07bcbf0c08
Wire the SecureEnclave enroll library into a real flow (login->bearer->CSR->
/device/enroll->keychain identity), presented on the existing mTLS path; add a
rotation scheduler. Atomic keychain replace (add-before-delete); renew body is
{csr}-only; renewal-failing surfaced in the UI. ClientTLS 48 tests pass.
376 lines
16 KiB
Swift
376 lines
16 KiB
Swift
import ClientTLS
|
||
import Foundation
|
||
import HostRegistry
|
||
import Observation
|
||
import SwiftUI
|
||
import WireProtocol
|
||
|
||
/// T-iOS-15 · Navigation + lifecycle owner: Pairing → SessionList → Terminal
|
||
/// with the production dependency graph (plan §7 T-iOS-15 step 1).
|
||
///
|
||
/// - Cold start: read the host store once — no paired host → Pairing, else
|
||
/// SessionList (`ColdStartPolicy.initialRoute`).
|
||
/// - `SessionListScreen.onOpen` → build ONE `TerminalSessionController`
|
||
/// (single foreground session, plan §1) and push the terminal.
|
||
/// - Back → `closeTerminal()` → `engine.close()` (detach; PTY keeps running).
|
||
/// - scenePhase is forwarded to the open controller (`.background` →
|
||
/// suspend/close, `.active` → resume/rebuild). The privacy shade is view
|
||
/// layer (RootView + PrivacyShadePolicy), not coordinator state.
|
||
@MainActor
|
||
@Observable
|
||
final class AppCoordinator {
|
||
private(set) var route: ColdStartPolicy.RootRoute = .loading
|
||
private(set) var terminalController: TerminalSessionController?
|
||
/// First-run pairing VM (root route). Recreated per entry to keep pairing
|
||
/// state machines single-shot.
|
||
private(set) var rootPairingViewModel: PairingViewModel?
|
||
/// Add-host pairing VM (sheet from the list header).
|
||
private(set) var addHostPairingViewModel: PairingViewModel?
|
||
var isAddHostPresented = false
|
||
/// T-iOS-26 · Projects sheet（入口在 RootView 的 toolbar —— 不碰
|
||
/// `SessionListScreen`，该文件 W7 内归 T-iOS-23）。每次呈现新建 VM，
|
||
/// prefs 每次进入都重新拉取。
|
||
private(set) var projectsViewModel: ProjectsViewModel?
|
||
var isProjectsPresented = false
|
||
/// C-iOS-3 (HIGH reachability fix) · "设备证书" sheet (import / rotate the
|
||
/// mTLS device cert via `ClientCertScreen`). No VM state — the screen owns
|
||
/// its own `ClientCertViewModel` over the keychain store; dismissal needs no
|
||
/// refresh because the transports resolve the identity lazily per connection.
|
||
var isDeviceCertPresented = false
|
||
/// B3 · "自动获取证书" sheet — the zero-`.p12` enrollment flow
|
||
/// (`EnrollmentScreen`): one login → Secure-Enclave key + CSR → device cert,
|
||
/// presented automatically on the existing mTLS path. VM built per entry.
|
||
var isEnrollmentPresented = false
|
||
private(set) var enrollmentViewModel: EnrollmentViewModel?
|
||
/// B3 · Re-entrancy guard so overlapping foregrounds never launch two silent
|
||
/// renews at once (a shared PTY-style single-flight for the rotation pass).
|
||
@ObservationIgnored private var isRotating = false
|
||
/// B3 (HIGH observability fix) · Persistent, OBSERVABLE flag: the last silent
|
||
/// rotation pass ended in `.failed` (keychain read fault or renew error). Set
|
||
/// alongside the os.Logger line so a silently-failing renewal surfaces to the
|
||
/// UI (a warning banner) instead of vanishing into the log. Cleared by the
|
||
/// next non-failed pass — a recovered renewal drops the warning automatically.
