repoburg 1.3.254 → 1.3.256

package/daemon/dist/tabtape/api/router.js

@@ -0,0 +1,519 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_HEADER = void 0;
+exports.createApiRouter = createApiRouter;
+/**
+ * tabtape's HTTP API, mounted on the daemon's port under /tabtape: the
+ * browser extension posts events, the replay UI reads them, Claude Code asks
+ * the MCP server.
+ *
+ * The router answers everything under the mount itself (nothing falls
+ * through to the daemon's other routes) and is mounted before the daemon's
+ * CORS and body-parsing middleware:
+ *  - only loopback Host names are served — never requests that came through
+ *    the Repoburg remote-access tunnel (DNS rebinding, remote access);
+ *  - CORS is answered for the extension only, so web pages cannot read
+ *    recordings (they hold cookies, Authorization headers and bodies);
+ *  - every write needs the X-Tabtape-Client header, which web pages cannot
+ *    send cross-origin without a preflight that only the extension passes.
+ */
+const express_1 = __importDefault(require("express"));
+const zlib_1 = __importDefault(require("zlib"));
+const errors_1 = require("../errors");
+const export_1 = require("../export/export");
+const har_1 = require("../har/har");
+const repro_1 = require("../repro/repro");
+const sink_1 = require("../sink");
+const record_1 = require("../store/record");
+const store_1 = require("../store/store");
+const follow_1 = require("./follow");
+const http_1 = require("./http");
+const record_2 = require("./record");
+const static_1 = require("./static");
+const DEFAULT_MAX_BATCH_BYTES = 64 << 20;
+/** Must accompany every write; see the file comment. */
+exports.CLIENT_HEADER = 'X-Tabtape-Client';
+function createApiRouter(opts) {
+    const { st, rd, buffers, logger } = opts;
+    const maxBatch = opts.maxBatchBytes ?? DEFAULT_MAX_BATCH_BYTES;
+    const router = express_1.default.Router();
+    const wrap = (fn) => (req, res, next) => {
+        Promise.resolve(fn(req, res)).catch(next);
+    };
+    const storeError = (res, err, id) => {
+        if (err instanceof errors_1.NotFoundError)
+            (0, http_1.sendText)(res, 404, err.message);
+        else if (err instanceof errors_1.InvalidIDError)
+            (0, http_1.sendText)(res, 400, err.message);
+        else {
+            logger.error('store failure', { session: id, err });
+            (0, http_1.sendText)(res, 500, 'internal error');
+        }
+    };
+    const bufferError = (res, err, key) => {
+        if (err instanceof errors_1.BufferNotFoundError || err instanceof errors_1.BufferEmptyError)
+            (0, http_1.sendText)(res, 404, err.message);
+        else
+            storeError(res, err, key);
+    };
+    // ---------- guard ----------
+    router.use((req, res, next) => {
+        if (!(0, http_1.loopbackHost)(req.headers.host) || (0, http_1.viaTunnel)(req)) {
+            (0, http_1.sendText)(res, 403, 'forbidden host');
+            return;
+        }
+        const origin = req.headers.origin;
+        if (typeof origin === 'string' && origin.startsWith('chrome-extension://')) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', `Content-Type, ${exports.CLIENT_HEADER}`);
+            res.setHeader('Access-Control-Max-Age', '600');
+            res.appendHeader('Vary', 'Origin');
+        }
+        if (req.method === 'OPTIONS') {
+            (0, http_1.sendStatus)(res, 204);
+            return;
+        }
+        // MCP clients are not browsers: /mcp rejects any request with an Origin
+        // header instead of requiring the client header.
