neoctl-web 0.1.0

package/server.mjs

@@ -0,0 +1,450 @@
+import http from 'node:http';
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { coreRuntimeInfo, createWebRuntime, loadNeoPlugins, runWebServer } from './core-runtime.mjs';
+import { createWebPluginHost } from './plugins.mjs';
+import { createWebPluginSettings } from './plugin-settings.mjs';
+import { createWebToolSettings } from './tool-settings.mjs';
+import { createWorkspaceRuntimeManager } from './runtime-workspaces.mjs';
+import { installRuntimeRouterIdleCleanup } from './runtime-router-cleanup.mjs';
+import { createCpaQuotaMonitor } from './cpa-quota.mjs';
+import { createMemoryMonitor } from './memory-monitor.mjs';
+
+installRuntimeRouterIdleCleanup();
+console.log(`neo core: ${coreRuntimeInfo.source} ${coreRuntimeInfo.version} (${coreRuntimeInfo.location})`);
+process.env.NEO_CORE_VERSION = coreRuntimeInfo.version;
+process.env.NEO_CLIENT_REVISION ||= `${coreRuntimeInfo.version}-${Date.now().toString(36)}`;
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(process.env.DIST_DIR || path.join(__dirname, 'dist'));
+const host = process.env.APP_HOST || '0.0.0.0';
+const port = Number(process.env.APP_PORT || process.env.PORT || 5173);
+const runtimeTarget = new URL(process.env.NEO_RUNTIME_TARGET || 'http://127.0.0.1:3101');
+const dataRoot = path.resolve(process.env.NEO_WEB_DATA_DIR || path.join(process.cwd(), '.neoctl-web'));
+const promptLibraryFile = path.resolve(process.env.NEO_PROMPT_LIBRARY_FILE || path.join(dataRoot, 'prompt-library.json'));
+const uploadsDir = path.resolve(process.env.NEO_UPLOADS_DIR || path.join(dataRoot, 'uploads'));
+const pluginDir = path.resolve(process.env.NEO_WEB_PLUGIN_DIR || path.join(__dirname, 'plugins'));
+const pluginDataDir = path.resolve(process.env.NEO_WEB_PLUGIN_DATA_DIR || dataRoot);
+const cpaConfigFile = path.resolve(process.env.NEO_CPA_CONFIG_FILE || path.join(dataRoot, 'cpa-config.json'));
+const memoryMonitorFile = path.resolve(process.env.NEO_MEMORY_MONITOR_FILE || path.join(dataRoot, 'memory-monitor.json'));
+const pluginSettingsFile = path.resolve(process.env.NEO_WEB_PLUGIN_SETTINGS_FILE || path.join(dataRoot, 'plugins.json'));
+const toolSettingsFile = path.resolve(process.env.NEO_WEB_TOOL_SETTINGS_FILE || path.join(dataRoot, 'tools.json'));
+const maxUploadBytes = Number(process.env.NEO_UPLOAD_MAX_BYTES || 25 * 1024 * 1024);
+const pluginSettings = await createWebPluginSettings(pluginSettingsFile);
+const toolSettings = await createWebToolSettings(toolSettingsFile);
+const pluginEnv = process.env.NEO_WEB_PLUGINS;
+const pluginResources = await loadNeoPlugins({ directories: pluginDir, appDataDir: pluginDataDir });
+const pluginHost = createWebPluginHost({
+  plugins: pluginResources,
+  enabled: pluginEnv?.trim() ? pluginEnv : pluginSettings.globalEnabledIds(),
+  locked: Boolean(pluginEnv?.trim()),
+  settings: pluginSettings,
+});
+const embedRuntime = process.env.NEO_EMBED_RUNTIME !== 'false';
+const cpaQuotaMonitor = createCpaQuotaMonitor({ configFile: cpaConfigFile });
+const memoryMonitor = createMemoryMonitor({
+  storageFile: memoryMonitorFile,
+  sampleMs: process.env.NEO_MEMORY_SAMPLE_MS,
+  retentionMs: process.env.NEO_MEMORY_RETENTION_MS,
+  publicSamples: process.env.NEO_MEMORY_PUBLIC_SAMPLES,
+  maxPersistedSamples: process.env.NEO_MEMORY_MAX_PERSISTED_SAMPLES,
+  maxPersistedBytes: process.env.NEO_MEMORY_MAX_PERSISTED_BYTES,
+});
+const workspaceRuntime = createWorkspaceRuntimeManager({
+  projectRoot: process.cwd(),
+  workspaceRoot: path.resolve(process.env.NEO_WORKSPACE_ROOT || path.join(process.cwd(), 'workspace')),
+  createRuntime: (runtimeOptions) => createWebRuntime({
+    ...runtimeOptions,
+    ...pluginHost.runtimePlugins(runtimeOptions.sessionId),
+    globalToolOverrides: toolSettings.globalOverrides(),
+    sessionToolOverrides: toolSettings.sessionOverrides(runtimeOptions.sessionId),
+    persistGlobalToolOverrides: (overrides) => toolSettings.setGlobalOverrides(overrides),
+    persistSessionToolOverrides: (sessionId, overrides) => toolSettings.setSessionOverrides(sessionId, overrides),
