@xingjisoft/neutrino 0.4.0 → 0.5.0

package/dist/web/server.js

@@ -15,16 +15,21 @@ import fs from "node:fs";
 import http from "node:http";
 import os from "node:os";
 import path from "node:path";
+import { timingSafeEqual } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { deleteSession, listSessions, loadConfig, normalizeApprovalMode, resolveModelSelection, saveConfig, sessionDir, } from "../config.js";
 import { getWebSettings, updateWebSettings } from "./settings.js";
+import { isSeenIdentity, loadSeen, updateSeen, SEEN_LIMIT } from "./clientState.js";
 import { WebAuth } from "./auth.js";
 import { normalizeCwd, sameCwd } from "../cwd.js";
 import { hub } from "./hub.js";
 import { writeCrashLog } from "../terminal/restore.js";
-import { createWebSession, proInitialSelection, resumeSession } from "./session.js";
-import { defaultProPreset, requireProPreset } from "../pro/config.js";
-import { listAgentSessions, loadAgentMessages } from "../agents.js";
+import { createWebSession, proInitialSelection, resumeSession, WebSession } from "./session.js";
+import { defaultProPreset, ensureProModels, requireProPreset } from "../pro/config.js";
+import { listAgentSessions, loadAgentMessages, loadAgentSession, safeAgentSessionId } from "../agents.js";
+import { migrateAgentSession, SessionMigrationError } from "../migration.js";
+import { runningBackground } from "../background.js";
+import { MANUAL_UPDATE_COMMAND, installUpdate, updateStatus } from "../update.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // dist/web -> package root (mirrors the same trick used in config.ts).
 const PKG_ROOT = path.resolve(__dirname, "..", "..");
@@ -119,10 +124,26 @@ export function webUrls(host, port) {
  * is listening right now, so a run started with --lan shows as on even though
  * nothing was saved yet.
  */
+function validTerminalBridge(bridge, ownerPid) {
+    if (!bridge || typeof bridge !== "object" || Array.isArray(bridge) || typeof ownerPid !== "number")
+        return false;
+    const info = bridge;
+    if (typeof info.url !== "string" || typeof info.token !== "string" || !/^[a-f0-9]{64}$/.test(info.token))
+        return false;
+    try {
+        const url = new URL(info.url);
+        return url.protocol === "http:" && url.hostname === "127.0.0.1" && Boolean(url.port)
+            && url.pathname === "/" && !url.username && !url.password && !url.search && !url.hash;
+    }
+    catch {
+        return false;
+    }
+}
 function settingsPayload(mode, binding) {
     const payload = getWebSettings(mode);
     const lan = isWildcardHost(binding.host);
     const { urls } = webUrls(binding.host, binding.port);
+    const background = binding.service?.status?.() ?? runningBackground();
     return {
         ...payload,
         settings: {
@@ -131,6 +152,12 @@ function settingsPayload(mode, binding) {
             web_host: binding.host,
             // Addresses another device can open; empty unless every interface is bound.
             web_urls: lan ? urls.filter((url) => !url.includes("//127.0.0.1:")) : [],
+            // The background service is a process, not a workspace: both pages report
+            // the same state. The prompt is never shown once the setting is on.
+            background: background?.pid === process.pid ? background.resident : payload.settings.background,
+            background_running: background?.resident === true,
+            background_url: background?.url ?? "",
+            background_prompt: binding.prompt.pending && payload.settings.background !== true,
         },
     };
 }
@@ -194,7 +221,6 @@ function sendApiError(res, error) {
 }
 const MAX_RECENT_WORKSPACES = 12;
 const AGENT_IDS = new Set(["claude", "codex", "opencode"]);
-const AGENT_SESSION_ID_RE = /^[A-Za-z0-9._-]{1,200}$/;
 /** Expand `~` and require an absolute path; used by every folder route. */
 function absolutePath(raw) {
     if (typeof raw !== "string" || !raw.trim()) {
@@ -354,9 +380,6 @@ function createFolder(raw) {
 function isAgentId(value) {
     return AGENT_IDS.has(value);
 }
-function safeAgentSessionId(id) {
-    return AGENT_SESSION_ID_RE.test(id) && !id.includes("..") && id !== "." && id !== "..";
-}
 /** Build the sidebar payload: the selected workspace's sessions grouped by directory. */
 function buildOverview(mode = "standard") {
     const sessions = listSessions(mode);
@@ -384,10 +407,15 @@ function buildOverview(mode = "standard") {
         seen.add(session.id);
     }
     // Live conversations that have not been saved yet (or whose newest save has
-    // not landed) still deserve a spot at the top of their directory group.
