autodev-cli 1.4.48 → 1.4.51

package/out/webSocketPoller.js

@@ -39,14 +39,14 @@ const tls = __importStar(require("tls"));
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const vnc_1 = require("./vnc");
-const rdp_1 = require("./rdp");
+const manager_1 = require("./vnc/manager");
+const manager_2 = require("./rdp/manager");
 const messageBuilder_1 = require("./messageBuilder");
 const todo_1 = require("./todo");
 const todoWriteManager_1 = require("./todoWriteManager");
 const commands_1 = require("./core/commands");
-const pathSafe_1 = require("./core/pathSafe");
-const gitService = __importStar(require("./git/gitService"));
+const fileBrowser_1 = require("./fileBrowser");
+const gitRequest_1 = require("./git/gitRequest");
 const wsHandshake_1 = require("./wsHandshake");
 // ---------------------------------------------------------------------------
 // WebSocketPoller — persistent WS connection for ws:// / wss:// endpoints
@@ -64,14 +64,12 @@ class WebSocketPoller {
     _reconnectTimer = null;
     _log = () => { };
     static RECONNECT_DELAY_MS = 5_000;
-    _vncPassword;
-    _vncSessions = new Map();
-    _rdpSessions = new Map();
-    _rdpSettings = {};
+    // VNC / RDP remote-desktop sessions are managed by shared session managers so
+    // the MCP-only bridge (mcp-operate) can reuse the exact same machinery.
+    _vncManager = new manager_1.VncSessionManager((frame) => { this.sendFrame(frame); }, (m) => this._log(m));
+    _rdpManager = new manager_2.RdpSessionManager((frame) => { this.sendFrame(frame); }, (m) => this._log(m));
     _gitEnabled = false;
     _fileBrowserEnabled = false;
-    _vncEnabled = false;
-    _rdpEnabled = false;
     // WebSocket message reassembly (fragmented frames: FIN=0 start + 0x0 continuations).
     _fragOpcode = 0;
     _fragChunks = [];
@@ -178,8 +176,8 @@ class WebSocketPoller {
     destroy() {
         this._destroyed = true;
         this._stopHeartbeat();
-        this._stopAllVncSessions();
-        this._stopAllRdpSessions();
+        this._vncManager.stopAll();
+        this._rdpManager.stopAll();
         if (this._reconnectTimer) {
             clearTimeout(this._reconnectTimer);
             this._reconnectTimer = null;
@@ -303,8 +301,8 @@ class WebSocketPoller {
     }
     _scheduleReconnect() {
         this._stopHeartbeat();
-        this._stopAllVncSessions();
-        this._stopAllRdpSessions();
+        this._vncManager.stopAll();
+        this._rdpManager.stopAll();
         if (this._destroyed) {
             return;
         }
@@ -511,133 +509,13 @@ class WebSocketPoller {
                 }
                 return;
             }
-            if (msgType === 'vnc_session') {
-                if (!this._vncEnabled) {
-                    this._log('vnc_session ignored — VNC not enabled');
-                    return;
-                }
-                const action = msg['action'];
-                if (action === 'start') {
-                    const sessionId = msg['sessionId'];
-                    const port = Number(msg['port'] ?? 5900);
-                    // Prefer password from server frame; fall back to locally-configured password
-                    const password = msg['password'] || this._vncPassword;
-                    this._log(`VNC session start: ${sessionId} → port ${port}`);
-                    const session = new vnc_1.VncSession(sessionId, (frame) => this.sendFrame(frame));
-                    this._vncSessions.set(sessionId, session);
-                    session.start(port, password).catch((err) => {
-                        this._log(`VNC session ${sessionId} failed to start: ${err.message}`);
-                        this._vncSessions.delete(sessionId);
-                        this.sendFrame({ type: 'vnc_close', sessionId, reason: err.message });
-                    });
-                }
-                return;
-            }
-            if (msgType === 'vnc_input') {
-                const sessionId = msg['sessionId'];
-                const event = msg['event'];
-                if (sessionId && event) {
-                    this._vncSessions.get(sessionId)?.handleInput(event);
-                }
-                return;
-            }
-            if (msgType === 'vnc_close') {
-                const sessionId = msg['sessionId'];
-                if (sessionId) {
-                    this._log(`VNC session closed: ${sessionId}`);
-                    this._vncSessions.get(sessionId)?.stop();
-                    this._vncSessions.delete(sessionId);
-                }
-                return;
-            }
-            // ── RDP frames from pixel-office ─────────────────────────────────────────
-            if (msgType === 'rdp_session') {
-                if (!this._rdpEnabled) {
-                    this._log('rdp_session ignored — RDP not enabled');
-                    return;
-                }
-                const action = msg['action'];
-                if (action === 'start') {
-                    const sessionId = msg['sessionId'];
-                    const opts = {
-                        // Host/port come ONLY from local settings — never from the WS frame.