|
||
private(set) var isCertificateRenewalFailing = false
|
||
|
||
let sessionList: SessionListViewModel
|
||
@ObservationIgnored let environment: AppEnvironment
|
||
/// T-iOS-22 · Deep-link handler; all routing/wiring logic lives in
|
||
/// DeepLinkRouter.swift (incl. the `makeDeepLinkHandler` extension).
|
||
@ObservationIgnored private(set) lazy var deepLink: DeepLinkHandler = makeDeepLinkHandler()
|
||
|
||
init(environment: AppEnvironment) {
|
||
self.environment = environment
|
||
sessionList = SessionListViewModel(
|
||
hostStore: environment.hostStore,
|
||
http: environment.http,
|
||
clock: ContinuousClock(),
|
||
unreadStore: environment.unreadStore
|
||
)
|
||
}
|
||
|
||
// MARK: - Cold start
|
||
|
||
/// Decide the boot route from the host store. A store READ failure routes
|
||
/// to the session list, whose own `reloadHosts` surfaces the explicit
|
||
/// error copy (never a silent empty pairing screen hiding a broken store).
|
||
func bootstrap() async {
|
||
guard route == .loading else { return }
|
||
do {
|
||
let hosts = try await environment.hostStore.loadAll()
|
||
route = ColdStartPolicy.initialRoute(pairedHostCount: hosts.count)
|
||
} catch {
|
||
route = .sessions
|
||
}
|
||
if route == .pairing {
|
||
rootPairingViewModel = makePairingViewModel()
|
||
}
|
||
runCertificateRotationIfDue() // B3 · renew a due device cert on cold launch
|
||
await deepLink.markReady() // flush a cold-launch deep link (T-iOS-22)
|
||
}
|
||
|
||
/// First-run pairing done → move to the list (the paired host is already
|
||
/// in the store — PairingViewModel upserts before signalling).
|
||
func completeFirstPairing(_ host: HostRegistry.Host) {
|
||
rootPairingViewModel = nil
|
||
route = .sessions
|
||
Task { await sessionList.reloadHosts() }
|
||
}
|
||
|
||
// MARK: - Add-host sheet (list header hook)
|
||
|
||
func presentAddHost() {
|
||
addHostPairingViewModel = makePairingViewModel()
|
||
isAddHostPresented = true
|
||
}
|
||
|
||
func completeAddHost(_ host: HostRegistry.Host) {
|
||
isAddHostPresented = false
|
||
addHostDismissed()
|
||
}
|
||
|
||
/// Sheet gone (paired OR cancelled): drop the VM and refresh hosts — the
|
||
/// list VM keeps the active host if it still exists.
|
||
func addHostDismissed() {
|
||
addHostPairingViewModel = nil
|
||
Task { await sessionList.reloadHosts() }
|
||
}
|
||
|
||
// MARK: - Projects (T-iOS-26)
|
||
|
||
/// Toolbar 入口（RootView）：以当前活跃主机呈现 Projects sheet。
|
||
func presentProjects() {
|
||
guard let host = sessionList.activeHost else { return }
|
||
projectsViewModel = ProjectsViewModel(host: host, http: environment.http)
|
||
isProjectsPresented = true
|
||
}
|
||
|
||
/// Sheet 消失（打开会话 OR 手动关闭）：丢弃 VM。
|
||
func projectsDismissed() {
|
||
projectsViewModel = nil
|
||
}
|
||
|
||
// MARK: - Device certificate (C-iOS-3)
|
||
|
||
/// Toolbar host-menu 入口：呈现设备证书导入/轮换 sheet。
|
||
func presentDeviceCert() {
|
||
isDeviceCertPresented = true
|
||
}
|
||
|
||
// MARK: - Device enrollment (B3, zero-.p12 auto-cert)
|
||
|
||
/// Toolbar host-menu 入口：呈现「自动获取证书」注册 sheet。VM 每次进入重建。
|
||
func presentEnrollment() {
|
||
enrollmentViewModel = makeEnrollmentViewModel()
