@engenty/wizards-runtime 0.7.8 → 0.7.10

package/apps/runtime/dist/cli/uninstall.js

@@ -1,13 +1,19 @@
-import { spawnSync } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { existsSync, lstatSync, readdirSync, readlinkSync, rmdirSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve, sep } from "node:path";
 import * as p from "@clack/prompts";
-import { LOGIN_LABEL, present, removeUnit, UNIT, unloadLoginItem } from "./autostart.js";
+import { LOGIN_LABEL, present, removeUnit, removeWindowsLoginItem, UNIT, unloadLoginItem, windowsLoginItem, } from "./autostart.js";
 import { apps as allApps } from "./connect.js";
 import { findWizardsProcesses, stopProcesses } from "./processes.js";
 import { settings } from "./start.js";
 import { bad, cyan, dim, no, ok } from "./ui.js";
+/** The user's own PATH from the registry, through PowerShell. */
+function userPath() {
+    const out = execFileSync("powershell.exe", ["-NoProfile", "-Command", '[Environment]::GetEnvironmentVariable("Path", "User")'], { encoding: "utf8", windowsHide: true });
+    return out.trim().split(";").filter(Boolean);
+}
+const sameDir = (a, b) => a.replace(/[\\/]+$/, "").toLowerCase() === b.replace(/[\\/]+$/, "").toLowerCase();
 export const realSystem = () => ({
     userHome: homedir(),
     platform: process.platform,
@@ -18,6 +24,56 @@ export const realSystem = () => ({
     stop: (pids) => stopProcesses(pids),
     unloadLoginItem,
     removeUnit,
+    windowsLoginItem,
+    removeWindowsLoginItem,
+    onUserPath: (dir) => {
+        try {
+            return userPath().some((entry) => sameDir(entry, dir));
+        }
+        catch {
+            return false;
+        }
+    },
+    removeFromUserPath: (dir) => {
+        const kept = userPath().filter((entry) => !sameDir(entry, dir));
+        const value = kept.join(";").replaceAll("'", "''");
+        execFileSync("powershell.exe", [
+            "-NoProfile",
+            "-Command",
+            `[Environment]::SetEnvironmentVariable("Path", '${value}', "User")`,
+        ], { windowsHide: true });
+    },
+    deleteAfterExit: (paths, ifEmpty) => {
+        // cmd.exe waits a moment for this process to end, then deletes what it held. Should it end
+        // with this terminal's session (an ssh session ends what it started), the next login does it.
+        const runOnce = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce";
+        const removals = [
+            ...paths.map((path) => `rmdir /s /q "${path}" 2>nul & del /f /q "${path}" 2>nul`),
+            // Without /s: a folder that still holds the data the person kept stays.
+            ...ifEmpty.map((dir) => `rmdir "${dir}" 2>nul`),
+        ];
+        const command = `cmd.exe /d /c ${removals.join(" & ")}`;
+        try {
+            execFileSync("reg", ["add", runOnce, "/v", "engenty-wizards-uninstall", "/d", command, "/f"], { windowsHide: true, stdio: "ignore" });
+        }
+        catch {
+            // The command below still runs.
+        }
+        // Tried every second for a minute, as this process may still take a moment to end. Done
+        // here, the entry goes too: a reinstall before the next login must not lose its files.
+        const gone = paths.map((path) => `if not exist "${path}"`).join(" ");
+        const now = [
+            `for /l %i in (1,1,60) do @(ping -n 2 127.0.0.1 >nul & ${removals.join(" & ")})`,
+            `${gone} reg delete ${runOnce} /v engenty-wizards-uninstall /f >nul 2>&1`,
+        ].join(" & ");
+        // As Node passes a shell command to cmd.exe: whole, in quotes, read as it is.
+        spawn("cmd.exe", ["/d", "/s", "/c", `"${now}"`], {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+            windowsVerbatimArguments: true,
+        }).unref();
+    },
 });
 /** Parts of the install folder that are the person's: kept or deleted with the data. */
 const WITH_DATA = [".env", ".env.local", "plugins"];
@@ -62,6 +118,9 @@ export async function makePlan(paths, system) {
         // Can't look: count it as there, so the uninstall tries and says so.
         loginItem = item;
     }
+    if (system.platform === "win32") {
+        loginItem = await system.windowsLoginItem();
