workoffdesk 0.0.0-stage → 1.0.0

package/dist/server/ops/release.js

@@ -0,0 +1,206 @@
+import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs';
+import { basename, join, relative, sep } from 'node:path';
+import { readBuildStamp, staleBuild } from './build.js';
+import { m } from '../system/messages.js';
+import { restartService } from './service.js';
+const KEEP = 3;
+const MARKER = '.complete';
+const PARTIAL = '.partial';
+export const ACTIVATED = '.activated';
+export const releasesDir = (home) => join(home, 'releases');
+const appLink = (home) => join(home, 'app');
+// The marker is written last, so a release without one is a copy that never finished.
+// It carries the order releases were made in, which does not depend on the clock.
+function seqOf(home, name) {
+    try {
+        const { seq } = JSON.parse(readFileSync(join(releasesDir(home), name, MARKER), 'utf8'));
+        return typeof seq === 'number' ? seq : null;
+    }
+    catch {
+        return null;
+    }
+}
+function markComplete(dir, seq, at) {
+    writeFileSync(join(dir, MARKER), JSON.stringify({ seq, at: at.toISOString() }));
+}
+export function listReleases(home) {
+    if (!existsSync(releasesDir(home)))
+        return [];
+    return readdirSync(releasesDir(home))
+        .filter((n) => !n.endsWith(PARTIAL))
+        .map((name) => ({ name, seq: seqOf(home, name) }))
+        .filter((r) => r.seq !== null)
+        .sort((a, b) => b.seq - a.seq)
+        .map((r) => r.name);
+}
+const nextSeq = (home) => Math.max(0, ...listReleases(home).map((n) => seqOf(home, n))) + 1;
+export function currentRelease(home) {
+    try {
+        return basename(readlinkSync(appLink(home)));
+    }
+    catch {
+        return undefined;
+    }
+}
+function pointAppAt(home, name) {
+    const tmp = `${appLink(home)}.tmp`;
+    rmSync(tmp, { force: true });
+    symlinkSync(join(releasesDir(home), name), tmp);
+    renameSync(tmp, appLink(home));
+}
+// The path a service should start `cli` by. Node hands a script its real path, so a cli run through
+// the app link names one release; started by that path, the service would outlive every later deploy.
+export function launchEntry(cli, home) {
+    let releases;
+    try {
+        releases = realpathSync(releasesDir(home));
+    }
+    catch {
+        return cli;
+    }
+    const [release, ...rest] = relative(releases, cli).split(sep);
+    if (release === '..')
+        return cli;
+    return join(appLink(home), ...rest);
+}
+const removeRelease = (home, name) => rmSync(join(releasesDir(home), name), { recursive: true, force: true });
+const isDir = (p) => existsSync(p) && lstatSync(p).isDirectory();
+const isBuild = (dir) => existsSync(join(dir, 'package.json')) && existsSync(join(dir, 'dist/server/cli.js'));
+// Builds from before 2.0.0 have no /healthz. A build has it under http/ when its server is laid out by layer.
+const HEALTH_ROUTE = ['dist/server/http/routes/health.js', 'dist/server/routes/health.js'];
+const reportsVersion = (dir) => HEALTH_ROUTE.some((f) => existsSync(join(dir, f)));
+export const versionOf = (dir) => String(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).version);
+// v1 ran from a plain app folder, with the build before it in app.old.
+export function migrateLayout(home) {
+    const app = appLink(home);
+    const old = join(home, 'app.old');
+    if (!isDir(app) && !isDir(old))
+        return;
+    mkdirSync(releasesDir(home), { recursive: true });
+    const at = new Date(0);
+    if (isDir(old)) {
+        const dir = join(releasesDir(home), 'v1-previous');
+        renameSync(old, dir);
+        markComplete(dir, nextSeq(home), at);
+    }
+    if (isDir(app)) {
+        const dir = join(releasesDir(home), 'v1-current');
+        renameSync(app, dir);
+        markComplete(dir, nextSeq(home), at);
+        pointAppAt(home, 'v1-current');
+    }
+}
+const pad = (n) => String(n).padStart(2, '0');
+const stamp = (d) => `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
+function freshName(home, at) {
+    const base = stamp(at);
+    let name = base;
+    for (let n = 2; existsSync(join(releasesDir(home), name)); n++)
+        name = `${base}-${n}`;
+    return name;
+}
+// Points app at a release and restarts; when it does not come up, points app back where it was. The
+// release learns when it began to serve before it starts; the one gone back to keeps its time, as it
+// never stopped serving.
+async function switchTo(d, name, from) {
+    const dir = join(releasesDir(d.home), name);
