nolo-cli 0.1.26 → 0.1.29

package/server/handlers/appSandboxHandler.ts

@@ -0,0 +1,1055 @@
+// packages/server/handlers/appSandboxHandler.ts
+// 在我们服务器用 Bun Worker 沙箱运行用户部署的应用代码
+// 路由: /apps/:appId/*  → 加载代码 → Worker 沙箱执行 → 返回 Response
+
+import { join } from "path";
+import { tmpdir } from "os";
+import { writeFile, unlink } from "fs/promises";
+import { pathToFileURL } from "node:url";
+import serverDb from "../../database/server/db";
+import { saveVersion } from "./versionStore";
+import type { BundleFile } from "../appBundler";
+import {
+  getSpaceRecord,
+  normalizeSpaceId,
+  resolveUserSpaceRole,
+  type SpaceRole,
+} from "./appSpaceAccess";
+import {
+  buildLegacyAppRouteKey,
+  buildOwnerScopedAppKey,
+} from "../../app/utils/appKeys";
+import { WEB_AUTH_TOKEN_COOKIE } from "../../auth/tokenCookie";
+import { buildTombstoneRecord, isTombstoneRecord } from "../../database/tombstones";
+
+// ── 存储 key ────────────────────────────────────────────────
+export const APP_CODE_PREFIX = "app-code-";
+
+export type AppVisibility = "private" | "unlisted" | "public";
+
+export type AppSourceSnapshot =
+  | {
+      kind: "worker-code";
+      code: string;
+    }
+  | {
+      kind: "worker-files";
+      files: BundleFile[];
+    }
+  | {
+      kind: "react-spa";
+      files: BundleFile[];
+      entryFile: string;
+      externalImports: string[];
+    };
+
+export interface AppRecord {
+  appId?: string;
+  appKey?: string;
+  code: string;
+  userId: string;
+  name: string;
+  scriptName?: string;
+  deployMode?: "platform";
+  visibility?: AppVisibility;
+  source?: AppSourceSnapshot;
+  framework?: "worker" | "react-spa";
+  customUrl?: string;
+  versionServerOrigin?: string;
+  spaceId?: string;
+  updatedAt: number;
+  createdAt?: number;
+}
+
+type StoredAppRecord = AppRecord & { appId: string; appKey: string };
+type RepairStoredAppRecordOptions = {
+  persist?: boolean;
+  source?: "legacy" | "scoped";
+};
+
+type RepairStoredAppRecordResult = {
+  record: StoredAppRecord | null;
+  repairedLegacyMirror: boolean;
+  createdScopedMirror: boolean;
+  updatedScopedMirror: boolean;
+};
+
+export type AppLegacyMirrorBackfillStats = {
+  scanned: number;
+  repairedLegacyMirror: number;
+  createdScopedMirror: number;
+  updatedScopedMirror: number;
+};
+
+type AppRuntimeContext = {
+  auth: {
+    provided: boolean;
+    authenticated: boolean;
+  };
+  app: {
+    id: string;
+    key: string;
+    name: string;
+    ownerId: string;
+    visibility: AppVisibility;
+    spaceId: string | null;
+  };
+  user: null | {
+    id: string;
+    isOwner: boolean;
+    isSpaceMember: boolean;
+    spaceRole: SpaceRole | null;
+  };
+  space: null | {
+    id: string;
+    isMember: boolean;
+    role: SpaceRole | null;
+  };
+};
+
+function hydrateAppRecord(appId: string, record: AppRecord | null): StoredAppRecord | null {
+  if (!record) return null;
+  if (isTombstoneRecord(record)) return null;
+  const normalizedUserId =
+    typeof record.userId === "string" && record.userId.trim()
+      ? record.userId.trim()
+      : null;
+  if (!normalizedUserId) return null;
+  const normalizedSpaceId = normalizeSpaceId(record.spaceId ?? null) ?? undefined;
+  const appKey =
+    typeof record.appKey === "string" && record.appKey.trim()
+      ? record.appKey
+      : buildOwnerScopedAppKey({
+          userId: normalizedUserId,
+          appId,
+          spaceId: normalizedSpaceId,
+        });
+  return {
+    ...record,
+    userId: normalizedUserId,