+    }
     const { dataDir } = settings(paths, system.env);
     const program = [];
     const data = existsSync(dataDir) ? [dataDir] : [];
@@ -80,6 +139,7 @@ export async function makePlan(paths, system) {
         processes: system.processes(paths.home),
         program,
         links: ourLinks(paths.home, system),
+        pathEntry: system.platform === "win32" && system.onUserPath(paths.bin) ? paths.bin : null,
         data,
     };
 }
@@ -104,6 +164,7 @@ export async function uninstall(paths, options, system = realSystem()) {
         ...(plan.processes.length ? [`Stop ${processes(plan.processes.length)}`] : []),
         ...(plan.program.length ? [`Delete the program in ${t(plan.home)}${size(plan.home)}`] : []),
         ...plan.links.map((link) => `Delete the command ${t(link)}`),
+        ...(plan.pathEntry ? [`Take ${t(plan.pathEntry)} off your PATH`] : []),
     ];
     if (!steps.length && !plan.data.length) {
         console.log(`${ok} engenty wizards isn’t installed here.`);
@@ -153,7 +214,10 @@ export async function uninstall(paths, options, system = realSystem()) {
     }
     if (plan.loginItem) {
         try {
-            if (system.platform === "darwin") {
+            if (system.platform === "win32") {
+                await system.removeWindowsLoginItem();
+            }
+            else if (system.platform === "darwin") {
                 await system.unloadLoginItem();
                 rmSync(plan.loginItem, { force: true });
             }
@@ -173,14 +237,37 @@ export async function uninstall(paths, options, system = realSystem()) {
             console.log(`${ok} Stopped ${processes(running.length)}`);
         }
     }
-    for (const path of [...plan.program, ...plan.links, ...(deleteData ? plan.data : [])]) {
+    // Looked at again now that nothing runs: what a process wrote meanwhile (the runtime's first
+    // update check writes update.json) goes too.
+    const now = await makePlan(paths, system);
+    // Windows keeps the files of a running program: the Node this command runs on, if it is the
+    // install's own, goes once the command has ended.
+    const later = [];
+    for (const path of [...now.program, ...now.links, ...(deleteData ? now.data : [])]) {
         try {
             rmSync(path, { recursive: true, force: true });
         }
         catch (error) {
-            failed(`Couldn’t delete ${t(path)}`, error);
+            if (system.platform === "win32") {
+                later.push(path);
+            }
+            else {
+                failed(`Couldn’t delete ${t(path)}`, error);
+            }
         }
     }
+    if (plan.pathEntry) {
+        try {
+            system.removeFromUserPath(plan.pathEntry);
+            console.log(`${ok} Took ${t(plan.pathEntry)} off your PATH`);
+        }
+        catch (error) {
+            failed("The PATH", error);
+        }
+    }
+    if (later.length) {
+        console.log(`${ok} ${later.map(t).join(", ")} go${later.length === 1 ? "es" : ""} once this command has ended`);
+    }
     for (const dir of [plan.home, join(system.userHome, ".engenty")]) {
         try {
             rmdirSync(dir);
@@ -195,8 +282,15 @@ export async function uninstall(paths, options, system = realSystem()) {
         ...after.apps.map((app) => `${app.name} still lists the wizards: ${cyan(`npx wizards disconnect ${app.id}`)}`),
         ...(after.loginItem ? [t(after.loginItem)] : []),
         ...after.processes.map((proc) => `process ${proc.pid}: ${cyan(`kill -9 ${proc.pid}`)}`),
-        ...[...after.program, ...after.links, ...(deleteData ? after.data : [])].map(t),
+        ...(after.pathEntry ? [`${t(after.pathEntry)} on your PATH`] : []),
+        ...[...after.program, ...after.links, ...(deleteData ? after.data : [])]
+            .filter((path) => !later.includes(path))
+            .map(t),
     ];
+    // Started after the second look, which would count it among the install's processes.
+    if (later.length) {
+        system.deleteAfterExit(later, [plan.home, join(system.userHome, ".engenty")]);
+    }
     if (!deleteData && after.data.length) {
         console.log(`${ok} Kept your data: ${after.data.map(t).join(", ")}`);
     }

