@workerdeck/server 0.9.0 → 0.11.0

package/README.md

@@ -54,6 +54,7 @@ Routes (default `basePath: '/v1'`):
 | --- | --- |
 | `GET/POST /v1/sessions` | List sessions / create one (`CreateSessionRequest`, `cwd` required) |
 | `GET/DELETE /v1/sessions/:id` | Session info / close and remove |
+| `PATCH /v1/sessions/:id` | Rename (`{ title }`; `null` restores the derived title) |
 | `WS /v1/sessions/:id/ws?afterSeq=n` | Attach: `attached` frame, replay past `n`, then live events |
 | `POST /v1/sessions/:id/permissions/:requestId` | Resolve a pending approval over REST |
 | `GET /v1/sdk-sessions?dir=…` | List the Agent SDK's on-disk sessions to offer resume |

package/build/index.d.mts

@@ -658,5 +658,55 @@ declare class AttachmentStore {
   drop(sessionId: string): void;
 }
 //#endregion
-export { AttachmentStore, type AttachmentStoreOptions, type Authenticator, BridgeHub, type BridgeHubOptions, type EngineRunnerContext, type FileSessionStoreOptions, MemorySessionStore, type ParkedSessionRecord, type ProfileStore, type QueueServerOptions, type SdkSessionLister, type SessionNotificationOptions, SessionNotifier, SessionParkManager, type SessionParkOptions, SessionRegistry, type SessionRegistryOptions, type SessionStore, type WorkerServer, type WorkerServerOptions, createFileProfileStore, createFileSessionStore, createMemoryProfileStore, createWorkerServer, toDurableRecord };
+//#region src/produced-files.d.ts
+/** One host file an engine reported writing, as the store holds it. */
+type ProducedFile = {
+  fileId: string; /** Absolute host path, exactly as the runner reported it. */
+  path: string;
+  mediaType?: string; /** Size when the runner announced it — advisory, and re-read at serve time. */
+  bytes?: number;
+  sessionId: string;
+};
+/**
+ * The paths this gateway will serve from `GET /sessions/:id/produced/:fileId`.
+ *
+ * **This is the whole access-control model, so it is worth being precise about
+ * what it is.** The store is an allowlist built from one source and one only:
+ * `file_produced` events, which a runner emits about a file its own engine just
+ * wrote. It is not a directory grant. Nothing else can add to it — not a
+ * request, not a config, and in particular not the agent, whose own path claims
+ * go through `/fs/*` and that route's root allowlist.
+ *
+ * That is why the route needs neither `hostFiles.roots` nor `maxFileBytes`:
+ * "somewhere under a root the operator declared" is a guess about which paths
+ * are safe, while "the exact path this session's runner reported producing" is
+ * a fact about one file. A 2 MB generated PNG is the common case, and making
+ * the operator raise a byte cap to see their own picture was the bug this
+ * replaces.
+ *
+ * Lifetime is the session's, like `AttachmentStore`'s: in memory, dropped when
+ * the session is removed. The bytes are never held here — only the path, so a
+ * gateway serving a long session accumulates a few hundred bytes per picture
+ * rather than the pictures.
+ */
+declare class ProducedFileStore {
+  #private;
+  /**
+   * Register a runner's produced files for its lifetime.
+   *
+   * Subscribes from seq 0, which is the opposite of what `SessionNotifier` wants
+   * and correct for the same reason: registration is idempotent (a `fileId` is
+   * derived from its path, so re-registering overwrites with itself), and a
+   * session rebuilt from a park must re-learn every file it produced before the
+   * park — otherwise a client's transcript keeps rendering image cards whose
+   * bytes have quietly become unreachable.
+   */
+  watch(runner: Runner): void;
+  get(sessionId: string, fileId: string): ProducedFile | undefined;
+  /** Everything one session has produced, newest registration last. */
+  list(sessionId: string): ProducedFile[];
+  drop(sessionId: string): void;
+}
+//#endregion
+export { AttachmentStore, type AttachmentStoreOptions, type Authenticator, BridgeHub, type BridgeHubOptions, type EngineRunnerContext, type FileSessionStoreOptions, MemorySessionStore, type ParkedSessionRecord, type ProducedFile, ProducedFileStore, type ProfileStore, type QueueServerOptions, type SdkSessionLister, type SessionNotificationOptions, SessionNotifier, SessionParkManager, type SessionParkOptions, SessionRegistry, type SessionRegistryOptions, type SessionStore, type WorkerServer, type WorkerServerOptions, createFileProfileStore, createFileSessionStore, createMemoryProfileStore, createWorkerServer, toDurableRecord };
 //# sourceMappingURL=index.d.mts.map