+        if (req.method !== 'GET' && req.method !== 'HEAD' && req.path !== '/mcp' && !req.headers[exports.CLIENT_HEADER.toLowerCase()]) {
+            (0, http_1.sendText)(res, 403, `missing ${exports.CLIENT_HEADER} header`);
+            return;
+        }
+        next();
+    });
+    // ---------- sessions ----------
+    router.get('/api/health', wrap((_req, res) => {
+        const s = st.stats();
+        (0, http_1.sendJSON)(res, 200, {
+            ok: true,
+            version: opts.version,
+            ...s,
+            redactHeaders: opts.redact.list(),
+            ...(buffers ? { buffers: buffers.stats() } : {}),
+        });
+    }));
+    router.get('/api/sessions', wrap((_req, res) => (0, http_1.sendJSON)(res, 200, st.list())));
+    router.post('/api/sessions', wrap(async (req, res) => {
+        const body = await (0, http_1.readJSON)(req, res);
+        if (body === undefined)
+            return;
+        const info = startInfo(body);
+        if (typeof info === 'string') {
+            (0, http_1.sendText)(res, 400, `invalid JSON body: ${info}`);
+            return;
+        }
+        try {
+            (0, http_1.sendJSON)(res, 201, st.start(info));
+        }
+        catch (err) {
+            storeError(res, err, info.id);
+        }
+    }));
+    router.get('/api/sessions/:id', wrap((req, res) => {
+        try {
+            (0, http_1.sendJSON)(res, 200, st.get(req.params.id));
+        }
+        catch (err) {
+            storeError(res, err, req.params.id);
+        }
+    }));
+    router.delete('/api/sessions/:id', wrap((req, res) => {
+        const id = req.params.id;
+        try {
+            st.delete(id);
+        }
+        catch (err) {
+            storeError(res, err, id);
+            return;
+        }
+        rd.forget(id);
+        (0, http_1.sendStatus)(res, 204);
+    }));
+    router.post('/api/sessions/:id/events', wrap(async (req, res) => {
+        const id = req.params.id;
+        if (!(0, store_1.validID)(id)) {
+            (0, http_1.sendText)(res, 400, new errors_1.InvalidIDError().message);
+            return;
+        }
+        let body;
+        try {
+            body = await (0, http_1.readBody)(req, maxBatch);
+        }
+        catch (err) {
+            if (err instanceof http_1.TooLargeError)
+                (0, http_1.sendText)(res, 413, 'batch too large');
+            else
+                (0, http_1.sendText)(res, 400, err.message);
+            return;
+        }
+        let recs;
+        try {
+            recs = (0, record_1.readRecords)(body);
+        }
+        catch (err) {
+            (0, http_1.sendText)(res, 400, err instanceof errors_1.RecordError ? err.message : String(err));
+            return;
+        }
+        let n;
+        try {
+            n = st.append(id, recs);
+        }
+        catch (err) {
+            storeError(res, err, id);
+            return;
+        }
+        // followers lets the extension flush more often while someone watches.
+        (0, http_1.sendJSON)(res, 200, { accepted: recs.length, bytes: n, followers: opts.followers.count(id) });
+    }));
+    router.post('/api/sessions/:id/end', wrap(async (req, res) => {
+        const id = req.params.id;
+        const body = await (0, http_1.readJSON)(req, res);
+        if (body === undefined)
+            return;
+        const endedAt = isObject(body) ? body.endedAt : undefined;
+        if (endedAt !== undefined && endedAt !== null && typeof endedAt !== 'number') {
+            (0, http_1.sendText)(res, 400, 'invalid JSON body: endedAt must be a number');
+            return;
+        }
+        try {
+            (0, http_1.sendJSON)(res, 200, st.end(id, typeof endedAt === 'number' ? Math.trunc(endedAt) : 0));
+        }
+        catch (err) {
+            storeError(res, err, id);
+        }
+    }));
+    // events streams the session's JSONL. ?follow=1 keeps the stream open for
+    // new lines (live viewing); ?gzip=1 downloads it as .jsonl.gz.
