@cydm/happy-elves 0.1.0-beta.70 → 0.1.0-beta.72

package/README.md

@@ -8,7 +8,7 @@ Public beta CLI for Happy Elves.
 happy-elves start
 ```
 
-Existing workspace recovery uses a one-time invite from Settings → Browsers → Add:
+Reconnect this Device to an existing Account with a one-time invite from Settings → Devices → Add Device (the CLI command name is retained for compatibility):
 
 ```bash
 happy-elves remote join-controller --url "<invite-url>" --recover-controller --json

package/apps/cli/dist/commands/account.js

@@ -2,12 +2,16 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
-import { CliError, configDir, configPath, generateAccountSecret, ok, parsePairingStartResponse, randomId, readRelayJson, requireRelayUrl, stopLocalDaemon, throwRelayHttpError, withAccountConfigTransaction } from "./lib/index.js";
+import { accountBindingPath, assertNoPendingEnrollmentAuthority, CliError, configDir, configPath, generateAccountSecret, ok, parseControllerConfig, parseDaemonConfig, parseLocalAccountBinding, parsePairingStartResponse, randomId, readLocalAccountBinding, readRelayJson, requireRelayUrl, stopLocalDaemon, throwRelayHttpError, withAccountConfigTransaction, } from "./lib/index.js";
+import { createLocalAccountBindingV1, localAccountBindingMatchesV1, } from "../../../../packages/shared/dist/index.js";
+import { commitAccountSnapshotMutation, } from "./lib/account-snapshot.js";
 const daemonConfigPath = path.join(configDir, "daemon.json");
-const accountConfigFiles = ["config.json", "daemon.json"];
+const accountConfigFiles = ["config.json", "daemon.json", "account.json"];
 const accountCreateRelayTimeoutMs = 15_000;
 function accountConfigTarget(file) {
-    return file === "config.json" ? configPath : daemonConfigPath;
+    if (file === "config.json")
+        return configPath;
+    return file === "daemon.json" ? daemonConfigPath : accountBindingPath;
 }
 export async function confirmReset(flags, testIo) {
     if (flags.json === true) {
@@ -72,8 +76,17 @@ async function copyConfigIfPresent(source, target) {
         const stat = await fs.lstat(source);
         if (!stat.isFile() || stat.isSymbolicLink())
             throw new CliError(`Refusing to copy non-regular config file: ${source}`, "CONFIG_BACKUP_UNSAFE");
-        await fs.copyFile(source, target);
-        await fs.chmod(target, 0o600);
+        const contents = await fs.readFile(source);
+        let handle;
+        try {
+            handle = await fs.open(target, "wx", 0o600);
+            await handle.writeFile(contents);
+            await handle.chmod(0o600);
+            await handle.sync();
+        }
+        finally {
+            await handle?.close().catch(() => undefined);
+        }
         return true;
     }
     catch (error) {
@@ -82,11 +95,41 @@ async function copyConfigIfPresent(source, target) {
         throw error;
     }
 }
+const unsupportedWindowsDirectorySyncCodes = new Set(["EINVAL", "ENOTSUP", "EISDIR", "EPERM"]);
+async function syncDirectory(directory) {
+    let handle;
+    try {
+        handle = await fs.open(directory, "r");
+        await handle.sync();
+    }
+    catch (error) {
+        if (process.platform !== "win32"
+            || !unsupportedWindowsDirectorySyncCodes.has(error.code ?? ""))
+            throw error;
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+async function writeSyncedBackupManifest(filePath, contents) {
+    let handle;
+    try {
+        handle = await fs.open(filePath, "wx", 0o600);
+        await handle.writeFile(contents, "utf8");
+        await handle.chmod(0o600);
+        await handle.sync();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
 async function backupAccountConfig(prefix = "account-reset") {
     const stamp = new Date().toISOString().replace(/[:.]/gu, "-");
     const backupsRoot = path.join(configDir, "backups");
+    let rootCreated = false;
     try {
         await fs.mkdir(backupsRoot, { mode: 0o700 });
+        rootCreated = true;
     }
     catch (error) {
         if (error.code !== "EEXIST")
@@ -97,15 +140,24 @@ async function backupAccountConfig(prefix = "account-reset") {
         throw new CliError("Refusing to write an account backup through an unsafe backups path.", "CONFIG_BACKUP_UNSAFE");
     }
     await fs.chmod(backupsRoot, 0o700);
+    if (rootCreated)
+        await syncDirectory(configDir);
     const backupPath = path.join(backupsRoot, `${prefix}-${stamp}-${randomId("backup")}`);
-    await fs.mkdir(backupPath, { mode: 0o700 });
-    await fs.chmod(backupPath, 0o700);
+    const stagingPath = path.join(backupsRoot, `.account-backup-staging-${randomId("backup")}`);
+    await fs.mkdir(stagingPath, { mode: 0o700 });
+    await fs.chmod(stagingPath, 0o700);
+    await syncDirectory(backupsRoot);
     const files = [];
-    if (await copyConfigIfPresent(configPath, path.join(backupPath, "config.json")))
+    if (await copyConfigIfPresent(configPath, path.join(stagingPath, "config.json")))
         files.push("config.json");
-    if (await copyConfigIfPresent(daemonConfigPath, path.join(backupPath, "daemon.json")))
+    if (await copyConfigIfPresent(daemonConfigPath, path.join(stagingPath, "daemon.json")))
         files.push("daemon.json");
-    await fs.writeFile(path.join(backupPath, "manifest.json"), JSON.stringify({ version: 1, createdAt: new Date().toISOString(), files }, null, 2) + "\n", { mode: 0o600 });
+    if (await copyConfigIfPresent(accountBindingPath, path.join(stagingPath, "account.json")))
+        files.push("account.json");
+    await writeSyncedBackupManifest(path.join(stagingPath, "manifest.json"), JSON.stringify({ version: 1, createdAt: new Date().toISOString(), files }, null, 2) + "\n");
+    await syncDirectory(stagingPath);
+    await fs.rename(stagingPath, backupPath);
+    await syncDirectory(backupsRoot);
     return { path: backupPath, files };
 }
