@xfey/tutti 0.1.33 → 0.1.35

package/dist/server-shell/local-console/server.js

@@ -1,9 +1,12 @@
 import { timingSafeEqual } from "node:crypto";
+import { existsSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 import fastify from "fastify";
 import { resolveTuttiHome } from "../../providers/openai/index.js";
+import { readCliVersion } from "../cli/version.js";
 import { registerHostWebStaticRoutes, resolvePackagedWebStaticRoot } from "../http/static-web.js";
-import { createLocalProjectFolder, detectLocalFolderPicker, pickLocalFolder, } from "./folder-picker.js";
+import { detectLocalFolderPicker, pickLocalFolder } from "./folder-picker.js";
+import { LOCAL_CONSOLE_INVOCATION_ENV_KEYS, createLocalConsoleServiceEnvironment, } from "./invocation-context.js";
 import { LocalConsoleProjectError, LocalConsoleProjectService, } from "./project-service.js";
 import { LOCAL_CONSOLE_SESSION_COOKIE, LocalConsoleSessionRegistry, localConsoleSessionCookie, parseCookieHeader, } from "./session.js";
 import { createLocalConsoleSecret, deleteLocalConsoleRuntimeEndpoint, writeLocalConsoleRuntimeEndpoint, } from "./runtime-endpoint.js";
@@ -59,12 +62,13 @@ function requireLoopbackHost(request) {
 }
 export function createLocalConsoleServer(options) {
     const app = fastify({ logger: false, bodyLimit: 64 * 1024 });
+    const tuttiHome = options.tuttiHome ?? resolveTuttiHome(options.env?.TUTTI_HOME, options.cwd);
     const sessions = new LocalConsoleSessionRegistry({
         ...(options.now === undefined ? {} : { now: options.now }),
     });
     const projects = new LocalConsoleProjectService({
-        cwd: options.cwd,
-        ...(options.env === undefined ? {} : { env: options.env }),
+        tuttiHome,
+        ...(options.env === undefined ? {} : { serviceEnvironment: options.env }),
     });
     app.addHook("onRequest", (request, reply, done) => {
         try {
@@ -101,10 +105,11 @@ export function createLocalConsoleServer(options) {
         if (!tokenEquals(bearerToken(request.headers.authorization), options.controlToken)) {
             throw new LocalConsoleHttpError(401, "unauthorized", "Local Console control token is invalid.");
         }
+        options.onActivity?.();
     }
     function requireSession(request, csrf = false) {
         const cookie = parseCookieHeader(headerValue(request.headers.cookie));
-        const session = sessions.readSession(cookie[LOCAL_CONSOLE_SESSION_COOKIE]);
+        const session = sessions.readSession(cookie[LOCAL_CONSOLE_SESSION_COOKIE], headerValue(request.headers["x-local-console-context"]));
         if (session === null) {
             throw new LocalConsoleHttpError(401, "session_required", "Open Tutti from the CLI again.");
         }
@@ -115,22 +120,65 @@ export function createLocalConsoleServer(options) {
                 throw new LocalConsoleHttpError(403, "csrf_rejected", "Local Console request was rejected.");
             }
         }
+        options.onActivity?.();
         return session;
     }
-    app.get(`${LOCAL_CONSOLE_API_BASE}/health`, () => ({ status: "ready" }));
+    app.get(`${LOCAL_CONSOLE_API_BASE}/health`, () => ({
+        status: "ready",
+        protocol_version: 2,
+        ...(options.runtime === undefined
+            ? {}
+            : {
+                instance_id: options.runtime.instanceId,
+                version: options.runtime.version,
+                pid: options.runtime.pid,
+            }),
+    }));
+    app.get(`${LOCAL_CONSOLE_API_BASE}/control/status`, (request) => {
+        requireControl(request);
+        return {
+            status: "running",
+            protocol_version: 2,
+            ...(options.runtime === undefined
+                ? {}
+                : {
+                    instance_id: options.runtime.instanceId,
+                    version: options.runtime.version,
+                    entrypoint: options.runtime.entrypoint,
+                    started_at: options.runtime.startedAt,
+                    pid: options.runtime.pid,
+                }),
+        };
+    });
+    app.post(`${LOCAL_CONSOLE_API_BASE}/control/shutdown`, (request) => {
+        requireControl(request);
+        setImmediate(() => options.onShutdown?.());
+        return { status: "stopping" };
+    });
     app.post(`${LOCAL_CONSOLE_API_BASE}/access-tokens`, {
         schema: {
             body: {
                 type: "object",
                 required: ["current_directory"],
