@wjarka/cezarion 0.14.8 → 0.14.9-dev.829

package/dist/server/server.js

@@ -1,6 +1,6 @@
 import { DelegationService } from '../delegation/service.js';
 import { delegationFailure } from '../delegation/routes.js';
-import { workerEmptyRequestSchema, runRelationshipsSchema, runDelegationSummarySchema } from '../contract/index.js';
+import { CLIENT_REQUEST_VARIANTS_ERROR, workerEmptyRequestSchema, runRelationshipsSchema, runDelegationSummarySchema } from '../contract/index.js';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { AutomationStore } from '../automations/store.js';
@@ -41,10 +41,14 @@ import { appendHandoffHeartbeat, handoffProgressExcerpt, readHandoff } from '../
 import { markStarted, onTodosChanged, readTodos, removeTodo, todoTaskText } from '../todos.js';
 import { HistoryCursorError, deriveRunContextEvents, readEventsAfterLiveCursor, readRunHistoryPage, validateLiveCursor, } from '../runs/event-history.js';
 import { readRunIndexFromDisk } from '../runs/run-index.js';
+import { clientRequestHash } from '../runs/client-request.js';
 import { ColdRepoHandles } from './cold-repo-handles.js';
 import { isV2WireEventType } from '../runs/ui-event-sink.js';
 import { runEventsQuerySchema, runHistoryQuerySchema, runIdParamSchema, } from '../contract/index.js';
 import { resolveAttachmentPath } from '../workflows/attachment-path.js';
+import { artifactParamsSchema, fileLinkQuerySchema } from '../contract/index.js';
+import { artifactDirectory, listArtifacts, readArtifact } from '../artifacts/store.js';
+import { artifactPreview, loadFileLink, rasterMime } from '../artifacts/resolve.js';
 import { isUntouchedCancelledRun, toPastedContent } from '../workflows/run.js';
 import { removeWorktree, worktreeDiff, worktreeDiffStat, worktreeSizeBytes } from '../git-worktree.js';
 import { isReclaimable, reclaimWorktrees } from '../runs/retention.js';
@@ -72,6 +76,8 @@ import { reviewGateEnabled } from '../runs/review-gate.js';
 import { readUiState, uiStatePath } from '../ui-state.js';
 import { agentHomePaths, expandTilde } from '../paths.js';
 import { isLoopbackHostHeader, normalizeHostname, resolveCapabilities } from './capabilities.js';
+import { applicationUpdateInputSchema } from '../contract/index.js';
+import { ApplicationUpdateConflictError, ApplicationUpdateFailureError } from '../application-update/service.js';
 import { createSocketHub } from './ws.js';
 import { browseDirectory, isInsideBrowseRoot, isLexicallyInsideBrowseRoot, resolveBrowseRoot } from './fs-browse.js';
 import { parseRemote, resolveForge } from './forge/index.js';
@@ -304,9 +310,14 @@ const startRunSchema = z
     // audit trail survives the composer detour. Bounded like every other
     // string here; a todo id is a short generated key.
     todoId: z.string().min(1).max(200, 'must be at most 200 characters').optional(),
+    // Idempotent start (#504): the same id and payload answer 200 with the existing run.
+    clientRequestId: z.string().uuid().optional(),
 })
     .refine((b) => Boolean(b.workflow) !== Boolean(b.steps), {
     message: 'provide either "workflow" or "steps", not both',
+})
+    .refine((b) => !(b.clientRequestId && (b.variants ?? 1) > 1), {
+    message: CLIENT_REQUEST_VARIANTS_ERROR,
 });
 const pickSchema = z.object({
     runId: z.string().min(1),
@@ -1088,6 +1099,9 @@ export function createApp(deps) {
             // the key as always-present, which is a shape no client ever receives. The contract schema
             // says `.optional()`, and contract-parity.test.ts holds the two together.
             ...(update?.latest !== undefined ? { latestVersion: update.latest } : {}),
+            ...(deps.applicationUpdate ? { applicationUpdate: caps.localHandoff
+                    ? deps.applicationUpdate.snapshot()
+                    : { status: 'idle', supported: false, message: 'Update this installation manually.' } } : {}),
             // Health is CORS-open and, in hosted mode, reachable off the loopback —
             // so any site/host that reads it would learn the developer's absolute
             // checkout path and username (#431). Local mode keeps the full path (the
@@ -1163,6 +1177,10 @@ export function createApp(deps) {
         })();
         return healthInFlight;
     };
+    deps.applicationUpdate?.onStateChange?.(() => {
+        healthCache = undefined;
+        void refreshHealth();
+    });
     // The read the GET and the topic snapshot share. On the live server (a hub is
     // injected) it answers from cache instantly and revalidates behind the
     // response; without a hub — a bare app in tests — there is no refresher
@@ -2342,6 +2360,32 @@ export function createApp(deps) {
             throw error;
         }
     });
+    // Workspace-level, server-selected target and executable. The empty JSON body is strict.
