deepccc 0.2.3 → 0.2.5

package/dist/web-runtime.js

@@ -1,9 +1,13 @@
 import { randomUUID } from "node:crypto";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { AttachmentStore, buildAttachmentPrompt, detectImageMime, MAX_ATTACHMENTS_PER_MESSAGE, MAX_ATTACHMENT_BYTES, } from "./attachments.js";
 import { ChatSession } from "./index.js";
-import { readBuiltinContextState } from "./context.js";
+import { DEFAULT_BUILTIN_CONTEXT_DIR, normalizeBuiltinSessionId, readBuiltinContextState } from "./context.js";
 import { WebSessionStore, } from "./web-session-store.js";
 export class DeepCccWebRuntime {
     store;
+    attachmentStore;
     loadConfig;
     sessionFactory;
     approvalTimeoutMs;
@@ -11,12 +15,18 @@ export class DeepCccWebRuntime {
     idFactory;
     agents = new Map();
     activeRuns = new Map();
+    startingRuns = new Map();
+    sessionMutations = new Set();
     events = new Map();
     listeners = new Map();
+    globalListeners = new Set();
     approvals = new Map();
     nextEventId = 1;
     constructor(options) {
         this.store = options.store ?? new WebSessionStore();
+        this.attachmentStore = options.attachmentStore ?? new AttachmentStore(resolve(this.store.rootDir) === resolve(DEFAULT_BUILTIN_CONTEXT_DIR)
+            ? {}
+            : { rootDir: join(this.store.rootDir, ".attachments") });
         this.loadConfig = options.loadConfig;
         this.approvalTimeoutMs = options.approvalTimeoutMs ?? 5 * 60_000;
         this.now = options.now ?? (() => new Date());
@@ -70,48 +80,134 @@ export class DeepCccWebRuntime {
         };
     }
     async updateSession(sessionId, patch) {
-        if (this.activeRuns.has(sessionId))
-            throw new Error("Cannot change session settings while the Agent is running");
-        const updated = await this.store.update(sessionId, patch);
-        this.agents.delete(sessionId);
-        this.emit(sessionId, "session_updated", updated);
-        return updated;
+        if (this.activeRuns.has(sessionId) || this.startingRuns.has(sessionId) || this.sessionMutations.has(sessionId)) {
+            throw new Error("Cannot change session settings while another session operation is running");
+        }
+        this.sessionMutations.add(sessionId);
+        try {
+            const updated = await this.store.update(sessionId, patch);
+            this.agents.delete(sessionId);
+            this.emit(sessionId, "session_updated", updated);
+            return updated;
+        }
+        finally {
+            this.sessionMutations.delete(sessionId);
+        }
     }
     async deleteSession(sessionId) {
-        if (this.activeRuns.has(sessionId))
+        if (this.activeRuns.has(sessionId) || this.startingRuns.has(sessionId) || this.sessionMutations.has(sessionId)) {
             throw new Error("Stop the running session before deleting it");
-        this.agents.delete(sessionId);
-        this.events.delete(sessionId);
-        return this.store.delete(sessionId);
+        }
+        this.sessionMutations.add(sessionId);
+        try {
+            this.agents.delete(sessionId);
+            const deleted = await this.store.delete(sessionId);
+            if (deleted) {
+                await this.attachmentStore.deleteSession(sessionId);
+                this.emit(sessionId, "session_deleted", { sessionId });
+                this.events.delete(sessionId);
+            }
+            return deleted;
+        }
+        finally {
+            this.sessionMutations.delete(sessionId);
+        }
     }
-    async sendMessage(sessionId, text) {
-        const prompt = text.trim();
-        if (!prompt)
+    async sendMessage(sessionId, text, attachmentIds = []) {
+        const displayPrompt = text.trim();
+        const uniqueAttachmentIds = [...new Set(attachmentIds)];
+        if (uniqueAttachmentIds.length > MAX_ATTACHMENTS_PER_MESSAGE) {
+            throw new Error(`A message can include at most ${MAX_ATTACHMENTS_PER_MESSAGE} images`);
+        }
+        if (!displayPrompt && !uniqueAttachmentIds.length)
             throw new Error("Message must not be empty");
-        if (this.activeRuns.has(sessionId))
+        const controller = new AbortController();
+        if (this.activeRuns.has(sessionId) || this.startingRuns.has(sessionId) || this.sessionMutations.has(sessionId)) {
             throw new Error("This session is already running");
