wind-agent-cli 1.37.2 → 1.38.0

package/server/modules/websocket/services/websocket-auth.service.ts

@@ -1,59 +1,59 @@
-import type { VerifyClientCallbackSync } from 'ws';
-
-import type { AuthenticatedWebSocketRequest } from '@/shared/types.js';
-
-type WebSocketAuthDependencies = {
-  isPlatform: boolean;
-  authenticateWebSocket: (token: string | null) => {
-    id?: string | number;
-    userId?: string | number;
-    username?: string;
-    [key: string]: unknown;
-  } | null;
-};
-
-/**
- * Authenticates websocket upgrade requests before the `connection` handler runs.
- */
-export function verifyWebSocketClient(
-  info: Parameters<VerifyClientCallbackSync<AuthenticatedWebSocketRequest>>[0],
-  dependencies: WebSocketAuthDependencies
-): boolean {
-  const request = info.req as AuthenticatedWebSocketRequest;
-  const upgradeUrl = new URL(request.url ?? '/', 'http://localhost');
-  const loggedUrl = new URL(upgradeUrl);
-  if (loggedUrl.searchParams.has('token')) {
-    loggedUrl.searchParams.set('token', 'REDACTED');
-  }
-
-  console.log('WebSocket connection attempt to:', `${loggedUrl.pathname}${loggedUrl.search}`);
-
-  // Platform mode: use the first DB user and skip token checks.
-  if (dependencies.isPlatform) {
-    const user = dependencies.authenticateWebSocket(null);
-    if (!user) {
-      console.log('[WARN] Platform mode: No user found in database');
-      return false;
-    }
-
-    request.user = user;
-    console.log('[OK] Platform mode WebSocket authenticated for user:', user.username);
-    return true;
-  }
-
-  // OSS mode: read JWT from query string first, then Authorization header.
-  const token =
-    upgradeUrl.searchParams.get('token') ??
-    request.headers.authorization?.split(' ')[1] ??
-    null;
-
-  const user = dependencies.authenticateWebSocket(token);
-  if (!user) {
-    console.log('[WARN] WebSocket authentication failed');
-    return false;
-  }
-
-  request.user = user;
-  console.log('[OK] WebSocket authenticated for user:', user.username);
-  return true;
-}
+import type { VerifyClientCallbackSync } from 'ws';
+
+import type { AuthenticatedWebSocketRequest } from '@/shared/types.js';
+
+type WebSocketAuthDependencies = {
+  isPlatform: boolean;
+  authenticateWebSocket: (token: string | null) => {
+    id?: string | number;
+    userId?: string | number;
+    username?: string;
+    [key: string]: unknown;
+  } | null;
+};
+
+/**
+ * Authenticates websocket upgrade requests before the `connection` handler runs.
+ */
+export function verifyWebSocketClient(
+  info: Parameters<VerifyClientCallbackSync<AuthenticatedWebSocketRequest>>[0],
+  dependencies: WebSocketAuthDependencies
+): boolean {
+  const request = info.req as AuthenticatedWebSocketRequest;
+  const upgradeUrl = new URL(request.url ?? '/', 'http://localhost');
+  const loggedUrl = new URL(upgradeUrl);
+  if (loggedUrl.searchParams.has('token')) {
+    loggedUrl.searchParams.set('token', 'REDACTED');
+  }
+
+  console.log('WebSocket connection attempt to:', `${loggedUrl.pathname}${loggedUrl.search}`);
+
+  // Platform mode: use the first DB user and skip token checks.
+  if (dependencies.isPlatform) {
+    const user = dependencies.authenticateWebSocket(null);
+    if (!user) {
+      console.log('[WARN] Platform mode: No user found in database');
+      return false;
+    }
+
+    request.user = user;
+    console.log('[OK] Platform mode WebSocket authenticated for user:', user.username);
+    return true;
+  }
+
+  // OSS mode: read JWT from query string first, then Authorization header.
+  const token =
+    upgradeUrl.searchParams.get('token') ??
+    request.headers.authorization?.split(' ')[1] ??
+    null;
+
+  const user = dependencies.authenticateWebSocket(token);
+  if (!user) {
+    console.log('[WARN] WebSocket authentication failed');
+    return false;
+  }
+
+  request.user = user;
+  console.log('[OK] WebSocket authenticated for user:', user.username);
+  return true;
+}

