newmark-agent 0.4.8 → 0.5.0

package/dist/server.js

@@ -33,12 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MOBILE_WORKSPACE_UPLOAD_MAX_BYTES = void 0;
+exports.configureHostedServer = configureHostedServer;
+exports.stopHostedServer = stopHostedServer;
+exports.hostedServerStatus = hostedServerStatus;
+exports.setHostedServerEnabled = setHostedServerEnabled;
 exports.runServer = runServer;
 exports.setHostedServerAutomation = setHostedServerAutomation;
 const http = __importStar(require("http"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+const crypto_1 = require("crypto");
 const uiPreferences_1 = require("./core/uiPreferences");
 const child_process_1 = require("child_process");
 const agent_1 = require("./core/agent");
@@ -49,6 +55,7 @@ const workspaceFileRouter_1 = require("./core/workspaceFileRouter");
 const nativeBash_1 = require("./core/nativeBash");
 const installUpdate_1 = require("./core/installUpdate");
 const mobilePairing_1 = require("./core/mobilePairing");
+const workEventCoalescer_1 = require("./core/workEventCoalescer");
 const PORT = 47890;
 let agent = null;
 let automation = null;
@@ -59,6 +66,14 @@ const mobileWorkEventSubscribers = new Set();
 const mobileScopedRuntimes = new Map();
 let hostedWorkEventSink = null;
 let unsubscribeHostedWorkEvents = null;
+let unsubscribeServerAgentWorkEvents = null;
+let hostedServer = null;
+let hostedServerRoot = '';
+let hostedServerOptions = {};
+let hostedServerError = '';
+let hostedServerStartedAt = 0;
+let hostedAccessHost = '';
+let hostedAccessHostCheckedAt = 0;
 let hostedConversationUiState;
 let hostedConversationUiAction;
 let hostedConversationPrompt;
@@ -74,9 +89,12 @@ function publishMobileWorkEvent(event) {
     }
 }
 function publishServerWorkEvent(event) {
+    serverWorkEventCoalescer.push(event);
+}
+const serverWorkEventCoalescer = new workEventCoalescer_1.WorkEventCoalescer(event => {
     publishMobileWorkEvent(event);
     hostedWorkEventSink?.(event);
-}
+});
 function mobileAuthorized(req) {
     if (!mobileToken)
         return false;
@@ -112,6 +130,8 @@ const MOBILE_EDITABLE_EXTENSIONS = new Set([
     '.bash', '.zsh', '.ps1', '.bat', '.cmd', '.sql', '.tex', '.typ', '.properties', '.gradle', '.gitignore',
 ]);
 const MOBILE_EDITOR_MAX_BYTES = 1024 * 1024;
+const MAX_API_BODY_BYTES = 30 * 1024 * 1024;
+exports.MOBILE_WORKSPACE_UPLOAD_MAX_BYTES = 64 * 1024 * 1024;
 function resolveMobileWorkspacePath(ws, relativePath) {
     const root = path.resolve(ws.path);
     const clean = String(relativePath || '').replace(/\\/g, '/').replace(/^\/+/, '');
@@ -130,6 +150,156 @@ function mobileEditableFile(target) {
     const base = path.basename(target).toLowerCase();
     return MOBILE_EDITABLE_EXTENSIONS.has(path.extname(base)) || MOBILE_EDITABLE_EXTENSIONS.has(base);
 }
+function validMobileUploadDirectory(value) {
+    const clean = String(value || '').replace(/\\/g, '/');
+    return !path.isAbsolute(clean)
+        && !/^[A-Za-z]:\//.test(clean)
+        && !clean.split('/').some(segment => segment === '..' || segment.includes('\0'));
+}
+function validMobileUploadFileName(value) {
+    const clean = String(value || '');
+    return clean.length > 0
+        && clean.length <= 255
+        && clean !== '.'
+        && clean !== '..'
