magpie-agent-console 1.0.0 → 1.2.0

package/index.mjs

@@ -40,6 +40,13 @@ const DEFAULT_PORT = 3488;
 // Longest wait for the daemon's ready line (Windows cold start + antivirus scanning can be slow)
 const READY_TIMEOUT_MS = 15000;
 const BIND_RETRY_MS = 2000;
+const SESSION_BEAT_MS = 4000;
+// A port still busy after this many tries (~10 s) is worth a log line (see bindLoop)
+const BUSY_LOG_AFTER = 5;
+function bindDelayMs() {
+  const v = Number(process.env.AGENT_CONSOLE_BIND_DELAY_MS);
+  return Number.isFinite(v) && v >= 0 ? v : 1200;
+}
 
 // Paths are computed again inside server(): tests change environment variables after import
 function paths() {
@@ -51,6 +58,8 @@ function paths() {
     logsDir: join(dataDir, "logs"),
     spawnLog: join(dataDir, "logs", "daemon-spawn.log"),
     daemonJson: join(dataDir, "daemon.json"),
+    // pid of the host that wrote page/session.js (kept out of the page directory, which any page can read)
+    sessionOwner: join(dataDir, "session-owner.json"),
     pageDir: process.env.AGENT_CONSOLE_PAGE_DIR || join(here, "page"),
   };
 }
@@ -182,14 +191,47 @@ async function shutdownLegacy(info, log) {
 
 // session.js is a script file holding only the gate port (a number) and the gate key (hex); "<" is still escaped just in case.
 // Any page that knows Magpie's page path can read it with <script src>, so the daemon token must never go here.
-function writeSession(pageDir, port, key) {
+// ts: when it was written. beat: whether this host keeps refreshing it (every SESSION_BEAT_MS, from the first page open on).
+// A host that is killed hard (Magpie restarting it, Windows) can't delete its session.js:
+// - boot.js treats a beating file whose ts stopped moving as stale, and after a lost connection (ac_lost) takes only a file written
+//   after the loss, so it waits for the new host's file instead of opening a dead gate;
+// - a file that never beat (the page was never opened) says nothing by its age, so the next host deletes it at startup when the
+//   host that wrote it is gone (removeDeadSession), before Magpie serves the page.
+function writeSession(pageDir, port, key, beat = false) {
   mkdirSync(pageDir, { recursive: true });
-  const json = JSON.stringify({ v: 2, port, key }).replace(/</g, "\\u003c");
+  const json = JSON.stringify({ v: 2, port, key, ts: Date.now(), beat }).replace(/</g, "\\u003c");
   const temp = join(pageDir, `.session-${process.pid}-${randomBytes(4).toString("hex")}.tmp`);
   writeFileSync(temp, `globalThis.AgentConsoleSession = ${json};\n`, { mode: 0o600 });
   renameSync(temp, join(pageDir, "session.js"));
 }
 
+// At host startup (synchronously, so before Magpie serves the page that made it start this host): a session.js left by a host
+// that is no longer running points at a dead gate; delete it so boot.js waits for this host's file.
+// session-owner.json holds the writer's pid; a live writer (another host, e.g. Magpie's own while a `magpie` CLI command runs) is left alone.
+function removeDeadSession(p) {
+  const sessionPath = join(p.pageDir, "session.js");
+  let owner;
+  try {
+    owner = JSON.parse(readFileSync(p.sessionOwner, "utf8"));
+  } catch {
+    return;
+  }
+  if (!owner || !Number.isInteger(owner.pid) || owner.pid === process.pid || pidAlive(owner.pid)) return;
+  try {
+    const cur = readFileSync(sessionPath, "utf8");
+    if (typeof owner.key === "string" && owner.key && !cur.includes(owner.key)) return;
+    unlinkSync(sessionPath);
+  } catch {}
+}
+
+function writeSessionOwner(p, key) {
+  try {
+    mkdirSync(p.dataDir, { recursive: true });
+    // Only the first 16 hex chars of the gate key: enough to recognise the file, useless for opening the gate
+    writeFileSync(p.sessionOwner, JSON.stringify({ pid: process.pid, key: key.slice(0, 16) }), { mode: 0o600 });
+  } catch {}
+}
+
 function removeSession(pageDir, key) {
   const sessionPath = join(pageDir, "session.js");
   try {
@@ -224,6 +266,7 @@ function installExitHook() {
 }
 