+    appId,
+    appKey,
+    ...(normalizedSpaceId ? { spaceId: normalizedSpaceId } : {}),
+  };
+}
+
+function getRecordTimestamp(record: Partial<AppRecord> | null | undefined): number {
+  const value = Number(record?.updatedAt ?? record?.createdAt ?? 0);
+  return Number.isFinite(value) ? value : 0;
+}
+
+function comparableStoredAppRecord(record: StoredAppRecord | null | undefined) {
+  if (!record) return null;
+  return {
+    appId: record.appId,
+    appKey: record.appKey,
+    code: record.code,
+    userId: record.userId,
+    name: record.name,
+    scriptName: record.scriptName,
+    deployMode: record.deployMode,
+    visibility: record.visibility,
+    source: record.source,
+    framework: record.framework,
+    customUrl: record.customUrl,
+    spaceId: normalizeSpaceId(record.spaceId ?? null) ?? undefined,
+    updatedAt: record.updatedAt,
+    createdAt: record.createdAt,
+  };
+}
+
+function storedAppRecordsMatch(
+  left: StoredAppRecord | null | undefined,
+  right: StoredAppRecord | null | undefined
+): boolean {
+  return JSON.stringify(comparableStoredAppRecord(left)) === JSON.stringify(comparableStoredAppRecord(right));
+}
+
+async function repairStoredAppRecord(
+  appId: string,
+  record: AppRecord | null,
+  options: RepairStoredAppRecordOptions = {}
+): Promise<RepairStoredAppRecordResult> {
+  const persist = options.persist === true;
+  const source = options.source ?? "legacy";
+  const hydrated = hydrateAppRecord(appId, record);
+  if (!hydrated) {
+    return {
+      record: null,
+      repairedLegacyMirror: false,
+      createdScopedMirror: false,
+      updatedScopedMirror: false,
+    };
+  }
+
+  if (source === "scoped") {
+    return {
+      record: hydrated,
+      repairedLegacyMirror: false,
+      createdScopedMirror: false,
+      updatedScopedMirror: false,
+    };
+  }
+
+  const normalizedSpaceId = normalizeSpaceId(record?.spaceId ?? null);
+  const existingScoped = hydrateAppRecord(
+    appId,
+    (await serverDb.get(hydrated.appKey).catch(() => null)) as AppRecord | null
+  );
+  const hydratedTimestamp = getRecordTimestamp(hydrated);
+  const existingScopedTimestamp = getRecordTimestamp(existingScoped);
+  const shouldPreferScoped =
+    Boolean(existingScoped) && existingScopedTimestamp >= hydratedTimestamp;
+  const shouldRepairFromScoped =
+    shouldPreferScoped && existingScoped ? !storedAppRecordsMatch(hydrated, existingScoped) : false;
+  const resolvedRecord = shouldPreferScoped && existingScoped ? existingScoped : hydrated;
+  const repairedLegacyMirror =
+    record?.appId !== appId ||
+    record?.appKey !== hydrated.appKey ||
+    normalizedSpaceId !== (hydrated.spaceId ?? null) ||
+    shouldRepairFromScoped;
+  const shouldWriteScoped =
+    !existingScoped || existingScopedTimestamp < hydratedTimestamp;
+  const createdScopedMirror = !existingScoped && shouldWriteScoped;
+  const updatedScopedMirror = Boolean(existingScoped) && shouldWriteScoped;
+
+  const writes: Promise<unknown>[] = [];
+  if (persist && repairedLegacyMirror) {
+    writes.push(serverDb.put(`${APP_CODE_PREFIX}${appId}`, resolvedRecord));
+  }
+
+  if (persist && shouldWriteScoped) {
+    writes.push(serverDb.put(hydrated.appKey, resolvedRecord));
+  }
+
+  if (writes.length > 0) {
+    await Promise.all(writes);
+  }
+
+  return {
+    record: resolvedRecord,
+    repairedLegacyMirror,
+    createdScopedMirror,
+    updatedScopedMirror,
+  };
+}
+
+export async function backfillOwnerScopedAppRecords(options: {
+  dryRun?: boolean;
