@dylanpiercey/work 0.1.0 → 0.2.0

package/lib/preview/media.mjs

@@ -1,13 +1,14 @@
 // What a browser can render inline for a binary file in review, keyed by
-// extension. Plain ESM with no dependencies: the blob route serves only the
-// types in this table and the browser picks its element from the same one,
-// so a type can never be displayable at one end and not the other.
+// extension. Plain ESM with no dependencies: the blob route serves inline
+// only the types in this table and the browser picks its element from the
+// same one, so a type can never be displayable at one end and not the other.
 //
 // The allowlist is the security boundary, not a nicety. The app's API and
 // the review page share an origin, so an `image/svg+xml` opened in a tab —
 // or worse a `text/html` — from a repo under review would be script with
 // the reviewer's access to it. Nothing outside this table is ever served
-// inline, and the served response denies scripts on top of that.
+// inline (a `.share/` file of another type goes only as an attachment),
+// and the served response denies scripts on top of that.
 
 /** @typedef {"image" | "pdf" | "video"} PreviewKind */
 /** @typedef {{ kind: PreviewKind, type: string }} Preview */

package/lib/setup/doctor.d.mts

@@ -1,3 +1,5 @@
+import type { TailscaleProbe } from "./tailscale.mjs";
+import type { FirewallProbe } from "./firewall.mjs";
 export interface DoctorTool {
   id: string;
   label: string;
@@ -47,6 +49,11 @@ export interface Doctor {
   awake: boolean | null;
   /** git credential helpers that run a gh which is gone (config keys). */
   staleGhHelpers: string[];
+  /** Tailscale, optional: how work is reached from other devices. */
+  tailscale: TailscaleProbe;
+  /** The host firewall in front of direct connections' UDP port; null
+   * with none active (or direct connections off). */
+  firewall: FirewallProbe | null;
 }
 export function setupPath(base?: string): string;
 export function which(bin: string): string | null;
@@ -61,5 +68,20 @@ export const VERSIONED_PATH: RegExp;
 export function stableGh(): string | null;
 export function staleGhHelpers(): Promise<string[]>;
 export function discoverAgents(fresh?: boolean): DoctorAgent[];
-export function doctor(opts?: { hosts?: string[] }): Promise<Doctor>;
+export function tailscaleProbe(opts?: {
+  port?: string;
+  allowedHosts?: string;
+}): Promise<TailscaleProbe>;
+export function doctor(opts?: {
+  hosts?: string[];
+  port?: string;
+  allowedHosts?: string;
+  /** The service's direct-connection settings, for the firewall probe. */
+  rtcPort?: string;
+  listen?: string;
+  rtc?: string;
+  /** The firewall as the service meets it, read by the caller (the CLI
+   * asks the running server); the probe runs here without it. */
+  firewall?: FirewallProbe | null | Promise<FirewallProbe | null>;
+}): Promise<Doctor>;
 export function formatDoctor(d: Doctor): string;

package/lib/setup/doctor.mjs

@@ -6,6 +6,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { AGENTS, DEFAULT_GITHUB_HOST, TOOLS } from "./catalog.mjs";
+import { readTailscale, tailscaleLine } from "./tailscale.mjs";
+import { firewallLine, firewallProbe } from "./firewall.mjs";
 
 const home = os.homedir();
 
@@ -363,11 +365,50 @@ async function ghExtensions() {
   return out;
 }
 
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+/** Tailscale here and what its serve config does with work's port
+ * (lib/setup/tailscale.mjs), from read-only commands. `port` and
+ * `allowedHosts` default to this process's own, which are the server's
+ * when the server asks. */
+export async function tailscaleProbe({ port, allowedHosts } = {}) {
+  const bin = which("tailscale");
+  if (!bin) return { installed: false };
+  // Without peers: a large tailnet's full status is megabytes, and only
+  // this node is read.
+  const [version, status, serve] = await Promise.all([
+    run(bin, ["version"], { timeout: 5000 }),
+    run(bin, ["status", "--json", "--peers=false"], { timeout: 5000 }),
+    run(bin, ["serve", "status", "--json"], { timeout: 5000 }),
+  ]);
+  return readTailscale(
+    {
+      path: tilde(bin),
+      version: version.stdout,
+      status: status.ok ? parseJson(status.stdout) : null,
+      serve: serve.ok ? parseJson(serve.stdout) : null,
+    },
+    {
+      port: port || process.env.PORT || process.env.WORK_APP_PORT || "7171",
+      allowedHosts: allowedHosts ?? process.env.WORK_ALLOWED_HOSTS,
+    },
+  );
+}
+
 /**
  * Full readiness snapshot.
  *
- * @param {{ hosts?: string[] }} [opts] configured GitHub hosts (settings);
- *   github.com and any host gh is already signed in to are always included.
+ * @param {{ hosts?: string[], port?: string, allowedHosts?: string }} [opts]
+ *   configured GitHub hosts (settings); github.com and any host gh is
+ *   already signed in to are always included. `port` and `allowedHosts`
+ *   are the service's, for the Tailscale probe; `firewall`, when given, is
+ *   the service's own firewall reading (`serviceFirewall` in the CLI).
  */
 export async function doctor(opts = {}) {
   const hostSet = new Set([
@@ -375,13 +416,29 @@ export async function doctor(opts = {}) {
     ...(opts.hosts || []),
     ...ghKnownHosts(),
   ]);
-  const [versions, github, awake, extensions, helpers] = await Promise.all([
-    miseVersions(),
-    Promise.all([...hostSet].map(githubHostStatus)),
-    canStayAwake(),
-    ghExtensions(),
-    staleGhHelpers(),
-  ]);
+  const [versions, github, awake, extensions, helpers, tailscale, firewall] =
+    await Promise.all([
+      miseVersions(),
+      Promise.all([...hostSet].map(githubHostStatus)),
+      canStayAwake(),
+      ghExtensions(),
+      staleGhHelpers(),
+      tailscaleProbe(opts),
+      // The CLI hands in the service's own reading (bin/work.mjs
+      // `serviceFirewall`); the server reads for itself.
+      opts.firewall !== undefined
+        ? opts.firewall
+        : firewallProbe({
+            rtcPort: opts.rtcPort ?? process.env.WORK_RTC_PORT,
+            appPort:
+              opts.port ||
+              process.env.PORT ||
+              process.env.WORK_APP_PORT ||
+              "7171",
+            listen: opts.listen ?? process.env.WORK_LISTEN,
+            rtc: opts.rtc ?? process.env.WORK_RTC,
+          }),
+    ]);
 
