samagotchi 0.108.0 → 0.110.0

data/lib/samagotchi/web/tunnel/tailscale.rb

@@ -0,0 +1,325 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "../tunnel"
+require_relative "../public_url"
+require_relative "../../session"
+
+module Samagotchi
+  module Web
+    module Tunnel
+      # `chi web --tunnel tailscale`: Tailscale Serve on this machine's
+      # tailnet name, port 443 → chi web's 127.0.0.1 port, never Funnel.
+      # The identity is the Tailscale login Serve sends (Tailscale-User-Login);
+      # the owner is web.proxy.owner, else this machine's own login.
+      #
+      # Serve's other ports are never touched, and on 443 only exactly what
+      # this provider sets (one handler / → http://127.0.0.1:<port>, no
+      # Funnel) is adopted or turned off: anything else there is refused at
+      # start and left alone at exit.
+      class Tailscale
+        # The CLI to run, before PATH: every spec that runs it sets this to a
+        # fake.
+        ENV_CLI = "SAMAGOTCHI_TAILSCALE_CLI"
+        # The macOS app's own CLI, when there is no tailscale on PATH (never
+        # in a test run).
+        APP_CLI = "/Applications/Tailscale.app/Contents/MacOS/Tailscale"
+        IDENTITY_HEADER = "Tailscale-User-Login"
+        STATUS_TIMEOUT = 5
+        SERVE_TIMEOUT = 15
+        LOCK_DOCS = "https://tailscale.com/kb/1226/tailnet-lock"
+
+        # No tailscale to run.
+        class CliMissing < Refused
+          def initialize
+            super("tailscale isn't installed: no tailscale on PATH or at #{APP_CLI} (install it from tailscale.com, " \
+                  "or set #{ENV_CLI} to its path)")
+          end
+        end
+
+        # SAMAGOTCHI_TAILSCALE_CLI names something that can't run.
+        class CliOverrideMissing < Refused
+          def initialize(path)
+            super("#{ENV_CLI} is #{path}, which isn't an executable file")
+          end
+        end
+
+        # Tailscale is installed but not connected (BackendState).
+        class NotRunning < Refused
+          def initialize(state)
+            super("Tailscale isn't connected (#{state}): open the Tailscale app and sign in, then run this again")
+          end
+        end
+
+        # No MagicDNS name for this machine.
+        class NoDnsName < Refused
+          def initialize
+            super("this machine has no tailnet name: turn on MagicDNS in the Tailscale admin console (DNS)")
+          end
+        end
+
+        # HTTPS certificates are off (no CertDomains for the name).
+        class NoHttps < Refused
+          def initialize(name)
+            super("HTTPS certificates are off for this tailnet (none for #{name}): turn them on in the Tailscale admin " \
+                  "console (DNS); rename this machine first, certificate names go into a public log")
+          end
+        end
+
+        # A tagged machine's UserID isn't a person: no owner by default.
+        class TaggedOwner < Refused
+          def initialize(tags)
+            super("this machine is tagged (#{tags.join(", ")}), so its Tailscale login isn't a person's: set " \
+                  "web.proxy.owner to your Tailscale login")
+          end
+        end
+
+        # Something other than this provider's one handler serves 443.
+        class ServeInUse < Refused
+          def initialize(what)
+            super("Tailscale Serve already serves port 443 here (#{what}), and chi web won't change it: turn it off " \
+                  "with tailscale serve --https=443 off, or use it as it is without --tunnel")
+          end
+        end
+
+        # Funnel (the public internet) is on for 443.
+        class Funnel < Refused
+          def initialize(name)
+            super("Tailscale Funnel is on for #{name} (the public internet), and chi web never runs behind Funnel: " \
+                  "turn it off first (tailscale funnel status shows it)")
+          end
+        end
+
+        # @param env [Hash] ENV: SAMAGOTCHI_TAILSCALE_CLI, PATH, the test-run flags
+        # @param app_cli [String] the app bundle's CLI (a spec's own path)
+        # @param runner [#call] (argv, timeout:) → Runner::Result
+        def initialize(env: ENV, app_cli: APP_CLI, runner: Runner.new)
+          @env = env
+          @app_cli = app_cli
+          @runner = runner
+        end
+
+        # The tailscale command: SAMAGOTCHI_TAILSCALE_CLI, else tailscale on
+        # PATH, else the macOS app's CLI (not in a test run).