-                        // A frame-supplied host/port would let a remote party open an outbound
-                        // RDP bridge to an arbitrary target (SSRF / internal-network pivot).
-                        // Default to loopback (xrdp runs on the same machine as the extension).
-                        host: this._rdpSettings.host || '127.0.0.1',
-                        port: this._rdpSettings.port ?? 3389,
-                        // credentials never sent from server — always use local settings
-                        username: this._rdpSettings.username || msg['username'],
-                        password: this._rdpSettings.password || msg['password'],
-                        domain: this._rdpSettings.domain || msg['domain'],
-                        width: msg['width'] ? Number(msg['width']) : undefined,
-                        height: msg['height'] ? Number(msg['height']) : undefined,
-                        colorDepth: msg['colorDepth'] ? Number(msg['colorDepth']) : undefined,
-                    };
-                    this._log(`RDP session start: ${sessionId} → ${opts.host}:${opts.port ?? 3389}`);
-                    // Send Guacamole token to browser so it can connect via guacamole-lite
-                    // (guacd + guacamole-lite must be running on the same host as xrdp, port 4567)
-                    if (opts.username || opts.password) {
-                        const guacSettings = {
-                            hostname: opts.host,
-                            port: String(opts.port ?? 3389),
-                            'ignore-cert': true,
-                        };
-                        if (opts.username) {
-                            guacSettings['username'] = opts.username;
-                        }
-                        if (opts.password) {
-                            guacSettings['password'] = opts.password;
-                        }
-                        if (opts.domain) {
-                            guacSettings['domain'] = opts.domain;
-                        }
-                        if (opts.width) {
-                            guacSettings['width'] = opts.width;
-                        }
-                        if (opts.height) {
-                            guacSettings['height'] = opts.height;
-                        }
-                        guacSettings['color-depth'] = opts.colorDepth ?? 24;
-                        const tokenPayload = JSON.stringify({ connection: { type: 'rdp', settings: guacSettings } });
-                        const token = Buffer.from(tokenPayload).toString('base64');
-                        // Use configured WSS URL (for HTTPS frontends), else fall back to plain WS on port 4567
-                        const guacWsUrl = this._rdpSettings.guacWsUrl || `ws://${opts.host}:4567`;
-                        this.sendFrame({
-                            type: 'rdp_guac_token',
-                            sessionId,
-                            wsUrl: guacWsUrl,
-                            token,
-                            width: opts.width ?? 1280,
-                            height: opts.height ?? 800,
-                        });
-                        this._log(`RDP guac token sent for session ${sessionId} → ${guacWsUrl}`);
-                    }
-                    const session = new rdp_1.RdpSession(sessionId, (frame) => this.sendFrame(frame), (msg) => this._log(msg));
-                    this._rdpSessions.set(sessionId, session);
-                    session.start(opts).catch((err) => {
-                        this._log(`RDP session ${sessionId} failed to start: ${err.message}`);
-                        this._rdpSessions.delete(sessionId);
-                        this.sendFrame({ type: 'rdp_close', sessionId, reason: err.message });
-                    });
-                }
-                return;
-            }
-            if (msgType === 'rdp_input') {
-                const sessionId = msg['sessionId'];
-                const event = msg['event'];
-                if (sessionId && event) {
-                    this._rdpSessions.get(sessionId)?.handleInput(event);
-                }
+            // ── VNC / RDP remote-desktop frames from pixel-office ────────────────────
+            // Delegated to shared session managers (same machinery the mcp-operate
+            // bridge uses). Each returns true if it consumed the frame.