+    writeFileSync(join(dir, ACTIVATED), (d.now ?? (() => new Date()))().toISOString());
+    pointAppAt(d.home, name);
+    await restartService(d);
+    if (await d.health(reportsVersion(dir) ? versionOf(dir) : null))
+        return true;
+    if (from) {
+        pointAppAt(d.home, from);
+        await restartService(d);
+    }
+    else {
+        unlinkSync(appLink(d.home));
+    }
+    return false;
+}
+// The native runtime of the iPhone app the build's JS update is for; the server serves it to no other.
+function appRuntimeOf(dir) {
+    try {
+        return JSON.parse(readFileSync(join(dir, 'dist/app-update/ios/update.json'), 'utf8')).runtimeVersion ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function prune(home, keep) {
+    for (const name of readdirSync(releasesDir(home))) {
+        if (name.endsWith(PARTIAL))
+            removeRelease(home, name);
+    }
+    for (const name of listReleases(home).slice(KEEP)) {
+        if (!keep.includes(name))
+            removeRelease(home, name);
+    }
+}
+// newAppRuntime: the iPhone update may be for another runtime than the live one's, or go, as when a new build of
+// the app is out. Without it, phones on the live runtime would be left with no updates and nothing would say so.
+export async function deploy(src, d, { newAppRuntime = false } = {}) {
+    if (!isBuild(src))
+        return { ok: false, release: '', message: m.release.notABuild(src) };
+    const stale = staleBuild(src);
+    if (stale)
+        return { ok: false, release: '', message: m.release.staleBuild(stale.version, stale.built) };
+    migrateLayout(d.home);
+    const live = currentRelease(d.home);
+    const liveRuntime = live ? appRuntimeOf(join(releasesDir(d.home), live)) : null;
+    if (liveRuntime && appRuntimeOf(src) !== liveRuntime && !newAppRuntime)
+        return { ok: false, release: '', message: m.release.appRuntimeChanged(liveRuntime, appRuntimeOf(src)) };
+    mkdirSync(releasesDir(d.home), { recursive: true });
+    const at = (d.now ?? (() => new Date()))();
+    const name = freshName(d.home, at);
+    const partial = join(releasesDir(d.home), `${name}${PARTIAL}`);
+    cpSync(src, partial, { recursive: true, verbatimSymlinks: true });
+    markComplete(partial, nextSeq(d.home), at);
+    renameSync(partial, join(releasesDir(d.home), name));
+    const dir = join(releasesDir(d.home), name);
+    if (!(await d.smoke(dir))) {
+        removeRelease(d.home, name);
+        return { ok: false, release: name, message: m.release.smokeFailed(versionOf(src)) };
+    }
+    const prev = currentRelease(d.home);
+    if (!(await switchTo(d, name, prev))) {
+        removeRelease(d.home, name);
+        return { ok: false, release: name, message: m.release.didNotComeUp(versionOf(src), prev) };
+    }
+    prune(d.home, [name, prev]);
+    return {
+        ok: true,
+        release: name,
+        message: [m.release.deployed(versionOf(dir), name), m.release.builtFrom(readBuildStamp(dir)), m.release.appUpdate(appRuntimeOf(dir))].join('\n'),
+    };
+}
+// The release rollback goes to: the newest one that is not running.
+export const rollbackTarget = (home) => listReleases(home).find((n) => n !== currentRelease(home));
+export async function rollback(d) {
+    migrateLayout(d.home);
+    const current = currentRelease(d.home);
+    const target = rollbackTarget(d.home);
+    if (!target)
+        return { ok: false, release: '', message: m.release.nothingToRollBackTo };
+    if (!(await switchTo(d, target, current))) {
+        return { ok: false, release: target, message: m.release.rollbackFailed(target, current) };
+    }
+    return { ok: true, release: target, message: m.release.rolledBack(versionOf(join(releasesDir(d.home), target)), target) };
+}
+// Polls the service on its loopback port until it reports `version`, or for a build with no /healthz
+// until anything answers there.
+export function healthOn(port, waitMs) {
+    return async (version) => {
+        const until = Date.now() + waitMs;
+        while (Date.now() < until) {
+            const res = await fetch(`http://127.0.0.1:${port}/healthz`).catch(() => null);
+            if (res && version === null)
+                return true;
+            const health = res?.ok ? (await res.json().catch(() => null)) : null;
+            if (health?.version === version)
+                return true;
+            await new Promise((r) => setTimeout(r, 500));
+        }
+        return false;
+    };
+}

