nebula-notebook 0.1.0

package/node-server/dist/index.js

@@ -0,0 +1,556 @@
+"use strict";
+/**
+ * Nebula Node Server - Main Entry Point
+ *
+ * Unified Node.js server for:
+ * - Jupyter kernel management
+ * - LLM providers (Google, OpenAI, Anthropic)
+ * - Filesystem operations
+ * - Python environment discovery
+ * - Terminal PTY management
+ *
+ * Uses Fastify with HTTP/2 support.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fastify_1 = __importDefault(require("fastify"));
+const cors_1 = __importDefault(require("@fastify/cors"));
+const multipart_1 = __importDefault(require("@fastify/multipart"));
+const static_1 = __importDefault(require("@fastify/static"));
+const ws_1 = require("ws");
+const url_1 = require("url");
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const crypto = __importStar(require("crypto"));
+const crypto_1 = require("crypto");
+// Import routes
+const kernel_1 = __importStar(require("./routes/kernel"));
+const llm_1 = __importStar(require("./routes/llm"));
+const fs_1 = __importDefault(require("./routes/fs"));
+const notebook_1 = __importDefault(require("./routes/notebook"));
+const python_1 = __importDefault(require("./routes/python"));
+const auth_1 = __importDefault(require("./routes/auth"));
+const cluster_1 = __importDefault(require("./routes/cluster"));
+const resources_1 = __importDefault(require("./routes/resources"));
+// Import cluster
+const server_registry_1 = require("./cluster/server-registry");
+const cluster_secret_1 = require("./cluster/cluster-secret");
+const client_registration_1 = require("./cluster/client-registration");
+// Import auth
+const auth_2 = require("./auth");
+const fs_service_1 = require("./fs/fs-service");
+// Import terminal routes (existing)
+const server_1 = require("./terminal/server");
+// Import notebook WebSocket
+const notebook_websocket_1 = require("./notebook/notebook-websocket");
+const PORT = process.env.PORT || process.env.NODE_SERVER_PORT || 3000;
+const DEV_MODE = process.env.DEV_MODE === 'true' || process.argv.includes('--dev');
+const BODY_LIMIT = process.env.NEBULA_BODY_LIMIT ||
+    process.env.NEBULA_MAX_BODY_SIZE ||
+    '1gb';
+const CLIENT_MODE = process.argv.includes('--client') ||
+    process.argv.includes('--client-mode') ||
+    process.env.NEBULA_CLIENT === 'true' ||
+    process.env.NEBULA_CLIENT_MODE === 'true' ||
+    process.env.npm_config_client === 'true' ||
+    process.env.npm_config_client === '1';
+const hasCliFlag = (names) => names.some(name => process.argv.includes(name));
+const parseOptionalBoolean = (value) => {
+    if (value === undefined)
+        return null;
+    const normalized = value.trim().toLowerCase();
+    if (['true', '1', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['false', '0', 'no', 'off'].includes(normalized))
+        return false;
+    return null;
+};
+const resolveBooleanFlag = (enabledCliFlags, disabledCliFlags, envNames, npmConfigNames, defaultValue) => {
+    if (hasCliFlag(disabledCliFlags))
+        return false;
+    if (hasCliFlag(enabledCliFlags))
+        return true;
+    for (const envName of [...envNames, ...npmConfigNames]) {
+        const resolved = parseOptionalBoolean(process.env[envName]);
+        if (resolved !== null) {
+            return resolved;
+        }
+    }
+    return defaultValue;
+};
+const getArgValue = (name) => {
+    const idx = process.argv.findIndex(arg => arg === name);
+    if (idx !== -1 && process.argv[idx + 1]) {
+        return process.argv[idx + 1];
+    }
+    const prefix = `${name}=`;
+    const found = process.argv.find(arg => arg.startsWith(prefix));
+    if (found) {
+        return found.slice(prefix.length);
+    }
+    return null;
+};
+const WORKDIR = getArgValue('--workdir') || process.env.NEBULA_WORKDIR || process.env.npm_config_workdir;
+const PRESERVE_KERNELS = resolveBooleanFlag(['--preserve-kernels', '--preserve-kernel'], ['--no-preserve-kernels', '--no-preserve-kernel'], ['NEBULA_PRESERVE_KERNELS'], ['npm_config_preserve_kernels'], DEV_MODE);
+const REATTACH_KERNELS = resolveBooleanFlag(['--reattach-kernels', '--reattach-kernel'], ['--no-reattach-kernels', '--no-reattach-kernel'], ['NEBULA_REATTACH_KERNELS'], ['npm_config_reattach_kernels'], DEV_MODE);
+// Log kernel preservation settings
+if (PRESERVE_KERNELS)
+    console.log('[Server] Kernel preservation ENABLED');
+if (REATTACH_KERNELS)
+    console.log('[Server] Kernel reattachment ENABLED');
+/**
+ * Parse a human-readable body limit string (e.g., '200mb', '1gb') to bytes.