+        && !clean.includes('/')
+        && !clean.includes('\\')
+        && !clean.includes('\0')
+        && path.basename(clean) === clean;
+}
+function numberedUploadName(fileName, index) {
+    if (index <= 0)
+        return fileName;
+    const extension = path.extname(fileName);
+    const stem = fileName.slice(0, fileName.length - extension.length);
+    return `${stem} (${index})${extension}`;
+}
+async function handleMobileWorkspaceUpload(req, res) {
+    if (agent && !agent.config.getBool('remote', 'touch_enabled')) {
+        mobileJson(res, { error: 'Remote touch disabled' }, 403);
+        req.resume();
+        return;
+    }
+    if (!mobileAuthorized(req)) {
+        mobileJson(res, { error: 'Unauthorized' }, 401);
+        req.resume();
+        return;
+    }
+    if (!agent) {
+        mobileJson(res, { error: 'Agent not initialized' }, 500);
+        req.resume();
+        return;
+    }
+    const url = new URL(req.url || '/', `http://localhost:${PORT}`);
+    const workspaceId = url.searchParams.get('workspaceId') || '';
+    const directory = url.searchParams.get('directory') || '';
+    const fileName = url.searchParams.get('fileName') || '';
+    const ws = resolveMobileWorkspace(agent, workspaceId);
+    if (!ws) {
+        mobileJson(res, { error: 'Unknown workspace' }, 404);
+        req.resume();
+        return;
+    }
+    if (!validMobileUploadDirectory(directory) || !validMobileUploadFileName(fileName)) {
+        mobileJson(res, { error: 'Invalid upload path or file name' }, 400);
+        req.resume();
+        return;
+    }
+    const declaredLength = Number(req.headers['content-length'] || -1);
+    if (Number.isFinite(declaredLength) && declaredLength > exports.MOBILE_WORKSPACE_UPLOAD_MAX_BYTES) {
+        mobileJson(res, { error: 'Upload exceeds the 64 MiB limit' }, 413);
+        req.resume();
+        return;
+    }
+    let temporaryPath = '';
+    try {
+        const resolved = resolveMobileWorkspacePath(ws, directory);
+        const realRoot = await fs.promises.realpath(resolved.root);
+        if (directory === 'Uploaded') {
+            await fs.promises.mkdir(resolved.target, { recursive: true });
+        }
+        const realDirectory = await fs.promises.realpath(resolved.target);
+        const canonicalRelative = path.relative(realRoot, realDirectory);
+        if (canonicalRelative === '..' || canonicalRelative.startsWith(`..${path.sep}`) || path.isAbsolute(canonicalRelative)) {
+            throw new Error('Path escapes workspace through a symbolic link');
+        }
+        const directoryStat = await fs.promises.stat(realDirectory);
+        if (!directoryStat.isDirectory()) {
+            mobileJson(res, { error: 'Upload destination is not a directory' }, 400);
+            req.resume();
+            return;
+        }
+        temporaryPath = path.join(realDirectory, `.newmark-upload-${(0, crypto_1.randomUUID)()}.tmp`);
+        const handle = await fs.promises.open(temporaryPath, 'wx', 0o600);
+        const hash = (0, crypto_1.createHash)('sha256');
+        let size = 0;
+        try {
+            for await (const part of req) {
+                const chunk = Buffer.isBuffer(part) ? part : Buffer.from(part);
+                size += chunk.length;
+                if (size > exports.MOBILE_WORKSPACE_UPLOAD_MAX_BYTES)
+                    throw new RangeError('Upload exceeds the 64 MiB limit');
+                hash.update(chunk);
+                let offset = 0;
+                while (offset < chunk.length) {
+                    const { bytesWritten } = await handle.write(chunk, offset, chunk.length - offset);
+                    if (bytesWritten <= 0)
+                        throw new Error('Unable to write the complete upload');
+                    offset += bytesWritten;
+                }
+            }
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        let finalPath = '';
+        let finalName = '';
+        let published = false;
+        for (let index = 0; index < 10_000; index++) {
+            finalName = numberedUploadName(fileName, index);
+            finalPath = path.join(realDirectory, finalName);
+            try {
+                // A hard link publishes the already-complete inode atomically and fails
+                // with EEXIST, so parallel uploads can never overwrite one another.
