@akira-tl/forgerelay 0.8.8 → 0.8.10

package/dist/cli/init.js

@@ -0,0 +1,180 @@
+import { resolve } from "node:path";
+import * as prompts from "@clack/prompts";
+import { publicEndpointUrl } from "../mcp/oauth/public-url.js";
+import { expandHomePath } from "../mcp/filesystem/roots.js";
+import { installManagedLanguageServers, installedManagedLanguageServers, managedLanguageServerOptions, } from "../lsp/runtime/managed-language-servers.js";
+import { generateInstanceId, generateOwnerToken, loadForgeRelayFiles, resolveSubagentsFlag, writeForgeRelayAuth, writeForgeRelayConfig, } from "../runtime/config/user-config.js";
+import { classifyClientFacingBaseUrl, compactPublicBaseUrlConfig, hasInsecureLanBaseUrl, isLoopbackBindAddress, normalizePublicBaseUrlsInput, SetupCancelledError, textPrompt, validateBindAddress, validateClientFacingBaseUrls, validatePort, } from "./setup-support.js";
+export async function runInit({ force }) {
+    const files = loadForgeRelayFiles();
+    if (!force && files.configExists && files.authExists) {
+        prompts.log.info(`ForgeRelay is already configured at ${files.dir}`);
+        prompts.log.info("Run `forgerelay init --force` to update it.");
+        return;
+    }
+    try {
+        prompts.intro("ForgeRelay setup");
+        const defaultRoots = files.config.allowedRoots?.join(", ") || process.cwd();
+        const rootsAnswer = await textPrompt({
+            message: `Where are your projects located? Press Enter to use ${defaultRoots}`,
+            placeholder: defaultRoots,
+            defaultValue: defaultRoots,
+            validate: (value) => value?.trim() ? undefined : "Enter at least one project root.",
+        });
+        const allowedRoots = rootsAnswer
+            .split(",")
+            .map((root) => resolve(expandHomePath(root.trim())))
+            .filter(Boolean);
+        const defaultPort = String(files.config.port ?? 7676);
+        const portAnswer = await textPrompt({
+            message: `Which local port should ForgeRelay use? Press Enter to use ${defaultPort}`,
+            placeholder: defaultPort,
+            defaultValue: defaultPort,
+            validate: validatePort,
+        });
+        const port = Number(portAnswer);
+        const existingPublicBaseUrls = Array.isArray(files.config.publicBaseUrl)
+            ? files.config.publicBaseUrl
+            : files.config.publicBaseUrl ? [files.config.publicBaseUrl] : [];
+        const defaultNetworkMode = !isLoopbackBindAddress(files.config.host ?? "127.0.0.1") || existingPublicBaseUrls.length > 0
+            ? "network"
+            : "local";
+        const selectedMode = await prompts.select({
+            message: "How should clients reach this ForgeRelay instance?",
+            initialValue: defaultNetworkMode,
+            options: [
+                {
+                    value: "local",
+                    label: "Local only",
+                    hint: "Bind to loopback; local clients only. Client-facing URL is derived automatically.",
+                },
+                {
+                    value: "ssh",
+                    label: "SSH relay",
+                    hint: "Bind to loopback; another ForgeRelay reaches it through an SSH tunnel.",
+                },
+                {
+                    value: "network",
+                    label: "LAN / HTTPS proxy",
+                    hint: "Expose through a LAN address or an HTTPS reverse proxy/tunnel.",
+                },
+            ],
+        });
+        if (prompts.isCancel(selectedMode))
+            throw new SetupCancelledError();
+        const networkMode = selectedMode;
+        let host = "127.0.0.1";
+        let publicBaseUrl = null;
+        let clientFacingBaseUrls = [`http://127.0.0.1:${port}`];
+        if (networkMode === "network") {
+            const defaultHost = files.config.host && !isLoopbackBindAddress(files.config.host)
+                ? files.config.host
+                : "0.0.0.0";
+            host = await textPrompt({
+                message: "Which address should ForgeRelay bind to? Use 0.0.0.0 for direct LAN, or 127.0.0.1 behind a local reverse proxy.",
+                placeholder: defaultHost,
+                defaultValue: defaultHost,
+                validate: validateBindAddress,
+            });
+            const defaultClientFacing = existingPublicBaseUrls.join(", ");
+            clientFacingBaseUrls = normalizePublicBaseUrlsInput(await textPrompt({
+                message: defaultClientFacing
+                    ? `What client-facing base URLs should clients use? Press Enter to keep ${defaultClientFacing}`
+                    : "What client-facing base URL should clients use?",
+                placeholder: defaultClientFacing || `http://192.168.1.20:${port} or https://forge.example.com`,
+                defaultValue: defaultClientFacing,
+                validate: validateClientFacingBaseUrls,
+            }));
+            for (const baseUrl of clientFacingBaseUrls)
+                classifyClientFacingBaseUrl(baseUrl);
+            if (hasInsecureLanBaseUrl(clientFacingBaseUrls)) {
+                prompts.note([
+                    "Plain HTTP does not encrypt the ForgeRelay Owner approval flow or MCP bearer tokens.",