+ */
+function parseBodyLimit(limit) {
+    const match = limit.match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb|tb)?$/i);
+    if (!match) {
+        return 1024 * 1024 * 1024; // default 1gb
+    }
+    const value = parseFloat(match[1]);
+    const unit = (match[2] || 'b').toLowerCase();
+    const multipliers = {
+        b: 1,
+        kb: 1024,
+        mb: 1024 * 1024,
+        gb: 1024 * 1024 * 1024,
+        tb: 1024 * 1024 * 1024 * 1024,
+    };
+    return Math.floor(value * (multipliers[unit] || 1));
+}
+// HTTP/1.1 only for now — HTTP/2 streaming requires a separate HTTPS server.
+// Returning from a function (vs a literal null const) keeps the TLS branch
+// typechecking so the build stays green while the feature is parked.
+function loadTlsCert() {
+    return null;
+}
+/**
+ * Generate or load self-signed TLS certificate for HTTP/2
+ */
+function getOrCreateTlsCert() {
+    const tlsDir = path.join(os.homedir(), '.nebula', 'tls');
+    const keyPath = path.join(tlsDir, 'server.key');
+    const certPath = path.join(tlsDir, 'server.cert');
+    try {
+        // Check if cert already exists and is still valid
+        if (fs.existsSync(keyPath) && fs.existsSync(certPath)) {
+            const key = fs.readFileSync(keyPath);
+            const cert = fs.readFileSync(certPath);
+            return { key, cert };
+        }
+        // Generate self-signed certificate using Node.js crypto
+        // Only available in Node.js 15+
+        if (!('generateKeyPairSync' in crypto)) {
+            console.log('[TLS] crypto.generateKeyPairSync not available, falling back to HTTP/1.1');
+            return null;
+        }
+        console.log('[TLS] Generating self-signed certificate for HTTP/2...');
+        // Create TLS directory
+        fs.mkdirSync(tlsDir, { recursive: true, mode: 0o700 });
+        // Use child_process to generate cert with openssl (most portable approach)
+        const { execSync } = require('child_process');
+        try {
+            execSync(`openssl req -x509 -newkey rsa:2048 -keyout "${keyPath}" -out "${certPath}" -days 365 -nodes -subj "/CN=localhost"`, { stdio: 'pipe' });
+            fs.chmodSync(keyPath, 0o600);
+            fs.chmodSync(certPath, 0o600);
+            const key = fs.readFileSync(keyPath);
+            const cert = fs.readFileSync(certPath);
+            console.log('[TLS] Self-signed certificate generated and cached at ~/.nebula/tls/');
+            return { key, cert };
+        }
+        catch (err) {
+            console.log('[TLS] openssl not available, falling back to HTTP/1.1');
+            return null;
+        }
+    }
+    catch (err) {
+        console.log('[TLS] Failed to generate certificate, falling back to HTTP/1.1');
+        return null;
+    }
+}
+/**
+ * Create and configure Fastify app
+ */
+async function createApp() {
+    const bodyLimitBytes = parseBodyLimit(BODY_LIMIT);
+    const tlsCert = loadTlsCert();
+    let fastify;
+    if (tlsCert) {
+        // Cast to FastifyInstance to unify the type with the HTTP/1 branch.
+        // The HTTP/2 Fastify instance is a superset but TypeScript infers a
+        // different generic specialisation; the cast is safe because we only
+        // use the common API surface.
+        fastify = (0, fastify_1.default)({
+            http2: true,
+            https: {
+                key: tlsCert.key,
+                cert: tlsCert.cert,
+                allowHTTP1: true,
+            },
+            bodyLimit: bodyLimitBytes,
+        });
+        console.log('[Server] HTTP/2 with TLS enabled');
+    }
+    else {
+        fastify = (0, fastify_1.default)({
+            bodyLimit: bodyLimitBytes,
+        });
+        console.log('[Server] HTTP/1.1 mode (no TLS)');
+    }
+    // Request timing hook
+    fastify.addHook('onResponse', (request, reply, done) => {
+        const duration = reply.elapsedTime;
+        if (duration > 1000) {
+            console.log(`[Slow Request] ${request.method} ${request.url} - ${Math.round(duration)}ms`);
+        }
+        done();
+    });
+    // Register CORS
+    await fastify.register(cors_1.default, {
+        origin: '*',
+        credentials: true,
+        methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+        allowedHeaders: ['Content-Type', 'Authorization', 'X-API-Key', 'X-API-Provider'],
+    });
+    // Register multipart support (replaces multer)
+    await fastify.register(multipart_1.default, {
+        limits: {
+            fileSize: bodyLimitBytes,
+        },
+    });
+    // Allow empty body with Content-Type: application/json.
