theus-cli-linux-arm64 0.2.84

package/vendor/theus-arsenal/scripts/lib/plan-canvas/server.js

@@ -0,0 +1,534 @@
+'use strict';
+
+/**
+ * Servidor de loopback del Lienzo de planes.
+ *
+ * Un solo proceso desacoplado sirve todas las sesiones de revisión abiertas:
+ * el marco del navegador, el artefacto renderizado, un stream SSE para
+ * actualizaciones en vivo y el endpoint de long-poll en el que se bloquean
+ * los agentes. Las sesiones se indexan por la ruta canónica del artefacto
+ * (ver sessions.js).
+ */
+
+const { EventEmitter } = require('events');
+const fs = require('fs');
+const http = require('http');
+const path = require('path');
+
+const { buildAllowedHostnames, isAllowedHostHeader, isAllowedOrigin } = require('../loopback-guard');
+const { renderMarkdown } = require('./markdown');
+const { artifactSdkJs } = require('./sdk');
+const {
+  canvasCss,
+  canvasClientJs,
+  renderCanvasHtml,
+  renderMarkdownArtifactHtml,
+  renderSessionListHtml
+} = require('./ui');
+
+const DEFAULT_PORT = 4517;
+const DEFAULT_HOST = '127.0.0.1';
+const DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
+const MAX_BODY_BYTES = 1024 * 1024;
+
+const CONTENT_TYPES = {
+  '.css': 'text/css; charset=utf-8',
+  '.gif': 'image/gif',
+  '.html': 'text/html; charset=utf-8',
+  '.ico': 'image/x-icon',
+  '.jpeg': 'image/jpeg',
+  '.jpg': 'image/jpeg',
+  '.js': 'text/javascript; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.md': 'text/plain; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.png': 'image/png',
+  '.svg': 'image/svg+xml',
+  '.ttf': 'font/ttf',
+  '.txt': 'text/plain; charset=utf-8',
+  '.webp': 'image/webp',
+  '.woff': 'font/woff',
+  '.woff2': 'font/woff2'
+};
+
+function resolvePort(env = process.env) {
+  const value = Number.parseInt(env.THEUS_PLAN_CANVAS_PORT || '', 10);
+  return Number.isInteger(value) && value >= 0 && value <= 65535 ? value : DEFAULT_PORT;
+}
+
+function resolveIdleTimeoutMs(env = process.env) {
+  const raw = String(env.THEUS_PLAN_CANVAS_IDLE_MS || '').trim().toLowerCase();
+  if (raw === '0' || raw === 'off') return 0;
+  const value = Number.parseInt(raw, 10);
+  return Number.isInteger(value) && value > 0 ? value : DEFAULT_IDLE_TIMEOUT_MS;
+}
+
+function readJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    req.on('data', chunk => {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        reject(new Error('cuerpo demasiado grande'));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on('end', () => {
+      if (chunks.length === 0) return resolve({});
+      try {
+        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+      } catch {
+        reject(new Error('cuerpo JSON inválido'));
+      }
+    });
+    req.on('error', reject);
+  });
+}
+
+function sendJson(res, statusCode, payload) {
+  const body = JSON.stringify(payload);
+  res.writeHead(statusCode, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+  res.end(body);
+}
+
+function sendHtml(res, statusCode, html, { csp = true } = {}) {
+  const headers = { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' };
+  if (csp) {
+    headers['content-security-policy'] =
+      "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'self'";
+  }
+  res.writeHead(statusCode, headers);
+  res.end(html);
+}
+
+function createPlanCanvasServer({
+  store,
+  host = DEFAULT_HOST,
+  version = '0.0.0',
+  idleTimeoutMs = DEFAULT_IDLE_TIMEOUT_MS,
+  heartbeatMs = 15000,
+  onIdleShutdown = null,
+  log = () => {}
+} = {}) {
+  if (!store) throw new Error('createPlanCanvasServer requiere un almacén de sesiones');
+
+  const allowedHostnames = buildAllowedHostnames(host);
+  const wake = new EventEmitter();
+  wake.setMaxListeners(0);
+  const sseClients = new Map(); // key -> Set<res>
+  const awaitCounts = new Map(); // key -> nº de long-polls activos
