teapot-coding-agent 0.25.2 → 0.26.1

package/dist/server/api.js

@@ -91,21 +91,68 @@ function mimeFor(rel, kind) {
 }
 export function buildApp(master) {
     const app = new Hono();
+    /**
+     * Cap on concurrent `/api/ws` event-stream clients (#79).
+     *
+     * Each one holds a listener on the global bus and receives every agent's
+     * events, so this bounds real fan-out. 64 is far above any plausible number of
+     * open tabs on a LAN and low enough that a runaway client cannot exhaust memory.
+     */
+    const MAX_WS_CLIENTS = 64;
     // Optional bearer auth for LAN exposure — TEAPOT_API_TOKEN env wins, else
     // the config's `password` field. Static files stay public; only /api/* is
-    // gated. WebSocket handshakes can't send headers → they accept ?token=.
+    // gated.
     const apiToken = process.env.TEAPOT_API_TOKEN || master.config.password || "";
+    /**
+     * Routes where `?token=` is accepted (#79).
+     *
+     * A browser WebSocket handshake cannot send an Authorization header, so the
+     * query parameter is the ONLY way for the UI to authenticate those two
+     * sockets. It used to be accepted on EVERY `/api/*` route, which put the
+     * secret into proxy access logs, `Referer` headers and browser history for
+     * requests that never needed it — `DELETE /api/agents/:id`, `PUT
+     * /api/config`, `POST /api/update/restart`.
+     *
+     * So this narrows where the secret can LEAK rather than changing who is
+     * authenticated: every route still accepts the header, and only these two
+     * also accept the query form.
+     */
+    const tokenInQueryOk = (path) => path === "/api/ws" || /^\/api\/agents\/[^/]+\/term$/.test(path);
     if (apiToken)
         app.use("/api/*", async (c, next) => {
             const h = c.req.header("authorization");
             const provided = h?.startsWith("Bearer ") ? h.slice(7) : undefined;
-            const q = c.req.query("token");
-            if ((provided && provided === apiToken) || (q && q === apiToken))
+            if (provided && provided === apiToken)
                 return next();
+            if (tokenInQueryOk(c.req.path)) {
+                const q = c.req.query("token");
+                if (q && q === apiToken)
+                    return next();
+            }
             return c.json({ error: "unauthorized" }, 401);
         });
     // per-agent terminal spawn guard
     const termCounts = new Map();
+    /**
+     * Live `/api/ws` event-stream connections (#79).
+     *
+     * Every one of these receives EVERY agent's events, so the count is a direct
+     * multiplier on fan-out, and `bus.setMaxListeners(1000)` only silences a
+     * warning — it does not bound anything. Capped so a stuck or hostile client
+     * cannot pin unbounded memory, and paired with a liveness check below so a
+     * client that stops reading is reaped rather than buffered for ever.
+     */
+    let wsClients = 0;
+    /**
+     * Agent ids reserved by an in-flight create (#71).
+     *
+     * The uniqueness loop is a check, not a reservation, and `addAgent` only
+     * publishes the id after awaiting — so concurrent creates all computed the
+     * same "unique" id and all persisted an entry. Reserving before the first
+     * await closes the window. Entries are released as soon as the agent is
+     * published or the create fails, so this never grows.
+     */
+    const idReservations = new Set();
     // keyed by CHILD, not agent: one agent may have up to 10 concurrent
     // terminals, each with its own size and its own foreground program
     const termSizes = new TermSizeTracker();
@@ -118,8 +165,30 @@ export function buildApp(master) {
     app.get("/api/ws", upgradeWebSocket(() => {
         let onUpdate = null;
         let ka = null;
+        // set by onOpen, cleared by a pong. Declared at the connection's scope
+        // because onMessage is a SIBLING handler and cannot see a local in onOpen.
+        let awaitingPong = false;
+        let counted = false;
         return {
             onOpen(_evt, ws) {
+                // #79: refuse beyond the cap rather than accepting and buffering.
+                // Each connection costs a listener on the global bus and receives
+                // every agent's events, so this bounds real memory, not just a count.
+                if (wsClients >= MAX_WS_CLIENTS) {
+                    try {
+                        ws.send(JSON.stringify({ kind: "error", error: `too many event-stream clients (max ${MAX_WS_CLIENTS})` }));
+                        ws.close(1013, "too many clients");
+                    }
+                    catch {
+                        /* already gone */
+                    }
+                    return;
+                }
+                wsClients++;
+                counted = true;
+                // a client that stops reading makes ws.send buffer without bound; the
+                // app-level ping doubles as a liveness probe — if a ping goes
+                // unanswered the socket is reaped instead of accumulating
                 const send = (data) => {
                     try {
                         ws.send(JSON.stringify(data));
@@ -141,8 +210,23 @@ export function buildApp(master) {
                     send(ev);
                 };
                 bus.on("update", onUpdate);
-                // app-level liveness ping every 30s
-                ka = setInterval(() => send({ kind: "ping" }), 30_000);
+                // app-level liveness ping every 30s, and a reaper for a client that
+                // has stopped answering (#79)
+                ka = setInterval(() => {
+                    if (awaitingPong) {
+                        // the previous ping went unanswered: the client is not reading,
+                        // so its send buffer is growing. Reap it.