+    // not landed) still deserve a spot at the top of their directory group. A
+    // conversation nobody has said anything in yet is not history: it stays out
+    // of the list (but in `live`, so the browser keeps its stream) until it has
+    // content.
     for (const live of lives) {
         if (live.sessionId && seen.has(live.sessionId))
             continue;
+        if (live.empty)
+            continue;
         const key = normalizeCwd(live.cwd) || "(unknown)";
         let group = groups.get(key);
         if (!group) {
@@ -484,6 +512,16 @@ function isSameOrigin(req) {
         return false;
     }
 }
+/** Constant-time comparison of the service's management token. */
+function hasServiceToken(req, token) {
+    const header = String(req.headers.authorization ?? "");
+    const prefix = "Bearer ";
+    if (!header.startsWith(prefix))
+        return false;
+    const supplied = Buffer.from(header.slice(prefix.length));
+    const expected = Buffer.from(token);
+    return supplied.length === expected.length && timingSafeEqual(supplied, expected);
+}
 function serveStatic(res, pathname) {
     let rel = pathname === "/" ? "/index.html" : pathname;
     try {
@@ -569,6 +607,10 @@ function streamLive(key, req, res) {
 async function handleApi(req, res, url, auth, mode, pathname, binding) {
     if (!pathname.startsWith("/api/"))
         return false;
+    // The Pro presets are not bundled either: the first Pro request makes sure they
+    // are on disk. When the download fails the route below reports the missing file.
+    if (mode === "pro")
+        await ensureProModels().catch(() => undefined);
     if (req.method === "OPTIONS") {
         // Same-origin only: no CORS headers, so cross-site preflights are rejected.
         // Answered before the login check because it reveals nothing.
@@ -576,6 +618,59 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         res.end();
         return true;
     }
+    // Management endpoints of the detached service. They are called by the CLI
+    // and the tray icon, which have the token from ~/.neutrino/background.json
+    // but not necessarily a browser login cookie.
+    if (["/api/background/ping", "/api/background/stop", "/api/background/configure"].includes(pathname)) {
+        if (req.method !== "GET" && req.method !== "POST") {
+            sendJson(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        if (!binding.service) {
+            sendJson(res, 404, { error: "this console is not running in the background" });
+            return true;
+        }
+        if (!hasServiceToken(req, binding.service.token)) {
+            sendJson(res, 401, { error: "background service token required" });
+            return true;
+        }
+        if (pathname.endsWith("/ping")) {
+            sendJson(res, 200, { ok: true, pid: process.pid, url: webUrls(binding.host, binding.port).url });
+            return true;
+        }
+        if (pathname.endsWith("/configure")) {
+            if (req.method !== "POST") {
+                sendJson(res, 405, { error: "method not allowed" });
+                return true;
+            }
+            if (!binding.service.configure) {
+                sendJson(res, 409, { error: "Restart the console to update background residency." });
+                return true;
+            }
+            try {
+                const body = await readJsonBody(req, 4096);
+                if (!body || typeof body !== "object" || Array.isArray(body)
+                    || Object.keys(body).some(key => key !== "resident" && key !== "ownerPid" && key !== "bridge")
+                    || (body.resident !== undefined && typeof body.resident !== "boolean")
+                    || (body.ownerPid !== undefined && (!Number.isSafeInteger(body.ownerPid) || body.ownerPid <= 0))
+                    || (body.bridge !== undefined && !validTerminalBridge(body.bridge, body.ownerPid))) {
+                    throw new Error("invalid background settings");
+                }
+                const updated = binding.service.configure(body);
+                if (updated.resident)
+                    binding.prompt.pending = false;
+                sendJson(res, 200, updated);
+            }
+            catch (error) {
+                sendJson(res, 400, { error: error instanceof Error ? error.message : "invalid background settings" });
+            }
+            return true;
+        }
+        sendJson(res, 200, { ok: true, stopping: true });
+        // Let the response reach the caller before the socket closes.
+        setImmediate(() => binding.service?.onStop());
+        return true;
+    }
     if (pathname === "/api/auth/login" || pathname === "/api/auth/logout") {
         if (req.method !== "POST") {
             sendJson(res, 405, { error: "method not allowed" });
@@ -610,6 +705,21 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         sendJson(res, 401, { error: "Password login required." });
         return true;
     }
+    // The first browser to see the background-residency prompt consumes it for
+    // this console run, whether it accepted or dismissed it.