 function createHost(port) {
+  const gatePort = port;
   const p = paths();
   const log = makeLogger(p);
   // Gate key: written to session.js; even if leaked it only buys one navigation to the daemon
@@ -236,6 +279,25 @@ function createHost(port) {
   let starting = null;
   let legacyChecked = false;
   let wakeBindLoop = null;
+  let beat = null;
+  let bound = false;
+  removeDeadSession(p);
+
+  // From the first page open on, session.js is rewritten every SESSION_BEAT_MS (only while it is still ours), so a page that lost
+  // its connection can tell this live host's file from a dead host's. Before that there is nothing to tell apart: no writes.
+  function startBeat() {
+    if (beat || stopped || !bound) return;
+    const refresh = () => {
+      if (stopped) return;
+      try {
+        const cur = readFileSync(join(p.pageDir, "session.js"), "utf8");
+        if (cur.includes(key)) writeSession(p.pageDir, port, key, true);
+      } catch { /* deleted or unreadable: leave it */ }
+    };
+    refresh();
+    beat = setInterval(refresh, SESSION_BEAT_MS);
+    beat.unref?.();
+  }
 
   async function checkLegacyOnce() {
     if (legacyChecked) return;
@@ -270,6 +332,9 @@ function createHost(port) {
           p.dataRoot,
           "--parent-pid",
           String(process.pid),
+          // the preview proxy refuses the gate's port
+          "--gate-port",
+          String(gatePort),
         ],
         {
           // The token goes through an environment variable, not the command line (command lines are visible to other users on the machine)
@@ -366,7 +431,14 @@ function createHost(port) {
     return { port: await starting };
   }
 
-  const gate = createGate({ port, key, token, ensureDaemon });
+  // The gate calls this only for an /open with the right key
+  const gate = createGate({
+    port, key, token,
+    ensureDaemon: () => {
+      startBeat();
+      return ensureDaemon();
+    },
+  });
 
   function waitForRetry() {
     return new Promise((resolve) => {
@@ -380,12 +452,25 @@ function createHost(port) {
 
   async function bindLoop() {
     const loggedCodes = new Set();
+    let busyTries = 0;
+    // B16: every `magpie` CLI command starts a short-lived plugin host that calls server() too. Waiting a moment before binding
+    // means such a host usually exits before it takes the gate or writes session.js, and a port held by the long-lived host
+    // (EADDRINUSE) is only logged once it has stayed busy for a while, not once per CLI command.
+    const delay = bindDelayMs();
+    if (delay > 0) {
+      await new Promise((resolve) => {
+        const timer = setTimeout(resolve, delay);
+        wakeBindLoop = () => { clearTimeout(timer); resolve(); };
+      });
+    }
     while (!stopped) {
       try {
         await gate.listen();
       } catch (error) {
         const code = error?.code || String(error);
-        if (!loggedCodes.has(code)) {
+        if (code === "EADDRINUSE") busyTries++;
+        const quiet = code === "EADDRINUSE" && busyTries < BUSY_LOG_AFTER;
+        if (!quiet && !loggedCodes.has(code)) {
           loggedCodes.add(code);
           log(`gate port ${port} bind failed (${code}); retrying every ${BIND_RETRY_MS / 1000}s`);
         }
@@ -404,7 +489,9 @@ function createHost(port) {
         return;
       }
       try {
-        writeSession(p.pageDir, port, key);
+        writeSession(p.pageDir, port, key, false);
+        writeSessionOwner(p, key);
+        bound = true;
         liveSessions.set(p.pageDir, key);
         installExitHook();
         log(`gate listening on 127.0.0.1:${port}; session.js written`);
@@ -432,6 +519,7 @@ function createHost(port) {
 
   async function stop() {
     stopped = true;
+    if (beat) clearInterval(beat);
     wakeBindLoop?.();
     await binding;
     await gate.close();

