@zhanguym/chatroom 1.1.0-beta.1 → 1.2.0-beta.0

package/dist/core/runtime/child-environment.js

@@ -1,3 +1,4 @@
+// Restrict environment inheritance for MCP-controlled and other supervised processes.
 const CHILD_ENV_KEYS = new Set([
     "PATH",
     "HOME",
@@ -25,12 +26,12 @@ const CHILD_ENV_KEYS = new Set([
     "USERPROFILE",
     "LOCALAPPDATA",
     "APPDATA",
-]);
+].map((key) => key.toUpperCase()));
 export function childEnvironment(overrides) {
     const env = {};
     for (const [key, value] of Object.entries(process.env)) {
         if (value !== undefined &&
-            (CHILD_ENV_KEYS.has(key) || key.startsWith("LC_")))
+            (CHILD_ENV_KEYS.has(key.toUpperCase()) || key.startsWith("LC_")))
             env[key] = value;
     }
     for (const [key, value] of Object.entries(overrides ?? {}))

package/dist/infrastructure/http/http-server.js

@@ -53,7 +53,7 @@ export class HttpServer {
         app.use(express.urlencoded({ extended: false, limit: "64kb" }));
         app.use(createOAuthRouter(this.auth, this.ingress, this.logs));
         app.use("/api", webMutationOrigin(this.ingress));
-        app.use("/api", createApiRouter(this.application, this.eventBus, this.auth, this.passkeys, this.ingress, this.cloud, this.logs, () => ({
+        app.use("/api", createApiRouter(this.application, this.eventBus, this.auth, this.passkeys, this.ingress, this.cloud, this.logs, this.config, () => ({
             version: CHATROOM_VERSION,
             mcpRequests: this.mcpRequestCount,
             uptimeMinutes: Math.floor((Date.now() - this.startedAt) / 60000),
@@ -74,6 +74,12 @@ export class HttpServer {
         const webIndexPath = path.join(webRoot, "index.html");
         if (existsSync(webIndexPath)) {
             const webIndex = readFileSync(webIndexPath, "utf8");
+            app.get("/transport-sw.js", (_req, res) => {
+                res.setHeader("Cache-Control", "no-store");
+                res.type("application/javascript").sendFile("transport-sw.js", {
+                    root: webRoot,
+                });
+            });
             app.use("/assets", express.static(path.join(webRoot, "assets"), {
                 index: false,
                 maxAge: "1y",

package/dist/plugins/cloud/tunnel-client.d.ts

@@ -1,84 +1,2 @@
-import { z } from "zod";
-import { type CloudLeaseState } from "./types.js";
-interface TunnelTimings {
-    readyTimeoutMs: number;
-    heartbeatIntervalMs: number;
-}
-declare const controlMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    type: z.ZodLiteral<"challenge">;
-    nonce: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"ready">;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"open">;
-    streamId: z.ZodNumber;
-    service: z.ZodEnum<{
-        mcp: "mcp";
-        web: "web";
-    }>;
-    method: z.ZodString;
-    path: z.ZodString;
-    headers: z.ZodRecord<z.ZodString, z.ZodString>;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"end">;
-    streamId: z.ZodNumber;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"abort">;
-    streamId: z.ZodNumber;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"pause">;
-    streamId: z.ZodNumber;
-}, z.core.$strict>, z.ZodObject<{
-    type: z.ZodLiteral<"resume">;
-    streamId: z.ZodNumber;
-}, z.core.$strict>], "type">;
-type ControlMessage = z.infer<typeof controlMessageSchema>;
-export declare function parseTunnelControlMessage(input: string): ControlMessage;
-export declare class CloudTunnelClient {
-    private lease;
-    private readonly identity;
-    private readonly local;
-    private readonly callbacks;
-    private socket;
-    private reconnectTimer;
-    private readyTimer;
-    private heartbeatTimer;
-    private awaitingPong;
-    private stopped;
-    private attempts;
-    private closeWhenIdle;
-    private acceptingServices;
-    private readonly streams;
-    private readonly timings;
-    constructor(lease: CloudLeaseState, identity: {
-        devicePrivateKey: string;
-    }, local: {
-        host: string;
-        port: number;
-    }, callbacks: {
-        onConnected(): void;
-        onDisconnected(): void;
-        onLeaseRejected(): void;
-        onError(error: Error): void;
-    }, timings?: Partial<TunnelTimings>);
-    start(): void;
-    stop(): void;
-    drainAndStop(): void;
-    updateLease(lease: CloudLeaseState): void;
-    private connect;
-    private handleControl;
-    private openStream;
-    private finishStream;
-    private pauseForBackpressure;
-    private destroyAllStreams;
-    private handleBinary;
-    private send;
-    private sendBinary;
-    private startReadyTimeout;
-    private clearReadyTimeout;
-    private startHeartbeat;
-    private clearSocketTimers;
-    private failSocket;
-    private scheduleReconnect;
-}
-export {};
+/** The device speaks V2; only Cloud Server carries the removable V1 adapter. */
+export { V2TunnelClient as CloudTunnelClient } from "./v2/tunnel-client.js";

