pi-webdesk 0.1.0

package/dist/apps/daemon/src/pi-sessions.js

@@ -0,0 +1,265 @@
+// apps/daemon/src/pi-sessions.ts
+import { randomUUID } from "node:crypto";
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import { inspectRepository } from "../../../packages/git/src/index.js";
+import {
+  PiBridgeError,
+  createPiSessionCatalog,
+  sanitizeApprovalDisplayText
+} from "../../../packages/pi-bridge/src/index.js";
+import {
+  PI_SESSION_CATALOG_MAX_ENTRIES,
+  PROTOCOL_VERSION,
+  continuePiSessionResultSchema,
+  piSessionCatalogSnapshotSchema
+} from "../../../packages/protocol/src/index.js";
+var DEFAULT_SELECTION_TTL_MS = 10 * 60 * 1e3;
+var MAX_SOURCE_SESSION_BYTES = 128 * 1024 * 1024;
+var PiSessionCatalogOperationError = class extends Error {
+  name = "PiSessionCatalogOperationError";
+  code;
+  status;
+  constructor(code, message, status, options) {
+    super(message, options);
+    this.code = code;
+    this.status = status;
+  }
+};
+function isWithin(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path.sep}`) && relative !== "..";
+}
+function redactCredentialText(text) {
+  return text.replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/giu, "$1[redacted]@").replace(
+    /([?&](?:access[_-]?token|api[_-]?key|auth|credential|password|secret|token)=)[^&#\s]*/giu,
+    "$1[redacted]"
+  ).replace(/\b(?:github_pat_|gh[pousr]_|sk-)[a-z0-9_-]{8,}\b/giu, "[redacted]");
+}
+function display(text, maximum, fallback = "") {
+  const safe = sanitizeApprovalDisplayText(redactCredentialText(text).slice(0, maximum));
+  const bounded = safe.length > maximum ? safe.slice(0, maximum) : safe;
+  return bounded.trim() === "" ? fallback : bounded;
+}
+function continuationFailureMessage(error) {
+  if (error instanceof PiSessionCatalogOperationError) return error.message;
+  if (error instanceof PiBridgeError && error.code === "PI_REQUEST_TIMEOUT") {
+    return "The Pi session took too long to continue. The isolated task was still created and will start with a fresh Pi session.";
+  }
+  return "Pi could not create the child session. The isolated task was still created and will start with a fresh Pi session; the original session was not changed.";
+}
+function createPiSessionCatalogService(options) {
+  const catalog = options.catalog ?? createPiSessionCatalog();
+  const now = options.now ?? Date.now;
+  const createId = options.createId ?? randomUUID;
+  const selectionTtlMs = options.selectionTtlMs ?? DEFAULT_SELECTION_TTL_MS;
+  if (!Number.isSafeInteger(selectionTtlMs) || selectionTtlMs < 1e3 || selectionTtlMs > 36e5) {
+    throw new Error("Pi session selection TTL must be between one second and one hour");
+  }
+  let selections = /* @__PURE__ */ new Map();
+  let refreshInFlight = null;
+  async function refreshCatalog() {
+    let inspection;
+    try {
+      inspection = await catalog.list();
+    } catch (error) {
+      throw new PiSessionCatalogOperationError(
+        "session-unavailable",
+        error instanceof PiBridgeError && error.code === "PI_REQUEST_TIMEOUT" ? "Pi session discovery took too long. Check unusually large session directories and retry." : "Pi sessions could not be inspected. Check the daemon output for details.",
+        error instanceof PiBridgeError && error.code === "PI_REQUEST_TIMEOUT" ? 504 : 503,
+        { cause: error }
+      );
+    }
+    if (!path.isAbsolute(inspection.sessionsRoot)) {
+      throw new PiSessionCatalogOperationError(
+        "session-unavailable",
+        "Pi returned an invalid session directory. Check the daemon output for details.",
+        503
+      );
+    }
+    const expiresAtMs = now() + selectionTtlMs;
+    const nextSelections = /* @__PURE__ */ new Map();
+    const sessions = inspection.sessions.slice(0, PI_SESSION_CATALOG_MAX_ENTRIES).flatMap((session) => {
