repoburg 1.3.255 → 1.3.256

package/daemon/dist/index.js

@@ -19,7 +19,29 @@ const routes_1 = require("./remote/routes");
 const checkRemoteAuth_1 = require("./middleware/checkRemoteAuth");
 const staticServing_1 = require("./staticServing");
 const router_1 = require("./recorder/router");
+const tabtape_1 = require("./tabtape");
 const PORT = 9998;
+/**
+ * tabtape (browser session recording and replay) on this port under
+ * /tabtape. Failure is non-fatal: the daemon keeps running without it.
+ * Kill switch: REPOBURG_TABTAPE=0.
+ */
+function loadTabtape() {
+    if (process.env.REPOBURG_TABTAPE === '0') {
+        console.log('[tabtape] disabled via REPOBURG_TABTAPE=0');
+        return null;
+    }
+    try {
+        return (0, tabtape_1.createTabtape)({
+            baseURL: `http://127.0.0.1:${PORT}${tabtape_1.TABTAPE_MOUNT}`,
+            uiDist: (0, tabtape_1.resolveTabtapeUiDist)(__dirname),
+        });
+    }
+    catch (err) {
+        console.warn('[tabtape] failed to start:', err);
+        return null;
+    }
+}
 async function main() {
     await serviceManager_1.serviceManager.connect();
     // Embedded agent-pane backend — served on THIS port (no second listener).
@@ -28,10 +50,25 @@ async function main() {
         console.warn('[agentPane] embed failed:', err);
         return null;
     });
+    // Opened once the port is ours (see server.listen below): a second daemon
+    // started by mistake must not touch the running one's recordings.
+    let tabtape = null;
     const app = (0, express_1.default)();
     const server = http_1.default.createServer(app);
     // Daemon wss in noServer mode — the shared upgrade router dispatches below.
     const wss = new ws_1.WebSocketServer({ noServer: true });
+    // tabtape: local-only recording API + replay UI + MCP. Mounted FIRST: it
+    // answers CORS for its Chrome extension only (the daemon-wide allowlist
+    // below would let any localhost page read recordings), refuses non-loopback
+    // Host names (tunnel traffic) and reads its own NDJSON bodies. The prefix
+    // stays tabtape's even while it is off.
+    app.use(tabtape_1.TABTAPE_MOUNT, (req, res, next) => {
+        if (tabtape) {
+            tabtape.router(req, res, next);
+            return;
+        }
+        res.status(503).type('text/plain').send('tabtape is not available on this daemon\n');
+    });
     // Spec: allowlist only — local tooling (vite, daemon-desktop) and
     // *.repoburg.com tunnel hostnames. The previous origin:'*' with
     // credentials:true was an open API surface.
@@ -98,14 +135,27 @@ async function main() {
         ws.on('close', () => console.log('Client disconnected from daemon WebSocket'));
         ws.on('error', (error) => console.error('WebSocket error:', error));
     });
-    // Single upgrade router: '/ws' -> embedded agent-pane (guarded by CF Access
-    // when configured), everything else -> daemon wss.
-    server.on('upgrade', (0, agentPane_1.createUpgradeRouter)(pane, wss, checkRemoteAuth_1.checkRemoteWsAuth));
+    // Single upgrade router: '/tabtape/...' -> tabtape live viewing, '/ws' ->
+    // embedded agent-pane (guarded by CF Access when configured), everything
+    // else -> daemon wss.
+    const paneUpgrade = (0, agentPane_1.createUpgradeRouter)(pane, wss, checkRemoteAuth_1.checkRemoteWsAuth);
+    server.on('upgrade', (req, socket, head) => {
+        const url = req.url ?? '';
+        if (url === tabtape_1.TABTAPE_MOUNT || url.startsWith(`${tabtape_1.TABTAPE_MOUNT}/`)) {
+            if (tabtape)
+                tabtape.handleUpgrade(req, socket, head);
+            else
+                socket.destroy();
+            return;
+        }
+        paneUpgrade(req, socket, head);
+    });
     // Spec: loopback binding only — remote access is exclusively via the
     // cloudflared tunnel; the daemon must never listen on public interfaces.
