oh-my-agent-web 0.2.0

package/dist/server/index.js

@@ -0,0 +1,543 @@
+/**
+ * oh-my-agent-web server — express + WebSocket hub in front of the codex app-server.
+ *
+ *   browser  <--ws /ws-->  [this]  <--ws-->  codex app-server (ws://127.0.0.1:25258)
+ *
+ * 我们是「透明 JSON-RPC 代理 + 进程守护」：
+ *  - 浏览器可以按名字调用任意 codex 方法；所有 codex 通知原样广播。
+ *  - `omaw/*` 是本地方法（状态 / 日志 / 文件系统 / 路径），由本进程处理。
+ *  - codex 反向请求（审批 / user input / 动态工具）广播给所有标签页，谁先 reply 谁赢，
+ *    随后广播 `serverRequest/resolved` 让其他标签页关掉弹窗。
+ *  - 同一 `dist/server/index.js` 既能被 CLI `startServer()` 调用，也能直接 `node` 运行。
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import express from "express";
+import { WebSocket, WebSocketServer } from "ws";
+import { CodexClient } from "./codex-client.js";
+import { CodexSupervisor } from "./codex-supervisor.js";
+import { RequestInspector } from "./request-inspector.js";
+import { FsError, listDirectory, paths as resolvePaths, readTextFile } from "./fs-service.js";
+import { LOCAL_METHODS, PROTOCOL_VERSION, } from "../shared/protocol.js";
+/* ------------------------------------------------------------------ */
+/* config                                                              */
+/* ------------------------------------------------------------------ */
+const DEFAULT_OMAW_PORT = 25257;
+const DEFAULT_OMAW_HOST = "127.0.0.1";
+const DEFAULT_CODEX_PORT = 25258;
+const DEFAULT_CODEX_BIN = "codex";
+const HEARTBEAT_MS = 30_000;
+const SERVER_REQUEST_HISTORY = 2_000;
+/**
+ * How long a proxied `codex/*` call waits for the app-server before giving up
+ * with `-32001`. Long enough to cover a cold `codex app-server` boot (and a
+ * reconnect after a crash), short enough that a genuinely dead server still
+ * reports an error quickly.
+ */
+const CODEX_READY_WAIT_MS = 20_000;
+/**
+ * `OMAW_DEV_WEB=1` —— dev 时前端不经 `web/dist`，而是把 Vite **挂在同一个进程里**
+ * 当中间件（middleware mode）。
+ *
+ * 这样对外只有一个源、一个端口：`http://127.0.0.1:25257`。页面由 Vite 现编
+ * （源码 + HMR，不用 build），`/ws` 与页面同源，也没有第二个端口要记、要开、
+ * 或者要配置跨源白名单。
+ */
+const DEV_SOURCE = process.env.OMAW_DEV_WEB === "1";
+/**
+ * Vite 的 HMR 通道挂在同一个 http server 上，得给个专属路径，
+ * 否则会和下面 `/ws` 的 upgrade 拦截器撞车（非 /ws 一律 destroy）。
+ */
+const DEV_HMR_PATH = "/omaw-hmr";
+/* ------------------------------------------------------------------ */
+/* package metadata                                                    */
+/* ------------------------------------------------------------------ */
+/** 从当前文件向上找 package.json —— 兼容 tsx(src) 与 dist 两种目录深度。 */
+function findPackageRoot(startDir) {
+    let dir = startDir;
+    for (let i = 0; i < 8; i += 1) {
+        if (existsSync(join(dir, "package.json")))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return startDir;
+}
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PACKAGE_ROOT = findPackageRoot(__dirname);
+function readOwnVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function codexVersionFromHandshake(userAgent) {
+    if (!userAgent)
+        return null;
+    // 形如 `codex-cli 0.156.1` 或 `codex/0.156.1 ...`。
+    const match = /(\d+\.\d+\.\d+(?:[-+][\w.]+)?)/.exec(userAgent);
+    return match ? match[1] : userAgent;
+}
+/* ------------------------------------------------------------------ */
+/* origin admission                                                    */
+/* ------------------------------------------------------------------ */
+function parseAllowOrigins() {
+    return (process.env.OMAW_ALLOW_ORIGINS ?? "")
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+}
+/**
+ * 浏览器 upgrade 的 Origin 校验：
+ *  - 无 Origin（curl / 脚本 / ws 测试）放行；
+ *  - 设置了 OMAW_ALLOW_ORIGINS 就按白名单；
+ *  - 否则放行同源，以及 localhost / 127.0.0.1 / ::1 的任意端口（覆盖 Vite dev server）。
+ */
+function originAllowed(req) {
+    const origin = req.headers.origin;
+    if (typeof origin !== "string" || !origin)
+        return true;
+    const lower = origin.toLowerCase();
+    const allow = parseAllowOrigins();
+    if (allow.length > 0)
+        return allow.includes(lower);
+    if (lower === "null")
+        return false;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    const hostHeader = req.headers.host;
+    if (typeof hostHeader === "string" && hostHeader) {
+        try {
+            const hostUrl = new URL(`http://${hostHeader}`);
