@abot-ai/runtime 1.3.1 → 1.4.0

package/dist/src/web-ui/server.js

@@ -1,88 +1,35 @@
+import { RuntimeSetupGateway } from "./runtime-setup-gateway.js";
 import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
 import { createServer, } from "node:http";
 import { normalize, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { WebSocketServer } from "ws";
-import { inspectRuntimeConfigFileWithMeta } from "../runtime/config/loader.js";
+import { resolveWebUiEnvironmentConfig, } from "./environment-config.js";
+export { resolveWebUiEnvironmentConfig, } from "./environment-config.js";
+import { closeRuntimeSetupServices } from "./runtime-setup-shutdown.js";
 import { loadDotEnvFile } from "../shared/load-dotenv.js";
 import { createWebUiShutdown } from "./server-shutdown.js";
 import { ExternalBridgeWebBackend } from "./external-bridge-backend.js";
 import { LocalRuntimeWebBackend } from "./local-runtime-backend.js";
 import { resolveWebUiAddress } from "./web-ui-address.js";
 import { createLinkPreviewRouteHandler } from "./link-preview/routes.js";
+import { WebSystemHostService } from "./system-host-service.js";
+import { allowsPublishedLoopbackAuthority } from "./forwarded-loopback-policy.js";
+import { acceptWebUiHttpAuthority, acceptWebUiUpgradeAuthority, } from "./request-authority.js";
 const DEFAULT_WEB_BACKEND = "runtime";
 const DEFAULT_BRIDGE_API_BASE = "http://127.0.0.1:8787/abot/api";
 const DEFAULT_BRIDGE_REALTIME_URL = "ws://127.0.0.1:8787/abot/realtime";
 const DEFAULT_BRIDGE_HEALTH_URL = "http://127.0.0.1:8787/abot/health";
 const DEFAULT_BRIDGE_AGENT_MODE_URL = "http://127.0.0.1:8787/abot/agent-mode";
 const DEFAULT_ASSISTANT_HOST_URL = "http://127.0.0.1:5188";
-const DEFAULT_ENVIRONMENT_ID = "prod";
 const DEFAULT_SETUP_COMMAND_MODE = "source";
-function isRecord(value) {
-    return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function getConfigString(value, key) {
-    if (!isRecord(value))
-        return "";
-    const raw = value[key];
-    return typeof raw === "string" ? raw.trim() : "";
-}
 function resolveWebApiToken() {
     return (process.env.LLM_RUNTIME_WEB_API_TOKEN ||
         process.env.CHAT_API_AUTH_TOKEN ||
         process.env.CHAT_HISTORY_API_TOKEN ||
         "");
 }
-export function resolveWebUiEnvironmentConfig(params) {
-    const overrideDefault = params.defaultEnvironmentId?.trim() ?? "";
-    const fallbackDefault = overrideDefault || DEFAULT_ENVIRONMENT_ID;
-    const fallback = {
-        defaultEnvironmentId: fallbackDefault,
-        environments: [
-            {
-                id: fallbackDefault,
-                label: fallbackDefault,
-                isDefault: true,
-            },
-        ],
-    };
-    let config;
-    try {
-        config = inspectRuntimeConfigFileWithMeta(params.rootDir, params.configPath).config;
-    }
-    catch {
-        // Runtime configuration errors belong to the backend catalog response so
-        // the Web UI can start and present the actionable setup error.
-        return fallback;
-    }
-    const environment = isRecord(config.environment)
-        ? config.environment
-        : undefined;
-    const profiles = isRecord(environment?.profiles)
-        ? environment.profiles
-        : undefined;
-    const profileIds = profiles
-        ? Object.keys(profiles).filter((id) => id.trim().length > 0)
-        : [];
-    const configuredDefault = getConfigString(environment, "default");
-    const defaultEnvironmentId = overrideDefault ||
-        configuredDefault ||
-        profileIds[0] ||
-        DEFAULT_ENVIRONMENT_ID;
-    const environmentIds = profileIds.length > 0 ? [...profileIds] : [defaultEnvironmentId];
-    if (!environmentIds.includes(defaultEnvironmentId)) {
-        environmentIds.unshift(defaultEnvironmentId);
-    }
-    return {
-        defaultEnvironmentId,
-        environments: environmentIds.map((id) => ({
-            id,
-            label: id,
-            isDefault: id === defaultEnvironmentId,
-        })),
-    };
-}
 function getOptionsFromEnv() {
     loadDotEnvFile();
     const address = resolveWebUiAddress(process.env);
@@ -197,12 +144,38 @@ export function startWebUiServer(overrides = {}) {
         defaultEnvironmentId: overrides.defaultEnvironmentId ?? environmentConfig.defaultEnvironmentId,
         environments: overrides.environments ?? environmentConfig.environments,
     };
+    const setupGateway = new RuntimeSetupGateway({
+        rootDir,
+        providerAdapters: options.providerAdapters,
+    });
+    const activateSetup = overrides.onRuntimeSetup ?? ((path) => setupGateway.activate(path));
