termdock 1.4.321 → 1.4.324

package/dist/server/utils/terminalPasteBuffer.js

@@ -0,0 +1,66 @@
+const START = '\x1b[200~';
+const END = '\x1b[201~';
+const MAX_BYTES = 1024 * 1024;
+const TIMEOUT_MS = 10_000;
+const INCOMPLETE = '粘贴内容未完整送达，已取消，请重新粘贴。';
+/** A socket owns its pending paste. Never expose its opening delimiter to the
+ * PTY until the closing delimiter has arrived, even across input records.
+ * Ordinary keyboard/mouse records remain synchronous and unbuffered. */
+export class TerminalPasteBuffer {
+    onTimeout;
+    pending = '';
+    startedAt = 0;
+    timer;
+    constructor(onTimeout) {
+        this.onTimeout = onTimeout;
+    }
+    push(data) {
+        const previousStart = this.startedAt;
+        const continuing = this.pending.length > 0;
+        const input = this.pending + data;
+        const output = [];
+        this.clear();
+        let offset = 0;
+        while (offset < input.length) {
+            const start = input.indexOf(START, offset);
+            if (start < 0) {
+                output.push(input.slice(offset));
+                break;
+            }
+            if (start > offset)
+                output.push(input.slice(offset, start));
+            const end = input.indexOf(END, start + START.length);
+            const nested = input.indexOf(START, start + START.length);
+            if (nested >= 0 && (end < 0 || nested < end))
+                throw new Error(INCOMPLETE);
+            const paste = input.slice(start, end < 0 ? undefined : end + END.length);
+            if (Buffer.byteLength(paste) > MAX_BYTES)
+                throw new Error('粘贴内容超过 1 MiB，请分段粘贴。');
+            if (end < 0) {
+                this.pending = paste;
+                this.startedAt = continuing && start === 0 ? previousStart : Date.now();
+                this.timer = setTimeout(() => { this.clear(); this.onTimeout(INCOMPLETE); }, Math.max(0, this.startedAt + TIMEOUT_MS - Date.now()));
+                this.timer.unref();
+                break;
+            }
+            output.push(paste);
+            offset = end + END.length;
+        }
+        return output;
+    }
+    /** HTTP input has no continuation stream. Reject its entire body on failure. */
+    complete(data) {
+        const output = this.push(data);
+        if (this.pending) {
+            this.clear();
+            throw new Error(INCOMPLETE);
+        }
+        return output;
+    }
+    clear() {
+        clearTimeout(this.timer);
+        this.timer = undefined;
+        this.pending = '';
+        this.startedAt = 0;
+    }
+}

package/dist/server/utils/tmuxClientCapabilities.js

@@ -15,6 +15,10 @@ export async function supportsTmuxClientFeatures(binary) {
 }
 export function buildTmuxAttachArgs(sessionName, supportsFeatures) {
     return [
+        // The Web/native terminal consumes UTF-8 regardless of the server launcher's
+        // locale. GUI-launched services may inherit C; tmux otherwise emits _ for
+        // non-ASCII cells before the encrypted output ever reaches the renderer.
+        '-u',
         ...(supportsFeatures ? ['-T', 'RGB,sync'] : []),
         'attach-session', '-t', sessionName,
     ];