+    router.get('/api/sessions/:id/events', wrap(async (req, res) => {
+        const id = req.params.id;
+        const q = (0, http_1.queryOf)(req);
+        if (q.get('follow') === '1') {
+            await httpFollow(id, req, res);
+            return;
+        }
+        if (!st.has(id)) {
+            storeError(res, new errors_1.NotFoundError(), id);
+            return;
+        }
+        res.setHeader('Cache-Control', 'no-store');
+        try {
+            if (q.get('gzip') === '1') {
+                res.writeHead(200, {
+                    'Content-Type': 'application/gzip',
+                    'Content-Disposition': `attachment; filename="${id}.jsonl.gz"`,
+                });
+                const gz = zlib_1.default.createGzip();
+                gz.pipe(res);
+                await st.writeSession(id, (0, http_1.writableSink)(gz, res));
+                await new Promise((resolve) => gz.end(resolve));
+            }
+            else {
+                res.writeHead(200, { 'Content-Type': 'application/x-ndjson' });
+                await st.writeSession(id, (0, http_1.writableSink)(res));
+                res.end();
+            }
+        }
+        catch (err) {
+            if (err instanceof errors_1.NotFoundError && !res.headersSent) {
+                storeError(res, err, id);
+                return;
+            }
+            if (!(err instanceof http_1.ClientGoneError))
+                logger.warn('stream session', { session: id, err });
+            res.destroy();
+        }
+    }));
+    /** The HTTP form of live viewing (curl, scripts); the replay UI uses the WebSocket. */
+    const httpFollow = async (id, req, res) => {
+        if (!st.has(id)) {
+            storeError(res, new errors_1.NotFoundError(), id);
+            return;
+        }
+        if (!opts.followers.acquire(id)) {
+            (0, http_1.sendText)(res, 429, `too many live viewers (at most ${opts.followers.max})`);
+            return;
+        }
+        try {
+            res.writeHead(200, { 'Content-Type': 'application/x-ndjson', 'Cache-Control': 'no-store' });
+            res.flushHeaders();
+            req.socket.setTimeout(0);
+            const sink = (0, http_1.writableSink)(res);
+            const out = {
+                write: sink,
+                keepAlive: () => sink(Buffer.from('\n')),
+                left: new Promise((resolve) => res.once('close', () => resolve())),
+            };
+            const end = await (0, follow_1.follow)(st, id, out, opts.stop, opts.keepAliveMs);
+            if (end === 'left')
+                res.destroy();
+            else
+                res.end();
+        }
+        finally {
+            opts.followers.release(id);
+        }
+    };
+    // repro returns markdown reproduction steps; ?format=json wraps them with
+    // the step count and the replay link.
+    router.get('/api/sessions/:id/repro', wrap(async (req, res) => {
+        const id = req.params.id;
+        const q = (0, http_1.queryOf)(req);
+        const from = (0, http_1.msParam)(q, res, 'from');
+        if (from === null)
+            return;
+        const to = (0, http_1.msParam)(q, res, 'to');
+        if (to === null)
+            return;
+        let v;
+        try {
+            v = await rd.view(id);
+        }
+        catch (err) {
+            storeError(res, err, id);
+            return;
+        }
+        let result;
+        try {
+            result = await (0, repro_1.generateRepro)(v, { from, to, lang: q.get('lang') ?? '', baseURL: opts.baseURL, timeZone: opts.timeZone });
+        }
+        catch (err) {
+            if (err instanceof errors_1.EmptyRangeError)
+                (0, http_1.sendText)(res, 400, err.message);
+            else
+                storeError(res, err, id);
+            return;
+        }
+        if (q.get('format') === 'json') {
+            (0, http_1.sendJSON)(res, 200, result);
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'text/markdown; charset=utf-8' });
+        res.end(result.markdown);
+    }));
+    // export downloads the session as one offline HTML file. Options:
+    // secrets=1 keeps sensitive headers, bodies=0 and args=0 remove bodies and
+    // console arguments, from/to (ms) export a range, estimate=1 returns only
+    // {"bytes": n}.