+  limit?: number;
+} = {}): Promise<AppLegacyMirrorBackfillStats> {
+  const stats: AppLegacyMirrorBackfillStats = {
+    scanned: 0,
+    repairedLegacyMirror: 0,
+    createdScopedMirror: 0,
+    updatedScopedMirror: 0,
+  };
+  const limit =
+    typeof options.limit === "number" && Number.isFinite(options.limit) && options.limit > 0
+      ? Math.floor(options.limit)
+      : null;
+
+  for await (const [key, value] of serverDb.iterator({
+    gte: APP_CODE_PREFIX,
+    lte: APP_CODE_PREFIX + "\xff",
+  })) {
+    if (limit !== null && stats.scanned >= limit) break;
+    const appId = key.slice(APP_CODE_PREFIX.length);
+    const result = await repairStoredAppRecord(appId, value as AppRecord, {
+      persist: !options.dryRun,
+      source: "legacy",
+    });
+    if (!result.record) continue;
+    stats.scanned += 1;
+    if (result.repairedLegacyMirror) stats.repairedLegacyMirror += 1;
+    if (result.createdScopedMirror) stats.createdScopedMirror += 1;
+    if (result.updatedScopedMirror) stats.updatedScopedMirror += 1;
+  }
+
+  return stats;
+}
+
+export async function saveAppCode(
+  appId: string,
+  code: string,
+  meta: {
+    userId: string;
+    name: string;
+    deployMode?: "platform";
+    visibility?: AppVisibility;
+    source?: AppSourceSnapshot;
+    framework?: "worker" | "react-spa";
+    customUrl?: string;
+    versionServerOrigin?: string;
+    spaceId?: string | null;
+  }
+): Promise<StoredAppRecord> {
+  const legacyExistingRaw: AppRecord | null = await serverDb
+    .get(`${APP_CODE_PREFIX}${appId}`)
+    .catch(() => null);
+  const legacyExisting = legacyExistingRaw && !isTombstoneRecord(legacyExistingRaw)
+    ? legacyExistingRaw
+    : null;
+  const now = Date.now();
+  const spaceId = normalizeSpaceId(meta.spaceId ?? legacyExisting?.spaceId ?? null) ?? undefined;
+  const appKey = buildOwnerScopedAppKey({
+    userId: meta.userId,
+    appId,
+    spaceId,
+  });
+  const keyExistingRaw: AppRecord | null = await serverDb.get(appKey).catch(() => null);
+  const keyExisting = keyExistingRaw && !isTombstoneRecord(keyExistingRaw)
+    ? keyExistingRaw
+    : null;
+  const existing = keyExisting ?? legacyExisting;
+  const visibility = meta.visibility ?? existing?.visibility ?? "private";
+  const { scriptName: _legacyScriptName, ...existingWithoutLegacyScriptName } = existing ?? {};
+  const { spaceId: _ignoredSpaceId, ...restMeta } = meta;
+  const record = hydrateAppRecord(appId, {
+    ...existingWithoutLegacyScriptName,
+    appId,
+    appKey,
+    ...restMeta,
+    code,
+    visibility,
+    versionServerOrigin: existing?.versionServerOrigin ?? meta.versionServerOrigin,
+    updatedAt: now,
+    createdAt: existing?.createdAt ?? now,
+    ...(spaceId ? { spaceId } : {}),
+  })!;
+  await Promise.all([
+    serverDb.put(appKey, record),
+    serverDb.put(`${APP_CODE_PREFIX}${appId}`, record),
+  ]);
+
+  // 每次保存自动创建版本快照（异步，不阻塞部署响应）
+  saveVersion("app", appId, record, { createdBy: meta.userId }).catch(() => {});
+  return record;
+}
+
+export async function saveAppSourceSnapshot(
+  appId: string,
+  source: AppSourceSnapshot,
+  meta?: {
+    framework?: "worker" | "react-spa";
+    preserveUpdatedAt?: boolean;
+    versionServerOrigin?: string;
+  }
+): Promise<StoredAppRecord | null> {
+  const existing = await getAppRecord(appId);
+  if (!existing) return null;
+
+  const next = hydrateAppRecord(appId, {
+    ...existing,
+    source,
+    framework:
+      meta?.framework ??
+      existing.framework ??
