replicas-computer 0.3.15 → 0.3.16

package/README.md

@@ -44,7 +44,7 @@ The server records every decision that changes the picture (viewer connects and
 | `REPLICAS_DESKTOP_STREAM_TRANSPORT` | `webrtc` | Transport for viewers whose URL does not choose one |
 | `REPLICAS_DESKTOP_STREAM_PROFILE` | `balanced` | Encoder profile for viewers whose URL does not choose one |
 | `REPLICAS_DESKTOP_STREAM_ADAPTIVE` | `1` | `0` pins the top quality rung by default |
-| `REPLICAS_DESKTOP_STREAM_ICE_SERVERS` | `stun:stun.l.google.com:19302` | Comma-separated STUN/TURN servers; `turn:user:secret@host:port?transport=tcp` adds a relay. Percent-encode the username and password; the browser receives their decoded values. Re-read from the workspace runtime env on every viewer, so the monolith's `DESKTOP_STREAM_ICE_SERVERS` reaches running workspaces |
+| `REPLICAS_DESKTOP_STREAM_ICE_SERVERS` | `stun:stun.l.google.com:19302` | Comma-separated STUN/TURN servers; `turn:user:secret@host:port?transport=tcp` adds a relay. Percent-encode the username and password; the browser receives their decoded values. Re-read from the workspace runtime env on every viewer, so the monolith's `DESKTOP_STREAM_ICE_SERVERS` reaches running workspaces. Short-lived credentials for the [TURN relay](../services/turn/README.md) are fetched from the monolith and appended; the server itself only uses UDP relays |
 | `REPLICAS_DESKTOP_STREAM_ICE_PORTS` | ephemeral | `begin-end` UDP port range for the server's ICE candidates |
 | `REPLICAS_DESKTOP_STREAM_WEBRTC` | `1` | `0` serves the WebSocket transport only |
 | `REPLICAS_DESKTOP_STREAM_COLOR` | `bt709` | `legacy` disables the explicit BT.709 conversion and signalling |

package/dist/index.js

@@ -2937,7 +2937,7 @@ async function computerStatusCommand() {
 }
 
 // src/version.ts
-var COMPUTER_USE_VERSION = "0.3.15";
+var COMPUTER_USE_VERSION = "0.3.16";
 var COMPUTER_USE_PROTOCOL_VERSION = 1;
 
 // src/program.ts
@@ -3179,69 +3179,11 @@ async function runComputerClient(argv) {
 // src/media-server.ts
 import { spawn as spawn5 } from "child_process";
 import { createHash as createHash3 } from "crypto";
-import { createReadStream, existsSync as existsSync7, readdirSync, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { createReadStream, existsSync as existsSync7, readdirSync, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
 import { createServer as createServer2 } from "http";
 import { availableParallelism as availableParallelism2, loadavg } from "os";
 import { dirname as dirname7, extname, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-
-// ../shared/src/runtime-env.ts
-function parsePosixEnvFile(content) {
-  const result = {};
-  let pos = 0;
-  while (pos < content.length) {
-    let lineStart;
-    if (pos === 0 || content[pos - 1] === "\n") {
-      lineStart = pos;
-    } else {
-      const nl2 = content.indexOf("\n", pos);
-      if (nl2 === -1) break;
-      lineStart = nl2 + 1;
-    }
-    if (!content.startsWith("export ", lineStart)) {
-      const nl2 = content.indexOf("\n", lineStart);
-      if (nl2 === -1) break;
-      pos = nl2 + 1;
-      continue;
-    }
-    const nameStart = lineStart + "export ".length;
-    const eqIdx = content.indexOf("=", nameStart);
-    if (eqIdx === -1) break;
-    const name = content.slice(nameStart, eqIdx).trim();
-    let cursor = eqIdx + 1;
-    if (content[cursor] !== "'") {
-      const nl2 = content.indexOf("\n", cursor);
-      pos = nl2 === -1 ? content.length : nl2 + 1;
-      continue;
-    }
-    cursor += 1;
-    let value = "";
-    let closed = false;
-    while (cursor < content.length) {
-      const ch = content[cursor];
-      if (ch === "'") {
-        if (content.startsWith("\\''", cursor + 1)) {
-          value += "'";
-          cursor += 4;
-          continue;
-        }
-        cursor += 1;
-        closed = true;
-        break;
-      }
-      value += ch;
-      cursor += 1;
-    }
-    if (closed && name) {
-      result[name] = value;
-    }
-    const nl = content.indexOf("\n", cursor);
-    pos = nl === -1 ? content.length : nl + 1;
-  }
-  return result;
-}
-
-// src/media-server.ts
 import WebSocket2, { WebSocketServer } from "ws";
 
