bothouse-dsh 0.1.57 → 0.1.59

package/collab/plugin.mjs

@@ -10,7 +10,8 @@ import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { Store, CollabError, publicMessage } from './store.mjs';
-import { InstanceLock, LOCK_FILE, lockBusyMessage } from './instance-lock.mjs';
+import { LOCK_FILE, acquireLockWithOwner, clearLockOwner } from './instance-lock.mjs';
+import { localConnection, isLocalOwner, mountSharedHost, refuse } from './local-host.mjs';
 import { startBotPort } from './bot-port.mjs';
 import { Hub } from './hub.mjs';
 import { TeamExit } from './team-exit.mjs';
@@ -25,7 +26,7 @@ import { avatarImage, checkAvatar } from './avatars.mjs';
 import { AvatarUploads } from './avatar-uploads.mjs';
 import { handler as clisHandler } from './clis.mjs';
 import { LeadState } from './lead-state.mjs';
-import { Attachments, INLINE_IMAGE } from './attachments.mjs';
+import { Attachments, DEFAULT_MAX_UPLOAD_BYTES, INLINE_IMAGE, MAX_BOT_ATTACHMENT_BYTES, formatBytes } from './attachments.mjs';
 import { Later, registerLater } from './later.mjs';
 import { QuotaCooling, quotaDirectory } from './quota-cooling.mjs';
 import { DeskEvents, DESK_NAMES_FILE, deskRoute } from './desk.mjs';
@@ -51,7 +52,6 @@ const MAX_BODY = 256 * 1024;
 // that forwards it to a bot.
 const MAX_MESSAGE_BODY = 8 * 1024 * 1024;
 const OWNER = 'owner';
-
 /** Validate the overlay config; misconfiguration fails at load. */
 export function resolveConfig(config, env = process.env) {
   const c = config ?? {};
@@ -86,6 +86,11 @@ export function resolveConfig(config, env = process.env) {
   }
   const maxRelay = c.maxRelay ?? 6;
   if (!Number.isSafeInteger(maxRelay) || maxRelay < 0) throw Error('conest-collab: maxRelay must be a non-negative integer');
+  // #197: the cap of one streamed channel upload, in bytes. The overlay's maxUploadBytes
+  // (README) wins so a slower machine or a small disk can lower it; otherwise the
+  // measured default in attachments.mjs applies (#228's 8 MiB only fit a ~6 MB file).
+  const maxUploadBytes = c.maxUploadBytes ?? DEFAULT_MAX_UPLOAD_BYTES;
+  if (!Number.isSafeInteger(maxUploadBytes) || maxUploadBytes <= 0) throw Error('conest-collab: maxUploadBytes must be a positive integer');
   const botTokenEnv = c.botTokenEnv ?? 'CONEST_COLLAB_BOT_TOKEN';
   const botToken = env[botTokenEnv] ?? '';
   // #142 桌面版宿主端口每次随机：给一个固定端口另开 bot 接入（bot-port.mjs）。配置或 CONEST_COLLAB_BOT_PORT，都没给就不开。
@@ -110,7 +115,7 @@ export function resolveConfig(config, env = process.env) {
   // #105 侧栏「bothouse」：读这份主桥配置的 [management] 段，在服务端转发管理面板（令牌不进浏览器）。
   const bridgeConfig = String(c.bridgeConfig ?? '').trim() || defaultBridgeConfig(env);
   if (!isAbsolute(bridgeConfig)) throw Error('conest-collab: bridgeConfig must be an absolute path');
-  return { dataDir: c.dataDir, workspacePath: c.workspacePath, leadFile, fallbackLead, boardDir, teamStatusDir, wikiDir, bridgeConfig, rooms, dshMembers: members, maxRelay, botTokenEnv, botToken, botPort, ownerName: c.ownerName ?? '我' };
+  return { dataDir: c.dataDir, workspacePath: c.workspacePath, leadFile, fallbackLead, boardDir, teamStatusDir, wikiDir, bridgeConfig, rooms, dshMembers: members, maxRelay, maxUploadBytes, botTokenEnv, botToken, botPort, ownerName: c.ownerName ?? '我' };
 }
 
