coxpit 4.6.0 → 4.8.0

package/src/server.ts

@@ -1,19 +1,23 @@
-import { readFile, readdir } from 'node:fs/promises';
+import { readFile, readdir, realpath, stat } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolve as presolve, dirname as pdirname, join as pjoin } from 'node:path';
+import { resolve as presolve, dirname as pdirname, join as pjoin, sep as psep } from 'node:path';
 import { createRequire } from 'node:module';
 import { randomBytes } from 'node:crypto';
-import Fastify, { type FastifyInstance } from 'fastify';
+import Fastify, { type FastifyInstance, type FastifyReply } from 'fastify';
 import websocket from '@fastify/websocket';
 import { eq, inArray, and, like, desc } from 'drizzle-orm';
 import { authGate } from './auth';
+import {
+  authMode, authIsOpen, verifyKey, storeKey, signSession, SESSION_COOKIE,
+  clientKey, rateCheck, rateFail, rateReset, setupAllowed,
+} from './authkey';
 import { config } from './config';
 import { db } from './db';
 import { machines, repos, tasks, agentRuns, agentEvents, designCaptures, shareLinks, taskGroups } from './db/schema';
 import { BOOKMARKLET_JS } from './design';
 import { runShellOn, shq } from './exec';
-import { launchRun, cleanupRun, stopRun, getRunDiff, loadRunDocs, mergeRun, getRunTermInfo, steerRun, exportRun, prRun, integrateRuns, planFanout, reviewTask, syncRun, openWorkbench, spawnSubtasks, listSubtasks, resolveAgentToken, taskCloseRisk, launchGroupTask, isRunLive, askGroupCoordinator } from './orchestrator';
+import { launchRun, cleanupRun, stopRun, getRunDiff, loadRunDocs, mergeRun, getRunTermInfo, steerRun, exportRun, prRun, integrateRuns, planFanout, reviewTask, syncRun, openWorkbench, spawnSubtasks, listSubtasks, resolveAgentToken, taskCloseRisk, launchGroupTask, isRunLive, askGroupCoordinator, computeRunOutputs, normalizeOutputs, listReclaimableWorktrees, pruneWorktrees } from './orchestrator';
 import { openTerm } from './term';
 import { addSink, removeSink, broadcast } from './hub';
 import { getProvider, listProviders } from './providers';
@@ -50,6 +54,19 @@ function mdLiteHTML(src: string): string {
   return s;
 }
 
+/** 확장자 → content-type 추론(파일 미리보기용). 미지 = octet-stream. */
+function contentTypeFor(path: string): string {
+  const ext = (path.split('.').pop() ?? '').toLowerCase();
+  const map: Record<string, string> = {
+    png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif',
+    webp: 'image/webp', svg: 'image/svg+xml', bmp: 'image/bmp', ico: 'image/x-icon',
+    avif: 'image/avif', pdf: 'application/pdf', txt: 'text/plain; charset=utf-8',
+    md: 'text/plain; charset=utf-8', json: 'application/json', csv: 'text/csv; charset=utf-8',
+    html: 'text/html; charset=utf-8', htm: 'text/html; charset=utf-8',
+  };
+  return map[ext] ?? 'application/octet-stream';
+}
+
 /** 공유 페이지 Documents 섹션 — md 는 mdLiteHTML, html 은 sandbox iframe. */
 function shareDocsHTML(docs: Array<{ path: string; kind: string; content: string }>): string {
   if (!docs.length) return '';
@@ -167,9 +184,81 @@ export async function buildServer(): Promise<FastifyInstance> {
   // 무인증 헬스(외부 감시용)
   app.get('/api/health', async () => ({ ok: true, name: 'coxpit', version: config.version }));
 
-  // 플릿 보드(단일 페이지). 인증 게이트 적용됨.
+  // 플릿 보드(단일 페이지). 인증 게이트 적용됨(무인증 요청은 게이트가 login/setup 페이지로 응답).
   app.get('/', async (_req, reply) => reply.type('text/html').send(BOARD_HTML));
 