+      if (!path.isAbsolute(session.path) || !path.isAbsolute(session.cwd) || session.id.trim() === "" || !Number.isSafeInteger(session.messageCount) || session.messageCount < 0) {
+        return [];
+      }
+      const selectionId = createId();
+      nextSelections.set(selectionId, {
+        id: selectionId,
+        expiresAtMs,
+        sessionsRoot: path.normalize(inspection.sessionsRoot),
+        session
+      });
+      return [
+        {
+          selectionId,
+          sessionId: display(session.id, 500, "unknown-session"),
+          name: session.name === null ? null : display(session.name, 200, "Untitled session"),
+          cwd: path.normalize(session.cwd),
+          firstMessage: display(session.firstMessage, 500),
+          createdAtMs: session.createdAtMs,
+          modifiedAtMs: session.modifiedAtMs,
+          messageCount: session.messageCount
+        }
+      ];
+    });
+    selections = nextSelections;
+    return piSessionCatalogSnapshotSchema.parse({
+      protocol: PROTOCOL_VERSION,
+      type: "pi-session-catalog",
+      sessions,
+      omitted: inspection.omitted + Math.max(0, inspection.sessions.length - PI_SESSION_CATALOG_MAX_ENTRIES),
+      expiresAtMs
+    });
+  }
+  async function verifySource(selectionId, repositoryId, ignoreExpiry = false) {
+    const selection = selections.get(selectionId);
+    if (selection === void 0 || !ignoreExpiry && now() > selection.expiresAtMs) {
+      throw new PiSessionCatalogOperationError(
+        "selection-expired",
+        "This Pi session selection expired. Refresh the session list and choose it again.",
+        409
+      );
+    }
+    const snapshot = await options.workspace.snapshot();
+    const repository = snapshot.state.repositories.find((entry) => entry.id === repositoryId);
+    if (repository === void 0) {
+      throw new PiSessionCatalogOperationError(
+        "invalid-request",
+        "Choose a registered repository for the continued task.",
+        404
+      );
+    }
+    try {
+      const [canonicalRoot, sourceDetails, cwdDetails] = await Promise.all([
+        realpath(selection.sessionsRoot),
+        lstat(selection.session.path),
+        lstat(selection.session.cwd)
+      ]);
+      if (!sourceDetails.isFile() || sourceDetails.isSymbolicLink()) {
+        throw new Error("session path is not a regular file");
+      }
+      if (sourceDetails.size > MAX_SOURCE_SESSION_BYTES) {
+        throw new Error("session file exceeds the continuation limit");
+      }
+      if (!cwdDetails.isDirectory()) throw new Error("session cwd is not a directory");
+      const [sessionPath, cwd] = await Promise.all([
+        realpath(selection.session.path),
+        realpath(selection.session.cwd)
+      ]);
+      if (!isWithin(canonicalRoot, sessionPath)) {
+        throw new Error("session resolves outside Pi's configured session directory");
+      }
+      const sourceRepository = await inspectRepository(cwd);
+      if (sourceRepository.commonDir !== repository.commonDir) {
+        throw new PiSessionCatalogOperationError(
+          "repository-mismatch",
+          "The selected Pi session belongs to a different Git repository.",
+          409
+        );
+      }
+      return { selection, sessionPath, cwd, repository };
+    } catch (error) {
+      if (error instanceof PiSessionCatalogOperationError) throw error;
+      throw new PiSessionCatalogOperationError(
+        "session-unavailable",
+        "The selected Pi session or its project is no longer available. Refresh and try again.",
+        409,
+        { cause: error }
+      );
+    }
+  }
+  async function continueInNewTask(request) {
+    const source = await verifySource(request.selectionId, request.repositoryId);