+    if (pathname === "/api/background/dismiss") {
+        if (req.method !== "POST") {
+            sendJson(res, 405, { error: "method not allowed" });
+        }
+        else if (!isSameOrigin(req)) {
+            sendJson(res, 403, { error: "cross-origin request rejected" });
+        }
+        else {
+            binding.prompt.pending = false;
+            sendJson(res, 200, { ok: true });
+        }
+        return true;
+    }
     if (pathname === "/api/settings") {
         if (req.method === "GET") {
             sendJson(res, 200, settingsPayload(mode, binding));
@@ -619,39 +729,15 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
                 sendJson(res, 403, { error: "cross-origin request rejected" });
                 return true;
             }
-            const wasLan = loadConfig(mode).web_lan === true;
             try {
                 const body = await readJsonBody(req);
-                updateWebSettings(body, mode);
-                // `web_lan` is both a saved preference and a live switch: apply it to
-                // the socket now so the console starts or stops answering on the LAN
-                // without a restart. Other settings never move the listener, and an
-                // explicit --host still decides the interface until this is changed.
-                const patch = body?.settings;
-                const desired = patch && Object.prototype.hasOwnProperty.call(patch, "web_lan")
-                    ? patch.web_lan === true
-                    : isWildcardHost(binding.host);
-                if (desired !== isWildcardHost(binding.host)) {
-                    await binding.setHost(desired ? WILDCARD_HOST : LOOPBACK_HOST);
-                }
+                await binding.updateSettings(body, mode);
                 if (body.settings?.web_password !== undefined) {
                     auth.remember(res);
                 }
                 sendJson(res, 200, settingsPayload(mode, binding));
             }
             catch (err) {
-                // A switch that could not bind must not pretend the socket moved:
-                // restore the saved preference so the file matches what is running.
-                if ((loadConfig(mode).web_lan === true) !== wasLan) {
-                    try {
-                        const config = loadConfig(mode);
-                        config.web_lan = wasLan;
-                        saveConfig(config, mode);
-                    }
-                    catch {
-                        // Reporting the original failure matters more than the rollback.
-                    }
-                }
                 sendJson(res, err?.code ? 500 : 400, {
                     error: err instanceof Error ? err.message : "invalid settings",
                 });
@@ -662,6 +748,33 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         }
         return true;
     }
+    // The update prompt's confirm button: npm runs on this machine, so the route
+    // sits behind the login cookie and the same-origin check like every other
+    // mutation, and only a release the registry announced can be installed.
+    if (pathname === "/api/update") {
+        if (req.method !== "POST") {
+            sendJson(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        if (!isSameOrigin(req)) {
+            sendJson(res, 403, { error: "cross-origin request rejected" });
+            return true;
+        }
+        if (!updateStatus().hasUpdate) {
+            sendJson(res, 409, { error: "No newer version is published." });
+            return true;
+        }
+        // Never rejects: a failure comes back as a result, carrying the command the
+        // browser shows so the user can finish the update by hand.
+        const result = await installUpdate();
+        sendJson(res, result.ok ? 200 : 500, {
+            ok: result.ok,
+            version: result.version,
+            error: result.error ?? "",
+            command: MANUAL_UPDATE_COMMAND,
+        });
+        return true;
+    }
     if (req.method === "GET" && pathname === "/api/health") {
         sendJson(res, 200, { ok: true, live: hub.list(mode).length });
         return true;
@@ -670,6 +783,53 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         sendJson(res, 200, buildOverview(mode));
         return true;
     }
+    // The sidebar's blue dot is the browser's own memory of what it has read. It
+    // belongs to the console rather than to a conversation, so it is stored in
+    // ~/.neutrino/web.json (see clientState.ts) and never in the config or the
+    // transcript. Each workspace keeps its own record.
+    if (pathname === "/api/seen") {
+        if (req.method === "GET") {
+            sendJson(res, 200, { seen: loadSeen(mode) });
+            return true;
+        }
+        if (req.method === "POST") {
+            if (!isSameOrigin(req)) {
+                sendJson(res, 403, { error: "cross-origin request rejected" });
+                return true;
+            }
+            try {
+                const body = await readJsonBody(req, 64 * 1024);
+                if (!body || typeof body !== "object" || Array.isArray(body)) {
+                    throw new ApiError(400, "invalid request", "invalid request");
+                }
+                const input = body;
+                if (Object.keys(body).some((key) => key !== "identities" && key !== "seen")) {
+                    throw new ApiError(400, "unknown field", "unknown field");
+                }
+                const identities = input.identities;
+                if (!Array.isArray(identities) || identities.length === 0 || identities.length > SEEN_LIMIT) {
+                    throw new ApiError(400, `identities must be a list of 1 to ${SEEN_LIMIT}`, "invalid identities");
+                }
+                if (!identities.every(isSeenIdentity)) {
+                    throw new ApiError(400, "invalid conversation id", "invalid conversation id");
+                }
+                if (typeof input.seen !== "boolean") {
+                    throw new ApiError(400, "seen must be a boolean", "seen must be a boolean");
+                }
+                sendJson(res, 200, { ok: true, seen: updateSeen(mode, identities, input.seen) });
+            }
+            catch (err) {
+                // A rejected body is the caller's fault; a file that cannot be written
+                // is ours, and must not read as a malformed request.
