termdock 1.4.383 → 1.4.384

package/dist/server/federation/sessionAccess.js

@@ -0,0 +1,171 @@
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { CollaborationError } from '../agent/collaborationProtocol.js';
+const readActions = ['session.view', 'session.chat-view', 'session.terminal-view', 'session.metadata'];
+const writeActions = [...readActions, 'session.chat-send', 'session.input', 'session.resize'];
+/** Local integrations may lend access to their own sessions without lending their
+ * credential. The encrypted peer must prove the device identity in the ticket. */
+export class SessionAccessStore {
+    file;
+    authorized;
+    now;
+    key;
+    states;
+    used = new Map();
+    constructor(file, authorized, now = Date.now) {
+        this.file = file;
+        this.authorized = authorized;
+        this.now = now;
+        try {
+            const saved = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (saved.version !== 1 || typeof saved.key !== 'string' || !saved.states)
+                throw new Error('Invalid session access store');
+            this.key = Buffer.from(saved.key, 'base64');
+            this.states = saved.states;
+            if (this.key.length !== 32)
+                throw new Error('Invalid session access key');
+            if (saved.used !== undefined && (!Array.isArray(saved.used) || saved.used.some((entry) => !Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== 'string' || !Number.isSafeInteger(entry[1])))) {
+                throw new Error('Invalid consumed session tickets');
+            }
+            this.used = new Map((saved.used ?? []).filter(([, expiry]) => expiry > this.now()));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            this.key = randomBytes(32);
+            this.states = {};
+            this.save(this.states);
+        }
+    }
+    save(states, used = this.used) {
+        fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 });
+        const temp = `${this.file}.${randomUUID()}.tmp`;
+        const fd = fs.openSync(temp, 'wx', 0o600);
+        try {
+            fs.writeFileSync(fd, JSON.stringify({ version: 1, key: this.key.toString('base64'), states, used: [...used] }));
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        fs.renameSync(temp, this.file);
+        const directory = fs.openSync(path.dirname(this.file), 'r');
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+        this.states = states;
+        this.used = used;
+    }
+    /** Non-mutating recovery metadata; never disclose lease identities or keys. */
+    revision(sessionId, principalId) {
+        const state = this.states[sessionId];
+        if (!this.authorized(sessionId, principalId) || state && state.principalId !== principalId) {
+            throw new CollaborationError('SESSION_ACCESS_DENIED', 'SESSION_ACCESS_DENIED', 409);
+        }
+        return { fence: state?.fence || 0, readerFence: state?.readers?.fence || 0, exclusive: state?.exclusive === true };
+    }
+    /** Exclusive ownership also fences ordinary session-scoped invitations. The
+     * federation runtime preserves separately authenticated full-service admins. */
+    restrictsNativeWriter(sessionId, action) {
+        const state = this.states[sessionId];
+        return state?.exclusive === true && this.authorized(sessionId, state.principalId)
+            && ['session.input', 'session.chat-send', 'session.resize'].includes(action);
+    }
+    update(sessionId, principalId, input) {
+        const old = this.states[sessionId], lease = input?.lease, now = this.now();
+        if (!this.authorized(sessionId, principalId) || !Number.isSafeInteger(input?.fence) || input.fence < 1
+            || input.exclusive !== undefined && typeof input.exclusive !== 'boolean'
+            || old && (old.principalId !== principalId || input.fence < old.fence))
+            throw new CollaborationError('SESSION_ACCESS_STALE', 'SESSION_ACCESS_STALE', 409);
+        if (lease !== null && (!lease || !/^[a-zA-Z0-9-]{16,80}$/.test(lease.id) || typeof lease.userId !== 'string' || !lease.userId || lease.userId.length > 256
+            || typeof lease.deviceId !== 'string' || lease.deviceId.length > 160 || !/^[a-zA-Z0-9]*$/.test(lease.deviceId)
+            || !Number.isSafeInteger(lease.expiresAt) || lease.expiresAt <= now || lease.expiresAt > now + 125000))
+            throw new CollaborationError('SESSION_ACCESS_INVALID_LEASE', 'SESSION_ACCESS_INVALID_LEASE', 409);
+        if (old && input.fence === old.fence && (old.lease?.id !== lease?.id || old.lease?.userId !== lease?.userId
+            || old.lease?.deviceId && old.lease.deviceId !== lease?.deviceId || old.lease && lease && lease.expiresAt < old.lease.expiresAt
+            || input.exclusive !== undefined && input.exclusive !== (old.exclusive === true)))
+            throw new CollaborationError('SESSION_ACCESS_CONFLICT', 'SESSION_ACCESS_CONFLICT', 409);