package/dist/server/utils/tmuxCopySelection.js

@@ -0,0 +1,94 @@
+import { randomUUID } from 'node:crypto';
+export const TMUX_COPY_MAX_BYTES = 256 * 1024;
+const FORMAT = '#{session_id}\t#{pane_id}\t#{pane_in_mode}\t#{selection_present}';
+function state(value) {
+    const parts = value.replace(/\r?\n$/, '').split('\t');
+    if (parts.length !== 4 || !/^\$\d+$/.test(parts[0]) || !/^%\d+$/.test(parts[1]) || !/^[01]$/.test(parts[2]) || !/^[01]?$/.test(parts[3]))
+        throw new Error('Tmux selection state was not confirmed');
+    return { session: parts[0], pane: parts[1], inMode: parts[2] === '1', selected: parts[3] === '1' };
+}
+/** Read this session's current selection through a unique, self-owned buffer.
+ * No global last-buffer read, shell copy command, clipboard write or mode exit. */
+export async function copyTmuxSelection(target, run) {
+    if (!target.trim() || /[\0\r\n]/.test(target))
+        throw new Error('Invalid tmux selection target');
+    const exact = `=${target}:`;
+    const read = () => run(['display-message', '-t', exact, '-p', FORMAT], { maxBuffer: 1024 }).then(state);
+    const before = await read();
+    const empty = () => ({ status: 'empty', paneId: before.pane, text: '', bytes: 0 });
+    if (!before.inMode || !before.selected)
+        return empty();
+    const prefix = `termdock-copy-${randomUUID()}-`;
+    const own = new RegExp(`^${prefix}[0-9]+$`);
+    const buffers = [];
+    let failed = false;
+    let primaryError;
+    const listArgs = ['list-buffers', '-f', `#{m:${prefix}*,#{buffer_name}}`, '-F', '#{buffer_name}\t#{buffer_size}'];
+    try {
+        await run(['send-keys', '-t', before.pane, '-X', 'copy-selection-no-clear', prefix], { maxBuffer: 1024 });
+        const metadata = await run(listArgs, { maxBuffer: 64 * 1024 });
+        for (const line of metadata.split('\n').filter(Boolean)) {
+            const [name, count] = line.split('\t');
+            if (!own.test(name))
+                throw new Error('Tmux returned an unowned selection buffer');
+            buffers.push({ name, bytes: Number(count) });
+            if (!/^\d+$/.test(count) || !Number.isSafeInteger(Number(count)))
+                throw new Error('Invalid owned tmux buffer metadata');
+        }
+        if (!buffers.length)
+            return empty();
+        if (buffers.length !== 1)
+            throw new Error('Tmux produced ambiguous selection buffers');
+        const buffer = buffers[0];
+        if (buffer.bytes > TMUX_COPY_MAX_BYTES)
+            throw new Error('Tmux selection exceeds the 256 KiB copy limit');
+        const text = await run(['save-buffer', '-b', buffer.name, '-'], { maxBuffer: TMUX_COPY_MAX_BYTES + 1 });
+        const after = await read();
+        if (after.session !== before.session || after.pane !== before.pane || !after.inMode || !after.selected)
+            throw new Error('Tmux selection target changed while copying');
+        const bytes = Buffer.byteLength(text, 'utf8');
+        if (bytes !== buffer.bytes || bytes > TMUX_COPY_MAX_BYTES)
+            throw new Error('Tmux selection was not read completely');
+        return bytes ? { status: 'copied', paneId: before.pane, text, bytes } : empty();
+    }
+    catch (error) {
+        failed = true;
+        primaryError = error;
+        throw error;
+    }
+    finally {
+        // A command may create its buffer before its reply fails. Enumerate only
+        // this UUID prefix even after metadata failure and attempt every own delete.
+        const names = new Set(buffers.map(buffer => buffer.name));
+        const cleanupErrors = [];
+        try {
+            const remaining = await run(listArgs, { maxBuffer: 64 * 1024 });
+            for (const line of remaining.split('\n').filter(Boolean)) {
+                const name = line.split('\t')[0];
+                if (!own.test(name)) {
+                    cleanupErrors.push(new Error('Tmux cleanup returned an unowned buffer'));
+                    continue;
+                }
+                names.add(name);
+            }
+        }
+        catch (error) {
+            cleanupErrors.push(error);
+        }
+        for (const name of names) {
+            try {
+                await run(['delete-buffer', '-b', name], { maxBuffer: 1024 });
+            }
+            catch (error) {
+                cleanupErrors.push(error);
+            }
+        }
+        if (cleanupErrors.length) {
+            const error = new AggregateError(cleanupErrors, 'Owned tmux copy buffer cleanup failed');
+            if (!failed)
+                throw error;
+            if (primaryError instanceof Error)
+                primaryError.cause = error;
+        }
+    }
+}

package/dist/server/utils/tmuxEmptyServerProbe.js

@@ -0,0 +1,15 @@
+/** A has-session failure is not evidence that tmux itself is unavailable.
+ * Confirm this one empty-server case without changing generic error handling. */
+export async function isConfirmedEmptyTmuxServer(error, target, run) {
+    if (!target.trim() || !error || typeof error !== 'object')
+        return false;
+    const value = error;
+    if (value.code !== 1 || typeof value.stderr !== 'string' || value.stderr.trim() !== 'no current target')
+        return false;
+    try {
+        return (await run(['list-sessions', '-F', '#{session_id}'])).trim() === '';
+    }
+    catch {
+        return false;
+    }
+}