+      (source.kind === "react-spa" ? "react-spa" : "worker"),
+    versionServerOrigin: existing.versionServerOrigin ?? meta?.versionServerOrigin,
+    updatedAt: meta?.preserveUpdatedAt === false ? Date.now() : existing.updatedAt,
+  });
+  if (!next) return null;
+
+  await Promise.all([
+    serverDb.put(next.appKey, next),
+    serverDb.put(`${APP_CODE_PREFIX}${appId}`, next),
+  ]);
+  return next;
+}
+
+export async function setAppVisibility(appId: string, visibility: AppVisibility): Promise<boolean> {
+  try {
+    const existing = await getAppRecord(appId);
+    if (!existing) return false;
+    const next = {
+      ...existing,
+      visibility,
+      updatedAt: Date.now(),
+    };
+    await Promise.all([
+      serverDb.put(existing.appKey, next),
+      serverDb.put(`${APP_CODE_PREFIX}${appId}`, next),
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function setAppCustomUrl(
+  appId: string,
+  customUrl?: string | null
+): Promise<boolean> {
+  try {
+    const existing = await getAppRecord(appId);
+    if (!existing) return false;
+    const next = {
+      ...existing,
+      customUrl: customUrl?.trim() || undefined,
+      updatedAt: Date.now(),
+    };
+    await Promise.all([
+      serverDb.put(existing.appKey, next),
+      serverDb.put(`${APP_CODE_PREFIX}${appId}`, next),
+    ]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function findScopedAppRecordById(appId: string): Promise<AppRecord | null> {
+  for await (const [key, value] of serverDb.iterator({
+    gte: "app-",
+    lte: "app-\xff",
+  })) {
+    const stringKey = String(key);
+    if (stringKey.startsWith(APP_CODE_PREFIX)) continue;
+    const record = value as AppRecord | null;
+    if (record?.appId !== appId) continue;
+    return record;
+  }
+  return null;
+}
+
+export async function getAppRecord(appId: string): Promise<AppRecord | null> {
+  try {
+    const legacyRecord = await serverDb.get(`${APP_CODE_PREFIX}${appId}`).catch(() => null);
+    if (legacyRecord) {
+      return (
+        await repairStoredAppRecord(appId, legacyRecord as AppRecord, {
+          source: "legacy",
+        })
+      ).record;
+    }
+
+    const scopedRecord = await findScopedAppRecordById(appId);
+    if (!scopedRecord) return null;
+
+    const hydrated = hydrateAppRecord(appId, scopedRecord);
+    if (!hydrated) return null;
+    await serverDb.put(`${APP_CODE_PREFIX}${appId}`, hydrated).catch(() => {});
+    return hydrated;
+  } catch {
+    return null;
+  }
+}
+
+export async function getAppRecordByKey(appKey: string): Promise<AppRecord | null> {
+  if (!appKey) return null;
+  const direct = await serverDb.get(appKey).catch(() => null);
+  if (direct) {
+    const directAppId =
+      typeof (direct as AppRecord | null)?.appId === "string" &&
+      (direct as AppRecord).appId
+        ? (direct as AppRecord).appId!
+        : appKey;
+    return (
+      await repairStoredAppRecord(directAppId, direct as AppRecord, {
+        source: "scoped",
+      })
+    ).record;
+  }
+  const legacyFallbackId = appKey.startsWith("app-") ? appKey.slice("app-".length) : appKey;
+  const legacyRecord = await getAppRecord(legacyFallbackId);
+  if (legacyRecord) {
+    return legacyRecord;
+  }
+  for await (const [key, value] of serverDb.iterator({
+    gte: APP_CODE_PREFIX,
+    lte: APP_CODE_PREFIX + "\xff",
+  })) {
+    const appId = key.slice(APP_CODE_PREFIX.length);
+    const hydrated = (
+      await repairStoredAppRecord(appId, value as AppRecord, { source: "legacy" })
+    ).record;
+    if (!hydrated) continue;
+    const canonicalKey = buildOwnerScopedAppKey({
+      userId: hydrated.userId,
+      appId,
+      spaceId: hydrated.spaceId,
+    });
+    if (canonicalKey === appKey || buildLegacyAppRouteKey(appId) === appKey) {
+      return hydrated;
+    }
+  }
+  return null;
+}
+
+// 扫描所有 public app（用于社区列表）
+export async function listPublicApps(): Promise<any[]> {
+  const results: any[] = [];
+  for await (const [key, value] of serverDb.iterator({
+    gte: APP_CODE_PREFIX,
+    lte: APP_CODE_PREFIX + "\xff",
+  })) {
+    const appId = key.slice(APP_CODE_PREFIX.length);
+    const record = (
+      await repairStoredAppRecord(appId, value as AppRecord, { source: "legacy" })
+    ).record;
