wind-agent-cli 1.37.2

package/dist-server/server/modules/websocket/services/terminal-replay-store.js

@@ -0,0 +1,161 @@
+const DEFAULT_MAX_SESSION_BYTES = 4 * 1024 * 1024;
+const DEFAULT_MAX_SESSION_ENTRIES = 5_000;
+const DEFAULT_MAX_TOTAL_BYTES = 16 * 1024 * 1024;
+function retainUtf8Tail(value, maxBytes) {
+    const bytes = Buffer.from(value, 'utf8');
+    if (bytes.length <= maxBytes) {
+        return { value, truncated: false };
+    }
+    let start = bytes.length - maxBytes;
+    while (start < bytes.length && (bytes[start] & 0xc0) === 0x80) {
+        start += 1;
+    }
+    return {
+        value: bytes.subarray(start).toString('utf8'),
+        truncated: true,
+    };
+}
+/**
+ * Used by the shell websocket service to own replay memory across retained
+ * PTYs. Websocket module tests construct isolated instances to verify that per-session
+ * and global budgets do not affect process lifetime or live output.
+ */
+export class TerminalReplayStore {
+    maxSessionBytes;
+    maxSessionEntries;
+    maxTotalBytes;
+    sessions = new Map();
+    globalRecords = [];
+    globalHead = 0;
+    inactiveGlobalRecords = 0;
+    totalBytes = 0;
+    constructor(options = {}) {
+        this.maxSessionBytes = options.maxSessionBytes ?? DEFAULT_MAX_SESSION_BYTES;
+        this.maxSessionEntries = options.maxSessionEntries ?? DEFAULT_MAX_SESSION_ENTRIES;
+        this.maxTotalBytes = options.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES;
+    }
+    append(sessionKey, data) {
+        if (!data || this.maxSessionBytes <= 0 || this.maxTotalBytes <= 0) {
+            return;
+        }
+        const retained = retainUtf8Tail(data, Math.min(this.maxSessionBytes, this.maxTotalBytes));
+        const bytes = Buffer.byteLength(retained.value, 'utf8');
+        const session = this.sessions.get(sessionKey) ?? {
+            records: [],
+            head: 0,
+            bytes: 0,
+            truncated: false,
+        };
+        this.sessions.set(sessionKey, session);
+        const record = {
+            sessionKey,
+            data: retained.value,
+            bytes,
+            active: true,
+        };
+        session.records.push(record);
+        session.bytes += bytes;
+        session.truncated ||= retained.truncated;
+        this.globalRecords.push(record);
+        this.totalBytes += bytes;
+        while (session.records.length - session.head > this.maxSessionEntries
+            || session.bytes > this.maxSessionBytes) {
+            this.deactivate(session.records[session.head], true);
+            this.advanceSessionHead(session);
+        }
+        while (this.totalBytes > this.maxTotalBytes) {
+            const oldest = this.nextActiveGlobalRecord();
+            if (!oldest) {
+                break;
+            }
+            const owner = this.sessions.get(oldest.sessionKey);
+            this.deactivate(oldest, true);
+            if (owner) {
+                this.advanceSessionHead(owner);
+            }
+        }
+        this.compact(session);
+        this.compactGlobalRecords();
+    }
+    snapshot(sessionKey) {
+        const session = this.sessions.get(sessionKey);
+        if (!session) {
+            return { chunks: [], truncated: false };
+        }
+        return {
+            chunks: session.records
+                .slice(session.head)
+                .filter((record) => record.active)
+                .map((record) => record.data),
+            truncated: session.truncated,
+        };
+    }
+    clear(sessionKey) {
+        this.delete(sessionKey);
+        this.sessions.set(sessionKey, {
+            records: [],
+            head: 0,
+            bytes: 0,
+            truncated: false,
+        });
+    }
+    delete(sessionKey) {
+        const session = this.sessions.get(sessionKey);
+        if (!session) {
+            return;
+        }
+        for (let index = session.head; index < session.records.length; index += 1) {
+            this.deactivate(session.records[index], false);
+        }
+        this.sessions.delete(sessionKey);
+        this.compactGlobalRecords();
+    }
+    deactivate(record, markTruncated) {
+        if (!record?.active) {
+            return;
+        }
+        record.active = false;
+        this.inactiveGlobalRecords += 1;
+        this.totalBytes -= record.bytes;
+        const session = this.sessions.get(record.sessionKey);
+        if (session) {
+            session.bytes -= record.bytes;
+            session.truncated ||= markTruncated;
+        }
+    }
+    advanceSessionHead(session) {
+        while (session.head < session.records.length && !session.records[session.head].active) {
+            session.head += 1;
+        }
+    }
+    nextActiveGlobalRecord() {
+        while (this.globalHead < this.globalRecords.length
+            && !this.globalRecords[this.globalHead].active) {
+            this.globalHead += 1;
+        }
+        return this.globalRecords[this.globalHead] ?? null;
+    }
+    compact(session) {
+        if (session.head >= 1_024 && session.head * 2 >= session.records.length) {
+            session.records = session.records.slice(session.head);
+            session.head = 0;
+        }
+    }
+    compactGlobalRecords() {
+        this.nextActiveGlobalRecord();
+        if (this.globalHead >= 1_024 && this.globalHead * 2 >= this.globalRecords.length) {
+            this.globalRecords = this.globalRecords.slice(this.globalHead);
+            this.globalHead = 0;
+            this.inactiveGlobalRecords = this.globalRecords.reduce((count, record) => count + (record.active ? 0 : 1), 0);
+        }
+        if (this.inactiveGlobalRecords >= 1_024
+            && this.inactiveGlobalRecords * 2 >= this.globalRecords.length) {
+            this.globalRecords = this.globalRecords.filter((record) => record.active);
+            this.globalHead = 0;
+            this.inactiveGlobalRecords = 0;
+        }
+    }
+}
+/** Used by the shell websocket service to bound retained PTY output globally. */
+export const terminalReplayStore = new TerminalReplayStore();
+//# sourceMappingURL=terminal-replay-store.js.map