+            if (url.hostname === hostUrl.hostname && url.port === hostUrl.port)
+                return true;
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    const hn = url.hostname.toLowerCase();
+    return hn === "localhost" || hn === "127.0.0.1" || hn === "::1" || hn === "[::1]";
+}
+/* ------------------------------------------------------------------ */
+/* helpers                                                             */
+/* ------------------------------------------------------------------ */
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function asJsonRpcError(err) {
+    if (err instanceof FsError)
+        return { code: err.code, message: err.message };
+    if (isRecord(err)) {
+        return {
+            code: typeof err.code === "number" ? err.code : -32000,
+            message: typeof err.message === "string" ? err.message : "internal error",
+            data: err.data,
+        };
+    }
+    return { code: -32000, message: err instanceof Error ? err.message : String(err) };
+}
+/* ------------------------------------------------------------------ */
+/* startServer                                                         */
+/* ------------------------------------------------------------------ */
+export async function startServer(options = {}) {
+    const version = readOwnVersion();
+    const cwd = resolve(options.cwd ?? process.env.OMAW_CWD ?? process.cwd());
+    const port = options.port ?? Number(process.env.OMAW_PORT ?? DEFAULT_OMAW_PORT);
+    const host = options.host ?? process.env.OMAW_HOST ?? DEFAULT_OMAW_HOST;
+    const codexPort = options.codexPort ?? Number(process.env.OMAW_CODEX_PORT ?? DEFAULT_CODEX_PORT);
+    const codexBin = options.codexBin ?? process.env.OMAW_CODEX_BIN ?? DEFAULT_CODEX_BIN;
+    const log = options.quiet
+        ? () => undefined
+        : (...args) => {
+            console.log("[oh-my-agent-web]", ...args);
+        };
+    /* -------- supervisor + client (capture/inspector off by default) -------- */
+    // 抓包（loopback Responses 代理）默认关闭：只有显式设置 OMAW_REQUEST_INSPECTOR=1
+    // 才会启动 inspector，也才会给 app-server 注入 chatgpt_base_url /
+    // model_providers.capture.base_url 这两个 -c 覆盖。默认一个都不加，codex 走自己的配置。
+    const inspector = new RequestInspector({ dataDir: join(PACKAGE_ROOT, "data") });
+    let inspectorUrl = "";
+    if (process.env.OMAW_REQUEST_INSPECTOR === "1") {
+        try {
+            inspectorUrl = await inspector.start();
+            log(`request inspector: ${inspectorUrl} -> ${process.env.OMAW_CODEX_UPSTREAM ?? "https://chatgpt.com/backend-api/codex"}`);
+        }
+        catch (error) {
+            log(`request inspector disabled: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    const supervisor = new CodexSupervisor({ port: codexPort, bin: codexBin, cwd, codexBaseUrl: inspectorUrl || undefined });
+    const client = new CodexClient(supervisor.url, version);
+    supervisor.onLog((line) => {
+        if (!options.quiet)
+            console.log("[codex]", line);
+    });
+    await supervisor.start();
+    void client.connect();
+    /* -------- HTTP app -------- */
+    const app = express();
+    app.disable("x-powered-by");
+    // 先建 http server：Vite 的 HMR 要挂到它上面（见下面的 middleware mode）。
+    // 路由按注册顺序匹配，所以这里提前 createServer 不影响 /api 的优先级。
+    const httpServer = createServer(app);
+    app.get("/api/health", (_req, res) => {
+        const body = { ok: true, codex: supervisor.status(), version };
+        res.json(body);
+    });
+    app.get("/api/version", (_req, res) => {
+        const hs = client.handshake();
+        res.json({
+            name: "oh-my-agent-web",
+            version,
+            protocolVersion: PROTOCOL_VERSION,
+            codexVersion: codexVersionFromHandshake(hs?.userAgent),
+            codexUserAgent: hs?.userAgent ?? null,
+            codexUrl: supervisor.url,
+        });
+    });
+    // 前端：dev 把 Vite 当中间件挂进本进程（源码 + HMR）；生产发 web/dist。
+    // 两种情况下对外都只有 http://127.0.0.1:<port> 一个源，页面与 /ws 同源。
+    if (DEV_SOURCE) {
+        // devDependency，且只在源码模式下加载。
+        const { createServer: createViteServer } = await import("vite");
+        const vite = await createViteServer({
+            configFile: join(PACKAGE_ROOT, "web", "vite.config.ts"),
+            // spa：index.html 的转换 + history fallback 都交给 Vite，