+        this.save({ ...this.states, [sessionId]: { ...old, principalId, fence: input.fence, lease,
+                ...(input.exclusive === undefined ? {} : { exclusive: input.exclusive }) } });
+        return { accepted: true, fence: input.fence };
+    }
+    /** Readers have an independent revision: renewing or releasing the writer must
+     * not resize, disconnect or upgrade an observer. The caller owns membership. */
+    updateReaders(sessionId, principalId, input) {
+        const old = this.states[sessionId], now = this.now();
+        if (!this.authorized(sessionId, principalId) || old && old.principalId !== principalId || !Number.isSafeInteger(input?.fence) || input.fence < 1
+            || !Array.isArray(input.leases) || input.leases.length > 32 || old?.readers && input.fence < old.readers.fence)
+            throw new CollaborationError('SESSION_ACCESS_STALE', 'SESSION_ACCESS_STALE', 409);
+        const ids = new Set();
+        for (const lease of input.leases) {
+            if (!lease || !/^[a-zA-Z0-9-]{16,80}$/.test(lease.id) || ids.has(lease.id) || typeof lease.userId !== 'string' || !lease.userId || lease.userId.length > 256
+                || typeof lease.deviceId !== 'string' || !/^[a-zA-Z0-9]{0,160}$/.test(lease.deviceId) || !Number.isSafeInteger(lease.expiresAt) || lease.expiresAt <= now || lease.expiresAt > now + 125000)
+                throw new CollaborationError('SESSION_ACCESS_INVALID_LEASE', 'SESSION_ACCESS_INVALID_LEASE', 409);
+            ids.add(lease.id);
+        }
+        if (old?.readers && input.fence === old.readers.fence && JSON.stringify(old.readers.leases) !== JSON.stringify(input.leases))
+            throw new CollaborationError('SESSION_ACCESS_CONFLICT', 'SESSION_ACCESS_CONFLICT', 409);
+        const generations = Object.fromEntries(input.leases.map(lease => {
+            const previous = old?.readers?.leases.find(reader => reader.id === lease.id);
+            const sameIdentity = previous?.userId === lease.userId && previous?.deviceId === lease.deviceId;
+            return [lease.id, sameIdentity ? old?.readers?.generations[lease.id] ?? input.fence : input.fence];
+        }));
+        this.save({ ...this.states, [sessionId]: { ...old, principalId, fence: old?.fence || 0, lease: old?.lease || null, readers: { fence: input.fence, leases: input.leases, generations } } });
+        return { accepted: true, fence: input.fence };
+    }
+    ticket(sessionId, principalId, deviceId, readerId) {
+        const state = this.states[sessionId];
+        const lease = readerId ? state?.readers?.leases.find(x => x.id === readerId) : state?.lease;
+        if (!lease || state.principalId !== principalId || lease.deviceId !== deviceId || !deviceId || lease.expiresAt <= this.now()
+            || !this.authorized(sessionId, principalId))
+            throw new CollaborationError('SESSION_ACCESS_DENIED', 'SESSION_ACCESS_DENIED', 409);
+        const claims = { aud: 'termdock-session-access', sessionId, principalId, deviceId, leaseId: lease.id,
+            fence: readerId ? state.readers.generations[readerId] : state.fence, ...(readerId ? { readOnly: true } : {}), exp: Math.min(lease.expiresAt, this.now() + 30000), jti: randomUUID() };
+        const body = Buffer.from(JSON.stringify(claims)).toString('base64url');
+        return `session.${body}.${createHmac('sha256', this.key).update(body).digest('base64url')}`;
+    }
+    consume(ticket, subjectId) {
+        if (typeof ticket !== 'string' || ticket.length > 4096)
+            throw new CollaborationError('SESSION_ACCESS_INVALID_TICKET', 'SESSION_ACCESS_INVALID_TICKET', 409);
+        const [prefix, body, signature, extra] = ticket.split('.');
+        if (prefix !== 'session' || !body || !signature || extra)
+            throw new CollaborationError('SESSION_ACCESS_INVALID_TICKET', 'SESSION_ACCESS_INVALID_TICKET', 409);
+        const expected = createHmac('sha256', this.key).update(body).digest(), supplied = Buffer.from(signature, 'base64url');
+        if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected))
+            throw new CollaborationError('SESSION_ACCESS_INVALID_TICKET', 'SESSION_ACCESS_INVALID_TICKET', 409);
+        const claims = JSON.parse(Buffer.from(body, 'base64url').toString());
+        const used = new Map([...this.used].filter(([, expiry]) => expiry > this.now()));
+        if (claims.aud !== 'termdock-session-access' || !Number.isSafeInteger(claims.exp) || claims.exp <= this.now() || claims.exp > this.now() + 35000
+            || typeof claims.jti !== 'string' || !claims.jti || used.has(claims.jti) || used.size > 4096 || !this.valid(claims, subjectId))
+            throw new CollaborationError('SESSION_ACCESS_DENIED', 'SESSION_ACCESS_DENIED', 409);
+        used.set(claims.jti, claims.exp);
+        // Admission is successful only after the single-use decision is durable.