package/build/index.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { closeSync, constants, existsSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { closeSync, constants, createReadStream, existsSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -266,7 +266,8 @@ const DEFAULT_IGNORED_DIRS = [
 	".pytest_cache",
 	".gradle",
 	"Pods",
-	"DerivedData"
+	"DerivedData",
+	".build"
 ];
 /**
 * Breadth-first so shallow files rank first before scoring even runs — for a bare
@@ -489,6 +490,67 @@ function safeName(name) {
 	return cleaned.length > 120 ? cleaned.slice(0, 120) : cleaned;
 }
 //#endregion
+//#region src/produced-files.ts
+/**
+* The paths this gateway will serve from `GET /sessions/:id/produced/:fileId`.
+*
+* **This is the whole access-control model, so it is worth being precise about
+* what it is.** The store is an allowlist built from one source and one only:
+* `file_produced` events, which a runner emits about a file its own engine just
+* wrote. It is not a directory grant. Nothing else can add to it — not a
+* request, not a config, and in particular not the agent, whose own path claims
+* go through `/fs/*` and that route's root allowlist.
+*
+* That is why the route needs neither `hostFiles.roots` nor `maxFileBytes`:
+* "somewhere under a root the operator declared" is a guess about which paths
+* are safe, while "the exact path this session's runner reported producing" is
+* a fact about one file. A 2 MB generated PNG is the common case, and making
+* the operator raise a byte cap to see their own picture was the bug this
+* replaces.
+*
+* Lifetime is the session's, like `AttachmentStore`'s: in memory, dropped when
+* the session is removed. The bytes are never held here — only the path, so a
+* gateway serving a long session accumulates a few hundred bytes per picture
+* rather than the pictures.
+*/
+var ProducedFileStore = class {
+	#bySession = /* @__PURE__ */ new Map();
+	/**
+	* Register a runner's produced files for its lifetime.
+	*
+	* Subscribes from seq 0, which is the opposite of what `SessionNotifier` wants
+	* and correct for the same reason: registration is idempotent (a `fileId` is
+	* derived from its path, so re-registering overwrites with itself), and a
+	* session rebuilt from a park must re-learn every file it produced before the
+	* park — otherwise a client's transcript keeps rendering image cards whose
+	* bytes have quietly become unreachable.
+	*/
+	watch(runner) {
+		runner.subscribe((event) => {
+			if (event.type !== "file_produced") return;
+			const held = this.#bySession.get(runner.id) ?? /* @__PURE__ */ new Map();
+			held.set(event.fileId, {
+				fileId: event.fileId,
+				path: event.path,
+				...event.mediaType ? { mediaType: event.mediaType } : {},
+				...event.bytes !== void 0 ? { bytes: event.bytes } : {},
+				sessionId: runner.id
+			});
+			this.#bySession.set(runner.id, held);
+		}, 0);
+	}
+	get(sessionId, fileId) {
+		return this.#bySession.get(sessionId)?.get(fileId);
+	}
+	/** Everything one session has produced, newest registration last. */
+	list(sessionId) {
+		return [...this.#bySession.get(sessionId)?.values() ?? []];
+	}
+	drop(sessionId) {
+		this.#bySession.delete(sessionId);
+	}
+};
+//#endregion
 //#region src/registry.ts
 /** In-memory session table. Terminal sessions stay listed until removed or the process exits. */
 var SessionRegistry = class {
@@ -1667,8 +1729,10 @@ function createWorkerServer(options = {}) {
 	* learned — and still absent on a cold server, the accepted regression.
 	*/
 	const profileDefaultModels = /* @__PURE__ */ new Map();
+	const producedFiles = new ProducedFileStore();
 	const registry = new SessionRegistry({ onRegister: (runner) => {
 		notifier.watch(runner);
+		producedFiles.watch(runner);
 		const profile = runner.info().profile;
 		if (!profile) return;
 		runner.subscribe((event) => {
@@ -1846,6 +1910,11 @@ function createWorkerServer(options = {}) {
 			attachments: true,
 			attachmentId: parts[2] === void 0 ? void 0 : decodeURIComponent(parts[2])
 		};
+		if (parts.length <= 3 && parts[1] === "produced") return {
+			id: decodeURIComponent(parts[0]),
+			produced: true,
+			producedFileId: parts[2] === void 0 ? void 0 : decodeURIComponent(parts[2])
+		};
 		if (parts.length <= 3 && parts[1] === "mcp") return {
 			id: decodeURIComponent(parts[0]),
 			mcp: true,
@@ -1954,6 +2023,10 @@ function createWorkerServer(options = {}) {
 				json(res, 400, { error: "action must be 'reconnect', 'enable' or 'disable'" });
 				return;
 			}
+			if (!(body.action === "reconnect" ? typeof runner.reconnectMcpServer === "function" : typeof runner.setMcpServerEnabled === "function")) {
+				json(res, 501, { error: `this session's engine cannot ${body.action} an MCP server` });
