[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_271":-5,"_274":275,"_276":277},"routes/shell",{"_40":41,"_270":-5,"_271":-5,"_272":273},"routes/repo",{"_33":-7,"_34":35,"_36":37,"_38":39,"_40":41,"_42":31,"_43":31,"_44":31,"_45":31,"_46":31,"_47":31,"_48":49,"_50":49,"_51":31,"_52":-7,"_53":-7,"_54":55,"_56":57,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":14,"_22":23,"_24":-5,"_25":26,"_27":28,"_28":29,"_30":31,"_32":14},"ref","aff8d54e95c93c117efe1d3682d8d89c4a208bcc","path","apps/host/src/gateway.ts","oid","a8371f7fd47450025f05c78829840444ac572231","size",24453,"commit","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","import { existsSync, mkdirSync, watch } from \"node:fs\";\nimport { hostname } from \"node:os\";\nimport { join } from \"node:path\";\n\nimport type { Server, ServerWebSocket } from \"bun\";\n\nimport * as auth from \"./auth\";\nimport * as catalog from \"./catalog\";\nimport { Connection } from \"./client\";\nimport { config } from \"./config\";\nimport { diagnostics } from \"./diagnostics\";\nimport * as directory from \"./directory\";\nimport { GatewayClient, type Watch } from \"./gateway-client\";\nimport * as github from \"./github\";\nimport { seal } from \"./keys\";\nimport { failure, log, open as openLog } from \"./log\";\nimport {\n\tarchive,\n\tarchiveInactive,\n\tisRunning,\n\tisWorkerAlive,\n\tmodels,\n\tproject,\n\tremove,\n} from \"./manage\";\nimport * as peers from \"./peers\";\nimport * as projects from \"./projects\";\nimport {\n\tHOST_PROTOCOL,\n\ttype HostEnvelope,\n\ttype HostFrame,\n\ttype HostInfo,\n\ttype HostRequest,\n\ttype Listing,\n\ttype People,\n} from \"./protocol\";\nimport { type Machine, self, whois } from \"./tailnet\";\nimport { checkKey, removeKey, setKey, setModel, settings } from \"./settings\";\nimport { resume, shutdown } from \"./shutdown\";\nimport * as terminals from \"./terminals\";\nimport * as web from \"./web\";\nimport * as windows from \"./windows\";\nimport * as workspace from \"./workspace\";\n\ntype Client = {\n\t/** The participant this socket speaks for: the owner on loopback, a verified login on the tailnet. */\n\tuser: string;\n\t/** Arrived over the tailnet. Peers act only on this host's channels, and never as its owner. */\n\tpeer: boolean;\n\tlocal: boolean;\n\tchannels: Map>;\n\t/** This client's connections to peer hosts, opened when it first uses one of their channels. */\n\tremotes: Map;\n\t/** Detaches this client from the terminals it opened; the shells keep running. */\n\tterminals: Map void>;\n};\n\nlet name = hostname();\nlet closing = false;\nlet updating = false;\nlet update = 0;\nlet suspending: Promise | undefined;\nconst pending = new Set>();\n\nfunction local(): Listing[] {\n\treturn catalog.list().map((record) => {\n\t\tconst state = record.archived ? \"archived\" : isRunning(record.id) ? \"running\" : \"dormant\";\n\t\tconst { id, name: channel, summary, revision, owner, project, model, created, active, hosted } =\n\t\t\trecord;\n\t\tconst listing: Listing = {\n\t\t\tid,\n\t\t\thost: name,\n\t\t\tname: channel,\n\t\t\tsummary,\n\t\t\trevision,\n\t\t\towner,\n\t\t\tproject,\n\t\t\tmodel,\n\t\t\tcreated,\n\t\t\tstate,\n\t\t\tbusy: state === \"running\" && !!record.busy && (!hosted || workspace.isConnected(id)),\n\t\t};\n\t\tif (active) listing.active = active;\n\t\tconst { root, repo } = projects.checkout(project);\n\t\tlisting.root = root;\n\t\tif (repo) listing.repo = repo;\n\t\tif (hosted) listing.hosted = hosted;\n\t\treturn listing;\n\t});\n}\n\n/** Channels only the directory knows: their host is unreachable, unless they are hosted. */\nfunction listed(seen: Set): Listing[] {\n\treturn directory.read().channels.filter((value) => !seen.has(value.id) && value.host !== name)\n\t\t.map((value) =>\n\t\t\tObject.assign({}, value, {\n\t\t\t\tstate: value.state === \"archived\" || value.hosted ? value.state : \"offline\" as const,\n\t\t\t\t// The directory is a cache, not a live connection, even for hosted channels.\n\t\t\t\tbusy: false,\n\t\t\t})\n\t\t);\n}\n\nfunction listings(client: Client): Listing[] {\n\tif (client.peer) return local();\n\tconst reachable = [...local(), ...peers.listings()];\n\treturn [...reachable, ...listed(new Set(reachable.map((value) => value.id)))];\n}\n\nconst sockets = new Set>();\n\nfunction broadcast() {\n\tfor (const socket of sockets) {\n\t\tsocket.send(JSON.stringify({ channels: listings(socket.data) } satisfies HostFrame));\n\t}\n\tpeopleChanged();\n}\n\n/** Fresher sources win: the directory, then reachable peers, then this host's own owner. */\nfunction people(): People {\n\tconst known: People = {};\n\tfor (const host of directory.read().hosts) if (host.github) known[host.login] = host.github;\n\tObject.assign(known, peers.people());\n\tconst own = github.login(peopleChanged);\n\tif (own) known[catalog.user] = own;\n\treturn known;\n}\n\nlet sent = \"\";\n\nfunction peopleChanged(): void {\n\tconst frame = JSON.stringify({ people: people() } satisfies HostFrame);\n\tif (frame === sent) return;\n\tsent = frame;\n\tfor (const socket of sockets) if (!socket.data.peer) socket.send(frame);\n}\n\nfunction projectsChanged(): void {\n\tconst frame = JSON.stringify({ projects: projects.list() } satisfies HostFrame);\n\tfor (const socket of sockets) if (!socket.data.peer) socket.send(frame);\n}\n\nfunction settingsChanged(): void {\n\tfor (const socket of sockets) {\n\t\tif (!socket.data.peer) socket.send(JSON.stringify({ settings: true } satisfies HostFrame));\n\t}\n}\n\nfunction connection(client: Client, channel: string, hosted?: string): Promise {\n\tlet open = client.channels.get(channel);\n\tif (!open) {\n\t\topen = hosted ? Connection.hosted(hosted, channel) : Connection.open(channel);\n\t\tclient.channels.set(channel, open);\n\t\t// A released connection can close after its replacement opened; never drop the replacement.\n\t\tconst drop = () => {\n\t\t\tif (client.channels.get(channel) === open) client.channels.delete(channel);\n\t\t};\n\t\topen.then((connection) => connection.closed.then(drop), drop);\n\t}\n\treturn open;\n}\n\nasync function remote(client: Client, host: string): Promise {\n\tlet open = client.remotes.get(host);\n\tif (!open) {\n\t\tconst machine = peers.machine(host);\n\t\tif (!machine) throw new Error(`${host} is not reachable`);\n\t\topen = new GatewayClient(peers.url(machine));\n\t\tclient.remotes.set(host, open);\n\t}\n\tfor (let waited = 0; open.status !== \"open\"; waited += 50) {\n\t\tif (waited >= 5000) throw new Error(`${host} is not reachable`);\n\t\tawait Bun.sleep(50);\n\t}\n\treturn open;\n}\n\nconst owned = new Set([\"archive\", \"archive-inactive\", \"delete\"]);\nconst windowOps = new Set([\"window\", \"windows\", \"tab-rename\", \"tab-result\"]);\nconst localOps = new Set([\n\t\"projects\",\n\t\"project-open\",\n\t\"github-list\",\n\t\"github-detail\",\n\t\"github-files\",\n\t\"github-pull\",\n\t\"settings\",\n\t\"diagnostics\",\n\t\"key-set\",\n\t\"key-check\",\n\t\"key-remove\",\n\t\"preferences\",\n\t\"update-prepare\",\n\t\"update-cancel\",\n\t// A terminal is a shell as this host's user, so only its owner opens one.\n\t\"terminal\",\n\t\"terminal-input\",\n\t\"terminal-resize\",\n\t\"terminal-close\",\n]);\n\nasync function handle(\n\tsocket: ServerWebSocket,\n\trequest: HostRequest,\n\tsend: (frame: HostFrame) => void,\n\tid: number,\n\ttrace: string,\n): Promise {\n\tif (closing) throw new Error(\"Ace Helper is shutting down\");\n\tconst client = socket.data;\n\tif (windowOps.has(request.op) && (!client.local || client.user !== catalog.user)) {\n\t\tthrow new Error(\"Tabs are only available through this host's authenticated local gateway\");\n\t}\n\tif (localOps.has(request.op) && (client.peer || client.user !== catalog.user)) {\n\t\tthrow new Error(\"This action is only available from this host's local app\");\n\t}\n\tif (!client.local && (request.op === \"update-prepare\" || request.op === \"update-cancel\")) {\n\t\tthrow new Error(\"Desktop updates are only available from this host's local app\");\n\t}\n\tif (updating && request.op !== \"update-cancel\") {\n\t\tthrow new Error(\"Ace is pausing this machine's channels to install an update\");\n\t}\n\t// A channel runs where it was created, so even its owner creates from that machine.\n\tif (client.peer && request.op === \"create\") {\n\t\tthrow new Error(\"Create channels from the host that will run them\");\n\t}\n\tif (owned.has(request.op) && client.user !== catalog.user) {\n\t\tthrow new Error(\"Only this host's owner can do that\");\n\t}\n\tswitch (request.op) {\n\t\tcase \"window\":\n\t\t\treturn windows.publish(socket, request.value);\n\t\tcase \"windows\":\n\t\t\treturn windows.list();\n\t\tcase \"tab-rename\":\n\t\t\treturn windows.rename(request);\n\t\tcase \"tab-result\":\n\t\t\treturn windows.result(socket, request.call, request.result);\n\t\tcase \"update-prepare\": {\n\t\t\tif (!config.helper) throw new Error(\"Only Ace Helper can prepare a desktop update\");\n\t\t\tconst current = ++update;\n\t\t\tupdating = true;\n\t\t\t// handle() starts before this request enters pending, so it cannot await itself.\n\t\t\tawait Promise.allSettled(pending);\n\t\t\t// A timed-out desktop request can be canceled while an older request is still draining.\n\t\t\tif (current !== update) throw new Error(\"The update was canceled\");\n\t\t\tconst stopping = Promise.allSettled([workspace.close(), shutdown(), terminals.closeAll()]);\n\t\t\tsuspending = stopping;\n\t\t\ttry {\n\t\t\t\tconst results = await stopping;\n\t\t\t\tconst errors = results.filter((result) => result.status === \"rejected\");\n\t\t\t\tif (errors.length) {\n\t\t\t\t\tthrow new AggregateError(\n\t\t\t\t\t\terrors.map((result) => result.reason),\n\t\t\t\t\t\t\"Some work could not be paused for the update\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (current !== update) throw new Error(\"The update was canceled\");\n\t\t\t} finally {\n\t\t\t\tsuspending = undefined;\n\t\t\t}\n\t\t\treturn { ready: true };\n\t\t}\n\t\tcase \"update-cancel\":\n\t\t\tif (updating) {\n\t\t\t\tupdate++;\n\t\t\t\tif (suspending) await Promise.allSettled([suspending]);\n\t\t\t\tawait resume();\n\t\t\t\tworkspace.sync();\n\t\t\t\tupdating = false;\n\t\t\t}\n\t\t\treturn;\n\t\tcase \"hello\":\n\t\t\treturn { user: client.user, host: name, github: github.login(peopleChanged) };\n\t\tcase \"channels\":\n\t\t\treturn listings(client);\n\t\tcase \"projects\":\n\t\t\treturn projects.list();\n\t\tcase \"project-open\": {\n\t\t\tconst project = projects.open(request.path);\n\t\t\tprojectsChanged();\n\t\t\treturn project;\n\t\t}\n\t\tcase \"project-repo\": {\n\t\t\tif (request.host && request.host !== name && !client.peer) {\n\t\t\t\treturn (await remote(client, request.host)).request(\n\t\t\t\t\t{\n\t\t\t\t\t\top: \"project-repo\",\n\t\t\t\t\t\tproject: request.project,\n\t\t\t\t\t},\n\t\t\t\t\tundefined,\n\t\t\t\t\ttrace,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst known = client.peer\n\t\t\t\t? catalog.list().some((channel) =>\n\t\t\t\t\tprojects.checkout(channel.project).root === request.project\n\t\t\t\t)\n\t\t\t\t: projects.list().some((project) => project.path === request.project);\n\t\t\tif (!known) throw new Error(\"Open this project in Ace first\");\n\t\t\treturn github.project(request.project);\n\t\t}\n\t\tcase \"github-list\":\n\t\t\treturn github.list(request);\n\t\tcase \"github-detail\":\n\t\t\treturn github.detail(request);\n\t\tcase \"github-files\":\n\t\t\treturn github.files(request.repo, request.number);\n\t\tcase \"github-pull\":\n\t\t\treturn github.pull(request.repo, request.branch);\n\t\tcase \"settings\":\n\t\t\treturn settings();\n\t\tcase \"diagnostics\":\n\t\t\treturn diagnostics();\n\t\tcase \"key-set\":\n\t\t\tawait setKey(request.provider, request.value);\n\t\t\treturn settingsChanged();\n\t\tcase \"key-check\":\n\t\t\treturn checkKey(request.provider);\n\t\tcase \"key-remove\":\n\t\t\tawait removeKey(request.provider);\n\t\t\treturn settingsChanged();\n\t\tcase \"preferences\":\n\t\t\tawait setModel(request.model);\n\t\t\treturn settingsChanged();\n\t\tcase \"models\":\n\t\t\tif (request.host && request.host !== name && !client.peer) {\n\t\t\t\treturn (await remote(client, request.host)).request({ op: \"models\" });\n\t\t\t}\n\t\t\treturn models();\n\t\tcase \"create\": {\n\t\t\tconst record = catalog.create(\n\t\t\t\tproject(request.project),\n\t\t\t\trequest.model,\n\t\t\t\trequest.name || undefined,\n\t\t\t);\n\t\t\tbroadcast();\n\t\t\treturn record;\n\t\t}\n\t\tcase \"archive\":\n\t\t\tif (request.archived) terminals.closeChannel(request.channel);\n\t\t\tawait archive(request.channel, request.archived);\n\t\t\treturn broadcast();\n\t\tcase \"archive-inactive\": {\n\t\t\tconst archived = await archiveInactive(request.project);\n\t\t\tfor (const channel of archived) terminals.closeChannel(channel);\n\t\t\tbroadcast();\n\t\t\treturn archived.length;\n\t\t}\n\t\tcase \"delete\":\n\t\t\tterminals.closeChannel(request.channel);\n\t\t\tawait remove(request.channel);\n\t\t\treturn broadcast();\n\t\tcase \"terminal\": {\n\t\t\tif (!catalog.owns(request.channel)) throw new Error(\"Terminals open on the channel's host\");\n\t\t\tconst { opened, attach } = await terminals.open(request);\n\t\t\tclient.terminals.get(opened.terminal)?.();\n\t\t\t// After the reply, which is sent once this returns and its microtasks settle.\n\t\t\tsetTimeout(() => {\n\t\t\t\tif (socket.readyState === 1) client.terminals.set(opened.terminal, attach(send));\n\t\t\t});\n\t\t\treturn opened;\n\t\t}\n\t\tcase \"terminal-input\":\n\t\t\treturn terminals.input(request.terminal, request.data);\n\t\tcase \"terminal-resize\":\n\t\t\treturn terminals.resize(request.terminal, request.cols, request.rows);\n\t\tcase \"terminal-close\":\n\t\t\tclient.terminals.delete(request.terminal);\n\t\t\treturn terminals.close(request.terminal);\n\t\tcase \"channel\": {\n\t\t\t// Only a watch streams; other requests must not leave watchers behind in relays.\n\t\t\tconst watch: Watch | undefined = request.request.op === \"watch\"\n\t\t\t\t? {\n\t\t\t\t\tevent: (event) => send({ id, event }),\n\t\t\t\t\t// After the accepted reply, a failure for the same id tells the client its watch ended.\n\t\t\t\t\tclosed: (error) => {\n\t\t\t\t\t\tlog(\"debug\", \"gateway.watch.closed\", {\n\t\t\t\t\t\t\ttrace,\n\t\t\t\t\t\t\tuser: client.user,\n\t\t\t\t\t\t\tpeer: client.peer,\n\t\t\t\t\t\t\tchannel: request.channel,\n\t\t\t\t\t\t\terror,\n\t\t\t\t\t\t});\n\t\t\t\t\t\tsend({ id, ok: false, error });\n\t\t\t\t\t},\n\t\t\t\t}\n\t\t\t\t: undefined;\n\t\t\tif (catalog.owns(request.channel)) {\n\t\t\t\tif (request.request.op === \"kill\") {\n\t\t\t\t\tif (client.user !== catalog.user) throw new Error(\"Only the channel's owner can kill it\");\n\t\t\t\t\tterminals.closeChannel(request.channel);\n\t\t\t\t}\n\t\t\t\tconst forwarded = \"author\" in request.request\n\t\t\t\t\t? { ...request.request, author: client.user }\n\t\t\t\t\t: request.request;\n\t\t\t\tconst target = await connection(client, request.channel);\n\t\t\t\treturn target.request(forwarded, watch, trace);\n\t\t\t}\n\t\t\tconst machine = !client.peer && peers.find(request.channel);\n\t\t\tconst hosted = !client.peer && !machine\n\t\t\t\t&& directory.read().channels.find((value) => value.id === request.channel && value.hosted);\n\t\t\tif (hosted) {\n\t\t\t\tif (request.request.op === \"kill\" && client.user !== hosted.owner) {\n\t\t\t\t\tthrow new Error(\"Only the channel's owner can kill it\");\n\t\t\t\t}\n\t\t\t\tconst forwarded = \"author\" in request.request\n\t\t\t\t\t? { ...request.request, author: client.user }\n\t\t\t\t\t: request.request;\n\t\t\t\tconst target = await connection(client, request.channel, hosted.hosted);\n\t\t\t\treturn target.request(forwarded, watch, trace);\n\t\t\t}\n\t\t\tif (!machine) throw new Error(\"No reachable host runs that channel\");\n\t\t\tconst target = await remote(client, machine.name);\n\t\t\treturn target.channel(request.channel, request.request, watch, trace);\n\t\t}\n\t\tcase \"release\": {\n\t\t\tconst open = client.channels.get(request.channel);\n\t\t\tclient.channels.delete(request.channel);\n\t\t\tif (open) return void (await open).close();\n\t\t\tconst machine = peers.find(request.channel);\n\t\t\tconst target = machine && client.remotes.get(machine.name);\n\t\t\tif (target?.status === \"open\") await target.request(request);\n\t\t\treturn;\n\t\t}\n\t}\n}\n\nfunction websocket(): Bun.WebSocketHandler {\n\treturn {\n\t\topen(socket) {\n\t\t\tsockets.add(socket);\n\t\t\tlog(\"info\", \"gateway.open\", { user: socket.data.user, peer: socket.data.peer });\n\t\t\tif (!socket.data.peer) {\n\t\t\t\tsocket.send(JSON.stringify({ projects: projects.list() } satisfies HostFrame));\n\t\t\t\tsocket.send(JSON.stringify({ people: people() } satisfies HostFrame));\n\t\t\t}\n\t\t},\n\t\tasync message(socket, raw) {\n\t\t\tconst { id, trace: given, ...request } = JSON.parse(String(raw)) as HostEnvelope;\n\t\t\t// A peer host's trace continues here, so one request reads across both machines' logs.\n\t\t\tconst trace = given || crypto.randomUUID().slice(0, 8);\n\t\t\tconst send = (frame: HostFrame) =>\n\t\t\t\tsocket.readyState === 1 && socket.send(JSON.stringify(frame));\n\t\t\tconst start = Date.now();\n\t\t\tconst fields = {\n\t\t\t\ttrace,\n\t\t\t\tuser: socket.data.user,\n\t\t\t\tpeer: socket.data.peer,\n\t\t\t\top: request.op,\n\t\t\t\t...(\"channel\" in request ? { channel: request.channel } : {}),\n\t\t\t\t...(request.op === \"channel\" ? { request: request.request.op } : {}),\n\t\t\t};\n\t\t\t// Listing and watching repeat constantly; everything else is a deliberate action.\n\t\t\tconst quiet = request.op === \"channels\" || request.op === \"projects\"\n\t\t\t\t|| request.op === \"window\" || request.op === \"windows\" || request.op === \"tab-result\"\n\t\t\t\t|| request.op === \"hello\" || request.op === \"models\"\n\t\t\t\t|| request.op === \"release\" || request.op === \"terminal-input\"\n\t\t\t\t|| request.op === \"terminal-resize\"\n\t\t\t\t|| (request.op === \"channel\" && [\"watch\", \"info\", \"models\"].includes(request.request.op));\n\t\t\tconst handling = handle(socket, request, send, id, trace);\n\t\t\tpending.add(handling);\n\t\t\ttry {\n\t\t\t\tconst value = await handling;\n\t\t\t\tlog(quiet ? \"debug\" : \"info\", \"gateway.request\", { ...fields, ms: Date.now() - start });\n\t\t\t\tsend({ id, ok: true, value: value ?? null });\n\t\t\t} catch (error) {\n\t\t\t\tlog(\"warn\", \"gateway.failed\", { ...fields, ms: Date.now() - start, ...failure(error) });\n\t\t\t\tsend({ id, ok: false, error: error instanceof Error ? error.message : String(error) });\n\t\t\t} finally {\n\t\t\t\tpending.delete(handling);\n\t\t\t}\n\t\t},\n\t\tclose(socket, code) {\n\t\t\tsockets.delete(socket);\n\t\t\twindows.drop(socket);\n\t\t\tlog(\"info\", \"gateway.close\", { user: socket.data.user, peer: socket.data.peer, code });\n\t\t\tfor (const open of socket.data.channels.values()) {\n\t\t\t\topen.then((connection) => connection.close(), () => {});\n\t\t\t}\n\t\t\tfor (const remote of socket.data.remotes.values()) remote.close();\n\t\t\tfor (const detach of socket.data.terminals.values()) detach();\n\t\t},\n\t};\n}\n\nfunction client(user: string, peer: boolean, local = false): Client {\n\treturn { user, peer, local, channels: new Map(), remotes: new Map(), terminals: new Map() };\n}\n\nasync function serveApp(url: URL): Promise {\n\tconst dir = config.app;\n\tif (!existsSync(dir)) {\n\t\treturn new Response(\"The app is not built; run bun app build\", { status: 404 });\n\t}\n\tconst file = Bun.file(join(dir, url.pathname));\n\tconst headers = {\n\t\t\"Content-Security-Policy\": \"frame-ancestors 'none'; object-src 'none'; base-uri 'none'\",\n\t\t\"Referrer-Policy\": \"no-referrer\",\n\t\t\"X-Content-Type-Options\": \"nosniff\",\n\t};\n\tif (url.pathname !== \"/\" && !url.pathname.includes(\"..\") && await file.exists()) {\n\t\treturn new Response(file, { headers });\n\t}\n\treturn new Response(Bun.file(join(dir, \"index.html\")), { headers });\n}\n\n/** The owner's listener: loopback only, serving the app. */\nfunction owner(port: number): Server {\n\tconst access = auth.owner(port);\n\treturn Bun.serve({\n\t\tport,\n\t\thostname: \"127.0.0.1\",\n\t\tasync fetch(request, server) {\n\t\t\tif (!access.accepts(request)) return new Response(\"Forbidden\", { status: 403 });\n\t\t\tconst url = new URL(request.url);\n\t\t\tif (url.pathname === \"/health\") {\n\t\t\t\tconst challenge = request.headers.get(\"x-ace-challenge\");\n\t\t\t\tif (challenge && !/^[a-f0-9]{64}$/.test(challenge)) {\n\t\t\t\t\treturn new Response(\"Bad challenge\", { status: 400 });\n\t\t\t\t}\n\t\t\t\tconst info: HostInfo = {\n\t\t\t\t\tapp: \"ace\",\n\t\t\t\t\tprotocol: HOST_PROTOCOL,\n\t\t\t\t\thome: catalog.home,\n\t\t\t\t\tpid: process.pid,\n\t\t\t\t\thelper: config.helper,\n\t\t\t\t};\n\t\t\t\treturn Response.json(info, {\n\t\t\t\t\theaders: challenge ? { \"x-ace-proof\": access.proof(info, challenge) } : undefined,\n\t\t\t\t});\n\t\t\t}\n\t\t\tif (url.pathname === \"/ws\") {\n\t\t\t\tif (!access.authorizes(request)) return new Response(\"Unauthorized\", { status: 401 });\n\t\t\t\tconst protocols = request.headers.get(\"sec-websocket-protocol\")?.split(\",\").map((value) =>\n\t\t\t\t\tvalue.trim()\n\t\t\t\t);\n\t\t\t\treturn server.upgrade(request, {\n\t\t\t\t\t\tdata: client(catalog.user, false, true),\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\"set-cookie\": access.cookie,\n\t\t\t\t\t\t\t...(protocols?.includes(\"ace\") ? { \"sec-websocket-protocol\": \"ace\" } : {}),\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t\t? undefined\n\t\t\t\t\t: new Response(\"Upgrade failed\", { status: 400 });\n\t\t\t}\n\t\t\treturn serveApp(url);\n\t\t},\n\t\twebsocket: websocket(),\n\t});\n}\n\n/**\n * The team's listener on this machine's tailnet address. Tailscale names the person behind each\n * connection. Sockets without an Origin are peer hosts. Browser sockets are the owner's own\n * devices, and only from a page this host or the configured web app served (see web.ts).\n */\nfunction team(machine: Machine, listener: web.Listener, tls?: Bun.TLSOptions): Server {\n\tconst hosts = web.hosts(machine, listener);\n\treturn Bun.serve({\n\t\tport: listener.port,\n\t\thostname: machine.address,\n\t\t...(tls ? { tls } : {}),\n\t\tasync fetch(request, server) {\n\t\t\tconst url = new URL(request.url);\n\t\t\tconst origin = request.headers.get(\"origin\");\n\t\t\tif (url.pathname !== \"/ws\") {\n\t\t\t\tif (request.method !== \"GET\" || !hosts.has(request.headers.get(\"host\") ?? \"\")) {\n\t\t\t\t\treturn new Response(\"Not found\", { status: 404 });\n\t\t\t\t}\n\t\t\t\treturn serveApp(url);\n\t\t\t}\n\t\t\tif (origin === null ? listener.secure : !web.origins(machine, listener).has(origin)) {\n\t\t\t\treturn new Response(\"Forbidden\", { status: 403 });\n\t\t\t}\n\t\t\tconst ip = server.requestIP(request);\n\t\t\tif (!ip) return new Response(\"Forbidden\", { status: 403 });\n\t\t\tlet user: string;\n\t\t\ttry {\n\t\t\t\tuser = await whois(ip.address, ip.port);\n\t\t\t} catch (error) {\n\t\t\t\tlog(\"warn\", \"gateway.whois\", { address: ip.address, ...failure(error) });\n\t\t\t\treturn new Response(\"Forbidden\", { status: 403 });\n\t\t\t}\n\t\t\tconst browser = origin !== null;\n\t\t\tif (browser && user !== catalog.user) {\n\t\t\t\tlog(\"warn\", \"gateway.browser.refused\", { user, origin });\n\t\t\t\treturn new Response(\"Open Ace from your own host\", { status: 403 });\n\t\t\t}\n\t\t\treturn server.upgrade(request, { data: client(user, !browser) })\n\t\t\t\t? undefined\n\t\t\t\t: new Response(\"Upgrade failed\", { status: 400 });\n\t\t},\n\t\twebsocket: websocket(),\n\t});\n}\n\nexport async function serve(port: number): Promise {\n\tconfig.port = port;\n\t// Hosted channels run tools in this process.\n\tseal();\n\topenLog(\"host\");\n\tawait resume();\n\tconst server = owner(port);\n\tlog(\"info\", \"host.start\", { port: server.port, user: catalog.user, bun: Bun.version });\n\tconst servers = [server];\n\tconst cleanup: (() => void)[] = [];\n\tasync function stop() {\n\t\tif (closing) return;\n\t\tclosing = true;\n\t\tlog(\"info\", \"host.stop\", { pending: pending.size });\n\t\tfor (const close of cleanup) close();\n\t\tawait Promise.allSettled(servers.map((server) => server.stop(true)));\n\t\tawait Promise.allSettled(pending);\n\t\tconst results = await Promise.allSettled([workspace.close(), shutdown(), terminals.closeAll()]);\n\t\tfor (const result of results) {\n\t\t\tif (result.status === \"rejected\") {\n\t\t\t\tlog(\"error\", \"host.shutdown.failed\", failure(result.reason));\n\t\t\t}\n\t\t}\n\t\tprocess.exit(results.some((result) => result.status === \"rejected\") ? 1 : 0);\n\t}\n\tprocess.on(\"SIGTERM\", () => void stop());\n\tprocess.on(\"SIGINT\", () => void stop());\n\tconsole.log(`Ace on http://${server.hostname}:${server.port}`);\n\tconst machine = await self();\n\tif (closing) return new Promise(() => {});\n\tif (machine) name = machine.name;\n\tconst address = machine ? { address: machine.address } : {};\n\tconst publish = directory.watch(\n\t\t() => ({ name, login: catalog.user, github: github.login(peopleChanged), ...address }),\n\t\tlocal,\n\t\tbroadcast,\n\t);\n\tlog(\"info\", \"host.tailnet\", machine ? { name, address: machine.address } : { tailscale: false });\n\tcleanup.push(publish.stop);\n\tif (machine) {\n\t\tservers.push(team(machine, { port, secure: false }));\n\t\tconsole.log(`Sharing with the tailnet on ${machine.address}:${port} as ${machine.login}`);\n\t\tconsole.log(`Your devices can open http://${machine.dns}:${port}`);\n\t\tcleanup.push(peers.watch(broadcast));\n\t\tconst tls = await web.tls(machine);\n\t\tif (tls && !closing) {\n\t\t\tconst listener = { port: config.webPort ?? port + 1000, secure: true };\n\t\t\tservers.push(team(machine, listener, tls));\n\t\t\tconsole.log(`and https://${machine.dns}:${listener.port}`);\n\t\t}\n\t} else {\n\t\tconsole.log(\"Tailscale is not running; channels stay on this machine\");\n\t}\n\tmkdirSync(join(catalog.home, \"channels\"), { recursive: true });\n\t// Workers create and remove their sockets; tell clients when a channel starts or retires.\n\tconst watcher = watch(join(catalog.home, \"channels\"), { recursive: true }, (_, file) => {\n\t\tif (closing || updating) return;\n\t\tif (file?.endsWith(\"channel.sock\") || file?.endsWith(\"channel.json\")) broadcast();\n\t\tif (file?.endsWith(\"channel.json\")) {\n\t\t\tprojectsChanged();\n\t\t\tworkspace.sync();\n\t\t\tvoid publish.sync();\n\t\t}\n\t});\n\tcleanup.push(() => watcher.close());\n\t// A crashed worker leaves its socket and projection behind without a filesystem event.\n\t// Probe only process liveness: sidebar observation must never attach to or wake a worker.\n\tlet crashed = new Set();\n\tconst liveness = setInterval(() => {\n\t\tif (closing || updating) return;\n\t\tconst current = new Set();\n\t\tfor (const record of catalog.list()) {\n\t\t\tif (!record.hosted && record.busy && !isWorkerAlive(record.id)) current.add(record.id);\n\t\t}\n\t\t// Do not overwrite a replacement worker's projection after observing its predecessor die.\n\t\tif (current.size !== crashed.size || [...current].some((id) => !crashed.has(id))) broadcast();\n\t\tcrashed = current;\n\t}, 5000);\n\tcleanup.push(() => clearInterval(liveness));\n\tworkspace.sync();\n\treturn new Promise(() => {});\n}\n","editable",false,"branch","documentNavigation","repo","githubnext/ace2","repoId","938fe4cd-5320-4e4f-ac7c-87d4dad8490c","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[226,227,228,229,230,231,232,233,234,235,236,237,238],"navigation",{"_54":55,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193},"sources",[],"viewer","meta",{"_174":175,"_176":177,"_178":179,"_42":31,"_180":166,"_181":31,"_48":49,"_50":49},"branches",[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173],"tags",[69,70,71,72,73,74,75,76,77,78,79,80],"cloneUrl","https://git.nexthub.sh/githubnext/ace2.git","desktop-canary-v0.0.10","desktop-canary-v0.0.11","desktop-canary-v0.0.12","desktop-canary-v0.0.13","desktop-canary-v0.0.14","desktop-canary-v0.0.15","desktop-canary-v0.0.16","desktop-canary-v0.0.18","desktop-canary-v0.0.21","desktop-canary-v0.0.7","desktop-canary-v0.0.8","desktop-canary-v0.0.9","amber-beacon/composer-effort","brisk-ember/github-avatars","brisk-grove/image-paste-91","calm-anchor/fix-streaming-draft-overlap","calm-grove/composer-agent-mode","cloud-pilot-ops/canary-0-0-17","cloud-pilot-ops/cloud-move","cloud-pilot-ops/cloud-pilot","codex/agentation-shortcut","codex/annotation-polish","codex/browser-pages","codex/canary-0-0-21","codex/canary-0.0.11","codex/channel-delete-close","codex/channel-watch-recovery","codex/clipboard-files