibling
+ * project into each other's collaborator lists. */
+export async function repositoryPresenceDirectory(
+  sessions: readonly EditorSession[],
+  repositoryId: string,
+  projectRelativePath: string,
+  fetchImpl: typeof fetch = fetch,
+): Promise<RepositorySessionPresence[]> {
+  const matching = sessions.filter(
+    (session) =>
+      session.sessionId &&
+      session.repositoryId === repositoryId &&
+      session.projectRelativePath === projectRelativePath &&
+      session.worktreeId &&
+      session.project,
+  );
+  const values = await Promise.all(
+    matching.map(async (session): Promise<RepositorySessionPresence | null> => {
+      try {
+        const sessionId = session.sessionId;
+        const worktreeId = session.worktreeId;
+        if (!sessionId || !worktreeId) return null;
+        const origin = `http://127.0.0.1:${session.port}`;
+        const [identityValue, snapshotValue] = await Promise.all([
+          readJson(`${origin}/__editor/project`, fetchImpl, session.controlSecret),
+          readJson(`${origin}/__editor/collaboration`, fetchImpl, session.controlSecret),
+        ]);
+        const identity = identityValue as SessionIdentityResponse;
+        const served = identity.session;
+        if (
+          served?.ephemeral === true ||
+          served?.sessionId !== sessionId ||
+          served.repositoryId !== repositoryId ||
+          served.projectRelativePath !== projectRelativePath ||
+          served.worktreeId !== worktreeId
+        ) {
+          return null;
+        }
+        const snapshot = snapshotValue as CollaborationSnapshot;
+        if (!Array.isArray(snapshot.participants)) return null;
+        const participants = snapshot.participants
+          .map(participantProjection)
+          .filter((participant): participant is RepositoryParticipantPresence =>
+            Boolean(participant),
+          )
+          .map((participant) => ({
+            ...participant,
+            changeCount: Array.isArray(snapshot.revisions)
+              ? snapshot.revisions.filter(
+                  (revision) => revision.authorId === participant.participantId,
+                ).length
+              : 0,
+          }));
+        const updatedAt = participants.reduce(
+          (latest, participant) =>
+            Date.parse(participant.lastSeenAt) > Date.parse(latest)
+              ? participant.lastSeenAt
+              : latest,
+          session.startedAt,
+        );
+        return {
+          sessionId,
+          repositoryId,
+          worktreeId,
+          branch: typeof served.branch === 'string' ? served.branch : null,
+          updatedAt,
+          participants,
+        };
+      } catch {
+        return null;
+      }
+    }),
+  );
+  return values.filter((value): value is RepositorySessionPresence => value !== null);
+}
+
+/** One editor process can be polled by every collaborator. Share one bounded
+ * directory read across those callers so the public projection does not fan
+ * out twice per worktree for every browser independently. */
+export function createRepositoryPresenceReader(options?: {
+  ttlMs?: number;
+  now?: () => number;
+  read?: typeof repositoryPresenceDirectory;
+}): (
+  sessions: readonly EditorSession[],
+  repositoryId: string,
+  projectRelativePath: string,
+) => Promise<RepositorySessionPresence[]> {
+  const ttlMs = options?.ttlMs ?? 2_000;
+  const now = options?.now ?? Date.now;
+  const read = options?.read ?? repositoryPresenceDirectory;
+  let cached:
+    | {
+        repositoryId: string;
+        projectRelativePath: string;
+        expiresAt: number;
+        value: RepositorySessionPresence[] | null;
+        pending: Promise<RepositorySessionPresence[]> | null;
+      }
+    | undefined;
+
+  return async (sessions, repositoryId, projectRelativePath) => {
+    if (
+      cached?.repositoryId === repositoryId &&
+      cached.projectRelativePath === projectRelativePath
+    ) {
+      if (cached.pending) return cached.pending;
+      if (cached.value && now() < cached.expiresAt) return cached.value;
+    }
+    const entry = {
+      repositoryId,
+      projectRelativePath,
+      expiresAt: 0,
+      value: null as RepositorySessionPresence[] | null,
+      pending: null as Promise<RepositorySessionPresence[]> | null,
+    };
+    const pending = read(sessions, repositoryId, projectRelativePath).then(
+      (value) => {
+        entry.value = value;
+        entry.expiresAt = now() + ttlMs;
+        entry.pending = null;
+        return value;
+      },
+      (error) => {
+        if (cached === entry) cached = undefined;
+        throw error;
+      },
+    );
+    entry.pending = pending;
+    cached = entry;
+    return pending;
+  };
+}