+        # @raise [CliMissing, CliOverrideMissing]
+        def cli
+          @cli ||= lookup
+        end
+
+        # Everything checked before anything changes: connected, the name
+        # and its certificate, the owner, config conflicts, what Serve has
+        # on 443, Tailnet Lock.
+        # @param config_owner [String, nil] web.proxy.owner
+        # @param config_public_url [String, nil] web.public_url
+        # @param config_identity_header [String, nil] web.proxy.identity_header
+        # @return [Plan]
+        # @raise [Refused]
+        def prepare(port:, config_owner: nil, config_public_url: nil, config_identity_header: nil)
+          status = json(%w[status --json])
+          dns_name = connected_name(status)
+          origin = "https://#{dns_name}"
+          check_config(origin, config_public_url, config_identity_header)
+          owner, owner_source = owner_for(status, config_owner)
+          adopted = classify(json(%w[serve status --json]), dns_name, port) == :ours
+          public_url = PublicUrl.from_config(url: origin, identity_header: IDENTITY_HEADER, owner: owner)
+          Plan.new(public_url: public_url, owner_source: owner_source, adopted: adopted, lock_off: lock_off?,
+                   port: port, dns_name: dns_name)
+        end
+
+        # Serve 443 → the plan's port, in the background (tailscaled keeps
+        # it until #down, also past a chi web killed hard: the next
+        # --tunnel adopts it). The explicit target: chi web binds 127.0.0.1
+        # only.
+        # @raise [CliFailed, CliTimeout] its output in the message (a consent URL)
+        def up(plan)
+          args = ["serve", "--bg", "--https=443", plan.target]
+          result = run(args, timeout: SERVE_TIMEOUT)
+          raise CliFailed.new(command(args), result.output) unless result.success
+
+          nil
+        end
+
+        # 443 off again, only while Serve has exactly what #up set (the same
+        # test as the adopt): a handler someone added meanwhile, another
+        # target, Funnel, is left as it is (`serve --https=443 off` would drop
+        # all of 443).
+        # @return [Symbol] :off, :changed (left alone), :gone (443 was off already)
+        # @raise [Refused] a command that failed (the caller warns)
+        def down(plan)
+          state = begin
+            classify(json(%w[serve status --json]), plan.dns_name, plan.port)
+          rescue ServeInUse, Funnel
+            :changed
+          end
+          return state == :none ? :gone : state unless state == :ours
+
+          args = %w[serve --https=443 off]
+          result = run(args, timeout: SERVE_TIMEOUT)
+          raise CliFailed.new(command(args), result.output) unless result.success
+
+          :off
+        end
+
+        # What the start lines add: how it is reached and whose login is the
+        # owner, and the Tailnet Lock warning.
+        def start_lines(plan)
+          source = plan.owner_source == :config ? "web.proxy.owner" : "this machine's Tailscale login"
+          via = "         via Tailscale Serve (tailnet only), owner #{plan.public_url.owner} (#{source})"
+          via += "; Serve already forwarded port 443 here, chi web turns it off on exit" if plan.adopted
+          lines = [via]
+          if plan.lock_off
+            lines << "Tailnet Lock is off: a device Tailscale's servers add to your tailnet could reach this page; " \
+                     "tailscale lock init turns it on (#{LOCK_DOCS})"
+          end
+          lines
+        end
+
+        # The line #down's outcome is said in, nil for none.
+        def down_line(plan, outcome)
+          case outcome
+          when :off then "Tailscale Serve: port 443 is off again."
+          when :changed
+            "Tailscale Serve's port 443 changed while chi web ran (#{plan.dns_name}): left as it is " \
+              "(tailscale serve status shows it)"
+          end
+        end
+
+        # A #down that failed: Serve may still forward the name.