                 additionalProperties: false,
-                properties: { current_directory: { type: "string", minLength: 1, maxLength: 4096 } },
+                properties: {
+                    current_directory: { type: "string", minLength: 1, maxLength: 4096 },
+                    environment: {
+                        type: "object",
+                        additionalProperties: false,
+                        properties: Object.fromEntries(LOCAL_CONSOLE_INVOCATION_ENV_KEYS.map((key) => [
+                            key,
+                            { type: "string", minLength: 1, maxLength: 4096 },
+                        ])),
+                    },
+                },
             },
         },
     }, (request) => {
         requireControl(request);
         const access = sessions.issueAccessToken({
             currentDirectory: resolve(request.body.current_directory),
+            environment: request.body.environment ?? {},
         });
         return { access_token: access.token, expires_at: access.expires_at };
     });
@@ -145,51 +193,41 @@ export function createLocalConsoleServer(options) {
         },
     }, (request, reply) => {
         requireSameOrigin(request);
-        const session = sessions.exchangeAccessToken(request.body.access_token);
+        const cookie = parseCookieHeader(headerValue(request.headers.cookie));
+        const session = sessions.exchangeAccessToken(request.body.access_token, cookie[LOCAL_CONSOLE_SESSION_COOKIE]);
         if (session === null) {
             throw new LocalConsoleHttpError(401, "access_token_invalid", "This Local Console access link has expired. Run `tutti` again.");
         }
-        void reply.header("set-cookie", localConsoleSessionCookie(session.sessionToken, session.expires_at));
-        return { csrf_token: session.csrfToken, expires_at: session.expires_at };
+        if (session.sessionToken !== undefined) {
+            void reply.header("set-cookie", localConsoleSessionCookie(session.sessionToken, session.expires_at));
+        }
+        options.onActivity?.();
+        return {
+            csrf_token: session.csrfToken,
+            context_token: session.contextToken,
+            expires_at: session.expires_at,
+        };
     });
     app.get(`${LOCAL_CONSOLE_API_BASE}/bootstrap`, (request) => {
         const session = requireSession(request);
-        const picker = detectLocalFolderPicker(process.platform, options.env ?? process.env);
         return {
             csrf_token: session.csrfToken,
-            current_directory: session.currentDirectory,
+            current_directory: session.context.currentDirectory,
             platform: process.platform,
-            folder_picker: picker.kind,
+            folder_picker: detectLocalFolderPicker(process.platform, session.context.environment).kind,
         };
     });
     app.get(`${LOCAL_CONSOLE_API_BASE}/projects`, async (request) => {
+        const session = requireSession(request);
+        return { projects: await projects.listProjects(session.context) };
+    });
+    app.get(`${LOCAL_CONSOLE_API_BASE}/heartbeat`, (request) => {
         requireSession(request);
-        return { projects: await projects.listProjects() };
+        return { status: "ok" };
     });
     app.post(`${LOCAL_CONSOLE_API_BASE}/folders/pick`, async (request) => {
-        requireSession(request, true);
-        return await pickLocalFolder({ env: options.env ?? process.env });
-    });
-    app.post(`${LOCAL_CONSOLE_API_BASE}/folders/create`, {
-        schema: {
-            body: {
-                type: "object",
-                required: ["parent_path", "name"],
-                additionalProperties: false,
-                properties: {
-                    parent_path: { type: "string", minLength: 1 },
-                    name: { type: "string", minLength: 1, maxLength: 160 },
-                },
-            },
-        },
-    }, (request) => {
-        requireSession(request, true);
-        try {
-            return { path: createLocalProjectFolder(request.body.parent_path, request.body.name) };
-        }
-        catch (error) {
-            throw new LocalConsoleHttpError(422, "project_folder_create_failed", error instanceof Error ? error.message : "Project folder could not be created.");
-        }
+        const session = requireSession(request, true);
+        return await pickLocalFolder({ env: session.context.environment });
     });