+    // MCP clients and some tools send DELETE/GET with an empty JSON body.
+    // Fastify rejects this by default (FST_ERR_CTP_EMPTY_JSON_BODY).
+    fastify.addContentTypeParser('application/json', { parseAs: 'string' }, (req, body, done) => {
+        if (!body || (typeof body === 'string' && body.trim() === '')) {
+            done(null, undefined);
+            return;
+        }
+        try {
+            done(null, JSON.parse(body));
+        }
+        catch (err) {
+            done(err, undefined);
+        }
+    });
+    // Health check endpoints (public - no auth required)
+    fastify.get('/api/health', async (_request, reply) => {
+        // Use configured root directory (from .nebula-config.json or fallback to cwd)
+        const rootDir = fs_service_1.fsService.normalizePath('~');
+        return reply.send({
+            status: 'ok',
+            version: '1.0.0',
+            ready: kernel_1.kernelService.isReady,
+            llm_providers: Object.keys(llm_1.llmService.getAvailableProviders()),
+            cwd: rootDir,
+        });
+    });
+    fastify.get('/api/ready', async (_request, reply) => {
+        if (!kernel_1.kernelService.isReady) {
+            return reply.code(503).send({
+                detail: 'Service initializing, kernel discovery in progress',
+            });
+        }
+        return reply.send({ status: 'ready' });
+    });
+    // Auth routes (public - no auth required)
+    await fastify.register(auth_1.default, { prefix: '/api' });
+    // Auth middleware - protect all other API routes
+    // Applied as an onRequest hook for /api/* routes (excluding public ones)
+    fastify.addHook('onRequest', async (request, reply) => {
+        const pathname = request.url.split('?')[0];
+        // Skip health, ready, and auth routes (they are public)
+        if (pathname === '/api/health' ||
+            pathname === '/api/ready' ||
+            pathname.startsWith('/api/auth/')) {
+            return;
+        }
+        // Skip non-API routes (static files etc)
+        if (!pathname.startsWith('/api/')) {
+            return;
+        }
+        // Apply auth middleware
+        await (0, auth_2.authMiddleware)(request, reply);
+    });
+    // API routes (protected)
+    await fastify.register(kernel_1.default, { prefix: '/api' });
+    await fastify.register(llm_1.default, { prefix: '/api' });
+    await fastify.register(fs_1.default, { prefix: '/api' });
+    await fastify.register(notebook_1.default, { prefix: '/api' });
+    await fastify.register(python_1.default, { prefix: '/api' });
+    await fastify.register(cluster_1.default, { prefix: '/api' });
+    await fastify.register(resources_1.default, { prefix: '/api/resources' });
+    // Terminal routes (registered directly on the app, not under /api prefix)
+    await fastify.register(server_1.setupTerminalRoutes);
+    return fastify;
+}
+/**
+ * Setup WebSocket routing (kernel, terminal, notebook)
+ * Uses the raw Node.js HTTP(S) server from Fastify for upgrade handling
+ */
+function setupWebSockets(server) {
+    // Create WebSocket server with noServer mode for path-based routing
+    // Disable per-message deflate to avoid compression issues with proxies/browsers
+    const wss = new ws_1.WebSocketServer({
+        noServer: true,
+        perMessageDeflate: false,
+    });
+    // Handle upgrade requests
+    server.on('upgrade', (request, socket, head) => {
+        const pathname = (0, url_1.parse)(request.url || '').pathname || '';
+        // Route to kernel WebSocket
+        if (pathname.match(/^\/api\/kernels\/[^/]+\/ws$/)) {
+            // Authenticate WebSocket connection
+            if (!(0, auth_2.authWebSocketMiddleware)(request)) {
+                socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+            wss.handleUpgrade(request, socket, head, (ws) => {
+                wss.emit('connection', ws, request);
+            });
+        }
+        // Terminal WebSocket (/ws) is handled by setupTerminalWebSocket
+        // Don't destroy socket for other paths - let other handlers deal with them
+    });
+    // Setup kernel WebSocket handler
+    (0, kernel_1.setupKernelWebSocket)(wss);
+}
+/**
+ * Setup static file serving for frontend
+ */
+async function setupStaticServing(fastify) {
+    const distDir = path.join(__dirname, '../../dist');
+    if (DEV_MODE) {
+        console.log('[Server] Development mode - frontend should run separately with npm run dev');