     const wss = new WebSocketServer({ noServer: true });
     const localRuntimeBackend = options.backend === "runtime"
         ? new LocalRuntimeWebBackend({
             rootDir: options.rootDir,
             configPath: options.configPath,
             defaultEnvironmentId: options.defaultEnvironmentId,
+            resolveEnvironmentConfig: (activeConfigPath) => {
+                const current = resolveWebUiEnvironmentConfig({
+                    rootDir,
+                    configPath: activeConfigPath ?? configPath,
+                    defaultEnvironmentId: overrides.defaultEnvironmentId ??
+                        envOptions.defaultEnvironmentId,
+                });
+                return {
+                    ...current,
+                    environments: overrides.environments ?? current.environments,
+                };
+            },
+            onRuntimeSetup: activateSetup,
+            createRuntimeSetupRestorePoint: overrides.createRuntimeSetupRestorePoint ??
+                (overrides.onRuntimeSetup
+                    ? undefined
+                    : () => setupGateway.createRestorePoint()),
+            checkRuntimeSetupActivation: overrides.checkRuntimeSetupActivation ??
+                (overrides.onRuntimeSetup
+                    ? undefined
+                    : (path) => setupGateway.checkActivation(path)),
             ...(options.providerAdapters
                 ? { providerAdapters: options.providerAdapters }
                 : {}),
@@ -229,12 +202,21 @@ export function startWebUiServer(overrides = {}) {
         });
     }
     const handleLinkPreview = createLinkPreviewRouteHandler();
+    const systemHost = localRuntimeBackend
+        ? new WebSystemHostService(rootDir)
+        : null;
+    const allowPublishedLoopback = allowsPublishedLoopbackAuthority(options.host);
     const server = createServer((req, res) => {
         void (async () => {
+            if (!acceptWebUiHttpAuthority(req, res, options.host, allowPublishedLoopback))
+                return;
             if (await handleLinkPreview(req, res))
                 return;
             const pathname = new URL(req.url || "/", "http://localhost").pathname;
+            if (await systemHost?.handleHttp(req, res, pathname))
+                return;
             if (pathname === "/web-config") {
+                const currentEnvironments = localRuntimeBackend?.environmentConfig() ?? options;
                 sendJson(res, 200, {
                     ok: true,
                     apiBasePath: "/web-api",
@@ -242,9 +224,13 @@ export function startWebUiServer(overrides = {}) {
                     agentModePath: "/web-agent-mode",
                     assistantHostPath: "/assistant-host",
                     realtimePath: "/web-realtime",
-                    defaultEnvironmentId: options.defaultEnvironmentId,
-                    environments: options.environments,
+                    defaultEnvironmentId: currentEnvironments.defaultEnvironmentId,
+                    environments: currentEnvironments.environments,
                     authConfigured: Boolean(options.apiToken),
+                    supportsProjects: Boolean(localRuntimeBackend),
+                    supportedToolPermissionModes: localRuntimeBackend
+                        ? ["ask", "full_access", "full_plus"]
+                        : ["ask", "full_access"],
                     backend: options.backend,
                     setupCommandMode: options.setupCommandMode,
                 });
@@ -297,6 +283,10 @@ export function startWebUiServer(overrides = {}) {
         });
     });
     server.on("upgrade", (req, socket, head) => {
+        if (systemHost?.handleUpgrade(req, socket, head, options.host))
+            return;
+        if (!acceptWebUiUpgradeAuthority(req, socket, options.host, allowPublishedLoopback))
+            return;
         const pathname = new URL(req.url || "/", "http://localhost").pathname;
         if (pathname !== "/web-realtime") {
             socket.destroy();
@@ -323,7 +313,7 @@ export function startWebUiServer(overrides = {}) {
     });
     const schedulerStartup = localRuntimeBackend?.start(options.environments.map(({ id }) => id));
     return {
-        close: createWebUiShutdown(server, wss, schedulerStartup, () => localRuntimeBackend?.stop(), listenAbort),
+        close: createWebUiShutdown(server, wss, schedulerStartup, () => closeRuntimeSetupServices(async () => localRuntimeBackend?.stop(), () => setupGateway.close(), async () => systemHost?.close()), listenAbort),
     };
 }
 const invokedPath = process.argv[1] ? pathToFileURL(process.argv[1]).href : "";

