@zuzuucodes/cli 1.1.0 → 1.2.0

package/web-app/dist/server.js

@@ -0,0 +1,407 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { Readable } from "node:stream";
+import { Hono } from "hono";
+import { getCookie, setCookie } from "hono/cookie";
+import { serve } from "@hono/node-server";
+import { WebSocketServer } from "ws";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { SessionManager } from "./sessions.js";
+import { createFsApi } from "./fs-api.js";
+import { createZuzuuApi } from "./zuzuu-api.js";
+import { search } from "./search.js";
+import { listFiles } from "./file-list.js";
+import { listWorkflows, saveWorkflow } from "./workflows.js";
+import * as git from "./git.js";
+import { shellHistory } from "./history.js";
+import * as config from "./config.js";
+import { listDirs, mkdirIn } from "./browse.js";
+const execFileAsync = promisify(execFile);
+import { handleTermSocket } from "./ws-term.js";
+import { handleFsSocket } from "./ws-fs.js";
+import { PathError, resolveSafe, safeJoin } from "./safe-path.js";
+const AUTH_COOKIE = "webcode_auth";
+const COOKIE_MAX_AGE = 30 * 24 * 3600;
+const STATIC_MIME = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript",
+    ".css": "text/css",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/x-icon",
+    ".woff2": "font/woff2",
+    ".json": "application/json",
+    ".webmanifest": "application/manifest+json",
+};
+export class WebcodeServer {
+    cfg;
+    app;
+    sessions;
+    /** mutable workspace root — switchable at runtime via switchTo() */
+    root;
+    startedAt = Date.now();
+    authSessions = new Set();
+    allowedHosts;
+    allowedOrigins;
+    server = null;
+    constructor(cfg) {
+        this.cfg = cfg;
+        this.root = cfg.root;
+        this.sessions = new SessionManager(cfg.root);
+        const hostNames = ["127.0.0.1", "localhost", "[::1]"];
+        this.allowedHosts = new Set(hostNames.flatMap((h) => [h, `${h}:${cfg.port}`]));
+        this.allowedOrigins = new Set([
+            ...hostNames.map((h) => `http://${h}:${cfg.port}`),
+            ...(cfg.extraOrigins ?? []),
+        ]);
+        // hosted: also accept the public hostname (Fly's edge sets Host to it);
+        // Host/Origin defense stays on, just widened to the one public origin.
+        if (cfg.publicHost) {
+            this.allowedHosts.add(cfg.publicHost.toLowerCase());
+            this.allowedOrigins.add(`https://${cfg.publicHost}`);
+            this.allowedOrigins.add(`http://${cfg.publicHost}`);
+        }
+        this.app = this.buildApp();
+    }
+    /**
+     * Re-root the live daemon onto a new workspace. Tears down all terminal
+     * sessions (like reloading an Obsidian vault) and rebuilds the manager;
+     * fs watchers belong to client sockets and clean up when the client reloads.
+     */
+    async switchTo(newRoot) {
+        const resolved = await fsp.realpath(path.resolve(newRoot));
+        const st = await fsp.stat(resolved);
+        if (!st.isDirectory())
+            throw new Error("not a directory");
+        this.sessions.shutdown();
+        this.sessions = new SessionManager(resolved);
+        this.root = resolved;
+        await config.addRecent(resolved);
+    }
+    // ── security gates ─────────────────────────────────────────────────
+    /** Host allowlist defeats DNS rebinding: rebinding changes DNS, not the Host header. */
+    hostAllowed(host) {
+        return !!host && this.allowedHosts.has(host.toLowerCase());
+    }
+    /** Origin allowlist defeats cross-site WS hijacking / CSRF from arbitrary websites. */
+    originAllowed(origin) {
+        return origin === undefined || this.allowedOrigins.has(origin);
+    }
+    cookieAuthed(cookieHeader) {
+        if (!cookieHeader)
+            return false;
+        const match = /(?:^|;\s*)webcode_auth=([^;]+)/.exec(cookieHeader);
+        return !!match && this.authSessions.has(match[1]);
+    }
+    // ── HTTP app ───────────────────────────────────────────────────────
+    buildApp() {
+        const { cfg } = this;
+        const app = new Hono();
+        app.use("*", async (c, next) => {
+            if (!this.hostAllowed(c.req.header("host"))) {
+                return c.text("forbidden host", 403);
+            }
+            if (!this.originAllowed(c.req.header("origin"))) {
+                return c.text("forbidden origin", 403);
+            }
+            // Token exchange: any page request carrying ?token= gets a cookie.