     server.listen(PORT, '127.0.0.1', () => {
         console.log(`Repoburg Platform Daemon listening on http://127.0.0.1:${PORT}`);
         console.log(`MCP Gateway available at http://localhost:${PORT}/mcp`);
+        tabtape = loadTabtape();
     });
     // Clean up MCP gateway sessions and the embedded agent-pane on shutdown.
     const shutdown = async () => {
@@ -119,6 +169,14 @@ async function main() {
             }
         }
         await mcp_gateway_1.mcpGateway.closeAllSessions();
+        if (tabtape) {
+            try {
+                await tabtape.close();
+            }
+            catch (err) {
+                console.error('[tabtape] shutdown failed:', err);
+            }
+        }
         process.exit(0);
     };
     process.on('SIGINT', shutdown);

package/daemon/dist/staticServing.js

@@ -11,8 +11,8 @@ exports.createPaneFrontendRouter = createPaneFrontendRouter;
  * Spec: a machine's daemon serves the pane at https://<mahlas>.repoburg.com
  * from its own origin — SPA and API share one origin (no CORS, no
  * mixed-content). The router is mounted LAST: every API path (/api, /ws,
- * /services, /auth, /registry, /mcp, /remote) is matched by earlier
- * routers and never reaches the fallback.
+ * /services, /auth, /registry, /mcp, /remote, /tabtape) is matched by
+ * earlier routers and never reaches the fallback.
  *
  * Path resolution is ABSOLUTE (pm2 God-daemon-cwd bug — see agentPane.ts).
  */

package/daemon/dist/tabtape/api/follow.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Follower = exports.Followers = exports.KEEP_ALIVE_MS = exports.MAX_FOLLOWERS = void 0;
+exports.controlLine = controlLine;
+exports.follow = follow;
+/**
+ * Live viewing: a session streamed like tail -f — the lines that exist, a
+ * "live" control line, then new lines as they are written. When the session
+ * ends the stream sends an "ended" control line and stops; it also stops when
+ * the viewer leaves, the session is deleted or tabtape shuts down. Viewers
+ * never slow down appends: they wait on store.watch() and read the segment
+ * files themselves.
+ *
+ * The same loop feeds two transports: the replay UI's WebSocket (see ws.ts)
+ * and the HTTP NDJSON stream of GET …/events?follow=1 (curl, scripts).
+ */
+const errors_1 = require("../errors");
+const segment_1 = require("../store/segment");
+/**
+ * Bounds live viewers. The replay UI follows over WebSockets, which do not
+ * count against the browser's six HTTP connections per host; the bound only
+ * caps the daemon's work.
+ */
+exports.MAX_FOLLOWERS = 8;
+/** How often an idle stream gets a keep-alive. */
+exports.KEEP_ALIVE_MS = 15000;
+/** Counts live viewers, in total (for the limit) and per session (reported to the extension so it can flush more often). */
+class Followers {
+    constructor(max = exports.MAX_FOLLOWERS) {
+        this.max = max;
+        this.total = 0;
+        this.per = new Map();
+    }
+    acquire(id) {
+        if (this.total >= this.max)
+            return false;
+        this.total++;
+        this.per.set(id, (this.per.get(id) ?? 0) + 1);
+        return true;
+    }
+    release(id) {
+        this.total--;
+        const n = (this.per.get(id) ?? 0) - 1;
+        if (n <= 0)
+            this.per.delete(id);
+        else
+            this.per.set(id, n);
+    }
+    count(id) {
+        return this.per.get(id) ?? 0;
+    }
+}
+exports.Followers = Followers;
+function controlLine(event, now = Date.now()) {
+    return Buffer.from(`{"ts":${now},"type":"tabtape","data":{"event":"${event}"}}\n`);
+}
+/** A live viewer's position: the segment being read and how much of it was sent. */
+class Follower {
+    constructor() {
+        this.seq = 0;
+        this.off = 0;
+        /** The segment's size when last seen. */
+        this.known = 0;
+    }
+    /**
+     * Writes everything in segs past the viewer's position. Reports whether
+     * data the viewer had not read was deleted meanwhile.