|
||
isEnrollmentPresented = true
|
||
}
|
||
|
||
/// Sheet 消失：丢弃 VM，并立刻跑一次轮换检查（刚注册完的证书据此登记续期）。
|
||
func enrollmentDismissed() {
|
||
enrollmentViewModel = nil
|
||
runCertificateRotationIfDue()
|
||
}
|
||
|
||
/// 生产 VM：登录 → 安全区生成密钥+CSR → `/device/enroll` → 存钥匙串，全部经
|
||
/// `DeviceEnrollmentFlow`（复用 ClientTLS 库，本层零加密/钥匙串逻辑）。
|
||
private func makeEnrollmentViewModel() -> EnrollmentViewModel {
|
||
let http = environment.http
|
||
return EnrollmentViewModel(
|
||
enrollOperation: { password, subdomain, deviceName, url in
|
||
try await makeDeviceEnrollmentFlow(controlPlaneURL: url, http: http)
|
||
.run(password: password, subdomain: subdomain, deviceName: deviceName)
|
||
},
|
||
loadSummary: { (try? KeychainClientIdentityStore().loadSummary()) ?? nil }
|
||
)
|
||
}
|
||
|
||
/// B3 · Silent rotation: check the installed leaf's timing and, if the renew
|
||
/// window has opened, renew over mTLS against the SAME Secure-Enclave key.
|
||
/// Fire-and-forget on launch + every foreground; single-flight via
|
||
/// `isRotating`. A `.notEnrolled` / `.notDue` pass is cheap and common.
|
||
func runCertificateRotationIfDue() {
|
||
guard !isRotating else { return }
|
||
isRotating = true
|
||
let scheduler = makeCertificateRotationScheduler(http: environment.http)
|
||
Task { [weak self] in
|
||
let outcome = await scheduler.runIfDue()
|
||
self?.isRotating = false
|
||
// Surface a silently-failing renewal as observable state (not only a
|
||
// log line); a later successful/not-due pass clears it.
|
||
self?.isCertificateRenewalFailing = (outcome == .failed)
|
||
}
|
||
}
|
||
|
||
/// "在此仓库开新会话"：关 sheet → fresh spawn（`attach(null, cwd)`）+
|
||
/// attach 后注入 `claude\r`（帧序由 engine 的 attach-first 队列保证）。
|
||
func openProject(_ request: ProjectOpenRequest) {
|
||
guard terminalController == nil else { return } // one foreground session
|
||
isProjectsPresented = false
|
||
projectsViewModel = nil
|
||
startTerminal(
|
||
host: request.host, sessionId: nil,
|
||
spawnCwd: request.cwd, bootstrapInput: request.bootstrapInput
|
||
)
|
||
}
|
||
|
||
// MARK: - Terminal open/close
|
||
|
||
/// `SessionListScreen.onOpen` (one navigation signal per tap) and the
|
||
/// "继续上次" banner both land here. `sessionId == nil` = new session.
|
||
func open(_ request: SessionListViewModel.OpenRequest) {
|
||
guard terminalController == nil else { return } // one foreground session
|
||
startTerminal(host: request.host, sessionId: request.sessionId)
|
||
}
|
||
|
||
/// 唯一的 controller 构造点（普通打开与 T-iOS-26 项目内 spawn 共用）。
|
||
private func startTerminal(
|
||
host: HostRegistry.Host,
|
||
sessionId: UUID?,
|
||
spawnCwd: String? = nil,
|
||
bootstrapInput: String? = nil
|
||
) {
|
||
let controller = TerminalSessionController(
|
||
host: host,
|
||
sessionId: sessionId,
|
||
environment: environment,
|
||
onPendingChanged: { [weak self] sessionId, pending in
|
||
self?.sessionList.setPendingApproval(sessionId: sessionId, pending: pending)
|
||
},
|
||
onTitleChanged: { [weak self] sessionId, title in
|
||
// T-iOS-23 · OSC title → list row (already sanitized in the
|
||
// VM; the list VM sanitizes once more at its own boundary).
|
||
self?.sessionList.setSessionTitle(sessionId: sessionId, title: title)
|
||
},
|
||
spawnCwd: spawnCwd,
|
||
bootstrapInput: bootstrapInput
|
||
)
|
||
terminalController = controller
|
||
controller.start()
|
||
}
|
||
|
||
/// Back navigation popped the terminal: explicit detach. Also the first
|
||
/// half of every session SWITCH (single live WS invariant, plan §1):
|
||
/// list back-nav and `openDeepLinkedSession` both close here before the
|
||
/// next `open` — one engine at a time, always close→open with replay.
|
||
func closeTerminal() {
|
||
// T-iOS-23 · leaving = seen: stamp the unread watermark for the
|
||
// adopted session so output watched in the terminal never relights
|
||
// the list dot.
|
||
if let sessionId = terminalController?.terminalViewModel.sessionId {
|
||
sessionList.markSeen(sessionId: sessionId)
|
||
}
|
||
terminalController?.teardown()
|
||
terminalController = nil
|
||
}
|
||
|
||
/// T-iPad-3 · 终端指针上下文菜单「结束会话」→ 复用既有 kill 通道
|
||
/// （`SessionListViewModel.kill` → `APIClient.killSession`，带 Origin，无新
|
||
/// 网络路径），随后 detach detail。无 adopted 会话 → no-op。
|
||
func killCurrentSession() {
|
||
guard let sessionId = terminalController?.terminalViewModel.sessionId else { return }
|
||
Task { await sessionList.kill(sessionId: sessionId) }
|
||
closeTerminal()
|
||
}
|
||
|
||
// MARK: - Split-view sidebar bridge (T-iPad-2)
|
||
|
||
/// Detail 面板当前显示的会话 → sidebar 选中态（二向绑定的 getter）。只反映
|
||
/// **adopted** 会话；未 adopted / 无打开的 detail → nil（占位「选择或新建
|
||
/// 会话」）。分栏与 stack 共享同一 `terminalController`（归 coordinator
|
||
/// 所有，与布局分支正交）。
|
||
var selectedSidebarItem: SidebarItem? {
|
||
terminalController?.terminalViewModel.sessionId.map(SidebarItem.session)
|
||
}
|
||
|
||
/// `NavigationSplitView` 的选中绑定。getter 反映 detail 会话；setter 复用
|
||
/// 既有路由（`open` / `presentProjects`）—— 分栏只是又一个触发面，绝不新开
|
||
/// 一条会话生命周期。取消选中（set nil）不主动关闭 detail。
|
||
var sidebarSelection: Binding<SidebarItem?> {
|
||
Binding(
|
||
get: { self.selectedSidebarItem },
|
||
set: { item in
|
||
guard let item else { return }
|
||
self.selectSidebarItem(item)
|
||
}
|
||
)
|
||
}
|
||
|
||
/// sidebar 触发面：把选中项映射到**同一** open(id) / open(nil) /
|
||
/// presentProjects API。切会话沿用单活 WS 不变式的 close→open（与
|
||
/// new-in-cwd / deep-link 切换同一套原语），`.projects` 走既有 sheet 呈现。
|
||
func selectSidebarItem(_ item: SidebarItem) {
|
||
switch item {
|
||
case .session(let sessionId):
|
||
switchTerminal(sessionId: sessionId)
|
||
case .newSession:
|
||
switchTerminal(sessionId: nil)
|
||
case .projects:
|
||
presentProjects()
|
||
}
|
||
}
|
||
|
||
/// 单活 WS 不变式下的会话切换：已在显示同一会话 → no-op（免无谓 churn）；
|
||
/// 否则先 `closeTerminal()`（旧会话记 last-seen 水位、engine detach）再
|
||
/// `open()`。复用既有原语，**非**平行生命周期。无 activeHost → no-op。
|
||
private func switchTerminal(sessionId: UUID?) {
|
||
guard let host = sessionList.activeHost else { return }
|
||
