@ghostlytools/cli 1.3.6 → 1.3.8

package/dist/assets/{main-DgbdDDif.js → main-BXwlJall.js}

@@ -1,9 +1,9 @@
-import { $n as GROUP_FILE_LIMITS, Ja as PR_CHECKS, Xa as RUN_RESULTS, Ya as PR_STATES, Za as STATUS_CARD_LIMITS, qa as ITEM_STATES, to as cardUrl } from "./src-XhjSWnp-.js";
-import { a as SECRET_RESULTS, i as ENGINE_READS, r as ENGINE_METHODS, t as turnRef } from "./turnRefs-Cle33IoV.js";
+import { $n as GROUP_FILE_LIMITS, Ja as PR_CHECKS, Xa as RUN_RESULTS, Ya as PR_STATES, Za as STATUS_CARD_LIMITS, qa as ITEM_STATES, to as cardUrl } from "./src-CVYir6mP.js";
+import { a as SECRET_RESULTS, i as ENGINE_READS, r as ENGINE_METHODS, t as turnRef } from "./turnRefs-BeWsTX0o.js";
 import { i as localFileError, n as EXIT, r as asCliError, t as CliError } from "./errors-B-zMxbcd.js";
-import { t as CONTACT_KEY } from "./apiKit-lX3Xx_hY.js";
+import { t as CONTACT_KEY } from "./apiKit-C9lLXQwt.js";
 import { a as createProfile, c as listProfiles, d as profilePaths, f as selectProfile, i as checkProfileName, l as lockOwner, o as currentProfile, s as ghostlyHome, u as profileExists } from "./profiles-gPCjLOQq.js";
-import { n as ownSocket } from "./privateFolder-Bk9C9oFv.js";
+import { a as provesDaemon, c as ownSocket, o as readDaemonSecret, r as newNonce, t as HELLO } from "./daemonProof-B53VnZ1Z.js";
 import { accessSync, constants, existsSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { spawn } from "node:child_process";
@@ -12,7 +12,7 @@ import { createInterface } from "node:readline";
 import { format } from "node:util";
 var package_default = {
 	name: "@ghostlytools/cli",
-	version: "1.3.6",
+	version: "1.3.8",
 	type: "module",
 	description: "Ghostly for bots and terminals: the app's own engine, headless on Node, behind a daemon and a `ghostly` command with JSON output.",
 	license: "MIT",
@@ -230,18 +230,45 @@ function liftGlobals(argv) {
 }
 //#endregion
 //#region src/client.ts
+/** The id of the hello on every connection: a string, so it is never one of the calls' numbers. */
+var HELLO_ID = "hello";
+/** The refusal of a listener that did not prove it is the profile's daemon (`isNotTheDaemon` tells it apart). */
+function notTheDaemon(socket) {
+	return new CliError("refused", `What answers on ${socket} did not prove it is this profile's daemon, so nothing was sent to it. A daemon of an older release cannot: \`ghostly daemon restart\` starts this one's`, { reason: "not-the-daemon" });
+}
+function isNotTheDaemon(error) {
+	return error instanceof CliError && error.code === "refused" && error.details?.reason === "not-the-daemon";
+}
 /**
 * A connection to a profile's daemon over its socket (WISP 1100 § Local control API). `null` from `connectDaemon`
-* means no daemon answers there: a one-shot command runs the profile itself.
+* means no daemon answers there: a one-shot command runs the profile itself. *
+* The first line on it is a `daemon.hello`, and no call is written until its answer proves the other end read the
+* profile's daemon secret (`daemonProof.ts`): until then every call waits, and a listener that does not prove it gets
+* every call refused (`refused`, `isNotTheDaemon`) having read nothing but the hello. Nothing it writes before that
+* is read either.