package/docs/integrations.md

@@ -1242,3 +1242,88 @@ message/thread/幂等键或历史，不自动补 Enter、不用屏幕文字识
 投递、不同/缺失/弱原生证据、多匹配/归属/未知旧写入拒绝、绑定持久化和失败、
 只读路由权限/CLI、网页暂停提示及加密传输边界。Mac 实际现场的当前原生身份尚未独立确认，原消息尚待拥有者确认及接入方实际服务
 升级/回读后继续投递；不以维护机回归冒充该现场已恢复。
+
+
+## 1.4.322：启动代次一致性与输入检查诊断
+
+最低实际服务 **1.4.322**，配套 CLI 也升级至 1.4.322。`capabilities` 回读：
+`agent_launch_generation_consistency=true`、
+`agent_launch_generation_consistency_min_version=1.4.322`、
+`terminal_input_check_diagnostics=true`。普通协作协议仍为 2，integration protocol 仍为 1；
+不新增权限。只更新 CLI 不会改变正在运行的旧服务。
+
+启动代次是 TD 服务生成的 `agentLaunchGeneration`，与原生 Agent UUID、
+IntegrationSession 的数值 `generation` 分别记录。同一 backend 在启动准备时从 null
+变为新的启动 UUID 是正常动作。名称、cwd、原生身份元数据等整记录更新过去可能
+携带 await 之前的旧启动字段写回；本版将启动字段交由专门的比较后更新路径管理，
+普通元数据更新继承当前启动代次与一次性检查，不能覆盖或复活旧值。
+
+启动操作在写入本次代次后、持久化之前捕获自己的输入检查令牌，并在持久化返回、
+承载解析、获取输入队列及粘贴/提交前持续使用它。冷启动、精确恢复、显式 cold retry
+和普通启动共用这条保护；不会为了继续输入而采纳后来出现的启动代次。启动状态
+落盘失败时不输入。真实 backend 对象/ID、绑定版本、tmux pane 或启动代次变化仍拒绝，
+保留 `TERMINAL_INPUT_TARGET_CHANGED` / `TMUX_PANE_CHANGED` 等错误。
+
+管理员沿现有入口读取已保存的诊断：
+
+```sh
+td integration diagnostics <TD-session-id>
+```
+
+`launch_diagnostics.steps` 追加可选阶段 `guard_captured / runtime_resolving / runtime_resolved`；
+既有 `queue_wait / queue_acquired / paste_* / submit_*` 保留。拒绝时
+`target_change` 可含 `check_phase / guard_captured_at / checked_at`，以及
+`expected_launch_id / current_launch_id`、backend ID/实例比较、绑定版本比较。
+`check_phase` 包含 `launch_state_commit / guard_capture / launch_persisted / runtime_resolve /
+runtime_resolved / queue_acquired / before_paste / before_submit`。时间是 TD 检查时间，
+不是内核首字节写入时间；不包含正文、argv、环境或凭据。旧记录不补造缺失的证据。
+
+这次修复不增加自动重试：原 create 同键只回读原操作。失败现场保留，先用
+`session get` 核对当前事实；明确授权后才按现有 `session retry-cold` 契约显式操作，
+必须满足无原生 UUID、无 TD 消息历史或待投递、精确原 shell、配置指纹与代次等条件。
+已有原生 UUID 的会话继续精确 restore，不能以 cold retry 替代。消息正文不因升级重发。
+
+升级由现场唯一维护者协调：保留现有 HTTPS/鉴权参数，仅替换并重启 TD 服务；
+核对在跑 tmux/Agent 完整身份没有变化，再回读实际服务版本和以上能力。
+本版不要求重启、重建或重试业务 Agent，不更改 launch profile、sandbox 或业务调度。
+终端动作仍是粘贴一次、50ms 后发送一次回车；TD 仍不保证应用提交、消费或执行完成。
+
+确定性交错回归覆盖延迟改名/元数据回写、清除检查、持久化等待、输入队列等待、
+真实第二次启动、backend 替换及重新绑定；发生真实换代时，旧输入及旧的延迟回车
+仍被拒绝。测试证明 TD 一致性与终端写入边界，不代替私有 Agent 的实机消费验收。
+
+## 1.4.323：归档与恢复本机协作组显示
+
+最低 **CLI / 实际服务均为 1.4.323**，回读
+`admin_local_group_archive=true`、`admin_local_group_archive_min_version=1.4.323`。
+本机管理员可归档/恢复精确本机组；CLI 与服务均检查能力，旧服务返回
+`ADMIN_LOCAL_GROUP_ARCHIVE_UNSUPPORTED`。
+
+```sh
+td integration group get <精确group-id>