+                    "Use this only on a trusted private LAN. Prefer SSH relay or HTTPS when the network is not fully trusted.",
+                ].join("\n"), "Unencrypted LAN access");
+                const approved = await prompts.confirm({
+                    message: "Allow unencrypted HTTP access on this private network?",
+                    initialValue: false,
+                });
+                if (prompts.isCancel(approved) || approved !== true)
+                    throw new SetupCancelledError();
+            }
+            publicBaseUrl = compactPublicBaseUrlConfig(clientFacingBaseUrls);
+        }
+        const installedManaged = installedManagedLanguageServers(files.dir);
+        const selectedManaged = await prompts.multiselect({
+            message: "Which Language Servers should ForgeRelay manage with npm?",
+            options: managedLanguageServerOptions(),
+            initialValues: installedManaged,
+            required: false,
+        });
+        if (prompts.isCancel(selectedManaged))
+            throw new SetupCancelledError();
+        const managedIds = selectedManaged;
+        const allowAgentInstallAnswer = await prompts.confirm({
+            message: "Allow Agents to install or update ForgeRelay-managed Language Servers on demand?",
+            initialValue: files.config.allowAgentLanguageServerInstall === true,
+        });
+        if (prompts.isCancel(allowAgentInstallAnswer))
+            throw new SetupCancelledError();
+        const allowAgentLanguageServerInstall = allowAgentInstallAnswer === true;
+        if (managedIds.length > 0) {
+            prompts.note([
+                "ForgeRelay installs these optional Language Servers into its private config directory, not global npm.",
+                "Rust Analyzer, gopls, and clangd remain external toolchain/system installations and are auto-detected when available.",
+            ].join("\n"), "Managed Language Servers");
+            const spinner = prompts.spinner();
+            spinner.start("Installing managed Language Servers with npm");
+            try {
+                const installed = await installManagedLanguageServers(managedIds, files.dir);
+                spinner.stop(`Installed ${installed.installed.join(", ")} under ${installed.root}`);
+            }
+            catch (error) {
+                spinner.stop("Managed Language Server installation failed");
+                throw error;
+            }
+        }
+        const config = {
+            host,
+            port,
+            allowedRoots,
+            publicBaseUrl,
+            allowedHosts: files.config.allowedHosts,
+            workflowInstructions: files.config.workflowInstructions,
+            appendInstructions: files.config.appendInstructions,
+            subagents: resolveSubagentsFlag(files.config),
+            languageServers: files.config.languageServers,
+            allowAgentLanguageServerInstall,
+        };
+        const auth = {
+            ...files.auth,
+            ownerToken: files.auth.ownerToken ?? generateOwnerToken(),
+            instanceId: files.auth.instanceId ?? generateInstanceId(),
+        };
+        const configPath = writeForgeRelayConfig(config);
+        const authPath = await writeForgeRelayAuth(auth);
+        const lines = [
+            `Config: ${configPath}`,
+            `Auth: ${authPath}`,
+            `Bind: http://${config.host}:${config.port}`,
+            ...clientFacingBaseUrls.map((baseUrl, index) => `${index === 0 ? "Client-facing MCP URL" : "Client-facing MCP alias"}: ${publicEndpointUrl(baseUrl, "mcp").toString()}`),
+        ];
+        if (networkMode === "ssh") {
+            lines.push(`SSH relay: forgerelay auth -J <ssh-host> 127.0.0.1:${port} --ssh-auth`);
+        }
+        prompts.note(lines.join("\n"), "ForgeRelay configured");
+        prompts.note([
+            `Owner password: ${auth.ownerToken}`,
+            "Use this when ChatGPT or Claude asks you to approve ForgeRelay access.",
+            `Stored at: ${authPath}`,
+        ].join("\n"), "Owner password");
+        prompts.outro("Run `forgerelay serve` to start the MCP server.");
+    }
+    catch (error) {
+        if (error instanceof SetupCancelledError) {
+            prompts.cancel("Setup cancelled");
+            return;
+        }
+        throw error;
+    }
+}

package/dist/cli/setup-support.js

@@ -0,0 +1,181 @@
+import { isIP } from "node:net";
+import { createRequire } from "node:module";
+import * as prompts from "@clack/prompts";
+import { satisfies } from "semver";
+const SUPPORTED_NODE_RANGE = ">=20.12 <27";
+const require = createRequire(import.meta.url);
+export function isNullConfigValue(value) {
+    const normalized = value.trim().toLowerCase();
+    return !normalized || normalized === "null" || normalized === "none";
+}
+export function normalizeOptionalPublicBaseUrl(value) {
+    const trimmed = value.trim();
+    if (isNullConfigValue(trimmed))
+        return null;
+    return compactPublicBaseUrlConfig(normalizePublicBaseUrlsInput(trimmed));
+}
+export function normalizePublicBaseUrlsInput(value) {
+    const entries = value
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    if (entries.length === 0)
+        throw new Error("Enter at least one public base URL.");
+    return Array.from(new Set(entries.map((entry) => normalizePublicBaseUrl(entry))));