+    resolveSessionToolOverrides: (sessionId) => toolSettings.sessionOverrides(sessionId),
+  }),
+});
+
+const DEFAULT_APP_PROMPT_LIBRARY = [];
+
+const mime = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.webp': 'image/webp',
+  '.ico': 'image/x-icon',
+};
+
+function shouldProxy(pathname) {
+  return pathname === '/events' || pathname.startsWith('/api/') || pathname === '/api' || pathname.startsWith('/vendor/');
+}
+
+const server = http.createServer((req, res) => {
+  void routeRequest(req, res);
+});
+
+server.keepAliveTimeout = 70_000;
+server.headersTimeout = 75_000;
+if (embedRuntime) await startEmbeddedRuntime();
+await cpaQuotaMonitor.start();
+await memoryMonitor.start();
+await new Promise((resolve, reject) => {
+  server.once('error', reject);
+  server.listen(port, host, () => {
+    server.off('error', reject);
+    console.log(`neo web listening on http://${host}:${port}, dist=${root}, runtime=${runtimeTarget.href}`);
+    resolve();
+  });
+});
+
+async function startEmbeddedRuntime() {
+  const runtimeHost = runtimeTarget.hostname || '127.0.0.1';
+  const runtimePort = runtimeTarget.port || '3101';
+  await runWebServer(['--host', runtimeHost, '--port', runtimePort], {
+    createRuntime: workspaceRuntime.createRuntime,
+    createRepl: workspaceRuntime.createRepl,
+  });
+}
+
+async function routeRequest(req, res) {
+  const url = new URL(req.url || '/', 'http://localhost');
+  try {
+    if (await pluginHost.route(req, res, url, { readJsonBody, sendJson })) return;
+    if (req.method === 'GET' && url.pathname === '/api/prompt-library') {
+      return sendJson(res, { items: await readPromptLibrary() });
+    }
+    if (req.method === 'GET' && url.pathname === '/api/cpa-quota') {
+      return sendJson(res, cpaQuotaMonitor.getPublicState());
+    }
+    if (req.method === 'GET' && url.pathname === '/api/memory') {
+      return sendJson(res, memoryMonitor.getPublicState());
+    }
+    if (req.method === 'POST' && url.pathname === '/api/cpa-config') {
+      const body = await readJsonBody(req);
+      const current = cpaQuotaMonitor.getPublicState();
+      const password = body?.preservePassword && current.config.hasPassword
+        ? undefined
+        : String(body?.password || '');
+      return sendJson(res, { ok: true, ...(await cpaQuotaMonitor.updateConfig({
+        url: body?.url,
+        password,
+        preservePassword: body?.preservePassword,
+      })) });
+    }
+    if (req.method === 'POST' && url.pathname === '/api/prompt-library') {
+      const body = await readJsonBody(req);
+      const item = normalizePromptItem(body?.item);
+      if (!item) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'invalid prompt item' }, 400);
+      const items = await readPromptLibrary();
+      const index = items.findIndex((entry) => entry.id === item.id);
+      if (index >= 0) items.splice(index, 1, item);
+      else items.unshift(item);
+      await writePromptLibrary(items);
+      return sendJson(res, { ok: true, item, items });
+    }
+    if (req.method === 'POST' && url.pathname === '/api/prompt-library/delete') {
+      const body = await readJsonBody(req);
+      const id = String(body?.id || '').trim();
+      if (!id) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'missing prompt id' }, 400);
+      const items = await readPromptLibrary();
+      const nextItems = items.filter((entry) => entry.id !== id);
+      await writePromptLibrary(nextItems);
+      return sendJson(res, { ok: true, items: nextItems });
+    }
+    if (req.method === 'POST' && url.pathname === '/api/prompt-library/reorder') {
+      const body = await readJsonBody(req);
+      const ids = Array.isArray(body?.ids) ? body.ids.map((id) => String(id || '').trim()).filter(Boolean) : [];
+      if (!ids.length || new Set(ids).size !== ids.length) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'invalid prompt order' }, 400);
+      const items = await readPromptLibrary();
+      const byId = new Map(items.map((item) => [item.id, item]));