+        try {
+            this.save(this.states, used);
+        }
+        catch (error) {
+            // A rename may already have committed before a directory fsync fails.
+            // Never retry the same admission in this process after an uncertain write.
+            this.used = used;
+            throw error;
+        }
+        return claims;
+    }
+    valid(claims, subjectId) {
+        const state = this.states[claims.sessionId];
+        const lease = claims.readOnly === true ? state?.readers?.leases.find(x => x.id === claims.leaseId) : state?.lease;
+        return !!lease && claims.deviceId === subjectId && lease.deviceId === subjectId && lease.id === claims.leaseId
+            && (claims.readOnly === true ? state.readers.generations[claims.leaseId] === claims.fence : state.fence === claims.fence) && state.principalId === claims.principalId && lease.expiresAt > this.now() && this.authorized(claims.sessionId, claims.principalId);
+    }
+    allows(claims, subjectId, action, sessionId) {
+        return this.valid(claims, subjectId) && sessionId === claims.sessionId && (claims.readOnly === true ? readActions : writeActions).includes(action);
+    }
+    grant(claims, subjectId) {
+        return this.valid(claims, subjectId) ? [{ id: claims.leaseId, subjectId, scope: { kind: 'sessions', sessionIds: [claims.sessionId] },
+                actions: claims.readOnly === true ? readActions : writeActions, expiresAt: (claims.readOnly === true ? this.states[claims.sessionId].readers.leases.find(x => x.id === claims.leaseId) : this.states[claims.sessionId].lease).expiresAt }] : [];
+    }
+}

package/dist/server/todos/store.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import { canClaimTodo } from './claimEligibility.js';
-import path from 'node:path';
+import { JsonStorageBudget } from '../utils/jsonStorageBudget.js';
 import { randomUUID, randomBytes, createHash } from 'node:crypto';
 import { nextAutomationRunAt, normalizeAutomationSchedule } from '../agent/automationStore.js';
 export class TodoError extends Error {
@@ -45,10 +45,10 @@ export function collectionSessionPolicy(input) {
 }
 const blank = () => ({ version: 1, todos: [], collectors: [], runs: [], requests: {}, defaults: { agentSlug: '', command: '', cwd: '', prompt: '' } });
 export class TodoStore {
-    file;
     doc = blank();
-    constructor(file) {
-        this.file = file;
+    storage;
+    constructor(file, options = {}) {
+        this.storage = new JsonStorageBudget(file, 'todos', 'TERMDOCK_TODO_STORAGE_MAX_BYTES', 32 * 1024 * 1024, () => new TodoError('待办新增内容已达容量上限；可完成或释放已有工作，或调整 TERMDOCK_TODO_STORAGE_MAX_BYTES', 409), options);
         try {
             const doc = JSON.parse(fs.readFileSync(file, 'utf8'));
             if (doc.version !== 1 || !Array.isArray(doc.todos) || !Array.isArray(doc.collectors) || !Array.isArray(doc.runs) || !doc.requests || !doc.defaults)
@@ -63,36 +63,18 @@ export class TodoStore {
                             run.error = '服务重启中断了启动确认，请检查已有终端后重新发起';
                             run.updatedAt = Date.now();
                         }
-                });
+                }, true);
         }
         catch (error) {
             if (error.code !== 'ENOENT')
                 throw error;
         }
     }
-    transaction(change) {
+    storageStatus() { return this.storage.status(); }
+    transaction(change, control = false) {
         const next = structuredClone(this.doc), result = change(next);
         const bytes = JSON.stringify(next);
-        if (Buffer.byteLength(bytes) > 32 * 1024 * 1024)
-            throw new TodoError('待办记录已达容量上限，请整理后重试', 409);
-        fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 });
-        const temporary = `${this.file}.${process.pid}.tmp`;
-        const fd = fs.openSync(temporary, 'w', 0o600);
-        try {
-            fs.writeFileSync(fd, bytes);
-            fs.fsyncSync(fd);
-        }
-        finally {
-            fs.closeSync(fd);
-        }
-        fs.renameSync(temporary, this.file);
-        const directory = fs.openSync(path.dirname(this.file), 'r');
-        try {
-            fs.fsyncSync(directory);
-        }
-        finally {
-            fs.closeSync(directory);
-        }