+  // ─── 접근키 인증(access-key) ────────────────────────────────────
+  // 요청이 tunnel/https 를 탔나 — Secure 쿠키 여부 결정용.
+  const isSecureReq = (req: { headers: Record<string, unknown> }): boolean => {
+    const proto = String(req.headers['x-forwarded-proto'] ?? '');
+    return proto.split(',')[0]!.trim() === 'https' || req.headers['cf-connecting-ip'] != null;
+  };
+  const REMEMBER_MS = 30 * 24 * 60 * 60 * 1000; // 30d
+  // 세션 쿠키 헤더 조립(라이브러리 없이). remember → Max-Age 30d, else 세션 쿠키.
+  const setSessionCookie = (
+    reply: FastifyReply, req: { headers: Record<string, unknown> }, remember: boolean,
+  ): void => {
+    const expiry = remember ? Date.now() + REMEMBER_MS : 0;
+    const value = signSession(expiry);
+    const parts = [
+      `${SESSION_COOKIE}=${encodeURIComponent(value)}`,
+      'Path=/', 'HttpOnly', 'SameSite=Lax',
+    ];
+    if (remember) parts.push(`Max-Age=${Math.floor(REMEMBER_MS / 1000)}`);
+    if (isSecureReq(req)) parts.push('Secure');
+    reply.header('set-cookie', parts.join('; '));
+  };
+  const socketIp = (req: { socket?: { remoteAddress?: string } }): string =>
+    String(req.socket?.remoteAddress ?? '');
+
+  // 첫 실행 셋업(anti-claim) — 셋업 토큰 일치 OR 진짜 로컬(loopback+no-fwd)만 허용.
+  // 키가 이미 있으면 409(단발). 성공 시 해시 저장 + 세션 쿠키.
+  app.post('/api/auth/setup', async (req, reply) => {
+    if (authMode().mode !== 'setup') return reply.code(409).send({ error: 'already configured' });
+    const b = (req.body ?? {}) as { key?: string; token?: string; remember?: boolean };
+    const key = String(b.key ?? '');
+    if (key.length < 6) return reply.code(400).send({ error: 'key too short', detail: 'use at least 6 characters' });
+    const gate = setupAllowed(req.headers as Record<string, unknown>, socketIp(req), String(b.token ?? ''));
+    if (!gate.ok) {
+      return reply.code(403).send({ error: 'setup not allowed', detail: 'paste the one-time setup token from the daemon log (this request is not local)' });
+    }
+    storeKey(key); // 평문 키는 절대 로그하지 않음
+    setSessionCookie(reply, req, b.remember === true);
+    return reply.code(201).send({ ok: true });
+  });
+
+  // 언락 — 상수시간 검증 + per-client 레이트리밋(백오프). 성공 시 세션 쿠키.
+  app.post('/api/auth/unlock', async (req, reply) => {
+    const m = authMode();
+    if (m.mode === 'disabled') return reply.send({ ok: true });
+    if (m.mode === 'setup') return reply.code(409).send({ error: 'not configured', detail: 'set an access key first' });
+    const id = clientKey(req.headers as Record<string, unknown>, socketIp(req));
+    const rc = rateCheck(id);
+    if (rc.blocked) {
+      const secs = Math.ceil(rc.retryMs / 1000);
+      return reply.code(429).send({ error: 'too many attempts', detail: `try again in ${secs}s` });
+    }
+    const b = (req.body ?? {}) as { key?: string; remember?: boolean };
+    if (verifyKey(String(b.key ?? ''), m)) {
+      rateReset(id);
+      setSessionCookie(reply, req, b.remember === true);
+      return reply.send({ ok: true });
+    }
+    const after = rateFail(id);
+    const detail = after.retryMs > 0
+      ? `wrong key — try again in ${Math.ceil(after.retryMs / 1000)}s`
+      : `wrong key — ${after.attemptsLeft} attempt(s) left`;
+    return reply.code(401).send({ error: 'wrong key', detail });
+  });
+
+  // 로그아웃 — 쿠키 제거(Max-Age=0).
+  app.post('/api/auth/logout', async (req, reply) => {
+    const parts = [`${SESSION_COOKIE}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0'];
+    if (isSecureReq(req)) parts.push('Secure');
+    reply.header('set-cookie', parts.join('; '));
+    return reply.send({ ok: true });
+  });
+
   // 보드 하이드레이션 — machines/repos/tasks/runs(+events)/captures 한 방에.
   // 기본 view=active: 닫힌 태스크·그 run·이벤트 전량을 내리지 않는다(수백 run 시 페이로드 폭발 방지).
   // 이벤트는 활성 run 당 최근 40개만(카드는 8, 모달은 전량 refetch). view=all 은 구버전 전량.
@@ -206,7 +295,8 @@ export async function buildServer(): Promise<FastifyInstance> {
       // authOpen = 비밀번호 미설정 → Funnel(공개) 가드가 켜져야 함(원격접근 카드용)
       daemon: {
         version: config.version, pid: process.pid, port: config.port, dbPath: config.dbPath,
-        authOpen: config.auth.disabled || config.auth.pass === '',
+        // authOpen = 인증이 실질 열려있음(disabled 또는 아직 키 미설정) → Funnel 가드 켜져야 함
+        authOpen: authIsOpen(),
       },
       providers: listProviders(),
     };
@@ -242,6 +332,23 @@ export async function buildServer(): Promise<FastifyInstance> {
     return { total: total0, rows };
   });
 