+    if (options.workspace.createPreparedTask === void 0) {
+      throw new PiSessionCatalogOperationError(
+        "continuation-unavailable",
+        "This workspace service does not support isolated Pi session continuation.",
+        503
+      );
+    }
+    const taskId = createId();
+    const creation = await options.workspace.createPreparedTask(
+      {
+        repositoryId: request.repositoryId,
+        title: request.title,
+        baseRef: request.baseRef
+      },
+      {
+        taskId,
+        prepare: async (task) => {
+          const currentSource = await verifySource(
+            request.selectionId,
+            request.repositoryId,
+            true
+          );
+          if (currentSource.sessionPath !== source.sessionPath || currentSource.selection.session.id !== source.selection.session.id) {
+            throw new PiSessionCatalogOperationError(
+              "session-unavailable",
+              "The selected Pi session changed identity while the task was being created.",
+              409
+            );
+          }
+          const targetCwd = await realpath(task.worktreePath);
+          const targetRepository = await inspectRepository(targetCwd);
+          if (targetRepository.root !== targetCwd || targetRepository.commonDir !== source.repository.commonDir || targetRepository.branch !== task.branch) {
+            throw new PiSessionCatalogOperationError(
+              "continuation-unavailable",
+              "The new task worktree could not be verified before continuing Pi.",
+              409
+            );
+          }
+          const forked = await catalog.fork(
+            currentSource.sessionPath,
+            targetCwd,
+            `pita-${createId()}`
+          );
+          if (path.normalize(forked.sourceCwd) !== path.normalize(source.selection.session.cwd) || forked.sourceSessionId !== source.selection.session.id || path.normalize(forked.cwd) !== targetCwd || forked.parentSession === null || path.normalize(forked.parentSession) !== currentSource.sessionPath) {
+            throw new PiSessionCatalogOperationError(
+              "continuation-unavailable",
+              "Pi returned a child session that did not match the selected source and task worktree.",
+              503
+            );
+          }
+          const [canonicalSessionsRoot, childDetails, childSessionFile] = await Promise.all([
+            realpath(currentSource.selection.sessionsRoot),
+            lstat(forked.sessionFile),
+            realpath(forked.sessionFile)
+          ]);
+          if (!childDetails.isFile() || childDetails.isSymbolicLink() || !isWithin(canonicalSessionsRoot, childSessionFile)) {
+            throw new PiSessionCatalogOperationError(
+              "continuation-unavailable",
+              "Pi created the child session outside its configured session directory.",
+              503
+            );
+          }
+          return { piSessionFile: childSessionFile };
+        }
+      }
+    );
+    return continuePiSessionResultSchema.parse({
+      protocol: PROTOCOL_VERSION,
+      type: "pi-session-continuation-result",
+      taskId: creation.taskId,
+      sourceSessionId: display(source.selection.session.id, 500, "unknown-session"),
+      continuation: creation.preparationError === null ? { status: "continued" } : {
+        status: "failed",
+        message: continuationFailureMessage(creation.preparationError)
+      },
+      snapshot: creation.snapshot
+    });
+  }
+  return {
+    refresh() {
+      refreshInFlight ??= refreshCatalog().finally(() => {
+        refreshInFlight = null;
+      });
+      return refreshInFlight;
+    },
+    continueInNewTask
+  };
+}
+export {
+  PiSessionCatalogOperationError,
+  createPiSessionCatalogService
+};