+td integration group archive <精确group-id> \
+  --expected-updated-at <当前updatedAt> --idempotency-key case-archive:v1
+td integration groups                         # 默认不列出归档组
+td integration groups --include-archived       # 显式查看
+td integration group unarchive <精确group-id> \
+  --expected-updated-at <当前updatedAt> --idempotency-key case-restore:v1
+```
+
+`group get` 对归档组仍可用，并在归档时返回 `archivedAt`。归档/恢复仅修改
+`archivedAt` 与组的 `updatedAt`，不改 `id`、名称、成员/角色、principal 固定组、
+TD/native session、运行承载、消息/reply、consumer 游标或历史；不关闭、释放、恢复
+会话，不停止业务调度，也不重放消息。Web 侧栏默认隐藏归档组，在“已归档协作组”
+中可查看并恢复显示；恢复组显示不会重启已关闭的 session。
+
+管理路由为 `POST /admin/groups/:id/archive` 与 `POST /admin/groups/:id/unarchive`，
+请求仅接受 `{expected_updated_at,idempotency_key}`。`GET /admin/groups` 默认隐藏归档
+组，传 `?include_archived=true` 显示归档组。归档/恢复 key 在同一操作范围内唯一，
+参数改变返回 `IDEMPOTENCY_CONFLICT`。成功回执分开返回当前 `group`、本次提交的
+`applied` 和 `replayed`；旧回执重放不会覆盖后来版本。并发版本过期返回
+`GROUP_CHANGED` 与 `currentUpdatedAt`，应先重新 get，再由调用者决定是否用新 key
+重试。同状态操作保留原 `archivedAt` 并记录幂等回执，不推进组版本。
+
+归档 journal 与组状态原子持久化，保留上限为 2000 条。状态/journal 不完整时返回
+`GROUP_ARCHIVE_STATE_UNCONFIRMED`，不会猜测或重建。只允许本机非 federated、未删除
+组；删除组、跨服务组和不确定的目标分别返回 `GROUP_NOT_FOUND`、`GROUP_NOT_LOCAL`、
+`GROUP_ARCHIVE_TARGET_UNAVAILABLE`。归档不延长消息历史保留期。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.321",
+  "version": "1.4.324",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",
@@ -43,7 +43,10 @@
     "test": "vitest --passWithNoTests",
     "test:ui": "vitest --ui",
     "prepublishOnly": "npm run build",
-    "postinstall": "node scripts/postinstall.mjs"
+    "postinstall": "node scripts/postinstall.mjs",
+    "preview:desktop:dev": "npm --prefix desktop-rust run dev",
+    "preview:desktop:build": "npm --prefix desktop-rust run build",
+    "preview:desktop:test": "npm --prefix desktop-rust run verify"
   },
   "dependencies": {
     "@chainsafe/libp2p-noise": "17.0.0",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.321",
+  "version": "1.4.324",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-oaGYi/P5ob8sd6VnNBOwshKozjhdV+hYiCmLAsn5x00=",
-  "serverBundleHash": "sha256-o36V1OU5HWHaYRXX3y2vcIKrppx0O4wtdbCRN90DifI=",
-  "clientBundleHash": "sha256-rMB/XxqqSbnbT1KeX2KqTnR82mLyuW/NFSb1X7Y6BRE=",
+  "serverBundleHash": "sha256-yjPt7bAXNp3KrOLjsqzi7sVLnPj/UD3Qz7jSJwgX9gU=",
+  "clientBundleHash": "sha256-AoWtEiTNIyzQQDP3vrVfbjymEXr6cyRy/8C++LTIBtc=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }