@xfey/tenso 0.1.130

package/dist/server-shell/local-console/browser-bridge.js

@@ -0,0 +1,286 @@
+import { createHash, randomBytes } from "node:crypto";
+import { resolveRelayUrl } from "../cli/launch.js";
+import { serializeRuntimeLogLine } from "@tutti/shared/utils";
+import { appendHostLogLine, getHostLogFilePath } from "../cli/machine-local.js";
+import { LOCAL_CONSOLE_SESSION_COOKIE } from "./session.js";
+const BASE = "/local-console/bridge/v1";
+const IDLE_MS = 15 * 60_000;
+const LIFETIME_MS = 12 * 60 * 60_000;
+const secret = () => randomBytes(32).toString("base64url");
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const tokenPattern = /^[A-Za-z0-9_-]{43}$/u;
+/** No caller-controlled destinations, control routes, session cookies or header forwarding. */
+export function isConsoleBridgeOperation(method, path) {
+    if (method === "GET") {
+        return ([
+            "/bootstrap",
+            "/projects",
+            "/heartbeat",
+            "/package-update",
+            "/package-update?refresh=true",
+        ].includes(path) || /^\/projects\/prj_[A-Za-z0-9]{1,64}\/feishu-setup$/u.test(path));
+    }
+    return (method === "POST" &&
+        ([
+            "/folders/pick",
+            "/providers/models",
+            "/projects/launch",
+            "/package-update",
+            "/account/managed-usage",
+        ].includes(path) ||
+            /^\/projects\/prj_[A-Za-z0-9]{1,64}\/(?:open|invite|stop)$/u.test(path) ||
+            /^\/managed-projects\/(?:prepare|authorize|read|reconcile|validate|launch)$/u.test(path)));
+}
+function validOrigin(origin) {
+    if (typeof origin !== "string")
+        return false;
+    try {
+        const url = new URL(origin);
+        return (url.origin === origin &&
+            !url.username &&
+            !url.password &&
+            (url.protocol === "https:" || (url.protocol === "http:" && url.hostname === "127.0.0.1")));
+    }
+    catch {
+        return false;
+    }
+}
+function objectWithKeys(value, required, optional = []) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        required.every((key) => Object.hasOwn(value, key)) &&
+        Object.keys(value).every((key) => required.includes(key) || optional.includes(key)));
+}
+export function registerConsoleBrowserBridge(app, options) {
+    const registry = new Map();
+    app.addHook("onResponse", (request, reply, done) => {
+        if (options.tuttiHome && request.url.startsWith(`${BASE}/`)) {
+            const suffix = request.url.slice(BASE.length);
+            const stage = [
+                "/session",
+                "/account",
+                "/account/complete",
+                "/request",
+                "/disconnect",
+            ].includes(suffix)
+                ? suffix.slice(1).replaceAll("/", "_")
+                : "rejected";
+            try {
+                appendHostLogLine(getHostLogFilePath(options.tuttiHome), serializeRuntimeLogLine({
+                    service: "host",
+                    component: "console-bridge",
+                    level: reply.statusCode >= 400 ? "warn" : "info",
+                    message: "Console bridge request",
+                    now: options.now ?? (() => new Date()),
+                    fields: { request_id: request.id, stage, status: reply.statusCode },
+                }));
+            }
+            catch {
+                /* Diagnostic failure never changes access or reveals request data. */
+            }
+        }
+        done();
+    });
+    const now = () => (options.now?.() ?? new Date()).getTime();
+    const remove = (key, entry) => {
+        options.sessions.revokeSession(entry.session);
+        if (entry.continuation)
+            options.sessions.revokeAccessToken(entry.continuation);
+        registry.delete(key);
+    };
+    const purge = () => {
+        for (const [key, entry] of registry) {
+            if (entry.expires <= now() || entry.touched + IDLE_MS <= now())
+                remove(key, entry);
+        }
+    };
+    const fail = (request, reply, status, code) => reply.code(status).send({
+        error: {
+            code,
+            message: "Reconnect this computer from Projects.",
+            retryable: false,
+            request_id: request.id,
+        },
+    });
+    // A preflight is only a transport negotiation. Every actual request separately authenticates
+    // its native-configured origin and entry capability; a successful OPTIONS grants no access.
+    app.addHook("onRequest", (request, reply, done) => {
+        if (!request.url.startsWith(`${BASE}/`))
+            return done();
+        reply.header("cache-control", "no-store").header("vary", "Origin");
+        if (!validOrigin(request.headers.origin)) {
+            void fail(request, reply, 403, "bridge_origin_rejected");
+            return;
+        }
+        if (request.url.includes("?")) {
+            void fail(request, reply, 400, "bridge_input_invalid");
+            return;
+        }
+        reply
+            .header("access-control-allow-origin", request.headers.origin)
+            .header("access-control-expose-headers", "x-tutti-request-id");
+        if (request.method === "OPTIONS") {
+            const requested = String(request.headers["access-control-request-headers"] ?? "")
+                .toLowerCase()
+                .split(",")
+                .map((v) => v.trim())
+                .filter(Boolean);
+            if (request.headers["access-control-request-method"] !== "POST" ||
+                requested.some((v) => !["authorization", "content-type"].includes(v))) {
+                void fail(request, reply, 403, "bridge_preflight_rejected");
+                return;
+            }
+            reply
+                .header("access-control-allow-methods", "POST")
+                .header("access-control-allow-headers", "authorization, content-type")
+                .header("access-control-allow-private-network", "true");
+            void reply.code(204).send();
+            return;
+        }
+        done();
+    });
+    app.options(`${BASE}/*`, (_request, reply) => reply.code(204).send());
+    app.post(`${BASE}/session`, (request, reply) => {
+        purge();
+        const body = request.body;
+        if (!objectWithKeys(body, ["access_token"]) ||