 /** Resolve a package from the running DSH installation, never a second copy. */
@@ -139,8 +144,23 @@ export async function apply(ctx, rawConfig) {
   // #1019: a second DSH on the same data directory refuses to start the plugin instead of
   // sharing collab.sqlite3 (the panel's 「打开 DSH」 used to start one beside a running host).
   const lockPath = join(config.dataDir, LOCK_FILE);
-  const lock = InstanceLock.acquire(lockPath);
-  if (lock === undefined) throw Error(lockBusyMessage(lockPath));
+  // #216: the holder records who it is, so a second DSH can repeat the truth instead of
+  // telling the user to go and configure a service that is in fact running.
+  // #227: taking the lock and writing that record are one step: if the record cannot be
+  // written the lock is released before the error travels on. This DSH stays alive with the
+  // plugin stopped, and a lock nobody releases would shut the data directory to every later
+  // DSH while its page says "another DSH is using it".
+  const local = localConnection(ctx.webServer);
+  const lock = acquireLockWithOwner(lockPath, { pid: process.pid, startedAt: Date.now(), dataDir: config.dataDir, host: hostname(), local });
+  if (lock === undefined) {
+    // #216: this instance is a client of the holder, not a second data writer. Keep scoped
+    // routes alive rather than throwing out of apply; unloading the plugin removes them.
+    // #227: the two routes live in local-host.mjs so this branch can be tested without the
+    // DSH runtime (审稿 F2: nothing ever called it in a test).
+    mountSharedHost(ctx, lockPath);
+    ctx.logger.info('conest-collab: using the existing channel host for %s', config.dataDir);
+    return;
+  }
   // Teardown is registered before anything is opened, so a startup that fails half-way still
   // stops whatever it started; the lock is released last, after the store and the background
   // writers are closed, so no second host gets in while this one can still write.
@@ -161,6 +181,9 @@ export async function apply(ctx, rawConfig) {
     await r.dsh?.close();
     r.store?.close();
     lock.release();
+    // #216: the record goes with the lock, so a DSH that opens later is not told about a
+    // holder that already quit.
+    clearLockOwner(lockPath);
   }, 'conest-collab: teardown');
 
   // #1044: an install from before had the desk, panel and other-computers pages; checked before Store creates the file.
@@ -224,7 +247,7 @@ export async function apply(ctx, rawConfig) {
 