 */
 var DaemonClient = class {
 	socket;
+	address;
 	nextId = 1;
 	pending = /* @__PURE__ */ new Map();
 	eventListener = null;
 	closedListener = null;
-	constructor(socket) {
+	verified = false;
+	refusal = null;
+	ready;
+	settle;
+	constructor(socket, address) {
 		this.socket = socket;
+		this.address = address;
+		this.ready = new Promise((resolve, reject) => {
+			this.settle = {
+				resolve,
+				reject
+			};
+		});
+		this.ready.catch(() => {});
+		const nonce = newNonce();
 		createInterface({
 			input: socket,
 			crlfDelay: Infinity
@@ -252,6 +279,17 @@ var DaemonClient = class {
 			} catch {
 				return;
 			}
+			if (!this.verified) {
+				if (this.refusal || message?.id !== HELLO_ID) return;
+				const secret = readDaemonSecret(this.address.dir);
+				if (!message.error && secret && provesDaemon(secret, nonce, message.result)) {
+					this.verified = true;
+					this.settle.resolve();
+					return;
+				}
+				this.refuse();
+				return;
+			}
 			if (message.event) {
 				this.eventListener?.(message.event);
 				return;
@@ -263,24 +301,41 @@ var DaemonClient = class {
 			else waiting.resolve(message.result);
 		});
 		socket.on("close", () => {
-			for (const waiting of this.pending.values()) waiting.reject(new CliError("unavailable", "The daemon went away"));
+			const why = this.refusal ?? new CliError("unavailable", "The daemon went away");
+			if (!this.verified) this.settle.reject(why);
+			for (const waiting of this.pending.values()) waiting.reject(why);
 			this.pending.clear();
 			this.closedListener?.();
 		});
 		socket.on("error", () => {});
+		socket.write(JSON.stringify({
+			id: HELLO_ID,
+			method: HELLO,
+			params: { nonce }
+		}) + "\n");
+	}
+	refuse() {
+		this.refusal = notTheDaemon(this.address.socket);
+		this.settle.reject(this.refusal);
+		this.socket.destroy();
 	}
 	call(method, params = {}) {
+		if (this.socket.destroyed && this.refusal) return Promise.reject(this.refusal);
 		const id = this.nextId++;
 		return new Promise((resolve, reject) => {
 			this.pending.set(id, {
 				resolve,
 				reject
 			});
-			this.socket.write(JSON.stringify({
-				id,
-				method,
-				params
-			}) + "\n");
+			this.ready.then(() => {
+				if (this.pending.has(id) && !this.socket.destroyed) this.socket.write(JSON.stringify({
+					id,
+					method,
+					params
+				}) + "\n");
+			}, (error) => {
+				if (this.pending.delete(id)) reject(error);
+			});
 		});
 	}
 	/** Events after `since` (replayed from the journal), then every new one, until the connection closes. */
@@ -297,7 +352,12 @@ var DaemonClient = class {
 		this.socket.destroy();
 	}
 };
-function connectDaemon(path, timeoutMs = 2e3) {
+/**
+* `timeoutMs` bounds the connect only. The client it gives has sent its hello; whether the listener is the daemon is
+* known at the first call (above).
+*/
+function connectDaemon(address, timeoutMs = 2e3) {
+	const path = address.socket;
 	if (!ownSocket(path)) return Promise.resolve(null);
 	return new Promise((resolve) => {
 		const socket = connect(path);
@@ -307,7 +367,7 @@ function connectDaemon(path, timeoutMs = 2e3) {
 		}, timeoutMs);
 		socket.once("connect", () => {
 			clearTimeout(timer);
-			resolve(new DaemonClient(socket));
+			resolve(new DaemonClient(socket, address));
 		});
 		socket.once("error", () => {
 			clearTimeout(timer);
@@ -882,7 +942,7 @@ var commands$8 = {
 				description: "Replace the three files when they are there"
 			}
 		},
-		run: async ({ options }, a) => (await import("./apps-Dn7rCafG.js")).initApp(a.dir, {
+		run: async ({ options }, a) => (await import("./apps-Bs8xpLGv.js")).initApp(a.dir, {
 			name: options.name,
 			title: options.title,
 			force: options.force === true
@@ -922,7 +982,7 @@ var commands$8 = {
 				description: "This version's sequence, higher than the bundle at --out's (default: one more than it)"
 			}
 		},
-		run: async ({ options }, a) => (await import("./apps-Dn7rCafG.js")).publishApp(a.dir, keyFile(options.key, "app publish <dir> --key <file> [--out <file>] [--sequence n]"), here(options.out), options.sequence)