package/server/modules/websocket/services/websocket-server.service.ts

@@ -1,127 +1,127 @@
-import type { Server as HttpServer } from 'node:http';
-
-import { WebSocket, WebSocketServer, type VerifyClientCallbackSync } from 'ws';
-
-import { handleChatConnection } from '@/modules/websocket/services/chat-websocket.service.js';
-import { verifyWebSocketClient } from '@/modules/websocket/services/websocket-auth.service.js';
-import { handlePluginWsProxy } from '@/modules/websocket/services/plugin-websocket-proxy.service.js';
-import { handleShellConnection } from '@/modules/websocket/services/shell-websocket.service.js';
-import { handleDesktopNotificationsConnection } from '@/modules/notifications/index.js';
-import type { AuthenticatedWebSocketRequest } from '@/shared/types.js';
-
-type WebSocketServerDependencies = {
-  verifyClient: Parameters<typeof verifyWebSocketClient>[1];
-  chat: Parameters<typeof handleChatConnection>[2];
-  shell: Parameters<typeof handleShellConnection>[1];
-  getPluginPort: Parameters<typeof handlePluginWsProxy>[2];
-};
-
-/**
- * Used by this module's websocket gateway to keep active transports alive and
- * close half-open connections so their route-specific clients can reconnect.
- */
-export function attachWebSocketHeartbeat(
-  ws: WebSocket,
-  intervalMs = 30_000,
-  scheduler = {
-    setInterval,
-    clearInterval,
-  },
-): () => void {
-  let isAlive = true;
-  let stopped = false;
-
-  const markAlive = () => {
-    isAlive = true;
-  };
-
-  const stopHeartbeat = () => {
-    if (stopped) {
-      return;
-    }
-
-    stopped = true;
-    scheduler.clearInterval(heartbeat);
-    ws.off('pong', markAlive);
-    ws.off('close', stopHeartbeat);
-    ws.off('error', stopHeartbeat);
-  };
-
-  ws.on('pong', markAlive);
-  ws.on('close', stopHeartbeat);
-  ws.on('error', stopHeartbeat);
-
-  const heartbeat = scheduler.setInterval(() => {
-    if (ws.readyState !== WebSocket.OPEN) {
-      return;
-    }
-
-    // A socket that did not answer the previous ping is half-open from the
-    // server's perspective. Terminating it emits close and lets clients resume.
-    if (!isAlive) {
-      stopHeartbeat();
-      ws.terminate();
-      return;
-    }
-
-    isAlive = false;
-    try {
-      ws.ping();
-    } catch {
-      stopHeartbeat();
-      ws.terminate();
-    }
-  }, intervalMs);
-
-  return stopHeartbeat;
-}
-
-/**
- * Creates and wires the server-wide websocket gateway used for chat, shell, and
- * plugin proxy routes. Exported through the websocket module for server startup.
- */
-export function createWebSocketServer(
-  server: HttpServer,
-  dependencies: WebSocketServerDependencies
-): WebSocketServer {
+import type { Server as HttpServer } from 'node:http';
+
+import { WebSocket, WebSocketServer, type VerifyClientCallbackSync } from 'ws';
+
+import { handleChatConnection } from '@/modules/websocket/services/chat-websocket.service.js';
+import { verifyWebSocketClient } from '@/modules/websocket/services/websocket-auth.service.js';
+import { handlePluginWsProxy } from '@/modules/websocket/services/plugin-websocket-proxy.service.js';
+import { handleShellConnection } from '@/modules/websocket/services/shell-websocket.service.js';
+import { handleDesktopNotificationsConnection } from '@/modules/notifications/index.js';
+import type { AuthenticatedWebSocketRequest } from '@/shared/types.js';
+
+type WebSocketServerDependencies = {
+  verifyClient: Parameters<typeof verifyWebSocketClient>[1];
+  chat: Parameters<typeof handleChatConnection>[2];
+  shell: Parameters<typeof handleShellConnection>[1];
+  getPluginPort: Parameters<typeof handlePluginWsProxy>[2];
+};
+
+/**
+ * Used by this module's websocket gateway to keep active transports alive and