+      if (ids.some((id) => !byId.has(id))) return sendJson(res, { errorCode: 'PROMPT_INVALID', error: 'prompt order contains unknown id' }, 400);
+      const ordered = ids.map((id) => byId.get(id));
+      const included = new Set(ids);
+      ordered.push(...items.filter((item) => !included.has(item.id)));
+      await writePromptLibrary(ordered);
+      return sendJson(res, { ok: true, items: ordered });
+    }
+    if (req.method === 'GET' && url.pathname.startsWith('/api/uploads/')) {
+      const storedName = decodeURIComponent(url.pathname.slice('/api/uploads/'.length));
+      return serveUploadedFile(res, storedName);
+    }
+    if (req.method === 'GET' && url.pathname.startsWith('/api/local-images/')) {
+      const encodedPath = decodeURIComponent(url.pathname.slice('/api/local-images/'.length));
+      return serveLocalImage(res, encodedPath);
+    }
+    if (req.method === 'POST' && url.pathname === '/api/uploads') {
+      const body = await readJsonBody(req);
+      const file = await storeUploadedFile(body);
+      return sendJson(res, { ok: true, file });
+    }
+    if (shouldProxy(url.pathname)) {
+      return proxy(req, res);
+    }
+    return serveStatic(res, url);
+  } catch (error) {
+    sendJson(res, { errorCode: 'WEB_REQUEST_FAILED', error: error instanceof Error ? error.message : String(error) }, 500);
+  }
+}
+
+async function proxy(req, res) {
+  const target = new URL(req.url || '/', runtimeTarget);
+  target.protocol = runtimeTarget.protocol;
+  target.hostname = runtimeTarget.hostname;
+  target.port = runtimeTarget.port;
+
+  const method = req.method || 'GET';
+  const requestBody = method === 'GET' || method === 'HEAD' ? undefined : await readRequestBody(req);
+  const requestHeaders = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === undefined) continue;
+    if (['host', 'content-length', 'connection', 'expect'].includes(key.toLowerCase())) continue;
+    requestHeaders.set(key, Array.isArray(value) ? value.join(', ') : value);
+  }
+
+  let upstream;
+  try {
+    upstream = await fetch(target, {
+      method,
+      headers: requestHeaders,
+      body: requestBody,
+    });
+
+    const responseHeaders = {};
+    for (const [key, value] of upstream.headers.entries()) {
+      if (['connection', 'content-length', 'transfer-encoding'].includes(key.toLowerCase())) continue;
+      responseHeaders[key] = value;
+    }
+    res.writeHead(upstream.status, responseHeaders);
+    if (!upstream.body) {
+      res.end();
+      return;
+    }
+
+    res.on('close', () => {
+      upstream.body?.cancel().catch(() => {});
+    });
+
+    for await (const chunk of upstream.body) {
+      if (res.destroyed) break;
+      if (!res.write(chunk) && !await waitForDrainOrClose(res)) break;
+    }
+    if (!res.writableEnded) res.end();
+  } catch (error) {
+    const isTerminatedSocket =
+      error?.name === 'TypeError' &&
+      error?.message === 'terminated' &&
+      error?.cause?.code === 'UND_ERR_SOCKET';
+    if (error?.name === 'AbortError' || isTerminatedSocket || res.destroyed) return;
+    throw error;
+  }
+}
+
+function waitForDrainOrClose(res) {
+  if (res.destroyed) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const cleanup = () => {
+      res.off('drain', onDrain);
+      res.off('close', onClose);
+      res.off('error', onClose);
+    };
+    const onDrain = () => {
+      cleanup();
+      resolve(true);
+    };
+    const onClose = () => {
+      cleanup();
+      resolve(false);
+    };
+    res.once('drain', onDrain);
+    res.once('close', onClose);
+    res.once('error', onClose);
+  });
+}
+
+async function serveStatic(res, url) {
+  let pathname = decodeURIComponent(url.pathname);
+  if (pathname === '/') pathname = '/index.html';
+  let filePath = path.resolve(root, `.${pathname}`);
+  if (!filePath.startsWith(root + path.sep) && filePath !== root) {
+    res.writeHead(403);
+    res.end('forbidden');
+    return;
+  }
+  try {
+    const stat = await fsp.stat(filePath);
+    if (stat.isDirectory()) filePath = path.join(filePath, 'index.html');
+  } catch {