+        return;
+    }
+    // Production mode: serve from dist
+    if (fs.existsSync(distDir)) {
+        // Serve static files
+        await fastify.register(static_1.default, {
+            root: distDir,
+            prefix: '/',
+        });
+        // SPA fallback - serve index.html for all non-API routes
+        fastify.setNotFoundHandler(async (request, reply) => {
+            const pathname = request.url.split('?')[0];
+            if (pathname.startsWith('/api/')) {
+                return reply.code(404).send({ detail: 'Not found' });
+            }
+            if (pathname.startsWith('/assets/') || path.extname(pathname)) {
+                return reply.code(404).type('text/plain').send('Not found');
+            }
+            return reply.sendFile('index.html');
+        });
+        console.log(`[Server] Serving frontend from ${distDir}`);
+    }
+    else {
+        console.log(`[Server] Warning: dist directory not found at ${distDir}`);
+        console.log('[Server] Run "npm run build" to create the production build');
+    }
+}
+/**
+ * Main entry point
+ */
+async function main() {
+    console.log('[Server] Starting Nebula Node Server...');
+    const mainServerUrl = process.env.NEBULA_MAIN_SERVER;
+    if (CLIENT_MODE && !mainServerUrl) {
+        console.error('[Cluster] Client mode requested but NEBULA_MAIN_SERVER is not set.');
+        console.error('[Cluster] Set NEBULA_MAIN_SERVER or remove --client.');
+        process.exit(1);
+    }
+    process.env.NEBULA_CLIENT_MODE = CLIENT_MODE ? 'true' : 'false';
+    if (!process.env.NEBULA_CLUSTER_SECRET) {
+        const allowCreate = !CLIENT_MODE;
+        const secret = (0, cluster_secret_1.getOrCreateClusterSecret)({ allowCreate });
+        if (secret) {
+            process.env.NEBULA_CLUSTER_SECRET = secret;
+            if (allowCreate) {
+                console.log('[Cluster] Generated cluster secret (stored at ~/.nebula/cluster.json)');
+            }
+        }
+        else if (CLIENT_MODE) {
+            console.error('[Cluster] No NEBULA_CLUSTER_SECRET set and no ~/.nebula/cluster.json found.');
+            console.error('[Cluster] Set NEBULA_CLUSTER_SECRET or copy ~/.nebula/cluster.json from the main server.');
+            process.exit(1);
+        }
+    }
+    const authDisabled = process.argv.includes('--noauth') ||
+        process.argv.includes('--no-auth') ||
+        process.env.NO_AUTH === 'true' ||
+        process.env.NEBULA_NO_AUTH === 'true' ||
+        process.env.npm_config_noauth === 'true' ||
+        process.env.npm_config_noauth === '1' ||
+        process.env.npm_config_no_auth === 'true' ||
+        process.env.npm_config_no_auth === '1' ||
+        CLIENT_MODE;
+    if (authDisabled) {
+        auth_2.authService.disableAuth();
+        console.log(`[Auth] Disabled (${CLIENT_MODE ? 'client mode' : '--noauth'})`);
+    }
+    if (WORKDIR) {
+        try {
+            const updated = fs_service_1.fsService.setRootDirectory(WORKDIR);
+            console.log(`[Server] Root directory set to ${updated}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.warn(`[Server] Failed to set root directory: ${message}`);
+        }
+    }
+    if (PRESERVE_KERNELS) {
+        console.log('[Kernel] Preserve kernels enabled');
+    }
+    if (REATTACH_KERNELS) {
+        console.log('[Kernel] Reattach kernels on startup enabled');
+    }
+    // Initialize authentication
+    const setupNeeded = await auth_2.authService.initialize();
+    if (setupNeeded) {
+        auth_2.authService.printSetupInstructions();
+    }
+    else {
+        console.log('[Auth] 2FA configured and ready');
+    }
+    // Set local server ID from hostname
+    const localServerId = `${os.hostname()}:${PORT}`;
+    server_registry_1.serverRegistry.setLocalServerId(localServerId);
+    console.log(`[Cluster] Local server ID: ${localServerId}`);
+    const serverInstanceId = (0, crypto_1.randomUUID)();
+    process.env.NEBULA_SERVER_ID = localServerId;
+    process.env.NEBULA_SERVER_INSTANCE_ID = serverInstanceId;
+    kernel_1.kernelService.setServerIdentity(localServerId, serverInstanceId);
+    // Create Fastify app (HTTP — always works, no cert warnings)
+    const fastify = await createApp();
+    // Setup static file serving
+    await setupStaticServing(fastify);
+    // Start HTTP server on main port
+    await fastify.listen({ port: Number(PORT), host: '0.0.0.0' });
+    // Get the raw Node.js server for WebSocket handling