package/apps/runtime/dist/cli/update.js

@@ -3,12 +3,13 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { autoUpdatePolicy, noteUpdated } from "./autoupdate.js";
 import { installedByScript, isCheckout, readInstallNote, writeInstallNote, } from "./home.js";
-import { runningRuntime, settings } from "./start.js";
-import { restart } from "./status.js";
+import { runningRuntime, settings, startInBackground } from "./start.js";
+import { restart, stop } from "./status.js";
 import { cmd, cyan, no, ok } from "./ui.js";
 import { currentVersion } from "./versions.js";
+const windows = process.platform === "win32";
 /** The installer this install was made with; it also updates one. */
-const INSTALLER = "https://engenty.ai/install.sh";
+const INSTALLER = windows ? "https://engenty.ai/install.ps1" : "https://engenty.ai/install.sh";
 async function installer(into) {
     const source = process.env.ENGENTY_WIZARDS_INSTALLER?.trim() || INSTALLER;
     if (!/^https?:\/\//.test(source)) {
@@ -17,13 +18,24 @@ async function installer(into) {
     const response = await fetch(source);
     const text = response.ok ? await response.text() : "";
     // The address answers with the studio's page while a server has no installer yet.
-    if (!text.startsWith("#!")) {
+    if (!text.startsWith(windows ? "# engenty wizards" : "#!")) {
         throw new Error(`${source} didn’t return the installer.`);
     }
-    const file = join(into, "install.sh");
+    const file = join(into, windows ? "install.ps1" : "install.sh");
     writeFileSync(file, text, { mode: 0o700 });
     return file;
 }
+/** The installer, without its questions. */
+function runInstaller(script) {
+    const [command, args] = windows
+        ? ["powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", script, "-NoSetup"]]
+        : ["bash", [script, "--no-setup"]];
+    return new Promise((done) => {
+        const child = spawn(command, args, { stdio: "inherit" });
+        child.on("error", () => done(127));
+        child.on("exit", (exit) => done(exit ?? 1));
+    });
+}
 /**
  * Brings an install made by install.sh to the newest version by running the installer again
  * without its questions: Node, the runtime and the command. With `restart`, a runtime that runs
@@ -37,14 +49,15 @@ export async function update(paths, options = {}) {
         return 0;
     }
     const before = currentVersion(paths);
+    // Windows keeps the files of a running program locked, its native modules among them: the
+    // runtime stops for the update and starts again after it, as the new version.
+    const stopped = windows && (await runningRuntime(settings(paths).dataDir)) !== null;
+    if (stopped && (await stop(paths)) !== 0) {
+        return 1;
+    }
     const tmp = mkdtempSync(join(paths.home, "update-"));
     try {
-        const script = await installer(tmp);
-        const code = await new Promise((done) => {
-            const child = spawn("bash", [script, "--no-setup"], { stdio: "inherit" });
-            child.on("error", () => done(127));
-            child.on("exit", (exit) => done(exit ?? 1));
-        });
+        const code = await runInstaller(await installer(tmp));
         if (code !== 0) {
             return code;
         }
@@ -55,12 +68,15 @@ export async function update(paths, options = {}) {
     }
     finally {
         rmSync(tmp, { recursive: true, force: true });
+        if (stopped) {
+            await startInBackground(paths);
+        }
     }
     const after = currentVersion(paths);
     if (before && after) {
         noteUpdated(paths, before, after);
     }
-    if (await runningRuntime(settings(paths).dataDir)) {
+    if (!stopped && (await runningRuntime(settings(paths).dataDir))) {
         if (options.restart) {
             return restart(paths);
         }