+            // 替代生产分支里那段 express 的 SPA fallback。
+            appType: "spa",
+            server: { middlewareMode: true, hmr: { server: httpServer, path: DEV_HMR_PATH } },
+        });
+        app.use(vite.middlewares);
+        httpServer.once("close", () => void vite.close());
+        log(`serving web UI from source via Vite (middleware mode, hmr=${DEV_HMR_PATH}, no build needed)`);
+    }
+    else {
+        const webDist = join(PACKAGE_ROOT, "web", "dist");
+        if (existsSync(webDist)) {
+            app.use(express.static(webDist));
+            app.get(/^\/(?!api\/|ws).*/, (_req, res) => {
+                res.sendFile(join(webDist, "index.html"));
+            });
+            log(`serving web UI from ${webDist}`);
+        }
+        else {
+            log(`web/dist not found — dev 直接跑 \`npm run dev\`（源码模式，无需 build），生产先 \`npm run build\``);
+            app.get(/^\/(?!api\/|ws).*/, (_req, res) => {
+                res.status(404).type("text/plain").send("web/dist 不存在。dev 请跑 npm run dev（源码模式，无需 build）；生产请先 npm run build。");
+            });
+        }
+    }
+    /* -------- WebSocket hub -------- */
+    const wss = new WebSocketServer({ noServer: true });
+    const browsers = new Set();
+    const send = (ws, msg) => {
+        if (ws.readyState !== WebSocket.OPEN)
+            return;
+        try {
+            ws.send(JSON.stringify(msg));
+        }
+        catch {
+            /* ignore */
+        }
+    };
+    const broadcast = (msg) => {
+        for (const ws of browsers)
+            send(ws, msg);
+    };
+    const broadcastStatus = () => {
+        broadcast({ type: "status", codex: supervisor.status() });
+    };
+    let prevPhase = supervisor.status().phase;
+    supervisor.onStatus((status) => {
+        broadcastStatus();
+        // supervisor 重新就绪后主动拉一次 codex 连接，避免等满 client 自己的退避。
+        if (status.phase === "ready" && prevPhase !== "ready" && !client.isReady())
+            client.reconnect();
+        prevPhase = status.phase;
+    });
+    client.on("state", (state) => {
+        supervisor.setConnected(state.connected, state.error);
+    });
+    client.on("notification", (evt) => {
+        broadcast({ type: "event", method: evt.method, params: evt.params });
+    });
+    // codex 反向请求：广播给所有浏览器，记录待答复集合用于去重。
+    const pendingServerRequests = new Map();
+    const answeredServerRequests = new Set();
+    client.on("serverRequest", (evt) => {
+        const key = String(evt.id);
+        const threadId = isRecord(evt.params) && typeof evt.params.threadId === "string" ? evt.params.threadId : null;
+        pendingServerRequests.set(key, { method: evt.method, threadId });
+        broadcast({ type: "serverRequest", id: evt.id, method: evt.method, params: evt.params });
+    });
+    client.on("state", (state) => {
+        // 断线后 codex 可能复用 request id，清掉去重历史避免误吞新请求。
+        if (!state.connected) {
+            pendingServerRequests.clear();
+            answeredServerRequests.clear();
+        }
+    });
+    function rememberAnswered(key) {
+        answeredServerRequests.add(key);
+        if (answeredServerRequests.size > SERVER_REQUEST_HISTORY) {
+            const first = answeredServerRequests.values().next().value;
+            if (first !== undefined)
+                answeredServerRequests.delete(first);
+        }
+    }
+    /* -------- local `omaw/*` methods -------- */
+    async function handleLocal(method, params) {
+        const p = isRecord(params) ? params : {};
+        switch (method) {
+            case LOCAL_METHODS.codexStatus:
+                return { status: supervisor.status() };
+            case LOCAL_METHODS.codexRestart:
+                await supervisor.restart();
+                client.reconnect();
+                return { ok: true };
+            case LOCAL_METHODS.codexLog:
+                return { lines: supervisor.logLines() };
+            case LOCAL_METHODS.requestLogsList:
+                return inspector.list(typeof p.threadId === "string" ? p.threadId : undefined, typeof p.limit === "number" ? p.limit : undefined);
+            case LOCAL_METHODS.requestLogsDetail: {
+                if (typeof p.id !== "string" || !p.id)
+                    throw new FsError(-32602, "omaw/request-logs/detail requires { id: string }");
+                const entry = await inspector.get(p.id);