     app.post(`${LOCAL_CONSOLE_API_BASE}/providers/models`, {
         schema: {
@@ -232,19 +270,19 @@ export function createLocalConsoleServer(options) {
             },
         },
     }, async (request) => {
-        requireSession(request, true);
+        const session = requireSession(request, true);
         return await projects.launchProject({
             workspacePath: request.body.workspace_path,
             ...(request.body.provider === undefined ? {} : { provider: request.body.provider }),
-        });
+        }, session.context);
     });
     app.post(`${LOCAL_CONSOLE_API_BASE}/projects/:projectId/invite`, async (request) => {
-        requireSession(request, true);
-        return await projects.refreshInvite(request.params.projectId);
+        const session = requireSession(request, true);
+        return await projects.refreshInvite(request.params.projectId, session.context);
     });
     app.post(`${LOCAL_CONSOLE_API_BASE}/projects/:projectId/stop`, async (request) => {
-        requireSession(request, true);
-        return await projects.stopProject(request.params.projectId);
+        const session = requireSession(request, true);
+        return await projects.stopProject(request.params.projectId, session.context);
     });
     const webStaticRoot = options.webStaticRoot === false
         ? undefined
@@ -261,24 +299,64 @@ function listeningPort(app) {
     }
     return address.port;
 }
+function entrypointIdentity(path) {
+    try {
+        const stats = statSync(path);
+        return `${stats.dev}:${stats.ino}:${stats.size}:${stats.mtimeMs}`;
+    }
+    catch {
+        return null;
+    }
+}
 export async function runLocalConsoleProcess(options = {}) {
     const cwd = resolve(options.cwd ?? process.cwd());
     const env = options.env ?? process.env;
     const tuttiHome = resolveTuttiHome(env.TUTTI_HOME, cwd);
+    const serviceEnvironment = createLocalConsoleServiceEnvironment({ env, tuttiHome });
     const controlToken = createLocalConsoleSecret();
+    const instanceId = createLocalConsoleSecret();
+    const now = options.now ?? (() => new Date());
+    const startedAt = now().toISOString();
+    const version = readCliVersion();
+    const entrypointArgument = process.argv[1];
+    if (entrypointArgument === undefined || entrypointArgument.trim() === "") {
+        throw new Error("Cannot locate the Tutti CLI entrypoint.");
+    }
+    const entrypoint = resolve(entrypointArgument);
+    const initialEntrypointIdentity = entrypointIdentity(entrypoint);
+    if (initialEntrypointIdentity === null) {
+        throw new Error("The Tutti CLI entrypoint is unavailable.");
+    }
+    let lastActivityAt = now().getTime();
+    let requestClose = () => undefined;
     const app = createLocalConsoleServer({
         controlToken,
         cwd,
-        env,
+        tuttiHome,
+        env: serviceEnvironment,
+        runtime: {
+            instanceId,
+            version,
+            entrypoint,
+            startedAt,
+            pid: process.pid,
+        },
+        onActivity: () => {
+            lastActivityAt = now().getTime();
+        },
+        onShutdown: () => requestClose(),
         ...(options.now === undefined ? {} : { now: options.now }),
     });
     await app.listen({ host: "127.0.0.1", port: 0 });
     writeLocalConsoleRuntimeEndpoint({
         tuttiHome,
+        instanceId,
         pid: process.pid,
         baseUrl: `http://127.0.0.1:${listeningPort(app)}`,
         controlToken,
-        ...(options.now === undefined ? {} : { now: options.now }),
+        version,
+        entrypoint,
+        now,
     });
     let closing = false;
     const close = async () => {
@@ -290,12 +368,41 @@ export async function runLocalConsoleProcess(options = {}) {
             tuttiHome,
             expectedControlToken: controlToken,
         });
-        await app.close();
+        const forceClose = setTimeout(() => app.server.closeAllConnections(), 5_000);
+        forceClose.unref();
+        try {
+            await app.close();
+        }
+        finally {
+            clearTimeout(forceClose);
+        }
     };
+    requestClose = () => void close();
+    const idleTimeoutMs = options.idleTimeoutMs ?? 60 * 60 * 1_000;
+    const idleCheck = setInterval(() => {
+        let installedVersion = null;
+        try {
+            installedVersion = readCliVersion();
+        }
+        catch {
+            // Package removal is handled as a runtime identity change.
