@dylanpiercey/work 0.1.0 → 0.1.1

package/README.md

@@ -80,13 +80,25 @@ from then on. A refused request gets a page saying which setting it needs.
 Everything (pages, API, and the `/term` websockets) serves from the single
 app port, so route the whole hostname to it.
 
+**Tailscale** is the zero-config way. On a machine logged in to Tailscale
+(1.52 or newer), `work setup` offers to run `tailscale serve --bg <port>`,
+which puts work at `https://<machine>.<tailnet>.ts.net/` for your devices on
+the tailnet alone (never Funnel, which would publish it to the internet),
+and adds that name to `WORK_ALLOWED_HOSTS`: open it on a phone signed in to
+the same tailnet. `work setup --tailscale` does it without asking and
+`--no-tailscale` skips the question; `--yes` alone leaves Tailscale's config
+as it is. A serve config already pointing at work only has its name
+allowed, and `work doctor` says which of these holds.
+
 **Opening workspace ports remotely.** The port chips in the sidebar link to
 `http://<host>:<port>`, which only works where the machine is reachable
-directly. Through a tunnel, route a wildcard hostname to the app port as
-well and work proxies it — HTTP and websockets, so HMR works — to
-`localhost:<port>`. `WORK_PORT_HOSTS` picks the hostname shape the chips
-link to; `sub` is always accepted, `dash` only when picked, and only for a
-name of three labels or more:
+directly — under a tailnet name too, since `tailscale serve` has no
+wildcard names: there a chip reaches a dev server that listens beyond
+loopback (`--host`), and one on loopback says so. Through a tunnel, route
+a wildcard hostname to the app port as well and work proxies it — HTTP and
+websockets, so HMR works — to `localhost:<port>`. `WORK_PORT_HOSTS` picks
+the hostname shape the chips link to; `sub` is always accepted, `dash` only
+when picked, and only for a name of three labels or more:
 
 - `sub` (default): `https://3000.work.example.com`. Needs a wildcard
   `*.work.example.com` route and a certificate that covers it (your own

package/bin/work.mjs

@@ -2,6 +2,8 @@
 // work CLI — ships with the npm package (no dependencies; plain node).
 //
 //   work setup    install missing tools, sign in, install/refresh the background service
+//                 (--tailscale serves work on the tailnet with `tailscale serve`, which
+//                 it otherwise offers when Tailscale is logged in; --no-tailscale skips that)
 //   work doctor   report machine readiness (--json, --fix to install what's missing)
 //   work start    run the server in the foreground
 //   work update   upgrade the npm package and refresh the service
@@ -26,8 +28,17 @@ import { execFileSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import readline from "node:readline/promises";
+import tty from "node:tty";
 import { fileURLToPath } from "node:url";
-import { doctor, formatDoctor, setupPath } from "../lib/setup/doctor.mjs";
+import {
+  doctor,
+  formatDoctor,
+  setupPath,
+  tailscaleProbe,
+  which,
+} from "../lib/setup/doctor.mjs";
+import { allowHost, stateText } from "../lib/setup/tailscale.mjs";
 import { installTool, repairGhHelpers } from "../lib/setup/install.mjs";
 import { bridgeCommands, bridgeIfNeeded } from "../lib/setup/bridge.mjs";
 import { dialHost, listenStream } from "../lib/setup/listen.mjs";
@@ -638,17 +649,23 @@ function until(iso) {
 
 async function setup() {
   await bridge();
-  await fix(await doctor());
+  const d = await doctor(doctorOpts());
+  await fix(d);
+  // Before the service is written: a tailnet name to answer goes into the
+  // WORK_ALLOWED_HOSTS it carries.
+  const tailnet = await tailscale(d.tailscale);
 
   const running = installService();
   const port = serviceEnv().PORT;
-  maybeTunnel(port);
+  if (!tailnet) maybeTunnel(port);
   if (running) {
     if (await waitForServer()) log(`done — http://localhost:${port}`);
     else
       warn(
         `service started but nothing answered on port ${port} within 30s — check the logs`,
       );
+    if (tailnet)
+      log(`on your phone and other devices on the tailnet: ${tailnet}`);
   } else {
     // A fresh install's shell may not have mise on PATH yet — name the shim.
     const shim = path.join(
@@ -725,15 +742,19 @@ async function update() {
     "@dylanpiercey/work@latest",
   ]);
   // Re-exec the (possibly new) CLI to finish with fresh code.
-  sh("work", ["setup", ...(yes ? ["--yes"] : [])]);
+  sh("work", [
+    "setup",
+    ...(yes ? ["--yes"] : []),
+    ...args.filter((a) => a === "--tailscale" || a === "--no-tailscale"),
+  ]);
 }
 