package/apps/runtime/dist/cli/versions.js

@@ -1,5 +1,5 @@
 import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, renameSync, rmSync, symlinkSync, } from "node:fs";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 /**
  * The runtimes of an install made by install.sh, one folder per version, side by side:
  *
@@ -8,6 +8,8 @@ import { join } from "node:path";
  *   runtime/current        → <version>, the one `bin/wizards` starts
  *   runtime/node_modules   → current/node_modules, for commands written before the versions
  *
+ * On Windows the links are junctions, which need no administrator (install.ps1 makes them too).
+ *
  * Up to 0.6.2 `runtime/` itself was the prefix; `switchTo` moves such an install into its
  * version folder first. A process keeps the files of the version it started with.
  */
@@ -48,7 +50,8 @@ const isLink = (path) => {
 /** The version `bin/wizards` starts; null without a runtime. */
 export function currentVersion(paths) {
     if (isLink(currentLink(paths))) {
-        return versionIn(join(paths.runtime, readlinkSync(currentLink(paths))));
+        // A junction names its target in full; a link here names the version folder alone.
+        return versionIn(resolve(paths.runtime, readlinkSync(currentLink(paths))));
     }
     return versionIn(paths.runtime);
 }
@@ -63,8 +66,16 @@ export function installedVersions(paths) {
         return [];
     }
 }
-/** Points `link` at `target` in one step: a new link renamed over the old one. */
+/**
+ * Points `link` at `target` in one step: a new link renamed over the old one. On Windows a
+ * junction, with its target in full, which takes the old one's place.
+ */
 function link(target, path) {
+    if (process.platform === "win32") {
+        rmSync(path, { force: true });
+        symlinkSync(resolve(dirname(path), target), path, "junction");
+        return;
+    }
     const tmp = `${path}.${process.pid}.tmp`;
     rmSync(tmp, { force: true });
     symlinkSync(target, tmp);
@@ -115,7 +126,8 @@ export function promote(paths, staged, version) {
     }
     // As install.sh leaves it: a command of 0.7.4 or older finds the runtime under its old name.
     const legacy = join(staged, "node_modules", LEGACY_PACKAGE);
-    if (!existsSync(legacy)) {
+    // Windows has no command of 0.7.4 or older.
+    if (!existsSync(legacy) && process.platform !== "win32") {
         symlinkSync(RUNTIME_PACKAGE, legacy);
     }
     rmSync(runtimeDir(paths, version), { recursive: true, force: true });

package/apps/runtime/dist/clients.js

@@ -0,0 +1,118 @@
+import { env } from "./env.js";
+import { allowed } from "./limits.js";
+import { managed } from "./manage.js";
+/**
+ * The clients of the public run API: who starts runs here (docs/content/dev/api.md,
+ * docs/plans/api-clients.md). A client names itself in the `x-wizards-client` header: `web` (the
+ * runner in a browser), `app` (the mobile app), `cli`, or the id of a client registered at the
+ * Manage-App. The id is no secret: it carries the terms, the limits and the revocation of a
+ * client, not its proof. The run keeps it.
+ *
+ * A managed runtime fetches the list of clients from its Manage-App at the start and once an
+ * hour, and keeps the last list when a fetch fails. Without a list every client may start runs:
+ * the Manage-App being down must not close the wizards. A runtime that runs alone fetches
+ * nothing and refuses nothing — its API is the person's own.
+ */
+export const CLIENT_HEADER = "x-wizards-client";
+/** The clients this repository ships: the runner, the mobile app, the command line. */
+export const OWN_CLIENTS = ["web", "app", "cli"];
+const ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** The client a request names, or null when it names none or a malformed one. */
+export function clientOf(c) {
+    const id = c.req.header(CLIENT_HEADER)?.trim().toLowerCase() ?? "";
+    return ID.test(id) ? id : null;
+}
+let list = null;
+/** The list in force; tests set it, a managed runtime fetches it. */
+export function setClientList(next) {
+    list = next;
+}
+const HOUR = 3600_000;
+/**
+ * Why `client` may not start a run now, or null when it may. Counts the try against the
+ * client's hourly cap, so call it once per start.
+ */
+export function clientRefused(client) {
+    if (!list) {
+        return null;
+    }
+    const known = list.clients.find((c) => c.id === client);
+    const cap = known ? known.runsPerHour : list.unknown.runsPerHour;
+    if (known ? known.revoked : !list.unknown.allow) {
+        return {
+            status: 403,
+            code: "client_refused",
+            note: "clientRefused",
+        };
+    }
+    if (cap !== null && !allowed(`client:${client ?? "unknown"}`, cap, HOUR)) {
+        return {
+            status: 429,
+            code: "client_limit",
+            note: "clientLimit",
+        };
+    }
+    return null;
+}
+/** The list as the Manage-App sends it, checked; throws on a shape this runtime does not know. */
+export function parseClientList(body) {
+    const raw = body;
+    if (!Array.isArray(raw?.clients)) {
+        throw new Error("no clients");
+    }
+    const clients = raw.clients.map((c) => {
+        if (typeof c?.id !== "string" || !ID.test(c.id)) {
+            throw new Error("bad client id");
+        }
+        return {
+            id: c.id,
+            name: typeof c.name === "string" ? c.name : c.id,
+            runsPerHour: typeof c.runsPerHour === "number" && c.runsPerHour >= 0 ? c.runsPerHour : null,
+            revoked: c.revoked === true,
+        };
+    });
+    const unknown = (raw.unknown ?? {});
+    return {
+        clients,
+        unknown: {
+            allow: unknown.allow !== false,
+            runsPerHour: typeof unknown.runsPerHour === "number" && unknown.runsPerHour >= 0
+                ? unknown.runsPerHour
+                : null,
+        },
+    };
+}
+/**
+ * Fetches the Manage-App's list. A Manage-App without the call (404) means no list: everything
+ * may start runs. Any other failure keeps the list from before.
+ */
+export async function loadClientList() {
+    if (!managed) {
+        return;
+    }
+    try {
+        const res = await fetch(`${env.manage.url}/v1/clients`, {
+            headers: { authorization: `Bearer ${env.manage.serviceKey}` },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (res.status === 404) {
+            list = null;
+            return;
+        }
+        if (!res.ok) {
+            throw new Error(`HTTP ${res.status}`);
+        }
+        list = parseClientList(await res.json());
+    }
+    catch (err) {
+        console.warn(`[clients] the Manage-App's client list was not read: ${err.message}`);
+    }
+}
+/** A managed runtime: the list now, and again every hour. */
+export function startClientChecks() {
+    if (!managed) {
+        return;
+    }
+    void loadClientList();
+    setInterval(() => void loadClientList(), HOUR).unref();
+}