+  const workingKeys = new Set(); // keys cuyo agente tomó feedback y está trabajando
+  const watchers = new Map(); // key -> fs.FSWatcher
+  let idleTimer = null;
+  let closed = false;
+
+  // --- presencia + SSE ----------------------------------------------------
+
+  function presenceFor(key) {
+    const session = store.get(key);
+    if (!session || session.status === 'ended') return 'ended';
+    if ((awaitCounts.get(key) || 0) > 0) return 'listening';
+    return workingKeys.has(key) ? 'working' : 'waiting';
+  }
+
+  function broadcast(key, event, payload) {
+    const clients = sseClients.get(key);
+    if (!clients) return;
+    const frameText = `event: ${event}\ndata: ${JSON.stringify(payload)}\n\n`;
+    for (const client of clients) client.write(frameText);
+  }
+
+  function broadcastPresence(key) {
+    broadcast(key, 'presence', { state: presenceFor(key) });
+  }
+
+  function connectionCount() {
+    let total = 0;
+    for (const clients of sseClients.values()) total += clients.size;
+    for (const count of awaitCounts.values()) total += count;
+    return total;
+  }
+
+  function armIdleTimer() {
+    if (!idleTimeoutMs || closed) return;
+    if (connectionCount() > 0) return;
+    clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => {
+      if (connectionCount() === 0 && !closed) {
+        log('[plan-canvas] tiempo de inactividad alcanzado, apagando');
+        if (onIdleShutdown) onIdleShutdown();
+      }
+    }, idleTimeoutMs);
+    if (idleTimer.unref) idleTimer.unref();
+  }
+
+  function noteConnectionOpened() {
+    clearTimeout(idleTimer);
+  }
+
+  function noteConnectionClosed() {
+    armIdleTimer();
+  }
+
+  // --- vigilancia del artefacto ---------------------------------------------
+
+  function watchSession(session) {
+    if (watchers.has(session.key)) return;
+    const dir = path.dirname(session.file);
+    const base = path.basename(session.file);
+    let debounce = null;
+    try {
+      const watcher = fs.watch(dir, (eventType, filename) => {
+        if (filename && filename !== base) return;
+        clearTimeout(debounce);
+        debounce = setTimeout(() => broadcast(session.key, 'reload', {}), 150);
+      });
+      watcher.on('error', () => watchers.delete(session.key));
+      watchers.set(session.key, watcher);
+    } catch {
+      // La vigilancia es best-effort; la recarga manual sigue funcionando.
+    }
+  }
+
+  function unwatchSession(key) {
+    const watcher = watchers.get(key);
+    if (watcher) {
+      watcher.close();
+      watchers.delete(key);
+    }
+  }
+
+  // --- acciones de sesión ------------------------------------------------------
+
+  function endSession(key, endedBy) {
+    const session = store.end(key, endedBy);
+    if (!session) return null;
+    wake.emit(`wake:${key}`);
+    broadcast(key, 'ended', { endedBy: session.endedBy });
+    broadcastPresence(key);
+    unwatchSession(key);
+    return session;
+  }
+
+  // --- manejadores de peticiones ------------------------------------------------
+
+  async function handleApi(req, res, url) {
+    const { pathname } = url;
+
+    if (req.method === 'POST' && pathname === '/api/sessions') {
+      const body = await readJsonBody(req);
+      if (!body.file || typeof body.file !== 'string') {
+        return sendJson(res, 400, { error: 'falta el campo file' });
+      }
+      if (!fs.existsSync(path.resolve(body.file))) {
+        return sendJson(res, 404, { error: `artefacto no encontrado: ${body.file}` });
+      }
+      const { session, refused } = store.open(body.file, { reopen: Boolean(body.reopen) });
+      if (refused) {
+        return sendJson(res, 409, {
+          status: 'user-ended',
+          key: session.key,
+          next_step: 'El usuario terminó esta revisión desde el navegador. No la reabras salvo que lo pida; pasa reopen:true cuando lo haga.'
+        });
+      }
+      watchSession(session);
+      broadcastPresence(session.key);
+      return sendJson(res, 200, {
+        status: 'open',
+        key: session.key,
+        file: session.file,
+        url: `/canvas/${session.key}`
+      });
+    }
+
+    if (req.method === 'GET' && pathname === '/api/sessions') {
+      return sendJson(res, 200, { sessions: store.list() });
+    }
+
+    if (req.method === 'GET' && pathname === '/api/await') {
+      const file = url.searchParams.get('file');
+      if (!file) return sendJson(res, 400, { error: 'falta el parámetro file' });
+      const session = store.findByFile(file);
+      if (!session) return sendJson(res, 200, { status: 'missing' });
+      const key = session.key;
+      const timeoutRaw = url.searchParams.get('timeoutMs');
+      const timeoutMs = timeoutRaw === null ? null : Math.max(0, Number.parseInt(timeoutRaw, 10) || 0);
+
+      const first = store.takeFeedback(key);
+      if (first.status !== 'waiting') {
+        if (first.status === 'feedback') workingKeys.add(key);
+        broadcastPresence(key);
+        return sendJson(res, 200, first);
+      }
+
+      // Long poll: mantiene la petición abierta hasta que haya feedback o la
+      // sesión termine.
+      noteConnectionOpened();
+      awaitCounts.set(key, (awaitCounts.get(key) || 0) + 1);
+      workingKeys.delete(key);
+      broadcastPresence(key);
+
+      let settled = false;
+      let heartbeat = null;
+      let waitTimer = null;
+      const finish = payload => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        if (payload) {
+          if (payload.status === 'feedback') workingKeys.add(key);
+          res.end(JSON.stringify(payload));
+        }
+        broadcastPresence(key);
+        noteConnectionClosed();
+      };
+      const onWake = () => {
+        const result = store.takeFeedback(key);
+        if (result.status !== 'waiting') finish(result);
+      };
+      // Resuelve los polls retenidos al apagar para que server.close() pueda
+      // completar; el CLI indica a los agentes que simplemente relancen await.
+      const onServerClose = () =>
+        finish({ status: 'waiting', note: 'el servidor del lienzo se está apagando; vuelve a ejecutar await' });
+      const cleanup = () => {
+        wake.removeListener(`wake:${key}`, onWake);
+        wake.removeListener('server-close', onServerClose);
+        clearInterval(heartbeat);
+        clearTimeout(waitTimer);
+        awaitCounts.set(key, Math.max(0, (awaitCounts.get(key) || 1) - 1));
+      };
+
+      res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+      // El espacio en blanco inicial mantiene la conexión visiblemente viva
+      // sin corromper el JSON escrito al final.
+      res.write(' ');
+      heartbeat = setInterval(() => {
+        if (!settled) res.write(' ');
+      }, heartbeatMs);
+      if (timeoutMs !== null) {
+        waitTimer = setTimeout(() => finish({ status: 'waiting' }), timeoutMs);
+      }
+      wake.on(`wake:${key}`, onWake);
+      wake.once('server-close', onServerClose);
+      req.on('close', () => finish(null));
+      return undefined;
+    }
+
+    if (req.method === 'POST' && pathname === '/api/end') {
+      const body = await readJsonBody(req);
+      if (!body.file || typeof body.file !== 'string') {
+        return sendJson(res, 400, { error: 'falta el campo file' });
+      }
+      const session = store.findByFile(body.file);
+      if (!session) return sendJson(res, 404, { error: 'no hay sesión para ese archivo' });
+      endSession(session.key, 'agent');
+      return sendJson(res, 200, { status: 'ended', endedBy: 'agent' });
+    }
+
