ai_co_discuss 0.3.10 → 0.3.11

package/backend/remote_launch.py

@@ -5,6 +5,10 @@ connected browser would send to the local bridge; the paired computer claims it
 sync, resolves the chosen project to its own directory and runs it. The Worker backend
 implements the same contract in ``worker.mjs``; both operate on ``local_machines`` and
 ``remote_launches``.
+
+Every other local-service operation travels as a machine command: the device encrypts it with the
+computer's published P-256 key, the site only queues ciphertext, and the computer long-polls, runs it
+through the same local entrypoint and returns an encrypted response.
 """
 
 import hashlib
@@ -27,6 +31,13 @@ MACHINE_TOKEN = re.compile(r"[0-9a-f]{64}")
 LAUNCH_ID = re.compile(r"[A-Za-z0-9_-]{1,80}")
 PROJECT_ID = re.compile(r"[0-9a-f]{8,32}")
 LAUNCH_STAGES = ("not_started", "unconfirmed", "created", "started")
+COMMAND_ID = re.compile(r"[A-Za-z0-9_-]{16,80}")
+COMMAND_TTL_SECONDS = 180
+COMMAND_WAIT_MAX = 20
+ENVELOPE_DATA_MAX = 512 * 1024
+BASE64 = re.compile(r"[A-Za-z0-9+/]*={0,2}")
+BASE64URL_COORDINATE = re.compile(r"[A-Za-z0-9_-]{43}")
+IV_BASE64 = re.compile(r"[A-Za-z0-9+/]{16}")
 
 
 def token_digest(token):
@@ -34,9 +45,13 @@ def token_digest(token):
     return hashlib.sha256(token.encode()).hexdigest() if isinstance(token, str) and MACHINE_TOKEN.fullmatch(token) else ""
 
 
+MACHINE_SELECT = "SELECT m.*, k.public_key FROM local_machines m LEFT JOIN machine_keys k ON k.machine_id=m.id"
+
+
 def machine_view(row, now):
-    """Public machine fields: projects by name and id, and which platforms it can wake."""
+    """Public machine fields: projects by name and id, which platforms it can wake, and its command key if any."""
     return {"id": row["id"], "name": row["name"], "projects": json.loads(row["projects"]), "clients": json.loads(row["clients"]),
+            "public_key": json.loads(row["public_key"]) if row["public_key"] else None,
             "seen_at": row["seen_at"], "online": now - row["seen_at"] <= MACHINE_ONLINE_SECONDS}
 
 
@@ -48,7 +63,7 @@ def launch_view(row):
 
 def list_machines(connection, now):
     """Paired computers, most recently seen first."""
-    rows = connection.execute("SELECT * FROM local_machines ORDER BY seen_at DESC, created_at DESC").fetchall()
+    rows = connection.execute(f"{MACHINE_SELECT} ORDER BY m.seen_at DESC, m.created_at DESC").fetchall()
     return {"machines": [machine_view(row, now) for row in rows]}
 
 
@@ -64,7 +79,7 @@ def pair_machine(connection, payload, now):
     connection.execute("INSERT INTO local_machines (id,name,token_hash,created_at) VALUES (?,?,?,?) "
                        "ON CONFLICT(id) DO UPDATE SET name=excluded.name, token_hash=excluded.token_hash",
                        (machine_id, name, token_digest(token), now))
-    return machine_view(connection.execute("SELECT * FROM local_machines WHERE id=?", (machine_id,)).fetchone(), now)
+    return machine_view(connection.execute(f"{MACHINE_SELECT} WHERE m.id=?", (machine_id,)).fetchone(), now)
 
 
 def require_machine(connection, machine_id, token):
@@ -98,13 +113,33 @@ def valid_clients(value):
     return value
 