-        let meta = await this.requireSession(sessionId);
-        if (meta.title === "新会话" || meta.title === "New session" || meta.title === meta.cwd.split(/[\\/]/).at(-1)) {
-            meta = await this.store.update(sessionId, { title: prompt.replace(/\s+/g, " ").slice(0, 42) });
         }
-        const runId = `run-${this.idFactory()}`;
-        const controller = new AbortController();
-        this.events.set(sessionId, []);
-        this.emit(sessionId, "user", { text: prompt });
-        this.emit(sessionId, "run_started", { runId });
-        const promise = this.run(meta, prompt, runId, controller.signal)
-            .finally(() => this.activeRuns.delete(sessionId));
-        this.activeRuns.set(sessionId, { runId, controller, promise });
-        void promise.catch(() => { });
-        return { runId };
+        this.startingRuns.set(sessionId, controller);
+        try {
+            let meta = await this.requireSession(sessionId);
+            const attachments = [];
+            for (const attachmentId of uniqueAttachmentIds) {
+                const attachment = await this.attachmentStore.get(sessionId, attachmentId);
+                if (!attachment)
+                    throw new Error(`Image attachment not found: ${attachmentId}`);
+                attachments.push(attachment);
+            }
+            const prompt = buildAttachmentPrompt(displayPrompt, attachments);
+            if (meta.title === "新会话" || meta.title === "New session" || meta.title === meta.cwd.split(/[\\/]/).at(-1)) {
+                const title = displayPrompt || attachments.map((attachment) => attachment.originalName).join(", ") || "图片任务";
+                meta = await this.store.update(sessionId, { title: title.replace(/\s+/g, " ").slice(0, 42) });
+            }
+            if (controller.signal.aborted)
+                throw new DOMException("The session start was stopped", "AbortError");
+            const runId = `run-${this.idFactory()}`;
+            this.events.set(sessionId, []);
+            this.emit(sessionId, "user", { text: displayPrompt || "请分析这些图片。", attachments });
+            const promise = Promise.resolve()
+                .then(() => this.run(meta, prompt, runId, controller.signal))
+                .finally(() => {
+                this.activeRuns.delete(sessionId);
+                this.emit(sessionId, "session_updated", { sessionId, status: "idle" });
+            });
+            this.activeRuns.set(sessionId, { runId, controller, promise });
+            this.emit(sessionId, "run_started", { runId });
+            void promise.catch(() => { });
+            return { runId };
+        }
+        finally {
+            this.startingRuns.delete(sessionId);
+        }
     }
     async stopSession(sessionId) {
         const active = this.activeRuns.get(sessionId);
-        if (!active)
+        const starting = this.startingRuns.get(sessionId);
+        if (!active && !starting)
             return false;
+        starting?.abort();
+        if (!active)
+            return true;
         active.controller.abort();
+        const pending = [...this.approvals.entries()]
+            .filter(([, waiter]) => waiter.approval.sessionId === sessionId);
+        await Promise.all(pending.map(([approvalId, waiter]) => this.finishApproval(approvalId, waiter, "deny", { stopped: true }).catch(() => { })));
         return true;
     }
+    async addAttachment(sessionId, input) {
+        await this.requireSession(sessionId);
+        return this.attachmentStore.save(sessionId, input);
+    }
+    async readAttachment(sessionId, attachmentId) {
+        await this.requireSession(sessionId);
+        return this.attachmentStore.read(sessionId, attachmentId);
+    }
+    async deleteAttachment(sessionId, attachmentId) {
+        await this.requireSession(sessionId);
+        return this.attachmentStore.delete(sessionId, attachmentId);
+    }
+    async readArtifact(sessionId, value) {
+        const meta = await this.requireSession(sessionId);
+        const path = await realpath(resolve(value)).catch(() => null);
+        if (!path)
+            return null;
+        const workspaceRoot = await realpath(meta.cwd).catch(() => resolve(meta.cwd));
+        const attachmentDir = join(this.attachmentStore.rootDir, normalizeBuiltinSessionId(sessionId));
+        const attachmentRoot = await realpath(attachmentDir).catch(() => resolve(attachmentDir));