 // src/encoder.ts
@@ -3573,13 +3515,17 @@ function superviseEncoder(options) {
   };
 }
 
-// src/video-encoder.ts
-import { existsSync as existsSync6 } from "fs";
-import { availableParallelism } from "os";
-import { dirname as dirname6, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
+// src/ice-servers.ts
+import { readFileSync as readFileSync6 } from "fs";
 
 // ../shared/src/desktop-stream.ts
+function isStreamIceServer(value) {
+  return isRecord(value) && typeof value.urls === "string" && (value.username === void 0 || typeof value.username === "string") && (value.credential === void 0 || typeof value.credential === "string");
+}
+var DESKTOP_ICE_SERVERS_PATH = "/v1/engine/desktop/ice-servers";
+function isDesktopIceServers(value) {
+  return isRecord(value) && typeof value.expiresAt === "number" && Array.isArray(value.iceServers) && value.iceServers.every(isStreamIceServer);
+}
 var DEFAULT_STREAM_REQUEST = {
   transport: "webrtc",
   profile: "balanced",
@@ -3636,6 +3582,144 @@ function isDesktopWebRtcFailure(value) {
   ].every((key) => typeof value[key] === "string" && value[key].length <= 200) && ["elapsedMs", "candidateErrors", "framesDecoded", "packetsReceived", "packetsLost", "bytesReceived", "lastFrameAgeMs", "encoderFps"].every((key) => typeof value[key] === "number" && Number.isFinite(value[key]));
 }
 