 async function requireDaemonStopped() {
@@ -138,18 +190,28 @@ async function requireRegularBackupFile(filePath) {
         throw new CliError(`Account backup contains an unsafe ${path.basename(filePath)}.`, "ACCOUNT_BACKUP_INVALID");
     }
 }
-async function stageAccountRestore(backupPath, files) {
+async function stageAccountRestore(backupPath, requestedFiles) {
     await fs.mkdir(configDir, { recursive: true, mode: 0o700 });
     await fs.chmod(configDir, 0o700);
     const stagingPath = await fs.mkdtemp(path.join(configDir, ".account-restore-"));
     await fs.chmod(stagingPath, 0o700);
+    let files = [...requestedFiles];
+    let controller;
+    let daemon;
+    let binding;
     try {
         for (const file of files) {
             const source = path.join(backupPath, file);
             await requireRegularBackupFile(source);
             const contents = await fs.readFile(source, "utf8");
             try {
-                JSON.parse(contents);
+                const parsed = JSON.parse(contents);
+                if (file === "config.json")
+                    controller = parseControllerConfig(parsed);
+                else if (file === "daemon.json")
+                    daemon = parseDaemonConfig(parsed);
+                else if (file === "account.json")
+                    binding = parseLocalAccountBinding(parsed);
             }
             catch {
                 throw new CliError(`Account backup ${file} is not valid JSON.`, "ACCOUNT_BACKUP_INVALID");
@@ -158,6 +220,38 @@ async function stageAccountRestore(backupPath, files) {
             await fs.writeFile(staged, contents, { mode: 0o600, flag: "wx" });
             await fs.chmod(staged, 0o600);
         }
+        if (controller && daemon &&
+            (controller.relayUrl !== daemon.relayUrl ||
+                controller.accountSecret !== daemon.accountSecret)) {
+            throw new CliError("Account backup Device and Daemon credentials identify different Accounts.", "ACCOUNT_BACKUP_INVALID");
+        }
+        if (binding) {
+            if (controller && !localAccountBindingMatchesV1(binding, {
+                relayUrl: controller.relayUrl,
+                accountSecret: controller.accountSecret,
+            }) ||
+                daemon && !localAccountBindingMatchesV1(binding, {
+                    relayUrl: daemon.relayUrl,
+                    accountId: daemon.accountId,
+                    accountSecret: daemon.accountSecret,
+                })) {
+                throw new CliError("Account backup binding does not match its Device or Daemon credential.", "ACCOUNT_BACKUP_INVALID");
+            }
+        }
+        else if (controller || daemon) {
+            const credential = controller ?? daemon;
+            if (!credential)
+                throw new CliError("Account backup credential is missing.", "ACCOUNT_BACKUP_INVALID");
+            binding = createLocalAccountBindingV1({
+                relayUrl: credential.relayUrl,
+                accountId: daemon?.accountId ?? null,
+                accountSecret: credential.accountSecret,
+            });
+            const stagedBinding = path.join(stagingPath, "account.json");
+            await fs.writeFile(stagedBinding, `${JSON.stringify(binding, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+            await fs.chmod(stagedBinding, 0o600);
+            files = [...files, "account.json"];
+        }
         return { path: stagingPath, files };
     }
     catch (error) {
@@ -184,72 +278,16 @@ async function currentAccountConfigFiles() {
     }
     return existing;
 }
-async function applyAccountRestore(staged) {
-    const existing = await currentAccountConfigFiles();
-    const rollbackPath = await fs.mkdtemp(path.join(configDir, ".account-restore-rollback-"));
-    await fs.chmod(rollbackPath, 0o700);
-    const moved = [];
-    const installed = [];
-    let result;
-    let preserveRollback = false;
-    try {
-        for (const file of existing) {
-            await fs.rename(accountConfigTarget(file), path.join(rollbackPath, file));
-            moved.push(file);
-        }
-        for (const file of staged.files) {
-            const target = accountConfigTarget(file);
-            await fs.rename(path.join(staged.path, file), target);
-            installed.push(file);
-            await fs.chmod(target, 0o600);
-        }
-        result = {
-            restored: staged.files.map(accountConfigTarget),
-            removed: existing.filter((file) => !staged.files.includes(file)).map(accountConfigTarget),
-        };
-    }
-    catch (error) {
-        const rollbackFailures = [];
-        for (const file of [...installed].reverse()) {
-            try {
-                await fs.rm(accountConfigTarget(file), { force: true });
-            }
-            catch (rollbackError) {
-                rollbackFailures.push(`${file} cleanup: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
-            }
-        }
-        for (const file of [...moved].reverse()) {
-            try {
-                const target = accountConfigTarget(file);
-                await fs.rename(path.join(rollbackPath, file), target);
-                await fs.chmod(target, 0o600);
-            }
-            catch (rollbackError) {
-                rollbackFailures.push(`${file} rollback: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
-            }
-        }
-        const detail = error instanceof Error ? error.message : String(error);
-        if (rollbackFailures.length > 0) {
-            preserveRollback = true;
-            throw new CliError(`Account restore failed and rollback was incomplete: ${detail}. ${rollbackFailures.join("; ")}. Recovery files remain in ${rollbackPath}`, "ACCOUNT_RESTORE_ROLLBACK_FAILED");
-        }
-        throw new CliError(`Account restore failed; the previous configuration was restored: ${detail}`, "ACCOUNT_RESTORE_FAILED");