-write","codex/composer-coordinate-check","codex/computer-use-validation","codex/desktop-actions","codex/desktop-app-search","codex/desktop-app-state","codex/desktop-availability","codex/desktop-click-variants","codex/desktop-clipboard","codex/desktop-clipboard-files","codex/desktop-clipboard-image","codex/desktop-clipboard-image-write","codex/desktop-clipboard-text","codex/desktop-drag","codex/desktop-keyboard","codex/desktop-launch","codex/desktop-locked-feedback","codex/desktop-menu-command","codex/desktop-menu-inventory","codex/desktop-minimize","codex/desktop-open","codex/desktop-pointer","codex/desktop-quit","codex/desktop-selection-keys","codex/desktop-tool-guidance","codex/desktop-tools-extraction","codex/desktop-window-close","codex/desktop-window-geometry","codex/desktop-windows","codex/dev-permission-identity","codex/durable-composer-drafts","codex/fix-message-clipping","codex/lane-base-96","codex/native-patch-prefix","codex/peekaboo","codex/peer-channel-messaging","codex/pixel-snapshot-authority","codex/publish-canary-0-0-21","codex/readme-security","codex/settings-refresh","codex/stale-click-refusal","codex/tab-renaming-api","codex/team-agent-access","codex/team-channel-sections","codex/team-dogfood-integration","codex/webkit-coordinate-window","codex/webkit-desktop-focus","deft-beacon/helper-isolation","deft-grove/align-avatar-byline","deft-grove/build-canary-0-0-18","deft-grove/canary-github-releases","deft-grove/ship-canary-0-0-18","deft-meadow/details-sidebar","fair-ember/canary-0-0-13","fair-ember/canary-0-0-14","fair-fjord/all-projects","feat/github-cache","feat/rebuild","fix/channel-credentials","glad-anchor/restore-message-queue","glad-ember/archive-inactive-channels","glad-fjord/project-identity","glad-orbit/channel-progress","glad-ridge/terminal-replay-input","hazy-anchor/github-row-actions","hazy-ember/channel-access-toggles","hazy-grove/all-projects-add-channel","local-project-setup/build-canary-0-0-20","local-project-setup/canary-0-0-20","local-project-setup/local-project-setup","main","mellow-ridge/canary-0-0-16","mellow-ridge/top-bar-drag-area","nimble-cedar/modal-top-offset","nimble-meadow/canary-0-0-15","remote-channel-load/build-canary-0-0-19","remote-channel-load/canary-0-0-19","remote-channel-load/fix-remote-channel-load","description","Ace: a collaborative coding environment on the team's own machines","owner","githubnext","section","","head","empty","pins",[208,209,210],"documents",{"_203":204,"_205":206},"code",{"_199":200,"_201":202},"automations",{"_196":197,"_198":-5},"delivery",{"_194":49,"_195":-5},"tag","9Rn62lcgXCFfpmCuooTjLxGyUf8","releases","applications","workflows",2,"deployments","commits",215,"changes",1,"counts",{"_207":206},"total",86,"issue",{"_211":201,"_213":224,"_15":201,"_215":225,"_52":217,"_218":31,"_219":217,"_220":202},{"_211":221,"_213":222,"_15":221,"_215":223,"_52":217,"_218":31,"_219":217,"_220":49},{"_211":212,"_213":214,"_15":212,"_215":216,"_52":217,"_218":31,"_219":217,"_220":206},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_211":201,"_213":224,"_15":201,"_215":269,"_52":217,"_218":31,"_219":217},{"_211":221,"_213":222,"_15":221,"_215":268,"_52":217,"_218":31,"_219":217},{"_211":212,"_213":214,"_15":212,"_215":267,"_52":217,"_218":31,"_219":217},{"_211":264,"_213":265,"_15":264,"_215":266,"_52":31,"_218":31,"_219":217},{"_211":261,"_213":262,"_15":261,"_215":263,"_52":31,"_218":31,"_219":217},{"_211":196,"_213":259,"_15":188,"_215":260,"_52":31,"_218":31,"_219":217},{"_211":198,"_213":256,"_15":257,"_215":258,"_52":31,"_218":31,"_219":217},{"_211":194,"_213":254,"_15":194,"_215":255,"_52":31,"_218":31,"_219":217},{"_211":250,"_213":251,"_15":252,"_215":253,"_52":31,"_218":31,"_219":217},{"_211":184,"_213":248,"_15":184,"_215":249,"_52":31,"_218":31,"_219":31},{"_211":245,"_213":246,"_15":245,"_215":247,"_52":31,"_218":31,"_219":31},{"_211":242,"_213":243,"_15":242,"_215":244,"_52":31,"_218":31,"_219":31},{"_211":239,"_213":240,"_15":239,"_215":241,"_52":31,"_218":31,"_219":31},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794498823881,"sidebar","expanded"]