+// ../shared/src/runtime-env.ts
+var REPLICAS_RUNTIME_ENV_ALIASES = {
+  monolithUrl: ["REPLICAS_MONOLITH_URL", "MONOLITH_URL"],
+  workspaceId: ["REPLICAS_WORKSPACE_ID", "WORKSPACE_ID"],
+  linearSessionId: ["REPLICAS_LINEAR_SESSION_ID", "LINEAR_SESSION_ID"],
+  linearAccessToken: ["REPLICAS_LINEAR_ACCESS_TOKEN", "LINEAR_ACCESS_TOKEN"],
+  slackBotToken: ["REPLICAS_SLACK_BOT_TOKEN", "SLACK_BOT_TOKEN"],
+  slackChannelId: ["REPLICAS_SLACK_CHANNEL_ID", "SLACK_CHANNEL_ID"],
+  slackThreadTs: ["REPLICAS_SLACK_THREAD_TS", "SLACK_THREAD_TS"]
+};
+function readReplicasRuntimeEnv(readEnv, [namespacedKey, legacyKey]) {
+  return readEnv(namespacedKey) ?? readEnv(legacyKey);
+}
+function parsePosixEnvFile(content) {
+  const result = {};
+  let pos = 0;
+  while (pos < content.length) {
+    let lineStart;
+    if (pos === 0 || content[pos - 1] === "\n") {
+      lineStart = pos;
+    } else {
+      const nl2 = content.indexOf("\n", pos);
+      if (nl2 === -1) break;
+      lineStart = nl2 + 1;
+    }
+    if (!content.startsWith("export ", lineStart)) {
+      const nl2 = content.indexOf("\n", lineStart);
+      if (nl2 === -1) break;
+      pos = nl2 + 1;
+      continue;
+    }
+    const nameStart = lineStart + "export ".length;
+    const eqIdx = content.indexOf("=", nameStart);
+    if (eqIdx === -1) break;
+    const name = content.slice(nameStart, eqIdx).trim();
+    let cursor = eqIdx + 1;
+    if (content[cursor] !== "'") {
+      const nl2 = content.indexOf("\n", cursor);
+      pos = nl2 === -1 ? content.length : nl2 + 1;
+      continue;
+    }
+    cursor += 1;
+    let value = "";
+    let closed = false;
+    while (cursor < content.length) {
+      const ch = content[cursor];
+      if (ch === "'") {
+        if (content.startsWith("\\''", cursor + 1)) {
+          value += "'";
+          cursor += 4;
+          continue;
+        }
+        cursor += 1;
+        closed = true;
+        break;
+      }
+      value += ch;
+      cursor += 1;
+    }
+    if (closed && name) {
+      result[name] = value;
+    }
+    const nl = content.indexOf("\n", cursor);
+    pos = nl === -1 ? content.length : nl + 1;
+  }
+  return result;
+}
+
+// src/ice-servers.ts
+var runtimeEnvFile = process.env.REPLICAS_RUNTIME_ENV_FILE || "/home/user/.replicas/runtime-env.sh";
+var refreshMs = 60 * 6e4;
+var retryMs = 6e4;
+var relays = [];
+var expiresAt = 0;
+var refreshAt = 0;
+var refreshing;
+async function currentIceServers() {
+  let env = process.env;
+  try {
+    env = { ...env, ...parsePosixEnvFile(readFileSync6(runtimeEnvFile, "utf8")) };
+  } catch {
+  }
+  const monolithUrl = readReplicasRuntimeEnv((name) => env[name], REPLICAS_RUNTIME_ENV_ALIASES.monolithUrl);
+  const workspaceId = readReplicasRuntimeEnv((name) => env[name], REPLICAS_RUNTIME_ENV_ALIASES.workspaceId);
+  const engineSecret = env.REPLICAS_ENGINE_SECRET;
+  if (monolithUrl && workspaceId && engineSecret && Date.now() >= refreshAt) {
+    const refreshed = refreshing ??= refreshRelays(monolithUrl, workspaceId, engineSecret).finally(() => {
+      refreshing = void 0;
+    });
+    if (expiresAt <= Date.now()) await refreshed;
+  }
+  return toIceServers(env.REPLICAS_DESKTOP_STREAM_ICE_SERVERS, expiresAt > Date.now() ? relays : []);
+}
+async function refreshRelays(monolithUrl, workspaceId, engineSecret) {
+  try {
+    const response = await fetch(new URL(DESKTOP_ICE_SERVERS_PATH, monolithUrl), {
+      headers: { authorization: `Bearer ${engineSecret}`, "x-workspace-id": workspaceId },
+      redirect: "error",
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (response.status === 404) {
+      relays = [];
+      expiresAt = 0;
+    } else {
+      const body = response.ok ? await response.json() : void 0;
+      if (!isDesktopIceServers(body)) throw new Error(`HTTP ${response.status}`);
+      ({ iceServers: relays, expiresAt } = body);
+    }
+    refreshAt = Date.now() + refreshMs;
+  } catch (error) {
+    process.stderr.write(`[desktop-stream] TURN credentials unavailable: ${error instanceof Error ? error.message : String(error)}
+`);
+    refreshAt = Date.now() + retryMs;
+  }
+}
+function toIceServers(spec = "stun:stun.l.google.com:19302", relayServers) {
+  const browser = spec.split(",").map((url) => url.trim()).filter(Boolean).map((url) => {
+    const match = url.match(/^(turns?):([^:@]+):(.+)@([^@]+)$/);
+    if (!match) return { urls: url };
+    const [username, credential] = match.slice(2, 4).map((value) => {
+      try {
+        return decodeURIComponent(value);
+      } catch {
+        return value;
+      }
+    });
+    return { urls: `${match[1]}:${match[4]}`, username, credential };
+  }).concat(relayServers);
+  const native = browser.filter(({ urls }) => !/^turns:|[?&]transport=tcp/i.test(urls)).map(({ urls, username, credential }) => username === void 0 || credential === void 0 ? urls : urls.replace(/^turn:/i, `turn:${encodeURIComponent(username)}:${encodeURIComponent(credential)}@`));
+  return { native, browser };
+}
+
+// src/video-encoder.ts
+import { existsSync as existsSync6 } from "fs";
+import { availableParallelism } from "os";
+import { dirname as dirname6, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+
 // src/input-validation.ts
 var finite = (value) => typeof value === "number" && Number.isFinite(value);
 var optionalFinite = (value) => value === void 0 || finite(value);
@@ -3951,22 +4035,6 @@ async function loadWebRtc() {
   }
 }
 var cleanupWebRtc = () => ndc?.cleanup();
-function parseIceServers(spec) {
-  const native = (spec ?? "stun:stun.l.google.com:19302").split(",").map((server) => server.trim()).filter(Boolean);
-  const browser = native.map((url) => {
-    const match = url.match(/^(turns?):([^:@]+):(.+)@([^@]+)$/);
-    if (!match) return { urls: url };
-    const [username, credential] = match.slice(2, 4).map((value) => {
-      try {
-        return decodeURIComponent(value);
-      } catch {
-        return value;
-      }
-    });
-    return { urls: `${match[1]}:${match[4]}`, username, credential };
-  });
-  return { native, browser };
-}
 var WebRtcViewer = class {
   constructor(options, handlers) {
     this.handlers = handlers;
@@ -4478,7 +4546,6 @@ var standbyRung = 5;
 var port = Number.parseInt(process.env.REPLICAS_DESKTOP_STREAM_PORT || String(DESKTOP_STREAM_PORT), 10);
 var display = process.env.REPLICAS_DESKTOP_DISPLAY?.replace(/^([^:])/, ":$1") || ":99";
 var webrtcEnabled = process.env.REPLICAS_DESKTOP_STREAM_WEBRTC !== "0";
-var runtimeEnvFile = process.env.REPLICAS_RUNTIME_ENV_FILE || "/home/user/.replicas/runtime-env.sh";
 var colorMode = process.env.REPLICAS_DESKTOP_STREAM_COLOR === "legacy" ? "legacy" : "bt709";
 var defaultRequest = parseStreamRequest(new URLSearchParams({
   transport: process.env.REPLICAS_DESKTOP_STREAM_TRANSPORT ?? "",
@@ -4534,14 +4601,6 @@ function mediaPacket(kind, timestamp, payload) {
   header.writeBigUInt64BE(BigInt(Math.max(0, timestamp)), 4);
   return Buffer.concat([header, payload]);
 }
-function currentIceServers() {
-  let spec = process.env.REPLICAS_DESKTOP_STREAM_ICE_SERVERS;
-  try {
-    spec = parsePosixEnvFile(readFileSync6(runtimeEnvFile, "utf8")).REPLICAS_DESKTOP_STREAM_ICE_SERVERS ?? spec;
-  } catch {
-  }
-  return parseIceServers(spec);
-}
 var appliedTheme;
 var pendingTheme;
 var applyingTheme = false;
@@ -4567,7 +4626,7 @@ function drainDesktopTheme() {
 function processCpuMs(pid) {
   if (!pid) return 0;
   try {
-    const stat = readFileSync6(`/proc/${pid}/stat`, "utf8");
+    const stat = readFileSync7(`/proc/${pid}/stat`, "utf8");
     const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
     return (Number(fields[11]) + Number(fields[12])) * 10;
   } catch {
@@ -5252,10 +5311,13 @@ async function runMediaServer() {
       // A socket viewer whose WebRTC attempt failed tries again in the background;
       // the socket keeps carrying its media until the new peer shows video.
       case "retry-webrtc": {
-        const ice = webrtc && viewer.fallback && !viewer.rtc && viewer.request.transport === "webrtc" ? currentIceServers() : void 0;
-        if (!ice) return;
-        record("retrying webrtc", "socket media continues meanwhile");
-        openWebRtc(viewer, reply, ice.native);
+        const retryable = () => webrtc && viewer.fallback && !viewer.rtc && viewer.request.transport === "webrtc" && viewer.socket.readyState === WebSocket2.OPEN;
+        if (!retryable()) return;
+        void currentIceServers().then((ice) => {
+          if (!retryable()) return;
+          record("retrying webrtc", "socket media continues meanwhile");
+          openWebRtc(viewer, reply, ice.native);
+        });
         return;
       }
       case "webrtc-ready":
@@ -5359,10 +5421,11 @@ async function runMediaServer() {
     if (extname(path) === ".html") {
       ensureEncoders();
       if (viewers.size === 0) stopEncodersSoon();
+      if (webrtc) void currentIceServers();
       response.setHeader("cache-control", "no-store");
       const digest = createHash3("sha1");
-      for (const name of readdirSync(webroot).filter((file) => /\.(js|css)$/.test(file)).sort()) digest.update(readFileSync6(resolve3(webroot, name)));
-      response.end(readFileSync6(path, "utf8").replaceAll("__VERSION__", `${COMPUTER_USE_VERSION}-${digest.digest("hex").slice(0, 8)}`));
+      for (const name of readdirSync(webroot).filter((file) => /\.(js|css)$/.test(file)).sort()) digest.update(readFileSync7(resolve3(webroot, name)));
+      response.end(readFileSync7(path, "utf8").replaceAll("__VERSION__", `${COMPUTER_USE_VERSION}-${digest.digest("hex").slice(0, 8)}`));
       return;
     }
     response.setHeader("cache-control", "private, max-age=31536000, immutable");
@@ -5375,9 +5438,10 @@ async function runMediaServer() {
       socket.destroy();
       return;
     }
-    webSocketServer.handleUpgrade(request, socket, head, (client) => webSocketServer.emit("connection", client, parseStreamRequest(url.searchParams, defaultRequest), url.searchParams.get("standby") === "1"));
+    const streamRequest = parseStreamRequest(url.searchParams, defaultRequest);
+    void (webrtc && streamRequest.transport === "webrtc" ? currentIceServers() : Promise.resolve(void 0)).then((ice) => webSocketServer.handleUpgrade(request, socket, head, (client) => webSocketServer.emit("connection", client, streamRequest, url.searchParams.get("standby") === "1", ice)));
   });
-  webSocketServer.on("connection", (socket, request, standby) => {
+  webSocketServer.on("connection", (socket, request, standby, ice) => {
     const viewer = {
       socket,
       input: new InputBridge(display, width, height),
@@ -5411,8 +5475,6 @@ async function runMediaServer() {
     const reply = (message) => {
       if (socket.readyState === WebSocket2.OPEN) socket.send(JSON.stringify(message));
     };
-    const offerWebRtc = webrtc && request.transport === "webrtc";
-    const ice = offerWebRtc ? currentIceServers() : void 0;
     const fallbackProfile = profile() === "high444" ? "main" : profile();
     const configMessage = { ...config, videoCodec: H264_PROFILES[fallbackProfile].codec, iceServers: ice?.browser, request };
     reply(configMessage);