+                if (!entry)
+                    throw new FsError(-32004, "request log not found");
+                return entry;
+            }
+            case LOCAL_METHODS.fsList:
+                return listDirectory({
+                    path: typeof p.path === "string" ? p.path : undefined,
+                    cwd,
+                    maxEntries: typeof p.maxEntries === "number" ? p.maxEntries : undefined,
+                });
+            case LOCAL_METHODS.fsRead:
+                if (typeof p.path !== "string")
+                    throw new FsError(-32602, "omaw/fs/read requires { path: string }");
+                return readTextFile({
+                    path: p.path,
+                    cwd,
+                    maxBytes: typeof p.maxBytes === "number" ? p.maxBytes : undefined,
+                });
+            case LOCAL_METHODS.paths: {
+                const codexHome = client.handshake()?.codexHome || process.env.CODEX_HOME || join(homedir(), ".codex");
+                return resolvePaths(cwd, codexHome);
+            }
+            default:
+                throw { code: -32601, message: `unknown local method: ${method}` };
+        }
+    }
+    /* -------- browser message handling -------- */
+    async function handleRpc(ws, requestId, method, params) {
+        try {
+            let result;
+            if (method.startsWith("omaw/")) {
+                result = await handleLocal(method, params);
+            }
+            else {
+                // A browser opened during startup races the app-server's boot (and a
+                // reconnect after a codex crash). Wait briefly instead of failing the
+                // client's first requests; only report -32001 if it never comes up.
+                if (!client.isReady() && !(await client.waitUntilReady(CODEX_READY_WAIT_MS))) {
+                    throw { code: -32001, message: "codex app-server not connected" };
+                }
+                result = await client.request(method, params);
+            }
+            send(ws, { type: "rpcResult", requestId, ok: true, result });
+        }
+        catch (err) {
+            send(ws, { type: "rpcResult", requestId, ok: false, error: asJsonRpcError(err) });
+        }
+    }
+    function handleReply(id, result, error) {
+        const key = String(id);
+        if (answeredServerRequests.has(key))
+            return; // 其他标签页已答复，忽略后来者
+        rememberAnswered(key);
+        const pending = pendingServerRequests.get(key);
+        pendingServerRequests.delete(key);
+        if (error)
+            client.respondError(id, error);
+        else
+            client.respond(id, result);
+        // 让其他标签页关闭审批弹窗；复用 codex 自己的通知名。
+        broadcast({
+            type: "event",
+            method: "serverRequest/resolved",
+            params: { threadId: pending?.threadId ?? null, requestId: id },
+        });
+    }
+    async function onBrowserMessage(ws, raw) {
+        let parsed;
+        try {
+            parsed = JSON.parse(typeof raw === "string" ? raw : raw.toString("utf8"));
+        }
+        catch {
+            log("忽略非 JSON 的浏览器报文");
+            return;
+        }
+        if (!isRecord(parsed) || typeof parsed.type !== "string")
+            return;
+        const msg = parsed;
+        switch (msg.type) {
+            case "rpc": {
+                if (typeof msg.requestId !== "string" || typeof msg.method !== "string")
+                    return;
+                await handleRpc(ws, msg.requestId, msg.method, msg.params);
+                return;
+            }
+            case "reply": {
+                if (msg.id === undefined || msg.id === null)
+                    return;
+                const hasError = "error" in msg && msg.error !== undefined;
+                const error = hasError ? asJsonRpcError(msg.error) : undefined;
+                handleReply(msg.id, msg.result, error);
+                return;
+            }
+            case "ping":
+                send(ws, { type: "pong" });
+                return;
+            default:
+                return;
+        }
+    }
+    wss.on("connection", (ws) => {
+        ws.__alive = true;
+        browsers.add(ws);
+        ws.on("pong", () => {
+            ws.__alive = true;
+        });
