geneseed 3.14.0 → 3.16.0

package/js/web/handler.mjs

@@ -16,20 +16,16 @@ import { isTruthy, jsonDumpsCompact } from '../lib/json.mjs';
 import { parseIntStrict, percentDecode } from '../lib/text.mjs';
 import { preflight } from '../maintain/update.mjs';
 import { apiDeployCmd, apiInstallCmd, apiPickFolder, apiRestore, buildOverride, mcpTargetPaths } from './actions.mjs';
-import { NotFound, PREFIX_ROUTES, STATE_ROUTES } from './api.mjs';
+import { NotFound } from './catalog.mjs';
 import { openUrl, requestRestart } from './daemon.mjs';
 import { apiDocs, apiDocsPage } from './docs.mjs';
 import { actionCommands } from './jobs.mjs';
-import { POST_ROUTES, readJsonBody } from './routes.mjs';
+import { POST_ROUTES, PREFIX_ROUTES, STATE_ROUTES, readJsonBody } from './routes.mjs';
 import { isFile } from '../lib/fs.mjs';
 import { readFileSync, statSync } from 'node:fs';
 import { basename, dirname, extname, join, sep } from 'node:path';
 import { gzipSync } from 'node:zlib';
 
-// `isFile` is owned by `js/lib/fs.mjs` now (single owner). Re-exported here so
-// `js/web/server.mjs`'s existing `import { isFile, ... } from './handler.mjs'` keeps working.
-export { isFile };
-
 /**
  * DNS-rebinding guard. `h.split(":", 1)[0]` keeps everything before the FIRST colon, so
  * `localhost:4747` passes and a bare IPv6 literal would not — which is what the `[::1]`
@@ -45,6 +41,15 @@ const GZIP_TYPES = ['application/json', 'text/', 'image/svg+xml',
   'application/manifest+json', 'application/javascript'];
 const GZIP_MIN = 1024;
 
+/**
+ * The largest POST body read, in bytes. Every real body is a few KB of JSON (a rule, a profile,
+ * a path); without a cap any web page could `no-cors` POST an arbitrary blob and this process
+ * would buffer all of it before the token check refused it.
+ */
+export const MAX_BODY = 1024 * 1024;
+
+const BUSY = { error: 'a job is running — wait for it to finish (or cancel it) first' };
+
 const CTYPES = {
   '.html': 'text/html', '.js': 'text/javascript',
   '.css': 'text/css', '.json': 'application/json',
@@ -126,7 +131,11 @@ export function makeHandler(state, jm, token, dist, holder = null) {
   function doGet(req, res, path, ae) {
     const route = STATE_ROUTES[path];
     if (route !== undefined) return sendJson(res, route(state), 200, ae);
-    if (path === '/api/ping') return sendJson(res, { ok: true, theme: state.theme }, 200, ae);
+    // `pid` is what a restarting client waits on: the OLD server keeps answering this ping for
+    // a moment after `/api/restart` returns, and a reload onto it fetches the old token.
+    if (path === '/api/ping') {
+      return sendJson(res, { ok: true, theme: state.theme, pid: process.pid }, 200, ae);
+    }
     for (const [prefix, handler] of PREFIX_ROUTES) {
       if (path.startsWith(prefix)) return sendJson(res, handler(state, path), 200, ae);
     }
@@ -148,14 +157,22 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     return serveStatic(res, path, ae);
   }
 