-    }
-    finally {
-        if (!preserveRollback)
-            await fs.rm(rollbackPath, { recursive: true, force: true });
-    }
-    if (!result)
-        throw new CliError("Account restore did not produce a result", "ACCOUNT_RESTORE_FAILED");
-    return result;
-}
 export async function handleAccount({ domain, action, flags }) {
     if (domain === "account" && action === "create") {
         const created = await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
             // This check intentionally precedes every relay request. Holding the
             // account-wide lease through pairing prevents concurrent creators from
             // producing an orphan remote account and racing the local credential.
-            if (await transaction.controllerExists() || await transaction.daemonExists()) {
+            if (await transaction.accountExists() ||
+                await transaction.controllerExists() ||
+                await transaction.daemonExists()) {
                 throw new CliError("Happy Elves account configuration already exists. Use an invite to recover the existing account; account create never replaces credentials.", "CONFIG_EXISTS");
             }
             const relayUrl = requireRelayUrl(flags);
@@ -261,7 +299,7 @@ export async function handleAccount({ domain, action, flags }) {
                 response = await fetch(`${relayUrl}/api/pairing/start`, {
                     method: "POST",
                     headers: { "content-type": "application/json" },
-                    body: JSON.stringify({ deviceId, deviceName }),
+                    body: JSON.stringify({ deviceId, deviceName, surface: "cli" }),
                     signal: AbortSignal.timeout(accountCreateRelayTimeoutMs),
                 });
             }
@@ -280,7 +318,7 @@ export async function handleAccount({ domain, action, flags }) {
                 controllerToken: paired.controllerToken,
                 accountSecret,
             };
-            await transaction.writeController(config, "create");
+            await transaction.writeController(config, "create", paired.accountId);
             return {
                 accountId: paired.accountId,
                 configPath,
@@ -292,20 +330,34 @@ export async function handleAccount({ domain, action, flags }) {
                 expiresAt: paired.expiresAt,
             };
         });
-        ok("account.create", created);
+        if (flags["reveal-secrets"] === true) {
+            ok("account.create", created);
+        }
+        else {
+            const { controllerToken: _controllerToken, accountSecret: _accountSecret, ...safeCreated } = created;
+            ok("account.create", safeCreated);
+        }
         return true;
     }
     if (domain === "account" && action === "reset") {
         await confirmReset(flags);
-        const stop = await requireDaemonStopped();
-        const backup = await withAccountConfigTransaction(async () => {
+        // Reject an unknown or malformed ownership boundary before stopping a
+        // healthy Daemon. The locked read below repeats this check at commit.
+        await readLocalAccountBinding();
+        await assertNoPendingEnrollmentAuthority();
+        const { backup, stop } = await withAccountConfigTransaction(async (transaction) => {
+            await transaction.readAccountBinding();
+            await assertNoPendingEnrollmentAuthority();
+            // Lock order is Account config -> verified Daemon lifetime. Local
+            // start/restart use the same order, so no process can reload the old
+            // credential between this stop and the snapshot commit.
+            const stop = await requireDaemonStopped();
             const result = await backupAccountConfig();
-            await fs.rm(configPath, { force: true });
-            await fs.rm(daemonConfigPath, { force: true });
-            return result;
+            await commitAccountSnapshotMutation({}, "reset");
+            return { backup: result, stop };
         });
         ok("account.reset", {
-            removed: [configPath, daemonConfigPath],
+            removed: [configPath, daemonConfigPath, accountBindingPath],
             backup,
             restoreCommand: `happy-elves account restore --from ${JSON.stringify(backup.path)} --yes --json`,
             stop,
@@ -336,11 +388,19 @@ export async function handleAccount({ domain, action, flags }) {
         try {
             const existing = await currentAccountConfigFiles();
             await confirmRestore(flags, files.length === 0 || existing.length > 0);
-            const stop = await requireDaemonStopped();
-            const { preRestoreBackup, restored } = await withAccountConfigTransaction(async () => {
+            await readLocalAccountBinding();
+            await assertNoPendingEnrollmentAuthority();
+            const { preRestoreBackup, restored, stop } = await withAccountConfigTransaction(async (transaction) => {
+                await transaction.readAccountBinding();
+                await assertNoPendingEnrollmentAuthority();
+                const stop = await requireDaemonStopped();
                 const preRestoreBackup = await backupAccountConfig("account-pre-restore");
-                const restored = await applyAccountRestore({ path: staged.path, files });
-                return { preRestoreBackup, restored };
+                const desired = {};
+                for (const file of staged.files) {
+                    desired[file] = await fs.readFile(path.join(staged.path, file), "utf8");
+                }
+                const restored = await commitAccountSnapshotMutation(desired, "restore");
+                return { preRestoreBackup, restored, stop };
             });
             ok("account.restore", {
                 backupPath,