+        if (!isPathInside(workspaceRoot, path) && !isPathInside(attachmentRoot, path)) {
+            throw new Error("Artifact path is outside the session workspace and attachment directory");
+        }
+        const info = await stat(path).catch(() => null);
+        if (!info?.isFile())
+            return null;
+        if (info.size > MAX_ATTACHMENT_BYTES)
+            throw new Error("Artifact image exceeds the 20 MB limit");
+        const bytes = await readFile(path);
+        const mimeType = detectImageMime(bytes);
+        if (!mimeType)
+            throw new Error("Artifact is not a supported PNG, JPEG, or WebP image");
+        return { path, mimeType, size: bytes.length, bytes };
+    }
     async waitForIdle(sessionId) {
         await this.activeRuns.get(sessionId)?.promise;
     }
@@ -119,11 +215,7 @@ export class DeepCccWebRuntime {
         const waiter = this.approvals.get(approvalId);
         if (!waiter)
             return false;
-        clearTimeout(waiter.timeout);
-        this.approvals.delete(approvalId);
-        await this.store.resolveApproval(waiter.approval.sessionId, approvalId, answer);
-        waiter.resolve(answer);
-        this.emit(waiter.approval.sessionId, "approval_resolved", { approvalId, answer });
+        await this.finishApproval(approvalId, waiter, answer);
         return true;
     }
     subscribe(sessionId, listener) {
@@ -136,6 +228,10 @@ export class DeepCccWebRuntime {
                 this.listeners.delete(sessionId);
         };
     }
+    subscribeAll(listener) {
+        this.globalListeners.add(listener);
+        return () => this.globalListeners.delete(listener);
+    }
     async run(meta, prompt, runId, signal) {
         try {
             const agent = this.agents.get(meta.sessionId) ?? this.createAgent(meta);
@@ -167,33 +263,60 @@ export class DeepCccWebRuntime {
             createdAt: this.now().toISOString(),
         };
         return new Promise((resolve) => {
+            const ready = this.store.addApproval(sessionId, {
+                ...approval,
+                status: "pending",
+            });
+            let waiter;
             const timeout = setTimeout(() => {
-                this.approvals.delete(approvalId);
-                void this.store.resolveApproval(sessionId, approvalId, "deny").finally(() => {
-                    resolve("deny");
-                    this.emit(sessionId, "approval_resolved", { approvalId, answer: "deny", timedOut: true });
-                });
+                void this.finishApproval(approvalId, waiter, "deny", { timedOut: true }).catch(() => { });
             }, this.approvalTimeoutMs);
             timeout.unref?.();
-            void this.store.addApproval(sessionId, {
-                ...approval,
-                status: "pending",
-            }).then(() => {
-                this.approvals.set(approvalId, { approval, resolve, timeout });
+            waiter = { approval, resolve, timeout, ready };
+            this.approvals.set(approvalId, waiter);
+            void ready.then(() => {
+                if (this.approvals.get(approvalId) !== waiter)
+                    return;
                 this.emit(sessionId, "approval", approval);
             }).catch(() => {
+                if (this.approvals.get(approvalId) !== waiter)
+                    return;
                 clearTimeout(timeout);
                 this.approvals.delete(approvalId);
                 resolve("deny");
             });
         });
     }
+    async finishApproval(approvalId, waiter, answer, extra = {}) {
+        if (this.approvals.get(approvalId) !== waiter)
+            return;
+        clearTimeout(waiter.timeout);
+        this.approvals.delete(approvalId);
+        try {
+            await waiter.ready;
+            await this.store.resolveApproval(waiter.approval.sessionId, approvalId, answer);
+        }
+        finally {
+            waiter.resolve(answer);
+            this.emit(waiter.approval.sessionId, "approval_resolved", { approvalId, answer, ...extra });
+        }
+    }
     emit(sessionId, type, data) {
-        const event = { eventId: this.nextEventId++, at: this.now().toISOString(), type, data };
+        const event = { eventId: this.nextEventId++, sessionId, at: this.now().toISOString(), type, data };
         const events = [...(this.events.get(sessionId) ?? []), event].slice(-500);