+  // 회수 가능한 고아 worktree — closed task 또는 failed/error/stopped run 의 worktree 만.
+  // running/preparing/pending/done 은 절대 포함 안 됨(활성·성공-미머지 보호). authGate 뒤.
+  app.get('/api/worktrees', async () => {
+    const items = await listReclaimableWorktrees();
+    const totalKb = items.reduce((s, w) => s + (w.sizeKb || 0), 0);
+    return { items, totalKb };
+  });
+
+  // 회수 실행 — body.runIds(선택 부분집합) 또는 전체. cleanupRun 재사용 + git worktree prune.
+  app.post('/api/worktrees/prune', async (req) => {
+    const b = (req.body ?? {}) as { runIds?: number[] };
+    const runIds = Array.isArray(b.runIds)
+      ? b.runIds.map((n) => Number(n)).filter((n) => Number.isInteger(n))
+      : undefined;
+    return pruneWorktrees(runIds);
+  });
+
   // ─── 머신 레지스트리 ────────────────────────────────────────────
   app.get('/api/machines', async () => ({ machines: await db.select().from(machines) }));
 
@@ -507,8 +614,12 @@ export async function buildServer(): Promise<FastifyInstance> {
   // ─── Design Mode ───────────────────────────────────────────────
   // 캡처 키: 인증 off 면 자유, on 이면 ?k=<COXPIT_AUTH_PASS> (북마클릿은 basic 헤더 불가)
   const captureKeyOk = (req: { query?: unknown }): boolean => {
-    if (config.auth.disabled || config.auth.pass === '') return config.auth.disabled;
-    return ((req.query ?? {}) as { k?: string }).k === config.auth.pass;
+    const m = authMode();
+    // 인증 꺼짐 → 자유. 아직 키 미설정(setup) → 캡처 불가(키가 없으니 증명 수단 없음).
+    if (m.mode === 'disabled') return true;
+    if (m.mode === 'setup') return false;
+    const k = ((req.query ?? {}) as { k?: string }).k ?? '';
+    return verifyKey(k, m);
   };
   const cors = (reply: { header: (k: string, v: string) => unknown }) => {
     reply.header('access-control-allow-origin', '*');
@@ -561,8 +672,8 @@ export async function buildServer(): Promise<FastifyInstance> {
   // Funnel has no Tailscale-side auth, so coxpit's basic auth is the only gate.
   app.post('/api/remote/funnel', async (req, reply) => {
     const b = (req.body ?? {}) as { on?: boolean };
-    if (b.on === true && (config.auth.disabled || config.auth.pass === '')) {
-      return reply.code(409).send({ error: 'set a password first', code: 'NO_AUTH' });
+    if (b.on === true && authIsOpen()) {
+      return reply.code(409).send({ error: 'set an access key first', code: 'NO_AUTH' });
     }
     return setFunnel(config.port, b.on === true);
   });
@@ -578,7 +689,7 @@ export async function buildServer(): Promise<FastifyInstance> {
   });
 