package/apps/cli/dist/commands/config.js

@@ -1,4 +1,4 @@
-import { CliError, configPath, ok, readConfig, redactedControllerConfig, redactedRelayUrl, requireRelayUrl, requireString, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
+import { assertNoPendingEnrollmentAuthority, CliError, configPath, ok, readConfig, redactedControllerConfig, redactedRelayUrl, requireRelayUrl, requireString, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
 export async function handleConfig({ domain, action, flags }) {
     if (domain === "config" && action === "init") {
         const config = {
@@ -7,6 +7,10 @@ export async function handleConfig({ domain, action, flags }) {
             accountSecret: requireString(flags, "secret"),
         };
         await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
+            if (await transaction.accountExists()) {
+                throw new CliError("Account binding already exists. config init never replaces Account ownership.", "CONFIG_EXISTS");
+            }
             if (await transaction.controllerExists()) {
                 throw new CliError("Controller configuration already exists. config init never replaces credentials.", "CONFIG_EXISTS");
             }
@@ -24,7 +28,7 @@ export async function handleConfig({ domain, action, flags }) {
             const redacted = redactedControllerConfig(config);
             console.log(`Config: ${configPath}`);
             console.log(`Relay: ${redacted.relayUrl}`);
-            console.log(`Controller token: ${redacted.hasControllerToken ? "configured" : "missing"}`);
+            console.log(`Device credential: ${redacted.hasControllerToken ? "configured" : "missing"}`);
             console.log(`Account secret: ${redacted.hasAccountSecret ? "configured" : "missing"}`);
             return true;
         }