+        def down_warning(plan, error)
+          "Warning: Tailscale Serve may still forward #{plan.dns_name} to 127.0.0.1:#{plan.port} (#{error.message}): " \
+            "turn it off with tailscale serve --https=443 off"
+        end
+
+        # What Serve has on 443: :none, :ours (exactly one handler / →
+        # http://127.0.0.1:<port>, no Funnel), or a ServeInUse / Funnel.
+        # Other ports are not looked at.
+        # @raise [ServeInUse, Funnel, UnexpectedOutput]
+        def classify(serve, dns_name, port)
+          raise UnexpectedOutput, command(%w[serve status --json]) unless serve.is_a?(Hash)
+
+          funnel = hash(serve["AllowFunnel"]).find { |key, on| on && https_key?(key) }
+          raise Funnel, funnel.first if funnel
+
+          tcp = hash(serve["TCP"])["443"]
+          web = hash(serve["Web"]).select { |key, _| https_key?(key) }
+          return :none if tcp.nil? && web.empty?
+          return :ours if ours?(tcp, web, dns_name, port)
+
+          raise ServeInUse, describe(tcp, web)
+        end
+
+        private
+
+        def lookup
+          override = @env[ENV_CLI].to_s.strip
+          unless override.empty?
+            return override if executable?(override)
+
+            raise CliOverrideMissing, override
+          end
+          on_path = @env["PATH"].to_s.split(File::PATH_SEPARATOR).reject(&:empty?)
+                                .map { |dir| File.join(dir, "tailscale") }.find { |path| executable?(path) }
+          return on_path if on_path
+          return @app_cli if !Session.test_session_env?(env: @env) && executable?(@app_cli)
+
+          raise CliMissing
+        end
+
+        def executable?(path) = File.file?(path) && File.executable?(path)
+
+        def connected_name(status)
+          raise UnexpectedOutput, command(%w[status --json]) unless status.is_a?(Hash)
+
+          state = status["BackendState"].to_s
+          raise NotRunning, (state.empty? ? "no state" : state) unless state == "Running"
+
+          name = hash(status["Self"])["DNSName"].to_s.strip.downcase.delete_suffix(".")
+          raise NoDnsName if name.empty?
+          raise NoHttps, name unless Array(status["CertDomains"]).any? { |domain| domain.to_s.casecmp?(name) }
+
+          name
+        end
+
+        def check_config(origin, config_public_url, config_identity_header)
+          unless blank?(config_public_url) || configured_origin(config_public_url) == origin
+            raise ConfigConflict.new("web.public_url", config_public_url.to_s.strip, origin)
+          end
+          return if blank?(config_identity_header) || config_identity_header.to_s.strip.casecmp?(IDENTITY_HEADER)
+
+          raise ConfigConflict.new("web.proxy.identity_header", config_identity_header.to_s.strip, IDENTITY_HEADER)
+        end
+
+        def configured_origin(url)
+          PublicUrl.from_config(url: url)&.origin
+        rescue PublicUrl::Invalid
+          nil
+        end
+
+        # [login, :config | :login]
+        def owner_for(status, config_owner)
+          return [config_owner.to_s.strip, :config] unless blank?(config_owner)
+
+          me = hash(status["Self"])
+          tags = Array(me["Tags"])
+          raise TaggedOwner, tags.map(&:to_s) unless tags.empty?
+
+          login = hash(hash(status["User"])[me["UserID"].to_s])["LoginName"].to_s.strip
+          raise UnexpectedOutput, command(%w[status --json]) if login.empty?