if let sessionId, selectedSidebarItem == .session(sessionId) { return }
|
||
if terminalController != nil { closeTerminal() }
|
||
open(SessionListViewModel.OpenRequest(id: UUID(), host: host, sessionId: sessionId))
|
||
}
|
||
|
||
// MARK: - "在当前目录开新会话" (T-iOS-29)
|
||
|
||
/// 当前终端会话的 cwd。解析次序：/live-sessions 行数据（server-adopted
|
||
/// id 匹配行，列表 VM 的最近快照）→ controller 的 `spawnCwd`（T-iOS-26
|
||
/// 项目 fresh-spawn 尚未进列表轮询）→ nil（未知）。服务器数据不可信：
|
||
/// 非绝对路径按未知处理（ProjectsViewModel 同款纪律；engine 侧还会再验）。
|
||
var currentTerminalCwd: String? {
|
||
guard let controller = terminalController else { return nil }
|
||
let fromRows = controller.terminalViewModel.sessionId.flatMap { id in
|
||
sessionList.rows.first(where: { $0.id == id })?.info.cwd
|
||
}
|
||
let candidate = fromRows ?? controller.spawnCwd
|
||
return candidate.flatMap { Validation.isAbsoluteCwd($0) ? $0 : nil }
|
||
}
|
||
|
||
/// TerminalScreen 工具栏与 exit 横幅共用动作：在当前会话的 cwd fresh
|
||
/// spawn（`attach(null, cwd)`，镜像 web tabs.ts `newTab()` M6）。单活
|
||
/// WS 不变式：先 `closeTerminal()`（旧会话记 last-seen 水位、engine
|
||
/// detach），再开新 controller。cwd 未知 → 普通新会话；无打开的终端
|
||
/// → no-op。不注入 bootstrap —— "开新 shell"不是"起 claude"。
|
||
func openNewSessionInCurrentCwd() {
|
||
guard let controller = terminalController else { return }
|
||
let host = controller.host
|
||
let cwd = currentTerminalCwd
|
||
closeTerminal()
|
||
startTerminal(host: host, sessionId: nil, spawnCwd: cwd)
|
||
}
|
||
|
||
// MARK: - "继续上次" (cold start step 5)
|
||
|
||
var continueLastSessionId: UUID? {
|
||
ColdStartPolicy.continueLastSessionId(
|
||
activeHost: sessionList.activeHost,
|
||
store: environment.lastSessionStore
|
||
)
|
||
}
|
||
|
||
func openContinueLast() {
|
||
guard let host = sessionList.activeHost, let sessionId = continueLastSessionId else {
|
||
return
|
||
}
|
||
open(SessionListViewModel.OpenRequest(id: UUID(), host: host, sessionId: sessionId))
|
||
}
|
||
|
||
// MARK: - scenePhase (plan §7 T-iOS-15 step 3)
|
||
|
||
func handleScenePhase(_ phase: ScenePhase) {
|
||
switch phase {
|
||
case .background:
|
||
terminalController?.suspend()
|
||
case .active:
|
||
terminalController?.resumeIfNeeded()
|
||
runCertificateRotationIfDue() // B3 · check for a due renewal each foreground
|
||
case .inactive:
|
||
break // transient; shade covers it at the view layer
|
||
@unknown default:
|
||
break
|
||
}
|
||
}
|
||
|
||
// MARK: - Helpers
|
||
|
||
private func makePairingViewModel() -> PairingViewModel {
|
||
PairingViewModel(store: environment.hostStore, probe: environment.probe)
|
||
}
|
||
}
|
||
|
||
/// T-iPad-2 · split 模式下 sidebar 的选中项。与现有 `AppCoordinator` 路由
|
||
/// 一一等价映射：`.session(id)` == `open(id)`、`.newSession` == `open(nil)`、
|
||
/// `.projects` == `presentProjects()`。
|
||
enum SidebarItem: Hashable {
|
||
case session(UUID)
|
||
case newSession
|
||
case projects
|
||
}
|