package/apps/runtime/dist/db/client.js

@@ -21,8 +21,10 @@ function open(url, authToken) {
 }
 async function prepare(client, url) {
     if (url.startsWith("file:")) {
-        await client.execute("PRAGMA journal_mode = WAL");
+        // The wait first: studio, doors and runner share the files, and switching to WAL waits
+        // too while another process recovers the log after a restart.
         await client.execute("PRAGMA busy_timeout = 5000");
+        await client.execute("PRAGMA journal_mode = WAL");
     }
     await client.execute("PRAGMA foreign_keys = ON");
 }
@@ -52,6 +54,28 @@ function tenantUrl(id, dbUrl) {
     }
     return `file:${join(env.dataDir, "tenants", `${id}.db`)}`;
 }
+function isBusy(err) {
+    for (let e = err; e; e = e.cause) {
+        if (String(e.code ?? "").startsWith("SQLITE_BUSY")) {
+            return true;
+        }
+    }
+    return false;
+}
+/** `fn` again while another process holds the database: 1, 2, 4, 8 and 16 seconds apart. */
+async function whileBusy(fn) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (attempt >= 5 || !isBusy(err)) {
+                throw err;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** attempt));
+        }
+    }
+}
 async function openTenant(id) {
     let row = await controlDb.query.tenant.findFirst({ where: eq(control.tenant.id, id) });
     if (!row) {
@@ -61,10 +85,20 @@ async function openTenant(id) {
     const url = tenantUrl(id, row.dbUrl);
     const client = open(url, url.startsWith("file:") ? "" : env.tenantDbAuthToken);
     clients.set(id, client);
-    await prepare(client, url);
     const db = makeTenantDb(client);
     // Every database is brought to the current schema when it is first opened.
-    await migrate(db, { migrationsFolder: migrationsFolder("tenant") });
+    try {
+        await whileBusy(async () => {
+            await prepare(client, url);
+            await migrate(db, { migrationsFolder: migrationsFolder("tenant") });
+        });
+    }
+    catch (err) {
+        // The next use opens it afresh (tenantDb forgets the failed attempt).
+        clients.delete(id);
+        client.close();
+        throw err;
+    }
     for (const hook of openHooks) {
         await hook(id, client);
     }

package/apps/runtime/dist/db/migrations/tenant/0017_run_client.sql

@@ -0,0 +1 @@
+ALTER TABLE `run` ADD `client` text;