@astralyn/sash 0.1.0

package/dist/process.js

@@ -0,0 +1,572 @@
+import { execFile, execFileSync, spawn } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { atomicWriteFileSync, durableRemoveFileSync, durableRenameSync } from "./fs-atomic.js";
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "EPERM")
+            return true;
+        return false;
+    }
+}
+function normalizePath(filePath) {
+    const cleaned = filePath.replace(/\s+\(deleted\)$/i, "").trim();
+    try {
+        return fs.realpathSync.native(cleaned);
+    }
+    catch {
+        return path.resolve(cleaned);
+    }
+}
+function exePathsMatch(observedPath, expectedPath) {
+    try {
+        const a = normalizePath(observedPath);
+        const b = normalizePath(expectedPath);
+        return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+    }
+    catch {
+        return false;
+    }
+}
+function basenameLower(filePath) {
+    return path.posix.basename(filePath.replace(/\\/g, "/")).toLowerCase();
+}
+function stripExeSuffix(name) {
+    return name.toLowerCase().replace(/\.exe$/, "");
+}
+function imageMatchesExpectedExe(imageOrComm, expectedExe) {
+    const expected = stripExeSuffix(basenameLower(expectedExe));
+    if (!expected)
+        return false;
+    const observed = stripExeSuffix(basenameLower(imageOrComm.trim()));
+    if (!observed)
+        return false;
+    if (observed === expected)
+        return true;
+    if (observed.length === 15 && expected.startsWith(observed) && expected.length > 15) {
+        return true;
+    }
+    return false;
+}
+let cachedPowerShell;
+function runPowerShell(script, timeoutMs = 5000) {
+    const windowsPowerShell = windowsSystemExecutable(path.join("WindowsPowerShell", "v1.0", "powershell.exe"));
+    const pwsh = findExecutableOnPath("pwsh.exe");
+    const candidates = [windowsPowerShell, ...(pwsh ? [pwsh] : [])];
+    const shells = cachedPowerShell
+        ? [cachedPowerShell, ...candidates.filter((shell) => shell !== cachedPowerShell)]
+        : candidates;
+    for (const shell of shells) {
+        try {
+            const output = runSanitizedCommand(shell, ["-NoProfile", "-NonInteractive", "-Command", script], { timeoutMs }).trim();
+            cachedPowerShell = shell;
+            if (output)
+                return output;
+        }
+        catch {
+        }
+    }
+    return undefined;
+}
+function readWindowsExecutablePath(pid) {
+    const script = [
+        `$process = Get-Process -Id ${pid} -ErrorAction Stop`,
+        "if ($process.Path) { [Console]::Out.Write($process.Path) }",
+    ].join("; ");
+    return runPowerShell(script);
+}
+function parseTasklistImageName(tasklistOutput) {
+    const line = tasklistOutput.trim().split(/\r?\n/)[0] ?? "";
+    if (!line || /^INFO:/i.test(line))
+        return undefined;
+    const quoted = line.match(/^"([^"]+)"/);
+    if (quoted?.[1])
+        return quoted[1];
+    const first = line.split(",")[0]?.replace(/^"|"$/g, "").trim();
+    return first || undefined;
+}
+function classifyDarwinComm(commOutput, expectedExe) {
+    const out = commOutput.trim();
+    if (!out)
+        return "mismatch";
+    if (path.isAbsolute(out)) {
+        if (exePathsMatch(out, expectedExe))
+            return "match";
+        if (expectedExe.startsWith(out) && out.length < expectedExe.length)
+            return "unknown";
+        return "mismatch";
+    }
+    return imageMatchesExpectedExe(out, expectedExe) ? "unknown" : "mismatch";
+}
+export function classifyProcessIdentity(pid, expectedExe) {
+    if (!isProcessAlive(pid))
+        return "mismatch";
+    const expected = expectedExe || "";
+    if (!expected)
+        return "unknown";
+    try {
+        if (process.platform === "linux") {
+            try {
+                const exeLink = fs.readlinkSync(`/proc/${pid}/exe`);