package/dist-server/server/modules/websocket/services/terminal-replay-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-replay-store.js","sourceRoot":"","sources":["../../../../../server/modules/websocket/services/terminal-replay-store.ts"],"names":[],"mappings":"AAyBA,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,SAAS,cAAc,CAAC,KAAa,EAAE,QAAgB;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;IACpC,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9D,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC7C,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IACb,eAAe,CAAS;IACxB,iBAAiB,CAAS;IAC1B,aAAa,CAAS;IACtB,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IACrD,aAAa,GAAmB,EAAE,CAAC;IACnC,UAAU,GAAG,CAAC,CAAC;IACf,qBAAqB,GAAG,CAAC,CAAC;IAC1B,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;QAC5E,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAClF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,UAAkB,EAAE,IAAY;QACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;YAC/C,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,KAAK;SACjB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAiB;YAC3B,UAAU;YACV,IAAI,EAAE,QAAQ,CAAC,KAAK;YACpB,KAAK;YACL,MAAM,EAAE,IAAI;SACb,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACvB,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;QAEzB,OACE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,iBAAiB;eAC3D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,eAAe,EACvC,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9B,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,OAAO;iBACpB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;iBACnB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;iBACjC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAkB;QACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE;YAC5B,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAEO,UAAU,CAAC,MAAgC,EAAE,aAAsB;QACzE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;YAC9B,OAAO,CAAC,SAAS,KAAK,aAAa,CAAC;QACtC,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,OAAsB;QAC/C,OAAO,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACtF,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,sBAAsB;QAC5B,OACE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM;eACxC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAC9C,CAAC;YACD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IACrD,CAAC;IAEO,OAAO,CAAC,OAAsB;QACpC,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACxE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,oBAAoB;QAC1B,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YACjF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAClD,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IACE,IAAI,CAAC,qBAAqB,IAAI,KAAK;eAChC,IAAI,CAAC,qBAAqB,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAC9D,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1E,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,qBAAqB,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC"}

