@dylanpiercey/work 0.1.1 → 0.2.1

package/lib/preview/media.mjs

@@ -1,13 +1,14 @@
 // What a browser can render inline for a binary file in review, keyed by
-// extension. Plain ESM with no dependencies: the blob route serves only the
-// types in this table and the browser picks its element from the same one,
-// so a type can never be displayable at one end and not the other.
+// extension. Plain ESM with no dependencies: the blob route serves inline
+// only the types in this table and the browser picks its element from the
+// same one, so a type can never be displayable at one end and not the other.
 //
 // The allowlist is the security boundary, not a nicety. The app's API and
 // the review page share an origin, so an `image/svg+xml` opened in a tab —
 // or worse a `text/html` — from a repo under review would be script with
 // the reviewer's access to it. Nothing outside this table is ever served
-// inline, and the served response denies scripts on top of that.
+// inline (a `.share/` file of another type goes only as an attachment),
+// and the served response denies scripts on top of that.
 
 /** @typedef {"image" | "pdf" | "video"} PreviewKind */
 /** @typedef {{ kind: PreviewKind, type: string }} Preview */

package/lib/setup/doctor.d.mts

@@ -1,4 +1,5 @@
 import type { TailscaleProbe } from "./tailscale.mjs";
+import type { FirewallProbe } from "./firewall.mjs";
 export interface DoctorTool {
   id: string;
   label: string;
@@ -50,6 +51,9 @@ export interface Doctor {
   staleGhHelpers: string[];
   /** Tailscale, optional: how work is reached from other devices. */
   tailscale: TailscaleProbe;
+  /** The host firewall in front of direct connections' UDP port; null
+   * with none active (or direct connections off). */
+  firewall: FirewallProbe | null;
 }
 export function setupPath(base?: string): string;
 export function which(bin: string): string | null;
@@ -72,5 +76,12 @@ export function doctor(opts?: {
   hosts?: string[];
   port?: string;
   allowedHosts?: string;
+  /** The service's direct-connection settings, for the firewall probe. */
+  rtcPort?: string;
+  listen?: string;
+  rtc?: string;
+  /** The firewall as the service meets it, read by the caller (the CLI
+   * asks the running server); the probe runs here without it. */
+  firewall?: FirewallProbe | null | Promise<FirewallProbe | null>;
 }): Promise<Doctor>;
 export function formatDoctor(d: Doctor): string;

package/lib/setup/doctor.mjs

@@ -7,6 +7,7 @@ import os from "node:os";
 import path from "node:path";
 import { AGENTS, DEFAULT_GITHUB_HOST, TOOLS } from "./catalog.mjs";
 import { readTailscale, tailscaleLine } from "./tailscale.mjs";
+import { firewallLine, firewallProbe } from "./firewall.mjs";
 
 const home = os.homedir();
 
@@ -406,7 +407,8 @@ export async function tailscaleProbe({ port, allowedHosts } = {}) {
  * @param {{ hosts?: string[], port?: string, allowedHosts?: string }} [opts]
  *   configured GitHub hosts (settings); github.com and any host gh is
  *   already signed in to are always included. `port` and `allowedHosts`
- *   are the service's, for the Tailscale probe.
+ *   are the service's, for the Tailscale probe; `firewall`, when given, is
+ *   the service's own firewall reading (`serviceFirewall` in the CLI).
  */
 export async function doctor(opts = {}) {
   const hostSet = new Set([
@@ -414,7 +416,7 @@ export async function doctor(opts = {}) {
     ...(opts.hosts || []),
     ...ghKnownHosts(),
   ]);
-  const [versions, github, awake, extensions, helpers, tailscale] =
+  const [versions, github, awake, extensions, helpers, tailscale, firewall] =
     await Promise.all([
       miseVersions(),
       Promise.all([...hostSet].map(githubHostStatus)),
@@ -422,6 +424,20 @@ export async function doctor(opts = {}) {
       ghExtensions(),
       staleGhHelpers(),
       tailscaleProbe(opts),
+      // The CLI hands in the service's own reading (bin/work.mjs
+      // `serviceFirewall`); the server reads for itself.
+      opts.firewall !== undefined
+        ? opts.firewall
+        : firewallProbe({
+            rtcPort: opts.rtcPort ?? process.env.WORK_RTC_PORT,
+            appPort:
+              opts.port ||
+              process.env.PORT ||
+              process.env.WORK_APP_PORT ||
+              "7171",
+            listen: opts.listen ?? process.env.WORK_LISTEN,
+            rtc: opts.rtc ?? process.env.WORK_RTC,
+          }),
     ]);
 