package/dist/server/ops/report.js

@@ -0,0 +1,40 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { readBuildStamp } from './build.js';
+import { ACTIVATED, currentRelease, listReleases, releasesDir, rollbackTarget, versionOf } from './release.js';
+import { VERSION } from '../system/version.js';
+import { readLastOp } from './lastOp.js';
+const activatedAt = (dir) => {
+    try {
+        return readFileSync(join(dir, ACTIVATED), 'utf8').trim() || null;
+    }
+    catch {
+        return null;
+    }
+};
+export function releasesOf(home) {
+    return listReleases(home).map((name) => {
+        const dir = join(releasesDir(home), name);
+        let version = '';
+        try {
+            version = versionOf(dir);
+        }
+        catch {
+            // a release whose package.json is unreadable still shows by name
+        }
+        return { name, version, activatedAt: activatedAt(dir) };
+    });
+}
+export async function macReport(o, messages) {
+    return {
+        checks: await o.doctor(messages),
+        version: VERSION,
+        build: readBuildStamp(o.buildRoot),
+        release: currentRelease(o.home) ?? null,
+        releases: releasesOf(o.home),
+        rollbackTo: rollbackTarget(o.home) ?? null,
+        managed: o.managed,
+        startedAt: o.startedAt,
+        lastOp: readLastOp(o.home),
+    };
+}

package/dist/server/ops/service.js

@@ -0,0 +1,39 @@
+// The service as launchd has it: started, stopped, restarted, and whether a process is it.
+const target = (d) => `gui/${d.uid}/${d.label}`;
+async function launchctl(d, args) {
+    const r = await d.exec('launchctl', args);
+    if (r.code !== 0)
+        throw new Error(r.out.trim() || `launchctl ${args[0]} failed (${r.code})`);
+}
+const loaded = async (d) => (await d.exec('launchctl', ['print', target(d)])).code === 0;
+const pidOf = async (d) => /\bpid = (\d+)/.exec((await d.exec('launchctl', ['print', target(d)])).out)?.[1];
+// Loads the agent install wrote, or starts the one launchd has.
+export async function startService(d, plist) {
+    if (await loaded(d))
+        await launchctl(d, ['kickstart', target(d)]);
+    else
+        await launchctl(d, ['bootstrap', `gui/${d.uid}`, plist]);
+}
+// Unloaded rather than killed: KeepAlive would start a killed one again.
+export async function stopService(d) {
+    if (await loaded(d))
+        await launchctl(d, ['bootout', target(d)]);
+}
+// How long the running service is given to close on its own (it allows itself 10 s), and how often it is looked at.
+const STOP_WAIT_MS = 12_000;
+const STOP_POLL_MS = 250;
+// The service is asked to stop with SIGTERM, so it tells the phones it is restarting and closes cleanly
+// (kickstart -k kills it outright), then started at once rather than after launchd's throttle. Only one
+// that will not stop is killed.
+export async function restartService(d) {
+    const was = await pidOf(d);
+    if (was) {
+        await d.exec('launchctl', ['kill', 'SIGTERM', target(d)]);
+        for (let t = 0; t < STOP_WAIT_MS && (await pidOf(d)) === was; t += STOP_POLL_MS)
+            await new Promise((r) => setTimeout(r, STOP_POLL_MS));
+    }
+    const stuck = was !== undefined && (await pidOf(d)) === was;
+    await d.exec('launchctl', ['kickstart', ...(stuck ? ['-k'] : []), target(d)]);
+}
+// launchd tells a job its own label in XPC_SERVICE_NAME; a server started by hand has another or none.
+export const isManaged = (env, label) => env.XPC_SERVICE_NAME === label;

package/dist/server/ops/shutdown.js

@@ -0,0 +1,12 @@
+// What a signal handler runs: close everything once, then exit 0; exit 1 if closing fails or takes
+// longer than the limit, so a supervisor is never left waiting on a server that will not stop.
+export function shutdownOnce(close, o) {
+    let started = false;
+    return () => {
+        if (started)
+            return;
+        started = true;
+        setTimeout(() => o.exit(1), o.timeoutMs).unref();
+        close().then(() => o.exit(0), () => o.exit(1));
+    };
+}

package/dist/server/sessions/control.js

@@ -0,0 +1,97 @@
+import { request, createServer } from 'node:http';
+import { listenOwnerOnly } from '../agents/claude/hooks/hooks.js';
+import { errorReply } from '../system/errors.js';
+// An environment's whole size is bounded by what exec takes on macOS, 1 MiB.
+const MAX_BODY = 1024 * 1024;
+const isEnv = (x) => typeof x === 'object' && x !== null && !Array.isArray(x) && Object.values(x).every((v) => typeof v === 'string');
+const bad = (error) => ({ status: 400, body: { error } });
+function openSession(open, body) {
+    const r = body;
+    if (typeof r?.cwd !== 'string' || (r.resumeId !== undefined && typeof r.resumeId !== 'string'))
+        return bad('cwd required');
+    if (r.env !== undefined && !isEnv(r.env))
+        return bad('env must be names to strings');
+    if (r.kind !== undefined && r.kind !== 'claude' && r.kind !== 'codex')
+        return bad('kind must be claude or codex');
+    return open({ kind: r.kind, cwd: r.cwd, resumeId: r.resumeId, env: r.env }).then((id) => ({ status: 201, body: { id } }), (e) => ({ status: 400, body: { error: e instanceof Error ? e.message : String(e) } }));
+}
+export function startControlServer(sockPath, o) {
+    const answered = (view) => view.then((body) => ({ status: 200, body }), (e) => {
+        const r = errorReply(e);
+        if (r.status === 500)
+            console.error(`workoffdesk: the control socket could not answer: ${e instanceof Error ? (e.stack ?? e.message) : String(e)}`);
+        return r;
+    });
+    const routes = {
+        'POST /sessions': (r) => openSession(o.open, r),
+        'GET /accounts': () => answered(o.accounts.view()),
+        'PUT /account': (r) => {
+            const id = r?.id;
+            return typeof id === 'string' ? answered(o.accounts.pick(id)) : bad('bad id');
+        },
+        'POST /account/move': () => answered(o.accounts.move()),
+    };
+    const server = createServer((req, res) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > MAX_BODY)
+                req.destroy();
+            else
+                chunks.push(c);
+        });
+        req.on('end', () => {
+            const reply = ({ status, body }) => {
+                res.writeHead(status, { 'content-type': 'application/json' });
+                res.end(JSON.stringify(body));
+            };
+            const route = routes[`${req.method} ${req.url}`];
+            if (!route)
+                return reply({ status: 404, body: { error: 'not found' } });
+            let body;
+            try {
+                const text = Buffer.concat(chunks).toString('utf8');
+                body = text ? JSON.parse(text) : undefined;
+            }
+            catch {
+                return reply(bad('bad json'));
+            }
+            void Promise.resolve(route(body)).then(reply);
+        });
+    });
+    return listenOwnerOnly(server, sockPath);
+}
+// What the server answered, or why it did not: its message, with its code when it gave one.
+function ask(sockPath, method, path, body) {
+    return new Promise((done, fail) => {
+        const req = request({ socketPath: sockPath, method, path, headers: { 'content-type': 'application/json' } }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                let answer = {};
+                try {
+                    answer = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                }
+                catch {
+                    // reported below
+                }
+                if (res.statusCode >= 200 && res.statusCode < 300)
+                    return done(answer);
+                fail(Object.assign(new Error(answer.error ?? `server answered ${res.statusCode}`), answer.code ? { code: answer.code } : {}));
+            });
+        });
+        req.on('error', fail);
+        req.end(body === undefined ? undefined : JSON.stringify(body));
+    });
+}
+// The id of the session the server opened, or the reason it did not.
+export async function askToOpen(sockPath, r) {
+    const { id } = await ask(sockPath, 'POST', '/sessions', r);
+    if (!id)
+        throw new Error('server answered no session');
+    return id;
+}
+export const askAccounts = (sockPath) => ask(sockPath, 'GET', '/accounts');
+export const askToPick = (sockPath, id) => ask(sockPath, 'PUT', '/account', { id });
+export const askToMove = (sockPath) => ask(sockPath, 'POST', '/account/move');