package/dist/plugins/cloud/tunnel-client.js

@@ -1,426 +1,2 @@
-import { createPrivateKey, sign } from "node:crypto";
-import http from "node:http";
-import WebSocket from "ws";
-import { z } from "zod";
-import { cloudServiceForPublicService, } from "./types.js";
-const PROTOCOL = "chatroom-tunnel-v1";
-const HIGH_WATER = 8 * 1024 * 1024;
-const LOW_WATER = 2 * 1024 * 1024;
-const READY_TIMEOUT_MS = 10_000;
-const HEARTBEAT_INTERVAL_MS = 20_000;
-const streamIdSchema = z.number().int().min(0).max(0xffff_ffff);
-const controlMessageSchema = z.discriminatedUnion("type", [
-    z
-        .object({
-        type: z.literal("challenge"),
-        nonce: z.string().min(1),
-    })
-        .strict(),
-    z.object({ type: z.literal("ready") }).strict(),
-    z
-        .object({
-        type: z.literal("open"),
-        streamId: streamIdSchema,
-        service: z.enum(["mcp", "web"]),
-        method: z.string().min(1),
-        path: z.string().startsWith("/"),
-        headers: z.record(z.string(), z.string()),
-    })
-        .strict(),
-    z.object({ type: z.literal("end"), streamId: streamIdSchema }).strict(),
-    z.object({ type: z.literal("abort"), streamId: streamIdSchema }).strict(),
-    z.object({ type: z.literal("pause"), streamId: streamIdSchema }).strict(),
-    z.object({ type: z.literal("resume"), streamId: streamIdSchema }).strict(),
-]);
-export function parseTunnelControlMessage(input) {
-    return controlMessageSchema.parse(JSON.parse(input));
-}
-export class CloudTunnelClient {
-    lease;
-    identity;
-    local;
-    callbacks;
-    socket = null;
-    reconnectTimer = null;
-    readyTimer = null;
-    heartbeatTimer = null;
-    awaitingPong = false;
-    stopped = true;
-    attempts = 0;
-    closeWhenIdle = null;
-    acceptingServices;
-    streams = new Map();
-    timings;
-    constructor(lease, identity, local, callbacks, timings = {}) {
-        this.lease = lease;
-        this.identity = identity;
-        this.local = local;
-        this.callbacks = callbacks;
-        this.acceptingServices = new Set(lease.services);
-        this.timings = {
-            readyTimeoutMs: timings.readyTimeoutMs ?? READY_TIMEOUT_MS,
-            heartbeatIntervalMs: timings.heartbeatIntervalMs ?? HEARTBEAT_INTERVAL_MS,
-        };
-    }
-    start() {
-        if (!this.stopped)
-            return;
-        this.stopped = false;
-        this.closeWhenIdle = null;
-        this.acceptingServices = new Set(this.lease.services);
-        this.connect();
-    }
-    stop() {
-        this.stopped = true;
-        this.closeWhenIdle = null;
-        this.acceptingServices.clear();
-        if (this.reconnectTimer)
-            clearTimeout(this.reconnectTimer);
-        this.reconnectTimer = null;
-        this.clearSocketTimers();
-        this.socket?.close();
-        this.socket = null;
-        this.destroyAllStreams();
-    }
-    drainAndStop() {
-        this.stopped = true;
-        this.acceptingServices.clear();
-        if (this.reconnectTimer)
-            clearTimeout(this.reconnectTimer);
-        this.reconnectTimer = null;
-        this.clearSocketTimers();
-        if (this.streams.size === 0) {
-            this.closeWhenIdle = null;
-            this.socket?.close();
-            return;
-        }
-        this.closeWhenIdle = "stop";
-    }
-    updateLease(lease) {
-        const tunnelChanged = lease.tunnelUrl !== this.lease.tunnelUrl;
-        const removesService = this.lease.services.some((service) => !lease.services.includes(service));
-        this.lease = lease;
-        this.acceptingServices = new Set(lease.services);
-        if (this.stopped)
-            return;
-        if (!tunnelChanged) {
-            if (this.socket?.readyState === WebSocket.OPEN)
-                this.send({ type: "update-lease", lease: lease.token });
-            return;
-        }
-        if (!removesService || this.streams.size === 0) {
-            this.socket?.close();
-            return;
-        }
-        this.closeWhenIdle = "reconnect";
-    }
-    connect() {
-        if (this.stopped || this.socket)
-            return;
-        const socket = new WebSocket(this.lease.tunnelUrl, PROTOCOL);
-        this.socket = socket;
-        socket.binaryType = "nodebuffer";
-        this.startReadyTimeout(socket);
-        socket.on("message", (data, isBinary) => {
-            try {
-                if (isBinary)
-                    this.handleBinary(Buffer.from(data));
-                else
-                    this.handleControl(parseTunnelControlMessage(data.toString()));
-            }
-            catch (error) {
-                this.callbacks.onError(error instanceof Error ? error : new Error(String(error)));
-                socket.close();
-            }
-        });
-        socket.on("pong", () => {
-            if (this.socket === socket)
-                this.awaitingPong = false;
-        });
-        socket.on("close", (code) => {
-            if (this.socket === socket) {
-                this.clearSocketTimers();
-                this.socket = null;
-            }
-            this.closeWhenIdle = null;
-            this.destroyAllStreams();
-            this.callbacks.onDisconnected();
-            if (this.stopped)
-                return;