+
+          [login, :login]
+        end
+
+        def ours?(tcp, web, dns_name, port)
+          handlers = { "Handlers" => { "/" => { "Proxy" => "http://127.0.0.1:#{port}" } } }
+          tcp == { "HTTPS" => true } && web.size == 1 && web.keys.first.casecmp?("#{dns_name}:443") &&
+            web.values.first == handlers
+        end
+
+        def describe(tcp, web)
+          parts = web.values.flat_map do |entry|
+            hash(hash(entry)["Handlers"]).map { |path, handler| "#{path} → #{handler_target(handler)}" }
+          end
+          forward = hash(tcp)["TCPForward"]
+          parts << "TCP → #{forward}" if forward
+          parts.empty? ? "a configuration chi web didn't make" : parts.join(", ")
+        end
+
+        def handler_target(handler)
+          handler = hash(handler)
+          handler["Proxy"] || (handler["Path"] && "files #{handler["Path"]}") || (handler.key?("Text") && "text") ||
+            handler.keys.join("/")
+        end
+
+        def https_key?(key) = key.to_s.end_with?(":443")
+
+        # Tailnet Lock is off (Enabled false); a failure says nothing.
+        def lock_off?
+          json(%w[lock status --json]).then { |lock| lock.is_a?(Hash) && lock["Enabled"] == false }
+        rescue Refused
+          false
+        end
+
+        def json(args)
+          result = run(args, timeout: STATUS_TIMEOUT)
+          raise CliFailed.new(command(args), result.output) unless result.success
+
+          JSON.parse(result.stdout)
+        rescue JSON::ParserError
+          raise UnexpectedOutput, command(args)
+        end
+
+        def run(args, timeout:)
+          @runner.call([cli, *args], timeout: timeout)
+        rescue Runner::Timeout => e
+          raise CliTimeout.new(command(args), timeout, e.output)
+        rescue SystemCallError => e
+          raise CliFailed.new(command(args), e.message)
+        end
+
+        def command(args) = ["tailscale", *args].join(" ")
+        def hash(value) = value.is_a?(Hash) ? value : {}
+        def blank?(value) = value.to_s.strip.empty?
+      end
+    end
+  end
+end

data/lib/samagotchi/web/tunnel.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require "open3"
+require_relative "../config"
+
+module Samagotchi
+  module Web
+    # `chi web --tunnel PROVIDER`: chi web reached from outside this machine
+    # through a provider that gives it an https name and tells it who is
+    # asking (Tailscale Serve: docs/configuration.md "Tailscale Serve"). The
+    # provider checks what it can before anything changes (#prepare), turns
+    # the tunnel on (#up) and off again on exit (#down), never touching what
+    # it didn't set. The public_url it makes is this run's, never written to
+    # config.yml.
+    module Tunnel
+      PROVIDERS = %w[tailscale].freeze
+
+      # What a tunnel's #prepare found: the PublicUrl chi web runs with this
+      # time, whose login is the owner (:config for web.proxy.owner, :login
+      # for this machine's own), whether the serve was already there (a
+      # leftover of an earlier run: #down resets it all the same), whether
+      # Tailnet Lock is off (a warning line), and the port it forwards to.
+      Plan = Data.define(:public_url, :owner_source, :adopted, :lock_off, :port, :dns_name) do
+        def target = "http://127.0.0.1:#{port}"
+      end
+
+      # Why `chi web --tunnel` won't start: each condition its own class and
+      # its own text (callers add only context).
+      class Refused < StandardError; end
+
+      # @return [Tailscale] the provider +name+ names
+      # @raise [ArgumentError] an unknown name (the flag's list refuses it first)
+      def self.for(name, **)
+        case name.to_s
+        when "tailscale"
+          require_relative "tunnel/tailscale"
+          Tailscale.new(**)
+        else raise ArgumentError, "unknown tunnel #{name} (#{PROVIDERS.join(", ")})"
+        end
+      end
+
+      # A web.public_url or web.proxy.identity_header setting the tunnel would
+      # override for its run.
+      class ConfigConflict < Refused
+        def initialize(key, value, tunnel_value)
+          env = Config::BY_KEY.fetch(key).env_key
+          super("#{key} is #{value}, but --tunnel sets it to #{tunnel_value} for this run: remove it from config.yml " \
+                "or the environment (#{env}), or drop --tunnel")
+        end
+      end
+
+      # A chi web already answers on the port: --tunnel starts its own.
+      class AlreadyRunning < Refused
+        def initialize(port)
+          super("chi web already runs on port #{port}, and --tunnel starts its own: stop that one first (Ctrl-C in its " \
+                "terminal), or use --port")
+        end
+      end
+
+      # The provider's command exited with an error.
+      class CliFailed < Refused
+        def initialize(command, output)
+          text = output.to_s.strip
+          super("#{command} failed#{text.empty? ? " (no output)" : ": #{text}"}")
+        end
+      end
+
+      # The provider's command didn't finish in time (stopped): a tailnet
+      # where Serve isn't allowed yet prints a consent URL and waits.
+      class CliTimeout < Refused
+        def initialize(command, seconds, output)
+          text = output.to_s.strip
+          super("#{command} didn't finish in #{seconds} s and was stopped#{": #{text}" unless text.empty?}" \
+                "#{" (if it printed a URL, open it to allow this, then run chi web again)" unless text.empty?}")
+        end
+      end
+
+      # The provider's command printed something chi can't read: never a
+      # guess that could change the wrong thing.
+      class UnexpectedOutput < Refused
+        def initialize(command)
+          super("#{command} printed something chi can't read (a newer version?); nothing was changed")
+        end
+      end
+
+      # A command run with a deadline: its own process group, both pipes read
+      # on threads, the group KILLed past +timeout+ (what it printed so far
+      # goes into the Timeout).
+      class Runner
+        Result = Data.define(:stdout, :stderr, :success) do
+          def output = [stdout, stderr].map(&:to_s).reject(&:empty?).join("\n")
+        end
+
+        class Timeout < StandardError
+          attr_reader :output
+
+          def initialize(output)
+            @output = output
+            super("timed out")
+          end
+        end
+
+        # @return [Result]
+        # @raise [Timeout]
+        # @raise [SystemCallError] the command can't run (ENOENT, EACCES)
+        def call(argv, timeout:)
+          Open3.popen3(*argv, pgroup: true) do |stdin, out, err, wait|
+            stdin.close
+            readers = [out, err].map { |io| Thread.new { io.read }.tap { |t| t.report_on_exception = false } }
+            unless wait.join(timeout)
+              stop(wait.pid)
+              readers.each { |reader| reader.join(1) }
+              raise Timeout, readers.map { |reader| text(reader) }.reject(&:empty?).join("\n")
+            end
+            # A process it left behind may hold the pipes: what was read by then.
+            readers.each { |reader| reader.join(1) }
+            Result.new(stdout: text(readers[0]), stderr: text(readers[1]), success: wait.value.success?)
+          end
+        end
+
+        private
+
+        def text(reader) = reader.alive? ? "" : reader.value.to_s
+
+        def stop(pid)
+          Process.kill("KILL", -pid)
+        rescue SystemCallError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/samagotchi/worker_sidecar.rb

@@ -70,14 +70,15 @@ module Samagotchi
     def initialize(port:, bind: nil, session_id: nil, started_at: nil, version: nil, input_format: nil, features: [],
                    epoch: nil) = super
 
-    # Written whole or not at all; input_format and epoch only when they
-    # name one.
+    # Written whole or not at all, readable by this user only (0600: no
+    # other account learns the worker's port from it); input_format and
+    # epoch only when they name one.
     def write(session_dir)
       FileUtils.mkdir_p(session_dir)
       record = to_h.transform_keys(&:to_s)
       record.delete("input_format") if input_format.nil?
       record.delete("epoch") if epoch.nil?