+		run: async ({ options }, a) => (await import("./apps-Bs8xpLGv.js")).publishApp(a.dir, keyFile(options.key, "app publish <dir> --key <file> [--out <file>] [--sequence n]"), here(options.out), options.sequence)
 	},
 	"app revoke": {
 		method: "app.revoke",
@@ -955,7 +1015,7 @@ var commands$8 = {
 				description: "Allow --up-to past the bundle's own sequence (versions published from elsewhere)"
 			}
 		},
-		run: async ({ options }, a) => (await import("./apps-Dn7rCafG.js")).revokeApp(a.dir, keyFile(options.key, "app revoke <dir> --key <file> (--digest <digest>... | --up-to <sequence>) [--reason <text>]"), {
+		run: async ({ options }, a) => (await import("./apps-Bs8xpLGv.js")).revokeApp(a.dir, keyFile(options.key, "app revoke <dir> --key <file> (--digest <digest>... | --up-to <sequence>) [--reason <text>]"), {
 			digests: options.digest,
 			upTo: options["up-to"],
 			reason: options.reason,
@@ -1016,7 +1076,7 @@ var commands$8 = {
 		usage: "app verify <bundle|url>",
 		summary: "Check a .ghostlyapp as a client would, from a file or an https URL: its manifest and digest, or refused (exit 1) with the reason, revoked when the ghostly-revoke.json beside it revokes this version",
 		args: ["bundle"],
-		run: async (_, a) => (await import("./apps-Dn7rCafG.js")).verifyApp(a.bundle)
+		run: async (_, a) => (await import("./apps-Bs8xpLGv.js")).verifyApp(a.bundle)
 	},
 	"store sign": {
 		method: "store.sign",
@@ -1033,7 +1093,7 @@ var commands$8 = {
 				description: "The folder to write ghostly-store.json and ghostly-store.sig in (default: the index's)"
 			}
 		},
-		run: async ({ options }, a) => (await import("./apps-Dn7rCafG.js")).signStore(a.index, keyFile(options.key, "store sign <index> --key <file> [--out <dir>]"), here(options.out))
+		run: async ({ options }, a) => (await import("./apps-Bs8xpLGv.js")).signStore(a.index, keyFile(options.key, "store sign <index> --key <file> [--out <dir>]"), here(options.out))
 	}
 };
 //#endregion
@@ -2223,20 +2283,22 @@ var commands$1 = {
 	},
 	"chat pay": {
 		method: "chat.pay",
-		usage: "chat pay <chat> <sats> [--memo t] [--network testnet] [--confirm-real]",
+		usage: "chat pay <chat> <sats> [--memo t] [--network testnet] [--confirm-real] [--force]",
 		summary: "Send ecash to a contact (Mainnet needs --confirm-real)",
 		args: ["chat", "amount"],
 		options: {
 			memo,
 			network: net,
-			"confirm-real": confirmReal
+			"confirm-real": confirmReal,
+			force
 		},
 		params: ({ options }, a) => ({
 			chat: a.chat,
 			amount: sats(a.amount),
 			memo: options.memo,
 			network: options.network,
-			confirmReal: options["confirm-real"] === true
+			confirmReal: options["confirm-real"] === true,
+			force: options.force === true
 		})
 	},
 	"chat pay-request": {
@@ -2267,7 +2329,7 @@ var commands$1 = {
 	},
 	"chat request": {
 		method: "chat.request",
-		usage: "chat request <chat> <sats> [--memo t] [--method m] [--rail cashu|lightning] [--network testnet] [--card <id>]",
+		usage: "chat request <chat> <sats> [--memo t] [--method m] [--rail cashu|lightning] [--network testnet] [--card <id>] [--force]",
 		summary: "Ask a contact to pay",
 		args: ["chat", "amount"],
 		options: {
@@ -2281,7 +2343,8 @@ var commands$1 = {
 				description: "cashu or lightning"
 			},
 			network: net,
-			card
+			card,
+			force
 		},
 		params: ({ options }, a) => ({
 			chat: a.chat,
@@ -2290,7 +2353,8 @@ var commands$1 = {
 			method: options.method,
 			rail: options.rail,
 			network: options.network,
-			card: options.card
+			card: options.card,
+			force: options.force === true
 		})
 	},
 	"lightning default": {
@@ -3061,10 +3125,20 @@ function runExec(command, event) {
 		child.stdin.end(JSON.stringify(event) + "\n");
 	});
 }
-async function post(url, event) {
-	for (let attempt = 0; attempt < 3; attempt++) {
+/** The longest wait between two tries of a webhook that is not answering. */
+var RETRY_MAX_MS = 6e4;
+/**
+* Posts one event; resolves true once the bridge took it, false when it refused it (a 4xx or a redirect, three times).
+* A bridge that is not there (refused connection, timeout, 5xx, 408, 429) has not handled the event: it is tried again,
+* waiting up to a minute between tries, for as long as it takes, so the cursor never moves past it. Before, three tries
+* in 3.5 s and the cursor moved on: a bridge restarting for longer lost every event of the time it was down, for good.
+*/
+async function post(url, event, retryMs) {
+	let wait = retryMs, holding = false;
+	for (let attempt = 0;; attempt++) {
+		let down = true;
 		try {
-			if ((await fetch(url, {
+			const response = await fetch(url, {
 				method: "POST",
 				redirect: "manual",
 				headers: {
@@ -3074,11 +3148,22 @@ async function post(url, event) {
 				},
 				body: JSON.stringify(event),
 				signal: AbortSignal.timeout(1e4)
-			})).ok) return true;
+			});
+			response.body?.cancel().catch(() => {});
+			if (response.ok) {
+				if (holding) process.stderr.write(`ghostly: the webhook at ${url.href} answers again: event ${event.seq} taken\n`);
+				return true;
+			}
+			down = response.status >= 500 || response.status === 408 || response.status === 429;
 		} catch {}
-		await new Promise((resolve) => setTimeout(resolve, 500 * 2 ** attempt));
+		if (!down && attempt >= 2) return false;
+		if (down && attempt >= 2 && !holding) {
+			holding = true;
+			process.stderr.write(`ghostly: the webhook at ${url.href} is not answering: holding event ${event.seq} (${event.type}) until it does\n`);
+		}
+		await new Promise((resolve) => setTimeout(resolve, wait));
+		wait = Math.min(wait * 2, RETRY_MAX_MS);
 	}
-	return false;
 }
 /**
 * A handler that takes events in order, one at a time. A step that throws (the output closed, the allowlist's lookup,
@@ -3107,7 +3192,7 @@ function eventHandler(options) {
 				const code = await runExec(options.exec, event);
 				if (code !== 0) process.stderr.write(`ghostly: --exec exited ${code} on event ${event.seq} (${event.type})\n`);
 			}
-			if (webhook && !await post(webhook, event)) process.stderr.write(`ghostly: the webhook did not take event ${event.seq} (${event.type})\n`);
+			if (webhook && !await post(webhook, event, options.retryMs ?? 500)) process.stderr.write(`ghostly: the webhook did not take event ${event.seq} (${event.type})\n`);
 			if (full) await options.drained?.();
 			if (options.cursor) writeCursor(options.cursor, event.seq);
 		}).catch((error) => {
@@ -3241,8 +3326,8 @@ var VERSION = package_default.version;
 * command a running daemon answers loads none of them, and starts about as fast as Node does. Statically imported, they
 * cost every command ~100 ms before its socket was opened.