+        this.storage.write(bytes, control);
         this.doc = next;
         return structuredClone(result);
     }
@@ -174,7 +156,7 @@ export class TodoStore {
             todo.revision++;
             todo.updatedAt = Date.now();
             return todo;
-        });
+        }, input.title === undefined && input.description === undefined && (input.status === 'completed' || input.status === 'ignored'));
     }
     defaults(input) { const config = launchConfig(input, this.doc.defaults); return this.transaction(doc => doc.defaults = config); }
     saveCollector(input) {
@@ -297,6 +279,8 @@ export class TodoStore {
         return this.hash({ todoIds: input.todoIds, note: input.note, sessionId: input.sessionId ?? null, config: input.sessionId ? null : input.config });
     }
     mark(id, update) {
+        if (update.error)
+            update = { ...update, error: update.error.slice(0, 4000) };
         return this.transaction(doc => {
             const run = doc.runs.find(r => r.id === id);
             if (!run)
@@ -312,18 +296,18 @@ export class TodoStore {
             }
             run.updatedAt = Date.now();
             return run;
-        });
+        }, true);
     }
     automaticFailed(id, error) {
         this.transaction(doc => {
             const todo = doc.todos.find(t => t.id === id);
             if (todo?.status === 'open' && todo.autoProcessing?.state === 'pending') {
                 todo.autoProcessing.state = 'failed';
-                todo.autoProcessing.error = error;
+                todo.autoProcessing.error = error.slice(0, 4000);
                 todo.updatedAt = Date.now();
                 todo.revision++;
             }
-        });
+        }, true);
     }
     claim(input) {
         if (![input.source, input.collectorId, input.todoId].some(value => typeof value === 'string' && value.trim()))
@@ -385,7 +369,7 @@ export class TodoStore {
             todo.revision++;
             todo.updatedAt = Date.now();
             return todo;
-        });
+        }, true);
     }
     renewClaim(id, token, minutes) {
         if (!Number.isInteger(minutes) || minutes < 1 || minutes > 1440)
@@ -400,7 +384,7 @@ export class TodoStore {
             todo.revision++;
             todo.updatedAt = Date.now();
             return todo;
-        });
+        }, true);
     }
     bindCollectionSession(sessionId, runtimeIdentity) {
         this.transaction(doc => {
@@ -408,7 +392,7 @@ export class TodoStore {
                 if (run.kind === 'collect' && run.sessionId === sessionId && run.collectionSession?.owned !== false && !run.collectionSession?.recycledAt) {
                     run.collectionSession = { ...collectionSessionPolicy(run.collectionSession), ...run.collectionSession, owned: true, runtimeIdentity };
                 }
-        });
+        }, true);
     }
     recycled(sessionId) {
         this.transaction(doc => {
@@ -416,7 +400,7 @@ export class TodoStore {
                 if (run.kind === 'collect' && run.sessionId === sessionId && run.collectionSession?.owned !== false) {
                     run.collectionSession = { ...collectionSessionPolicy(run.collectionSession), owned: true, recycledAt: Date.now() };
                 }
-        });
+        }, true);
     }
     report(id, status, content) {
         if (!['complete', 'blocked', 'failed'].includes(status))
@@ -434,7 +418,7 @@ export class TodoStore {
             run.result = result;
             run.updatedAt = Date.now();
             return run;
-        });
+        }, true);
     }
     hash(value) { return createHash('sha256').update(JSON.stringify(value)).digest('hex'); }
 }

package/dist/server/utils/jsonStorageBudget.js

@@ -0,0 +1,105 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { atomicIntegrationWrite } from '../agent/integrationJournal.js';
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+/** Admission limits protect against new work, not against recording the outcome
+ * of work already admitted. Domain stores explicitly mark bounded control writes;
+ * ordinary content edits/new requests still need capacity. No history is erased. */
+export class JsonStorageBudget {
+    file;
+    label;
+    full;
+    bytes = 0;
