termdock 1.4.299 → 1.4.300

package/dist/server/agent/integrationStore.js

@@ -0,0 +1,199 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { CollaborationError } from './collaborationProtocol.js';
+export const INTEGRATION_PROTOCOL = 1;
+export const INTEGRATION_OPERATIONS = ['task.read', 'task.create', 'task.assign', 'task.comment', 'task.revise', 'task.answer', 'events.read', 'session.create', 'session.read', 'session.restore'];
+export function integrationError(code, message, status = 400) { throw new CollaborationError(code, message, status); }
+export function atomicJson(file, value) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${process.pid}.tmp`;
+    const descriptor = fs.openSync(temporary, 'w', 0o600);
+    try {
+        fs.fchmodSync(descriptor, 0o600);
+        fs.writeFileSync(descriptor, JSON.stringify(value));
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    fs.renameSync(temporary, file);
+    const directory = fs.openSync(path.dirname(file), 'r');
+    try {
+        fs.fsyncSync(directory);
+    }
+    finally {
+        fs.closeSync(directory);
+    }
+}
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+function identifier(value, label) {
+    if (typeof value !== 'string' || !/^[a-zA-Z0-9._-]{1,80}$/.test(value))
+        integrationError('INVALID_INTEGRATION_POLICY', `Invalid ${label}`);
+}
+export function validatePolicy(value) {
+    identifier(value?.id, 'principal id');
+    if (!value.groupId || typeof value.groupId !== 'string' || value.groupId.length > 160)
+        integrationError('INVALID_INTEGRATION_POLICY', 'A single groupId is required');
+    if (!Array.isArray(value.permissions) || value.permissions.some(p => !INTEGRATION_OPERATIONS.includes(p)))
+        integrationError('INVALID_INTEGRATION_POLICY', 'Unknown permission');
+    if (!Array.isArray(value.launchProfiles) || value.launchProfiles.length > 16)
+        integrationError('INVALID_INTEGRATION_POLICY', 'launchProfiles must be an array');
+    const ids = new Set();
+    for (const profile of value.launchProfiles) {
+        identifier(profile?.id, 'profile id');
+        identifier(profile.agentSlug, 'agent slug');
+        if (ids.has(profile.id))
+            integrationError('INVALID_INTEGRATION_POLICY', 'Duplicate launch profile');
+        ids.add(profile.id);
+        if (typeof profile.executable !== 'string' || !path.isAbsolute(profile.executable) || /[\x00-\x1f\x7f]/.test(profile.executable))
+            integrationError('INVALID_INTEGRATION_POLICY', 'Launcher must be an absolute path');
+        if (!Array.isArray(profile.argv) || !Array.isArray(profile.resumeArgv) || [...profile.argv, ...profile.resumeArgv].some(a => typeof a !== 'string' || /[\x00-\x1f\x7f]/.test(a) || a.length > 8192) || profile.argv.length > 128 || profile.resumeArgv.length > 128)
+            integrationError('INVALID_INTEGRATION_POLICY', 'Invalid structured argv');
+        if (profile.resumeArgv.filter(a => a === '{sessionId}').length !== 1 || profile.resumeArgv.filter(a => a === '{launchArgs}').length !== 1 || profile.resumeArgv.some(a => a.includes('{sessionId}') && a !== '{sessionId}') || profile.resumeArgv.includes('--last'))
+            integrationError('INVALID_INTEGRATION_POLICY', 'resumeArgv requires one {sessionId} and one {launchArgs}; --last is forbidden');
+        if (!Array.isArray(profile.cwdRoots) || !profile.cwdRoots.length || profile.cwdRoots.some(root => typeof root !== 'string' || !path.isAbsolute(root) || /[\x00-\x1f\x7f]/.test(root)))
+            integrationError('INVALID_INTEGRATION_POLICY', 'cwdRoots must be absolute paths');
+    }
+    // Policies contain launcher configuration, never authentication material.