-      AtomicFile.write(self.class.path(session_dir), "#{JSON.pretty_generate(record)}\n")
+      AtomicFile.write(self.class.path(session_dir), "#{JSON.pretty_generate(record)}\n", perm: 0o600)
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: samagotchi
 version: !ruby/object:Gem::Version
-  version: 0.108.0
+  version: 0.110.0
 platform: ruby
 authors:
 - Dmitry Dedov
@@ -449,6 +449,7 @@ files:
 - lib/samagotchi/memory_orphans.rb
 - lib/samagotchi/memory_paths.rb
 - lib/samagotchi/message_parts.rb
+- lib/samagotchi/message_time.rb
 - lib/samagotchi/model_catalog.rb
 - lib/samagotchi/model_list_store.rb
 - lib/samagotchi/model_match.rb
@@ -497,6 +498,7 @@ files:
 - lib/samagotchi/prompt_literal_guard.rb
 - lib/samagotchi/prompt_note.rb
 - lib/samagotchi/prompt_warmup.rb
+- lib/samagotchi/proxy_trace.rb
 - lib/samagotchi/question_answer.rb
 - lib/samagotchi/question_asked.rb
 - lib/samagotchi/question_desk.rb
@@ -579,6 +581,7 @@ files:
 - lib/samagotchi/terminal_ui/between_turns.rb
 - lib/samagotchi/terminal_ui/event_renderer.rb
 - lib/samagotchi/terminal_ui/formatting.rb
+- lib/samagotchi/terminal_ui/gap_clock.rb
 - lib/samagotchi/terminal_ui/image_input.rb
 - lib/samagotchi/terminal_ui/input_support.rb
 - lib/samagotchi/terminal_ui/line_reader.rb
@@ -697,6 +700,7 @@ files:
 - lib/samagotchi/web/grants.rb
 - lib/samagotchi/web/info_probe.rb
 - lib/samagotchi/web/lan.rb
+- lib/samagotchi/web/link_codes.rb
 - lib/samagotchi/web/markdown_renderer.rb
 - lib/samagotchi/web/participant_access.rb
 - lib/samagotchi/web/participant_review.rb
@@ -704,6 +708,7 @@ files:
 - lib/samagotchi/web/participant_view.rb
 - lib/samagotchi/web/participants_admin.rb
 - lib/samagotchi/web/principal.rb
+- lib/samagotchi/web/proxy_gate.rb
 - lib/samagotchi/web/public/activity.js
 - lib/samagotchi/web/public/annotate_actions.js
 - lib/samagotchi/web/public/annotate_bar.js
@@ -711,6 +716,7 @@ files:
 - lib/samagotchi/web/public/annotations.js
 - lib/samagotchi/web/public/answer_refs.js
 - lib/samagotchi/web/public/app.js
+- lib/samagotchi/web/public/auth_lost.js
 - lib/samagotchi/web/public/bubbles.js
 - lib/samagotchi/web/public/card.js
 - lib/samagotchi/web/public/cards_place.js
@@ -796,9 +802,11 @@ files:
 - lib/samagotchi/web/public/task_stop.js
 - lib/samagotchi/web/public/thinking_chip.js
 - lib/samagotchi/web/public/thinking_ticker.js
+- lib/samagotchi/web/public/time_gaps.js
 - lib/samagotchi/web/public/timing.js
 - lib/samagotchi/web/public/toast_place.js
 - lib/samagotchi/web/public/toasts.js
+- lib/samagotchi/web/public/token_fragment.js
 - lib/samagotchi/web/public/tokens.css
 - lib/samagotchi/web/public/toolkit_chip.js
 - lib/samagotchi/web/public/turn_events.js
@@ -815,6 +823,7 @@ files:
 - lib/samagotchi/web/public/working_set.js
 - lib/samagotchi/web/public/working_set_rail.js
 - lib/samagotchi/web/public/working_set_view.js
+- lib/samagotchi/web/public_url.rb
 - lib/samagotchi/web/qr.rb
 - lib/samagotchi/web/running.rb
 - lib/samagotchi/web/server.rb
@@ -822,6 +831,8 @@ files:
 - lib/samagotchi/web/session_hub.rb
 - lib/samagotchi/web/session_summary.rb
 - lib/samagotchi/web/token.rb
+- lib/samagotchi/web/tunnel.rb
+- lib/samagotchi/web/tunnel/tailscale.rb
 - lib/samagotchi/worker.rb
 - lib/samagotchi/worker_idle_exit.rb
 - lib/samagotchi/worker_inbound.rb