+    const applicationUpdateRoutes = new Hono()
+        .post('/workspace/application-update/apply', jsonZodValidator(applicationUpdateInputSchema), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json({ error: 'Application updates require a local cockpit.' }, 409);
+        if (!deps.applicationUpdate)
+            return c.json({ error: 'Application update is unavailable.' }, 409);
+        try {
+            return c.json({ state: await deps.applicationUpdate.apply() });
+        }
+        catch (error) {
+            return c.json({ error: error instanceof ApplicationUpdateConflictError || error instanceof ApplicationUpdateFailureError ? error.message : 'Application update preparation failed.' }, error instanceof ApplicationUpdateConflictError ? 409 : error instanceof ApplicationUpdateFailureError ? error.status : 500);
+        }
+    })
+        .post('/workspace/application-update/restart', jsonZodValidator(applicationUpdateInputSchema), async (c) => {
+        if (!capabilities().localHandoff)
+            return c.json({ error: 'Application updates require a local cockpit.' }, 409);
+        if (!deps.applicationUpdate)
+            return c.json({ error: 'Application update is unavailable.' }, 409);
+        try {
+            return c.json({ state: await deps.applicationUpdate.restart() });
+        }
+        catch (error) {
+            return c.json({ error: error instanceof ApplicationUpdateConflictError ? error.message : 'Application restart is unavailable.' }, error instanceof ApplicationUpdateConflictError ? 409 : 500);
+        }
+    });
     // ---- GUI clone (multi-project spec, step 4.3) ----------------------------
     // "Add project → Clone from GitHub": clone into the checkout root, then
     // register the result through `registerFolder` above (same guards, same
@@ -3131,8 +3175,21 @@ export function createApp(deps) {
         return run ? c.json(run) : c.json({ error: 'not found' }, 404);
     })
         .post('/runs', jsonZodValidator(startRunSchema), async (c) => {
-        const { root: repoRoot, dataDir, manager } = c.get('project');
+        const { root: repoRoot, dataDir, manager, store } = c.get('project');
         const parsed = { data: c.req.valid('json') };
+        const clientRequest = parsed.data.clientRequestId
+            ? { id: parsed.data.clientRequestId, hash: clientRequestHash(parsed.data) }
+            : undefined;
+        // A retry only retrieves a persisted result: mutable start prerequisites (workflow,
+        // provider, account and model policy) must not invalidate an already accepted request.
+        if (clientRequest) {
+            const existing = store.findRunByClientRequestId(clientRequest.id);
+            if (existing) {
+                if (existing.clientRequestHash !== clientRequest.hash)
+                    return c.json({ error: 'request id payload conflict' }, 409);
+                return c.json(existing, 200);
+            }
+        }
         if (agentModelsLocked(repoRoot) &&
             (parsed.data.model?.trim() || parsed.data.effort?.trim())) {
             return c.json({ error: AGENT_MODELS_LOCKED_ERROR }, 409);
@@ -3186,6 +3243,18 @@ export function createApp(deps) {
             // CEZ_TODOS_FILE alike (RunManager.agentEnv).
             generateFollowups: capabilities().followups ? parsed.data.generateFollowups : false,
         };
+        if (clientRequest) {
+            // Recheck after every await: concurrent first requests may both miss the early lookup.
+            // The manager's lookup and create are synchronous, so exactly one can create (#504).
+            const result = manager.startRunIdempotent(workflow, input, clientRequest);
+            if ('conflict' in result)
+                return c.json({ error: 'request id payload conflict' }, 409);
+            if (!result.created)
+                return c.json(result.run, 200);
+            if (parsed.data.todoId)
+                await noteTodoStarted(dataDir, parsed.data.todoId, result.run.id);
+            return c.json(result.run, 201);
+        }
         const variants = parsed.data.variants ?? 1;
         if (variants > 1) {
             // Variants live in worktrees — without git there's nothing to isolate
@@ -3703,6 +3772,70 @@ export function createApp(deps) {
         if (!result.ok)
             return c.json({ error: result.error }, 409);
         return c.json(result.commit);
+    })
+        .get('/runs/:id/file-link', paramZodValidator(artifactParamsSchema.omit({ artifactId: true })), queryZodValidator(fileLinkQuerySchema), async (c) => {
+        const { root, dataDir, store } = c.get('project');
+        const run = store.getRun(c.req.valid('param').id);
+        if (!run)
+            return c.json({ error: 'not found' }, 404);
+        const query = c.req.valid('query');
+        const loaded = await loadFileLink({ dataDir, runId: run.id, projectRoot: root, workingDirectory: run.worktreePath ?? root, path: query.path });
+        if (query.raw === '1') {
+            if (!loaded.imageBytes || loaded.preview.type !== 'file')
+                return c.json({ error: 'Only bounded raster images can be served inline.' }, 409);
+            return c.body(new Uint8Array(loaded.imageBytes).buffer, 200, {
+                'content-type': rasterMime(loaded.preview.path), 'x-content-type-options': 'nosniff',
+                'content-security-policy': "default-src 'none'; sandbox", 'cache-control': 'private, no-store',
+            });
+        }
+        return c.json(loaded.preview);
+    })