+ * close half-open connections so their route-specific clients can reconnect.
+ */
+export function attachWebSocketHeartbeat(
+  ws: WebSocket,
+  intervalMs = 30_000,
+  scheduler = {
+    setInterval,
+    clearInterval,
+  },
+): () => void {
+  let isAlive = true;
+  let stopped = false;
+
+  const markAlive = () => {
+    isAlive = true;
+  };
+
+  const stopHeartbeat = () => {
+    if (stopped) {
+      return;
+    }
+
+    stopped = true;
+    scheduler.clearInterval(heartbeat);
+    ws.off('pong', markAlive);
+    ws.off('close', stopHeartbeat);
+    ws.off('error', stopHeartbeat);
+  };
+
+  ws.on('pong', markAlive);
+  ws.on('close', stopHeartbeat);
+  ws.on('error', stopHeartbeat);
+
+  const heartbeat = scheduler.setInterval(() => {
+    if (ws.readyState !== WebSocket.OPEN) {
+      return;
+    }
+
+    // A socket that did not answer the previous ping is half-open from the
+    // server's perspective. Terminating it emits close and lets clients resume.
+    if (!isAlive) {
+      stopHeartbeat();
+      ws.terminate();
+      return;
+    }
+
+    isAlive = false;
+    try {
+      ws.ping();
+    } catch {
+      stopHeartbeat();
+      ws.terminate();
+    }
+  }, intervalMs);
+
+  return stopHeartbeat;
+}
+
+/**
+ * Creates and wires the server-wide websocket gateway used for chat, shell, and
+ * plugin proxy routes. Exported through the websocket module for server startup.
+ */
+export function createWebSocketServer(
+  server: HttpServer,
+  dependencies: WebSocketServerDependencies
+): WebSocketServer {
   const wss = new WebSocketServer({
     server,
     perMessageDeflate: false,
-    verifyClient: ((
-      info: Parameters<VerifyClientCallbackSync<AuthenticatedWebSocketRequest>>[0]
-    ) => verifyWebSocketClient(info, dependencies.verifyClient)),
-  });
-
-  wss.on('connection', (ws, request) => {
-    attachWebSocketHeartbeat(ws);
-
-    const incomingRequest = request as AuthenticatedWebSocketRequest;
-    const url = incomingRequest.url ?? '/';
-    const pathname = new URL(url, 'http://localhost').pathname;
-
-    if (pathname === '/shell') {
-      handleShellConnection(ws, dependencies.shell);
-      return;
-    }
-
-    if (pathname === '/ws') {
-      handleChatConnection(ws, incomingRequest, dependencies.chat);
-      return;
-    }
-
-    if (pathname === '/desktop-notifications') {
-      handleDesktopNotificationsConnection(ws, incomingRequest);
-      return;
-    }
-
-    if (pathname.startsWith('/plugin-ws/')) {
-      handlePluginWsProxy(ws, pathname, dependencies.getPluginPort);
-      return;
-    }
-
-    console.log('[WARN] Unknown WebSocket path:', pathname);
-    ws.close();
-  });
-
-  return wss;
-}
+    verifyClient: ((
+      info: Parameters<VerifyClientCallbackSync<AuthenticatedWebSocketRequest>>[0]
+    ) => verifyWebSocketClient(info, dependencies.verifyClient)),
+  });
+
+  wss.on('connection', (ws, request) => {
+    attachWebSocketHeartbeat(ws);
+
+    const incomingRequest = request as AuthenticatedWebSocketRequest;
+    const url = incomingRequest.url ?? '/';
+    const pathname = new URL(url, 'http://localhost').pathname;
+
+    if (pathname === '/shell') {
+      handleShellConnection(ws, dependencies.shell);
+      return;
+    }
+
+    if (pathname === '/ws') {
+      handleChatConnection(ws, incomingRequest, dependencies.chat);
+      return;
+    }
+
+    if (pathname === '/desktop-notifications') {
+      handleDesktopNotificationsConnection(ws, incomingRequest);
+      return;
+    }
+
+    if (pathname.startsWith('/plugin-ws/')) {
+      handlePluginWsProxy(ws, pathname, dependencies.getPluginPort);
+      return;
+    }
+
+    console.log('[WARN] Unknown WebSocket path:', pathname);
+    ws.close();
+  });
+
+  return wss;
+}