+            typeof body.access_token !== "string" ||
+            !tokenPattern.test(body.access_token))
+            return fail(request, reply, 400, "bridge_input_invalid");
+        const context = options.sessions.readEntryContext(body.access_token);
+        const origin = request.headers.origin;
+        const configured = context ? resolveRelayUrl(context.environment).replace(/\/$/u, "") : null;
+        if (!context || !validOrigin(origin) || configured !== origin)
+            return fail(request, reply, 403, "bridge_entry_rejected");
+        if (registry.size >= 16)
+            return fail(request, reply, 429, "bridge_capacity_reached");
+        const session = options.sessions.exchangeAccessToken(body.access_token, undefined, undefined, true);
+        if (!session?.sessionToken)
+            return fail(request, reply, 401, "bridge_entry_expired");
+        const token = secret();
+        registry.set(hash(token), {
+            origin,
+            session: session.sessionToken,
+            context: session.contextToken,
+            csrf: session.csrfToken,
+            touched: now(),
+            expires: now() + LIFETIME_MS,
+        });
+        return { bridge_token: token };
+    });
+    function authenticate(request) {
+        purge();
+        const bearer = /^Bearer ([A-Za-z0-9_-]{43})$/u.exec(String(request.headers.authorization ?? ""))?.[1];
+        const key = bearer ? hash(bearer) : "";
+        const entry = registry.get(key);
+        if (!entry ||
+            entry.origin !== request.headers.origin ||
+            !options.sessions.readSession(entry.session, entry.context))
+            return null;
+        entry.touched = now();
+        return [key, entry];
+    }
+    app.post(`${BASE}/disconnect`, (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        if (request.body !== undefined)
+            return fail(request, reply, 400, "bridge_input_invalid");
+        remove(...auth);
+        return { status: "disconnected" };
+    });
+    app.post(`${BASE}/account`, (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        if (request.body !== undefined)
+            return fail(request, reply, 400, "bridge_input_invalid");
+        const entry = auth[1];
+        const session = options.sessions.readSession(entry.session, entry.context);
+        if (session.accountReady)
+            return fail(request, reply, 409, "bridge_account_already_ready");
+        if (entry.continuation)
+            options.sessions.revokeAccessToken(entry.continuation);
+        const issued = options.sessions.issueAccountContinuation(session.context);
+        entry.continuation = issued.token;
+        return { access_token: issued.token, expires_at: issued.expires_at };
+    });
+    app.post(`${BASE}/account/complete`, (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        const entry = auth[1];
+        const body = request.body;
+        if (!objectWithKeys(body, ["access_token", "account_display_name"]) ||
+            body.access_token !== entry.continuation ||
+            typeof body.access_token !== "string" ||
+            typeof body.account_display_name !== "string" ||
+            !body.account_display_name.trim() ||
+            body.account_display_name.length > 80)
+            return fail(request, reply, 400, "bridge_account_mismatch");
+        const session = options.sessions.exchangeAccessToken(body.access_token, undefined, body.account_display_name, true);
+        if (!session?.sessionToken)
+            return fail(request, reply, 401, "bridge_account_expired");
+        options.sessions.revokeSession(entry.session);
+        entry.session = session.sessionToken;
+        entry.context = session.contextToken;
+        entry.csrf = session.csrfToken;
+        delete entry.continuation;
+        return { status: "ready" };
+    });
+    app.post(`${BASE}/request`, async (request, reply) => {
+        const auth = authenticate(request);
+        if (!auth)
+            return fail(request, reply, 401, "bridge_session_required");
+        const [key, entry] = auth;
+        const body = request.body;
+        if (!objectWithKeys(body, ["method", "path"], ["body"]) ||
+            typeof body.method !== "string" ||
+            typeof body.path !== "string" ||
+            !isConsoleBridgeOperation(body.method, body.path) ||
+            (body.body !== undefined && typeof body.body !== "string") ||
+            (body.method === "GET" && body.body !== undefined))
+            return fail(request, reply, 400, "bridge_operation_rejected");
+        if (!options.sessions.readSession(entry.session, entry.context)?.accountReady)
+            return fail(request, reply, 401, "bridge_account_required");
+        const response = await app.inject({
+            method: body.method,
+            url: `/local-console/v1${body.path}`,
+            headers: {
+                host: request.headers.host,
+                origin: `http://${request.headers.host}`,
+                cookie: `${LOCAL_CONSOLE_SESSION_COOKIE}=${entry.session}`,
+                "x-local-console-context": entry.context,
+                "x-local-console-csrf": entry.csrf,
+                ...(body.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            ...(body.body === undefined ? {} : { payload: body.body }),
+        });
+        purge();
+        if (registry.get(key) !== entry)
+            return fail(request, reply, 401, "bridge_session_required");
+        if (response.rawPayload.length > 2 * 1024 * 1024)
+            return fail(request, reply, 502, "bridge_response_too_large");
+        let data;
+        try {
+            data = response.json();
+        }
+        catch {
+            return fail(request, reply, 502, "bridge_response_invalid");
+        }
+        // The reused controller only needs a readiness marker; never expose native cookie/CSRF.
+        if (body.path === "/bootstrap" &&
+            typeof data === "object" &&
+            data !== null &&
+            "csrf_token" in data)
+            data = { ...data, csrf_token: "bridge" };
+        return reply.code(response.statusCode).send(data);
+    });
+    app.addHook("onClose", (_instance, done) => {
+        for (const [key, entry] of registry)
+            remove(key, entry);
+        done();
+    });
+}
+//# sourceMappingURL=browser-bridge.js.map