 /** Machine readiness from lib/setup — the same probe the Settings page runs. */
 async function doctorCmd() {
-  let d = await doctor();
+  let d = await doctor(doctorOpts());
   if (args.includes("--fix")) {
     await fix(d);
-    d = await doctor();
+    d = await doctor(doctorOpts());
   }
   if (args.includes("--json")) {
     console.log(JSON.stringify(d, null, 2));
@@ -747,6 +768,13 @@ async function doctorCmd() {
   if (!d.ready) process.exitCode = 1;
 }
 
+/** What the doctor's Tailscale probe checks against: the port and allowed
+ * names the service runs with (or will, after `work setup`). */
+function doctorOpts() {
+  const env = serviceEnv();
+  return { port: env.PORT, allowedHosts: env.WORK_ALLOWED_HOSTS || "" };
+}
+
 /** Said when the service listens beyond this machine with nothing declared
  * to answer there: every other machine is refused (server/access.ts), which
  * is safe, but likely not what the listening was for. */
@@ -1312,8 +1340,179 @@ function maybeTunnel(port = appPort) {
   if (yes || have("cloudflared")) return;
   console.log(`
 To reach work from your phone or other devices, put it behind something
-that terminates TLS and authenticates, e.g. a Cloudflare Tunnel with
+that terminates TLS and authenticates, e.g. Tailscale (\`work setup
+--tailscale\` runs \`tailscale serve\` for you) or a Cloudflare Tunnel with
 Access (https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)
-pointing at http://localhost:${port}, or Tailscale. The server itself has
-no auth of its own.`);
+pointing at http://localhost:${port}. The server itself has no auth of its
+own.`);
+}
+
+/**
+ * `tailscale serve` in front of work: https://<machine>.<tailnet>.ts.net/,
+ * TLS and the tailnet's own sign-in in the local daemon, proxied to work's
+ * port, so requests arrive from this machine under that name — which goes
+ * into WORK_ALLOWED_HOSTS. Tailnet only, never Funnel: Funnel publishes to
+ * the internet, and work has no login of its own. Tailscale's config is
+ * changed only on an explicit yes, the prompt's or `--tailscale`; `--yes`
+ * is how the installer, `work update` and the app's own update run setup
+ * unattended, and none of them asked for it. A serve config already
+ * pointing at work only has its name allowed. Returns the URL work is
+ * served at, or null.
+ */
+async function tailscale(ts) {
+  if (args.includes("--no-tailscale")) return null;
+  const asked = args.includes("--tailscale");
+  const port = serviceEnv().PORT;
+  if (!ts?.installed) {
+    if (asked)
+      warn(
+        "Tailscale is not installed: https://tailscale.com/download, then work setup --tailscale",
+      );
+    return null;
+  }
+  if (ts.serve) {
+    if (!allowTailnet(ts.serve)) return null;
+    if (ts.running) return servedAt(ts.serve.url);
+    // A serve config outlives a logout, and serves again once it is up.
+    log(
+      `Tailscale is ${stateText(ts)}: work is at ${ts.serve.url} once it is up`,
+    );
+    return null;
+  }
+  if (!ts.running) {
+    if (asked)
+      warn(
+        `Tailscale is ${stateText(ts)}: ${ts.state === null ? "start tailscaled" : "run `tailscale up`"}, then work setup --tailscale`,
+      );
+    return null;
+  }
+  const input = yes ? null : terminal();
+  try {
+    const refusal = serveRefusal(ts, port);
+    if (refusal) {
+      if (asked || input) warn(refusal);
+      return null;
+    }
+    const target = serveTarget(port);
+    const command = `tailscale serve --bg ${target}`;
+    if (!asked) {
+      if (!input) {
+        log(
+          `Tailscale is logged in: \`work setup --tailscale\` serves work at https://${ts.name}/ on your tailnet`,
+        );
+        return null;
+      }
+      console.log(`
+Tailscale is logged in here as ${ts.name}.
+\`${command}\` puts work at https://${ts.name}/
+for your devices on the tailnet (only them: never Funnel), proxied by the
+local Tailscale daemon to port ${port}.${ts.https === false ? "\nHTTPS certificates are off on your tailnet: tailscale prints a link that\nturns them on." : ""}`);
+      if (!(await confirm(input, `Run \`${command}\`? [y/N] `))) {