+                sendJson(res, err instanceof ApiError ? err.status : 500, {
+                    error: err instanceof Error ? err.message : "invalid request",
+                });
+            }
+            return true;
+        }
+        sendJson(res, 405, { error: "method not allowed" });
+        return true;
+    }
     if (req.method === "GET" && pathname === "/api/sessions") {
         sendJson(res, 200, { sessions: listSessions(mode) });
         return true;
@@ -797,7 +957,7 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         sendJson(res, 200, { ok: true, deleted: true });
         return true;
     }
-    // Read-only history recorded by other agents (Claude Code, Codex, OpenCode).
+    // History recorded by other agents (Claude Code, Codex, OpenCode).
     const agentSessionsMatch = /^\/api\/agents\/([^/]+)\/sessions$/.exec(pathname);
     if (req.method === "GET" && agentSessionsMatch) {
         const agent = decodeURIComponent(agentSessionsMatch[1]);
@@ -821,7 +981,59 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
             sendJson(res, 400, { error: "invalid session id" });
             return true;
         }
-        sendJson(res, 200, { agent, id, messages: loadAgentMessages(agent, id) });
+        const cwd = url.searchParams.get("cwd");
+        if (cwd) {
+            const source = loadAgentSession(agent, id, cwd);
+            if (!source) {
+                sendJson(res, 404, { error: "session not found in this working directory" });
+                return true;
+            }
+            sendJson(res, 200, { ...source, agent });
+        }
+        else {
+            sendJson(res, 200, { agent, id, messages: loadAgentMessages(agent, id) });
+        }
+        return true;
+    }
+    const migrateMatch = /^\/api\/agents\/([^/]+)\/sessions\/([^/]+)\/migrate$/.exec(pathname);
+    if (migrateMatch) {
+        if (req.method !== "POST") {
+            sendJson(res, 405, { error: "method not allowed" });
+            return true;
+        }
+        if (!isSameOrigin(req)) {
+            sendJson(res, 403, { error: "cross-origin request rejected" });
+            return true;
+        }
+        const agent = decodeURIComponent(migrateMatch[1]);
+        const id = decodeURIComponent(migrateMatch[2]);
+        if (!isAgentId(agent) || !safeAgentSessionId(id)) {
+            sendJson(res, 400, { error: !isAgentId(agent) ? "unknown agent" : "invalid session id" });
+            return true;
+        }
+        try {
+            const body = await readJsonBody(req);
+            if (!body || typeof body !== "object" || Array.isArray(body))
+                throw new Error("invalid JSON body");
+            const input = body;
+            const cwd = existingDirectory(input.cwd ?? process.cwd());
+            const preset = mode === "pro" ? requireProPreset(input.pro_preset ?? defaultProPreset()) : undefined;
+            const selection = mode === "pro" ? proInitialSelection(preset)
+                : resolveModelSelection(input.selection ?? getWebSettings(mode).selection, false);
+            const migrated = migrateAgentSession(agent, id, cwd, {
+                provider: selection.provider, model: selection.model.name, intensity: selection.intensity,
+            }, mode, preset);
+            const session = new WebSession(migrated, selection.model, mode);
+            const key = session.start();
+            webSessions.set(key, session);
+            sendJson(res, 201, { ok: true, id: migrated.id, key, cwd, snapshot: hub.snapshot(key) });
+        }
+        catch (err) {
+            if (err instanceof SessionMigrationError)
+                sendJson(res, err.status, { error: err.message });
+            else
+                sendApiError(res, err);
+        }
         return true;
     }
     const sessionMatch = /^\/api\/session\/([^/]+)$/.exec(pathname);
@@ -870,14 +1082,29 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
         // Already running (TUI or another tab)? Attach instead of duplicating.