package/dist/server/sessions/events.js

@@ -0,0 +1,77 @@
+export class EventHub {
+    machine;
+    lastReply;
+    clients = new Set();
+    pending = null;
+    pendingHeads = null;
+    constructor(machine, lastReply = async () => null) {
+        this.machine = machine;
+        this.lastReply = lastReply;
+        machine.onChange(() => this.schedule());
+        machine.journal.onHead(() => this.scheduleHeads());
+    }
+    async add(socket) {
+        this.clients.add(socket);
+        const ping = setInterval(() => socket.ping(), 25_000);
+        socket.on('close', () => {
+            clearInterval(ping);
+            this.clients.delete(socket);
+        });
+        const snapshot = await this.snapshot();
+        if (snapshot)
+            socket.send(JSON.stringify(snapshot));
+        socket.send(JSON.stringify(this.heads()));
+    }
+    schedule() {
+        if (this.pending)
+            return;
+        this.pending = setTimeout(async () => {
+            this.pending = null;
+            if (!this.clients.size)
+                return;
+            const snapshot = await this.snapshot();
+            if (!snapshot)
+                return;
+            const msg = JSON.stringify(snapshot);
+            for (const c of this.clients)
+                if (c.readyState === c.OPEN)
+                    c.send(msg);
+        }, 50);
+    }
+    // Each session's journal version, sent on its own: it changes with every line Claude writes, and the
+    // list is costly to read.
+    scheduleHeads() {
+        if (this.pendingHeads)
+            return;
+        this.pendingHeads = setTimeout(() => {
+            this.pendingHeads = null;
+            const msg = JSON.stringify(this.heads());
+            for (const c of this.clients)
+                if (c.readyState === c.OPEN)
+                    c.send(msg);
+        }, 50);
+    }
+    heads() {
+        return { type: 'heads', machine: this.machine.id, epoch: this.machine.journal.epoch, heads: this.machine.journal.heads() };
+    }
+    // Null when tmux does not answer: the next change, or the machine's watch, brings a list that holds.
+    // asOf: when it was read, so a client can tell an answer about a message (dated by its `at`) the list
+    // already accounts for from one it does not. Also asked for on its own, by a client whose socket does
+    // not get through.
+    async snapshot() {
+        const asOf = Date.now();
+        const sessions = await this.machine.listSessions().catch(() => null);
+        if (!sessions)
+            return null;
+        const replies = await Promise.all(sessions.map((s) => this.lastReply(s).catch(() => null)));
+        return { type: 'sessions', machine: this.machine.id, asOf, sessions: sessions.map((s, i) => ({ ...s, lastReply: replies[i] })) };
+    }
+    close() {
+        if (this.pending)
+            clearTimeout(this.pending);
+        if (this.pendingHeads)
+            clearTimeout(this.pendingHeads);
+        for (const c of this.clients)
+            c.close(1001);
+    }
+}