-            if (code === 4003) {
-                this.stopped = true;
-                this.callbacks.onLeaseRejected();
-                return;
-            }
-            this.scheduleReconnect();
-        });
-        socket.on("error", (error) => this.failSocket(socket, error));
-    }
-    handleControl(message) {
-        if (message.type === "challenge") {
-            this.send({
-                type: "authenticate",
-                lease: this.lease.token,
-                signature: signChallenge(message.nonce, this.lease.token, this.identity.devicePrivateKey),
-            });
-            return;
-        }
-        if (message.type === "ready") {
-            this.attempts = 0;
-            this.clearReadyTimeout();
-            if (this.socket)
-                this.startHeartbeat(this.socket);
-            this.callbacks.onConnected();
-            return;
-        }
-        if (message.type === "open") {
-            this.openStream(message);
-            return;
-        }
-        const stream = this.streams.get(message.streamId);
-        if (!stream)
-            return;
-        if (message.type === "end")
-            stream.request.end();
-        else if (message.type === "abort") {
-            stream.request.destroy();
-            stream.response?.destroy();
-            this.finishStream(message.streamId);
-        }
-        else if (message.type === "pause")
-            stream.response?.pause();
-        else if (message.type === "resume")
-            stream.response?.resume();
-    }
-    openStream(message) {
-        if (this.streams.has(message.streamId))
-            throw new Error(`Duplicate tunnel stream id: ${message.streamId}`);
-        const service = cloudServiceForPublicService(message.service);
-        if (!this.acceptingServices.has(service) ||
-            !allowedPath(message.service, message.path)) {
-            this.send({
-                type: "response",
-                streamId: message.streamId,
-                status: 404,
-                headers: { "content-type": "text/plain" },
-            });
-            this.send({ type: "response-end", streamId: message.streamId });
-            return;
-        }
-        const headers = sanitizeHeaders(message.headers);
-        headers.host = publicHost(this.lease, message.service);
-        const request = http.request({
-            host: this.local.host,
-            port: this.local.port,
-            method: message.method,
-            path: message.path,
-            headers,
-        }, (response) => {
-            const stream = this.streams.get(message.streamId);
-            if (stream)
-                stream.response = response;
-            this.send({
-                type: "response",
-                streamId: message.streamId,
-                status: response.statusCode ?? 502,
-                headers: responseHeaders(response.headers),
-            });
-            response.on("data", (chunk) => {
-                if (!this.sendBinary(message.streamId, Buffer.from(chunk)))
-                    this.pauseForBackpressure(message.streamId, response);
-            });
-            response.on("end", () => {
-                this.send({ type: "response-end", streamId: message.streamId });
-                this.finishStream(message.streamId);
-            });
-            response.on("error", () => {
-                this.send({ type: "abort", streamId: message.streamId });
-                this.finishStream(message.streamId);
-            });
-        });
-        request.on("drain", () => this.send({ type: "resume", streamId: message.streamId }));
-        request.on("error", () => {
-            this.send({
-                type: "response",
-                streamId: message.streamId,
-                status: 502,
-                headers: {},
-            });
-            this.send({ type: "response-end", streamId: message.streamId });
-            this.finishStream(message.streamId);
-        });
-        this.streams.set(message.streamId, {
-            request,
-            response: null,
-            backpressureTimer: null,
-        });
-    }
-    finishStream(streamId) {
-        const stream = this.streams.get(streamId);
-        if (stream?.backpressureTimer)
-            clearInterval(stream.backpressureTimer);
-        this.streams.delete(streamId);
-        if (this.streams.size !== 0 || !this.closeWhenIdle)
-            return;
-        const action = this.closeWhenIdle;
-        this.closeWhenIdle = null;
-        if (action === "stop") {
-            this.socket?.close();
-            return;
-        }
-        this.socket?.close();
-    }
-    pauseForBackpressure(streamId, response) {
-        response.pause();
-        const stream = this.streams.get(streamId);
-        if (!stream || stream.backpressureTimer)
-            return;
-        stream.backpressureTimer = setInterval(() => {
-            if (!this.socket || this.socket.readyState !== WebSocket.OPEN) {
-                if (stream.backpressureTimer)
-                    clearInterval(stream.backpressureTimer);
-                stream.backpressureTimer = null;
-                return;
-            }
-            if (this.socket.bufferedAmount <= LOW_WATER) {