package/dist/server-shell/local-console/browser-open.d.ts

@@ -0,0 +1,5 @@
+export declare function openLocalConsoleBrowser(url: string, options?: {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+}): boolean;
+//# sourceMappingURL=browser-open.d.ts.map

package/dist/server-shell/local-console/browser-open.js

@@ -0,0 +1,40 @@
+import { spawn } from "node:child_process";
+import { constants, accessSync } from "node:fs";
+import { delimiter, join } from "node:path";
+function executableInPath(command, env) {
+    for (const directory of (env.PATH ?? "").split(delimiter)) {
+        if (directory.trim() === "") {
+            continue;
+        }
+        const candidate = join(directory, command);
+        try {
+            accessSync(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Keep searching PATH.
+        }
+    }
+    return null;
+}
+export function openLocalConsoleBrowser(url, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const env = options.env ?? process.env;
+    const command = platform === "darwin"
+        ? "/usr/bin/open"
+        : platform === "linux" && (env.DISPLAY !== undefined || env.WAYLAND_DISPLAY !== undefined)
+            ? executableInPath("xdg-open", env)
+            : null;
+    if (command === null) {
+        return false;
+    }
+    const child = spawn(command, [url], {
+        detached: true,
+        env,
+        stdio: "ignore",
+    });
+    child.on("error", () => undefined);
+    child.unref();
+    return true;
+}
+//# sourceMappingURL=browser-open.js.map

package/dist/server-shell/local-console/folder-picker.d.ts

@@ -0,0 +1,20 @@
+export type LocalFolderPickerKind = "macos" | "zenity" | "kdialog" | "unavailable";
+export type LocalFolderPickResult = {
+    kind: "selected";
+    path: string;
+} | {
+    kind: "cancelled";
+} | {
+    kind: "unavailable";
+    message: string;
+};
+export declare function detectLocalFolderPicker(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): {
+    kind: LocalFolderPickerKind;
+    executable?: string;
+};
+export declare function pickLocalFolder(options?: {
+    prompt?: string;
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+}): Promise<LocalFolderPickResult>;
+//# sourceMappingURL=folder-picker.d.ts.map