 */
-var engineApi = () => import("./api-Br3msjtR.js");
-var engineHost = () => import("./host-DFzlKU3P.js");
+var engineApi = () => import("./api-CYG-sByy.js");
+var engineHost = () => import("./host-Mz74S9cM.js");
 var pretty = false;
 function print(value) {
 	process.stdout.write(JSON.stringify(value, null, pretty ? 2 : void 0) + "\n");
@@ -3338,7 +3423,7 @@ function readOnly(method, params) {
 }
 async function session(g, options) {
 	requireProfile(g);
-	const client = await connectDaemon(g.paths.socket);
+	const client = await connectDaemon(g.paths);
 	if (client) await warnVersion(client);
 	if (client) return {
 		mode: "daemon",
@@ -3706,7 +3791,7 @@ async function profileCommand(sub, argv) {
 			const [file, name] = parsed.positionals;
 			if (!file || !name) throw new CliError("usage", "ghostly profile restore <file> <new profile> [--passphrase-file f] [--use]");
 			noMoreThan(2, parsed.positionals, "profile restore <file> <new profile> [--passphrase-file f] [--use]");
-			const { backupFileProtection, restoreProfile } = await import("./backup-_JnqeFZb.js");
+			const { backupFileProtection, restoreProfile } = await import("./backup-OlEHNkqQ.js");
 			const protection = await backupFileProtection(file);
 			const paths = await restoreProfile(g.home, checkProfileName(name), file, protection === "none" ? void 0 : backupPassphrase(parsed.options["passphrase-file"], RESTORE_PASSPHRASE));
 			if (parsed.options.use) selectProfile(g.home, name);
@@ -3769,7 +3854,7 @@ function backupPassphrase(file, missing = BACKUP_PASSPHRASE) {
 }
 async function runDaemon(g) {
 	requireProfile(g);
-	if (await connectDaemon(g.paths.socket)) throw new CliError("busy", `A daemon already runs profile ${g.profile}`);
+	if (await connectDaemon(g.paths)) throw new CliError("busy", `A daemon already runs profile ${g.profile}`);
 	const { keepServing, openHost, serve } = await engineHost();
 	const host = await openHost(g.paths, "daemon", VERSION);
 	let served;
@@ -3819,7 +3904,7 @@ async function daemonCommand(argv) {
 	].includes(sub)) noMoreThan(0, parsed.positionals, sub === "status" ? "daemon status" : sub ? `daemon ${sub} [--timeout s]` : "daemon [--detach] [--timeout s]");
 	if (sub === "status") {
 		knownProfile(g);
-		const client = await connectDaemon(g.paths.socket);
+		const client = await connectDaemon(g.paths);
 		if (!client) {
 			print({
 				running: false,
@@ -3842,7 +3927,7 @@ async function daemonCommand(argv) {
 	if (sub === "stop") {
 		knownProfile(g);
 		const stopFor = seconds(parsed, 20);
-		const client = await connectDaemon(g.paths.socket);
+		const client = await connectDaemon(g.paths);
 		if (!client) throw new CliError("not_found", `No daemon runs profile ${g.profile}`);
 		print({
 			stopped: true,
@@ -3852,7 +3937,7 @@ async function daemonCommand(argv) {
 	}
 	if (sub === "restart") {
 		const stopFor = seconds(parsed, 20), startFor = seconds(parsed, 60);
-		const client = await connectDaemon(g.paths.socket);
+		const client = await connectDaemon(g.paths);
 		const before = client ? (await client.call("status").catch(() => null))?.version ?? null : null;
 		print({
 			restarted: true,
@@ -3883,7 +3968,19 @@ function seconds(parsed, fallback) {
 * the lock a moment before it exits); its pid.