-                if (stream.backpressureTimer)
-                    clearInterval(stream.backpressureTimer);
-                stream.backpressureTimer = null;
-                response.resume();
-            }
-        }, 10);
-        stream.backpressureTimer.unref();
-    }
-    destroyAllStreams() {
-        for (const stream of this.streams.values()) {
-            if (stream.backpressureTimer)
-                clearInterval(stream.backpressureTimer);
-            stream.request.destroy();
-            stream.response?.destroy();
-        }
-        this.streams.clear();
-    }
-    handleBinary(frame) {
-        if (frame.length < 4)
-            throw new Error("Invalid tunnel data frame");
-        const streamId = frame.readUInt32BE(0);
-        const stream = this.streams.get(streamId);
-        if (!stream)
-            return;
-        if (!stream.request.write(frame.subarray(4)))
-            this.send({ type: "pause", streamId });
-    }
-    send(message) {
-        if (this.socket?.readyState === WebSocket.OPEN)
-            this.socket.send(JSON.stringify(message));
-    }
-    sendBinary(streamId, chunk) {
-        const socket = this.socket;
-        if (!socket || socket.readyState !== WebSocket.OPEN)
-            return false;
-        const frame = Buffer.allocUnsafe(4 + chunk.length);
-        frame.writeUInt32BE(streamId, 0);
-        chunk.copy(frame, 4);
-        socket.send(frame, { binary: true });
-        return socket.bufferedAmount < HIGH_WATER;
-    }
-    startReadyTimeout(socket) {
-        this.clearReadyTimeout();
-        this.readyTimer = setTimeout(() => {
-            this.readyTimer = null;
-            this.failSocket(socket, new Error("Tunnel connection timed out"));
-        }, this.timings.readyTimeoutMs);
-        this.readyTimer.unref();
-    }
-    clearReadyTimeout() {
-        if (this.readyTimer)
-            clearTimeout(this.readyTimer);
-        this.readyTimer = null;
-    }
-    startHeartbeat(socket) {
-        if (this.heartbeatTimer)
-            clearInterval(this.heartbeatTimer);
-        this.awaitingPong = false;
-        this.heartbeatTimer = setInterval(() => {
-            if (this.socket !== socket || socket.readyState !== WebSocket.OPEN)
-                return;
-            if (this.awaitingPong) {
-                this.failSocket(socket, new Error("Tunnel heartbeat timed out"));
-                return;
-            }
-            this.awaitingPong = true;
-            socket.ping();
-        }, this.timings.heartbeatIntervalMs);
-        this.heartbeatTimer.unref();
-    }
-    clearSocketTimers() {
-        this.clearReadyTimeout();
-        if (this.heartbeatTimer)
-            clearInterval(this.heartbeatTimer);
-        this.heartbeatTimer = null;
-        this.awaitingPong = false;
-    }
-    failSocket(socket, error) {
-        if (this.socket !== socket)
-            return;
-        this.callbacks.onError(error);
-        this.clearSocketTimers();
-        this.socket = null;
-        socket.terminate();
-    }
-    scheduleReconnect() {
-        if (this.reconnectTimer || this.stopped)
-            return;
-        const delay = Math.min(30_000, 500 * 2 ** Math.min(this.attempts++, 6)) *
-            (0.8 + Math.random() * 0.4);
-        this.reconnectTimer = setTimeout(() => {
-            this.reconnectTimer = null;
-            this.connect();
-        }, delay);
-        this.reconnectTimer.unref();
-    }
-}
-function signChallenge(nonce, lease, privateKey) {
-    const key = createPrivateKey({
-        key: Buffer.from(privateKey, "base64url"),
-        format: "der",
-        type: "pkcs8",
-    });
-    return sign(null, Buffer.from(`chatroom-tunnel-v1\n${nonce}\n${lease}`), key).toString("base64url");
-}
-function publicHost(lease, service) {
-    const baseUrl = service === "mcp" ? lease.mcpBaseUrl : lease.webBaseUrl;
-    if (!baseUrl)
-        throw new Error("Tunnel lease is missing " + service + " public base URL");
-    return new URL(baseUrl).host;
-}
-function allowedPath(service, value) {
-    const pathname = new URL(value, "http://localhost").pathname.toLowerCase();
-    const mcpPath = pathname === "/mcp" || pathname.startsWith("/mcp/");
-    const oauthPath = pathname.startsWith("/oauth/") ||
-        pathname.startsWith("/.well-known/oauth-");
-    if (service === "mcp")
-        return mcpPath || oauthPath;
-    return !mcpPath && !oauthPath;
-}
-function sanitizeHeaders(headers) {
-    const blocked = new Set([
-        "connection",
-        "host",
-        "proxy-connection",
-        "keep-alive",
-        "transfer-encoding",
-        "upgrade",
-    ]);
-    return Object.fromEntries(Object.entries(headers).filter(([key]) => !blocked.has(key.toLowerCase())));
-}
-function responseHeaders(headers) {
-    const result = {};
-    for (const [key, value] of Object.entries(headers)) {
-        if (value === undefined ||
-            ["connection", "keep-alive", "transfer-encoding", "upgrade"].includes(key.toLowerCase()))
-            continue;
-        result[key] = Array.isArray(value) ? value.join(", ") : value;
-    }
-    return result;
-}
+/** The device speaks V2; only Cloud Server carries the removable V1 adapter. */
+export { V2TunnelClient as CloudTunnelClient } from "./v2/tunnel-client.js";