+        log(
+          "left Tailscale as it was (work setup --tailscale serves work later; --no-tailscale skips this question)",
+        );
+        return null;
+      }
+    } else if (ts.https === false && !input) {
+      // tailscale serve would wait, unattended, for someone to follow the
+      // link it prints.
+      warn(
+        "HTTPS certificates are off on your tailnet: turn them on (https://login.tailscale.com/admin/dns), then run work setup --tailscale",
+      );
+      return null;
+    }
+    log(command);
+    spawnSync(which("tailscale"), ["serve", "--bg", target], {
+      stdio: "inherit",
+    });
+  } finally {
+    if (input && input !== process.stdin) input.destroy();
+  }
+  // Its exit status is no proof: it exits 0 having only printed how to
+  // turn HTTPS on, when it does not wait for that.
+  const after = await tailscaleProbe({ port, allowedHosts: "" });
+  if (!after.serve) {
+    warn(
+      "tailscale serve did not serve work (see above); once it does, run work setup again",
+    );
+    return null;
+  }
+  return allowTailnet(after.serve) ? servedAt(after.serve.url) : null;
+}
+
+function servedAt(url) {
+  log(`Tailscale serves work at ${url} (tailnet only)`);
+  return url;
+}
+
+/** Why `tailscale serve --bg <port>` is not run here, or null. */
+function serveRefusal(ts, port) {
+  if (!ts.serveCli)
+    return `tailscale ${ts.version || "(unknown version)"} predates \`tailscale serve --bg <port>\` (1.52): update Tailscale, then run work setup --tailscale`;
+  // It would replace whatever serves the name's root now.
+  if (ts.rootTaken)
+    return `https://${ts.name}/ already serves ${ts.rootTaken}, which work leaves alone. To serve work beside it: tailscale serve --bg --https=8443 ${port}, then work setup`;
+  if (!serveTarget(port))
+    return `work listens on ${serviceEnv().WORK_LISTEN} alone, and tailscale serve proxies to loopback: WORK_LISTEN= work setup --tailscale`;
+  return null;
+}
+
+/** What `tailscale serve` proxies to: work's port on loopback, where
+ * requests are this machine's (server/access.ts). Null when work listens
+ * on one other address only, which loopback does not reach. */
+function serveTarget(port) {
+  const listen = serviceEnv().WORK_LISTEN;
+  if (listen === "::1") return `http://[::1]:${port}`;
+  return ["127.0.0.1", "0.0.0.0", "::", "*"].includes(listen)
+    ? String(port)
+    : null;
+}
+
+/** Put the name tailscale serve serves work under in WORK_ALLOWED_HOSTS,
+ * for installService() to write — or, when Funnel publishes that name to
+ * the internet, take it out, so work refuses the internet there. False
+ * then. */
+function allowTailnet(serve) {
+  const current = serviceEnv().WORK_ALLOWED_HOSTS || "";
+  const next = allowHost(current, serve.host, !serve.funnel);
+  if (next !== current) {
+    process.env.WORK_ALLOWED_HOSTS = next;
+    log(
+      `${serve.funnel ? "refusing" : "allowing"} ${serve.host} (WORK_ALLOWED_HOSTS=${next})`,
+    );
+  }
+  if (serve.funnel) {
+    warn(
+      `Tailscale Funnel publishes ${serve.url} to the internet, and work has no login, so work refuses that name. Turn Funnel off (tailscale funnel --https=${new URL(serve.url).port || 443} off), then run work setup again`,
+    );
+    return false;
+  }
+  return true;
+}
+
+/** Where to ask the user something: stdin when it is a terminal, else the
+ * controlling terminal, since the curl installer pipes its script into the
+ * shell this runs under. Null with no terminal at all. */
+function terminal() {
+  if (process.stdin.isTTY) return process.stdin;
+  try {
+    return new tty.ReadStream(fs.openSync("/dev/tty", "r"));
+  } catch {
+    return null;
+  }
+}
+
+/** A yes/no question, no unless answered yes. Line-buffered by the
+ * terminal itself, so Ctrl-C stops setup as it would anywhere else. */
+async function confirm(input, question) {
+  const rl = readline.createInterface({
+    input,
+    output: process.stdout,
+    terminal: false,
+  });
+  try {
+    return /^y(es)?$/i.test((await rl.question(question)).trim());
+  } finally {
+    rl.close();
+  }
 }