-  function doPost(req, res, path, ae, body) {
+  /** The Host and token guards, answered BEFORE a byte of the body is read. `true` = refused. */
+  function refusePost(req, res, ae) {
     if (!localHost(req.headers.host)) {
-      return sendJson(res, { error: 'forbidden host' }, 403, ae);
+      sendJson(res, { error: 'forbidden host' }, 403, ae);
+      return true;
     }
     if (req.headers['x-geneseed-token'] !== token) {
-      return sendJson(res, { error: 'forbidden' }, 403, ae);
+      sendJson(res, { error: 'forbidden' }, 403, ae);
+      return true;
     }
+    return false;
+  }
+
+  function doPost(req, res, path, ae, body) {
     if (path === '/api/shutdown') {
+      if (jm.busy) return sendJson(res, BUSY, 409, ae);
       // The one POST route the SHELL owns. It must answer BEFORE it stops, so closing is
       // deferred to `res.on('finish', ...)` so the response flushes first.
       // `closeAllConnections` is the other half: `close()` alone waits for idle keep-alive
@@ -167,18 +184,17 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       return sendJson(res, { stopping: true }, 200, ae);
     }
     if (path === '/api/restart') {
-      // THE ONE ROUTE IN THIS FILE NO TEST MAY REACH, and it is declared rather than probed.
-      // `requestRestart` spawns a DETACHED `web restart`, which stops whatever daemon the
-      // record names and starts a fresh one that outlives the caller. Actually driving this
-      // route from a test would either stop the test's own server or, worse, orphan a real
-      // daemon that binds 4747 and serves the checkout forever in the developer's own
-      // environment.
-      //
-      // So the gate asserts this dispatches to `requestRestart(state.theme)` directly rather
-      // than by hitting the route through a live request — a declaration is not normally
-      // enough to stand in for a dispatcher, but here probing the dispatcher costs more than
-      // the assurance is worth.
-      requestRestart(state.theme);
+      // THE SUCCESS ARM NO TEST MAY REACH. `requestRestart` spawns a DETACHED `web restart`,
+      // which stops whatever daemon the record names and starts a fresh one that outlives the
+      // caller — driven from a test, it would orphan a real daemon on 4747 in the developer's
+      // own environment. Its two REFUSALS are reachable and probed: a running job (409, it
+      // would be orphaned), and a server that is not the recorded daemon (409, see
+      // `requestRestart`) — which a test's server never is.
+      if (jm.busy) return sendJson(res, BUSY, 409, ae);
+      if (!requestRestart(state.theme)) {
+        return sendJson(res,
+          { error: 'foreground server: restart it from its terminal' }, 409, ae);
+      }
       return sendJson(res, { restarting: true }, 200, ae);
     }
     if (path === '/api/reveal') {
@@ -277,6 +293,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
         return sendJson(res,
           { precondition: pre.code, kind: pre.kind, message: pre.message }, 422, ae);
       }
+      // `requestRestart` declines on a foreground server, which then shows its stale banner.
       const jid = jm.start('update', actionCommands('update'), (rc) => {
         state.refresh();
         if (rc === 0) requestRestart(state.theme);
@@ -336,12 +353,19 @@ export function makeHandler(state, jm, token, dist, holder = null) {
         }
       }
       if (req.method === 'POST') {
-        // The body is drained before routing regardless of what the route needs it for:
-        // `readJsonBody` needs the bytes for a real POST body, and Node's own HTTP parser
-        // owns the message boundary anyway — unread bytes are discarded when the response
-        // ends rather than mis-parsed as the next request line, so this is where the bytes
-        // have to come from either way.
+        // GUARDS FIRST, BODY SECOND. The Host and token checks need no body, so they answer
+        // before one is read — a refused request is DISCARDED (`resume`, nothing buffered), never
+        // collected. A body over `MAX_BODY` is refused on its declared length, and the socket is
+        // closed rather than drained. Otherwise the body is buffered before routing regardless
+        // of what the route needs it for: Node's parser owns the message boundary, so unread
+        // bytes are discarded when the response ends rather than mis-parsed as the next request.
+        if (refusePost(req, res, ae)) return req.resume();
         const length = parseIntStrict(String(req.headers['content-length'] ?? '')) ?? 0;
+        if (length > MAX_BODY) {
+          res.setHeader('Connection', 'close');
+          sendJson(res, { error: `request body over ${MAX_BODY} bytes` }, 413, ae);
+          return req.resume();
+        }
         return readBody(req, length, (buf) => {
           req._body = buf;
           try {

package/js/web/jobs.mjs

@@ -91,6 +91,7 @@ import { setupBuildArgs } from '../build/generate.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { isDict } from '../hosts/mcp.mjs';
 import { readText, writeText, isFile } from '../lib/fs.mjs';
+import { which } from '../lib/paths.mjs';
 import { jsonDumpsCompact, parseJson, isTruthy } from '../lib/json.mjs';
 
 /**
@@ -103,7 +104,10 @@ function killJobTree(child) {
   try {
     if (process.platform === 'win32') {
       // The one machine primitive with no Node equivalent — see this module's header.
-      spawnSync('taskkill', ['/T', '/F', '/PID', String(child.pid)], {
+      // `which`, never a bare name (cwd-first on Windows); none on PATH → `child.kill()` below.
+      const taskkill = which('taskkill');
+      if (!taskkill) throw new Error('taskkill not on PATH');
+      spawnSync(taskkill, ['/T', '/F', '/PID', String(child.pid)], {
         timeout: 15000, windowsHide: true, stdio: 'ignore',
       });
     } else {
@@ -210,8 +214,13 @@ export class JobManager {
     }
   }
 