   const tools = TOOLS.map((t) => {
@@ -471,6 +487,7 @@ export async function doctor(opts = {}) {
     awake,
     staleGhHelpers: helpers,
     tailscale,
+    firewall,
   };
 }
 
@@ -500,6 +517,10 @@ export function formatDoctor(d) {
   // Optional, so never part of `ready`: it is how work is reached from
   // elsewhere, not what it needs to run.
   lines.push(tailscaleLine(d.tailscale));
+  // Optional too: only devices elsewhere on the network lose the direct
+  // path to a firewall, and work runs either way.
+  const firewall = firewallLine(d.firewall);
+  if (firewall) lines.push(firewall);
   // Said only when nothing holds the host: not a readiness gate, since
   // work runs either way, but the one place a headless host would say so.
   if (d.awake === false) {

package/lib/setup/firewall.d.mts

@@ -0,0 +1,76 @@
+export const RULE: string;
+export interface FirewallProbe {
+  kind: "firewalld" | "ufw" | "macos";
+  /** How it is named in a sentence: `firewalld (zone FedoraServer)`. */
+  what: string;
+  zone?: string;
+  /** The UDP port direct connections use. */
+  port: number;
+  /** It lets that port in (by its settings, or work's own rule). */
+  admits: boolean;
+  /** It likely drops it: not admitted by what could be read. */
+  likely: boolean;
+  /** Its settings were read as they are, not as shipped. */
+  exact: boolean;
+  /** work's named rule is there. */
+  ruled: boolean;
+  /** The commands `work setup --firewall` runs (argv, sudo first); empty
+   * where it adds nothing. */
+  plan: string[][];
+  /** Those as one shell line, or the fix to run by hand; null with none. */
+  fix: string | null;
+  /** What the verdict rests on, when it is not work's rule. */
+  why?: string | null;
+  /** The node macOS's firewall was asked about (its real path). */
+  node?: string;
+  /** Whose node that was, as the CLI found it: the running service's
+   * own reading, its definition's, or this shell's for want of either. */
+  nodeFrom?: "service" | "unit" | "shell";
+}
+export function firewallProbe(opts?: {
+  rtcPort?: string | number;
+  appPort?: string | number;
+  listen?: string;
+  rtc?: string;
+  node?: string;
+  root?: string;
+  platform?: string;
+}): Promise<FirewallProbe | null>;
+export interface MacosVerdict {
+  admits: boolean;
+  exact: boolean;
+  why: string;
+  needs: "blockall" | "unblock" | "add" | null;
+}
+export function macosVerdict(said: {
+  state?: string;
+  blockAll?: string;
+  signed?: string;
+  blocked?: string;
+  apps?: string;
+  sign?: string;
+  paths: string[];
+}): MacosVerdict | null;
+export function globalOn(text?: string): boolean | null;
+export function blockAllOn(text?: string): boolean | null;
+export function allowSigned(text?: string): {
+  builtIn: boolean | null;
+  downloaded: boolean | null;
+};
+export function listedAs(
+  text?: string,
+  paths?: string[],
+): "allow" | "block" | null;
+export function appBlocked(text?: string): "allow" | "block" | null;
+export function signatureOf(
+  text?: string,
+): "developer-id" | "apple" | "adhoc" | "unsigned" | "other" | null;
+export function serviceNode(
+  text: string,
+  opts?: { PATH?: string },
+): string | null;
+export function firewallLine(f: FirewallProbe | null): string | null;
+export function applyPlan(
+  plan: string[][],
+  log: (line: string) => void,
+): { ok: boolean; failed?: string[] };