+                return exePathsMatch(exeLink, expected) ? "match" : "mismatch";
+            }
+            catch (err) {
+                const code = err.code;
+                return code === "ENOENT" ? "mismatch" : "unknown";
+            }
+        }
+        if (process.platform === "win32") {
+            const executable = readWindowsExecutablePath(pid);
+            if (executable) {
+                return exePathsMatch(executable, expected) ? "match" : "mismatch";
+            }
+            try {
+                const out = runSanitizedCommand(windowsSystemExecutable("tasklist.exe"), ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"], { timeoutMs: 3000 }).trim();
+                const image = parseTasklistImageName(out);
+                if (!image)
+                    return "mismatch";
+                return imageMatchesExpectedExe(image, expected) ? "unknown" : "mismatch";
+            }
+            catch {
+                return "unknown";
+            }
+        }
+        if (process.platform === "darwin") {
+            try {
+                const out = runSanitizedCommand("/bin/ps", ["-ww", "-p", String(pid), "-o", "comm="], {
+                    timeoutMs: 3000,
+                });
+                return classifyDarwinComm(out, expected);
+            }
+            catch {
+                return "unknown";
+            }
+        }
+    }
+    catch {
+        return "unknown";
+    }
+    return "unknown";
+}
+export function readProcessCommandLine(pid) {
+    try {
+        if (process.platform === "linux") {
+            const raw = fs.readFileSync(`/proc/${pid}/cmdline`, "utf8");
+            const parts = raw.split("\0").filter((s) => s.length > 0);
+            return parts.length > 0 ? parts.join(" ") : undefined;
+        }
+        if (process.platform === "win32") {
+            const script = [
+                `$p = Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}" -ErrorAction Stop`,
+                "if ($p.CommandLine) { [Console]::Out.Write($p.CommandLine) }",
+            ].join("; ");
+            return runPowerShell(script);
+        }
+        if (process.platform === "darwin") {
+            const out = runSanitizedCommand("/bin/ps", ["-ww", "-p", String(pid), "-o", "command="], {
+                timeoutMs: 3000,
+            }).trim();
+            return out || undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+export function commandLineContains(pid, marker) {
+    const cmdline = readProcessCommandLine(pid);
+    if (!cmdline)
+        return false;
+    const normalize = (s) => s.replace(/\\/g, "/").toLowerCase();
+    return normalize(cmdline).includes(normalize(marker));
+}
+const STRIPPED_ENV_KEYS = new Set([
+    "GITHUB_TOKEN",
+    "GH_TOKEN",
+    "GH_ENTERPRISE_TOKEN",
+    "GITHUB_PAT",
+    "GITHUB_ACCESS_TOKEN",
+    "GH_PAT",
+    "NPM_TOKEN",
+    "NPM_AUTH_TOKEN",
+    "NODE_AUTH_TOKEN",
+    "NPM_ID_TOKEN",
+    "ACTIONS_ID_TOKEN_REQUEST_TOKEN",
+    "ACTIONS_ID_TOKEN_REQUEST_URL",
+]);
+export function buildSanitizedEnv(sourceEnv = process.env) {
+    const childEnv = { ...sourceEnv };
+    for (const key of Object.keys(childEnv)) {
+        const upper = key.toUpperCase();
+        const lower = key.toLowerCase();
+        const isNpmAuthConfig = lower.startsWith("npm_config_") &&
+            (lower.includes("authtoken") ||
+                lower.includes("auth_token") ||
+                lower.endsWith("_auth") ||
+                lower.includes("password") ||
+                lower.includes("username") ||
+                lower === "npm_config_userconfig" ||
+                lower === "npm_config_globalconfig");
+        if (STRIPPED_ENV_KEYS.has(upper) || isNpmAuthConfig) {
+            delete childEnv[key];
+        }
+    }
+    return childEnv;
+}