         const existing = hub.list(mode).find((entry) => entry.sessionId === id);
         if (existing) {
-            if (preset !== undefined) {
+            const remote = hub.remoteAction(existing.key);
+            if (remote && preset !== undefined) {
+                const result = await remote("pro-preset", { preset });
+                if (result.status !== 200) {
+                    sendJson(res, result.status, result.data);
+                    return true;
+                }
+            }
+            else if (remote && selection) {
+                const result = await remote("model", { provider: selection.provider, model: selection.model.name, intensity: selection.intensity });
+                if (result.status !== 200) {
+                    sendJson(res, result.status, result.data);
+                    return true;
+                }
+            }
+            if (!remote && preset !== undefined) {
                 const changed = hub.setProPreset(existing.key, preset);
                 if (!changed.ok) {
                     sendJson(res, 409, { error: changed.error });
                     return true;
                 }
             }
-            if (selection) {
+            if (!remote && selection) {
                 const changed = hub.configure(existing.key, selection);
                 if (!changed.ok) {
                     sendJson(res, 409, { error: changed.error });
@@ -941,6 +1168,23 @@ async function handleApi(req, res, url, auth, mode, pathname, binding) {
                 sendJson(res, 404, { error: "unknown live session" });
                 return true;
             }
+            const remote = hub.remoteAction(key);
+            if (remote) {
+                if (action === "close") {
+                    sendJson(res, 400, { error: "this session is owned by the terminal UI" });
+                    return true;
+                }
+                try {
+                    const body = ["approve", "approval-mode", "message", "model", "pro-preset"].includes(action)
+                        ? await readJsonBody(req) : {};
+                    const result = await remote(action, body);
+                    sendJson(res, result.status, result.data);
+                }
+                catch (error) {
+                    sendJson(res, 400, { error: error instanceof Error ? error.message : "invalid request" });
+                }
+                return true;
+            }
             if (action === "pro-preset") {
                 if (mode !== "pro") {
                     sendJson(res, 404, { error: "Pro presets are only available in Pro mode" });
@@ -1123,6 +1367,9 @@ export async function startWebServer(options) {
         host,
         port,
         setHost: (next) => rebind(next),
+        prompt: { pending: options.backgroundPrompt === true },
+        service: options.backgroundService,
+        updateSettings: (body, mode) => updateSettings(body, mode),
     };
     const server = http.createServer((req, res) => {
         handleRequest(req, res, auth, binding).catch((err) => {
@@ -1170,6 +1417,7 @@ export async function startWebServer(options) {
         handle.port = port;
         handle.url = address.url;
         handle.urls = address.urls;
+        options.onAddressChange?.();
     };
     // Two tabs saving at once must not interleave close/listen on one socket.
     let switches = Promise.resolve();
@@ -1211,6 +1459,51 @@ export async function startWebServer(options) {
         switches = task.catch(() => undefined);
         return task;
     }
+    // Serialize saves from both workspaces so a failed switch cannot roll back
+    // another tab's successful change.
+    let settingsChanges = Promise.resolve();
+    function updateSettings(body, mode) {
+        const task = settingsChanges.then(async () => {
+            const previous = loadConfig(mode);
+            const wasHost = binding.host;
+            try {
+                updateWebSettings(body, mode);
+                const patch = body?.settings;
+                const desiredHost = patch && Object.prototype.hasOwnProperty.call(patch, "web_lan")
+                    ? patch.web_lan === true ? WILDCARD_HOST : LOOPBACK_HOST
+                    : binding.host;
+                if (desiredHost !== binding.host)
+                    await binding.setHost(desiredHost);
+                if (patch && Object.prototype.hasOwnProperty.call(patch, "background")) {
+                    if (!binding.service?.configure) {
+                        throw new Error("Background residency could not be applied. Restart the console and try again.");
+                    }
+                    binding.service.configure({ resident: patch.background === true });
+                    if (patch.background === true)
+                        binding.prompt.pending = false;
+                }
+            }
+            catch (error) {
+                // A failed lifetime or address change must not look saved or active.
+                if (binding.host !== wasHost) {
+                    try {
+                        await binding.setHost(wasHost);
+                    }
+                    catch { /* Report the original failure. */ }
+                }
+                const config = loadConfig(mode);
+                config.web_lan = previous.web_lan;
+                config.background = previous.background;
+                try {
+                    saveConfig(config, mode);
+                }
+                catch { /* Report the original failure. */ }
+                throw error;
+            }
+        });
+        settingsChanges = task.catch(() => undefined);
+        return task;
+    }
     const handle = {
         host,
         port,