package/dist-server/server/modules/websocket/services/websocket-auth.service.js

@@ -0,0 +1,36 @@
+/**
+ * Authenticates websocket upgrade requests before the `connection` handler runs.
+ */
+export function verifyWebSocketClient(info, dependencies) {
+    const request = info.req;
+    const upgradeUrl = new URL(request.url ?? '/', 'http://localhost');
+    const loggedUrl = new URL(upgradeUrl);
+    if (loggedUrl.searchParams.has('token')) {
+        loggedUrl.searchParams.set('token', 'REDACTED');
+    }
+    console.log('WebSocket connection attempt to:', `${loggedUrl.pathname}${loggedUrl.search}`);
+    // Platform mode: use the first DB user and skip token checks.
+    if (dependencies.isPlatform) {
+        const user = dependencies.authenticateWebSocket(null);
+        if (!user) {
+            console.log('[WARN] Platform mode: No user found in database');
+            return false;
+        }
+        request.user = user;
+        console.log('[OK] Platform mode WebSocket authenticated for user:', user.username);
+        return true;
+    }
+    // OSS mode: read JWT from query string first, then Authorization header.
+    const token = upgradeUrl.searchParams.get('token') ??
+        request.headers.authorization?.split(' ')[1] ??
+        null;
+    const user = dependencies.authenticateWebSocket(token);
+    if (!user) {
+        console.log('[WARN] WebSocket authentication failed');
+        return false;
+    }
+    request.user = user;
+    console.log('[OK] WebSocket authenticated for user:', user.username);
+    return true;
+}
+//# sourceMappingURL=websocket-auth.service.js.map

package/dist-server/server/modules/websocket/services/websocket-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-auth.service.js","sourceRoot":"","sources":["../../../../../server/modules/websocket/services/websocket-auth.service.ts"],"names":[],"mappings":"AAcA;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAA4E,EAC5E,YAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAoC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5F,8DAA8D;IAC9D,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,sDAAsD,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,KAAK,GACT,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC;IAEP,MAAM,IAAI,GAAG,YAAY,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,wCAAwC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist-server/server/modules/websocket/services/websocket-server.service.js

@@ -0,0 +1,91 @@
+import { WebSocket, WebSocketServer } from 'ws';
+import { handleChatConnection } from '../../../modules/websocket/services/chat-websocket.service.js';
+import { verifyWebSocketClient } from '../../../modules/websocket/services/websocket-auth.service.js';
+import { handlePluginWsProxy } from '../../../modules/websocket/services/plugin-websocket-proxy.service.js';
+import { handleShellConnection } from '../../../modules/websocket/services/shell-websocket.service.js';
+import { handleDesktopNotificationsConnection } from '../../../modules/notifications/index.js';
+/**
+ * Used by this module's websocket gateway to keep active transports alive and
+ * close half-open connections so their route-specific clients can reconnect.
+ */
+export function attachWebSocketHeartbeat(ws, intervalMs = 30_000, scheduler = {
+    setInterval,
+    clearInterval,
+}) {
+    let isAlive = true;
+    let stopped = false;
+    const markAlive = () => {
+        isAlive = true;
+    };
+    const stopHeartbeat = () => {
+        if (stopped) {
+            return;
+        }
+        stopped = true;
+        scheduler.clearInterval(heartbeat);
+        ws.off('pong', markAlive);
+        ws.off('close', stopHeartbeat);
+        ws.off('error', stopHeartbeat);
+    };
+    ws.on('pong', markAlive);
+    ws.on('close', stopHeartbeat);
+    ws.on('error', stopHeartbeat);
+    const heartbeat = scheduler.setInterval(() => {
+        if (ws.readyState !== WebSocket.OPEN) {
+            return;
+        }
+        // A socket that did not answer the previous ping is half-open from the
+        // server's perspective. Terminating it emits close and lets clients resume.
+        if (!isAlive) {
+            stopHeartbeat();
+            ws.terminate();
+            return;
+        }
+        isAlive = false;
+        try {
+            ws.ping();
+        }
+        catch {
+            stopHeartbeat();
+            ws.terminate();
+        }
+    }, intervalMs);
+    return stopHeartbeat;
+}
+/**
+ * Creates and wires the server-wide websocket gateway used for chat, shell, and
+ * plugin proxy routes. Exported through the websocket module for server startup.
+ */
+export function createWebSocketServer(server, dependencies) {
+    const wss = new WebSocketServer({
+        server,
+        perMessageDeflate: false,
+        verifyClient: ((info) => verifyWebSocketClient(info, dependencies.verifyClient)),
+    });
+    wss.on('connection', (ws, request) => {
+        attachWebSocketHeartbeat(ws);
+        const incomingRequest = request;
+        const url = incomingRequest.url ?? '/';
+        const pathname = new URL(url, 'http://localhost').pathname;
+        if (pathname === '/shell') {
+            handleShellConnection(ws, dependencies.shell);
+            return;
+        }
+        if (pathname === '/ws') {
+            handleChatConnection(ws, incomingRequest, dependencies.chat);
+            return;
+        }
+        if (pathname === '/desktop-notifications') {
+            handleDesktopNotificationsConnection(ws, incomingRequest);
+            return;
+        }
+        if (pathname.startsWith('/plugin-ws/')) {
+            handlePluginWsProxy(ws, pathname, dependencies.getPluginPort);
+            return;
+        }
+        console.log('[WARN] Unknown WebSocket path:', pathname);
+        ws.close();
+    });
+    return wss;
+}
+//# sourceMappingURL=websocket-server.service.js.map