+    if (record?.visibility === "public") {
+      const appId = key.slice(APP_CODE_PREFIX.length);
+      results.push({ ...record, code: undefined });
+    }
+  }
+  return results;
+}
+
+export async function listUserApps(userId: string): Promise<any[]> {
+  const results = new Map<string, any>();
+  const scopedPrefix = `app-${userId}-`;
+  for await (const [key, value] of serverDb.iterator({
+    gte: scopedPrefix,
+    lte: `${scopedPrefix}\xff`,
+  })) {
+    const record = value as AppRecord;
+    if (record?.userId !== userId || !record?.name) continue;
+    const appId =
+      typeof record.appId === "string" && record.appId
+        ? record.appId
+        : String(key).slice(scopedPrefix.length);
+    const hydrated = hydrateAppRecord(appId, record);
+    if (!hydrated) continue;
+    results.set(appId, { ...hydrated, code: undefined });
+  }
+  for await (const [key, value] of serverDb.iterator({
+    gte: APP_CODE_PREFIX,
+    lte: APP_CODE_PREFIX + "\xff",
+  })) {
+    const record = value as AppRecord;
+    if (record?.userId !== userId) continue;
+    const appId = key.slice(APP_CODE_PREFIX.length);
+    if (results.has(appId)) continue;
+    const hydrated = (
+      await repairStoredAppRecord(appId, record, { persist: true, source: "legacy" })
+    ).record;
+    if (!hydrated) continue;
+    results.set(appId, { ...hydrated, code: undefined });
+  }
+  return [...results.values()];
+}
+
+export async function listSpaceApps(spaceId: string): Promise<any[]> {
+  const space = await getSpaceRecord(spaceId);
+  const contentKeys = new Set<string>();
+  for (const item of Object.values(space?.contents ?? {})) {
+    const content = item as { type?: string; contentKey?: string } | null;
+    if (!content || content.type?.toLowerCase() !== "app" || !content.contentKey) continue;
+    contentKeys.add(content.contentKey);
+  }
+
+  const directRecords = await Promise.all(
+    [...contentKeys].map(async (contentKey) => {
+      const record = await getAppRecordByKey(contentKey);
+      if (!record) return null;
+      return { ...(record as StoredAppRecord), code: undefined };
+    })
+  );
+  const resolvedDirectRecords = directRecords.filter(Boolean);
+  return resolvedDirectRecords;
+}
+
+// ── legacy 清理索引：仅用于删除旧的 app-script-* key ───────────────
+// 新的 app CRUD / deploy 主路径已经不再读写这类索引。
+// 当一次性 sweep 脚本确认线上旧 key 已清空后，可连同 APP_SCRIPT_PREFIX
+// 和 deleteAppScriptIndex 一起删除。
+const APP_SCRIPT_PREFIX = "app-script-";
+
+export async function deleteAppScriptIndex(scriptName: string): Promise<void> {
+  try {
+    await serverDb.del(`${APP_SCRIPT_PREFIX}${scriptName}`);
+  } catch {}
+}
+
+export async function deleteAppCode(
+  appId: string,
+  options?: { appKey?: string | null }
+): Promise<void> {
+  const record = await getAppRecord(appId);
+  const explicitAppKey =
+    typeof options?.appKey === "string" && options.appKey.trim()
+      ? options.appKey.trim()
+      : null;
+  const keyToDelete = explicitAppKey ?? record?.appKey ?? null;
+  const nowIso = new Date().toISOString();
+  await evictAppRuntime(appId);
+  await Promise.all([
+    serverDb.del(`${APP_CODE_PREFIX}${appId}`).catch(() => {}),
+    keyToDelete
+      ? serverDb
+          .put(
+            keyToDelete,
+            buildTombstoneRecord(
+              record
+                ? {
+                    ...record,
+                    appId,
+                    appKey: keyToDelete,
+                    type: "app",
+                    dbKey: keyToDelete,
+                  }
+                : {
+                    appId,
+                    appKey: keyToDelete,
+                    dbKey: keyToDelete,
+                    type: "app",
+                  },
+              nowIso
+            )
+          )
+          .catch(() => {})
+      : Promise.resolve(),
+  ]);
+}
+
+async function loadAppCode(appId: string): Promise<string | null> {
+  try {
+    const record = await serverDb.get(`${APP_CODE_PREFIX}${appId}`) as any;
+    return record?.code ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// ── Worker 池：cacheKey → { worker, pending, lastUsed, tmpFiles } ─
+// cacheKey = `${appId}:${codeHash}`，代码变更后旧 Worker 自动失效
+interface PoolEntry {
+  worker: Worker;