+        .get('/runs/:id/artifacts', paramZodValidator(artifactParamsSchema.omit({ artifactId: true })), async (c) => {
+        const { dataDir, store } = c.get('project');
+        const id = c.req.valid('param').id;
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        return c.json({ artifacts: await listArtifacts(artifactDirectory(dataDir, id), id) });
+    })
+        .get('/runs/:id/artifacts/:artifactId', paramZodValidator(artifactParamsSchema), async (c) => {
+        const { dataDir, store } = c.get('project');
+        const { id, artifactId } = c.req.valid('param');
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        const entry = await readArtifact(artifactDirectory(dataDir, id), id, artifactId);
+        if (!entry)
+            return c.json({ error: 'Published file is missing or unavailable.' }, 404);
+        return c.json(artifactPreview(entry.metadata, entry.bytes));
+    })
+        .get('/runs/:id/artifacts/:artifactId/download', paramZodValidator(artifactParamsSchema), async (c) => {
+        const { dataDir, store } = c.get('project');
+        const { id, artifactId } = c.req.valid('param');
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        const entry = await readArtifact(artifactDirectory(dataDir, id), id, artifactId);
+        if (!entry)
+            return c.json({ error: 'Published file is missing or unavailable.' }, 404);
+        return c.body(new Uint8Array(entry.bytes).buffer, 200, {
+            'content-type': 'application/octet-stream', 'x-content-type-options': 'nosniff',
+            'content-disposition': `attachment; filename="${entry.metadata.name.replace(/[^A-Za-z0-9._-]/g, '_')}"`,
+            'content-security-policy': "default-src 'none'; sandbox", 'cache-control': 'private, no-store',
+        });
+    })
+        .get('/runs/:id/artifacts/:artifactId/image', paramZodValidator(artifactParamsSchema), async (c) => {
+        const { dataDir, store } = c.get('project');
+        const { id, artifactId } = c.req.valid('param');
+        if (!store.getRun(id))
+            return c.json({ error: 'not found' }, 404);
+        const entry = await readArtifact(artifactDirectory(dataDir, id), id, artifactId);
+        if (!entry)
+            return c.json({ error: 'Published file is missing or unavailable.' }, 404);
+        const mime = rasterMime(entry.metadata.name);
+        if (!mime)
+            return c.json({ error: 'Only raster images can be served inline.' }, 409);
+        return c.body(new Uint8Array(entry.bytes).buffer, 200, {
+            'content-type': mime, 'x-content-type-options': 'nosniff',
+            'content-security-policy': "default-src 'none'; sandbox", 'cache-control': 'private, no-store',
+        });
     })
         // Files tab: directory listing (path omitted or a dir) or file content
         // (size-capped, binary flagged). Traversal-safe — readWorktreePath rejects
@@ -5080,6 +5213,7 @@ export function createApp(deps) {
         .route('/', projectsRoutes)
         .route('/', agentProfilesRoutes)
         .route('/', skillsUpdateRoutes)
+        .route('/', applicationUpdateRoutes)
         .route('/', workspaceConfigRoutes)
         .route('/', fsBrowseRoutes)
         .route('/', automationChecksRoutes)
@@ -5146,7 +5280,28 @@ export function startServer(deps, port) {
     // hosted/VPS deployment (which also flips CEZ_REMOTE to gate the local-handoff endpoints) —
     // src/index.ts never passes it, so the loopback guarantee holds for the normal CLI.
     const server = serve({
-        fetch: app.fetch,
+        fetch: async (request, env) => {
+            const result = await app.fetch(request, env);
+            if (request.method === 'POST' && new URL(request.url).pathname === '/api/v1/workspace/application-update/restart'
+                && result.status === 200) {
+                // Arming is server-owned. A connected caller must receive the complete
+                // acknowledgement before shutdown; a caller that already disconnected
+                // cannot leave its explicitly requested, armed restart stranded.
+                const response = env.outgoing;
+                const handoff = () => {
+                    response.off('finish', handoff);
+                    response.off('close', handoff);
+                    deps.applicationUpdate?.afterResponse?.();
+                };
+                if (response.destroyed)
+                    handoff();
+                else {
+                    response.once('finish', handoff);
+                    response.once('close', handoff);
+                }
+            }
+            return result;
+        },
         port,
         hostname: deps.bindHost ?? '127.0.0.1',
     });
@@ -5239,7 +5394,18 @@ export function startServer(deps, port) {
     });
     server.once('close', () => { unsubscribe(); coordinator.stop(); automationScheduler.stop(); sharedContexts.disposeAll(); void deps.delegation?.close(); });
     socketHub.attach(server, (req) => verifyWsUpgrade(req, deps.bindHost));
-    return server;
+    const shutdownForRestart = async () => {
+        sharedContexts.disposeAll(); // flush every built secondary project before old process exits
+        deps.store.flush();
+        socketHub.close();
+        await deps.delegation?.close();
+        await new Promise((resolve) => {
+            server.close(() => resolve());
+            if ('closeAllConnections' in server)
+                server.closeAllConnections();
+        });
+    };
+    return Object.assign(server, { shutdownForRestart });
 }
 /**
  * The WebSocket twin of the `/api/*` request-origin guard (#426), applied