+            if (msgType && this._vncManager.handleFrame(msgType, msg)) {
                 return;
             }
-            if (msgType === 'rdp_close') {
-                const sessionId = msg['sessionId'];
-                if (sessionId) {
-                    this._log(`RDP session closed: ${sessionId}`);
-                    this._rdpSessions.get(sessionId)?.stop();
-                    this._rdpSessions.delete(sessionId);
-                }
+            if (msgType && this._rdpManager.handleFrame(msgType, msg)) {
                 return;
             }
             // ── A2A task frame ────────────────────────────────────────────────────────
@@ -773,286 +651,38 @@ class WebSocketPoller {
     }
     /** Handle a file-browser request from the server (originated by the browser UI). */
     _handleFbRequest(requestId, action, relPath, content, newPath, query) {
-        const respond = (ok, extra) => {
-            this.sendFrame({ type: 'fb_response', requestId, ok, ...extra });
-        };
-        if (!this._fileBrowserEnabled) {
-            respond(false, { error: 'File browser not enabled' });
-            return;
-        }
-        const root = this._workspaceRoot;
-        if (!root) {
-            respond(false, { error: 'No workspace root configured' });
-            return;
-        }
-        // Resolve and validate path is within workspace root. The root itself is
-        // permitted for read-only actions (list/search) but never for mutations.
-        // Containment is lexical AND canonical (realpath) — a workspace symlink
-        // pointing outside must not let a remote fb_request read/write host files.
-        const resolveSafe = (rel, allowRoot) => (0, pathSafe_1.resolveWithinRoot)(root, rel, allowRoot);
-        const MUTATING = new Set(['write', 'delete', 'rename', 'mkdir']);
-        const allowRoot = !MUTATING.has(action);
-        const absPath = resolveSafe(relPath, allowRoot);
-        if (!absPath) {
-            respond(false, {
-                error: allowRoot ? 'Path outside workspace' : 'Refusing to modify workspace root',
-            });
-            return;
-        }
-        try {
-            switch (action) {
-                case 'list': {
-                    const entries = fs.readdirSync(absPath, { withFileTypes: true }).map(e => {
-                        const stat = (() => { try {
-                            return fs.statSync(path.join(absPath, e.name));
-                        }
-                        catch {
-                            return null;
-                        } })();
-                        return {
-                            name: e.name,
-                            type: e.isDirectory() ? 'dir' : 'file',
-                            size: stat?.size ?? 0,
-                            mtime: stat?.mtimeMs ?? 0,
-                        };
-                    });
-                    // Dirs first, then files; both alphabetical
-                    entries.sort((a, b) => {
-                        if (a.type !== b.type) {
-                            return a.type === 'dir' ? -1 : 1;
-                        }
-                        return a.name.localeCompare(b.name);
-                    });
-                    respond(true, { entries });
-                    break;
-                }
-                case 'read': {
-                    const stat = fs.statSync(absPath);
-                    const MAX_BYTES = 1_048_576; // 1 MB
-                    if (stat.size > MAX_BYTES) {
-                        respond(false, { error: `File too large (${stat.size} bytes, limit 1 MB)` });
-                        break;
-                    }
-                    // Binary detection: read first 512 bytes and check for null bytes
-                    const sample = Buffer.allocUnsafe(Math.min(512, stat.size));
-                    const fd = fs.openSync(absPath, 'r');
-                    fs.readSync(fd, sample, 0, sample.length, 0);
-                    fs.closeSync(fd);
-                    const isBinary = sample.includes(0x00);
-                    if (isBinary) {
-                        respond(false, { error: 'Binary file — cannot display' });
-                        break;
-                    }
-                    const fileContent = fs.readFileSync(absPath, 'utf8');
-                    respond(true, { content: fileContent });
-                    break;
-                }
-                case 'write': {
-                    if (content === undefined) {
-                        respond(false, { error: 'No content provided' });
-                        break;
-                    }
-                    fs.writeFileSync(absPath, content, 'utf8');
-                    respond(true);
-                    break;
-                }
-                case 'delete': {