+    return structuredClone({ id: value.id, groupId: value.groupId, permissions: value.permissions, launchProfiles: value.launchProfiles });
+}
+export class IntegrationStore {
+    file;
+    retention;
+    doc = { version: 1, principals: [], events: [], sequences: {}, prunedThrough: {}, sources: {}, consumers: {} };
+    listeners = new Set();
+    constructor(file, retention = 10000) {
+        this.file = file;
+        this.retention = retention;
+        try {
+            const document = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (document.version !== 1 || !Array.isArray(document.events) || !Array.isArray(document.principals) || !document.sources || !document.consumers || !document.sequences || !document.prunedThrough)
+                throw new Error('Invalid integration journal');
+            this.doc = document;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    write(next) {
+        if (Buffer.byteLength(JSON.stringify(next)) > 64 * 1024 * 1024)
+            integrationError('EVENT_STORAGE_FULL', 'Integration journal is full; no event was acknowledged', 503);
+        atomicJson(this.file, next);
+        this.doc = next;
+        for (const listener of this.listeners) {
+            try {
+                listener();
+            }
+            catch { /* Subscription reports its own failure. */ }
+        }
+    }
+    subscribe(listener) { this.listeners.add(listener); return () => { this.listeners.delete(listener); }; }
+    policies() { return this.doc.principals.map(({ tokenHash: _, ...principal }) => structuredClone(principal)); }
+    provision(policy) {
+        const checked = validatePolicy(policy);
+        if (this.doc.principals.some(p => p.id === checked.id))
+            integrationError('INTEGRATION_EXISTS', 'Use a new id; credentials cannot be silently replaced', 409);
+        const token = randomBytes(32).toString('base64url');
+        const next = structuredClone(this.doc);
+        next.principals.push({ ...checked, tokenHash: hash(token), revoked: false });
+        this.write(next);
+        return { principal: checked, token };
+    }
+    revoke(id) {
+        const next = structuredClone(this.doc), principal = next.principals.find(p => p.id === id);
+        if (!principal)
+            integrationError('INTEGRATION_NOT_FOUND', 'Integration does not exist', 404);
+        principal.revoked = true;
+        this.write(next);
+    }
+    authenticate(id, token) {
+        const principal = this.doc.principals.find(p => p.id === id);
+        const given = Buffer.from(hash(token)), expected = Buffer.from(principal?.tokenHash ?? hash('invalid'));
+        if (!principal || !timingSafeEqual(given, expected))
+            integrationError('INTEGRATION_UNAUTHORIZED', 'Invalid integration credential', 401);
+        if (principal.revoked)
+            integrationError('INTEGRATION_REVOKED', 'Integration authorization was revoked', 403);
+        return structuredClone(principal);
+    }
+    authorize(principal, permission, groupId = principal.groupId) {
+        const active = this.doc.principals.find(p => p.id === principal.id);
+        if (!active || active.revoked)
+            integrationError('INTEGRATION_REVOKED', 'Integration authorization was revoked', 403);
+        if (groupId !== active.groupId || !active.permissions.includes(permission))
+            integrationError('INTEGRATION_PERMISSION_DENIED', 'Operation is outside the integration grant', 403);
+    }
+    append(updates) {
+        const next = structuredClone(this.doc);
+        let changed = false;
+        for (const update of updates) {
+            if (next.sources[update.sourceKey] === update.sourceVersion)
+                continue;
+            const group = update.event.group_id, sequence = (next.sequences[group] ?? 0) + 1;
+            next.events.push({ ...update.event, event_id: update.eventId ?? randomUUID(), sequence, cursor: this.cursor(group, sequence) });
+            next.sequences[group] = sequence;
+            next.sources[update.sourceKey] = update.sourceVersion;
+            changed = true;
+        }
+        if (!changed)
+            return;
+        const counts = new Map();
+        next.events = next.events.reverse().filter(event => {
+            const count = (counts.get(event.group_id) ?? 0) + 1;
+            counts.set(event.group_id, count);
+            if (count <= this.retention)
+                return true;
+            next.prunedThrough[event.group_id] = Math.max(next.prunedThrough[event.group_id] ?? 0, event.sequence);
+            return false;
+        }).reverse();
+        this.write(next);
+    }
+    cursor(group, sequence) { return Buffer.from(JSON.stringify({ v: 1, group, sequence })).toString('base64url'); }
+    decode(group, cursor) {
+        let value;
+        try {
+            value = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        }
+        catch {
+            return integrationError('INVALID_EVENT_CURSOR', 'Invalid cursor');
+        }
+        if (value.v !== 1 || value.group !== group || !Number.isSafeInteger(value.sequence) || value.sequence < 0 || value.sequence > (this.doc.sequences[group] ?? 0))
+            integrationError('INVALID_EVENT_CURSOR', 'Cursor does not belong to this group');
+        return value.sequence;
+    }
+    key(principal, consumer) { identifier(consumer, 'consumer'); return `${principal.id}:${principal.groupId}:${consumer}`; }
+    page(principal, consumer, cursor) {
+        this.authorize(principal, 'events.read');
+        const key = this.key(principal, consumer), group = principal.groupId;
+        const floor = this.doc.prunedThrough[group] ?? 0;
+        // A new consumer explicitly starts at the earliest retained fact. Existing
+        // consumers never silently skip a retention gap.
+        if (this.doc.consumers[key] === undefined) {
+            const next = structuredClone(this.doc);
+            next.consumers[key] = floor;
+            this.write(next);
+        }
+        const after = cursor ? this.decode(group, cursor) : this.doc.consumers[key];
+        if (after < floor)
+            integrationError('EVENT_RETENTION_GAP', 'Confirmed cursor is older than retained history; reconcile task/session snapshots and use a new consumer', 409);
+        return { events: structuredClone(this.doc.events.filter(e => e.group_id === group && e.sequence > after).slice(0, 100)), cursor: this.cursor(group, after) };
+    }
+    ack(principal, consumer, cursor) {
+        this.authorize(principal, 'events.read');
+        const key = this.key(principal, consumer), sequence = this.decode(principal.groupId, cursor), confirmed = this.doc.consumers[key];
+        if (confirmed === undefined)
+            integrationError('EVENT_CONSUMER_NOT_STARTED', 'Subscribe before acknowledging');
+        if (sequence < confirmed)
+            integrationError('EVENT_ACK_REWIND', 'Acknowledgement cannot rewind');
+        if (confirmed < (this.doc.prunedThrough[principal.groupId] ?? 0))
+            integrationError('EVENT_RETENTION_GAP', 'Consumer has a retention gap', 409);
+        // Cursor is a cumulative declaration that every preceding event is safely
+        // in the bridge inbox. The subscription server separately checks it was sent.
+        const next = structuredClone(this.doc);
+        next.consumers[key] = sequence;
+        this.write(next);
+        return { cursor, ack_semantics: 'durable_received' };
+    }
+    cursorSequence(group, cursor) { return this.decode(group, cursor); }
+}

package/dist/server/cli.js

@@ -15,6 +15,7 @@ if (process.argv.slice(2).some(arg => arg === '--federation-pairing' || arg ===
     const { runFederationCli } = await import('./federation/cli.js');
     process.exit(await runFederationCli(process.argv.slice(2)));
 }
+import { INTEGRATION_HELP, runIntegrationAdmin, revokeIntegration, runIntegrationCollab } from './agent/integrationCli.js';
 import { parseNotifyCommand, NOTIFY_HELP, NOTIFY_PROMPT } from './agent/notifyCli.js';
 import { detectLocalSessionContext, resolveLocalCollaborationContext } from './agent/localSessionContext.js';
 import { parseAutomationCommand, executeAutomationCommand, AUTOMATION_HELP } from './agent/automationCli.js';
@@ -207,6 +208,7 @@ Short commands:
   n [message]       Progress reminder; run td n for help and Agent instructions
   notify [message]  Same as n (see td n --prompt)
   automation         Manage scheduled tasks (see td automation --help)
+  integration       Manage local scoped integrations (see integration help)
   collab status      Show this Session's collaboration groups and peers
   collab inbox       Read messages without acknowledging (see collab --help)
   collab send <session-id> <message>
@@ -658,6 +660,7 @@ function parseArgs(argv) {
     let pluginHooks;
     let pluginRemove;
     let agentEvent;
+    let integration;
     let collab;
     let automation;
     let notify;
@@ -797,6 +800,10 @@ function parseArgs(argv) {