+        }
+        if (!existsSync(entrypoint) ||
+            entrypointIdentity(entrypoint) !== initialEntrypointIdentity ||
+            installedVersion !== version) {
+            void close();
+            return;
+        }
+        if (now().getTime() - lastActivityAt >= idleTimeoutMs) {
+            void close();
+        }
+    }, Math.min(60_000, Math.max(1_000, Math.floor(idleTimeoutMs / 4))));
+    idleCheck.unref();
     process.once("SIGINT", () => void close());
     process.once("SIGTERM", () => void close());
     await new Promise((resolveClosed) => {
         app.server.once("close", resolveClosed);
     });
+    clearInterval(idleCheck);
 }
 //# sourceMappingURL=server.js.map

package/dist/server-shell/local-console/session.d.ts

@@ -1,33 +1,28 @@
+import type { LocalConsoleInvocationContext } from "./invocation-context.js";
 export declare const LOCAL_CONSOLE_SESSION_COOKIE = "tutti_local_console_session";
-type ExpiringValue = {
-    hash: string;
-    expiresAt: number;
-};
-type LocalConsoleSession = ExpiringValue & {
-    csrfToken: string;
-    currentDirectory: string;
-};
 export type IssuedLocalConsoleAccessToken = {
     token: string;
     expires_at: string;
 };
 export type ExchangedLocalConsoleSession = {
-    sessionToken: string;
+    sessionToken?: string;
+    contextToken: string;
     csrfToken: string;
     expires_at: string;
 };
+export type ReadLocalConsoleSession = {
+    csrfToken: string;
+    context: LocalConsoleInvocationContext;
+};
 export declare class LocalConsoleSessionRegistry {
     #private;
     constructor(options?: {
         now?: () => Date;
     });
-    issueAccessToken(options: {
-        currentDirectory: string;
-    }): IssuedLocalConsoleAccessToken;
-    exchangeAccessToken(token: string): ExchangedLocalConsoleSession | null;
-    readSession(token: string | undefined): LocalConsoleSession | null;
+    issueAccessToken(context: LocalConsoleInvocationContext): IssuedLocalConsoleAccessToken;
+    exchangeAccessToken(token: string, existingSessionToken?: string): ExchangedLocalConsoleSession | null;
+    readSession(token: string | undefined, contextToken?: string): ReadLocalConsoleSession | null;
 }
 export declare function parseCookieHeader(header: string | undefined): Record<string, string>;
 export declare function localConsoleSessionCookie(token: string, expiresAt: string): string;
-export {};
 //# sourceMappingURL=session.d.ts.map

package/dist/server-shell/local-console/session.js

@@ -16,22 +16,24 @@ function secretEquals(value, expectedHash) {
 export class LocalConsoleSessionRegistry {
     #accessTokens = new Map();
     #sessions = new Map();
+    #contexts = new Map();
     #now;
+    #browserSessionToken;
     constructor(options = {}) {
         this.#now = options.now ?? (() => new Date());
     }
-    issueAccessToken(options) {
+    issueAccessToken(context) {
         this.#purgeExpired();
         const token = createSecret();
         const expiresAt = this.#now().getTime() + ACCESS_TOKEN_TTL_MS;
         this.#accessTokens.set(hashSecret(token), {
             hash: hashSecret(token),
             expiresAt,
-            currentDirectory: options.currentDirectory,
+            context,
         });
         return { token, expires_at: new Date(expiresAt).toISOString() };
     }
-    exchangeAccessToken(token) {
+    exchangeAccessToken(token, existingSessionToken) {
         this.#purgeExpired();
         const accessTokenHash = hashSecret(token);
         const accessToken = this.#accessTokens.get(accessTokenHash);
@@ -41,25 +43,58 @@ export class LocalConsoleSessionRegistry {
             return null;
         }
         this.#accessTokens.delete(accessTokenHash);
-        const sessionToken = createSecret();
-        const expiresAt = this.#now().getTime() + SESSION_TTL_MS;
-        this.#sessions.set(hashSecret(sessionToken), {
-            hash: hashSecret(sessionToken),
-            csrfToken: createSecret(),
-            expiresAt,
-            currentDirectory: accessToken.currentDirectory,