+     */
+    async send(segs, write) {
+        let trimmed = false;
+        if (this.seq !== 0 && this.off < this.known && !segs.some((sg) => sg.seq === this.seq))
+            trimmed = true;
+        for (const sg of segs) {
+            if (sg.seq < this.seq)
+                continue;
+            if (sg.seq > this.seq) {
+                this.seq = sg.seq;
+                this.off = 0;
+            }
+            this.known = sg.size;
+            if (sg.size <= this.off)
+                continue;
+            try {
+                for await (const chunk of (0, segment_1.readSegment)(sg.path, this.off, sg.size - this.off)) {
+                    const pending = write(chunk);
+                    if (pending)
+                        await pending;
+                    this.off += chunk.length;
+                }
+            }
+            catch (err) {
+                if ((0, errors_1.isNotExist)(err)) {
+                    trimmed = true; // deleted after the snapshot
+                    continue;
+                }
+                throw err;
+            }
+        }
+        return trimmed;
+    }
+}
+exports.Follower = Follower;
+/**
+ * Streams session id to out until it ends, is deleted, the viewer leaves or
+ * stop resolves. The caller checks that the session exists and acquires a
+ * follower slot.
+ */
+async function follow(st, id, out, stop, keepAliveMs = exports.KEEP_ALIVE_MS) {
+    const f = new Follower();
+    let live = false;
+    // One listener each for the whole stream (not one per wait): a long live
+    // session waits thousands of times.
+    let quit = null;
+    let wake = null;
+    void out.left.then(() => {
+        quit = quit ?? 'left';
+        wake?.();
+    });
+    void stop.then(() => {
+        quit = quit ?? 'stopped';
+        wake?.();
+    });
+    const write = (chunk) => out.write(chunk);
+    try {
+        for (;;) {
+            if (quit)
+                return quit;
+            let changed;
+            let snap;
+            try {
+                changed = st.watch(id); // before reading: no change is missed
+                snap = st.snapshot(id);
+            }
+            catch {
+                return 'gone'; // deleted
+            }
+            const trimmed = await f.send(snap.segments, write);
+            if (trimmed)
+                await out.write(controlLine('trimmed'));
+            if (!live) {
+                live = true;
+                await out.write(controlLine('live'));
+            }
+            if (snap.session.endedAt) {
+                await out.write(controlLine('ended'));
+                await out.flush?.();
+                return 'ended';
+            }
+            await out.flush?.();
+            if (quit)
+                return quit;
+            let ticked = false;
+            await new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    ticked = true;
+                    resolve();
+                }, keepAliveMs);
+                wake = () => {
+                    clearTimeout(timer);
+                    resolve();
+                };
+                void changed.then(() => wake?.());
+            });
+            wake = null;
+            if (quit)
+                return quit;
+            if (ticked)
+                await out.keepAlive();
+        }
+    }
+    catch {
+        return 'left'; // a failed write: the viewer is gone
+    }
+}

package/daemon/dist/tabtape/api/http.js

@@ -0,0 +1,221 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TooLargeError = exports.ClientGoneError = void 0;
+exports.sendText = sendText;
+exports.sendJSON = sendJSON;
+exports.sendStatus = sendStatus;
+exports.readBody = readBody;
+exports.readJSON = readJSON;
+exports.msParam = msParam;
+exports.queryOf = queryOf;
+exports.writableSink = writableSink;
+exports.loopbackHost = loopbackHost;
+exports.viaTunnel = viaTunnel;
+/** Small HTTP helpers for the tabtape routes: plain Node responses, no Express magic (ETags, 304s). */
+const net_1 = __importDefault(require("net"));
+/** The client went away (or stopped reading) while a response was being streamed. */