+    fingerprint;
+    warning = '';
+    uncertain = false;
+    maxBytes;
+    warnPercent;
+    constructor(file, label, setting, fallback, full, options = {}) {
+        this.file = file;
+        this.label = label;
+        this.full = full;
+        this.maxBytes = options.maxBytes ?? Number(process.env[setting] ?? fallback);
+        this.warnPercent = options.warnPercent ?? Number(process.env.TERMDOCK_STORAGE_WARN_PERCENT ?? 80);
+        if (!Number.isSafeInteger(this.maxBytes) || this.maxBytes < 1 || !Number.isSafeInteger(this.warnPercent) || this.warnPercent < 1 || this.warnPercent > 100)
+            throw new Error(`Invalid storage configuration: ${setting} / TERMDOCK_STORAGE_WARN_PERCENT`);
+        try {
+            const raw = fs.readFileSync(file);
+            this.bytes = raw.length;
+            this.fingerprint = digest(raw);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        this.report();
+    }
+    status() {
+        return { store: this.label, bytes: this.bytes, max_bytes: this.maxBytes, warning_percent: this.warnPercent,
+            state: this.bytes >= this.maxBytes ? 'full' : this.bytes >= this.maxBytes * this.warnPercent / 100 ? 'warning' : 'ok',
+            control_writes_use_admission_budget: false, commit_unconfirmed: this.uncertain };
+    }
+    report() {
+        const state = this.status().state;
+        if (state !== 'ok' && state !== this.warning)
+            console.warn('[storage-capacity]', JSON.stringify(this.status()));
+        this.warning = state;
+    }
+    admit(serialized, control = false) {
+        if (this.uncertain)
+            throw new Error(`${this.label}: storage commit unconfirmed; reopen before writing`);
+        const bytes = Buffer.byteLength(serialized);
+        // Shrinking an already oversized legacy document must remain possible.
+        if (!control && bytes > this.maxBytes && bytes > this.bytes) {
+            if (this.warning !== 'rejected')
+                console.warn('[storage-capacity]', JSON.stringify({ ...this.status(), rejected_bytes: bytes }));
+            this.warning = 'rejected';
+            throw this.full();
+        }
+    }
+    committed(serialized) { this.bytes = Buffer.byteLength(serialized); this.fingerprint = digest(serialized); this.report(); }
+    failed() {
+        try {
+            this.uncertain = digest(fs.readFileSync(this.file)) !== this.fingerprint;
+        }
+        catch (readError) {
+            this.uncertain = readError.code !== 'ENOENT' || this.fingerprint !== undefined;
+        }
+    }
+    /** Confirm the exact already-written document without overwriting an
+     * uncertain commit or another writer's state. Used by durable receipt replay. */
+    reconfirm(serialized) {
+        const expected = Buffer.from(serialized), descriptor = fs.openSync(this.file, 'r');
+        try {
+            if (!fs.readFileSync(descriptor).equals(expected))
+                throw new Error(`${this.label}: persisted state changed; reopen before confirming`);
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        const directory = fs.openSync(path.dirname(this.file), 'r');
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+        if (!fs.readFileSync(this.file).equals(expected))
+            throw new Error(`${this.label}: persisted state changed; reopen before confirming`);
+        this.committed(serialized);
+        this.uncertain = false;
+    }
+    write(serialized, control = false) {
+        this.admit(serialized, control);
+        try {
+            atomicIntegrationWrite(this.file, fd => fs.writeFileSync(fd, serialized));
+        }
+        catch (error) {
+            this.failed();
+            throw error;
+        }
+        this.committed(serialized);
+    }
+}

package/dist/server/utils/termdockState.js

@@ -28,6 +28,11 @@ export function isProcessRunning(pid) {
         return false;
     }
 }
+export function readLocalApiCa(state, fallbackPath) {
+    if (state?.httpsCaPath)
+        return fs.readFileSync(state.httpsCaPath);
+    return fs.existsSync(fallbackPath) ? fs.readFileSync(fallbackPath) : undefined;
+}
 export function readJsonFile(filePath) {
     try {
         return JSON.parse(fs.readFileSync(filePath, 'utf8'));