+    router.get('/api/sessions/:id/export', wrap(async (req, res) => {
+        const id = req.params.id;
+        const q = (0, http_1.queryOf)(req);
+        const from = (0, http_1.msParam)(q, res, 'from');
+        if (from === null)
+            return;
+        const to = (0, http_1.msParam)(q, res, 'to');
+        if (to === null)
+            return;
+        let v;
+        try {
+            v = await rd.view(id);
+        }
+        catch (err) {
+            storeError(res, err, id);
+            return;
+        }
+        const exportOpts = {
+            secrets: q.get('secrets') === '1',
+            stripBodies: q.get('bodies') === '0',
+            stripConsoleArgs: q.get('args') === '0',
+            from,
+            to,
+            redact: opts.redact,
+            version: opts.version,
+        };
+        const viewer = opts.viewer() ?? { js: '', css: '' };
+        if (q.get('estimate') === '1') {
+            const c = (0, sink_1.counter)();
+            try {
+                await (0, export_1.writeExport)(c.sink, v, viewer, exportOpts);
+            }
+            catch (err) {
+                if (err instanceof errors_1.NoViewerError)
+                    (0, http_1.sendText)(res, 503, err.message);
+                else
+                    storeError(res, err, id);
+                return;
+            }
+            (0, http_1.sendJSON)(res, 200, { bytes: c.count() });
+            return;
+        }
+        if (viewer.js.length === 0) {
+            (0, http_1.sendText)(res, 503, new errors_1.NoViewerError().message);
+            return;
+        }
+        res.writeHead(200, {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Content-Disposition': `attachment; filename="tabtape-${id}.html"`,
+            'Cache-Control': 'no-store',
+        });
+        try {
+            await (0, export_1.writeExport)((0, http_1.writableSink)(res), v, viewer, exportOpts);
+            res.end();
+        }
+        catch (err) {
+            if (!(err instanceof http_1.ClientGoneError))
+                logger.warn('export session', { session: id, err }); // mid-stream: the status is sent
+            res.destroy();
+        }
+    }));
+    // har downloads the session's network data as HAR 1.2. Options: secrets=1
+    // keeps sensitive headers, from/to (ms) select a range.
+    router.get('/api/sessions/:id/har', wrap(async (req, res) => {
+        const id = req.params.id;
+        const q = (0, http_1.queryOf)(req);
+        const from = (0, http_1.msParam)(q, res, 'from');
+        if (from === null)
+            return;
+        const to = (0, http_1.msParam)(q, res, 'to');
+        if (to === null)
+            return;
+        let har;
+        try {
+            const v = await rd.view(id);
+            har = await (0, har_1.buildHar)(v, { secrets: q.get('secrets') === '1', redact: opts.redact, from, to, version: opts.version });
+        }
+        catch (err) {
+            storeError(res, err, id);
+            return;
+        }
+        const body = JSON.stringify(har, null, 2) + '\n';
+        res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Content-Disposition': `attachment; filename="tabtape-${id}.har"`,
+            'Cache-Control': 'no-store',
+            'Content-Length': Buffer.byteLength(body),
+        });
+        res.end(body);
+    }));
+    // ---------- buffer mode ----------
+    if (buffers) {
+        router.get('/api/buffers', wrap((_req, res) => (0, http_1.sendJSON)(res, 200, buffers.list())));
+        // Appends NDJSON records to a tab's buffer; ?window=<ms> is how much the tab keeps.
+        router.post('/api/buffers/:key/events', wrap(async (req, res) => {
+            const key = req.params.key;
+            const window = (0, http_1.msParam)((0, http_1.queryOf)(req), res, 'window');
+            if (window === null)
+                return;
+            let body;
+            try {
+                body = await (0, http_1.readBody)(req, maxBatch);
+            }
+            catch (err) {
+                if (err instanceof http_1.TooLargeError)
+                    (0, http_1.sendText)(res, 413, 'batch too large');
+                else
+                    (0, http_1.sendText)(res, 400, err.message);
+                return;
+            }
+            let recs;
+            try {
+                recs = (0, record_1.readRecords)(body);
+            }
+            catch (err) {
+                (0, http_1.sendText)(res, 400, err instanceof errors_1.RecordError ? err.message : String(err));
+                return;
+            }
+            try {
+                buffers.append(key, recs, window, req.headers['user-agent'] ?? '');
+            }
+            catch (err) {
+                bufferError(res, err, key);
+                return;
+            }
+            (0, http_1.sendJSON)(res, 200, { accepted: recs.length });
+        }));
+        // Copies the last minutes of a buffer into a new session. Body:
+        // {"minutes": 2, "continue": false}; continue keeps the session open so a
+        // recording can carry on in it.