-                    fs.rmSync(absPath, { recursive: true, force: true });
-                    respond(true);
-                    break;
-                }
-                case 'rename': {
-                    if (!newPath) {
-                        respond(false, { error: 'No newPath provided' });
-                        break;
-                    }
-                    const absNewPath = resolveSafe(newPath, false);
-                    if (!absNewPath) {
-                        respond(false, { error: 'newPath outside workspace' });
-                        break;
-                    }
-                    fs.renameSync(absPath, absNewPath);
-                    respond(true);
-                    break;
-                }
-                case 'download': {
-                    const stat = fs.statSync(absPath);
-                    const MAX_DOWNLOAD_BYTES = 25 * 1_048_576; // 25 MB — base64 ~1.33x in heap
-                    if (stat.size > MAX_DOWNLOAD_BYTES) {
-                        respond(false, { error: `File too large (${stat.size} bytes, limit 25 MB)` });
-                        break;
-                    }
-                    const buf = fs.readFileSync(absPath);
-                    respond(true, { base64: buf.toString('base64') });
-                    break;
-                }
-                case 'mkdir': {
-                    fs.mkdirSync(absPath, { recursive: true });
-                    respond(true);
-                    break;
-                }
-                case 'search': {
-                    const rawQuery = (query ?? '').toLowerCase().trim();
-                    if (!rawQuery) {
-                        respond(true, { results: [] });
-                        break;
-                    }
-                    const results = [];
-                    const walk = (dir, relDir, depth) => {
-                        if (depth > 8 || results.length >= 300)
-                            return;
-                        let dirents;
-                        try {
-                            dirents = fs.readdirSync(dir, { withFileTypes: true });
-                        }
-                        catch {
-                            return;
-                        }
-                        for (const e of dirents) {
-                            if (results.length >= 300)
-                                break;
-                            const rel = relDir ? `${relDir}/${e.name}` : e.name;
-                            if (e.name.toLowerCase().includes(rawQuery)) {
-                                results.push({ path: rel, name: e.name, type: e.isDirectory() ? 'dir' : 'file' });
-                            }
-                            if (e.isDirectory() && !e.name.startsWith('.') && e.name !== 'node_modules' && e.name !== 'vendor') {
-                                walk(path.join(dir, e.name), rel, depth + 1);
-                            }
-                        }
-                    };
-                    walk(absPath, '', 0);
-                    respond(true, { results });
-                    break;
-                }
-                default:
-                    respond(false, { error: `Unknown action: ${action}` });
-            }
-        }
-        catch (err) {
-            respond(false, { error: String(err) });
-        }
+        (0, fileBrowser_1.handleFbRequest)({
+            root: this._workspaceRoot ?? null,
+            enabled: this._fileBrowserEnabled,
+            requestId,
+            action,
+            relPath,
+            content,
+            newPath,
+            query,
+            sendFrame: (frame) => { this.sendFrame(frame); },
+            log: (m) => this._log(m),
+        });
     }
+    /** Handle a git-panel request from the server (originated by the browser UI). */
     _handleGitRequest(requestId, action, filePath, staged, message, branch, hash) {
-        const respond = (ok, data, error) => {
-            this.sendFrame({ type: 'git_response', requestId, ok, ...(data ?? {}), ...(error ? { error } : {}) });
-        };
-        const root = this._workspaceRoot;
-        if (!root) {
-            respond(false, undefined, 'No workspace root');
-            return;
-        }
-        if (!this._gitEnabled) {
-            respond(false, undefined, 'Git not enabled');
-            return;
-        }
-        // Containment guard — mirror _handleFbRequest. Every path-bearing arg
-        // (filePath) must resolve inside the workspace root both lexically AND after
-        // resolving symlinks; otherwise a git_request could read arbitrary host
-        // files (e.g. path '../../.claude/.credentials.json' via the readFileSync
-        // fallback in getDiff, or leak them through `git diff -- <path>`). An empty
-        // filePath means "whole repo" and is permitted (allowRoot).