package/dist/src/web-ui/session-read-state/service.d.ts

@@ -55,12 +55,17 @@ export declare class WebSessionReadStates {
             lastReadAt: number;
             latestMessageId: string | number | null;
             latestAssistantMessageId: string | number | null;
-            id: string;
             title: string;
             createdAt: number;
             updatedAt: number;
             lastMessagePreview: string;
             lastMessageAt: number | null;
+            project?: Readonly<{
+                id: string;
+                name: string;
+                directory: string;
+            }> | undefined;
+            id: string;
         }[];
         nextCursor: null;
     } | {
@@ -71,7 +76,6 @@ export declare class WebSessionReadStates {
             hasUnread: null;
             lastReadAt: null;
             lastReadMessageId: null;
-            id: string;
             title: string;
             createdAt: number;
             updatedAt: number;
@@ -79,6 +83,12 @@ export declare class WebSessionReadStates {
             lastMessageAt: number | null;
             latestMessageId: string | number | null;
             latestAssistantMessageId: string | number | null;
+            project?: Readonly<{
+                id: string;
+                name: string;
+                directory: string;
+            }> | undefined;
+            id: string;
         }[];
         nextCursor: null;
     }>;

package/dist/src/web-ui/system-host-service.d.ts

@@ -0,0 +1,19 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Duplex } from "node:stream";
+export declare class WebSystemHostService {
+    private readonly rootDir;
+    private readonly store;
+    private readonly connection;
+    private readonly setup;
+    private readonly wss;
+    private broker?;
+    private starting?;
+    private closing;
+    constructor(rootDir: string);
+    private ensureStarted;
+    /** Native upgrade is separate from browser realtime and requires its own credential. */
+    handleUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer, listenHost?: string): boolean;
+    private acceptCompanion;
+    handleHttp(request: IncomingMessage, response: ServerResponse, pathname: string): Promise<boolean>;
+    close(): Promise<void>;
+}