             }
             argv = [];
         }
+        else if (command === 'integration') {
+            integration = argv.slice(1);
+            argv = [];
+        }
         else if (command === 'collab') {
             try {
                 collab = parseCollaborationCommand(argv.slice(1));
@@ -1183,6 +1190,7 @@ function parseArgs(argv) {
         pluginHooks,
         pluginRemove,
         agentEvent,
+        integration,
         collab,
         automation,
         notify,
@@ -1434,6 +1442,10 @@ async function runAutomation(command) {
 }
 async function runCollab(command) {
     const runningState = getRunningState();
+    if (command.options.principal) {
+        process.exitCode = await runIntegrationCollab(command, runningState?.port ?? 9834, { write: line => console.log(line), stdin: readStdinText });
+        return;
+    }
     if (!runningState?.localApiToken) {
         // Help is a plain read: it must stay available without a running server.
         if (command.action === 'help') {
@@ -3475,6 +3487,23 @@ async function main() {
         await runAutomation(options.automation);
         return;
     }
+    if (options.integration) {
+        const argv = options.integration;
+        if (!argv.length || ['help', '--help'].includes(argv[0])) {
+            console.log(INTEGRATION_HELP);
+            return;
+        }
+        const state = getRunningState();
+        if (!state?.localApiToken) {
+            console.error(JSON.stringify({ ok: false, code: 'SERVICE_UNAVAILABLE', error: 'Termdock is not running' }));
+            process.exitCode = 1;
+            return;
+        }
+        process.exitCode = argv[0] === 'revoke' && argv.length === 2
+            ? await revokeIntegration(argv[1], state.port, state.localApiToken, line => console.log(line))
+            : await runIntegrationAdmin(argv, state.port, state.localApiToken, line => console.log(line));
+        return;
+    }
     if (options.collab) {
         await runCollab(options.collab);
         return; // Preserve the receipt exit code and allow piped JSON output to drain.

package/dist/server/entry.js

@@ -1,7 +1,8 @@
+import { IntegrationRuntime, integrationSocketPath } from './agent/integrationServer.js';
 import { CollaborationService } from './agent/collaborationService.js';
 import { X509Certificate } from 'node:crypto';
 import { CollaborationPeerTransport, connectCollaborationRpc } from './agent/collaborationPeerTransport.js';
-import { collaborationStore, collaborationTaskStore, deliverPeerCollaboration, collaborationLocalActivity, collaborationDirectorySessions, prepareCollaborationTaskWorker } from './routes/terminal.js';
+import { collaborationStore, collaborationTaskStore, deliverPeerCollaboration, collaborationLocalActivity, collaborationDirectorySessions, prepareCollaborationTaskWorker, integrationSessionAdapter } from './routes/terminal.js';
 import { CollaborationTaskService } from './agent/collaborationTaskService.js';
 import { setPushTargetPeerId } from './notifications/pushService.js';
 import { desktopDirectTargets } from './federation/desktopTargets.js';
@@ -571,7 +572,7 @@ export function startServer(options = {}) {
             return routeInvitations.consume(code, subjectId);
         },
     });
-    void federation.then(runtime => {
+    void federation.then(async (runtime) => {
         federationServiceId = runtime.serviceId;
         setPushTargetPeerId(runtime.serviceId);
         refreshDirectTargets();
@@ -634,6 +635,21 @@ export function startServer(options = {}) {
         app.locals.collaborationService = collaborationService;
         const collaborationTasks = new CollaborationTaskService(collaborationTaskStore, collaborationStore, collaborationService, deliverPeerCollaboration, (task, template, dependencies) => prepareCollaborationTaskWorker(task, template, dependencies, collaborationService, (taskId, dependencyId, offset) => collaborationTasks.dependencyChunk(taskId, dependencyId, offset)));
         app.locals.collaborationTasks = collaborationTasks;
+        if (options.port !== 0) {
+            let integration;
+            try {
+                const port = options.port ?? DEFAULT_PORT;
+                integration = new IntegrationRuntime({ directory: path.join(homedir(), '.termdock', 'integration-state', String(port)), socketPath: integrationSocketPath(port), adminToken: options.localApiToken,
+                    messages: collaborationStore, taskStore: collaborationTaskStore, tasks: collaborationTasks, peers: collaborationService, sessions: integrationSessionAdapter });