-        if (filePath !== undefined && filePath !== '') {
-            if ((0, pathSafe_1.resolveWithinRoot)(root, filePath, true) === null) {
-                respond(false, undefined, 'Path outside workspace');
-                return;
-            }
-        }
-        (async () => {
-            try {
-                switch (action) {
-                    case 'status': {
-                        const status = await gitService.getStatus(root);
-                        respond(true, { status });
-                        break;
-                    }
-                    case 'log': {
-                        const commits = await gitService.getLog(root);
-                        respond(true, { commits });
-                        break;
-                    }
-                    case 'diff': {
-                        const diff = await gitService.getDiff(root, filePath ?? '', staged ?? false);
-                        respond(true, { diff });
-                        break;
-                    }
-                    case 'commit_diff': {
-                        const diff = await gitService.getCommitDiff(root, hash ?? '', filePath);
-                        respond(true, { diff });
-                        break;
-                    }
-                    case 'stage': {
-                        if (filePath)
-                            await gitService.stageFile(root, filePath);
-                        else
-                            await gitService.stageAll(root);
-                        respond(true);
-                        break;
-                    }
-                    case 'unstage': {
-                        if (!filePath) {
-                            respond(false, undefined, 'path required');
-                            break;
-                        }
-                        await gitService.unstageFile(root, filePath);
-                        respond(true);
-                        break;
-                    }
-                    case 'commit': {
-                        if (!message) {
-                            respond(false, undefined, 'message required');
-                            break;
-                        }
-                        const commitHash = await gitService.commit(root, message);
-                        respond(true, { hash: commitHash });
-                        break;
-                    }
-                    case 'fetch': {
-                        await gitService.fetchOrigin(root);
-                        respond(true);
-                        break;
-                    }
-                    case 'branches': {
-                        const branches = await gitService.getBranches(root);
-                        respond(true, { branches });
-                        break;
-                    }
-                    case 'checkout': {
-                        if (!branch) {
-                            respond(false, undefined, 'branch required');
-                            break;
-                        }
-                        await gitService.checkoutBranch(root, branch);
-                        respond(true);
-                        break;
-                    }
-                    default:
-                        respond(false, undefined, `Unknown git action: ${action}`);
-                }
-            }
-            catch (err) {
-                respond(false, undefined, String(err));
-            }
-        })();
-    }
-    /** Stop all active VNC sessions (called on destroy/reconnect). */
-    _stopAllVncSessions() {
-        for (const [id, session] of this._vncSessions) {
-            this._log(`VNC session terminated (disconnect): ${id}`);
-            session.stop();
-        }
-        this._vncSessions.clear();
-    }
-    /** Stop all active RDP sessions (called on destroy/reconnect). */
-    _stopAllRdpSessions() {
-        for (const [id, session] of this._rdpSessions) {
-            this._log(`RDP session terminated (disconnect): ${id}`);
-            session.stop();
-        }
-        this._rdpSessions.clear();
+        (0, gitRequest_1.handleGitRequest)({
+            root: this._workspaceRoot ?? null,
+            enabled: this._gitEnabled,
+            requestId,
+            action,
+            filePath,
+            staged,
+            message,
+            branch,
+            hash,
+            sendFrame: (frame) => { this.sendFrame(frame); },
+            log: (m) => this._log(m),
+        });
     }
     /** Update the VNC password used for incoming vnc_session requests. */
     setVncPassword(password) {
-        this._vncPassword = password;
+        this._vncManager.setPassword(password);
     }
     setGitEnabled(enabled) {
         this._gitEnabled = enabled;
@@ -1061,13 +691,13 @@ class WebSocketPoller {
         this._fileBrowserEnabled = enabled;
     }
     setVncEnabled(enabled) {
-        this._vncEnabled = enabled;
+        this._vncManager.setEnabled(enabled);
     }
     setRdpEnabled(enabled) {
-        this._rdpEnabled = enabled;
+        this._rdpManager.setEnabled(enabled);
     }
     setRdpSettings(s) {
-        this._rdpSettings = s;
+        this._rdpManager.setSettings(s);
     }
     /**
      * Send a JSON payload to the server over the WebSocket connection.