+                        try {
+                            ws.close(1011, "unresponsive");
+                        }
+                        catch {
+                            /* already gone */
+                        }
+                        return;
+                    }
+                    awaitingPong = true;
+                    send({ kind: "ping" });
+                }, 30_000);
             },
             onMessage(evt, ws) {
                 // clients may send {"kind":"ping"} — nothing else to do today
@@ -150,6 +234,8 @@ export function buildApp(master) {
                     const m = JSON.parse(String(evt.data));
                     if (m?.kind === "ping")
                         ws.send(JSON.stringify({ kind: "pong" }));
+                    if (m?.kind === "pong")
+                        awaitingPong = false;
                 }
                 catch {
                     /* ignore junk */
@@ -160,6 +246,10 @@ export function buildApp(master) {
                     clearInterval(ka);
                 if (onUpdate)
                     bus.off("update", onUpdate);
+                // only a connection that was actually admitted owns a slot — a
+                // refused one must not decrement one it never took (#70's lesson)
+                if (counted)
+                    wsClients = Math.max(0, wsClients - 1);
             },
         };
     }));
@@ -169,6 +259,12 @@ export function buildApp(master) {
     app.get("/api/agents/:id/term", upgradeWebSocket((c) => {
         const agentId = c.req.param("id") ?? "";
         let child = null;
+        // #70: whether THIS connection was admitted to the per-agent terminal
+        // budget. Declared per connection (not inside onOpen) because onClose is a
+        // sibling handler: a connection refused at the cap never incremented the
+        // counter, so onClose must not decrement for it — that asymmetry walked
+        // the counter below the live-shell count and disabled the cap entirely.
+        let admitted = false;
         const cleanup = () => {
             if (!child)
                 return;
@@ -198,7 +294,12 @@ export function buildApp(master) {
                     return;
                 }
                 termCounts.set(agentId, cur + 1);
+                admitted = true;
                 if (!agent) {
+                    // the slot was just taken and this connection owns it, so release
+                    // it here rather than leaving onClose to work it out
+                    termCounts.set(agentId, cur);
+                    admitted = false;
                     send({ kind: "exit", error: `no such agent: ${agentId}` });
                     return;
                 }
@@ -250,6 +351,11 @@ export function buildApp(master) {
                 if (dead)
                     termSizes.forget(dead);
                 cleanup();
+                // #70: only an ADMITTED connection owns a slot. A connection refused
+                // at the cap never incremented, so decrementing for it is exactly
+                // what drove the counter negative and disabled the limit.
+                if (!admitted)
+                    return;
                 const n = (termCounts.get(agentId) ?? 1) - 1;
                 if (n <= 0)
                     termCounts.delete(agentId);
@@ -281,10 +387,27 @@ export function buildApp(master) {
         let n = 2;
         // ids must be unique among RUNNING agents AND persisted config entries —
         // a config-only agent (not yet loaded) would otherwise collide on addAgent
-        while (master.agents.has(id) || master.config.agents.some((a) => a.id === id))
+        //
+        // #71: the loop below is a CHECK, not a RESERVATION, and addAgent only
+        // publishes the id after several awaits (mkdirSync, agent.init()). Every
+        // concurrent request therefore passed the check, computed the same "unique"
+        // id, and all persisted an entry — measured: 3 concurrent creates → 3 config
+        // entries, and with 5 concurrent spawns each minting its own session dir,
+        // `resolveSessionDir` binds to the first entry on restart and the rest are
+        // orphaned.
+        //
+        // So the id is RESERVED synchronously, before the first await. The set is
+        // per-process and only guards the window; a real agent arriving through
+        // another path still collides correctly via addAgent's own check.
+        while ((master.agents.has(id) || master.config.agents.some((a) => a.id === id) || idReservations.has(id)))
             id = `${base.slice(0, 38)}-${n++}`;
+        idReservations.add(id);
+        const releaseId = () => idReservations.delete(id);
         try {
+            // the reservation covers the awaits inside addAgent; once the agent is
+            // published the reservation is redundant and must be released
             const agent = await master.addAgent({ id, workspace: ws, provider: body.provider, model: body.model }, { persist: true, fresh: true });
+            releaseId();
             // NOTE: creation no longer auto-starts an LLM loop — the agent sits in
             // "stopped" (a lazy, zero-cost session) until the operator sends the
             // first prompt or presses ▶ start. The web UI relies on this.
@@ -293,6 +416,7 @@ export function buildApp(master) {
             return c.json({ ok: true, agent: agent.snapshot() });
         }
         catch (err) {
+            releaseId(); // never leak a reservation on failure
             return c.json({ error: err.message }, 400);
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teapot-coding-agent",
-  "version": "0.25.2",
+  "version": "0.26.1",
   "description": "A lightweight, always-on multi-agent harness for AI coding agents",
   "type": "module",
   "license": "AGPL-3.0-or-later",