+    const server = fastify.server;
+    // Setup WebSocket routing (kernel)
+    setupWebSockets(server);
+    // Setup terminal WebSocket (now using noServer mode)
+    (0, server_1.setupTerminalWebSocket)(server);
+    // Setup notebook operations WebSocket
+    (0, notebook_websocket_1.setupNotebookWebSocket)(server);
+    if (REATTACH_KERNELS) {
+        try {
+            const result = await kernel_1.kernelService.reattachOrphanedSessions();
+            if (result.attempted > 0) {
+                console.log(`[Kernel] Reattach summary: ${result.reattached} reattached, ${result.failed} failed, ${result.skipped} skipped`);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.warn(`[Kernel] Reattach failed: ${message}`);
+        }
+    }
+    // Graceful shutdown
+    let shuttingDown = false;
+    const shutdown = async () => {
+        if (shuttingDown)
+            return; // ignore repeat signals (tsx watch can send several)
+        shuttingDown = true;
+        console.log('\n[Server] Shutting down...');
+        console.log(`[Server] PRESERVE_KERNELS=${PRESERVE_KERNELS}`);
+        // Safety net: shutdown must never hang the process. fastify.close() blocks
+        // until every open connection drains, and Nebula holds long-lived WebSockets
+        // (kernel/notebook/terminal), so without this a SIGTERM from `tsx watch` would
+        // leave the old process alive — and backend code changes would silently never
+        // reload. Force-exit if cleanup stalls.
+        const forceExit = setTimeout(() => {
+            console.warn('[Server] Shutdown exceeded 3s — forcing exit');
+            process.exit(0);
+        }, 3000);
+        forceExit.unref();
+        // Cleanup terminals
+        (0, server_1.cleanupTerminals)();
+        // Cleanup kernel sessions (fast when preserving; awaited so kernel state is saved)
+        try {
+            await kernel_1.kernelService.shutdown({ preserveKernels: PRESERVE_KERNELS });
+        }
+        catch (err) {
+            console.error('[Server] Error during kernel cleanup:', err);
+        }
+        // Cleanup cluster registration
+        try {
+            await client_registration_1.clientRegistration.shutdown();
+            server_registry_1.serverRegistry.shutdown();
+        }
+        catch (err) {
+            console.error('[Server] Error during cluster cleanup:', err);
+        }
+        // Close the HTTP/WS server, but don't wait forever on open WebSocket clients —
+        // race the close against a short timeout so dev restarts stay snappy.
+        try {
+            await Promise.race([
+                fastify.close(),
+                new Promise((resolve) => setTimeout(resolve, 750)),
+            ]);
+        }
+        catch (err) {
+            console.error('[Server] Error during server close:', err);
+        }
+        console.log('[Server] Server closed');
+        clearTimeout(forceExit);
+        process.exit(0);
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    const protocol = fastify.server.constructor.name.includes('Secure') ? 'https' : 'http';
+    const wsProtocol = protocol === 'https' ? 'wss' : 'ws';
+    const mode = DEV_MODE ? 'development' : 'production';
+    console.log(`[Server] Nebula running on ${protocol}://localhost:${PORT} (${mode} mode)`);
+    console.log(`[Server] API endpoints: ${protocol}://localhost:${PORT}/api/*`);
+    console.log(`[Server] Kernel WebSocket: ${wsProtocol}://localhost:${PORT}/api/kernels/{session_id}/ws`);
+    console.log(`[Server] Notebook WebSocket: ${wsProtocol}://localhost:${PORT}/api/notebook/{path}/ws`);
+    console.log(`[Server] Terminal WebSocket: ${wsProtocol}://localhost:${PORT}/ws?id={terminal_id}`);
+    console.log(`[Server] Root directory: ${fs_service_1.fsService.getRootDirectory()} (change with --workdir)`);
+    // Initialize client registration (explicit client mode only)
+    if (CLIENT_MODE) {
+        client_registration_1.clientRegistration.initFromEnv(Number(PORT));
+    }
+}
+// Run
+main().catch((err) => {
+    console.error('[Server] Fatal error:', err);
+    process.exit(1);
+});

package/node-server/dist/kernel/default-kernel.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Default kernel resolution based on the Python executable in the server env.
+ */
+export declare function getDefaultKernelName(): Promise<string | null>;
+export declare function invalidateDefaultKernelName(): void;