+        router.post('/api/buffers/:key/save', wrap(async (req, res) => {
+            const key = req.params.key;
+            const body = await (0, http_1.readJSON)(req, res);
+            if (body === undefined)
+                return;
+            const o = isObject(body) ? body : {};
+            if ((o.minutes !== undefined && typeof o.minutes !== 'number') || (o.continue !== undefined && typeof o.continue !== 'boolean')) {
+                (0, http_1.sendText)(res, 400, 'invalid JSON body: minutes must be a number and continue a boolean');
+                return;
+            }
+            const minutes = typeof o.minutes === 'number' ? o.minutes : 0;
+            try {
+                const sess = await buffers.save(key, st, { windowMs: Math.trunc(minutes * 60000), continue: o.continue === true });
+                (0, http_1.sendJSON)(res, 201, sess);
+            }
+            catch (err) {
+                bufferError(res, err, key);
+            }
+        }));
+        router.delete('/api/buffers/:key', wrap((req, res) => {
+            const key = req.params.key;
+            try {
+                buffers.delete(key);
+            }
+            catch (err) {
+                if (!(err instanceof errors_1.BufferNotFoundError)) {
+                    bufferError(res, err, key);
+                    return;
+                }
+            }
+            (0, http_1.sendStatus)(res, 204);
+        }));
+    }
+    // ---------- record links ----------
+    router.get(['/record', '/record/stop'], (_req, res) => (0, record_2.sendRecordAsset)(res, 'text/html; charset=utf-8', (0, record_2.recordHTML)(opts.mount)));
+    router.get('/record/record.js', (_req, res) => (0, record_2.sendRecordAsset)(res, 'text/javascript; charset=utf-8', (0, record_2.recordJS)(opts.mount)));
+    // Answers the extension: 204 when the token is this daemon's, 403 otherwise (or when record links are off).
+    router.post('/api/record/verify', wrap(async (req, res) => {
+        const body = await (0, http_1.readJSON)(req, res);
+        if (body === undefined)
+            return;
+        const token = isObject(body) ? body.token : undefined;
+        if (!(0, record_2.validRecordToken)(opts.recordToken, token)) {
+            (0, http_1.sendText)(res, 403, 'invalid record token');
+            return;
+        }
+        (0, http_1.sendStatus)(res, 204);
+    }));
+    // ---------- MCP ----------
+    if (opts.mcp) {
+        const mcp = opts.mcp;
+        router.all('/mcp', wrap((req, res) => mcp.handle(req, res)));
+    }
+    // ---------- replay UI ----------
+    router.use((0, static_1.uiRouter)(opts.uiDist));
+    // Nothing under the mount falls through to the daemon's other routes.
+    router.use((_req, res) => (0, http_1.sendText)(res, 404, '404 page not found'));
+    router.use((err, req, res, _next) => {
+        logger.error('request failed', { path: req.originalUrl, err });
+        if (res.headersSent)
+            res.destroy();
+        else
+            (0, http_1.sendText)(res, 500, 'internal error');
+    });
+    return router;
+}
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/** Decodes a StartInfo body; a string is the error. */
+function startInfo(body) {
+    if (!isObject(body))
+        return 'expected a JSON object';
+    const out = { id: '' };
+    for (const key of ['id', 'url', 'title', 'userAgent', 'source']) {
+        const v = body[key];
+        if (v === undefined || v === null)
+            continue;
+        if (typeof v !== 'string')
+            return `${key} must be a string`;
+        out[key] = v;
+    }
+    if (body.startedAt !== undefined && body.startedAt !== null) {
+        if (typeof body.startedAt !== 'number')
+            return 'startedAt must be a number';
+        out.startedAt = Math.trunc(body.startedAt);
+    }
+    return out;
+}