+class ClientGoneError extends Error {
+    constructor(message = 'client left') {
+        super(message);
+        this.name = 'ClientGoneError';
+    }
+}
+exports.ClientGoneError = ClientGoneError;
+/** A request body over the limit. */
+class TooLargeError extends Error {
+    constructor() {
+        super('request body too large');
+        this.name = 'TooLargeError';
+    }
+}
+exports.TooLargeError = TooLargeError;
+/** Like Go's http.Error: a plain-text message with a trailing newline. */
+function sendText(res, status, message) {
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    const body = message + '\n';
+    res.writeHead(status, {
+        'Content-Type': 'text/plain; charset=utf-8',
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Length': Buffer.byteLength(body),
+    });
+    res.end(body);
+}
+function sendJSON(res, status, v, headers = {}) {
+    const body = JSON.stringify(v) + '\n';
+    res.writeHead(status, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), ...headers });
+    res.end(body);
+}
+function sendStatus(res, status) {
+    res.writeHead(status);
+    res.end();
+}
+/** Reads the whole request body, failing with TooLargeError past limit bytes. */
+function readBody(req, limit) {
+    return new Promise((resolve, reject) => {
+        const parts = [];
+        let size = 0;
+        let done = false;
+        const finish = (err) => {
+            if (done)
+                return;
+            done = true;
+            req.off('data', onData);
+            req.off('end', onEnd);
+            req.off('error', onError);
+            if (err) {
+                req.resume(); // drain the rest; the response says why
+                reject(err);
+            }
+            else {
+                resolve(Buffer.concat(parts, size));
+            }
+        };
+        const onData = (chunk) => {
+            size += chunk.length;
+            if (size > limit) {
+                finish(new TooLargeError());
+                return;
+            }
+            parts.push(chunk);
+        };
+        const onEnd = () => finish(null);
+        const onError = (err) => finish(err);
+        req.on('data', onData);
+        req.on('end', onEnd);
+        req.on('error', onError);
+    });
+}
+/** Control bodies (start, end, save, verify) are small. */
+const MAX_CONTROL_BYTES = 64 << 10;
+/**
+ * Reads a small JSON body. Answers 400 "invalid JSON body: …" (or 413) and
+ * returns undefined when it cannot.
+ */
+async function readJSON(req, res) {
+    let body;
+    try {
+        body = await readBody(req, MAX_CONTROL_BYTES);
+    }
+    catch (err) {
+        if (err instanceof TooLargeError)
+            sendText(res, 413, 'invalid JSON body: http: request body too large');
+        else
+            sendText(res, 400, `invalid JSON body: ${err.message}`);
+        return undefined;
+    }
+    const text = body.toString('utf8');
+    if (text.trim() === '') {
+        sendText(res, 400, 'invalid JSON body: EOF');
+        return undefined;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        sendText(res, 400, `invalid JSON body: ${err.message}`);
+        return undefined;
+    }
+}
+/**
+ * Reads an optional non-negative integer of milliseconds from the query.
+ * Answers 400 and returns null when it is not one; 0 when absent.
+ */
+function msParam(query, res, name) {
+    const raw = query.get(name);
+    if (raw === null || raw === '')
+        return 0;
+    if (!/^[+-]?\d+$/.test(raw) || Number(raw) < 0 || !Number.isSafeInteger(Number(raw))) {
+        sendText(res, 400, `${name} must be a non-negative number of milliseconds`);
+        return null;
+    }
+    return Number(raw);
+}
+/** The request's query string. */
+function queryOf(req) {
+    const url = req.url ?? '';
+    const i = url.indexOf('?');
+    return new URLSearchParams(i < 0 ? '' : url.slice(i + 1));
+}
+/**
+ * A sink writing to a stream with backpressure. `watch` is the response whose
+ * closing means the client left (it differs from target when a gzip stream
+ * sits in between). A client that stops reading for timeoutMs is dropped.