+}
+export function compactPublicBaseUrlConfig(baseUrls) {
+    return baseUrls.length === 1 ? baseUrls[0] : baseUrls;
+}
+export function normalizePublicBaseUrl(value) {
+    const trimmed = value.trim();
+    const parsed = new URL(trimmed);
+    parsed.hash = "";
+    parsed.search = "";
+    parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+    return parsed.toString().replace(/\/$/, "");
+}
+export function classifyClientFacingBaseUrl(value) {
+    const parsed = new URL(normalizePublicBaseUrl(value));
+    if (parsed.protocol === "https:")
+        return "secure";
+    if (parsed.protocol !== "http:") {
+        throw new Error("Client-facing base URLs must use http:// or https://.");
+    }
+    if (!isPrivateNetworkHost(parsed.hostname)) {
+        throw new Error("Plain HTTP is allowed only for local/LAN addresses. Use HTTPS for public addresses.");
+    }
+    return "insecure-lan";
+}
+export function validateClientFacingBaseUrls(value) {
+    const trimmed = value?.trim() ?? "";
+    if (!trimmed)
+        return "Enter at least one client-facing base URL.";
+    try {
+        for (const baseUrl of normalizePublicBaseUrlsInput(trimmed))
+            classifyClientFacingBaseUrl(baseUrl);
+        return undefined;
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+export function hasInsecureLanBaseUrl(baseUrls) {
+    return baseUrls.some((baseUrl) => classifyClientFacingBaseUrl(baseUrl) === "insecure-lan");
+}
+function isPrivateNetworkHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost" || !host.includes(".") || host.endsWith(".local") || host.endsWith(".lan") || host.endsWith(".home.arpa")) {
+        return true;
+    }
+    const family = isIP(host);
+    if (family === 4) {
+        const [a, b] = host.split(".").map(Number);
+        return a === 10
+            || a === 127
+            || (a === 172 && b >= 16 && b <= 31)
+            || (a === 192 && b === 168)
+            || (a === 169 && b === 254)
+            || (a === 100 && b >= 64 && b <= 127);
+    }
+    if (family === 6) {
+        return host === "::1"
+            || host.startsWith("fc")
+            || host.startsWith("fd")
+            || /^fe[89ab]/.test(host);
+    }
+    return false;
+}
+export async function textPrompt(options) {
+    const result = await prompts.text({
+        ...options,
+        validate: (value) => options.validate?.(value?.trim() ? value : options.defaultValue),
+    });
+    if (prompts.isCancel(result))
+        throw new SetupCancelledError();
+    const value = String(result).trim();
+    return value || options.defaultValue;
+}
+export function validatePort(value) {
+    const port = Number(value);
+    return Number.isInteger(port) && port >= 1 && port <= 65535
+        ? undefined
+        : "Enter a port between 1 and 65535.";
+}
+export function isLoopbackBindAddress(value) {
+    const host = value.trim().toLowerCase();
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+export function validateBindAddress(value) {
+    const host = value?.trim() ?? "";
+    if (!host)
+        return "Enter a bind address.";
+    if (/\s|:\/\//.test(host) || host.includes("/")) {
+        return "Enter only a host or IP address, not a URL.";
+    }
+    return undefined;
+}
+export function validateRequiredPublicBaseUrls(value) {
+    const trimmed = value?.trim() ?? "";
+    if (!trimmed)
+        return "Enter at least one public base URL from your tunnel or reverse proxy.";
+    try {
+        normalizePublicBaseUrlsInput(trimmed);
+        return undefined;
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+export function assertSupportedNode() {
+    if (satisfies(process.versions.node, SUPPORTED_NODE_RANGE))
+        return;
+    throw new Error([
+        `ForgeRelay requires Node ${SUPPORTED_NODE_RANGE}.`,
+        `Current Node: ${process.version}`,
+        "",
+        "Install Node 22 LTS or use a version manager such as nvm, fnm, or mise.",
+    ].join("\n"));
+}
+export function nodeVersionStatus() {
+    return satisfies(process.versions.node, SUPPORTED_NODE_RANGE)
+        ? `supported ${SUPPORTED_NODE_RANGE}`
+        : `unsupported, requires ${SUPPORTED_NODE_RANGE}`;
+}
+export class SetupCancelledError extends Error {
+}
+export function checkSqliteNative() {
+    try {
+        const Database = require("better-sqlite3");
+        const db = new Database(":memory:");
+        db.close();
+        return "ok";
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+export function checkGitAvailable() {
+    try {
+        const { execFileSync } = require("node:child_process");
+        return execFileSync("git", ["--version"], { encoding: "utf8" }).trim();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return `unavailable (${message})`;
+    }
+}
+export function checkBashShell() {
+    try {
+        const { execFileSync } = require("node:child_process");
+        const command = process.env.BASH?.trim() || "bash";
+        const version = execFileSync(command, ["--version"], {
+            encoding: "utf8",
+            windowsHide: true,
+        }).split(/\r?\n/, 1)[0]?.trim();
+        return version ? `${command} (${version})` : command;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return `unavailable (${message})`;
+    }
+}