 */
 async function stopDaemon(g, client, seconds) {
-	const { pid } = await client.call("daemon.stop");
+	let pid;
+	try {
+		({pid} = await client.call("daemon.stop"));
+	} catch (error) {
+		if (!isNotTheDaemon(error)) throw error;
+		const holder = lockOwner(g.paths);
+		if (holder === null) throw error;
+		process.stderr.write(`ghostly: what answers on the socket did not prove it is this profile's daemon (an older release's cannot): stopping the process that holds the profile (${holder}) with SIGTERM\n`);
+		pid = holder;
+		try {
+			process.kill(pid, "SIGTERM");
+		} catch {}
+	}
 	client.close();
 	const until = Date.now() + seconds * 1e3;
 	const running = () => lockOwner(g.paths) === pid || processAlive(pid);
@@ -3907,7 +4004,7 @@ function processAlive(pid) {
 /** A daemon in the background, running this command's code, once its socket answers. */
 async function startDetached(g, seconds) {
 	requireProfile(g);
-	if (await connectDaemon(g.paths.socket)) throw new CliError("busy", `A daemon already runs profile ${g.profile}`);
+	if (await connectDaemon(g.paths)) throw new CliError("busy", `A daemon already runs profile ${g.profile}`);
 	heldBy(g);
 	const log = openSync(g.paths.log, "a", 384);
 	const child = spawn(process.execPath, [
@@ -3932,7 +4029,7 @@ async function startDetached(g, seconds) {
 	while (!client && Date.now() < until) {
 		if (child.exitCode !== null) break;
 		await new Promise((resolve) => setTimeout(resolve, 200));
-		client = await connectDaemon(g.paths.socket, 500);
+		client = await connectDaemon(g.paths, 500);
 	}
 	if (!client) {
 		heldBy(g, child.pid);
@@ -4030,11 +4127,11 @@ async function listenCommand(argv) {
 		});
 	};
 	requireProfile(g);
-	const client = await connectDaemon(g.paths.socket);
+	const client = await connectDaemon(g.paths);
 	if (client) await warnVersion(client);
 	if (client) {
 		const handle = await start((m, p) => client.call(m, p), async (chat) => {
-			const c = await connectDaemon(g.paths.socket, 1e3);
+			const c = await connectDaemon(g.paths, 1e3);
 			if (!c) return null;
 			try {
 				return (await c.call("chat.get", { chat })).peer || null;
@@ -4051,7 +4148,7 @@ async function listenCommand(argv) {
 				await new Promise((resolve) => setTimeout(resolve, wait));
 				wait = 1e3;
 				if (current || feed.paused) return;
-				const next = await connectDaemon(g.paths.socket, 1e3);
+				const next = await connectDaemon(g.paths, 1e3);
 				if (next) {
 					current = next;
 					await follow(next).catch(() => {
@@ -4233,7 +4330,7 @@ async function textCommand(name, argv) {
 	};
 	if (spec.target === "group") params.mentions = parsed.options.mention ?? [];
 	if (parsed.options.reply !== void 0) params.reply = parsed.options.reply;
-	if (!spec.message) Object.assign(params, (await import("./buttons-DDB9Xdha.js")).buttonsOf(parsed.options));
+	if (!spec.message) Object.assign(params, (await import("./buttons-BoGOYSHb.js")).buttonsOf(parsed.options));
 	print(await withSession(g, (s) => {
 		if (spec.target === "chat") {
 			params.wait = parsed.options.wait ?? (s.mode === "one-shot" ? spec.message ? "confirmed" : "sent" : "none");
@@ -4291,10 +4388,10 @@ async function identityAddCommand(argv) {
 		if (event.type === "identity.approval" || event.type === "identity.progress") process.stderr.write(JSON.stringify(event) + "\n");
 	};
 	requireProfile(g);
-	const client = await connectDaemon(g.paths.socket);
+	const client = await connectDaemon(g.paths);
 	if (client) {
 		await warnVersion(client);
-		const watcher = await connectDaemon(g.paths.socket);
+		const watcher = await connectDaemon(g.paths);
 		await watcher?.subscribe(void 0, tell);
 		try {
 			print(await client.call("identity.add", params));
@@ -4369,7 +4466,7 @@ async function callPipeCommand(argv) {
 	const parsed = parseArgs(argv, {}, idSlot({ args: ["call...?"] }));
 	const g = globals(parsed);
 	const ref = parsed.positionals.join(" ") || void 0;
-	const client = await connectDaemon(g.paths.socket);
+	const client = await connectDaemon(g.paths);
 	if (!client) throw new CliError("unavailable", `No daemon runs profile ${g.profile}: calls need one (ghostly daemon --detach)`);
 	let call;
 	try {
@@ -4517,4 +4614,4 @@ async function run(argv) {
 //#endregion
 export { run };
 
-//# sourceMappingURL=main-DgbdDDif.js.map
+//# sourceMappingURL=main-BXwlJall.js.map