+  /**
+   * Persist the newest `HISTORY_MAX` finished jobs — and DROP the rest from memory too. The
+   * file was always capped; `_jobs` was not, so a daemon left running for weeks held every job
+   * it ever ran, each with up to `MEM_CAP` chars of output. Memory now holds what the file
+   * holds, plus whatever is running (which `_run` saves again when it finishes).
+   */
   _saveHistory() {
-    if (!this._historyPath) return;
     const jobs = [...this._jobs.values()].filter((j) => j.status !== 'running')
       .map((j) => ({ ...j }));
     // STABLE sort matters: two jobs started inside the same clock tick keep insertion
@@ -219,11 +228,24 @@ export class JobManager {
     jobs.sort((a, b) => (Number(a.started ?? 0) || 0) - (Number(b.started ?? 0) || 0));
     const kept = jobs.slice(-JobManager.HISTORY_MAX)
       .map((j) => ({ ...j, output: tailChars(String(j.output), JobManager.OUTPUT_CAP) }));
+    const keep = new Set(kept.map((j) => String(j.id)));
+    for (const [id, j] of this._jobs) {
+      if (j.status !== 'running' && !keep.has(id)) this._jobs.delete(id);
+    }
+    if (!this._historyPath) return;
     try {
       writeText(this._historyPath, jsonDumpsCompact(kept, { bareInts: true }));
     } catch { /* a console that cannot persist its history still runs */ }
   }
 
+  /**
+   * A job is running. `/api/shutdown` and `/api/restart` refuse while it is: a running job is
+   * not persisted, and stopping the server under it orphans the child and loses its record.
+   */
+  get busy() {
+    return this._busy;
+  }
+
   /** Last `n` jobs, oldest first — the order the console appends in. */
   recent(n = JobManager.HISTORY_MAX) {
     const jobs = [...this._jobs.values()]

package/js/web/routes.mjs

@@ -1,10 +1,12 @@
 /**
  * WHAT THE WEB API ANSWERS — as a declaration, separate from the dispatcher that honours it.
  *
- * Two tables and two inline lists. They are not documentation: `tests/unit/web_server.test.mjs`
- * holds their union against a surface list written out in the test, and probes the real handler,
- * because a declaration is not a dispatcher — a route can be declared here and missing from the
- * dispatch, and nothing but a probe notices.
+ * Four tables and two inline lists. The two GET tables (`STATE_ROUTES`, `PREFIX_ROUTES`) used
+ * to live in `api.mjs`, which made it import every route module that also imported it. None of
+ * this is documentation: `tests/unit/web_server.test.mjs` holds their union against a surface
+ * list written out in the test, and probes the real handler, because a declaration is not a
+ * dispatcher — a route can be declared here and missing from the dispatch, and nothing but a
+ * probe notices.
  *
  * This file used to also carry the Python→Node port's NOT_PORTED / DECLINED partition — five
  * sets, all empty once the port finished. They were deleted when the port bookkeeping retired
@@ -15,8 +17,15 @@
  * expose X?", which has nothing to do with sockets, daemons or gzip.
  */
 import { formatValue, isTruthy, parseJson } from '../lib/json.mjs';
-import { apiExcludesMutate, apiInstallToggle, apiLoopsPresetMutate, apiMcpToggle, apiMemoryDelete, apiProfileSave, apiRulesMutate, apiRulesPromote, apiSelectView } from './actions.mjs';
-import { apiActivityToggle } from './activity.mjs';
+import { percentDecode } from '../lib/text.mjs';
+import { apiExcludesMutate, apiInstallToggle, apiLoopsPresetMutate, apiMcp, apiMcpToggle, apiMemoryDelete, apiSelectView } from './actions.mjs';
+import { apiActivity, apiActivityDetail, apiActivityToggle } from './activity.mjs';
+import {
+  apiDiff, apiDoctor, apiExcludes, apiInstalls, apiLoops, apiLoopsActive, apiOverview,
+  apiRecent, apiSetup, apiThemes,
+} from './api.mjs';
+import { NotFound, apiCatalog, apiItem } from './catalog.mjs';
+import { apiProfile, apiProfileSave, apiRules, apiRulesMutate, apiRulesPromote } from './user-files.mjs';
 
 /**
  * The POSTs this daemon answers — and this table IS the dispatch, not a declaration beside
@@ -102,3 +111,49 @@ export function readJsonBody(buf) {
   return (obj !== null && typeof obj === 'object' && obj.constructor === Object) ? obj : {};
 }
 