package/dist/src/web-ui/system-host-service.js

@@ -0,0 +1,159 @@
+import { join } from "node:path";
+import { WebSocketServer } from "ws";
+import { HostConnection } from "../../plugins/system/source/companion/connection.js";
+import { HostPairingStore } from "../../plugins/system/source/companion/pairing-store.js";
+import { startHostBroker } from "../../plugins/system/source/companion/broker-server.js";
+import { hostStateDirectory } from "../../plugins/system/source/companion/private-store.js";
+import { HOST_SOCKET_PATH, HOST_WIRE_MAX_BYTES, } from "../../plugins/system/source/companion/protocol.js";
+import { isProcessOwnerAlive, requireCurrentProcessOwnerIdentity, } from "../../plugins/system/source/companion/process-owner-identity.js";
+import { ensurePrivateRuntimeDirectory } from "../runtime/local-host/private-directory.js";
+import { acquireFileLock } from "../runtime/adapters/long-term-memory/file-lock/acquisition.js";
+import { acceptConfigMutationRequest } from "./local-runtime/config-mutation-request.js";
+import { readBody, sendJson } from "./local-runtime/http.js";
+import { hostBearerCredential } from "./system-host-setup/native-authorization.js";
+import { hasTrustedSystemHostUpgrade, rejectSystemHostUpgrade } from "./system-host-upgrade-authority.js";
+import { readHostReadiness } from "./system-host-setup/readiness.js";
+import { HostSetupRoutes, isHostSetupRoute, sendHostSetupInputError } from "./system-host-setup/routes.js";
+function isSystemHostRoute(pathname) {
+    if (pathname === "/web-api/runtime/system-host")
+        return true;
+    return pathname === "/web-api/runtime/system-host/pairing";
+}
+export class WebSystemHostService {
+    rootDir;
+    store;
+    connection;
+    setup;
+    wss = new WebSocketServer({
+        noServer: true,
+        maxPayload: HOST_WIRE_MAX_BYTES,
+        perMessageDeflate: false,
+    });
+    broker;
+    starting;
+    closing = false;
+    constructor(rootDir) {
+        this.rootDir = rootDir;
+        this.store = new HostPairingStore(rootDir);
+        this.connection = new HostConnection(this.store);
+        this.setup = new HostSetupRoutes({
+            store: this.store,
+            readiness: () => readHostReadiness(this.connection.status()),
+            prepareCompanion: () => this.ensureStarted(),
+        });
+    }
+    ensureStarted() {
+        if (this.closing)
+            return Promise.reject(new Error("host_service_stopped"));
+        this.starting ??= (async () => {
+            await ensurePrivateRuntimeDirectory(hostStateDirectory(this.rootDir));
+            const ownerIdentity = await requireCurrentProcessOwnerIdentity();
+            this.broker = await startHostBroker(this.rootDir, this.connection, () => acquireFileLock(join(hostStateDirectory(this.rootDir), "owner.lock"), {
+                waitMs: 0,
+                ownerIdentity,
+                processIsAlive: isProcessOwnerAlive,
+            }));
+        })().catch((error) => {
+            this.starting = undefined;
+            throw error;
+        });
+        return this.starting;
+    }
+    /** Native upgrade is separate from browser realtime and requires its own credential. */
+    handleUpgrade(request, socket, head, listenHost = "127.0.0.1") {
+        const pathname = new URL(request.url ?? "/", "http://localhost").pathname;
+        if (pathname !== HOST_SOCKET_PATH)
+            return false;
+        if (!hasTrustedSystemHostUpgrade(request, listenHost)) {
+            rejectSystemHostUpgrade(socket);
+            return true;
+        }
+        void this.acceptCompanion(request, socket, head).catch(() => socket.destroy());
+        return true;
+    }
+    async acceptCompanion(request, socket, head) {
+        await this.ensureStarted();
+        const token = hostBearerCredential(request);
+        if (!token || !this.store.authenticate(token)) {
+            rejectSystemHostUpgrade(socket);
+            return;
+        }
+        if (this.wss.clients.size >= 4) {
+            socket.destroy();
+            return;
+        }
+        if (this.closing) {
+            socket.destroy();
+            return;
+        }
+        this.wss.handleUpgrade(request, socket, head, (client) => this.connection.accept(client, token));
+    }
+    async handleHttp(request, response, pathname) {
+        if (!isSystemHostRoute(pathname) && !isHostSetupRoute(pathname))
+            return false;
+        response.setHeader("cache-control", "no-store");
+        try {
+            if (isHostSetupRoute(pathname)) {
+                await this.setup.handle(request, response, pathname);
+                return true;
+            }
+            if (request.method === "GET" &&
+                pathname === "/web-api/runtime/system-host") {
+                const status = this.connection.status();
+                const readiness = await readHostReadiness(status);
+                sendJson(response, 200, { ok: true, ...status, readiness });
+                return true;
+            }
+            if (!acceptConfigMutationRequest(request, response))
+                return true;
+            const raw = await readBody(request, { maxBytes: 1024 });
+            const body = raw.length ? JSON.parse(raw.toString()) : {};
+            if (JSON.stringify(body) !== "{}") {
+                sendJson(response, 400, {
+                    ok: false,
+                    error: "unexpected_host_configuration_fields",
+                });
+                return true;
+            }
+            if (request.method === "POST" && pathname.endsWith("/pairing")) {
+                await this.ensureStarted();
+                sendJson(response, 200, { ok: true, ...this.store.begin() });
+                return true;
+            }
+            if (request.method === "DELETE" &&
+                pathname === "/web-api/runtime/system-host") {
+                await this.ensureStarted();
+                this.store.revoke();
+                this.connection.disconnect();
+                const status = this.connection.status();
+                sendJson(response, 200, { ok: true, ...status, readiness: await readHostReadiness(status) });
+                return true;
+            }
+            sendJson(response, 405, { ok: false, error: "method_not_allowed" });
+        }
+        catch (error) {
+            if (sendHostSetupInputError(response, error))
+                return true;
+            const alreadyPaired = error instanceof Error && error.message === "host_already_paired";
+            sendJson(response, alreadyPaired ? 409 : 503, {
+                ok: false,
+                error: alreadyPaired
+                    ? "host_already_paired"
+                    : "host_connection_unavailable",
+                message: alreadyPaired
+                    ? "Disconnect the paired computer before creating a new pairing."
+                    : "The host connection service could not be started or updated.",
+            });
+        }
+        return true;
+    }
+    async close() {
+        if (this.closing)
+            return;
+        this.closing = true;
+        await this.starting?.catch(() => undefined);
+        this.connection.close();
+        await this.broker?.close();
+        await new Promise((resolve) => this.wss.close(() => resolve()));
+    }
+}