   // #131: a request the tailnet pairing listener authenticated with a device credential acts as
   // the owner; everything else still needs this DSH's own sign-in.
-  const owner = req => req[REMOTE_OWNER] === true || ctx.connection.requestRejection(req) === undefined;
+  const owner = req => req[REMOTE_OWNER] === true || isLocalOwner(req, local) || ctx.connection.requestRejection(req) === undefined;
   // Test-only overrides (same-machine two-instance check): address and port of the pairing listener.
   const pairAddr = String(process.env.CONEST_COLLAB_PAIR_ADDR ?? '').trim();
   const pairPort = Number(process.env.CONEST_COLLAB_PAIR_PORT) || PAIR_PORT;
@@ -290,7 +313,7 @@ export async function apply(ctx, rawConfig) {
     const url = new URL(req.url ?? '/', 'http://collab.invalid');
     const path = url.pathname.replace(/\/+$/, '');
     // A paired device reaches us on the tailnet listener; ticket URLs stay on this machine's own origin.
-    if (!req[REMOTE_OWNER]) later.origin ??= localOrigin(req);
+    if (!req[REMOTE_OWNER] && !isLocalOwner(req, local)) later.origin ??= localOrigin(req);
     const scheduled = laterRoute(req, res, url, { hub, gateway, owner, later });
     if (scheduled !== undefined) return scheduled;
     const routed = tasksRoute(req, res, url, { tasks, gateway, owner });
@@ -326,7 +349,8 @@ export async function apply(ctx, rawConfig) {
         rooms: store.roomsView().map(r => ({ ...r, lead_id: store.leadId(r.id), effective_lead_id: hub.primaryIn(r.id)?.id ?? null,
           workspace_path: store.workspacePath(r.id, config.workspacePath) })), members: hub.memberView(),
         thinking: Object.fromEntries([...hub.thinking].map(([k, v]) => [k, [...v]])),
-        queued: Object.fromEntries([...hub.queued.keys()].map(r => [r, hub.queueView(r)])) });
+        queued: Object.fromEntries([...hub.queued.keys()].map(r => [r, hub.queueView(r)])),
+        max_upload_bytes: config.maxUploadBytes });
     }
     if (path === '/collab/api/events' && req.method === 'GET') return events(req, res);
     if (path === '/collab/api/lead' && req.method === 'GET') {
@@ -343,6 +367,13 @@ export async function apply(ctx, rawConfig) {
         return { lead_id: id, effective_lead_id: hub.primaryMember()?.id ?? null };
       });
     }
+    // #197: one attachment streams straight to disk instead of riding base64 in the
+    // message JSON, so its cap no longer comes from MAX_MESSAGE_BODY. The bytes are
+    // the raw request body; the name and type travel in the query string because a
+    // header can not carry 中文. The browser posts the message with the returned
+    // metadata once every file of that message has arrived.
+    const streamed = streamUploadRoute(req, res, url, { files, maxBytes: config.maxUploadBytes });
+    if (streamed !== undefined) return streamed;
     const att = /^\/collab\/api\/attachments\/([0-9a-f-]{36})$/.exec(path);
     if (att !== null && req.method === 'GET') {
       const row = store.attachmentMeta(att[1]);
@@ -398,7 +429,8 @@ export async function apply(ctx, rawConfig) {
         const clientKey = typeof body?.client_key === 'string' && body.client_key ? `web:${body.client_key.slice(0, 64)}` : undefined;
         const roomId = Number(m[1]);
         if (store.room(roomId) === undefined) throw new CollabError('room-missing', `room ${roomId} does not exist`);
-        const attachments = files.save(body?.attachments);
+        // #197: ids from the streamed upload endpoint, or base64 from an older client/bot.
+        const attachments = files.receive(body?.attachments);
         const { message } = hub.post(roomId, { authorKind: 'user', author: OWNER, name: config.ownerName, text: String(body?.text ?? ''), clientKey,
           replyTo: Number.isInteger(body?.reply_to) ? body.reply_to : undefined, attachments });
         return { message: publicMessage(message, store) };
@@ -585,6 +617,31 @@ export function memberAvatarRoute(req, res, path, { roster, owner }) {
   }, req.method === 'POST', 512 * 1024);
 }
 
+/**
+ * #197: one attachment streams straight to disk instead of riding base64 in the message
+ * JSON, so its cap no longer comes from MAX_MESSAGE_BODY. The bytes are the raw request
+ * body; the name and type travel in the query string because a header can not carry 中文.
+ * The browser posts the message with the returned metadata once every file of that message
+ * has arrived.
+ *   POST /collab/api/attachments?name=…&mime=…  -> 201 { attachment } | 413/400 { error, code, max_upload_bytes }
+ * Owner authentication is checked by browserRoute before this handler, like ownMessageRoute.
+ */
+export function streamUploadRoute(req, res, url, { files, maxBytes }) {
+  // browserRoute normalizes trailing slashes before routing; do the same here so a stray one still lands.
+  if (url.pathname.replace(/\/+$/, '') !== '/collab/api/attachments' || req.method !== 'POST') return undefined;
+  const name = url.searchParams.get('name') ?? '';
+  const mime = url.searchParams.get('mime') ?? String(req.headers?.['content-type'] ?? '');
+  return files.saveStream(req, { name, mime, maxBytes }).then(
+    attachment => json(res, 201, { attachment }),
+    (error) => {
+      if (!(error instanceof CollabError)) throw error;
+      // Past the cap the rest of the body is drained, not cut, so the browser sees this reply
+      // rather than a reset connection (same trade as readBody).
+      return json(res, error.code === 'too-large' ? 413 : 400,
+        { error: error.message, code: error.code, max_upload_bytes: maxBytes });
+    });
+}
+
 /** Owner authentication is checked by browserRoute before this handler, like ownMessageRoute. */
 export function renameRoomRoute(req, res, path, { store, hub, dsh }) {
   const match = /^\/collab\/api\/rooms\/(\d+)$/.exec(path);
@@ -639,12 +696,10 @@ export function ownMessageRoute(req, res, path, { store, hub, gateway, dsh }) {
 /**
  * #597 G26: a later ticket only opens workspaces (and later). Sent anywhere else, say where to go
  * instead of a bare 401, so a member does not give up; the route's own auth is unchanged.
+ * #227: the split lives in local-host.mjs beside the routes that also use it; re-exported here
+ * because the task API has always published the sentence.
  */
-export const TICKET_WRONG_ROUTE = '这个接口不认 X-Later-Ticket 票据。建工作区请用 POST /collab/api/rooms/{id}/workspaces（同一个票据头，JSON: title, owner, reason），任务和十分钟看门会自动开，不用再调 /tasks。';
-function refuse(req, res) {
-  if (req.headers?.['x-later-ticket'] !== undefined) return json(res, 403, { error: TICKET_WRONG_ROUTE });
-  return json(res, 401, { error: 'unauthorized' });
-}
+export { TICKET_WRONG_ROUTE } from './local-host.mjs';
 