package/dist/server-shell/local-console/folder-picker.js

@@ -0,0 +1,78 @@
+import { execFile } from "node:child_process";
+import { constants, accessSync, existsSync, statSync } from "node:fs";
+import { delimiter, join, resolve } from "node:path";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+function executableInPath(command, env) {
+    for (const directory of (env.PATH ?? "").split(delimiter)) {
+        if (directory.trim() === "") {
+            continue;
+        }
+        const candidate = join(directory, command);
+        try {
+            accessSync(candidate, constants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Keep searching PATH.
+        }
+    }
+    return null;
+}
+export function detectLocalFolderPicker(platform = process.platform, env = process.env) {
+    if (platform === "darwin") {
+        return { kind: "macos", executable: "/usr/bin/osascript" };
+    }
+    if (platform !== "linux" || (env.DISPLAY === undefined && env.WAYLAND_DISPLAY === undefined)) {
+        return { kind: "unavailable" };
+    }
+    const zenity = executableInPath("zenity", env);
+    if (zenity !== null) {
+        return { kind: "zenity", executable: zenity };
+    }
+    const kdialog = executableInPath("kdialog", env);
+    if (kdialog !== null) {
+        return { kind: "kdialog", executable: kdialog };
+    }
+    return { kind: "unavailable" };
+}
+function normalizeSelectedPath(stdout) {
+    const value = stdout.trim();
+    if (value === "") {
+        return null;
+    }
+    const selected = resolve(value);
+    if (!existsSync(selected) || !statSync(selected).isDirectory()) {
+        return null;
+    }
+    return selected;
+}
+export async function pickLocalFolder(options = {}) {
+    const prompt = options.prompt ?? "Choose a Tenso project folder";
+    const picker = detectLocalFolderPicker(options.platform, options.env);
+    if (picker.kind === "unavailable" || picker.executable === undefined) {
+        return {
+            kind: "unavailable",
+            message: "No desktop folder picker is available. Enter an absolute folder path instead.",
+        };
+    }
+    const args = picker.kind === "macos"
+        ? ["-e", `POSIX path of (choose folder with prompt ${JSON.stringify(prompt)})`]
+        : picker.kind === "zenity"
+            ? ["--file-selection", "--directory", `--title=${prompt}`]
+            : ["--getexistingdirectory", resolve(process.cwd()), "--title", prompt];
+    try {
+        const result = await execFileAsync(picker.executable, args, {
+            encoding: "utf8",
+            env: options.env ?? process.env,
+            maxBuffer: 16 * 1024,
+            timeout: 120_000,
+        });
+        const selected = normalizeSelectedPath(result.stdout);
+        return selected === null ? { kind: "cancelled" } : { kind: "selected", path: selected };
+    }
+    catch {
+        return { kind: "cancelled" };
+    }
+}
+//# sourceMappingURL=folder-picker.js.map

package/dist/server-shell/local-console/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./browser-open.js";
+export * from "./managed-console.js";
+export * from "./server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server-shell/local-console/index.js

@@ -0,0 +1,4 @@
+export * from "./browser-open.js";
+export * from "./managed-console.js";
+export * from "./server.js";
+//# sourceMappingURL=index.js.map