   app.post('/api/tasks', async (req, reply) => {
-    const b = (req.body ?? {}) as { repoId?: number; title?: string; prompt?: string; designCaptureId?: number };
+    const b = (req.body ?? {}) as { repoId?: number; title?: string; prompt?: string; designCaptureId?: number; outputs?: unknown };
     const repoId = Number(b.repoId);
     const title = (b.title ?? '').trim();
     if (!repoId || !title) return reply.code(400).send({ error: 'repoId and title required' });
@@ -590,7 +701,9 @@ export async function buildServer(): Promise<FastifyInstance> {
       if (!dc[0]) return reply.code(404).send({ error: 'design capture not found' });
       designCaptureId = dc[0].id;
     }
-    const ins = await db.insert(tasks).values({ repoId, title, prompt: b.prompt ?? '', designCaptureId }).returning();
+    // 산출물 계약(선택) — {answer,code,doc,page,file} 만 허용, 중복 제거, JSON 문자열로 저장.
+    const outputs = normalizeOutputs(b.outputs);
+    const ins = await db.insert(tasks).values({ repoId, title, prompt: b.prompt ?? '', designCaptureId, outputs: JSON.stringify(outputs) }).returning();
     return reply.code(201).send({ ok: true, task: ins[0] });
   });
 
@@ -791,6 +904,8 @@ export async function buildServer(): Promise<FastifyInstance> {
       runId: run.id, taskId: task.id, title: task.title, status: run.status,
       agent: run.agent, model: run.model, branch: run.branch, filesChanged: run.filesChanged,
       live: isRunLive(run.id), steerable: isSteerable(run),
+      // 수렴 콕핏 결정 행용: 태스크 닫힘 여부 + worktree 생존(터미널 가드·머지 가능성 판단).
+      taskStatus: task.status, hasWorktree: !!run.worktreePath,
     }));
     const runIds = g.rows.map((x) => x.run.id);
     // 이벤트: 그룹 run 전체에서 최근 200개(id 순, 오래된 것 먼저 — 방 피드는 append-only).
@@ -930,6 +1045,96 @@ export async function buildServer(): Promise<FastifyInstance> {
     return { ok: true, docs, source };
   });
 