 /**
  * #139 B task API, for the owner's browser and for cloud-web bots. The browser
@@ -815,11 +870,10 @@ const ERROR_STATUS = { 'room-missing': 404, 'member-missing': 404, 'task-missing
 /** Parse a JSON body (unless `parse` is false), run fn, and map CollabError codes to HTTP statuses. */
 class BodyTooLarge extends Error {}
 
-// cc-connect send accepts attachments up to 50 MiB by default (DefaultMaxAttachmentSize in
-// bridge/core/api.go). Bot frames carry them base64-encoded (x4/3) plus JSON fields; 1 MiB of
-// headroom covers those. A smaller cap makes ws close the bot with 1009 after the sender
-// already reported success.
-const MAX_BOT_ATTACHMENT_BYTES = 50 * 1024 * 1024;
+// A bot frame carries attachments base64-encoded (x4/3) plus JSON fields; 1 MiB of
+// headroom covers those. A smaller cap makes ws close the bot with 1009 after the
+// sender already reported success. MAX_BOT_ATTACHMENT_BYTES lives in attachments.mjs
+// because #197 also uses it to decide which files are too big to send at all.
 export const BOT_WS_MAX_PAYLOAD = Math.ceil(MAX_BOT_ATTACHMENT_BYTES / 3) * 4 + 1024 * 1024;
 
 /** Parses a single `bytes=` range against size: undefined = serve whole body, null = unsatisfiable. */

package/collab/roster.mjs

@@ -96,7 +96,12 @@ export class Roster {
       }
       try {
         const avatar = m?.avatar && ['orange', 'whale', 'dragon', 'rainbow', 'lanxi'].includes(m.avatar) ? m.avatar : undefined;
-        const member = await this.create({ name, persona: m?.persona ?? '', ...(m?.cli ? { cli: m.cli } : {}), ...(m?.name_customized === undefined ? {} : { nameCustomized: Boolean(m.name_customized) }), ...(avatar ? { avatar } : {}) });
+        const base = { name, persona: m?.persona ?? '', ...(m?.cli ? { cli: m.cli } : {}), ...(m?.name_customized === undefined ? {} : { nameCustomized: Boolean(m.name_customized) }), ...(avatar ? { avatar } : {}) };
+        // The wizard pins a DSH-model role to the route its key belongs to (#1173); a host without that model
+        // still gets the role, on its default model.
+        const model = !m?.cli && m?.model?.provider && m?.model?.model ? { provider: String(m.model.provider), model: String(m.model.model) } : undefined;
+        const member = model === undefined ? await this.create(base)
+          : await this.create({ ...base, model }).catch(() => this.create(base));
         claimed.add(member.id);
         imported.push({ ...m, name: member.name, id: member.id });
         added.push(member.name);