+export function runSanitizedCommand(command, args, options = {}) {
+    const output = execFileSync(command, args, {
+        encoding: "utf8",
+        env: buildSanitizedEnv(options.sourceEnv),
+        maxBuffer: options.maxBuffer,
+        stdio: options.stdio ?? ["ignore", "pipe", "pipe"],
+        timeout: options.timeoutMs ?? 5000,
+        windowsHide: true,
+    });
+    return output ?? "";
+}
+export function runSanitizedCommandAsync(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        const child = execFile(command, args, {
+            encoding: "utf8",
+            env: buildSanitizedEnv(options.sourceEnv),
+            maxBuffer: options.maxBuffer,
+            shell: false,
+            timeout: options.timeoutMs ?? 5000,
+            windowsHide: true,
+        }, (error, stdout) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(options.stdio === "ignore" ? "" : (stdout ?? ""));
+        });
+        child.stdin?.end();
+    });
+}
+export function windowsSystemExecutable(relativePath) {
+    const root = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim();
+    return root && path.isAbsolute(root)
+        ? path.join(root, "System32", relativePath)
+        : path.basename(relativePath);
+}
+export function findExecutableOnPath(command, sourceEnv = process.env) {
+    for (const directory of (sourceEnv.PATH ?? sourceEnv.Path ?? "").split(path.delimiter)) {
+        if (!directory || !path.isAbsolute(directory))
+            continue;
+        const candidate = path.join(directory, command);
+        try {
+            if (!fs.lstatSync(candidate).isFile())
+                continue;
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return candidate;
+        }
+        catch {
+        }
+    }
+    return undefined;
+}
+function openPrivateAppendLogFd(filePath) {
+    try {
+        if (!fs.lstatSync(filePath).isFile()) {
+            throw new Error(`Refusing to append to non-regular log file: ${filePath}`);
+        }
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    const noFollow = process.platform === "win32" ? 0 : fs.constants.O_NOFOLLOW;
+    const fd = fs.openSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND | noFollow, 0o600);
+    try {
+        if (!fs.fstatSync(fd).isFile()) {
+            throw new Error(`Refusing to append to non-regular log file: ${filePath}`);
+        }
+        if (process.platform !== "win32")
+            fs.fchmodSync(fd, 0o600);
+        return fd;
+    }
+    catch (err) {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+        }
+        throw err;
+    }
+}
+export function withPrivateAppendLogFds(stdoutPath, stderrPath, use) {
+    const stdoutFd = openPrivateAppendLogFd(stdoutPath);
+    let stderrFd;
+    try {
+        stderrFd = openPrivateAppendLogFd(stderrPath);
+    }
+    catch (err) {
+        try {
+            fs.closeSync(stdoutFd);
+        }
+        catch {
+        }
+        throw err;
+    }
+    try {
+        return use({ stdoutFd, stderrFd });
+    }
+    finally {
+        for (const fd of [stdoutFd, stderrFd]) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+            }
+        }
+    }
+}
+export const TAIL_FILE_CHUNK_BYTES = 64 * 1024;
+const MAX_TAIL_LINE_BYTES = 64 * 1024;
+export function tailFile(filePath, lineCount = 20) {
+    if (!Number.isSafeInteger(lineCount) || lineCount <= 0)
+        return "";
+    let fd;
+    try {
+        const size = fs.statSync(filePath).size;
+        if (size <= 0)
+            return "";
+        fd = fs.openSync(filePath, "r");
+        let position = size;
+        let pending = "";
+        const lines = [];
+        while (position > 0 && lines.length < lineCount) {
+            const bytesToRead = Math.min(TAIL_FILE_CHUNK_BYTES, position);
+            position -= bytesToRead;