+  pending: Map<number, { resolve: (v: any) => void; reject: (e: any) => void }>;
+  lastUsed: number;
+  tmpFiles: string[];
+}
+
+const POOL = new Map<string, PoolEntry>();
+// appId → 当前活跃的 cacheKey（用于代码更新时驱逐旧 Worker）
+const APP_CACHE_KEY = new Map<string, string>();
+const POOL_TTL_MS = 5 * 60 * 1000; // 5分钟无访问则驱逐
+let _reqId = 0;
+
+function codeHash(code: string): string {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < code.length; i++) {
+    h ^= code.charCodeAt(i);
+    h = (h * 0x01000193) >>> 0;
+  }
+  return h.toString(36);
+}
+
+async function evictWorker(cacheKey: string): Promise<void> {
+  const entry = POOL.get(cacheKey);
+  if (entry) {
+    entry.worker.terminate();
+    POOL.delete(cacheKey);
+    await Promise.all(entry.tmpFiles.map((f) => unlink(f).catch(() => {})));
+  }
+  for (const [appId, activeCacheKey] of APP_CACHE_KEY.entries()) {
+    if (activeCacheKey === cacheKey) {
+      APP_CACHE_KEY.delete(appId);
+    }
+  }
+}
+
+export async function evictAppRuntime(appId: string): Promise<void> {
+  const cacheKey = APP_CACHE_KEY.get(appId);
+  if (!cacheKey) return;
+  await evictWorker(cacheKey);
+}
+
+// 定期清理空闲 Worker
+const workerPoolCleanupTimer = setInterval(() => {
+  const now = Date.now();
+  for (const [cacheKey, entry] of POOL) {
+    if (now - entry.lastUsed > POOL_TTL_MS) {
+      evictWorker(cacheKey);
+    }
+  }
+}, 60_000);
+
+// 允许一次性脚本 import 本模块后在完成工作时自然退出。
+if (typeof (workerPoolCleanupTimer as { unref?: () => void }).unref === "function") {
+  (workerPoolCleanupTimer as { unref: () => void }).unref();
+}
+
+async function getOrCreateWorker(appId: string, code: string): Promise<PoolEntry> {
+  const key = `${appId}:${codeHash(code)}`;
+
+  // 若代码变了，驱逐旧 Worker
+  const prevKey = APP_CACHE_KEY.get(appId);
+  if (prevKey && prevKey !== key) {
+    evictWorker(prevKey);
+  }
+
+  const existing = POOL.get(key);
+  if (existing) {
+    existing.lastUsed = Date.now();
+    return existing;
+  }
+
+  // 写用户代码到临时文件（ESM 格式）
+  // 文件名含 codeHash，避免同一 appId 并发新旧代码更新时互相覆盖临时文件
+  const hash = codeHash(code);
+  const userFile = join(tmpdir(), `nolo-app-${appId}-${hash}.mjs`);
+  const wrapperFile = join(tmpdir(), `nolo-wrap-${appId}-${hash}.mjs`);
+  const userFileUrl = pathToFileURL(userFile).href;
+  const wrapperFileUrl = pathToFileURL(wrapperFile);
+
+  // wrapper 负责：导入用户模块 + postMessage 桥接
+  const wrapperCode = `
+import userApp from "${userFileUrl}";
+
+let handler = null;
+if (userApp && typeof userApp.fetch === "function") {
+  handler = userApp;  // export { fetch }
+} else if (userApp && userApp.default && typeof userApp.default.fetch === "function") {
+  handler = userApp.default;  // export default { fetch }
+}
+
+self.onmessage = async (e) => {
+  const { id, method, url, headers, body, env: runtimeEnv } = e.data;
+  if (!handler) {
+    self.postMessage({ id, error: "Worker 未导出 fetch 处理器", status: 500 });
+    return;
+  }
+  try {
+    const req = new Request(url, {
+      method,
+      headers: new Headers(headers ?? {}),
+      body: body ?? null,
+    });
+    const env = runtimeEnv && typeof runtimeEnv === "object" ? runtimeEnv : {};
+    const resp = await handler.fetch(req, env);
+    const buf = await resp.arrayBuffer();
+    const uint8 = new Uint8Array(buf);
+    self.postMessage(
+      { id, status: resp.status, headers: [...resp.headers.entries()], body: uint8 },
+      [uint8.buffer]
+    );
+  } catch (err) {
+    self.postMessage({ id, error: String(err), status: 500 });
+  }
+};
+`;
+
+  await writeFile(userFile, code, "utf-8");
+  await writeFile(wrapperFile, wrapperCode, "utf-8");
+
+  const worker = new Worker(wrapperFileUrl, { type: "module" });
+  const pending = new Map<number, { resolve: (v: any) => void; reject: (e: any) => void }>();
+
+  worker.onmessage = (e: MessageEvent) => {
+    const { id, ...rest } = e.data;
+    const p = pending.get(id);
+    if (p) { pending.delete(id); p.resolve(rest); }
+  };
+  worker.onerror = (e: ErrorEvent) => {
+    for (const [, p] of pending) p.reject(new Error(e.message));
+    pending.clear();
+    POOL.delete(key);
+    APP_CACHE_KEY.delete(appId);
+    unlink(userFile).catch(() => {});
+    unlink(wrapperFile).catch(() => {});
+  };
+
+  const entry: PoolEntry = { worker, pending, lastUsed: Date.now(), tmpFiles: [userFile, wrapperFile] };