+            const token = c.req.query("token");
+            if (token && !c.req.path.startsWith("/api/")) {
+                if (!timingSafeEqualStr(token, cfg.token))
+                    return c.text("invalid token", 403);
+                const secret = crypto.randomBytes(24).toString("base64url");
+                this.authSessions.add(secret);
+                setCookie(c, AUTH_COOKIE, secret, {
+                    httpOnly: true,
+                    sameSite: "Strict",
+                    path: "/",
+                    maxAge: COOKIE_MAX_AGE,
+                });
+                const url = new URL(c.req.url);
+                url.searchParams.delete("token");
+                // /auth?token=… exists so the Vite dev server can proxy the
+                // exchange; land on the app root afterwards either way.
+                const dest = url.pathname === "/auth" ? "/" : url.pathname + url.search;
+                return c.redirect(dest);
+            }
+            await next();
+        });
+        app.use("/api/*", async (c, next) => {
+            if (!this.authSessions.has(getCookie(c, AUTH_COOKIE) ?? "")) {
+                return c.json({ error: "unauthorized" }, 401);
+            }
+            await next();
+        });
+        app.get("/api/workspace", (c) => {
+            const body = {
+                root: this.root,
+                name: path.basename(this.root) || this.root,
+                version: cfg.version,
+            };
+            return c.json(body);
+        });
+        app.get("/api/sessions", (c) => c.json(this.sessions.list()));
+        app.post("/api/sessions", async (c) => {
+            let body = {};
+            try {
+                body = await c.req.json();
+            }
+            catch {
+                // empty body is fine
+            }
+            const cwd = body.cwd ? safeJoin(this.root, body.cwd) : this.root;
+            const session = this.sessions.create(cwd, body.cols, body.rows);
+            return c.json(session.info(), 201);
+        });
+        app.delete("/api/sessions/:id", (c) => {
+            const ok = this.sessions.close(c.req.param("id"));
+            return ok ? c.json({ ok: true }) : c.json({ error: "no such session" }, 404);
+        });
+        // Save the session's output ring buffer as an asciicast v2 file INSIDE
+        // the workspace — it shows up in the tree and replays in the preview.