package/dist/server/sessions/machine/accounts.js

@@ -0,0 +1,55 @@
+import { Conflict } from '../../system/errors.js';
+// The Claude accounts on the Mac: the one new sessions run on, and each one's last limits.
+export class Accounts {
+    d;
+    p;
+    constructor(d, p) {
+        this.d = d;
+        this.p = p;
+    }
+    // Written when a figure moves by a whole point or a reset time changes, not on every status line.
+    keepLimits(dir, u) {
+        const before = this.d.store.get().claudeLimits?.[dir];
+        const same = (a, b) => Math.round(a?.used ?? -1) === Math.round(b?.used ?? -1) && a?.resetsAt === b?.resetsAt;
+        if (before && same(before.fiveHour, u.fiveHour) && same(before.sevenDay, u.sevenDay))
+            return;
+        this.d.store.update((st) => {
+            st.claudeLimits = { ...st.claudeLimits, [dir]: { fiveHour: u.fiveHour, sevenDay: u.sevenDay, at: Date.now() } };
+        });
+    }
+    // The account new sessions here run on: the one picked while it can still be, else this server's own.
+    // undefined: none was ever picked, and the start command says nothing of accounts.
+    async accountInUse() {
+        const picked = this.d.store.get().claudeAccount;
+        if (picked === undefined || !this.d.accounts)
+            return undefined;
+        const found = (await this.d.accounts.list()).find((a) => a.id === picked);
+        return found && this.d.accounts.pickable(found) ? picked : this.d.accounts.ownId();
+    }
+    async claudeAccountsView() {
+        const accounts = this.d.accounts ? await this.d.accounts.list() : [];
+        const limits = this.d.store.get().claudeLimits ?? {};
+        const inUse = await this.accountInUse();
+        return {
+            accounts: accounts.map((a) => ({ ...a, limits: limits[a.id] ?? null })),
+            inUse: inUse ?? this.d.accounts?.ownId() ?? '',
+            picked: this.d.store.get().claudeAccount !== undefined,
+            ...this.p.moves.counts(inUse),
+        };
+    }
+    // The id is one of the accounts found, never taken as a path of its own.
+    async pickClaudeAccount(id) {
+        const found = this.d.accounts && (await this.d.accounts.list()).find((a) => a.id === id);
+        if (!found || !this.d.accounts?.pickable(found))
+            throw new Conflict('that Claude account cannot be used now', 'account-unusable');
+        this.d.store.update((st) => void (st.claudeAccount = id));
+        return this.claudeAccountsView();
+    }
+    // Which account a Claude session runs on, said only on a Mac with more than one.
+    accountLabel(meta) {
+        const known = this.d.accounts?.known() ?? [];
+        if (meta.kind !== 'claude' || meta.claudeDir === undefined || known.length < 2)
+            return undefined;
+        return known.find((a) => a.id === meta.claudeDir)?.email;
+    }
+}