+  POOL.set(key, entry);
+  APP_CACHE_KEY.set(appId, key);
+  return entry;
+}
+
+function callWorker(entry: PoolEntry, payload: object): Promise<any> {
+  return new Promise((resolve, reject) => {
+    const id = ++_reqId;
+    entry.pending.set(id, { resolve, reject });
+    entry.worker.postMessage({ id, ...payload });
+    // 30s 超时
+    setTimeout(() => {
+      if (entry.pending.has(id)) {
+        entry.pending.delete(id);
+        reject(new Error("Worker 响应超时"));
+      }
+    }, 30_000);
+  });
+}
+
+function isHtmlNavigationRequest(req: Request): boolean {
+  const accept = (req.headers.get("accept") ?? req.headers.get("Accept") ?? "").toLowerCase();
+  const secFetchDest = (req.headers.get("sec-fetch-dest") ?? req.headers.get("Sec-Fetch-Dest") ?? "").toLowerCase();
+  const secFetchMode = (req.headers.get("sec-fetch-mode") ?? req.headers.get("Sec-Fetch-Mode") ?? "").toLowerCase();
+
+  return (
+    accept.includes("text/html") ||
+    secFetchDest === "document" ||
+    secFetchMode === "navigate"
+  );
+}
+
+function createJsonErrorResponse(status: number, message: string): Response {
+  return new Response(JSON.stringify({ error: message }), {
+    status,
+    headers: { "Content-Type": "application/json; charset=utf-8" },
+  });
+}
+
+function createSpaceMemberGatePageResponse(): Response {
+  return new Response(
+    `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>访问受限 - nolo.chat</title>
+  <style>
+    :root {
+      color-scheme: light;
+      --bg: #f6f7fb;
+      --card: #ffffff;
+      --text: #111827;
+      --muted: #6b7280;
+      --border: #e5e7eb;
+      --primary: #111827;
+      --primary-hover: #000000;
+      --secondary-bg: #ffffff;
+      --secondary-hover: #f9fafb;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 24px;
+      font-family: Inter, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      background: radial-gradient(circle at top, #ffffff 0%, var(--bg) 58%);
+      color: var(--text);
+    }
+    .card {
+      width: 100%;
+      max-width: 560px;
+      background: var(--card);
+      border: 1px solid var(--border);
+      border-radius: 20px;
+      box-shadow: 0 20px 60px rgba(17, 24, 39, 0.08);
+      padding: 32px;
+    }
+    .brand {
+      font-size: 14px;
+      font-weight: 700;
+      letter-spacing: 0.08em;
+      text-transform: uppercase;
+      color: var(--muted);
+      margin-bottom: 16px;
+    }
+    h1 {
+      margin: 0 0 12px;
+      font-size: 28px;
+      line-height: 1.25;
+    }
+    p {
+      margin: 0;
+      color: var(--muted);
+      line-height: 1.7;
+      font-size: 15px;
+    }
+    .actions {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin-top: 28px;
+    }
+    .button {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 44px;
+      padding: 0 18px;
+      border-radius: 12px;
+      border: 1px solid var(--border);
+      text-decoration: none;
+      font-weight: 600;
+      font-size: 14px;
+      transition: all 0.15s ease;
+    }
+    .button-primary {
+      background: var(--primary);
+      color: #ffffff;
+      border-color: var(--primary);
+    }
+    .button-primary:hover {
+      background: var(--primary-hover);
+      border-color: var(--primary-hover);
+    }
+    .button-secondary {
+      background: var(--secondary-bg);
+      color: var(--text);
+    }
+    .button-secondary:hover {
+      background: var(--secondary-hover);
+    }
+    .hint {
+      margin-top: 18px;
+      font-size: 13px;
+      color: var(--muted);
+    }
+    @media (max-width: 640px) {
+      .card { padding: 24px; border-radius: 16px; }
+      h1 { font-size: 24px; }
+      .actions { flex-direction: column; }
+      .button { width: 100%; }
+    }
+  </style>
+</head>
+<body>
+  <main class="card">
+    <div class="brand">nolo.chat</div>
+    <h1>这个演示应用仅对空间成员开放</h1>
+    <p>请先登录或注册 nolo.chat 账号，再由分享者将你加入对应空间后访问此应用。</p>
+    <div class="actions">
+      <a class="button button-primary" href="/login">登录</a>
+      <a class="button button-secondary" href="/signup">注册</a>
+      <a class="button button-secondary" href="/">返回首页</a>
+    </div>
+    <div class="hint">如果你认为自己应该有权限，请联系分享者为你开通空间访问权限。</div>
+  </main>
+</body>
+</html>`,
+    {