+    filePath = path.join(root, 'index.html');
+  }
+
+  try {
+    const body = await fsp.readFile(filePath);
+    const ext = path.extname(filePath).toLowerCase();
+    const cache = filePath.includes(`${path.sep}assets${path.sep}`) ? 'public, max-age=31536000, immutable' : 'no-store';
+    res.writeHead(200, { 'Content-Type': mime[ext] || 'application/octet-stream', 'Cache-Control': cache });
+    res.end(body);
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  }
+}
+
+async function readPromptLibrary() {
+  try {
+    const raw = await fsp.readFile(promptLibraryFile, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) throw new Error('prompt library file must contain an array');
+    return parsed.map(normalizePromptItem).filter(Boolean);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    const items = DEFAULT_APP_PROMPT_LIBRARY.map(clonePromptItem);
+    await writePromptLibrary(items);
+    return items;
+  }
+}
+
+async function writePromptLibrary(items) {
+  await fsp.mkdir(path.dirname(promptLibraryFile), { recursive: true });
+  await fsp.writeFile(promptLibraryFile, `${JSON.stringify(items, null, 2)}\n`, 'utf8');
+}
+
+function normalizePromptItem(item) {
+  if (!item || typeof item !== 'object') return null;
+  const title = String(item.title || '').trim();
+  const content = String(item.content || '').trim();
+  if (!title || !content) return null;
+  return {
+    id: String(item.id || createPromptId()).trim(),
+    title,
+    content,
+    usage: String(item.usage || '').trim(),
+  };
+}
+
+function clonePromptItem(item) {
+  return { ...item };
+}
+
+function createPromptId() {
+  return `prompt-${Math.random().toString(36).slice(2, 10)}`;
+}
+
+async function storeUploadedFile(payload) {
+  const name = sanitizeUploadName(payload?.name);
+  if (!name) throw new Error('invalid upload name');
+  const data = String(payload?.data || '').trim();
+  if (!data) throw new Error('missing upload data');
+  const buffer = Buffer.from(data, 'base64');
+  if (!buffer.length) throw new Error('empty upload data');
+  if (buffer.length > maxUploadBytes) throw new Error(`upload too large: max ${maxUploadBytes} bytes`);
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const random = Math.random().toString(36).slice(2, 8);
+  const storedName = `${stamp}-${random}-${name}`;
+  await fsp.mkdir(uploadsDir, { recursive: true });
+  const absolutePath = path.join(uploadsDir, storedName);
+  await fsp.writeFile(absolutePath, buffer);
+  return {
+    id: `upload-${random}`,
+    name,
+    storedName,
+    size: buffer.length,
+    mimeType: normalizeMimeType(payload?.mimeType),
+    absolutePath,
+    relativePath: path.relative(__dirname, absolutePath) || storedName,
+    url: `/api/uploads/${encodeURIComponent(storedName)}`,
+  };
+}
+
+async function serveUploadedFile(res, storedName) {
+  const safeName = path.basename(String(storedName || '').trim());
+  if (!safeName || safeName !== storedName) {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('invalid upload name');
+    return;
+  }
+  const uploadRoot = path.resolve(uploadsDir);
+  const filePath = path.resolve(uploadRoot, safeName);
+  if (!filePath.startsWith(uploadRoot + path.sep)) {
+    res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('forbidden');
+    return;
+  }
+  try {
+    const body = await fsp.readFile(filePath);
+    res.writeHead(200, {
+      'Content-Type': mime[path.extname(filePath).toLowerCase()] || 'application/octet-stream',
+      'Cache-Control': 'public, max-age=31536000, immutable',
+    });
+    res.end(body);
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  }
+}
+
+async function serveLocalImage(res, encodedPath) {
+  let filePath = '';
+  try {
+    filePath = Buffer.from(encodedPath, 'base64url').toString('utf8');
+  } catch {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('invalid image path');
+    return;
+  }
+  const absolutePath = path.resolve(filePath);
+  const contentType = mime[path.extname(absolutePath).toLowerCase()] || 'application/octet-stream';
+  if (!contentType.startsWith('image/')) {