+            const chunk = Buffer.allocUnsafe(bytesToRead);
+            const bytesRead = fs.readSync(fd, chunk, 0, bytesToRead, position);
+            const parts = (chunk.subarray(0, bytesRead).toString("utf8") + pending).split(/\r?\n/);
+            pending = parts.shift() ?? "";
+            if (Buffer.byteLength(pending) > MAX_TAIL_LINE_BYTES) {
+                pending = pending.slice(-MAX_TAIL_LINE_BYTES);
+            }
+            for (let index = parts.length - 1; index >= 0 && lines.length < lineCount; index--) {
+                const line = parts[index];
+                if (line?.trim())
+                    lines.push(line);
+            }
+        }
+        if (lines.length < lineCount && pending.trim())
+            lines.push(pending);
+        return lines.reverse().join("\n");
+    }
+    catch {
+        return "";
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+            }
+        }
+    }
+}
+async function runTaskkill(pid, force) {
+    const args = force ? ["/PID", String(pid), "/T", "/F"] : ["/PID", String(pid), "/T"];
+    return new Promise((resolve) => {
+        const killer = spawn(windowsSystemExecutable("taskkill.exe"), args, {
+            env: buildSanitizedEnv(),
+            windowsHide: true,
+            stdio: "ignore",
+        });
+        killer.on("close", (code) => resolve(code === 0));
+        killer.on("error", () => resolve(false));
+    });
+}
+async function processIdentityMatches(verify) {
+    try {
+        return (await verify()) === "match";
+    }
+    catch {
+        return false;
+    }
+}
+async function sendTerminationSignal(pid, force) {
+    if (process.platform === "win32")
+        return runTaskkill(pid, force);
+    try {
+        process.kill(pid, force ? "SIGKILL" : "SIGTERM");
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ESRCH")
+            return true;
+        throw err;
+    }
+}
+export async function killProcessGracefully(pid, opts) {
+    const isAlive = opts.isAliveFn ?? isProcessAlive;
+    const signal = opts.signalFn ?? sendTerminationSignal;
+    const wait = opts.sleepFn ?? sleep;
+    if (!isAlive(pid))
+        return true;
+    if (!(await processIdentityMatches(opts.verify)))
+        return false;
+    const totalTimeout = opts.timeoutMs ?? 10_000;
+    const graceMs = Math.min(5000, Math.floor(totalTimeout / 2));
+    const forceMs = Math.max(1000, totalTimeout - graceMs);
+    const gracefulOk = await signal(pid, false);
+    if (gracefulOk) {
+        const deadline = Date.now() + graceMs;
+        while (Date.now() < deadline && isAlive(pid))
+            await wait(200);
+    }
+    if (isAlive(pid)) {
+        if (!(await processIdentityMatches(opts.verify)))
+            return false;
+        await signal(pid, true);
+        const hardDeadline = Date.now() + forceMs;
+        while (Date.now() < hardDeadline && isAlive(pid))
+            await wait(100);
+    }
+    return !isAlive(pid);
+}
+export function readPidRecord(pidFile) {
+    try {
+        if (!fs.existsSync(pidFile))
+            return undefined;
+        const raw = fs.readFileSync(pidFile, "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.pid === "number" &&
+            Number.isInteger(parsed.pid) &&
+            parsed.pid > 0 &&
+            typeof parsed.exe === "string" &&
+            typeof parsed.startedAt === "string") {
+            return {
+                pid: parsed.pid,
+                exe: parsed.exe,
+                startedAt: parsed.startedAt,
+            };
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function writePidRecord(pidFile, record) {
+    atomicWriteFileSync(pidFile, `${JSON.stringify(record, null, 2)}\n`);
+}
+export function clearPidRecord(pidFile) {
+    try {
+        fs.rmSync(pidFile, { force: true });
+    }
+    catch {
+    }
+}
+export function binaryUnlockProbePath(target) {