package/dist/_D1C-XIqT.js

@@ -0,0 +1,168 @@
+var glyphBadgeNum = "_y _x";
+var usageInk = {
+	ok: "_z",
+	mid: "_A",
+	warm: "_B",
+	hot: "_C"
+};
+var usageFill = {
+	ok: "_D",
+	mid: "_E",
+	warm: "_F",
+	hot: "_G"
+};
+var prTone = {
+	open: "_H",
+	draft: "_I",
+	merged: "_J",
+	closed: "_K"
+};
+var phaseIcon = {
+	working: "_X _W",
+	waiting: "_Y _W",
+	idle: "_Z _W",
+	off: "_0 _W"
+};
+var btnSm = "_7 _r";
+var btnLg = "_8 _r";
+var tone = {
+	accent: "_bb",
+	ok: "_bc",
+	warn: "_bd",
+	danger: "_be",
+	merged: "_bf",
+	closed: "_bg"
+};
+var inputLg = "_bk _bj";
+var iconBtnXs = "_bo _m";
+var iconBtnRow = "_bp _m";
+var iconBtnLg = "_bq _m";
+var chipBtn = "_br _m";
+var tocDot = "_dx _U";
+//#endregion
+//#region src/styles/tokens.css.ts
+var color = {
+	ok: "light-dark(#1a7f37, #57d364)",
+	okStrong: "light-dark(#116329, #7ee787)",
+	warn: "light-dark(#bf8700, #d4a72c)",
+	warnStrong: "light-dark(#8a5a00, #f0b84a)",
+	merged: "light-dark(#8250df, #a371f7)",
+	closed: "light-dark(#cf222e, #f85149)",
+	onAccent: "#fff",
+	onDanger: "#fff",
+	accentDefault: "light-dark(#4f5bd5, #6470e6)",
+	bg: "var(--bg)",
+	panel: "var(--panel)",
+	border: "var(--border)",
+	text: "var(--text)",
+	dim: "var(--dim)",
+	accent: "var(--accent)",
+	accentFill: "var(--accent-fill)",
+	accentText: "var(--accent-text)",
+	danger: "var(--danger)",
+	fieldBorder: "var(--field-border)",
+	raised: "color-mix(in srgb, var(--panel) 94%, var(--text))",
+	raisedHover: "color-mix(in srgb, var(--panel) 90%, var(--text))",
+	onScrim: "#fff"
+};
+var sans = "Inter, ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", sans-serif";
+var iconSize = {
+	sm: 12,
+	md: 14,
+	lg: 16,
+	xl: 18
+};
+var toastKind = {
+	error: "_bJ",
+	warn: "_bK",
+	info: "_bL"
+};
+var toastTitle = {
+	error: "_bM",
+	warn: "_bN",
+	info: "_bO"
+};
+//#endregion
+//#region src/tags/settings-agents.css.ts
+var agentRow = "_fD _dI";
+var list$3 = "_dM _c9 _dH _dK";
+var metaChip = "_d0 _bi _bh";
+var sectionCount = "_c6 _9 __";
+var usageNote = "_jn _bh";
+var pop$2 = "_ht _bw";
+var spinner = "_hw _bm _2";
+var toolLead = "_he _dV";
+var name$4 = "_gW _dV";
+var desc$1 = "_gX _dW";
+//#endregion
+//#region src/tags/lsp-add-dialog.css.ts
+var addDlg = "_k1 _b2";
+var key$1 = "_k_ _k8";
+var addTile = "_lb _k8";
+var field$2 = "_lm _bj";
+var keyField = "_ln _lm _bj";
+var labelField = "_lo _lm _bj";
+var themeSeg = "_eI _bA";
+var checkList = "_gM _c7";
+//#endregion
+//#region src/tags/prompt-dialog.css.ts
+var promptDlg = "_b6 _b2";
+var item$1 = "_bY _m";
+var glance = "_dE _m";
+//#endregion
+//#region src/tags/side-nav.css.ts
+var iconBtn = "_b9 _m";