package/server/modules/websocket/services/websocket-state.service.ts

@@ -1,16 +1,16 @@
-import type { RealtimeClientConnection } from '@/shared/types.js';
-
-/**
- * Numeric readyState for an open WebSocket connection.
- *
- * We keep this in module state so services that broadcast updates do not need
- * to import `ws` directly just to compare open/closed state.
- */
-export const WS_OPEN_STATE = 1;
-
-/**
- * Shared registry of active chat WebSocket connections.
- *
- * Project/session services publish realtime updates by iterating this set.
- */
-export const connectedClients = new Set<RealtimeClientConnection>();
+import type { RealtimeClientConnection } from '@/shared/types.js';
+
+/**
+ * Numeric readyState for an open WebSocket connection.
+ *
+ * We keep this in module state so services that broadcast updates do not need
+ * to import `ws` directly just to compare open/closed state.
+ */
+export const WS_OPEN_STATE = 1;
+
+/**
+ * Shared registry of active chat WebSocket connections.
+ *
+ * Project/session services publish realtime updates by iterating this set.
+ */
+export const connectedClients = new Set<RealtimeClientConnection>();

package/server/modules/websocket/services/websocket-writer.service.ts

@@ -1,38 +1,38 @@
-import { WS_OPEN_STATE } from '@/modules/websocket/services/websocket-state.service.js';
-import type { RealtimeClientConnection } from '@/shared/types.js';
-
-/**
- * Thin transport adapter that gives WebSocket connections the same interface as
- * SSE writers used by API routes (`send`, `setSessionId`, `getSessionId`).
- */
-export class WebSocketWriter {
-  ws: RealtimeClientConnection;
-  sessionId: string | null;
-  userId: string | number | null;
-  isWebSocketWriter: boolean;
-
-  constructor(ws: RealtimeClientConnection, userId: string | number | null = null) {
-    this.ws = ws;
-    this.sessionId = null;
-    this.userId = userId;
-    this.isWebSocketWriter = true;
-  }
-
-  send(data: unknown): void {
-    if (this.ws.readyState === WS_OPEN_STATE) {
-      this.ws.send(JSON.stringify(data));
-    }
-  }
-
-  updateWebSocket(newRawWs: RealtimeClientConnection): void {
-    this.ws = newRawWs;
-  }
-
-  setSessionId(sessionId: string): void {
-    this.sessionId = sessionId;
-  }
-
-  getSessionId(): string | null {
-    return this.sessionId;
-  }
-}
+import { WS_OPEN_STATE } from '@/modules/websocket/services/websocket-state.service.js';
+import type { RealtimeClientConnection } from '@/shared/types.js';
+
+/**
+ * Thin transport adapter that gives WebSocket connections the same interface as
+ * SSE writers used by API routes (`send`, `setSessionId`, `getSessionId`).
+ */
+export class WebSocketWriter {
+  ws: RealtimeClientConnection;
+  sessionId: string | null;
+  userId: string | number | null;
+  isWebSocketWriter: boolean;
+
+  constructor(ws: RealtimeClientConnection, userId: string | number | null = null) {
+    this.ws = ws;
+    this.sessionId = null;
+    this.userId = userId;
+    this.isWebSocketWriter = true;
+  }
+
+  send(data: unknown): void {
+    if (this.ws.readyState === WS_OPEN_STATE) {
+      this.ws.send(JSON.stringify(data));
+    }
+  }
+
+  updateWebSocket(newRawWs: RealtimeClientConnection): void {
+    this.ws = newRawWs;
+  }
+
+  setSessionId(sessionId: string): void {
+    this.sessionId = sessionId;
+  }
+
+  getSessionId(): string | null {
+    return this.sessionId;
+  }
+}