package/dist/apps/daemon/src/runtime-process.js

@@ -0,0 +1,241 @@
+// apps/daemon/src/runtime-process.ts
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var RuntimeProcessRecoveryError = class extends Error {
+  name = "RuntimeProcessRecoveryError";
+};
+function errorCode(error) {
+  return error !== null && typeof error === "object" && "code" in error ? String(error.code) : null;
+}
+function fingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+async function processGroupIdentity(pid) {
+  try {
+    const fields = process.platform === "linux" ? "pgid=,sid=" : "pgid=";
+    const { stdout } = await execFileAsync("ps", ["-o", fields, "-p", String(pid)], {
+      encoding: "utf8",
+      env: { ...process.env, LC_ALL: "C", LANG: "C" },
+      timeout: 2e3,
+      maxBuffer: 16 * 1024
+    });
+    const [group, linuxSession] = stdout.trim().split(/\s+/).map(Number);
+    const session = process.platform === "darwin" && group === pid ? pid : linuxSession;
+    return Number.isSafeInteger(group) && group > 0 && Number.isSafeInteger(session) && session > 0 ? { processGroupId: group, sessionId: session } : null;
+  } catch (error) {
+    if (errorCode(error) === "ESRCH" || error.code === 1) return null;
+    throw error;
+  }
+}
+async function linuxProcessFingerprints(pid) {
+  try {
+    const [stat, bootId, command] = await Promise.all([
+      readFile(`/proc/${pid}/stat`, "utf8"),
+      readFile("/proc/sys/kernel/random/boot_id", "utf8"),
+      readFile(`/proc/${pid}/cmdline`)
+    ]);
+    const closingParen = stat.lastIndexOf(")");
+    if (closingParen < 0) throw new Error("malformed /proc stat record");
+    const fields = stat.slice(closingParen + 1).trim().split(/\s+/);
+    if (fields[0]?.startsWith("Z")) return null;
+    const startTicks = fields[19];
+    if (startTicks === void 0 || !/^\d+$/.test(startTicks)) {
+      throw new Error("missing Linux process start time");
+    }
+    return {
+      bootFingerprint: fingerprint(`linux\0${bootId.trim()}`),
+      startFingerprint: fingerprint(
+        `linux\0${bootId.trim()}\0${startTicks}\0${command.toString("hex")}`
+      )
+    };
+  } catch (error) {
+    if (errorCode(error) === "ENOENT" || errorCode(error) === "ESRCH") return null;
+    throw error;
+  }
+}
+async function darwinProcessFingerprints(pid) {
+  try {
+    const [
+      { stdout: started },
+      { stdout: command },
+      { stdout: state },
+      { stdout: bootSessionId }
+    ] = await Promise.all([
+      execFileAsync("ps", ["-o", "lstart=", "-p", String(pid)], {
+        encoding: "utf8",
+        env: { ...process.env, LC_ALL: "C", LANG: "C" },
+        timeout: 2e3,
+        maxBuffer: 16 * 1024
+      }),
+      execFileAsync("ps", ["-ww", "-o", "command=", "-p", String(pid)], {
+        encoding: "utf8",
+        env: { ...process.env, LC_ALL: "C", LANG: "C" },
+        timeout: 2e3,
+        maxBuffer: 16 * 1024
+      }),
+      execFileAsync("ps", ["-o", "stat=", "-p", String(pid)], {
+        encoding: "utf8",
+        env: { ...process.env, LC_ALL: "C", LANG: "C" },
+        timeout: 2e3,
+        maxBuffer: 16 * 1024
+      }),
+      execFileAsync("sysctl", ["-n", "kern.bootsessionuuid"], {
+        encoding: "utf8",
+        timeout: 2e3,
+        maxBuffer: 16 * 1024
+      })
+    ]);
+    if (started.trim() === "" || state.trim().startsWith("Z")) return null;
+    return {
+      bootFingerprint: fingerprint(`darwin\0${bootSessionId.trim()}`),
+      startFingerprint: fingerprint(
+        `darwin\0${bootSessionId.trim()}\0${started.trim()}\0${command.trim()}`
+      )
+    };
+  } catch (error) {
+    if (error.code === 1 || errorCode(error) === "ESRCH") return null;
+    throw error;
+  }
+}
+function createRuntimeProcessInspector() {
+  if (process.platform !== "linux" && process.platform !== "darwin") {