         this.events.set(sessionId, events);
-        for (const listener of this.listeners.get(sessionId) ?? [])
-            listener(event);
+        this.notifyListeners(this.listeners.get(sessionId) ?? [], event);
+        if (["run_started", "run_finished", "session_updated", "session_deleted"].includes(type)) {
+            this.notifyListeners(this.globalListeners, event);
+        }
+    }
+    notifyListeners(listeners, event) {
+        for (const listener of listeners) {
+            try {
+                listener(event);
+            }
+            catch { /* a disconnected SSE client must not affect the Agent run */ }
+        }
     }
     async requireSession(sessionId) {
         const meta = await this.store.get(sessionId);
@@ -202,3 +325,7 @@ export class DeepCccWebRuntime {
         return meta;
     }
 }
+function isPathInside(root, candidate) {
+    const rel = relative(resolve(root), resolve(candidate));
+    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}

package/dist/web-server.d.ts

@@ -19,7 +19,7 @@ export interface PublicDeepCccConfig {
     defaultCwd?: string;
 }
 export interface DeepCccWebRequestHandlerOptions {
-    runtime: Pick<DeepCccWebRuntime, "listSessions" | "createSession" | "getSession" | "updateSession" | "deleteSession" | "sendMessage" | "stopSession" | "resolveApproval" | "subscribe">;
+    runtime: Pick<DeepCccWebRuntime, "listSessions" | "createSession" | "getSession" | "updateSession" | "deleteSession" | "sendMessage" | "stopSession" | "resolveApproval" | "subscribe" | "subscribeAll" | "addAttachment" | "readAttachment" | "deleteAttachment" | "readArtifact">;
     getPublicConfig: () => PublicDeepCccConfig;
     saveConfig: (patch: DeepCccConfigPatch) => Promise<PublicDeepCccConfig> | PublicDeepCccConfig;
     defaultCwd: string;

package/dist/web-server.js

@@ -6,6 +6,7 @@ import { stat } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { MAX_ATTACHMENT_BYTES } from "./attachments.js";
 import { DEEPCCC_HOME, loadConfig, saveConfigPatch, } from "./config.js";
 import { killProcessTree } from "./proc-tree-kill.js";
 import { DeepCccWebRuntime } from "./web-runtime.js";
@@ -84,6 +85,9 @@ export function createDeepCccWebRequestHandler(options) {
             if (method === "GET" && path === "/api/sessions") {
                 return jsonReply(res, 200, { ok: true, sessions: await options.runtime.listSessions() });
             }
+            if (method === "GET" && path === "/api/events") {
+                return openGlobalEventStream(req, res, options.runtime);
+            }
             if (method === "POST" && path === "/api/sessions") {
                 const body = await readJson(req);
                 const cwd = body.cwd?.trim() || options.defaultCwd;
@@ -91,6 +95,37 @@ export function createDeepCccWebRequestHandler(options) {
                 const session = await options.runtime.createSession({ ...body, cwd });
                 return jsonReply(res, 201, { ok: true, session });
             }
+            const attachmentMatch = path.match(/^\/api\/sessions\/([^/]+)\/attachments(?:\/([^/]+))?$/);
+            if (attachmentMatch) {
+                const sessionId = decodeURIComponent(attachmentMatch[1]);
+                const attachmentId = attachmentMatch[2] ? decodeURIComponent(attachmentMatch[2]) : "";
+                if (method === "POST" && !attachmentId) {
+                    const originalName = url.searchParams.get("name")?.trim() || "image";
+                    const bytes = await readBinary(req, MAX_ATTACHMENT_BYTES);
+                    const attachment = await options.runtime.addAttachment(sessionId, { originalName, bytes });
+                    return jsonReply(res, 201, { ok: true, attachment });
+                }
+                if (method === "GET" && attachmentId) {
+                    const stored = await options.runtime.readAttachment(sessionId, attachmentId);
+                    if (!stored)
+                        return jsonReply(res, 404, { ok: false, error: "Image attachment not found" });
+                    return binaryReply(res, 200, stored.bytes, stored.attachment.mimeType, stored.attachment.originalName);
+                }
+                if (method === "DELETE" && attachmentId) {
+                    const deleted = await options.runtime.deleteAttachment(sessionId, attachmentId);