package/dist/src/web-ui/system-host-setup/companion-bundle.d.ts

@@ -0,0 +1,2 @@
+/** Packaged entries use their sibling CLI; source mode serves the built artifact. */
+export declare function readInstallerCompanionBundle(moduleUrl?: string, read?: (url: URL) => Promise<Buffer>): Promise<Buffer>;

package/dist/src/web-ui/system-host-setup/companion-bundle.js

@@ -0,0 +1,12 @@
+import { readFile } from "node:fs/promises";
+/** Packaged entries use their sibling CLI; source mode serves the built artifact. */
+export async function readInstallerCompanionBundle(moduleUrl = import.meta.url, read = readFile) {
+    try {
+        return await read(new URL("../../cli/host-companion-bundle.mjs", moduleUrl));
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        return read(new URL("../../../dist/src/cli/host-companion-bundle.mjs", moduleUrl));
+    }
+}

package/dist/src/web-ui/system-host-setup/companion-macos.d.ts

@@ -0,0 +1,2 @@
+import { type CompanionInstallerInput } from "./installer-contract.js";
+export declare function renderMacCompanionScript(input: CompanionInstallerInput): string;

package/dist/src/web-ui/system-host-setup/companion-macos.js

@@ -0,0 +1,74 @@
+import { shellString, } from "./installer-contract.js";
+import { COMPANION_NODE_DISTRIBUTIONS, COMPANION_NODE_VERSION, } from "./node-distribution.js";
+export function renderMacCompanionScript(input) {
+    const url = new URL(input.url);
+    const localAlias = url.hostname === "localhost" || url.hostname.endsWith(".localhost");
+    const resolve = localAlias
+        ? ` --resolve ${shellString(`${url.hostname}:${url.port || "80"}:127.0.0.1`)}`
+        : "";
+    const payload = JSON.stringify({ url: input.url, code: input.code });
+    return `#!/bin/bash
+set -euo pipefail
+umask 077
+BASE="$HOME/Library/Application Support/ABot/HostCompanion"
+TEMP=''
+cleanup() {
+  case "$TEMP" in "$BASE"/setup.*) /bin/rm -rf -- "$TEMP" ;; esac
+}
+failed() { echo 'Setup did not complete. Review the error above, then obtain a fresh setup file if needed.' >&2; }
+trap cleanup EXIT
+trap failed ERR
+verify_installation_directory() {
+  if [ -L "$BASE" ]; then echo 'The installation directory must not be a link.' >&2; exit 1; fi
+  if [ ! -O "$BASE" ]; then echo 'The installation directory must belong to this user.' >&2; exit 1; fi
+}
+run_verified_companion_setup() {
+  if [ ! -f "$NODE" ]; then echo 'The cached Node.js runtime is missing. Restore this installation before resuming setup.' >&2; exit 1; fi
+  if [ ! -f "$BUNDLE" ]; then echo 'The cached companion bundle is missing. Restore this installation before resuming setup.' >&2; exit 1; fi
+  verify_installation_directory
+  if [ "$("$NODE" --version)" != '${COMPANION_NODE_VERSION}' ]; then echo 'The dedicated Node.js runtime could not be verified.' >&2; exit 1; fi