+        app.post("/api/sessions/:id/recording", async (c) => {
+            const session = this.sessions.get(c.req.param("id"));
+            if (!session)
+                return c.json({ error: "no such session" }, 404);
+            let body;
+            try {
+                body = await c.req.json();
+            }
+            catch {
+                return c.json({ error: "path required" }, 400);
+            }
+            if (!body.path?.endsWith(".cast"))
+                return c.json({ error: "path must end in .cast" }, 400);
+            let abs;
+            try {
+                abs = await resolveSafe(this.root, body.path);
+            }
+            catch (err) {
+                if (err instanceof PathError)
+                    return c.json({ error: err.message }, 403);
+                throw err;
+            }
+            await fsp.mkdir(path.dirname(abs), { recursive: true });
+            await fsp.writeFile(abs, session.recording(), "utf8");
+            return c.json({ ok: true, path: body.path, truncated: session.castTruncated });
+        });
+        app.get("/api/search", async (c) => {
+            const query = c.req.query("q") ?? "";
+            if (!query)
+                return c.json({ error: "q required" }, 400);
+            let searchRoot;
+            try {
+                searchRoot = await resolveSafe(this.root, c.req.query("path") ?? "");
+            }
+            catch (err) {
+                if (err instanceof PathError)
+                    return c.json({ error: err.message }, 403);
+                throw err;
+            }
+            const res = await search({
+                query,
+                searchRoot,
+                root: this.root,
+                regex: c.req.query("regex") === "1",
+                caseSensitive: c.req.query("case") === "1",
+            });
+            return c.json(res);
+        });
+        app.get("/api/files", async (c) => {
+            const limit = Math.min(Number(c.req.query("limit")) || 5000, 20000);
+            return c.json(await listFiles(this.root, limit));
+        });
+        app.get("/api/workflows", async (c) => {
+            return c.json({ workflows: await listWorkflows(this.root) });
+        });
+        app.post("/api/workflows", async (c) => {
+            let wf;
+            try {
+                wf = await c.req.json();
+            }
+            catch {
+                return c.json({ error: "invalid body" }, 400);
+            }
+            if (!wf.name?.trim() || !wf.command?.trim()) {
+                return c.json({ error: "name and command required" }, 400);
+            }
+            const path = await saveWorkflow(this.root, wf);
+            return c.json({ ok: true, path });
+        });
+        // ── git ──────────────────────────────────────────────────────────
+        app.get("/api/git/status", async (c) => c.json(await git.status(this.root)));
+        app.get("/api/git/diff", async (c) => {
+            const p = c.req.query("path") ?? "";
+            if (!p)
+                return c.json({ error: "path required" }, 400);
+            return c.json({ original: await git.diffOriginal(this.root, p) });
+        });
+        app.post("/api/git/stage", async (c) => {
+            const { paths } = await c.req.json();
+            await git.stage(this.root, Array.isArray(paths) ? paths : []);
+            return c.json({ ok: true });
+        });
+        app.post("/api/git/unstage", async (c) => {
+            const { paths } = await c.req.json();
+            await git.unstage(this.root, Array.isArray(paths) ? paths : []);
+            return c.json({ ok: true });
+        });
+        app.post("/api/git/commit", async (c) => {
+            const { message } = await c.req.json();
+            if (!message?.trim())
+                return c.json({ error: "message required" }, 400);
+            try {
+                await git.commit(this.root, message.trim());
+            }
+            catch (err) {
+                return c.json({ error: err.message }, 400);
+            }
+            return c.json({ ok: true });
+        });
+        // ── shell history + quick-fix actions ──────────────────────────────
+        app.get("/api/history", async (c) => c.json({ commands: await shellHistory() }));
+        app.post("/api/fix/kill-port", async (c) => {
+            const { port } = await c.req.json();
+            if (!Number.isInteger(port) || port < 1 || port > 65535) {
+                return c.json({ error: "invalid port" }, 400);
+            }
+            try {
+                const { stdout } = await execFileAsync("lsof", ["-ti", `tcp:${port}`]);
+                const pids = stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+                for (const pid of pids) {
+                    try {
+                        process.kill(Number(pid), "SIGTERM");
+                    }
+                    catch {
+                        // already gone
+                    }
+                }
+                return c.json({ ok: true, killed: pids.length });
+            }
+            catch {