+    res.writeHead(415, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not an image');
+    return;
+  }
+  try {
+    const fileStat = await fsp.stat(absolutePath);
+    if (!fileStat.isFile()) throw new Error('not a file');
+    res.writeHead(200, {
+      'Content-Type': contentType,
+      'Content-Length': String(fileStat.size),
+      'Cache-Control': 'no-store',
+    });
+    fs.createReadStream(absolutePath)
+      .on('error', () => res.destroy())
+      .pipe(res);
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+  }
+}
+
+function sanitizeUploadName(value) {
+  const base = path.basename(String(value || '').trim()).replace(/[<>:"/\\|?*\u0000-\u001f]+/g, '-');
+  return base.replace(/\s+/g, ' ').trim().slice(0, 180);
+}
+
+function normalizeMimeType(value) {
+  const mimeType = String(value || '').trim();
+  return mimeType || 'application/octet-stream';
+}
+
+async function readJsonBody(req) {
+  const body = await readRequestBody(req);
+  if (!body.length) return {};
+  return JSON.parse(body.toString('utf8'));
+}
+
+async function readRequestBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}
+
+function sendJson(res, value, status = 200) {
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
+  res.end(JSON.stringify(value));
+}

package/tool-settings.mjs

@@ -0,0 +1,80 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+
+export async function createWebToolSettings(storageFile) {
+  let state = await readState(storageFile);
+  let writeQueue = Promise.resolve();
+
+  function snapshot() {
+    return structuredClone(state);
+  }
+
+  async function update(next) {
+    state = next;
+    writeQueue = writeQueue.catch(() => undefined).then(() => writeState(storageFile, state));
+    await writeQueue;
+  }
+
+  return {
+    snapshot,
+    globalOverrides() {
+      return { ...state.global };
+    },
+    sessionOverrides(sessionId) {
+      const value = state.sessions[String(sessionId || '')];
+      return value && typeof value === 'object' ? { ...value } : {};
+    },
+    async setGlobalOverrides(overrides) {
+      await update({ ...state, global: normalizeOverrides(overrides) });
+    },
+    async setSessionOverrides(sessionId, overrides) {
+      const id = String(sessionId || '').trim();
+      if (!id) throw new Error('session id is required');
+      const sessions = { ...state.sessions };
+      const normalized = normalizeOverrides(overrides);
+      if (Object.keys(normalized).length) sessions[id] = normalized;
+      else delete sessions[id];
+      await update({ ...state, sessions });
+    },
+  };
+}
+
+function normalizeOverrides(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  return Object.fromEntries(
+    Object.entries(value)
+      .filter(([name, enabled]) => String(name).trim() && typeof enabled === 'boolean')
+      .map(([name, enabled]) => [String(name).trim(), enabled])
+      .sort(([left], [right]) => left.localeCompare(right)),
+  );
+}
+
+async function readState(storageFile) {
+  if (!storageFile) return emptyState();
+  try {
+    const parsed = JSON.parse(await fsp.readFile(storageFile, 'utf8'));
+    const sessions = parsed?.sessions && typeof parsed.sessions === 'object' && !Array.isArray(parsed.sessions)
+      ? Object.fromEntries(Object.entries(parsed.sessions).map(([id, value]) => [id, normalizeOverrides(value)]))
+      : {};
+    return {
+      version: 1,
+      global: normalizeOverrides(parsed?.global),
+      sessions,
+    };
+  } catch (error) {
+    if (error?.code !== 'ENOENT') console.warn(`failed to read web tool settings: ${error.message || error}`);
+    return emptyState();
+  }
+}
+
+function emptyState() {
+  return { version: 1, global: {}, sessions: {} };
+}
+
+async function writeState(storageFile, state) {
+  if (!storageFile) return;
+  await fsp.mkdir(path.dirname(storageFile), { recursive: true });
+  const temporary = `${storageFile}.${process.pid}.tmp`;
+  await fsp.writeFile(temporary, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+  await fsp.rename(temporary, storageFile);
+}