+                await integration.listen();
+                app.locals.integrationRuntime = integration;
+                server.once('close', () => { void integration?.close(); });
+            }
+            catch {
+                await integration?.close();
+                console.error('[integrations] Local integration endpoint could not start; existing terminal service remains available');
+            }
+        }
         collaborationTasks.start();
         server.once('close', () => collaborationTasks.close());
         collaborationService.start();
@@ -786,15 +802,18 @@ export function startServer(options = {}) {
         return;
     });
     server.listen(port, host, () => {
+        const listeningAddress = server.address();
+        const listeningPort = listeningAddress && typeof listeningAddress !== 'string' ? listeningAddress.port : port;
+        const listeningHost = listeningAddress && typeof listeningAddress !== 'string' ? listeningAddress.address : host;
         const displayHost = host === '0.0.0.0' ? 'localhost' : host;
-        console.log(`Termdock server running at ${scheme}://${displayHost}:${port}`);
-        console.log(`Health check: ${scheme}://${displayHost}:${port}/health`);
+        console.log(`Termdock server running at ${scheme}://${displayHost}:${listeningPort}`);
+        console.log(`Health check: ${scheme}://${displayHost}:${listeningPort}/health`);
         const onboardingServerState = scheme === 'https'
-            ? startOnboardingServer({ httpsPort: port, caCertPath: options.httpsCaPath })
+            ? startOnboardingServer({ httpsPort: listeningPort, caCertPath: options.httpsCaPath })
             : { server: null, url: null };
-        void localAccessManager.start({ host, port, scheme, caCertPath: options.httpsCaPath, onboardingPort: options.onboardingPort ?? port }).then((state) => {
+        void localAccessManager.start({ host: listeningHost, port: listeningPort, scheme, caCertPath: options.httpsCaPath, onboardingPort: options.onboardingPort ?? listeningPort }).then((state) => {
             const publishState = () => {
-                const onboardingUrl = onboardingServerState.url ?? state.onboardingUrl;
+                const onboardingUrl = state.status === 'loopback-only' ? null : onboardingServerState.url ?? state.onboardingUrl;
                 latestLocalAccessState = state;
                 latestOnboardingUrl = onboardingUrl;
                 if (state.status === 'active') {

package/dist/server/routes/filesystem.js

@@ -5064,89 +5064,136 @@ router.post('/upload', async (req, res) => {
             res.status(400).json({ error: 'Missing dir query parameter', code: 'MISSING_DIR' });
             return;
         }
+        // New clients can reject an oversized selection before sending any files.
+        // Older clients are still checked against the actual multipart contents.
+        const declaredCount = req.query.fileCount;
+        if (declaredCount !== undefined && (typeof declaredCount !== 'string' || !/^\d+$/.test(declaredCount))) {
+            res.status(400).json({ error: 'Invalid fileCount query parameter', code: 'INVALID_FILE_COUNT' });
+            return;
+        }
+        if (typeof declaredCount === 'string' && Number(declaredCount) > MAX_UPLOAD_FILES) {
+            res.status(413).json({ error: 'Upload limit exceeded', code: 'UPLOAD_LIMIT', files: [], results: [], maxFiles: MAX_UPLOAD_FILES });
+            return;
+        }
         const resolvedDir = await pathValidator.validatePathAsync(dir);
         const stat = await fs.promises.stat(resolvedDir);
         if (!stat.isDirectory()) {
             res.status(400).json({ error: 'Target is not a directory', code: 'NOT_A_DIRECTORY' });
             return;
         }
-        const files = [];
-        let fileCount = 0;
-        let aborted = false;
+        const results = [];
+        const createdPaths = [];
+        let failure;
         let totalSize = 0;
+        const fail = (error, code = 'UPLOAD_FAILED', status = 500) => {
+            failure ??= { error, code, status };
+        };
         const bb = busboy({
             headers: req.headers,
             // Browser FormData sends UTF-8 filenames, while busboy defaults bare
             // multipart filename parameters to latin1. Without this, dropped files
             // named with CJK characters turn into mojibake like "查询".