+  EXISTING_SHA=$(/usr/bin/shasum -a 256 "$BUNDLE" | /usr/bin/awk '{print $1}')
+  if [ "$EXISTING_SHA" != '${input.bundleSha256}' ]; then echo 'The existing companion bundle does not match its checksum.' >&2; exit 1; fi
+  echo 'Connecting this computer and enabling startup at sign-in...'
+  printf '%s' ${shellString(payload)} | "$NODE" "$BUNDLE" setup
+  echo 'Companion setup completed. Return to ABot to check the computer connection.'
+}
+case "$(/usr/bin/uname -m)" in
+  arm64) ARCH='arm64'; NODE_SHA='${COMPANION_NODE_DISTRIBUTIONS["darwin-arm64"].sha256}' ;;
+  x86_64) ARCH='x64'; NODE_SHA='${COMPANION_NODE_DISTRIBUTIONS["darwin-x64"].sha256}' ;;
+  *) echo 'This Mac architecture is not supported by companion setup.' >&2; exit 1 ;;
+esac
+NODE_NAME="node-${COMPANION_NODE_VERSION}-darwin-$ARCH"
+NODE="$BASE/$NODE_NAME/bin/node"
+BUNDLE="$BASE/companion-${input.bundleSha256}.mjs"
+if [ -e "$HOME/.abot/host-companion/connection.json" ]; then
+  run_verified_companion_setup
+  exit 0
+fi
+if [ "$(/bin/date +%s)" -ge ${Math.floor(Date.parse(input.expiresAt) / 1000)} ]; then
+  echo 'This setup invitation expired. Download a fresh setup file in ABot.' >&2
+  exit 1
+fi
+if [ -L "$BASE" ]; then echo 'The installation directory must not be a link.' >&2; exit 1; fi
+/bin/mkdir -p "$BASE"
+verify_installation_directory
+/bin/chmod 700 "$BASE"
+TEMP=$(/usr/bin/mktemp -d "$BASE/setup.XXXXXX")
+if [ ! -f "$NODE" ]; then
+  echo 'Downloading the verified per-user Node.js runtime...'
+  /usr/bin/curl --fail --show-error --silent --proto '=https' --tlsv1.2 --max-redirs 0 --connect-timeout 15 --max-time 300 --output "$TEMP/node.tar.gz" "https://nodejs.org/dist/${COMPANION_NODE_VERSION}/$NODE_NAME.tar.gz"
+  ACTUAL_SHA=$(/usr/bin/shasum -a 256 "$TEMP/node.tar.gz" | /usr/bin/awk '{print $1}')
+  if [ "$ACTUAL_SHA" != "$NODE_SHA" ]; then echo 'Node.js checksum verification failed.' >&2; exit 1; fi
+  /usr/bin/tar -xzf "$TEMP/node.tar.gz" -C "$TEMP"
+  /bin/mv "$TEMP/$NODE_NAME" "$BASE/$NODE_NAME"
+fi
+echo 'Downloading and verifying the ABot companion...'
+PAIRING_CODE=${shellString(input.code)}
+printf 'header = "Authorization: Bearer %s"\n' "$PAIRING_CODE" | /usr/bin/curl --config - --fail --show-error --silent --proto '=http' --max-redirs 0 --noproxy '*' --connect-timeout 10 --max-time 120${resolve} --output "$TEMP/companion.mjs" ${shellString(input.url + "/web-api/runtime/system-host/bundle")}
+ACTUAL_SHA=$(/usr/bin/shasum -a 256 "$TEMP/companion.mjs" | /usr/bin/awk '{print $1}')
+if [ "$ACTUAL_SHA" != '${input.bundleSha256}' ]; then echo 'Companion checksum verification failed. Nothing was executed.' >&2; exit 1; fi
+/bin/chmod 600 "$TEMP/companion.mjs"
+if [ ! -e "$BUNDLE" ]; then /bin/mv "$TEMP/companion.mjs" "$BUNDLE"; fi
+run_verified_companion_setup
+`;
+}