-        });
-        const session = this.#sessions.get(hashSecret(sessionToken));
+        let sessionToken;
+        let sessionHash = "";
+        let session;
+        if (existingSessionToken !== undefined) {
+            sessionHash = hashSecret(existingSessionToken);
+            const existingSession = this.#sessions.get(sessionHash);
+            if (existingSession !== undefined &&
+                existingSession.expiresAt > this.#now().getTime() &&
+                secretEquals(existingSessionToken, existingSession.hash)) {
+                session = existingSession;
+            }
+        }
+        if (session === undefined && this.#browserSessionToken !== undefined) {
+            const sharedSessionHash = hashSecret(this.#browserSessionToken);
+            const sharedSession = this.#sessions.get(sharedSessionHash);
+            if (sharedSession !== undefined &&
+                sharedSession.expiresAt > this.#now().getTime() &&
+                secretEquals(this.#browserSessionToken, sharedSession.hash)) {
+                sessionToken = this.#browserSessionToken;
+                sessionHash = sharedSessionHash;
+                session = sharedSession;
+            }
+        }
         if (session === undefined) {
-            return null;
+            sessionToken = createSecret();
+            this.#browserSessionToken = sessionToken;
+            sessionHash = hashSecret(sessionToken);
+            session = {
+                hash: sessionHash,
+                csrfToken: createSecret(),
+                expiresAt: this.#now().getTime() + SESSION_TTL_MS,
+                defaultContextHash: "",
+            };
+            this.#sessions.set(sessionHash, session);
         }
+        const contextToken = createSecret();
+        const contextHash = hashSecret(contextToken);
+        session.defaultContextHash = contextHash;
+        this.#contexts.set(contextHash, {
+            hash: contextHash,
+            expiresAt: session.expiresAt,
+            sessionHash,
+            context: accessToken.context,
+        });
         return {
-            sessionToken,
+            ...(sessionToken === undefined ? {} : { sessionToken }),
+            contextToken,
             csrfToken: session.csrfToken,
-            expires_at: new Date(expiresAt).toISOString(),
+            expires_at: new Date(session.expiresAt).toISOString(),
         };
     }
-    readSession(token) {
+    readSession(token, contextToken) {
         this.#purgeExpired();
         if (token === undefined || token.trim() === "") {
             return null;
@@ -70,7 +105,15 @@ export class LocalConsoleSessionRegistry {
             !secretEquals(token, session.hash)) {
             return null;
         }
-        return session;
+        const contextHash = contextToken === undefined ? session.defaultContextHash : hashSecret(contextToken);
+        const context = this.#contexts.get(contextHash);
+        if (context === undefined ||
+            context.sessionHash !== hashSecret(token) ||
+            context.expiresAt <= this.#now().getTime() ||
+            (contextToken !== undefined && !secretEquals(contextToken, context.hash))) {
+            return null;
+        }
+        return { csrfToken: session.csrfToken, context: context.context };
     }
     #purgeExpired() {
         const now = this.#now().getTime();
@@ -84,6 +127,15 @@ export class LocalConsoleSessionRegistry {
                 this.#sessions.delete(key);
             }
         }
+        if (this.#browserSessionToken !== undefined &&
+            !this.#sessions.has(hashSecret(this.#browserSessionToken))) {
+            this.#browserSessionToken = undefined;
+        }
+        for (const [key, value] of this.#contexts) {
+            if (value.expiresAt <= now || !this.#sessions.has(value.sessionHash)) {
+                this.#contexts.delete(key);
+            }
+        }
     }
 }
 export function parseCookieHeader(header) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",