+    throw new RuntimeProcessRecoveryError(
+      `Supervised runtime process recovery is unsupported on ${process.platform}`
+    );
+  }
+  return {
+    async currentBootFingerprint() {
+      if (process.platform === "linux") {
+        const bootId = await readFile("/proc/sys/kernel/random/boot_id", "utf8");
+        return fingerprint(`linux\0${bootId.trim()}`);
+      }
+      const { stdout } = await execFileAsync("sysctl", ["-n", "kern.bootsessionuuid"], {
+        encoding: "utf8",
+        timeout: 2e3,
+        maxBuffer: 16 * 1024
+      });
+      return fingerprint(`darwin\0${stdout.trim()}`);
+    },
+    async inspect(pid) {
+      if (!Number.isSafeInteger(pid) || pid < 1) return null;
+      const [fingerprints, observedGroup] = await Promise.all([
+        process.platform === "linux" ? linuxProcessFingerprints(pid) : darwinProcessFingerprints(pid),
+        processGroupIdentity(pid)
+      ]);
+      if (fingerprints === null || observedGroup === null) return null;
+      return { ...fingerprints, ...observedGroup };
+    },
+    async groupExists(group) {
+      try {
+        const { stdout } = await execFileAsync("ps", ["-axo", "pgid=,stat="], {
+          encoding: "utf8",
+          env: { ...process.env, LC_ALL: "C", LANG: "C" },
+          timeout: 1e3,
+          maxBuffer: 1024 * 1024
+        });
+        return stdout.split("\n").some((line) => {
+          const [observedGroup, state] = line.trim().split(/\s+/);
+          return Number(observedGroup) === group && state !== void 0 && !state.startsWith("Z");
+        });
+      } catch {
+      }
+      try {
+        process.kill(-group, 0);
+        return true;
+      } catch (error) {
+        return errorCode(error) === "EPERM";
+      }
+    },
+    signalGroup(group, signal) {
+      process.kill(-group, signal);
+    }
+  };
+}
+async function captureRuntimeProcess(pid, inspector = createRuntimeProcessInspector()) {
+  if (pid === process.pid) {
+    throw new RuntimeProcessRecoveryError("Refusing to supervise the daemon as a Pi child");
+  }
+  const observed = await inspector.inspect(pid);
+  if (observed === null) {
+    throw new RuntimeProcessRecoveryError("Pi exited before Webdesk could record its process identity");
+  }
+  if (observed.processGroupId !== pid || observed.sessionId !== pid) {
+    throw new RuntimeProcessRecoveryError(
+      "Pi did not start as the leader of its dedicated process group"
+    );
+  }
+  return {
+    pid,
+    processGroupId: pid,
+    sessionId: pid,
+    bootFingerprint: observed.bootFingerprint,
+    startFingerprint: observed.startFingerprint
+  };
+}
+async function recoveryDisposition(record, inspector) {
+  const observed = await inspector.inspect(record.pid);
+  if (observed !== null) {
+    if (observed.startFingerprint === record.startFingerprint && observed.processGroupId === record.processGroupId && observed.sessionId === record.sessionId && record.processGroupId === record.pid && record.sessionId === record.pid) {
+      return "exact-leader";
+    }
+    throw new RuntimeProcessRecoveryError(
+      `Runtime process ${record.pid} no longer matches its recorded launch identity`
+    );
+  }
+  if (await inspector.groupExists(record.processGroupId)) {
+    throw new RuntimeProcessRecoveryError(
+      `Runtime process ${record.pid} is gone but its process group cannot be verified`
+    );
+  }
+  return "gone";
+}
+async function waitUntilGroupGone(processGroupId, inspector, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!await inspector.groupExists(processGroupId)) return true;
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  return !await inspector.groupExists(processGroupId);
+}
+async function recoverRuntimeProcess(record, options = {}) {