package/dist-server/server/modules/websocket/services/websocket-server.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-server.service.js","sourceRoot":"","sources":["../../../../../server/modules/websocket/services/websocket-server.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAiC,MAAM,IAAI,CAAC;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wDAAwD,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAChG,OAAO,EAAE,oCAAoC,EAAE,MAAM,kCAAkC,CAAC;AAUxF;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,EAAa,EACb,UAAU,GAAG,MAAM,EACnB,SAAS,GAAG;IACV,WAAW;IACX,aAAa;CACd;IAED,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,GAAG,EAAE;QACzB,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,OAAO,GAAG,IAAI,CAAC;QACf,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACnC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1B,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAE9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE;QAC3C,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,EAAE,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,EAAE,CAAC;YAChB,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,YAAyC;IAEzC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC;QAC9B,MAAM;QACN,iBAAiB,EAAE,KAAK;QACxB,YAAY,EAAE,CAAC,CACb,IAA4E,EAC5E,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;KAC7D,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE;QACnC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAE7B,MAAM,eAAe,GAAG,OAAwC,CAAC;QACjE,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,IAAI,GAAG,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QAE3D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,qBAAqB,CAAC,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,oBAAoB,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,KAAK,wBAAwB,EAAE,CAAC;YAC1C,oCAAoC,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC;QACxD,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist-server/server/modules/websocket/services/websocket-state.service.js

@@ -0,0 +1,14 @@
+/**
+ * Numeric readyState for an open WebSocket connection.
+ *
+ * We keep this in module state so services that broadcast updates do not need
+ * to import `ws` directly just to compare open/closed state.
+ */
+export const WS_OPEN_STATE = 1;
+/**
+ * Shared registry of active chat WebSocket connections.
+ *
+ * Project/session services publish realtime updates by iterating this set.
+ */
+export const connectedClients = new Set();
+//# sourceMappingURL=websocket-state.service.js.map

package/dist-server/server/modules/websocket/services/websocket-state.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-state.service.js","sourceRoot":"","sources":["../../../../../server/modules/websocket/services/websocket-state.service.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC"}

package/dist-server/server/modules/websocket/services/websocket-writer.service.js

@@ -0,0 +1,32 @@
+import { WS_OPEN_STATE } from '../../../modules/websocket/services/websocket-state.service.js';
+/**
+ * Thin transport adapter that gives WebSocket connections the same interface as
+ * SSE writers used by API routes (`send`, `setSessionId`, `getSessionId`).
+ */
+export class WebSocketWriter {
+    ws;
+    sessionId;
+    userId;
+    isWebSocketWriter;
+    constructor(ws, userId = null) {
+        this.ws = ws;
+        this.sessionId = null;
+        this.userId = userId;
+        this.isWebSocketWriter = true;
+    }
+    send(data) {
+        if (this.ws.readyState === WS_OPEN_STATE) {
+            this.ws.send(JSON.stringify(data));
+        }
+    }
+    updateWebSocket(newRawWs) {
+        this.ws = newRawWs;
+    }
+    setSessionId(sessionId) {
+        this.sessionId = sessionId;
+    }
+    getSessionId() {
+        return this.sessionId;
+    }
+}
+//# sourceMappingURL=websocket-writer.service.js.map