+    return path.join(path.dirname(target), `.${path.basename(target)}.unlock-probe`);
+}
+function regularFileStat(file) {
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile())
+            throw new Error(`Binary path is not a regular file: ${file}`);
+        return stat;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return undefined;
+        throw err;
+    }
+}
+function fileDigestSync(file) {
+    const hash = crypto.createHash("sha256");
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    const fd = fs.openSync(file, "r");
+    try {
+        for (;;) {
+            const bytes = fs.readSync(fd, buffer, 0, buffer.length, null);
+            if (bytes === 0)
+                break;
+            hash.update(buffer.subarray(0, bytes));
+        }
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    return hash.digest("hex");
+}
+export function recoverBinaryUnlockProbe(target) {
+    const probe = binaryUnlockProbePath(target);
+    const probeStat = regularFileStat(probe);
+    if (!probeStat)
+        return;
+    const targetStat = regularFileStat(target);
+    if (!targetStat) {
+        durableRenameSync(probe, target);
+        return;
+    }
+    if (probeStat.size === targetStat.size && fileDigestSync(probe) === fileDigestSync(target)) {
+        durableRemoveFileSync(probe);
+        return;
+    }
+    throw new Error(`Core binary and unlock probe both exist with different content; preserved ${target} and ${probe}`);
+}
+async function recoverUnlockProbeWithRetry(target) {
+    let lastError;
+    for (let attempt = 0; attempt < 4; attempt++) {
+        try {
+            recoverBinaryUnlockProbe(target);
+            return;
+        }
+        catch (err) {
+            lastError = err;
+            if (attempt < 3)
+                await sleep(100);
+        }
+    }
+    throw lastError;
+}
+export async function waitForBinaryUnlocked(target, timeoutMs = 30_000) {
+    await recoverUnlockProbeWithRetry(target);
+    if (process.platform !== "win32" || !fs.existsSync(target))
+        return;
+    const probe = binaryUnlockProbePath(target);
+    const deadline = Date.now() + timeoutMs;
+    let delay = 150;
+    while (Date.now() < deadline) {
+        try {
+            durableRenameSync(target, probe);
+        }
+        catch {
+            await sleep(delay);
+            delay = Math.min(1000, Math.floor(delay * 1.5));
+            continue;
+        }
+        try {
+            durableRenameSync(probe, target);
+            return;
+        }
+        catch (secondError) {
+            try {
+                await recoverUnlockProbeWithRetry(target);
+                return;
+            }
+            catch (recoveryError) {
+                throw new Error(`Failed to restore the binary after the lock probe; preserved state near ${probe}: ${secondError.message}; recovery failed: ${recoveryError.message}`);
+            }
+        }
+    }
+    await recoverUnlockProbeWithRetry(target);
+    throw new Error(`Binary is still locked after ${timeoutMs}ms: ${target}. Close programs using it and retry.`);
+}

package/dist/profile-migration.js

@@ -0,0 +1,101 @@
+import fs from "node:fs";
+import { isDeepStrictEqual } from "node:util";
+import YAML from "yaml";
+import { commitManagedStateTransaction, defaultManagedStateFileOperations, } from "./managed-state-transaction.js";
+import { buildDefaultConfig, isValidMihomoConfig, PROFILE_DOWNLOAD_SIZE_LIMIT, stripManagedKeys, } from "./mihomo-config.js";
+import { allocateProfileId, DEFAULT_PROFILE_INTERVAL_HOURS, findProfileByUrl, loadProfiles, NEVER_UPDATED, profileNameFromUrl, } from "./profiles.js";
+export const IMPORTED_CONFIG_PROFILE_NAME = "Imported config";
+export async function migrateLegacyProfileSetting(settings, layout, files = defaultManagedStateFileOperations) {