+  // ─── 산출물 계약(v4.7 P1) — 카드 목록 · 뷰어 콘텐츠 · 파일 바이트 ──
+  // 카드 목록: computeRunOutputs 로 병합(매니페스트+git status+answer). 404 = run 없음.
+  app.get('/api/runs/:id/outputs', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+    if (!rr[0]) return reply.code(404).send({ error: 'not found' });
+    const outputs = await computeRunOutputs(id);
+    return { outputs };
+  });
+
+  // 뷰어 콘텐츠: answer/doc → md, page → html(둘 다 loadRunDocs 폴백 재사용).
+  // code 는 별도 콘텐츠 없음 — 클라이언트가 기존 /api/runs/:id/diff 를 재사용한다.
+  app.get('/api/runs/:id/output', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const q = (req.query ?? {}) as { type?: string; path?: string };
+    const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+    if (!rr[0]) return reply.code(404).send({ error: 'not found' });
+    const type = (q.type ?? '').trim();
+    if (type === 'answer') {
+      const cards = await computeRunOutputs(id);
+      const has = cards.some((c) => c.type === 'answer' && c.present);
+      const content = has ? (rr[0].exitSummary || '') : '';
+      // answer 본문은 result 이벤트가 원천 — exitSummary 는 그 클립(≤500자)이라 여기선 이벤트 우선.
+      const evs = await db.select().from(agentEvents).where(eq(agentEvents.runId, id));
+      let answer = content;
+      for (let i = evs.length - 1; i >= 0; i--) {
+        if (evs[i]!.kind !== 'result') continue;
+        try { const o = JSON.parse(evs[i]!.payload) as { result?: string }; if (typeof o.result === 'string' && o.result.trim()) { answer = o.result.trim(); break; } } catch { /* skip */ }
+      }
+      return { kind: 'md', content: answer };
+    }
+    if (type === 'doc' || type === 'page') {
+      const wantKind = type === 'doc' ? 'md' : 'html';
+      const { docs } = await loadRunDocs(id); // worktree→snapshot 폴백 내장
+      const path = (q.path ?? '').trim();
+      const doc = path ? docs.find((d) => d.path === path) : docs.find((d) => d.kind === wantKind);
+      if (!doc) return reply.code(404).send({ error: 'output not found' });
+      return { kind: doc.kind === 'html' ? 'html' : 'md', content: doc.content };
+    }
+    if (type === 'code') {
+      // code 는 콘텐츠 뷰어가 없다 — 컬러 diff 는 클라이언트가 /api/runs/:id/diff 로 재사용.
+      return { kind: 'diff', diffUrl: `/api/runs/${id}/diff` };
+    }
+    return reply.code(400).send({ error: 'type must be one of answer|doc|page|code' });
+  });
+
+  // 파일 바이트(NEW · 보안 임계) — 이미지/바이너리 미리보기용 raw bytes.
+  // 가드: worktree 루트 기준으로 path 를 해석하고, realpath 가 worktree 밖으로
+  // 벗어나면(.. / 절대경로 / 심볼릭링크 탈출) 거부. 크기 상한 ~10MB. worktree 소멸 후 404.
+  const FILE_MAX = 10 * 1024 * 1024;
+  app.get('/api/runs/:id/file', async (req, reply) => {
+    const id = Number((req.params as { id: string }).id);
+    const q = (req.query ?? {}) as { path?: string };
+    const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+    const run = rr[0];
+    if (!run) return reply.code(404).send({ error: 'not found' });
+    const rel = (q.path ?? '').trim();
+    if (!rel) return reply.code(400).send({ error: 'path required' });
+    // 절대경로 즉시 거부(worktree 밖 강제)
+    if (rel.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(rel)) return reply.code(400).send({ error: 'path must be relative' });
+    if (!run.worktreePath) return reply.code(404).send({ error: 'no worktree' });
+
+    // 원격 머신 파일은 데몬 파일시스템에 없다 — export 와 동일하게 로컬 전용.
+    const mr = await db.select().from(machines).where(eq(machines.id, run.machineId)).limit(1);
+    const mach = mr[0];
+    const isRemote = !!mach && mach.kind !== 'local' && (mach.address ?? '') !== '';
+    if (isRemote) return reply.code(400).send({ error: 'remote file preview not supported' });
+
+    // worktree 루트를 realpath 로 정규화(심링크 해소된 canonical base).
+    let rootReal: string;
+    try { rootReal = await realpath(run.worktreePath); }
+    catch { return reply.code(404).send({ error: 'worktree gone' }); }
+    // 요청 경로 = 루트에 join 후 realpath — 심링크 탈출까지 잡는다.
+    const joined = presolve(rootReal, rel);
+    let targetReal: string;
+    try { targetReal = await realpath(joined); }
+    catch { return reply.code(404).send({ error: 'file not found' }); }
+    // realpath 결과가 worktree 루트 하위가 아니면 탈출 — 거부.
+    const rootWithSep = rootReal.endsWith(psep) ? rootReal : rootReal + psep;
+    if (targetReal !== rootReal && !targetReal.startsWith(rootWithSep)) {
+      return reply.code(403).send({ error: 'path escapes the worktree' });
+    }
+    let st;
+    try { st = await stat(targetReal); } catch { return reply.code(404).send({ error: 'file not found' }); }
+    if (!st.isFile()) return reply.code(404).send({ error: 'not a file' });
+    if (st.size > FILE_MAX) return reply.code(413).send({ error: 'file too large (>10MB)' });
+    const buf = await readFile(targetReal);
+    return reply.type(contentTypeFor(rel)).send(buf);
+  });
+
   // ─── 에이전트 셀프 오케스트레이션 (run 별 Bearer 토큰 — authGate 예외, 여기서 자체 검증) ──
   const agentAuth = (req: { headers: { authorization?: string } }): number | null => {
     const h = req.headers.authorization ?? '';
@@ -1043,7 +1248,13 @@ export async function buildServer(): Promise<FastifyInstance> {
     const rows = Math.max(5, Math.min(200, Number(q.rows) || 24));
     const info = await getRunTermInfo(id);
     if (!info) {
-      socket.send(JSON.stringify({ t: 'err', d: 'run or tmux session not found' }));
+      // tmuxWindow 가 없음 = 세션이 정리됐거나(닫힌 task·cleanup) run 미존재.
+      // 죽은 세션에 attach 를 시도하지 말고 명확한 사유로 닫는다.
+      const rr = await db.select().from(agentRuns).where(eq(agentRuns.id, id)).limit(1);
+      const d = rr[0]
+        ? 'terminal unavailable — worktree cleaned (run closed or cleaned up)'
+        : 'run not found';
+      socket.send(JSON.stringify({ t: 'err', d }));
       socket.close();
       return;
     }