+ */
+function writableSink(target, watch = target, timeoutMs = 60000) {
+    return (chunk) => {
+        if (watch.destroyed || target.destroyed)
+            throw new ClientGoneError();
+        if (target.write(chunk))
+            return;
+        return new Promise((resolve, reject) => {
+            const cleanup = () => {
+                clearTimeout(timer);
+                target.off('drain', onDrain);
+                watch.off('close', onClose);
+                target.off('error', onClose);
+            };
+            const onDrain = () => {
+                cleanup();
+                resolve();
+            };
+            const onClose = () => {
+                cleanup();
+                reject(new ClientGoneError());
+            };
+            const timer = setTimeout(() => {
+                cleanup();
+                watch.destroy();
+                reject(new ClientGoneError('client stopped reading'));
+            }, timeoutMs);
+            target.once('drain', onDrain);
+            watch.once('close', onClose);
+            target.once('error', onClose);
+        });
+    };
+}
+/** Whether a Host header names a loopback host (localhost, 127.0.0.0/8, ::1). */
+function loopbackHost(hostport) {
+    if (!hostport)
+        return false;
+    let host = hostport;
+    const v6 = /^\[([^\]]+)\](?::\d*)?$/.exec(hostport);
+    if (v6) {
+        host = v6[1];
+    }
+    else {
+        const i = hostport.lastIndexOf(':');
+        if (i >= 0 && hostport.indexOf(':') === i)
+            host = hostport.slice(0, i);
+    }
+    if (host.toLowerCase() === 'localhost')
+        return true;
+    if (net_1.default.isIPv4(host))
+        return host.split('.')[0] === '127';
+    if (net_1.default.isIPv6(host)) {
+        let normalized;
+        try {
+            normalized = new URL(`http://[${host}]/`).hostname.toLowerCase(); // "[::1]"
+        }
+        catch {
+            return false;
+        }
+        if (normalized === '[::1]')
+            return true;
+        // IPv4-mapped loopback: ::ffff:127.x.y.z → [::ffff:7fxx:yyzz]
+        return /^\[::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}\]$/.test(normalized);
+    }
+    return false;
+}
+/**
+ * Whether the request came through Cloudflare (the Repoburg remote-access
+ * tunnel). Defense in depth next to the Host check: tabtape is local-only.
+ */
+function viaTunnel(req) {
+    return req.headers['cf-ray'] !== undefined || req.headers['cf-connecting-ip'] !== undefined;
+}

package/daemon/dist/tabtape/api/record.js

@@ -0,0 +1,149 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.newRecordToken = newRecordToken;
+exports.validRecordToken = validRecordToken;
+exports.recordHTML = recordHTML;
+exports.recordJS = recordJS;
+exports.sendRecordAsset = sendRecordAsset;
+/**
+ * Record links start and stop recordings in browsers that can only be told
+ * to open a URL, such as one driven by Playwright MCP:
+ *
+ *   <mount>/record?token=…&name=…&url=…   start recording this tab, then open url
+ *   <mount>/record/stop?token=…           stop the recording
+ *
+ * The extension notices the tab opening one of them, asks
+ * <mount>/api/record/verify whether the token is this daemon's, and only
+ * then starts or stops. Web pages can open these URLs too, but without the
+ * token nothing happens. The extension then sends the tab back to
+ * <mount>/record?started=… (or stopped, error), which says what happened.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+/** The page keeps to its own script: it shows query parameters. */
+const RECORD_CSP = "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'";
+/** A new record token: links from an earlier daemon run stop working. */
+function newRecordToken() {
+    return crypto_1.default.randomBytes(20).toString('base64url');
+}
+/** Constant-time comparison; an empty expected token turns record links off. */
+function validRecordToken(want, got) {
+    if (!want || typeof got !== 'string')
+        return false;
+    const a = Buffer.from(got);
+    const b = Buffer.from(want);
+    return a.length === b.length && crypto_1.default.timingSafeEqual(a, b);
+}
+function recordHTML(mount) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>tabtape</title>
+<style>
+  :root { color-scheme: light dark; font: 15px/1.5 system-ui, -apple-system, sans-serif; }
+  body { margin: 0; display: grid; place-items: center; min-height: 100vh; }
+  main { max-width: 38rem; padding: 2rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.75rem; }
+  h1::before { content: ''; display: inline-block; width: 0.7em; height: 0.7em; margin-right: 0.5em; border-radius: 50%; background: #e5484d; vertical-align: 0.02em; }
+  p { margin: 0 0 0.6rem; }
+  code { font-size: 0.92em; }
+</style>
+</head>
+<body>
+<main>
+<h1 id="title">tabtape</h1>
+<div id="body"></div>
+</main>
+<script src="${mount}/record/record.js"></script>
+</body>
+</html>
+`;
+}
+function recordJS(mount) {
+    return `// Says what a record link did. The tabtape extension, not this page, starts
+// and stops recordings; it sends the tab back here with the outcome.