package/dist/plugins/cloud/v2/stream.d.ts

@@ -0,0 +1,48 @@
+/** Tunnel V2 framing, independent of Node.js, WebSocket and WebRTC. */
+export declare const V2_PROTOCOL = "chatroom-tunnel-v2";
+export declare const DATA_SIZE: number;
+export declare const INITIAL_CREDIT: number;
+export declare const MAX_META: number;
+export declare const MAX_QUEUED: number;
+export declare const enum Op {
+    OPEN = 1,
+    META = 2,
+    DATA = 3,
+    FIN = 4,
+    RESET = 5,
+    CREDIT = 6
+}
+export interface Frame {
+    op: Op;
+    id: number;
+    payload: Uint8Array;
+}
+export declare function encodeFrame(op: Op, id: number, payload?: Uint8Array): Uint8Array;
+export declare function decodeFrame(raw: Uint8Array): Frame;
+export declare function readCredit(payload: Uint8Array): number;
+export declare function creditFrame(id: number, amount: number): Uint8Array;
+export declare class CreditSender {
+    private readonly id;
+    private readonly send;
+    private readonly pause;
+    private readonly resume;
+    private readonly onFinished;
+    private readonly canSend;
+    private credit;
+    private readonly chunks;
+    private queued;
+    private ending;
+    private finished;
+    private cancelled;
+    private wakeup;
+    constructor(id: number, send: (frame: Uint8Array) => void, pause: () => void, resume: () => void, onFinished?: () => void, canSend?: () => boolean);
+    enqueue(chunk: Uint8Array): void;
+    addCredit(amount: number): void;
+    end(): void;
+    cancel(): void;
+    /** Called when the physical transport signals that its send buffer drained. */
+    writable(): void;
+    private flush;
+}
+export declare function parseMeta<T>(payload: Uint8Array): T;
+export declare function metaFrame(op: Op.OPEN | Op.META | Op.RESET, id: number, value: unknown): Uint8Array;