package/dist/stream-viewer.js

@@ -4,6 +4,9 @@ function isRecord(value) {
 }
 
 // ../shared/src/desktop-stream.ts
+function isStreamIceServer(value) {
+  return isRecord(value) && typeof value.urls === "string" && (value.username === void 0 || typeof value.username === "string") && (value.credential === void 0 || typeof value.credential === "string");
+}
 var DEFAULT_STREAM_REQUEST = {
   transport: "webrtc",
   profile: "balanced",
@@ -49,10 +52,6 @@ var DESKTOP_QUALITY_MESSAGE = "replicas-desktop-quality";
 
 // src/input-validation.ts
 var finite = (value) => typeof value === "number" && Number.isFinite(value);
-var iceServer = (value) => {
-  if (!isRecord(value)) return false;
-  return typeof value.urls === "string" && (value.username === void 0 || typeof value.username === "string") && (value.credential === void 0 || typeof value.credential === "string");
-};
 function validServerMessage(value) {
   if (!isRecord(value) || typeof value.type !== "string") return false;
   switch (value.type) {
@@ -66,7 +65,7 @@ function validServerMessage(value) {
     case "candidate":
       return typeof value.candidate === "string" && value.candidate.length < 1024 && typeof value.mid === "string" && value.mid.length < 16;
     case "config":
-      return finite(value.protocolVersion) && (value.serverVersion === void 0 || typeof value.serverVersion === "string") && (value.webrtcUnavailableReason === void 0 || typeof value.webrtcUnavailableReason === "string") && (value.inputRace === void 0 || typeof value.inputRace === "boolean") && finite(value.width) && finite(value.height) && finite(value.fps) && typeof value.videoCodec === "string" && typeof value.audioCodec === "string" && finite(value.audioSampleRate) && finite(value.audioChannels) && isRecord(value.request) && (value.iceServers === void 0 || Array.isArray(value.iceServers) && value.iceServers.every(iceServer));
+      return finite(value.protocolVersion) && (value.serverVersion === void 0 || typeof value.serverVersion === "string") && (value.webrtcUnavailableReason === void 0 || typeof value.webrtcUnavailableReason === "string") && (value.inputRace === void 0 || typeof value.inputRace === "boolean") && finite(value.width) && finite(value.height) && finite(value.fps) && typeof value.videoCodec === "string" && typeof value.audioCodec === "string" && finite(value.audioSampleRate) && finite(value.audioChannels) && isRecord(value.request) && (value.iceServers === void 0 || Array.isArray(value.iceServers) && value.iceServers.every(isStreamIceServer));
     case "telemetry":
       return isRecord(value.encoder) && isRecord(value.cpu) && isRecord(value.viewer) && Array.isArray(value.events);
     default:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-computer",
-  "version": "0.3.15",
+  "version": "0.3.16",
   "description": "Replicas workspace computer-use runtime",
   "type": "module",
   "main": "dist/index.js",