+        ws.on("message", (raw) => {
+            void onBrowserMessage(ws, raw).catch((err) => log("browser message handler error:", err));
+        });
+        ws.on("error", (err) => log("browser socket error:", err.message));
+        ws.on("close", () => browsers.delete(ws));
+        const info = {
+            version,
+            protocolVersion: PROTOCOL_VERSION,
+            cwd,
+            codexUrl: supervisor.url,
+            codexVersion: codexVersionFromHandshake(client.handshake()?.userAgent),
+            platform: process.platform,
+        };
+        send(ws, { type: "welcome", info });
+        send(ws, { type: "status", codex: supervisor.status() });
+    });
+    // 升级前做 origin 校验 + 路径校验；非 /ws 直接 destroy（dev 下 Vite 的 HMR 通道除外，
+    // 它由 Vite 自己在这个 server 上注册的 upgrade 监听器处理）。
+    httpServer.on("upgrade", (req, socket, head) => {
+        let pathname = "/";
+        try {
+            pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+        }
+        catch {
+            /* fall through */
+        }
+        if (DEV_SOURCE && pathname === DEV_HMR_PATH)
+            return;
+        if (pathname !== "/ws") {
+            socket.destroy();
+            return;
+        }
+        if (!originAllowed(req)) {
+            socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        wss.handleUpgrade(req, socket, head, (ws) => wss.emit("connection", ws, req));
+    });
+    // 心跳：30s 一次 ping，未回 pong 的直接 terminate。
+    const heartbeat = setInterval(() => {
+        for (const ws of browsers) {
+            if (ws.__alive === false) {
+                ws.terminate();
+                browsers.delete(ws);
+                continue;
+            }
+            ws.__alive = false;
+            try {
+                ws.ping();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }, HEARTBEAT_MS);
+    heartbeat.unref?.();
+    /* -------- listen -------- */
+    await new Promise((resolvePromise, rejectPromise) => {
+        httpServer.once("error", rejectPromise);
+        httpServer.listen(port, host, () => resolvePromise());
+    });
+    const address = httpServer.address();
+    const actualPort = typeof address === "object" && address ? address.port : port;
+    const url = `http://${host}:${actualPort}`;
+    log(`listening on ${url} (ws://${host}:${actualPort}/ws)`);
+    log(`codex app-server: ${supervisor.url} (${supervisor.isExternal() ? "external" : "managed"})`);
+    /* -------- close -------- */
+    let closed = false;
+    async function close() {
+        if (closed)
+            return;
+        closed = true;
+        clearInterval(heartbeat);
+        for (const ws of browsers) {
+            try {
+                ws.close(1001, "server shutting down");
+            }
+            catch {
+                /* ignore */
+            }
+            ws.terminate();
+        }
+        browsers.clear();
+        client.close();
+        await supervisor.stop();
+        await inspector.close();
+        await new Promise((resolvePromise) => {
+            wss.close(() => resolvePromise());
+            // 没有活跃连接时 wss.close 回调可能不触发；兜底。
+            setTimeout(resolvePromise, 500);
+        });
+        await new Promise((resolvePromise) => {
+            httpServer.close(() => resolvePromise());
+            setTimeout(resolvePromise, 500);
+        });
+    }
+    return { port: actualPort, host, url, cwd, version, supervisor, client, close };
+}
+/* ------------------------------------------------------------------ */
+/* direct execution (node dist/server/index.js)                        */
+/* ------------------------------------------------------------------ */
+const invokedPath = process.argv[1] ? pathToFileURL(resolve(process.argv[1])).href : "";
+if (invokedPath === import.meta.url) {
+    startServer()
+        .then((handle) => {
+        const shutdown = (signal) => {
+            console.log(`\n[oh-my-agent-web] received ${signal}, shutting down…`);
+            void handle.close().finally(() => process.exit(0));
+        };
+        process.on("SIGINT", () => shutdown("SIGINT"));
+        process.on("SIGTERM", () => shutdown("SIGTERM"));
+    })
+        .catch((err) => {
+        console.error("[oh-my-agent-web] failed to start:", err);
+        process.exit(1);
+    });
+}