package/collab/store.mjs

@@ -92,6 +92,8 @@ export class Store {
     this.closed = false;
     /** fn(roomId) when a workspace's sessions are dropped for a new claim (resetSessions). */
     this.sessionResets = [];
+    /** fn(roomId) when a workspace returns to the pool; bindings remain resumable. */
+    this.workspaceReleases = [];
     this.db.exec('PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;');
     let version = this.db.prepare('PRAGMA user_version').get().user_version;
     if (version > SCHEMA_VERSION) throw Error(`collab: store schema ${version} is newer than ${SCHEMA_VERSION}`);
@@ -550,7 +552,7 @@ export class Store {
    * workspace was claimed again, so a late release never frees the new claim. null = any claim.
    */
   releaseWorkspace(roomId, claim = null) {
-    return this.transaction(() => {
+    const released = this.transaction(() => {
       const ws = this.q.room.get(roomId);
       if (ws === undefined) throw new CollabError('room-missing', `room ${roomId} does not exist`);
       if (ws.kind !== 'workspace' || this.workspaceOwner(ws.id) == null) return false;
@@ -562,8 +564,14 @@ export class Store {
       this.db.prepare('UPDATE rooms SET free = 1, claim_bridge = 0 WHERE id = ?').run(ws.id);
       return true;
     });
+    if (released) {
+      for (const fn of this.workspaceReleases) fn(roomId);
+    }
+    return released;
   }
 
+  onWorkspaceRelease(fn) { this.workspaceReleases.push(fn); }
+
   /** Register fn(roomId), called when a workspace's sessions are dropped (resetSessions). */
   onSessionsReset(fn) { this.sessionResets.push(fn); }
 

package/collab/team-mode-rules.md

@@ -4,7 +4,7 @@
 - 聊天频道要保持畅通，大活交工作区：预计超过 10 分钟，或要改代码、跑测试、等命令的，谁接活谁这一轮写交接（副手被直接点名也一样）（至少写「用户原话」「总目标」「范围」三节和参照实现，范围每项写一行「改：…」；被退回按列出的一次补齐），跑 `ws-handoff <交接文件> "<任务>"`，不在聊天频道自己做；它不算开子 agent，不用另问用户；交出就结束本轮，不在本轮等或查进度，结果由工作区 [report] 转回。工作区里接到的活自己做。DSH 频道调 POST /collab/api/rooms/{聊天频道 id}/workspaces。一个工作区同一时间只做一件活，满 4 个就排队。
 - 聊天频道里对真人说人话：讲场景、短段落，默认不用表格、不贴代码，细节进子话题。
 - 同团队同平台成员在新频道默认可派；团队外成员才请用户发 `/bind <队友项目名>`，机器人自己发的 /bind 不生效。
-- 在工作区里要问用户或交结果：最后一条回复第一行写 [ask] 或 [report] 加 #任务板编号和「背景：」，再一行做了什么，再一行「要你做的：」，再一行「我加的：」（用户原话里没有、你加的设定，没有写「无」）；这四段贴到聊天频道，不写编号、代号、路径、表格；之后是细节，进子话题。在跑时有截图或阶段结果就 ws-up 推一条。
+- 在工作区里要问用户或交结果：最后一条回复第一行写 [ask] 或 [report] 加 #任务板编号和「背景：」，再一行做了什么，再一行「要你做的：」，再一行「我加的：」（用户原话里没有、你加的设定，没有写「无」）；这四段贴到聊天频道，不写编号、代号、路径、表格；之后是细节，进子话题。截图用 ws-up --image 推；文字进度不推。
 - 发 [ask] 后工作区让出、会话清空，用户回复后系统找空工作区带交接文件和答复接着做；交回最终 [report] 后系统自动标完成、清空会话、放回工作区。
 - 一个工作区同一时间只归一个聊天频道；挑空着的，都占着就新建。所有聊天频道共用同一组工作区1..n。
 - 收口（每小时合结果、发汇报）时，没收完、这一小时也没在动的活由收口的人当场暂停（`board pause <编号>`）：它让出工作区，那里没别的活就放回池子、清空会话；恢复时重新交活，先用空着的工作区。