package/lib/gate.mjs

@@ -56,6 +56,24 @@ export function failureHtml(error) {
   );
 }
 
+/**
+ * The Magpie plugin page boot.js came from (?back=), so the daemon page can go back through it after the plugin host restarts
+ * (fresh session.js → new gate → new daemon). Only a loopback Magpie plugin page is accepted, so the daemon page can't be turned
+ * into an open redirect; it travels in the 302's # fragment next to the token and never reaches a server.
+ * Keep in sync with web/src/api/backToMagpie.ts.
+ */
+export function safeBackUrl(raw) {
+  if (typeof raw !== "string" || !raw || raw.length > 2048) return null;
+  let u;
+  try { u = new URL(raw); } catch { return null; }
+  if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+  if (u.username || u.password) return null;
+  const hostname = u.hostname.toLowerCase();
+  if (hostname !== "127.0.0.1" && hostname !== "localhost" && hostname !== "[::1]") return null;
+  if (!/^\/_magpie\/plugin\/[A-Za-z0-9_-]{1,128}\/(?:page\/)?index\.html$/.test(u.pathname)) return null;
+  return `${u.protocol}//${u.host}${u.pathname}${u.search}`;
+}
+
 const REOPEN_HTML =
   "<!doctype html><meta charset=utf-8><p>Agent Console: 链接已失效，请在 Magpie 里重新打开插件页。" +
   "<br>The link is no longer valid. Please reopen the Agent Console page in Magpie.</p>";
@@ -117,7 +135,9 @@ export function createGate({ port, key, token, ensureDaemon, host = "127.0.0.1"
     for (const name of ["theme", "lang", "tokens"]) {
       if (url.searchParams.has(name)) query.set(name, url.searchParams.get(name));
     }
-    const location = `http://127.0.0.1:${daemon.port}/?${query}#t=${encodeURIComponent(token)}`;
+    const back = safeBackUrl(url.searchParams.get("back"));
+    const fragment = `t=${encodeURIComponent(token)}` + (back ? `&b=${encodeURIComponent(back)}` : "");
+    const location = `http://127.0.0.1:${daemon.port}/?${query}#${fragment}`;
     res.writeHead(302, { ...SAFE_HEADERS, location });
     res.end();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "magpie-agent-console",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "A Magpie page plugin that drives local Agent CLIs (Claude Code, Codex, Cursor, and others) with a persistent daemon and a structured timeline.",
   "author": "qingnian108",
   "homepage": "https://github.com/qingnian108/magpie-agent-console",
@@ -44,7 +44,8 @@
       },
       "file": "page/index.html",
       "icon": "assets/icon.svg"
-    }
+    },
+    "permissions": []
   },
   "main": "./index.mjs",
   "type": "module",
@@ -61,7 +62,9 @@
     "check:v1": "tsc -p tsconfig.daemon.json --noEmit && tsc -p tsconfig.web.json --noEmit",
     "e2e:v1": "node scripts/e2e-v1.mjs",
     "shot:v1": "node scripts/shot-v1.mjs",
-    "verify:build": "node scripts/verify-build.mjs"
+    "verify:build": "node scripts/verify-build.mjs",
+    "test:real": "vitest run --config vitest.real.config.ts",
+    "test:preview-attack": "node scripts/preview-attack.mjs"
   },
   "engines": {
     "node": ">=20",
@@ -69,32 +72,33 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "2.1.0",
-    "@anthropic-ai/claude-agent-sdk": "0.3.312",
-    "@tanstack/react-virtual": "3.14.24",
-    "@xterm/addon-fit": "0.11.0",
-    "@xterm/xterm": "6.0.0",
-    "clsx": "2.1.1",
-    "dompurify": "3.4.17",
-    "highlight.js": "11.12.0",
     "ignore": "7.0.14",
-    "lucide-react": "1.64.0",
-    "marked": "18.1.2",
-    "node-pty": "1.2.0-beta.15",
-    "react": "19.3.1",
-    "react-dom": "19.3.1",
     "ws": "8.22.0",
-    "zod": "4.6.7",
-    "zustand": "5.0.16"
+    "zod": "4.6.7"
+  },
+  "optionalDependencies": {
+    "node-pty": "1.2.0-beta.15"
   },
   "devDependencies": {
+    "@tanstack/react-virtual": "3.14.24",
     "@types/dompurify": "3.0.5",
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@types/ws": "8.18.2",
+    "@xterm/addon-fit": "0.11.0",
+    "@xterm/xterm": "6.0.0",
+    "clsx": "2.1.1",
+    "dompurify": "3.4.17",
     "esbuild": "0.28.2",
+    "highlight.js": "11.12.0",
+    "lucide-react": "1.64.0",
+    "marked": "18.1.2",
     "playwright-core": "1.64.1",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
     "typescript": "7.0.2",
-    "vitest": "5.0.5"
+    "vitest": "5.0.5",
+    "zustand": "5.0.16"
   }
 }