package/dist/server-shell/local-console/invocation-context.d.ts

@@ -0,0 +1,30 @@
+export declare const LOCAL_CONSOLE_INVOCATION_ENV_KEYS: readonly ["DBUS_SESSION_BUS_ADDRESS", "DISPLAY", "LANG", "LC_ALL", "LC_CTYPE", "PATH", "TUTTI_HOST_ENDPOINT_HOST", "TUTTI_HOST_ENDPOINT_PORT", "TUTTI_RELAY_URL", "WAYLAND_DISPLAY", "XDG_CURRENT_DESKTOP"];
+export type LocalConsoleInvocationEnvironment = Partial<Record<(typeof LOCAL_CONSOLE_INVOCATION_ENV_KEYS)[number], string>>;
+export type LocalConsoleInvocationContext = {
+    source: "terminal";
+    currentDirectory: string;
+    environment: LocalConsoleInvocationEnvironment;
+} | {
+    source: "desktop";
+    environment: LocalConsoleInvocationEnvironment;
+};
+export declare function collectLocalConsoleInvocationEnvironment(env: NodeJS.ProcessEnv): LocalConsoleInvocationEnvironment;
+export declare function createLocalConsoleInvocationContext(options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}): LocalConsoleInvocationContext;
+export declare function createDesktopLocalConsoleInvocationContext(options: {
+    env: NodeJS.ProcessEnv;
+}): LocalConsoleInvocationContext;
+export declare function createLocalConsoleServiceEnvironment(options: {
+    env: NodeJS.ProcessEnv;
+    tuttiHome: string;
+    runtimeExecutablePath?: string;
+}): NodeJS.ProcessEnv;
+export declare function createLocalConsoleOperationEnvironment(options: {
+    serviceEnvironment: NodeJS.ProcessEnv;
+    invocationEnvironment: LocalConsoleInvocationEnvironment;
+    tuttiHome: string;
+    runtimeExecutablePath?: string;
+}): NodeJS.ProcessEnv;
+//# sourceMappingURL=invocation-context.d.ts.map

package/dist/server-shell/local-console/invocation-context.js

@@ -0,0 +1,73 @@
+import { delimiter, dirname, resolve } from "node:path";
+export const LOCAL_CONSOLE_INVOCATION_ENV_KEYS = [
+    "DBUS_SESSION_BUS_ADDRESS",
+    "DISPLAY",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "PATH",
+    "TUTTI_HOST_ENDPOINT_HOST",
+    "TUTTI_HOST_ENDPOINT_PORT",
+    "TUTTI_RELAY_URL",
+    "WAYLAND_DISPLAY",
+    "XDG_CURRENT_DESKTOP",
+];
+function mergeExecutablePaths(values, runtimeExecutablePath) {
+    const entries = [dirname(runtimeExecutablePath), ...values.flatMap((value) => value?.split(delimiter) ?? [])]
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "");
+    return [...new Set(entries)].join(delimiter);
+}
+export function collectLocalConsoleInvocationEnvironment(env) {
+    const environment = {};
+    for (const key of LOCAL_CONSOLE_INVOCATION_ENV_KEYS) {
+        const value = env[key];
+        if (value !== undefined && value !== "") {
+            environment[key] = value;
+        }
+    }
+    return environment;
+}
+export function createLocalConsoleInvocationContext(options) {
+    return {
+        source: "terminal",
+        currentDirectory: resolve(options.cwd),
+        environment: collectLocalConsoleInvocationEnvironment(options.env),
+    };
+}
+export function createDesktopLocalConsoleInvocationContext(options) {
+    return {
+        source: "desktop",
+        environment: collectLocalConsoleInvocationEnvironment(options.env),
+    };
+}
+export function createLocalConsoleServiceEnvironment(options) {
+    const environment = { TUTTI_HOME: options.tuttiHome };
+    for (const key of [
+        "HOME",
+        "LANG",
+        "LC_ALL",
+        "LC_CTYPE",
+        "LOGNAME",
+        "PATH",
+        "TMPDIR",
+        "USER",
+    ]) {
+        const value = options.env[key];
+        if (value !== undefined && value !== "") {
+            environment[key] = value;
+        }
+    }
+    environment.PATH = mergeExecutablePaths([environment.PATH], options.runtimeExecutablePath ?? process.execPath);
+    return environment;
+}
+export function createLocalConsoleOperationEnvironment(options) {
+    const executablePath = mergeExecutablePaths([options.invocationEnvironment.PATH, options.serviceEnvironment.PATH], options.runtimeExecutablePath ?? process.execPath);
+    return {
+        ...options.serviceEnvironment,
+        ...options.invocationEnvironment,
+        PATH: executablePath,
+        TUTTI_HOME: options.tuttiHome,
+    };
+}
+//# sourceMappingURL=invocation-context.js.map

package/dist/server-shell/local-console/lifecycle-lock.d.ts

@@ -0,0 +1,13 @@
+type LifecycleLockTiming = {
+    staleMs: number;
+    waitMs: number;
+    pollMs: number;
+};
+export declare function withLocalConsoleLifecycleLock<T>(options: {
+    tuttiHome: string;
+    run: () => Promise<T>;
+    now?: () => number;
+    timing?: Partial<LifecycleLockTiming>;
+}): Promise<T>;
+export {};
+//# sourceMappingURL=lifecycle-lock.d.ts.map