package/server/modules/websocket/tests/chat-attachment-filter.test.ts

@@ -1,59 +1,59 @@
-import assert from 'node:assert/strict';
-import os from 'node:os';
-import path from 'node:path';
-import test from 'node:test';
-
-import {
-  filterAttachmentsToUploadStore,
-  filterImagesToUploadStore,
-} from '@/modules/websocket/services/chat-websocket.service.js';
-
-const STORE = path.join(os.tmpdir(), 'cloudcli-assets-store');
-
-test('images inside the upload store pass through', () => {
-  const inside = path.join(STORE, 'shot.png');
-  const result = filterImagesToUploadStore(
-    [{ path: inside, name: 'shot.png', mimeType: 'image/png' }],
-    STORE,
-  );
-  assert.equal(result.length, 1);
-  assert.equal(result[0].path, inside);
-});
-
-test('bare filenames are anchored inside the store', () => {
-  const result = filterImagesToUploadStore(['shot.png'], STORE);
-  assert.equal(result.length, 1);
-});
-
-test('paths outside the store, traversal, and subdirs are dropped', () => {
-  const result = filterImagesToUploadStore(
-    [
-      { path: 'C:/Users/victim/.ssh/id_rsa' },
-      { path: '/etc/passwd' },
-      { path: '../outside.png' },
-      { path: path.join(STORE, '..', 'escaped.png') },
-      { path: path.join(STORE, 'nested', 'deep.png') },
-      { path: STORE }, // the store folder itself is not a file
-    ],
-    STORE,
-  );
-  assert.deepEqual(result, []);
-});
-
-test('malformed payloads yield no attachments', () => {
-  assert.deepEqual(filterImagesToUploadStore(undefined, STORE), []);
-  assert.deepEqual(filterImagesToUploadStore('nope', STORE), []);
-  assert.deepEqual(filterImagesToUploadStore([{ name: 'no-path' }, 42], STORE), []);
-});
-
-test('general files inside the upload store preserve their metadata', () => {
-  const inside = path.join(STORE, 'brief.pdf');
-  const result = filterAttachmentsToUploadStore(
-    [{ path: inside, name: 'brief.pdf', mimeType: 'application/pdf', size: 2048 }],
-    STORE,
-  );
-
-  assert.deepEqual(result, [
-    { path: inside, name: 'brief.pdf', mimeType: 'application/pdf', size: 2048 },
-  ]);
-});
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import {
+  filterAttachmentsToUploadStore,
+  filterImagesToUploadStore,
+} from '@/modules/websocket/services/chat-websocket.service.js';
+
+const STORE = path.join(os.tmpdir(), 'cloudcli-assets-store');
+
+test('images inside the upload store pass through', () => {
+  const inside = path.join(STORE, 'shot.png');
+  const result = filterImagesToUploadStore(
+    [{ path: inside, name: 'shot.png', mimeType: 'image/png' }],
+    STORE,
+  );
+  assert.equal(result.length, 1);
+  assert.equal(result[0].path, inside);
+});
+
+test('bare filenames are anchored inside the store', () => {
+  const result = filterImagesToUploadStore(['shot.png'], STORE);
+  assert.equal(result.length, 1);
+});
+
+test('paths outside the store, traversal, and subdirs are dropped', () => {
+  const result = filterImagesToUploadStore(
+    [
+      { path: 'C:/Users/victim/.ssh/id_rsa' },
+      { path: '/etc/passwd' },
+      { path: '../outside.png' },
+      { path: path.join(STORE, '..', 'escaped.png') },
+      { path: path.join(STORE, 'nested', 'deep.png') },
+      { path: STORE }, // the store folder itself is not a file
+    ],
+    STORE,
+  );
+  assert.deepEqual(result, []);
+});
+
+test('malformed payloads yield no attachments', () => {
+  assert.deepEqual(filterImagesToUploadStore(undefined, STORE), []);
+  assert.deepEqual(filterImagesToUploadStore('nope', STORE), []);
+  assert.deepEqual(filterImagesToUploadStore([{ name: 'no-path' }, 42], STORE), []);
+});
+
+test('general files inside the upload store preserve their metadata', () => {
+  const inside = path.join(STORE, 'brief.pdf');
+  const result = filterAttachmentsToUploadStore(
+    [{ path: inside, name: 'brief.pdf', mimeType: 'application/pdf', size: 2048 }],
+    STORE,
+  );
+
+  assert.deepEqual(result, [
+    { path: inside, name: 'brief.pdf', mimeType: 'application/pdf', size: 2048 },
+  ]);
+});