             defParamCharset: 'utf8',
-            limits: { fileSize: MAX_UPLOAD_SIZE, files: MAX_UPLOAD_FILES },
+            // Enforce the count in the file handler rather than Busboy's files limit:
+            // the latter silently omits the names of files beyond the limit.
+            // Busboy marks a stream truncated as soon as this boundary is reached;
+            // one extra byte lets an exactly-100MB file remain a valid upload.
+            limits: { fileSize: MAX_UPLOAD_SIZE + 1 },
         });
         const writePromises = [];
         bb.on('file', (_fieldname, fileStream, info) => {
-            if (aborted) {
-                fileStream.resume();
-                return;
-            }
-            fileCount++;
-            if (fileCount > MAX_UPLOAD_FILES) {
-                aborted = true;
-                fileStream.resume();
-                return;
-            }
-            const { filename } = info;
-            const destName = sanitizeUploadFilename(filename, `file_${fileCount}`);
+            const index = results.length;
+            const destName = sanitizeUploadFilename(info.filename, `file_${index + 1}`);
+            const result = { index, name: destName, status: 'failed' };
+            results.push(result);
+            if (results.length > MAX_UPLOAD_FILES)
+                fail('Upload limit exceeded', 'UPLOAD_LIMIT', 413);
             const baseDestPath = path.join(resolvedDir, destName);
-            // Resolve unique path asynchronously inside the write promise
+            fileStream.on('limit', () => fail('Upload limit exceeded', 'UPLOAD_LIMIT', 413));
+            // Parsing/cancellation can destroy this stream while exclusive open is
+            // pending. The async iterator below will still observe the same error.
+            fileStream.on('error', () => { });
             const writePromise = (async () => {
-                const destPath = await uniquePath(baseDestPath);
-                return new Promise((resolve, reject) => {
-                    const writeStream = fs.createWriteStream(destPath);
-                    let fileSize = 0;
-                    fileStream.on('data', (chunk) => {
-                        fileSize += chunk.length;
-                        totalSize += chunk.length;
-                        if (totalSize > MAX_UPLOAD_SIZE) {
-                            aborted = true;
-                            fileStream.destroy?.(new Error('File too large'));
-                            writeStream.destroy();
-                            return;
+                let destination;
+                let fileSize = 0;
+                try {
+                    if (!failure) {
+                        destination = await createUniqueUploadFile(baseDestPath);
+                        createdPaths.push(destination.path);
+                    }
+                    // Keep draining rejected files so every multipart item can be
+                    // reported, and Busboy can finish without a dangling write stream.
+                    for await (const chunk of fileStream) {
+                        const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                        fileSize += data.length;
+                        totalSize += data.length;
+                        if (totalSize > MAX_UPLOAD_SIZE)
+                            fail('Upload limit exceeded', 'UPLOAD_LIMIT', 413);
+                        if (destination && !failure) {
+                            try {
+                                await destination.handle.writeFile(data);
+                            }
+                            catch (error) {
+                                // Do not throw from the iterator body: that would destroy the
+                                // multipart source before Busboy can drain the rest of it.