+      status: 403,
+      headers: { "Content-Type": "text/html; charset=utf-8" },
+    }
+  );
+}
+
+function createSpaceMemberForbiddenResponse(req: Request): Response {
+  if (isHtmlNavigationRequest(req)) {
+    return createSpaceMemberGatePageResponse();
+  }
+  return createJsonErrorResponse(403, "此应用仅限空间成员访问");
+}
+
+async function resolveSandboxRuntimeContext(
+  req: Request,
+  record: StoredAppRecord
+): Promise<AppRuntimeContext | Response> {
+  const authHeader = req.headers.get("authorization") ?? req.headers.get("Authorization") ?? "";
+  const cookieHeader = req.headers.get("cookie") ?? req.headers.get("Cookie") ?? "";
+  const authProvided =
+    /^Bearer\s+.+$/i.test(authHeader) ||
+    cookieHeader.includes(`${WEB_AUTH_TOKEN_COOKIE}=`);
+  let authUserId: string | null = null;
+
+  if (authProvided) {
+    const { authenticateRequest } = await import("../../auth/utils");
+    const auth = await authenticateRequest(req);
+    if (!(auth instanceof Response)) {
+      authUserId = auth.userId;
+    } else if (record.spaceId && record.visibility === "private") {
+      return createSpaceMemberForbiddenResponse(req);
+    }
+  } else if (record.spaceId && record.visibility === "private") {
+    return createSpaceMemberForbiddenResponse(req);
+  }
+
+  const spaceRole =
+    authUserId && record.spaceId
+      ? await resolveUserSpaceRole(authUserId, record.spaceId)
+      : null;
+
+  if (record.spaceId && record.visibility === "private" && !spaceRole) {
+    return createSpaceMemberForbiddenResponse(req);
+  }
+
+  return {
+    auth: {
+      provided: authProvided,
+      authenticated: Boolean(authUserId),
+    },
+    app: {
+      id: record.appId,
+      key: record.appKey,
+      name: record.name,
+      ownerId: record.userId,
+      visibility: record.visibility ?? "private",
+      spaceId: record.spaceId ?? null,
+    },
+    user: authUserId
+      ? {
+          id: authUserId,
+          isOwner: authUserId === record.userId,
+          isSpaceMember: Boolean(spaceRole),
+          spaceRole,
+        }
+      : null,
+    space: record.spaceId
+      ? {
+          id: record.spaceId,
+          isMember: Boolean(spaceRole),
+          role: spaceRole,
+        }
+      : null,
+  };
+}
+
+// ── 主 handler ───────────────────────────────────────────────
+// GET/POST/... /apps/:appId/*
+export async function handleAppSandbox(req: Request): Promise<Response> {
+  const url = new URL(req.url);
+  // 从路径提取 appId: /apps/{appId}/...
+  const match = url.pathname.match(/^\/apps\/([^/]+)(\/.*)?$/);
+  if (!match) return new Response("Not Found", { status: 404 });
+
+  const appId = match[1];
+
+  const record = await getAppRecord(appId);
+  const code = record?.code ?? null;
+  if (!code || !record) {
+    return createJsonErrorResponse(404, "应用不存在或未部署");
+  }
+  const runtimeContext = await resolveSandboxRuntimeContext(req, record as StoredAppRecord);
+  if (runtimeContext instanceof Response) return runtimeContext;
+
+  let entry: PoolEntry;
+  try {
+    entry = await getOrCreateWorker(appId, code);
+  } catch (err) {
+    return createJsonErrorResponse(500, `沙箱启动失败: ${err}`);
+  }
+
+  // 读取请求 body
+  let body: ArrayBuffer | null = null;
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    try { body = await req.arrayBuffer(); } catch { body = null; }
+  }
+
+  const headersObj = Object.fromEntries(req.headers.entries());
+
+  // 剥去 /apps/{appId} 前缀，让应用代码看到与 CF Workers 一致的干净路径
+  // 平台模式: /apps/{appId}/about → /about
+  // CF 模式:  /about            → /about（代码无需改动，两端一致）
+  const workerUrl = new URL(req.url);
+  workerUrl.pathname = workerUrl.pathname.replace(`/apps/${appId}`, "") || "/";
+
+  let result: any;
+  try {
+    result = await callWorker(entry, {
+      method: req.method,
+      url: workerUrl.toString(),
+      headers: headersObj,
+      body,
+      env: { context: runtimeContext },
+    });
+  } catch (err) {
+    return createJsonErrorResponse(500, String(err));
+  }
+
+  if (result.error) {
+    return createJsonErrorResponse(result.status ?? 500, result.error);
+  }
+
+  const respHeaders = new Headers(result.headers ?? []);
+  return new Response(result.body, {
+    status: result.status ?? 200,
+    headers: respHeaders,
+  });
+}