+                await fs.promises.link(temporaryPath, finalPath);
+                published = true;
+                break;
+            }
+            catch (error) {
+                if (error?.code === 'EEXIST')
+                    continue;
+                throw error;
+            }
+        }
+        if (!published)
+            throw new Error('Unable to allocate a unique upload name');
+        await fs.promises.unlink(temporaryPath);
+        temporaryPath = '';
+        const relativePath = path.posix.join(resolved.relative, finalName).replace(/^\.\//, '');
+        const suppliedMime = String(req.headers['content-type'] || 'application/octet-stream').split(';')[0].trim();
+        const mimeType = /^[\w.+-]+\/[\w.+-]+$/.test(suppliedMime) ? suppliedMime : 'application/octet-stream';
+        mobileJson(res, {
+            ok: true,
+            file: { name: finalName, path: relativePath, size, mimeType, sha256: hash.digest('hex'), created: true },
+        }, 201);
+    }
+    catch (error) {
+        if (temporaryPath)
+            await fs.promises.unlink(temporaryPath).catch(() => { });
+        if (error instanceof RangeError)
+            mobileJson(res, { error: error.message }, 413);
+        else if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') {
+            mobileJson(res, { error: 'Upload destination does not exist' }, 400);
+        }
+        else if (String(error?.message || '').toLowerCase().includes('workspace')) {
+            mobileJson(res, { error: 'Invalid upload destination' }, 400);
+        }
+        else {
+            mobileJson(res, { error: 'Upload could not be stored' }, 500);
+        }
+    }
+}
 function mobileRightSidebarState(current, ws, conversationId) {
     const scoped = mobileScopedAgent(ws, conversationId);
     return {
@@ -1107,7 +1277,7 @@ async function handleApi(req, res, body) {
                 const workspaceId = String(params.workspaceId || '');
                 const conversationId = String(params.conversationId || '');
                 const action = String(params.action || '');
-                const allowed = new Set(['goal_update', 'goal_guide', 'conversation_guide', 'goal_toggle_pause', 'goal_clear', 'flow_pause', 'flow_resume', 'flow_guide', 'conversation_stop', 'input_mode', 'queue_enqueue', 'queue_update', 'queue_delete', 'queue_toggle_pause', 'queue_guide']);
+                const allowed = new Set(['goal_update', 'goal_guide', 'conversation_guide', 'goal_toggle_pause', 'goal_clear', 'flow_pause', 'flow_resume', 'flow_guide', 'conversation_stop', 'input_mode', 'queue_enqueue', 'queue_update', 'queue_delete', 'queue_reorder', 'queue_toggle_pause', 'queue_guide']);
                 if (!workspaceId || !conversationId || !allowed.has(action)) {
                     mobileJson(res, { error: 'workspaceId, conversationId, and a valid action are required' }, 400);
                     return;
@@ -1448,7 +1618,8 @@ function startServer(root, options = {}) {
                 agent.setConversationFromStorage(previousConversation);
             }
         });
-    agent.subscribeWorkEvents(publishServerWorkEvent);
+    unsubscribeServerAgentWorkEvents?.();
+    unsubscribeServerAgentWorkEvents = agent.subscribeWorkEvents(publishServerWorkEvent);
     if (automation) {
         agent.setAutomationManager(automation);
         if (!options.automation)
@@ -1470,10 +1641,30 @@ function startServer(root, options = {}) {
             handleMobileEvents(req, res);
             return;
         }
+        if (req.method === 'POST' && url.pathname === '/api/mobile/workspace-file-upload') {
+            await handleMobileWorkspaceUpload(req, res);
+            return;
+        }
         if (req.method === 'POST' && url.pathname.startsWith('/api/')) {
             let body = '';
-            req.on('data', chunk => body += chunk);
-            req.on('end', () => handleApi(req, res, body));
+            let bodyBytes = 0;
+            let rejected = false;
+            req.on('data', chunk => {
+                if (rejected)
+                    return;
+                bodyBytes += Buffer.byteLength(chunk);
+                if (bodyBytes > MAX_API_BODY_BYTES) {
+                    rejected = true;
+                    if (url.pathname.startsWith('/api/mobile/'))
+                        mobileJson(res, { error: 'Request body too large' }, 413);
+                    else
+                        jsonResponse(res, { error: 'Request body too large' }, 413);
+                    return;
+                }
+                body += chunk;
+            });
+            req.on('end', () => { if (!rejected)
+                handleApi(req, res, body); });
             return;
         }
         if (url.pathname.startsWith('/api/')) {
@@ -1492,6 +1683,14 @@ function startServer(root, options = {}) {
     const lan = (0, mobilePairing_1.lanIpv4)();
     const accessHost = tailscale || lan || '<lan-or-tailscale-ip>';
     const tokenPath = path.join(root, '.newmark-mobile-token');
+    hostedServer = server;
+    hostedServerError = '';
+    hostedServerStartedAt = Date.now();
+    server.once('error', error => {
+        hostedServerError = error instanceof Error ? error.message : String(error);
+        if (hostedServer === server)
+            hostedServer = null;
+    });
     server.listen(PORT, bindHost, () => {
         console.log(`\n  Newmark Agent v1.0 - Server Mode`);