+    if (!("subscriptionUrl" in settings))
+        return false;
+    const candidate = { ...settings };
+    const url = candidate.subscriptionUrl?.trim() ?? "";
+    delete candidate.subscriptionUrl;
+    let migratedIndex;
+    if (url) {
+        const index = loadProfiles(layout);
+        if (!findProfileByUrl(index, url)) {
+            const now = new Date().toISOString();
+            const profile = {
+                id: allocateProfileId(index, layout),
+                name: profileNameFromUrl(url),
+                url,
+                intervalHours: DEFAULT_PROFILE_INTERVAL_HOURS,
+                createdAt: now,
+                updatedAt: NEVER_UPDATED,
+            };
+            migratedIndex = {
+                activeId: index.activeId ?? profile.id,
+                profiles: [...index.profiles, profile],
+            };
+        }
+    }
+    await commitManagedStateTransaction(layout, { ...(migratedIndex ? { index: migratedIndex } : {}), settings: candidate }, undefined, files);
+    delete settings.subscriptionUrl;
+    return true;
+}
+function hasMeaningfulRoutingContent(doc) {
+    const unmanaged = stripManagedKeys(doc);
+    const defaultConfig = buildDefaultConfig();
+    if (isDeepStrictEqual(unmanaged, defaultConfig))
+        return false;
+    if (Array.isArray(unmanaged.proxies) && unmanaged.proxies.length > 0)
+        return true;
+    const providers = unmanaged["proxy-providers"];
+    if (typeof providers === "object" &&
+        providers !== null &&
+        !Array.isArray(providers) &&
+        Object.keys(providers).length > 0) {
+        return true;
+    }
+    const groups = unmanaged["proxy-groups"];
+    if (Array.isArray(groups) &&
+        groups.length > 0 &&
+        !isDeepStrictEqual(groups, defaultConfig["proxy-groups"])) {
+        return true;
+    }
+    return (Array.isArray(unmanaged.rules) &&
+        unmanaged.rules.length > 0 &&
+        !isDeepStrictEqual(unmanaged.rules, defaultConfig.rules));
+}
+export async function migrateUnmanagedConfig(layout, files = defaultManagedStateFileOperations) {
+    if (fs.existsSync(layout.profilesIndexFile) || !fs.existsSync(layout.configFile))
+        return false;
+    const stat = fs.lstatSync(layout.configFile);
+    if (!stat.isFile() || stat.size > PROFILE_DOWNLOAD_SIZE_LIMIT) {
+        throw new Error(`Unmanaged config must be a regular file no larger than ${PROFILE_DOWNLOAD_SIZE_LIMIT} bytes: ${layout.configFile}`);
+    }
+    const yamlText = fs.readFileSync(layout.configFile, "utf8");
+    let doc;
+    try {
+        doc = YAML.parse(yamlText);
+    }
+    catch (err) {
+        throw new Error(`Unmanaged config is invalid YAML and was left unchanged: ${layout.configFile}: ${err.message}`);
+    }
+    if (!isValidMihomoConfig(doc)) {
+        throw new Error(`Unmanaged config is not a valid core configuration and was left unchanged: ${layout.configFile}`);
+    }
+    if (!hasMeaningfulRoutingContent(doc))
+        return false;
+    const now = new Date().toISOString();
+    const id = allocateProfileId({ activeId: null, profiles: [] }, layout);
+    const profile = {
+        id,
+        name: IMPORTED_CONFIG_PROFILE_NAME,
+        url: "",
+        intervalHours: 0,
+        createdAt: now,
+        updatedAt: now,
+    };
+    await commitManagedStateTransaction(layout, {
+        index: { activeId: id, profiles: [profile] },
+        profile: { id, yamlText },
+    }, undefined, files);
+    return true;
+}
+export async function migrateProfileState(settings, layout, files = defaultManagedStateFileOperations) {
+    const legacySubscription = await migrateLegacyProfileSetting(settings, layout, files);
+    const unmanagedConfig = await migrateUnmanagedConfig(layout, files);
+    return { legacySubscription, unmanagedConfig };
+}