+                                fail(error instanceof Error ? error.message : 'Upload failed');
+                            }
                         }
-                    });
-                    fileStream.pipe(writeStream);
-                    writeStream.on('finish', () => {
-                        files.push({ name: destName, path: destPath, size: fileSize });
-                        resolve();
-                    });
-                    writeStream.on('error', (err) => {
-                        fs.promises.unlink(destPath).catch(() => { });
-                        reject(err);
-                    });
-                });
+                    }
+                    if (destination && !failure) {
+                        result.status = 'uploaded';
+                        result.path = destination.path;
+                        result.size = fileSize;
+                    }
+                }
+                catch (error) {
+                    fail(error instanceof Error ? error.message : 'Upload failed');
+                    fileStream.resume();
+                }
+                finally {
+                    try {
+                        await destination?.handle.close();
+                    }
+                    catch (error) {
+                        fail(error instanceof Error ? error.message : 'Upload failed');
+                    }
+                }
             })();
             writePromises.push(writePromise);
         });
-        bb.on('error', (_err) => {
-            // Will be handled by the promise rejection below
-        });
-        bb.on('filesLimit', () => {
-            aborted = true;
-        });
-        bb.on('finish', async () => {
-            try {
-                await Promise.all(writePromises);
-                if (aborted && files.length === 0) {
-                    res.status(413).json({ error: 'Upload limit exceeded', code: 'UPLOAD_LIMIT' });
-                    return;
-                }
-                res.status(200).json({ files });
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : 'Upload failed';
-                res.status(500).json({ error: message, code: 'UPLOAD_FAILED' });
-            }
-        });
-        req.pipe(bb);
+        const onAborted = () => bb.destroy(new Error('Upload canceled'));
+        req.once('aborted', onAborted);
+        try {
+            await new Promise((resolve, reject) => {
+                bb.once('finish', resolve);
+                bb.once('error', reject);
+                req.pipe(bb);
+            });
+        }
+        catch (error) {
+            fail(error instanceof Error ? error.message : 'Upload failed');
+        }
+        finally {
+            req.off('aborted', onAborted);
+        }
+        await Promise.all(writePromises);
+        if (res.destroyed)
+            fail('Upload canceled');
+        if (failure) {
+            // Paths enter this list only after an exclusive create succeeded. Never
+            // remove an existing file or another concurrent request's destination.
+            await Promise.all(createdPaths.map(filePath => fs.promises.unlink(filePath).catch(error => {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            })));
+            const { error, code, status } = failure;
+            if (!res.destroyed)
+                res.status(status).json({ error, code, files: [], maxFiles: MAX_UPLOAD_FILES,
+                    results: results.map(result => ({ index: result.index, name: result.name, status: 'failed', error, code })) });
+            return;
+        }
+        const files = results.map(result => ({ name: result.name, path: result.path, size: result.size }));
+        res.status(200).json({ files, results });
     }
     catch (error) {
         if (error instanceof Error && error.code === 'PATH_NOT_ALLOWED') {
@@ -5157,32 +5204,18 @@ router.post('/upload', async (req, res) => {
         res.status(500).json({ error: message, code: 'UPLOAD_FAILED' });
     }
 });
-async function uniquePath(filePath) {
-    try {
-        await fs.promises.access(filePath);
-        // File exists — find a unique name
-        const ext = path.extname(filePath);
-        const base = filePath.slice(0, filePath.length - ext.length);
-        let counter = 1;
-        let candidate;
-        do {
-            candidate = `${base}_${counter}${ext}`;
-            counter++;
-        } while (await exists(candidate));
-        return candidate;
-    }
-    catch {
-        // File doesn't exist — use as-is
-        return filePath;
-    }
-}
-async function exists(p) {
-    try {
-        await fs.promises.access(p);
-        return true;
-    }
-    catch {
-        return false;
+async function createUniqueUploadFile(filePath) {
+    const ext = path.extname(filePath);
+    const base = filePath.slice(0, filePath.length - ext.length);
+    for (let counter = 0;; counter++) {
+        const candidate = counter === 0 ? filePath : `${base}_${counter}${ext}`;
+        try {
+            return { path: candidate, handle: await fs.promises.open(candidate, 'wx') };
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
     }
 }
 export default router;