package/dist/src/web-ui/system-host-setup/companion-windows.d.ts

@@ -0,0 +1,2 @@
+import { type CompanionInstallerInput } from "./installer-contract.js";
+export declare function renderWindowsCompanionScript(input: CompanionInstallerInput): string;

package/dist/src/web-ui/system-host-setup/companion-windows.js

@@ -0,0 +1,105 @@
+import { installerMetadataBase64, } from "./installer-contract.js";
+import { COMPANION_NODE_DISTRIBUTIONS, COMPANION_NODE_VERSION, } from "./node-distribution.js";
+import { wrapWindowsSetupScript } from "./windows-script-wrapper.js";
+export function renderWindowsCompanionScript(input) {
+    const metadata = installerMetadataBase64({
+        ...input,
+        nodeVersion: COMPANION_NODE_VERSION,
+        distributions: COMPANION_NODE_DISTRIBUTIONS,
+    });
+    return wrapWindowsSetupScript(String.raw `
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$Metadata = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${metadata}')) | ConvertFrom-Json
+$Temporary = $null
+function Assert-CompanionDirectory {
+  if ((Get-Item -LiteralPath $Base).Attributes -band [IO.FileAttributes]::ReparsePoint) { throw 'The companion installation directory must not be a link.' }
+}
+function Invoke-VerifiedCompanionSetup {
+  if (-not (Test-Path -LiteralPath $Node -PathType Leaf)) { throw 'The cached Node.js runtime is missing. Restore this installation before resuming setup.' }
+  if (-not (Test-Path -LiteralPath $Bundle -PathType Leaf)) { throw 'The cached companion bundle is missing. Restore this installation before resuming setup.' }
+  Assert-CompanionDirectory
+  if ((& $Node --version) -ne $Metadata.nodeVersion -or $LASTEXITCODE -ne 0) { throw 'The dedicated Node.js runtime could not be verified.' }
+  if ((Get-FileHash -LiteralPath $Bundle -Algorithm SHA256).Hash -ne $Metadata.bundleSha256) { throw 'The existing companion bundle does not match its recorded checksum.' }
+  Write-Host 'Connecting this computer and enabling startup at sign-in...'
+  $Payload = @{ url = $Metadata.url; code = $Metadata.code } | ConvertTo-Json -Compress
+  $Payload | & $Node $Bundle setup
+  if ($LASTEXITCODE -ne 0) { throw 'Companion setup did not complete. Check the message above before resuming setup.' }
+  Write-Host 'Companion setup completed. Return to ABot to check the computer connection.'
+}
+function Get-VerifiedDownload([string]$Url, [string]$Destination, [string]$ExpectedHash, [string]$Bearer = '') {
+  $Original = [Uri]$Url
+  $Address = $Original
+  if ($Original.Host -eq 'localhost' -or $Original.Host.EndsWith('.localhost')) {
+    $Builder = New-Object UriBuilder($Original)
+    $Builder.Host = '127.0.0.1'
+    $Address = $Builder.Uri
+  }
+  $Request = [Net.HttpWebRequest]::Create($Address)
+  $Request.Host = $Original.Authority
+  $Request.AllowAutoRedirect = $false
+  $Request.Timeout = 300000
+  $Request.ReadWriteTimeout = 300000
+  $Request.Proxy = $null
+  if ($Bearer) { $Request.Headers['Authorization'] = 'Bearer ' + $Bearer }
+  $Response = $null
+  $File = $null
+  try {
+    $Response = $Request.GetResponse()
+    if ([int]$Response.StatusCode -ne 200) { throw 'The download endpoint did not return a file.' }
+    $File = [IO.File]::Open($Destination, [IO.FileMode]::CreateNew)
+    $Response.GetResponseStream().CopyTo($File)
+  } finally {
+    if ($File) { $File.Dispose() }
+    if ($Response) { $Response.Dispose() }
+  }
+  if ((Get-FileHash -LiteralPath $Destination -Algorithm SHA256).Hash -ne $ExpectedHash) {
+    throw 'Checksum verification failed. The downloaded file will not be executed.'