+                return c.json({ ok: true, killed: 0 }); // nothing listening
+            }
+        });
+        // ── health / onboarding / vault picker ─────────────────────────────
+        app.get("/api/health", (c) => c.json({
+            ok: true,
+            version: cfg.version,
+            uptimeMs: Date.now() - this.startedAt,
+            rss: process.memoryUsage().rss,
+            root: this.root,
+            name: path.basename(this.root) || this.root,
+        }));
+        app.get("/api/workspace/config", async (c) => {
+            const conf = await config.load();
+            return c.json({ onboarded: conf.onboarded, recent: conf.recent });
+        });
+        app.post("/api/workspace/onboarded", async (c) => {
+            await config.setOnboarded();
+            return c.json({ ok: true });
+        });
+        app.get("/api/browse", async (c) => {
+            try {
+                return c.json(await listDirs(c.req.query("path")));
+            }
+            catch (err) {
+                return c.json({ error: err.message }, 400);
+            }
+        });
+        app.post("/api/browse/mkdir", async (c) => {
+            const { parent, name } = await c.req.json();
+            try {
+                const dir = await mkdirIn(parent, name);
+                return c.json({ ok: true, path: dir });
+            }
+            catch (err) {
+                return c.json({ error: err.message }, 400);
+            }
+        });
+        app.post("/api/workspace/switch", async (c) => {
+            const { path: target } = await c.req.json();
+            if (!target)
+                return c.json({ error: "path required" }, 400);
+            try {
+                await this.switchTo(target);
+            }
+            catch (err) {
+                return c.json({ error: err.message }, 400);
+            }
+            return c.json({ ok: true, root: this.root });
+        });
+        app.route("/api/fs", createFsApi(() => this.root));
+        app.route("/api/zuzuu", createZuzuuApi(() => this.root));
+        // Static SPA with index.html fallback
+        app.get("*", async (c) => {
+            let rel = decodeURIComponent(new URL(c.req.url).pathname);
+            let abs;
+            try {
+                abs = safeJoin(cfg.webDist, rel);
+            }
+            catch {
+                return c.text("not found", 404);
+            }
+            let st = await fsp.stat(abs).catch(() => null);
+            if (!st?.isFile()) {
+                abs = path.join(cfg.webDist, "index.html");
+                st = await fsp.stat(abs).catch(() => null);
+                if (!st)
+                    return c.text("web UI not built — run: npm run build -w @zuzuu-web/web", 404);
+            }
+            const ext = path.extname(abs).toLowerCase();
+            const immutable = rel.startsWith("/assets/");
+            return new Response(Readable.toWeb(fs.createReadStream(abs)), {
+                headers: {
+                    "Content-Type": STATIC_MIME[ext] ?? "application/octet-stream",
+                    "Cache-Control": immutable ? "public, max-age=31536000, immutable" : "no-cache",
+                },
+            });
+        });
+        return app;
+    }
+    // ── listen + WS upgrade ────────────────────────────────────────────
+    start(onReady) {
+        const { cfg } = this;
+        this.server = serve({ fetch: this.app.fetch, port: cfg.port, hostname: cfg.host }, (info) => onReady(info.port));
+        const wss = new WebSocketServer({ noServer: true });
+        this.server.on("upgrade", (req, socket, head) => {
+            const reject = (status, msg) => {
+                socket.write(`HTTP/1.1 ${status} ${msg}\r\nConnection: close\r\n\r\n`);
+                socket.destroy();
+            };
+            if (!this.hostAllowed(req.headers.host))
+                return reject(403, "Forbidden");
+            if (!this.originAllowed(req.headers.origin))
+                return reject(403, "Forbidden");
+            if (!this.cookieAuthed(req.headers.cookie))
+                return reject(401, "Unauthorized");
+            const url = new URL(req.url ?? "/", "http://localhost");
+            const termMatch = /^\/ws\/term\/([0-9a-f]+)$/.exec(url.pathname);
+            if (termMatch) {
+                const session = this.sessions.get(termMatch[1]);
+                if (!session)
+                    return reject(404, "Not Found");
+                wss.handleUpgrade(req, socket, head, (ws) => handleTermSocket(ws, session));
+                return;
+            }
+            if (url.pathname === "/ws/fs") {
+                wss.handleUpgrade(req, socket, head, (ws) => handleFsSocket(ws, this.root));
+                // ^ this.root read at upgrade time → new connections (post-switch) use the new root
+                return;
+            }
+            reject(404, "Not Found");
+        });
+    }
+    stop() {
+        this.sessions.shutdown();
+        this.server?.close();
+    }
+}
+function timingSafeEqualStr(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ba.length === bb.length && crypto.timingSafeEqual(ba, bb);
+}