         console.log(`  Bind: ${bindHost}:${PORT}`);
@@ -1503,14 +1702,137 @@ function startServer(root, options = {}) {
         console.log(`  Mobile events (SSE): http://${accessHost}:${PORT}/api/mobile/events?token=<token>`);
         console.log(`  Press Ctrl+C to stop\n`);
     });
+    return server;
+}
+function configuredAccessHost() {
+    const now = Date.now();
+    if (now - hostedAccessHostCheckedAt < 30_000)
+        return hostedAccessHost;
+    hostedAccessHost = (0, mobilePairing_1.tailscaleIpv4)() || (0, mobilePairing_1.lanIpv4)() || '';
+    hostedAccessHostCheckedAt = now;
+    return hostedAccessHost;
+}
+function waitForHostedServerListening(timeoutMs = 5000) {
+    if (hostedServer?.listening)
+        return Promise.resolve();
+    return new Promise((resolve, reject) => {
+        const deadline = Date.now() + timeoutMs;
+        const tick = () => {
+            if (hostedServer?.listening)
+                return resolve();
+            if (hostedServerError)
+                return reject(new Error(hostedServerError));
+            if (Date.now() >= deadline)
+                return reject(new Error('Mobile server listen timeout'));
+            setTimeout(tick, 50);
+        };
+        tick();
+    });
+}
+async function probeHostedServer(host) {
+    if (!hostedServer?.listening || !mobileToken)
+        return { ok: false, error: hostedServerError || 'Mobile server is not listening' };
+    return await new Promise(resolve => {
+        const request = http.get({
+            hostname: host,
+            port: PORT,
+            path: `/api/mobile/hello?token=${encodeURIComponent(mobileToken)}`,
+            timeout: 1800,
+        }, response => {
+            let body = '';
+            response.setEncoding('utf8');
+            response.on('data', chunk => { body += chunk; });
+            response.on('end', () => {
+                try {
+                    const parsed = JSON.parse(body || '{}');
+                    const ok = response.statusCode === 200 && parsed.ok === true;
+                    resolve({ ok, error: ok ? '' : String(parsed.error || `HTTP ${response.statusCode || 0}`) });
+                }
+                catch (error) {
+                    resolve({ ok: false, error: error instanceof Error ? error.message : String(error) });
+                }
+            });
+        });
+        request.on('timeout', () => request.destroy(new Error('Mobile server probe timeout')));
+        request.on('error', error => resolve({ ok: false, error: error.message }));
+    });
+}
+function configureHostedServer(root, options = {}) {
+    hostedServerRoot = root;
+    hostedServerOptions = options;
+}
+async function stopHostedServer() {
+    const server = hostedServer;
+    hostedServer = null;
+    if (server) {
+        await new Promise(resolve => {
+            const timer = setTimeout(resolve, 2500);
+            server.close(() => {
+                clearTimeout(timer);
+                resolve();
+            });
+            server.closeAllConnections?.();
+        });
+    }
+    unsubscribeHostedWorkEvents?.();
+    unsubscribeHostedWorkEvents = null;
+    unsubscribeServerAgentWorkEvents?.();
+    unsubscribeServerAgentWorkEvents = null;
+    hostedServerStartedAt = 0;
+}
+async function hostedServerStatus(enabled = true, probeHost = '') {
+    const listening = !!hostedServer?.listening;
+    const host = enabled ? (String(probeHost || '').trim() || configuredAccessHost()) : '';
+    let reachable = false;
+    let error = hostedServerError;
+    if (enabled && listening) {
+        if (!host)
+            error = 'No LAN or Tailscale IPv4 address is available';
+        else {
+            const probe = await probeHostedServer(host);
+            reachable = probe.ok;
+            if (!probe.ok)
+                error = probe.error;
+        }
+    }
+    const state = !enabled ? 'off' : listening && reachable ? 'listening' : 'error';
+    return {
+        enabled,
+        listening,
+        reachable,
+        state,
+        host,
+        port: PORT,
+        error: state === 'error' ? (error || 'Mobile server is not reachable') : '',
+        checkedAt: new Date().toISOString(),
+        startedAt: hostedServerStartedAt,
+    };
+}
+async function setHostedServerEnabled(enabled, probeHost = '') {
+    await stopHostedServer();
+    hostedServerError = '';
+    if (enabled) {
+        if (!hostedServerRoot)
+            throw new Error('Hosted mobile server is not configured');
+        startServer(hostedServerRoot, hostedServerOptions);
+        try {
+            await waitForHostedServerListening();
+        }
+        catch (error) {
+            hostedServerError = error instanceof Error ? error.message : String(error);
+        }
+    }
+    return await hostedServerStatus(enabled, probeHost);
 }
-let hostedServerStarted = false;
 /** 托管启动 server（GUI/TUI 内嵌调用；幂等防重入，进程常驻即服务常驻） */
 function runServer(root, options = {}) {
-    if (hostedServerStarted)
+    if (!hostedServerRoot || Object.keys(options).length > 0)
+        configureHostedServer(root, options);
+    else
+        hostedServerRoot = root;
+    if (hostedServer?.listening)
         return;
-    hostedServerStarted = true;
-    startServer(root, options);
+    startServer(hostedServerRoot, hostedServerOptions);
 }
 /** Attach the GUI-owned automation manager after deferred startup. */
 function setHostedServerAutomation(manager) {