 
+def valid_public_key(value):
+    """An ECDH P-256 public key as JWK coordinates; anything else is rejected."""
+    if (not isinstance(value, dict) or value.get("kty") != "EC" or value.get("crv") != "P-256"
+            or not all(isinstance(value.get(axis), str) and BASE64URL_COORDINATE.fullmatch(value[axis]) for axis in ("x", "y"))):
+        raise ValueError("电脑公钥须为 P-256 JWK")
+    return {"kty": "EC", "crv": "P-256", "x": value["x"], "y": value["y"]}
+
+
+def valid_envelope(value, with_key):
+    """Ciphertext and IV, plus the sender's ephemeral key on requests; the site never reads the content."""
+    if (not isinstance(value, dict) or not isinstance(value.get("iv"), str) or not IV_BASE64.fullmatch(value["iv"])
+            or not isinstance(value.get("data"), str) or not 0 < len(value["data"]) <= ENVELOPE_DATA_MAX or not BASE64.fullmatch(value["data"])):
+        raise ValueError("加密命令格式无效")
+    return {"iv": value["iv"], "data": value["data"], **({"key": valid_public_key(value.get("key"))} if with_key else {})}
+
+
 def machine_sync(connection, machine_id, token, payload, now):
-    """Record the computer's projects and clients, and hand it every launch it has not finished."""
+    """Record the computer's projects, clients and command key, and hand it every launch it has not finished."""
     require_machine(connection, machine_id, token)
     projects, clients = valid_projects(payload.get("projects")), valid_clients(payload.get("clients"))
+    public_key = valid_public_key(payload["public_key"]) if "public_key" in payload else None
     begin_write(connection)
     connection.execute("UPDATE local_machines SET projects=?, clients=?, seen_at=? WHERE id=?",
                        (json.dumps(projects, ensure_ascii=False), json.dumps(clients, ensure_ascii=False), now, machine_id))
+    if public_key:
+        connection.execute("INSERT INTO machine_keys (machine_id,public_key) VALUES (?,?) "
+                           "ON CONFLICT(machine_id) DO UPDATE SET public_key=excluded.public_key", (machine_id, json.dumps(public_key)))
     rows = connection.execute("SELECT id,request FROM remote_launches WHERE machine_id=? AND status IN ('pending','claimed') ORDER BY created_at",
                               (machine_id,)).fetchall()
     return {"launches": [{"id": row["id"], "request": json.loads(row["request"])} for row in rows]}
@@ -173,3 +208,60 @@ def remote_launch_status(connection, launch_id):
     if not row:
         raise LookupError("启动请求不存在")
     return launch_view(row)
+
+
+def submit_machine_command(connection, machine_id, payload, now):
+    """Queue one encrypted local-service operation for the paired computer."""
+    command_id = payload.get("id")
+    if not isinstance(command_id, str) or not COMMAND_ID.fullmatch(command_id):
+        raise ValueError("命令编号无效")
+    envelope = valid_envelope(payload.get("envelope"), with_key=True)
+    begin_write(connection)
+    if not connection.execute("SELECT 1 FROM local_machines WHERE id=?", (machine_id,)).fetchone():
+        raise LookupError("这台电脑尚未连接网站")
+    if not connection.execute("SELECT 1 FROM machine_keys WHERE machine_id=?", (machine_id,)).fetchone():
+        raise FileExistsError("这台电脑的 codiscuss 版本过旧，请更新后重试")
+    if connection.execute("SELECT 1 FROM machine_commands WHERE id=?", (command_id,)).fetchone():
+        raise FileExistsError("命令编号已使用")
+    connection.execute("INSERT INTO machine_commands (id,machine_id,request,created_at,updated_at) VALUES (?,?,?,?,?)",
+                       (command_id, machine_id, json.dumps(envelope), now, now))
+    return {"id": command_id, "status": "pending"}
+
+
+def machine_command_status(connection, machine_id, command_id):
+    """Report a command's progress; a finished command hands over its response once and is deleted."""
+    row = connection.execute("SELECT * FROM machine_commands WHERE id=? AND machine_id=?", (command_id, machine_id)).fetchone()
+    if not row:
+        raise LookupError("命令不存在或已过期")
+    if row["status"] != "done":
+        return {"id": command_id, "status": row["status"]}
+    begin_write(connection)
+    connection.execute("DELETE FROM machine_commands WHERE id=?", (command_id,))
+    return {"id": command_id, "status": "done", "response": json.loads(row["response"])}
+
+
+def claim_machine_commands(connection, machine_id, token, now):
+    """Drop expired commands and hand the computer every pending one, clearing the queued ciphertext."""
+    require_machine(connection, machine_id, token)
+    begin_write(connection)
+    connection.execute("DELETE FROM machine_commands WHERE machine_id=? AND created_at<?", (machine_id, now - COMMAND_TTL_SECONDS))
+    connection.execute("UPDATE local_machines SET seen_at=? WHERE id=?", (now, machine_id))
+    rows = connection.execute("SELECT id,request FROM machine_commands WHERE machine_id=? AND status='pending' ORDER BY created_at",
+                              (machine_id,)).fetchall()
+    for row in rows:
+        connection.execute("UPDATE machine_commands SET status='claimed', request='{}', updated_at=? WHERE id=?", (now, row["id"]))
+    return {"commands": [{"id": row["id"], "envelope": json.loads(row["request"])} for row in rows]}
+
+
+def finish_machine_command(connection, machine_id, command_id, token, payload, now):
+    """Store the computer's encrypted response for the device that is waiting on it."""
+    require_machine(connection, machine_id, token)
+    envelope = valid_envelope(payload.get("envelope"), with_key=False)
+    begin_write(connection)
+    row = connection.execute("SELECT status FROM machine_commands WHERE id=? AND machine_id=?", (command_id, machine_id)).fetchone()
+    if not row:
+        raise LookupError("命令不存在或已过期")
+    if row["status"] != "claimed":
+        raise FileExistsError("命令已结束")
+    connection.execute("UPDATE machine_commands SET status='done', response=?, updated_at=? WHERE id=?", (json.dumps(envelope), now, command_id))
+    return {"id": command_id, "status": "done"}

package/backend/schema.sql

@@ -831,6 +831,24 @@ CREATE TABLE IF NOT EXISTS remote_launches (
     updated_at INTEGER NOT NULL
 );
 CREATE INDEX IF NOT EXISTS remote_launches_machine ON remote_launches(machine_id, status);
+-- The P-256 public key a paired computer publishes so other devices can encrypt commands only it can read.
+CREATE TABLE IF NOT EXISTS machine_keys (
+    machine_id TEXT PRIMARY KEY,
+    public_key TEXT NOT NULL
+);
+-- A local-service operation relayed from a device without the local service. Request and response are end-to-end
+-- encrypted between that device and the computer, so the site never holds keys, paths or results in plaintext;
+-- the request is cleared once claimed and the row is deleted once read or expired.
+CREATE TABLE IF NOT EXISTS machine_commands (
+    id TEXT PRIMARY KEY,
+    machine_id TEXT NOT NULL,
+    request TEXT NOT NULL DEFAULT '{}',
+    response TEXT NOT NULL DEFAULT '{}',
+    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','claimed','done')),
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS machine_commands_machine ON machine_commands(machine_id, status);
 
 -- Normalize legacy online relay members and retired brainstorm rooms for the shared free-room model.
 INSERT OR IGNORE INTO member_manual_sources(member_id,source)