+var settingsDot = "_b_ _bz";
+var notifyBtn = "_ce _m";
+//#endregion
+//#region src/styles/session-pop.css.ts
+var sessionPop = "_b7 _bw";
+var sessionPopBtn = "_b8 _4";
+var wsBtn = "_fe _4";
+var rowIcon = "_fg _bo _m";
+var prChip = "_kM _v _kG";
+var readyChip = "_kN _v";
+var prDot = "_kP _kO";
+//#endregion
+//#region src/tags/port-chip.css.ts
+var port = "_m6 _v _kG";
+var open = "_j7 _4";
+var action = "_ka _br _m";
+var toggle = "_d5 _P";
+var fold = "_d6 _dJ";
+var item = "_jz _4";
+var menu = "_kx _b7 _bw";
+var menuItem = "_kz _4";
+var findBtn$1 = "_ih _fV _bp _m";
+var tool = "_fV _bp _m";
+var pop$1 = "_kg _b7 _bw";
+var fileFilter = "_m4 _o";
+var findInput = "_ei _o";
+var keybarIconBtn = "_er _br _m";
+var repoTitle = "_lU _L";
+var input = "_ct _o";
+var group = "_cw _P";
+var hint$1 = "_l2 _9 _M";
+var sheetDir = "_ml _by";
+var upBtn = "_gc _bp _m";
+var findBtn = "_gg _fV _bp _m";
+var goBtn = "_gh _fV _bp _m";
+var note = "_l5 _bh";
+//#endregion
+//#region src/tags/manage-workspace.css.ts
+var procCmd = "_fs _dV";
+var factCopy = "_fz _br _m";
+var resultRow = "_jO _4";
+var resultBranch = "_jP _d0 _bi _bh _bo _m";
+var urlAction = "_jQ _d0 _bi _bh _d1";
+var curRow = "_eC _dP";
+//#endregion
+//#region src/tags/join-dialog.css.ts
+var dlg = "_jC _b2";
+var hint = "_jD _bh";
+var kbtn = "_cP _bq _m";
+var repeat = "_cS _cR";
+var dpadUser = "_cV _cR";
+var dpadEsc = "_cW _cR";
+//#endregion
+export { key$1 as $, item as A, usageFill as At, wsBtn as B, keybarIconBtn as C, iconBtnLg as Ct, findBtn$1 as D, phaseIcon as Dt, tool as E, inputLg as Et, port as F, settingsDot as G, sessionPopBtn as H, prChip as I, promptDlg as J, glance as K, prDot as L, toggle as M, action as N, menu as O, prTone as Ot, open as P, field$2 as Q, readyChip as R, findInput as S, glyphBadgeNum as St, pop$1 as T, iconBtnXs as Tt, iconBtn as U, sessionPop as V, notifyBtn as W, themeSeg as X, checkList as Y, addTile as Z, sheetDir as _, sans as _t, dlg as a, toolLead as at, input as b, btnSm as bt, resultBranch as c, usageNote as ct, factCopy as d, metaChip as dt, keyField as et, procCmd as f, agentRow as ft, upBtn as g, iconSize as gt, goBtn as h, color as ht, repeat as i, name$4 as it, fold as j, usageInk as jt, menuItem as k, tone as kt, resultRow as l, sectionCount as lt, findBtn as m, toastTitle as mt, dpadUser as n, addDlg as nt, hint as o, pop$2 as ot, note as p, toastKind as pt, item$1 as q, kbtn as r, desc$1 as rt, curRow as s, spinner as st, dpadEsc as t, labelField as tt, urlAction as u, list$3 as ut, hint$1 as v, tocDot as vt, fileFilter as w, iconBtnRow as wt, repoTitle as x, chipBtn as xt, group as y, btnLg as yt, rowIcon as z };