+                    return jsonReply(res, deleted ? 200 : 404, { ok: deleted });
+                }
+            }
+            const artifactMatch = path.match(/^\/api\/sessions\/([^/]+)\/artifact$/);
+            if (artifactMatch && method === "GET") {
+                const artifactPath = url.searchParams.get("path") ?? "";
+                if (!artifactPath)
+                    throw new WebHttpError(400, "Artifact path is required");
+                const artifact = await options.runtime.readArtifact(decodeURIComponent(artifactMatch[1]), artifactPath);
+                if (!artifact)
+                    return jsonReply(res, 404, { ok: false, error: "Artifact image not found" });
+                return binaryReply(res, 200, artifact.bytes, artifact.mimeType, artifact.path.split(/[\\/]/).at(-1) ?? "image");
+            }
             const sessionMatch = path.match(/^\/api\/sessions\/([^/]+)$/);
             if (sessionMatch && method === "GET") {
                 return jsonReply(res, 200, { ok: true, session: await options.runtime.getSession(decodeURIComponent(sessionMatch[1])) });
@@ -112,7 +147,10 @@ export function createDeepCccWebRequestHandler(options) {
             const messagesMatch = path.match(/^\/api\/sessions\/([^/]+)\/messages$/);
             if (messagesMatch && method === "POST") {
                 const body = await readJson(req);
-                const result = await options.runtime.sendMessage(decodeURIComponent(messagesMatch[1]), body.text ?? "");
+                const attachmentIds = Array.isArray(body.attachmentIds)
+                    ? body.attachmentIds.filter((value) => typeof value === "string")
+                    : [];
+                const result = await options.runtime.sendMessage(decodeURIComponent(messagesMatch[1]), body.text ?? "", attachmentIds);
                 return jsonReply(res, 202, { ok: true, ...result });
             }
             const stopMatch = path.match(/^\/api\/sessions\/([^/]+)\/stop$/);
@@ -265,6 +303,20 @@ function openEventStream(req, res, sessionId, runtime) {
     heartbeat.unref?.();
     req.on("close", () => { clearInterval(heartbeat); unsubscribe(); });
 }
+function openGlobalEventStream(req, res, runtime) {
+    res.writeHead(200, {
+        "content-type": "text/event-stream; charset=utf-8",
+        "cache-control": "no-cache, no-transform",
+        connection: "keep-alive",
+        "x-accel-buffering": "no",
+    });
+    res.write(": connected\n\n");
+    const send = (event) => res.write(`id: ${event.eventId}\ndata: ${JSON.stringify(event)}\n\n`);
+    const unsubscribe = runtime.subscribeAll(send);
+    const heartbeat = setInterval(() => res.write(": heartbeat\n\n"), 15_000);
+    heartbeat.unref?.();
+    req.on("close", () => { clearInterval(heartbeat); unsubscribe(); });
+}
 async function readJson(req) {
     const chunks = [];
     let bytes = 0;
@@ -284,6 +336,20 @@ async function readJson(req) {
         throw new WebHttpError(400, "Invalid JSON body");
     }
 }
+async function readBinary(req, maxBytes) {
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > maxBytes)
+            throw new WebHttpError(413, "Image attachment exceeds the 20 MB limit");
+        chunks.push(buffer);
+    }
+    if (!chunks.length)
+        throw new WebHttpError(400, "Image attachment must not be empty");
+    return Buffer.concat(chunks);
+}
 async function assertDirectory(path) {
     try {
         if (!(await stat(path)).isDirectory())
@@ -307,6 +373,16 @@ function textReply(res, status, value, contentType) {
     res.writeHead(status, { "content-type": contentType, "cache-control": "no-store" });
     res.end(value);
 }
+function binaryReply(res, status, value, contentType, fileName) {
+    res.writeHead(status, {
+        "content-type": contentType,
+        "content-length": String(value.byteLength),
+        "content-disposition": `inline; filename*=UTF-8''${encodeURIComponent(fileName)}`,
+        "cache-control": "no-store",
+        "x-content-type-options": "nosniff",
+    });
+    res.end(value);
+}
 class WebHttpError extends Error {
     status;
     constructor(status, message) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepccc",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "A lightweight coding agent with OpenAI-compatible and Anthropic Messages API support.",
   "license": "Apache-2.0",
   "keywords": [