package/dist-server/server/modules/websocket/services/websocket-writer.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"websocket-writer.service.js","sourceRoot":"","sources":["../../../../../server/modules/websocket/services/websocket-writer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yDAAyD,CAAC;AAGxF;;;GAGG;AACH,MAAM,OAAO,eAAe;IAC1B,EAAE,CAA2B;IAC7B,SAAS,CAAgB;IACzB,MAAM,CAAyB;IAC/B,iBAAiB,CAAU;IAE3B,YAAY,EAA4B,EAAE,SAAiC,IAAI;QAC7E,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAa;QAChB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,eAAe,CAAC,QAAkC;QAChD,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF"}

package/dist-server/server/modules/websocket/tests/chat-attachment-filter.test.js

@@ -0,0 +1,40 @@
+import assert from 'node:assert/strict';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { filterAttachmentsToUploadStore, filterImagesToUploadStore, } from '../../../modules/websocket/services/chat-websocket.service.js';
+const STORE = path.join(os.tmpdir(), 'cloudcli-assets-store');
+test('images inside the upload store pass through', () => {
+    const inside = path.join(STORE, 'shot.png');
+    const result = filterImagesToUploadStore([{ path: inside, name: 'shot.png', mimeType: 'image/png' }], STORE);
+    assert.equal(result.length, 1);
+    assert.equal(result[0].path, inside);
+});
+test('bare filenames are anchored inside the store', () => {
+    const result = filterImagesToUploadStore(['shot.png'], STORE);
+    assert.equal(result.length, 1);
+});
+test('paths outside the store, traversal, and subdirs are dropped', () => {
+    const result = filterImagesToUploadStore([
+        { path: 'C:/Users/victim/.ssh/id_rsa' },
+        { path: '/etc/passwd' },
+        { path: '../outside.png' },
+        { path: path.join(STORE, '..', 'escaped.png') },
+        { path: path.join(STORE, 'nested', 'deep.png') },
+        { path: STORE }, // the store folder itself is not a file
+    ], STORE);
+    assert.deepEqual(result, []);
+});
+test('malformed payloads yield no attachments', () => {
+    assert.deepEqual(filterImagesToUploadStore(undefined, STORE), []);
+    assert.deepEqual(filterImagesToUploadStore('nope', STORE), []);
+    assert.deepEqual(filterImagesToUploadStore([{ name: 'no-path' }, 42], STORE), []);
+});
+test('general files inside the upload store preserve their metadata', () => {
+    const inside = path.join(STORE, 'brief.pdf');
+    const result = filterAttachmentsToUploadStore([{ path: inside, name: 'brief.pdf', mimeType: 'application/pdf', size: 2048 }], STORE);
+    assert.deepEqual(result, [
+        { path: inside, name: 'brief.pdf', mimeType: 'application/pdf', size: 2048 },
+    ]);
+});
+//# sourceMappingURL=chat-attachment-filter.test.js.map

package/dist-server/server/modules/websocket/tests/chat-attachment-filter.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-attachment-filter.test.js","sourceRoot":"","sources":["../../../../../server/modules/websocket/tests/chat-attachment-filter.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,wDAAwD,CAAC;AAEhE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAE9D,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,yBAAyB,CACtC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EAC3D,KAAK,CACN,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;IACxD,MAAM,MAAM,GAAG,yBAAyB,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,MAAM,GAAG,yBAAyB,CACtC;QACE,EAAE,IAAI,EAAE,6BAA6B,EAAE;QACvC,EAAE,IAAI,EAAE,aAAa,EAAE;QACvB,EAAE,IAAI,EAAE,gBAAgB,EAAE;QAC1B,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE;QAC/C,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE;QAChD,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,wCAAwC;KAC1D,EACD,KAAK,CACN,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,8BAA8B,CAC3C,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAC9E,KAAK,CACN,CAAC;IAEF,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACvB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;KAC7E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}