+				return;
+			}
 			try {
 				if (body.action === "reconnect") await runner.reconnectMcpServer?.(serverName);
 				else await runner.setMcpServerEnabled?.(serverName, body.action === "enable");
@@ -1967,6 +2040,68 @@ function createWorkerServer(options = {}) {
 		json(res, 405, { error: "method not allowed" });
 	};
 	/**
+	* `{basePath}/sessions/:id/produced[/:fileId]` — files this session's ENGINE
+	* wrote on the host (codex's generated images), listed and served.
+	*
+	* The one route here with no root allowlist and no byte cap, and the comment
+	* on {@link ProducedFileStore} is the argument for why that is right rather
+	* than lax: the allowlist is the exact set of paths this session's own runner
+	* announced producing. It is emphatically NOT a hole in `/fs/*` — a path the
+	* *agent* named is not a produced file and never enters this store.
+	*
+	* Everything else matches the attachment download: `nosniff` and an attachment
+	* disposition, because these bytes are model-authored and must not render as a
+	* document on the gateway's origin. (`<img src>` is unaffected — disposition
+	* does not apply to subresources, which is the whole point.)
+	*/
+	const handleProducedFiles = async (req, res, sessionId, fileId) => {
+		if (req.method !== "GET") {
+			json(res, 405, { error: "method not allowed" });
+			return;
+		}
+		if (fileId === void 0) {
+			json(res, 200, { files: producedFiles.list(sessionId).map(({ fileId: id, path, mediaType, bytes }) => ({
+				fileId: id,
+				path,
+				...mediaType ? { mediaType } : {},
+				...bytes !== void 0 ? { bytes } : {}
+			})) });
+			return;
+		}
+		const found = producedFiles.get(sessionId, fileId);
+		if (!found) {
+			json(res, 404, { error: "no such produced file" });
+			return;
+		}
+		let stat;
+		try {
+			stat = statSync(found.path);
+		} catch {
+			json(res, 404, { error: "produced file is no longer on disk" });
+			return;
+		}
+		if (!stat.isFile()) {
+			json(res, 404, { error: "produced file is not a regular file" });
+			return;
+		}
+		const filename = basename(found.path) || "file";
+		res.writeHead(200, {
+			"content-type": found.mediaType ?? contentTypeFor(filename),
+			"content-length": stat.size,
+			"content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`,
+			"x-content-type-options": "nosniff"
+		});
+		await new Promise((done) => {
+			const stream = createReadStream(found.path);
+			stream.on("error", () => {
+				res.destroy();
+				done();
+			});
+			stream.on("close", () => done());
+			stream.pipe(res);
+		});
+	};
+	/**
 	* `{basePath}/fs/*` — the operator's real tree. Authorized by the auth key alone
 	* and deliberately outside the agent permission flow: the caller is the operator.
 	*
@@ -2631,6 +2766,10 @@ function createWorkerServer(options = {}) {
 			res.end(content);
 			return;
 		}
+		if (route.produced) {
+			await handleProducedFiles(req, res, route.id, route.producedFileId);
+			return;
+		}
 		if (route.permissionId) {
 			if (req.method !== "POST") {
 				json(res, 405, { error: "method not allowed" });
@@ -2656,11 +2795,29 @@ function createWorkerServer(options = {}) {
 			json(res, 200, { session: runner?.info() ?? parked.info });
 			return;
 		}
+		if (req.method === "PATCH") {
+			if (!runner) {
+				json(res, 409, { error: "session is parked (wake it before renaming)" });
+				return;
+			}
+			const body = await readJsonBody(req, maxBodyBytes);
+			if (body?.title !== void 0) {
+				if (body.title !== null && typeof body.title !== "string") {
+					json(res, 400, { error: "title must be a string or null" });
+					return;
+				}
+				const title = typeof body.title === "string" ? body.title.trim() : "";
+				runner.setTitle(title || void 0);
+			}
+			json(res, 200, { session: runner.info() });
+			return;
+		}
 		if (req.method === "DELETE") {
 			registry.remove(route.id);
 			bridge.remove(route.id);
 			await parking.discard(route.id);
 			attachmentStore.drop(route.id);
+			producedFiles.drop(route.id);
 			json(res, 200, { session: runner?.info() ?? {
 				...parked.info,
 				status: "closed"
@@ -2893,6 +3050,6 @@ function createFileProfileStore(path = join(process.cwd(), ".workerdeck", "profi
 	};
 }
 //#endregion
-export { AttachmentStore, BridgeHub, MemorySessionStore, SessionNotifier, SessionParkManager, SessionRegistry, createFileProfileStore, createFileSessionStore, createMemoryProfileStore, createWorkerServer, toDurableRecord };
+export { AttachmentStore, BridgeHub, MemorySessionStore, ProducedFileStore, SessionNotifier, SessionParkManager, SessionRegistry, createFileProfileStore, createFileSessionStore, createMemoryProfileStore, createWorkerServer, toDurableRecord };
 
 //# sourceMappingURL=index.mjs.map