+  const inspector = options.inspector ?? createRuntimeProcessInspector();
+  if (record.bootFingerprint !== void 0 && await inspector.currentBootFingerprint() !== record.bootFingerprint) {
+    return false;
+  }
+  if (record.pid === process.pid) {
+    throw new RuntimeProcessRecoveryError(
+      `Runtime process ${record.pid} conflicts with the current daemon identity. Restart the Webdesk daemon before retrying`
+    );
+  }
+  const graceMs = options.graceMs ?? 2e3;
+  let signalled = false;
+  for (const signal of ["SIGTERM", "SIGKILL"]) {
+    const disposition = await recoveryDisposition(record, inspector);
+    if (disposition === "gone") return signalled;
+    try {
+      inspector.signalGroup(record.processGroupId, signal);
+      signalled = true;
+    } catch (error) {
+      if (errorCode(error) === "ESRCH") return true;
+      throw new RuntimeProcessRecoveryError(
+        `Could not signal orphaned Pi process group ${record.processGroupId}`,
+        { cause: error }
+      );
+    }
+    if (await waitUntilGroupGone(record.processGroupId, inspector, graceMs)) {
+      return true;
+    }
+  }
+  throw new RuntimeProcessRecoveryError(
+    `Orphaned Pi process ${record.pid} did not exit after SIGKILL`
+  );
+}
+export {
+  RuntimeProcessRecoveryError,
+  captureRuntimeProcess,
+  createRuntimeProcessInspector,
+  recoverRuntimeProcess
+};

package/dist/apps/daemon/src/secret.js

@@ -0,0 +1,71 @@
+// apps/daemon/src/secret.ts
+import { chmodSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import path from "node:path";
+var DaemonStateError = class extends Error {
+  name = "DaemonStateError";
+};
+var SESSION_SECRET_FILE = "session-secret";
+var SECRET_BYTES = 32;
+var SECRET_HEX_PATTERN = /^[0-9a-f]{64}$/;
+function sessionSecretPath(stateDir) {
+  return path.join(stateDir, SESSION_SECRET_FILE);
+}
+function loadOrCreateSessionSecret(stateDir) {
+  mkdirSync(stateDir, { recursive: true, mode: 448 });
+  if (process.platform !== "win32") {
+    const state = lstatSync(stateDir);
+    if (!state.isDirectory() || state.isSymbolicLink()) {
+      throw new DaemonStateError(
+        `Daemon state path ${stateDir} must be a real directory, not a symlink or other file`
+      );
+    }
+    const mode = state.mode & 511;
+    if ((mode & 63) !== 0) {
+      throw new DaemonStateError(
+        `Daemon state directory ${stateDir} is accessible by other users (mode ${mode.toString(8).padStart(3, "0")}); set its permissions to 700`
+      );
+    }
+  }
+  const file = sessionSecretPath(stateDir);
+  let raw;
+  try {
+    raw = readFileSync(file, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+    const secret = randomBytes(SECRET_BYTES);
+    writeFileSync(file, `${secret.toString("hex")}
+`, { mode: 384, flag: "wx" });
+    chmodSync(file, 384);
+    return secret;
+  }
+  if (process.platform !== "win32") {
+    const state = lstatSync(file);
+    if (!state.isFile() || state.isSymbolicLink()) {
+      throw new DaemonStateError(
+        `Session secret ${file} must be a regular file, not a symlink or other file`
+      );
+    }
+    const mode = state.mode & 511;
+    if ((mode & 63) !== 0) {
+      throw new DaemonStateError(
+        `Session secret ${file} is readable by other users (mode ${mode.toString(8).padStart(3, "0")}); set its permissions to 600`
+      );
+    }
+  }
+  const hex = raw.trim();
+  if (!SECRET_HEX_PATTERN.test(hex)) {
+    throw new DaemonStateError(
+      `Session secret ${file} is malformed (expected 64 lowercase hex characters). Delete the file to generate a new secret; existing browser sessions will be signed out.`
+    );
+  }
+  return Buffer.from(hex, "hex");
+}
+export {
+  DaemonStateError,
+  SESSION_SECRET_FILE,
+  loadOrCreateSessionSecret,
+  sessionSecretPath
+};