package/page/boot.js

@@ -27,6 +27,17 @@
   if (said) said.textContent = zh ? "正在启动本地服务…" : "Starting local service…";
   if (brand) brand.textContent = zh ? "Agent 控制台" : "Agent Console";
 
+  // ts: when the host wrote the file. beat: true once the host refreshes it every few seconds (from the first page open on);
+  // a beating file whose ts stopped moving belongs to a host that was killed (Magpie restarting it) and its gate is gone, so wait
+  // for the new host's file instead of navigating to a dead port. A file that doesn't beat (the page was never opened) can be old
+  // and still live; a dead host's one is deleted by the next host when it starts.
+  const STALE_MS = 12000;
+  // ac_lost: set by the daemon page when it lost its connection and came back here. The old host's file was last refreshed before
+  // that moment, so only a session.js refreshed after it (a live host's) is used.
+  const here = new URL(location.href);
+  const lostAt = Number(here.searchParams.get("ac_lost")) || 0;
+  here.searchParams.delete("ac_lost");
+  here.hash = "";
   function validSession(s) {
     return (
       s &&
@@ -35,9 +46,16 @@
       s.port > 0 &&
       s.port <= 65535 &&
       typeof s.key === "string" &&
-      /^[0-9a-f]{64}$/.test(s.key)
+      /^[0-9a-f]{64}$/.test(s.key) &&
+      fresh(s)
     );
   }
+  function fresh(s) {
+    if (typeof s.ts !== "number") return true; // a host from before ts
+    if (lostAt && !(s.ts > lostAt)) return false;
+    if (s.beat === false) return true;
+    return Math.abs(Date.now() - s.ts) < STALE_MS;
+  }
 
   // Reload an uncached copy of session.js (the key changes after the plugin host restarts).
   // Returns null when the file doesn't exist (the host isn't up yet or the port isn't bound yet).
@@ -62,8 +80,8 @@
   const preloaded = validSession(globalThis.AgentConsoleSession) ? globalThis.AgentConsoleSession : null;
   let session = await loadFreshSession(0);
   if (!session && preloaded) session = preloaded;
-  // Right after the host starts the file may not be written yet: retry every 500ms for about 10 seconds
-  for (let attempt = 1; !session && attempt <= 20; attempt++) {
+  // Right after the host starts (or restarts) the file may be missing or stale: retry every 500ms for about 30 seconds
+  for (let attempt = 1; !session && attempt <= 60; attempt++) {
     await new Promise((resolve) => setTimeout(resolve, 500));
     session = await loadFreshSession(attempt);
   }
@@ -94,6 +112,12 @@
   if (Object.keys(slim).length) {
     try { q.set("tokens", btoa(unescape(encodeURIComponent(JSON.stringify(slim))))); } catch { /* fine if it can't be passed along */ }
   }
+  // This page's own URL: when Magpie restarts the plugin host (new gate key, the old daemon exits), the daemon page comes back here
+  // to read the fresh session.js. The gate checks it and puts it only in the # fragment.
+  try {
+    const back = here.toString();
+    if (back.length <= 2048) q.set("back", back);
+  } catch { /* no self-heal, the page still works */ }
 
   location.replace("http://127.0.0.1:" + session.port + "/open?" + q.toString());
 })();