+const MOUNT = ${JSON.stringify(mount)};
+const q = new URLSearchParams(location.search);
+const ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+
+/** Each line is a string or an array of strings and nodes. */
+function show(title, ...lines) {
+  document.title = \`tabtape · \${title}\`;
+  document.getElementById('title').textContent = title;
+  document.getElementById('body').replaceChildren(
+    ...lines.map((line) => {
+      const p = document.createElement('p');
+      p.append(...[].concat(line));
+      return p;
+    }),
+  );
+}
+
+function el(tag, text, attrs = {}) {
+  const e = Object.assign(document.createElement(tag), attrs);
+  e.textContent = text;
+  return e;
+}
+
+const started = q.get('started');
+const stopped = q.get('stopped');
+const error = q.get('error');
+const name = q.get('name');
+
+if (error) {
+  show('Record link failed', error);
+} else if (started && ID.test(started)) {
+  show(
+    'Recording',
+    ['Recording ', el('code', started), name ? \` “\${name}”\` : '', '.'],
+    'Open the page to test in this tab. Open the stop link when you are done, or close the tab.',
+  );
+} else if (stopped && ID.test(stopped)) {
+  show(
+    'Recording saved',
+    ['Saved recording ', el('code', stopped), '.'],
+    [el('a', 'Watch the replay', { href: \`\${MOUNT}/#/s/\${stopped}\` })],
+    ['Ask the tabtape MCP tools about it with session_id ', el('code', stopped), '.'],
+  );
+} else if (q.has('used') || (q.get('token') && performance.getEntriesByType('navigation')[0]?.type === 'back_forward')) {
+  // The extension ignores record links reached with Back or Forward. The
+  // token leaves this history entry too: the extension also looks at open
+  // tabs when it starts, and must not take this one for a new link.
+  if (q.get('token')) history.replaceState(null, '', \`\${location.pathname}?used\`);
+  show(
+    'Record link already used',
+    'Going back or forward to a record link starts and stops nothing; the recording, if any, goes on.',
+    'To use the link again, open it anew, or ask get_record_link for a new one.',
+  );
+} else if (q.get('token')) {
+  const stopping = location.pathname === MOUNT + '/record/stop';
+  show(stopping ? 'Stopping the recording…' : 'Starting a recording…', 'The tabtape extension in this browser takes it from here.');
+  setTimeout(() => {
+    show(
+      'Nothing happened',
+      'No tabtape extension answered in this browser, so nothing is recorded.',
+      ['Load the extension (', el('code', 'tabtape/extension/dist'), ' of the Repoburg repository, chrome://extensions → Load unpacked) and check that its server is ', el('code', location.origin + MOUNT), '.'],
+    );
+  }, 5000);
+} else {
+  show('Record links', 'This page starts and stops tabtape recordings from links. The tabtape MCP tool get_record_link makes them.');
+}
+`;
+}
+function sendRecordAsset(res, contentType, body) {
+    res.writeHead(200, {
+        'Content-Type': contentType,
+        'Cache-Control': 'no-store',
+        // The token is in the URL: never send it on.
+        'Referrer-Policy': 'no-referrer',
+        'Content-Security-Policy': RECORD_CSP,
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Length': Buffer.byteLength(body),
+    });
+    res.end(body);
+}