+    const sessionMatch = pathname.match(/^\/api\/session\/([a-f0-9]{12})\/(feedback|end|reply)$/);
+    if (sessionMatch && req.method === 'POST') {
+      const [, key, action] = sessionMatch;
+      const session = store.get(key);
+      if (!session) return sendJson(res, 404, { error: 'sesión desconocida' });
+
+      if (action === 'feedback') {
+        const body = await readJsonBody(req);
+        const result = store.queueFeedback(key, body.items, { endSession: Boolean(body.endSession) });
+        if (!result) return sendJson(res, 409, { error: 'la sesión ya terminó' });
+        wake.emit(`wake:${key}`);
+        broadcast(key, 'chat-sync', { chat: store.get(key).chat });
+        if (body.endSession) broadcast(key, 'ended', { endedBy: 'user' });
+        return sendJson(res, 200, { status: 'queued', accepted: result.accepted.length, pending: result.pending });
+      }
+
+      if (action === 'end') {
+        endSession(key, 'user');
+        return sendJson(res, 200, { status: 'ended', endedBy: 'user' });
+      }
+
+      if (action === 'reply') {
+        const body = await readJsonBody(req);
+        if (!body.text || typeof body.text !== 'string') {
+          return sendJson(res, 400, { error: 'falta el campo text' });
+        }
+        const entry = store.addAgentReply(key, body.text);
+        broadcast(key, 'chat-sync', { chat: store.get(key).chat });
+        return sendJson(res, 200, { status: 'sent', at: entry.at });
+      }
+    }
+
+    return sendJson(res, 404, { error: 'no encontrado' });
+  }
+
+  function handleEvents(req, res, key) {
+    const session = store.get(key);
+    if (!session) return sendJson(res, 404, { error: 'sesión desconocida' });
+    noteConnectionOpened();
+    res.writeHead(200, {
+      'content-type': 'text/event-stream',
+      'cache-control': 'no-store',
+      connection: 'keep-alive'
+    });
+    res.write(`event: chat-sync\ndata: ${JSON.stringify({ chat: session.chat })}\n\n`);
+    res.write(`event: presence\ndata: ${JSON.stringify({ state: presenceFor(key) })}\n\n`);
+    if (!sseClients.has(key)) sseClients.set(key, new Set());
+    sseClients.get(key).add(res);
+    const ping = setInterval(() => res.write(': ping\n\n'), 25000);
+    if (ping.unref) ping.unref();
+    req.on('close', () => {
+      clearInterval(ping);
+      const clients = sseClients.get(key);
+      if (clients) {
+        clients.delete(res);
+        if (clients.size === 0) sseClients.delete(key);
+      }
+      noteConnectionClosed();
+    });
+  }
+
+  function serveArtifact(res, key, assetPath) {
+    const session = store.get(key);
+    if (!session) return sendHtml(res, 404, '<h1>Sesión desconocida</h1>');
+
+    if (!assetPath) {
+      let content;
+      try {
+        content = fs.readFileSync(session.file, 'utf8');
+      } catch {
+        return sendHtml(res, 404, `<h1>Artefacto ausente</h1><p>${session.file} ya no existe.</p>`, { csp: false });
+      }
+      const ext = path.extname(session.file).toLowerCase();
+      if (ext === '.md' || ext === '.markdown') {
+        const html = renderMarkdownArtifactHtml(renderMarkdown(content), {
+          title: path.basename(session.file),
+          sdkSrc: '/sdk.js'
+        });
+        return sendHtml(res, 200, html, { csp: false });
+      }
+      const sdkTag = '<script src="/sdk.js"></script>';
+      const injected = content.includes('</body>')
+        ? content.replace('</body>', `${sdkTag}\n</body>`)
+        : `${content}\n${sdkTag}`;
+      return sendHtml(res, 200, injected, { csp: false });
+    }
+
+    // Los recursos hermanos se resuelven relativos al directorio del
+    // artefacto y deben quedar confinados a él.