+/**
+ * The prefix routes — path in, response out.
+ *
+ * `percentDecode` and not `decodeURIComponent`: the JS builtin throws a `URIError` on a `%`
+ * that is not an escape, where this shell instead answers a 404 naming the literal text.
+ */
+export const PREFIX_ROUTES = [
+  ['/api/catalog/', (state, p) => apiCatalog(state, p.split('/').pop())],
+  // /api/item/<type>/<name> — TYPE has no slash, the NAME keeps its slashes so a wiki
+  // page's relpath survives. A missing name is a 404 here rather than a 500 two frames down.
+  ['/api/item/', (state, p) => {
+    const m = /^\/api\/item\/([^/]+)\/(.+)$/.exec(p);
+    if (!m) throw new NotFound(p);
+    return apiItem(state, m[1], percentDecode(m[2]));
+  }],
+  // The sid is passed through unquoted — `apiActivityDetail`'s safe-name scheme is what
+  // makes the lookup safe, rather than a check out here.
+  ['/api/activity/', (state, p) => apiActivityDetail(
+    state, percentDecode(p.slice('/api/activity/'.length)))],
+];
+
+/**
+ * A literal path to `api_X(state)`, table-keyed rather than a chain of `if`s — the reason
+ * it is a table is `tests/unit/web_server.test.mjs`'s cross-check, which requires this
+ * table plus `PREFIX_ROUTES` and `GET_INLINE` to equal a surface list written out in the
+ * test, so a route cannot appear or vanish unenumerated.
+ */
+export const STATE_ROUTES = {
+  '/api/overview': apiOverview,
+  '/api/recent': apiRecent,
+  '/api/themes': apiThemes,
+  '/api/setup': apiSetup,
+  '/api/doctor': apiDoctor,
+  '/api/installs': apiInstalls,
+  '/api/excludes': apiExcludes,
+  '/api/profile': apiProfile,
+  '/api/diff': apiDiff,
+  '/api/activity': apiActivity,
+  // `/api/rules` must exist as a PAIR with its POST: `apiRulesMutate` splices `parseRules`'
+  // line indices, and the fingerprint every mutation must send back is what this GET
+  // answers — a daemon whose POST worked and whose GET 501'd would have no way to obtain one.
+  '/api/rules': apiRules,
+  '/api/mcp': apiMcp,
+  '/api/loops': apiLoops,
+  '/api/loops/active': apiLoopsActive,
+};

package/js/web/server.mjs

@@ -23,13 +23,13 @@
  * surface now lives in `js/web/routes.mjs` and `tests/unit/web_server.test.mjs`.
  */
 import { GLOBAL_MANIFEST, resolvePath } from '../hosts/hosts.mjs';
-import { printOut } from '../lib/fs.mjs';
+import { isFile, printOut } from '../lib/fs.mjs';
 import { which } from '../lib/paths.mjs';
 import { parseIntStrict } from '../lib/text.mjs';
-import { promptLine } from '../maintain/setup.mjs';
-import { webState } from './api.mjs';
+import { promptLine } from '../lib/prompt.mjs';
+import { webState } from './state.mjs';
 import { clearDaemon, codeStamp, openUrl, readDaemon, restartDaemon, startDaemon, statusDaemon, stopDaemon, writeDaemon } from './daemon.mjs';
-import { isFile, makeHandler } from './handler.mjs';
+import { makeHandler } from './handler.mjs';
 import { JobManager } from './jobs.mjs';
 import { spawnSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';