+  }
+}
+try {
+  $Base = Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'ABot\HostCompanion'
+  $Architecture = $env:PROCESSOR_ARCHITECTURE
+  if ($env:PROCESSOR_ARCHITEW6432) { $Architecture = $env:PROCESSOR_ARCHITEW6432 }
+  $Key = switch ($Architecture.ToUpperInvariant()) { 'AMD64' { 'win-x64' }; 'ARM64' { 'win-arm64' }; default { throw 'This Windows architecture is not supported by companion setup.' } }
+  $Distribution = $Metadata.distributions.$Key
+  $NodeDirectory = Join-Path $Base ([IO.Path]::GetFileNameWithoutExtension($Distribution.archive))
+  $Node = Join-Path $NodeDirectory 'node.exe'
+  $Bundle = Join-Path $Base ('companion-' + $Metadata.bundleSha256 + '.mjs')
+  $ExistingConnection = Join-Path ([Environment]::GetFolderPath('UserProfile')) '.abot\host-companion\connection.json'
+  if (Test-Path -LiteralPath $ExistingConnection) {
+    Invoke-VerifiedCompanionSetup
+    exit 0
+  }
+  if ([DateTimeOffset]::UtcNow -ge [DateTimeOffset]::Parse($Metadata.expiresAt)) { throw 'This setup invitation expired. Download a fresh setup file in ABot.' }
+  [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+  [IO.Directory]::CreateDirectory($Base) | Out-Null
+  Assert-CompanionDirectory
+  $Temporary = Join-Path $Base ('setup-' + [Guid]::NewGuid().ToString('N'))
+  [IO.Directory]::CreateDirectory($Temporary) | Out-Null
+  if (-not (Test-Path -LiteralPath $Node -PathType Leaf)) {
+    Write-Host 'Downloading the verified per-user Node.js runtime...'
+    $Archive = Join-Path $Temporary 'node.zip'
+    Get-VerifiedDownload ('https://nodejs.org/dist/' + $Metadata.nodeVersion + '/' + $Distribution.archive) $Archive $Distribution.sha256
+    $Extracted = Join-Path $Temporary 'node'
+    Expand-Archive -LiteralPath $Archive -DestinationPath $Extracted
+    Move-Item -LiteralPath (Join-Path $Extracted ([IO.Path]::GetFileNameWithoutExtension($Distribution.archive))) -Destination $NodeDirectory
+  }
+  Write-Host 'Downloading and verifying the ABot companion...'
+  $Candidate = Join-Path $Temporary 'companion.mjs'
+  Get-VerifiedDownload ($Metadata.url + '/web-api/runtime/system-host/bundle') $Candidate $Metadata.bundleSha256 $Metadata.code
+  if (-not (Test-Path -LiteralPath $Bundle)) { Move-Item -LiteralPath $Candidate -Destination $Bundle }
+  Invoke-VerifiedCompanionSetup
+} catch {
+  Write-Host ('Setup failed: ' + $_.Exception.Message) -ForegroundColor Red
+  exit 1
+} finally {
+  if ($Temporary -and (Test-Path -LiteralPath $Temporary)) {
+    $ResolvedBase = [IO.Path]::GetFullPath($Base).TrimEnd('\') + '\'
+    $ResolvedTemporary = [IO.Path]::GetFullPath($Temporary)
+    if ($ResolvedTemporary.StartsWith($ResolvedBase, [StringComparison]::OrdinalIgnoreCase)) { Remove-Item -LiteralPath $ResolvedTemporary -Recurse -Force }
+  }
+}
+`);
+}

package/dist/src/web-ui/system-host-setup/installer-contract.d.ts

@@ -0,0 +1,18 @@
+export declare class InstallerInputError extends Error {
+}
+export type CompanionInstallerInput = Readonly<{
+    platform: "windows" | "macos";
+    url: string;
+    code: string;
+    bundleSha256: string;
+    expiresAt: string;
+}>;
+export type InstallerDownload = Readonly<{
+    filename: string;
+    mimeType: string;
+    contentBase64: string;
+}>;
+export declare function validateCompanionInstaller(input: CompanionInstallerInput): CompanionInstallerInput;
+export declare function validateWslDistribution(distribution?: string): string | undefined;
+export declare function installerMetadataBase64(value: unknown): string;
+export declare function shellString(value: string): string;