+    const baseDir = path.dirname(session.file);
+    const resolved = path.resolve(baseDir, assetPath);
+    if (resolved !== baseDir && !resolved.startsWith(baseDir + path.sep)) {
+      return sendJson(res, 403, { error: 'la ruta del recurso escapa del directorio del artefacto' });
+    }
+    let data;
+    try {
+      data = fs.readFileSync(resolved);
+    } catch {
+      return sendJson(res, 404, { error: 'recurso no encontrado' });
+    }
+    const type = CONTENT_TYPES[path.extname(resolved).toLowerCase()] || 'application/octet-stream';
+    res.writeHead(200, { 'content-type': type, 'cache-control': 'no-store' });
+    return res.end(data);
+  }
+
+  const server = http.createServer((req, res) => {
+    if (!isAllowedHostHeader(req.headers.host, allowedHostnames)) {
+      return sendJson(res, 403, { error: 'cabecera Host no permitida' });
+    }
+    if (!isAllowedOrigin(req.headers.origin, allowedHostnames)) {
+      return sendJson(res, 403, { error: 'origen no permitido' });
+    }
+    const url = new URL(req.url, `http://${req.headers.host}`);
+    const { pathname } = url;
+
+    Promise.resolve()
+      .then(() => {
+        if (req.method === 'GET' && pathname === '/health') {
+          return sendJson(res, 200, { ok: true, app: 'theus-plan-canvas', version });
+        }
+        if (req.method === 'POST' && pathname === '/shutdown') {
+          sendJson(res, 200, { status: 'stopping' });
+          setImmediate(() => {
+            if (onIdleShutdown) onIdleShutdown();
+          });
+          return undefined;
+        }
+        if (req.method === 'GET' && pathname === '/') {
+          return sendHtml(res, 200, renderSessionListHtml(store.list()));
+        }
+        if (req.method === 'GET' && pathname === '/canvas.css') {
+          res.writeHead(200, { 'content-type': 'text/css; charset=utf-8', 'cache-control': 'no-store' });
+          return res.end(canvasCss());
+        }
+        if (req.method === 'GET' && pathname === '/client.js') {
+          res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' });
+          return res.end(canvasClientJs());
+        }
+        if (req.method === 'GET' && pathname === '/sdk.js') {
+          res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' });
+          return res.end(artifactSdkJs());
+        }
+        const canvasMatch = pathname.match(/^\/canvas\/([a-f0-9]{12})$/);
+        if (req.method === 'GET' && canvasMatch) {
+          const session = store.get(canvasMatch[1]);
+          if (!session) return sendHtml(res, 404, '<h1>Sesión desconocida</h1>');
+          return sendHtml(res, 200, renderCanvasHtml(session));
+        }
+        const eventsMatch = pathname.match(/^\/events\/([a-f0-9]{12})$/);
+        if (req.method === 'GET' && eventsMatch) {
+          return handleEvents(req, res, eventsMatch[1]);
+        }
+        const artifactMatch = pathname.match(/^\/artifact\/([a-f0-9]{12})\/(.*)$/);
+        if (req.method === 'GET' && artifactMatch) {
+          const assetPath = decodeURIComponent(artifactMatch[2]);
+          return serveArtifact(res, artifactMatch[1], assetPath || null);
+        }
+        if (pathname.startsWith('/api/')) {
+          return handleApi(req, res, url);
+        }
+        return sendJson(res, 404, { error: 'no encontrado' });
+      })
+      .catch(error => {
+        if (!res.headersSent) sendJson(res, 400, { error: error.message });
+        else res.end();
+      });
+  });
+
+  function close() {
+    closed = true;
+    clearTimeout(idleTimer);
+    for (const key of watchers.keys()) unwatchSession(key);
+    for (const clients of sseClients.values()) {
+      for (const client of clients) client.end();
+    }
+    sseClients.clear();
+    wake.emit('server-close');
+    return new Promise((resolve, reject) => {
+      server.close(error => (error ? reject(error) : resolve()));
+      // Los sockets keep-alive del navegador mantendrían close() abierto.
+      if (typeof server.closeIdleConnections === 'function') server.closeIdleConnections();
+    });
+  }
+
+  function listen(port = resolvePort()) {
+    return new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(port, host, () => {
+        armIdleTimer();
+        resolve({ port: server.address().port, host });
+      });
+    });
+  }
+
+  return { server, listen, close, presenceFor, watchSession };
+}
+
+module.exports = {
+  DEFAULT_HOST,
+  DEFAULT_PORT,
+  createPlanCanvasServer,
+  resolveIdleTimeoutMs,
+  resolvePort
+};