package/js/web/state.mjs

@@ -0,0 +1,138 @@
+/**
+ * `WebState` — the resolved view of the deployed harness every endpoint reads from.
+ *
+ * Its own module so that `daemon.mjs`, which needs only `webState(theme).target`, does not load
+ * every read endpoint to get it (it imported all of `api.mjs` for this one factory). It still
+ * reaches `catalog.mjs`, for the inventory it caches.
+ */
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+import { opencodeConfigDir } from '../hosts/hosts.mjs';
+import {
+  footprintOfDir, installedDefaults, modeOfDir, postureOfDir, themeOfDir, trustOfDir,
+} from '../hosts/installs.mjs';
+import { doctorCollect } from '../inspect/doctor.mjs';
+import { DEFAULT_PRESET } from '../loop/score.mjs';
+import { readText, isFile } from '../lib/fs.mjs';
+import { stripWhitespace } from '../lib/text.mjs';
+import { inventoryFor } from './catalog.mjs';
+
+/**
+ * `YYYY-MM-DD HH:MM`, LOCAL time — `toISOString` would be UTC, which reads wrong in every
+ * timezone but one for a user-facing timestamp.
+ */
+export function stampMinute(ms) {
+  const d = new Date(ms);
+  const p2 = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${p2(d.getMonth() + 1)}-${p2(d.getDate())} `
+    + `${p2(d.getHours())}:${p2(d.getMinutes())}`;
+}
+
+// ---- WebState ---------------------------------------------------------------------------
+
+/**
+ * The resolved view of the deployed harness a request reads from.
+ *
+ * A factory returning a plain object rather than a class, because the two cached
+ * properties are the only behaviour and a getter pair expresses them without ceremony.
+ * THE CACHING IS BEHAVIOUR, NOT AN OPTIMISATION: `doctorCollect` renders a theme per call
+ * and the console GETs `/api/overview` on mount and again after every mutation, so an
+ * uncached `doctor` would put a full build on each of those requests. `refresh()` is what a mutation calls to
+ * drop both.
+ */
+export function webState(theme = null, target = null) {
+  const st = {
+    // NOT resolved: `target` is printed by three endpoints, so resolving it here would
+    // change what they answer.
+    target: target || opencodeConfigDir(),
+    root: null,
+    theme: null,
+    emit: null,
+    footprint: null,
+    posture: null,
+    mode: null,
+    trust: null,
+    _inv: null,
+    _doctor: null,
+  };
+  // The INSTALL ROOT (== build --out). For globals it IS the data dir; a claude/bob
+  // PROJECT install keeps its data under <repo>/.claude while the markers land at <repo>/.
+  st.root = st.target;
+  st.theme = theme || themeOfDir(st.target) || 'neutral';
+  st.emit = installedDefaults().emit || 'opencode-global';
+  // The install's sigils, each defaulted when its marker is absent (footprint to 'full').
+  // Read from the ROOT, where every emit writes them.
+  const readMarkers = () => {
+    st.footprint = footprintOfDir(st.root);
+    st.posture = postureOfDir(st.root) || 'peer';
+    st.mode = modeOfDir(st.root) || 'direct';
+    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
+  };
+  readMarkers();
+
+  Object.defineProperty(st, 'inventory', {
+    get() {
+      if (st._inv === null) st._inv = inventoryFor(st);
+      return st._inv;
+    },
+  });
+  Object.defineProperty(st, 'doctor', {
+    get() {
+      if (st._doctor === null) {
+        const [, problems] = doctorCollect({ theme: st.theme });
+        st.stampDoctor(problems);
+      }
+      return st._doctor;
+    },
+  });
+  st.stampDoctor = (problems) => {
+    st._doctor = { ok: !problems.length, problems, checked_at: stampMinute(Date.now()) };
+  };
+  /**
+   * The CURRENT install's mode, from its `.geneseed-emit` marker: the ROOT first (where
+   * every emit writes it), then the data dir.
+   *
+   * `refresh()` below MUST call this: without it, `emit` goes stale after any write that
+   * re-themes or re-points the install, since the constructor only reads it once via
+   * `installedDefaults()`.
+   */
+  st.detectEmit = () => {
+    for (const d of [st.root, st.target]) {
+      try {
+        const em = path.join(d, '.geneseed-emit');
+        if (isFile(em)) {
+          const v = stripWhitespace(readText(em));
+          if (v) return v;
+        }
+      } catch { /* unreadable marker: try the next candidate */ }
+    }
+    return existsSync(path.join(st.root, 'CLAUDE.md')) ? 'claude-global' : 'opencode-global';
+  };
+  /**
+   * Re-point the console at another detected install's data dir.
+   *
+   * `root` is the install ROOT the markers and sigils live at. It defaults to `target` and
+   * differs only for claude/bob/openclaude PROJECT installs, where the data sits under
+   * `<repo>/.claude|.bob|.openclaude` while `.geneseed-emit`/`-theme`/`-footprint` land at
+   * `<repo>/` — reading them from the data dir mis-detects the install as opencode/neutral,
+   * and a Diff or a Restore would then overwrite it in the wrong dialect.
+   */
+  st.selectView = (target, root = null) => {
+    st.target = target;
+    st.root = root || target;
+    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || 'neutral';
+    st.emit = st.detectEmit();
+    readMarkers();
+    st._inv = null;
+    st._doctor = null;
+  };
+  st.refresh = () => {
+    st._inv = null;
+    st._doctor = null;
+    st.theme = themeOfDir(st.root) || themeOfDir(st.target) || st.theme;
+    st.emit = st.detectEmit() || st.emit;
+    readMarkers();
+  };
+  return st;
+}