   const tools = TOOLS.map((t) => {
     if (t.ghExtension) {
@@ -429,6 +486,8 @@ export async function doctor(opts = {}) {
     github,
     awake,
     staleGhHelpers: helpers,
+    tailscale,
+    firewall,
   };
 }
 
@@ -455,6 +514,13 @@ export function formatDoctor(d) {
       `${a.label.padEnd(11)}${mark(a.installed)} ${a.installed ? a.instances.map((i) => `${i.command} (${i.path})`).join(", ") : "not installed"}`,
     );
   }
+  // Optional, so never part of `ready`: it is how work is reached from
+  // elsewhere, not what it needs to run.
+  lines.push(tailscaleLine(d.tailscale));
+  // Optional too: only devices elsewhere on the network lose the direct
+  // path to a firewall, and work runs either way.
+  const firewall = firewallLine(d.firewall);
+  if (firewall) lines.push(firewall);
   // Said only when nothing holds the host: not a readiness gate, since
   // work runs either way, but the one place a headless host would say so.
   if (d.awake === false) {

package/lib/setup/firewall.d.mts

@@ -0,0 +1,76 @@
+export const RULE: string;
+export interface FirewallProbe {
+  kind: "firewalld" | "ufw" | "macos";
+  /** How it is named in a sentence: `firewalld (zone FedoraServer)`. */
+  what: string;
+  zone?: string;
+  /** The UDP port direct connections use. */
+  port: number;
+  /** It lets that port in (by its settings, or work's own rule). */
+  admits: boolean;
+  /** It likely drops it: not admitted by what could be read. */
+  likely: boolean;
+  /** Its settings were read as they are, not as shipped. */
+  exact: boolean;
+  /** work's named rule is there. */
+  ruled: boolean;
+  /** The commands `work setup --firewall` runs (argv, sudo first); empty
+   * where it adds nothing. */
+  plan: string[][];
+  /** Those as one shell line, or the fix to run by hand; null with none. */
+  fix: string | null;
+  /** What the verdict rests on, when it is not work's rule. */
+  why?: string | null;
+  /** The node macOS's firewall was asked about (its real path). */
+  node?: string;
+  /** Whose node that was, as the CLI found it: the running service's
+   * own reading, its definition's, or this shell's for want of either. */
+  nodeFrom?: "service" | "unit" | "shell";
+}
+export function firewallProbe(opts?: {
+  rtcPort?: string | number;
+  appPort?: string | number;
+  listen?: string;
+  rtc?: string;
+  node?: string;
+  root?: string;
+  platform?: string;
+}): Promise<FirewallProbe | null>;
+export interface MacosVerdict {
+  admits: boolean;
+  exact: boolean;
+  why: string;
+  needs: "blockall" | "unblock" | "add" | null;
+}
+export function macosVerdict(said: {
+  state?: string;
+  blockAll?: string;
+  signed?: string;
+  blocked?: string;
+  apps?: string;
+  sign?: string;
+  paths: string[];
+}): MacosVerdict | null;
+export function globalOn(text?: string): boolean | null;
+export function blockAllOn(text?: string): boolean | null;
+export function allowSigned(text?: string): {
+  builtIn: boolean | null;
+  downloaded: boolean | null;
+};
+export function listedAs(
+  text?: string,
+  paths?: string[],
+): "allow" | "block" | null;
+export function appBlocked(text?: string): "allow" | "block" | null;
+export function signatureOf(
+  text?: string,
+): "developer-id" | "apple" | "adhoc" | "unsigned" | "other" | null;
+export function serviceNode(
+  text: string,
+  opts?: { PATH?: string },
+): string | null;
+export function firewallLine(f: FirewallProbe | null): string | null;
+export function applyPlan(
+  plan: string[][],
+  log: (line: string) => void,
+): { ok: boolean; failed?: string[] };