@hasna/machines 0.0.44 → 0.0.46

package/dist/consumer.js

@@ -96,6 +96,7 @@ class SqliteAdapter {
   raw;
   constructor(path) {
     this.raw = new Database(path);
+    this.raw.exec("PRAGMA busy_timeout = 5000");
   }
   close() {
     this.raw.close();
@@ -161,6 +162,23 @@ function createTables(db) {
       updated_at TEXT NOT NULL
     )
   `);
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS mutation_approval_nonces (
+      nonce_sha256 TEXT PRIMARY KEY,
+      token_sha256 TEXT NOT NULL,
+      surface TEXT NOT NULL,
+      operation TEXT NOT NULL,
+      caller_id TEXT NOT NULL,
+      run_id TEXT NOT NULL,
+      transport TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      used_at INTEGER NOT NULL
+    )
+  `);
+  db.exec(`
+    CREATE INDEX IF NOT EXISTS mutation_approval_nonces_expires_at_idx
+    ON mutation_approval_nonces (expires_at)
+  `);
 }
 function migrateAgentHeartbeats(db) {
   const columns = db.query("PRAGMA table_info(agent_heartbeats)").all();
@@ -5990,12 +6008,24 @@ function validateMachinesConsumerEnvelope(envelope, value) {
 }
 // src/remote.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { hostname as hostname4 } from "os";
+import { existsSync as existsSync5, mkdtempSync, readFileSync as readFileSync3, rmSync } from "fs";
+import { hostname as hostname4, tmpdir } from "os";
+import { join as join3 } from "path";
 
 // src/commands/ssh.ts
 function shellQuote2(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function validateSshTarget(target) {
+  const trimmed = target.trim();
+  if (!trimmed || trimmed.startsWith("-") || /[\s"'`$\\;&|<>()[\]{}]/.test(trimmed)) {
+    throw new Error(`Unsafe SSH target: ${target}`);
+  }
+  if (!/^(?:[A-Za-z0-9._%+-]+@)?[A-Za-z0-9._:-]+$/.test(trimmed)) {
+    throw new Error(`Unsafe SSH target: ${target}`);
+  }
+  return trimmed;
+}
 function resolveSshTarget(machineId, options = {}) {
   const resolved = resolveMachineRoute(machineId, options);
   if (!resolved.ok || !resolved.target) {
@@ -6006,15 +6036,28 @@ function resolveSshTarget(machineId, options = {}) {
   }
   return {
     machineId: resolved.machine_id ?? machineId,
-    target: resolved.command_target ?? resolved.target,
+    target: validateSshTarget(resolved.command_target ?? resolved.target),
     route: resolved.route,
     confidence: resolved.confidence,
     warnings: resolved.warnings
   };
 }
 function buildSshCommand(machineId, remoteCommand, options = {}) {
+  return buildSshCommandPlan(machineId, remoteCommand, options).shellCommand;
+}
+function buildSshCommandArgs(machineId, remoteCommand, options = {}) {
+  return buildSshCommandPlan(machineId, remoteCommand, options).args;
+}
+function buildSshCommandPlan(machineId, remoteCommand, options = {}) {
   const resolved = resolveSshTarget(machineId, options);
-  return remoteCommand ? `ssh ${resolved.target} ${shellQuote2(remoteCommand)}` : `ssh ${resolved.target}`;
+  const args = remoteCommand ? [resolved.target, remoteCommand] : [resolved.target];
+  const shellCommand2 = `ssh ${args.map(shellQuote2).join(" ")}`;
+  return {
+    ...resolved,
+    command: "ssh",
+    args,
+    shellCommand: shellCommand2
+  };
 }
 
 // src/remote.ts
@@ -6026,35 +6069,233 @@ function machineIsLocal(machineId, localMachineId) {
 }
 function resolveMachineCommand(machineId, command, localMachineId = getLocalMachineId()) {
   if (machineIsLocal(machineId, localMachineId)) {
-    return { source: "local", shellCommand: command };
+    return { source: "local", command: "bash", args: ["-c", command], shellCommand: command, usesShell: true };
   }
   try {
+    const plan = buildSshCommandPlan(machineId, command);
     return {
-      source: resolveSshTarget(machineId).route,
-      shellCommand: buildSshCommand(machineId, command)
+      source: plan.route,
+      command: plan.command,
+      args: plan.args,
+      shellCommand: plan.shellCommand,
+      usesShell: false
     };
   } catch (error) {
     const message = String(error.message ?? error);
     if (message.includes("Machine route not found") || message.includes("Machine not found in manifest")) {
-      return { source: "ssh", shellCommand: `ssh ${shellQuote3(machineId)} ${shellQuote3(command)}` };
+      const target = validateSshTarget(machineId);
+      return {
+        source: "ssh",
+        command: "ssh",
+        args: [target, command],
+        shellCommand: `ssh ${shellQuote3(target)} ${shellQuote3(command)}`,
+        usesShell: false
+      };
     }
     throw error;
   }
 }
-function runMachineCommand(machineId, command) {
+function runMachineCommand(machineId, command, options = {}) {
   const resolved = resolveMachineCommand(machineId, command);
-  const result = spawnSync2("bash", ["-c", resolved.shellCommand], {
+  if (options.timeoutMs && options.timeoutMs > 0 && process.platform !== "win32") {
+    return runMachineCommandWithProcessGroupTimeout(machineId, resolved, options);
+  }
+  const result = spawnSync2(resolved.command, resolved.args, {
     encoding: "utf8",
-    env: process.env
+    env: process.env,
+    timeout: options.timeoutMs,
+    killSignal: "SIGTERM"
   });
+  const timedOut = Boolean(result.error && "code" in result.error && result.error.code === "ETIMEDOUT");
+  const timeoutMessage = timedOut ? `Command timed out after ${options.timeoutMs}ms.` : "";
+  const stderr = [result.stderr || "", timeoutMessage].filter(Boolean).join(result.stderr ? `
+` : "");
   return {
     machineId,
     source: resolved.source,
     stdout: result.stdout || "",
-    stderr: result.stderr || "",
-    exitCode: result.status ?? 1
+    stderr,
+    exitCode: timedOut ? 124 : result.status ?? 1,
+    timedOut,
+    signal: result.signal
   };
 }
+function runMachineCommandWithProcessGroupTimeout(machineId, resolved, options) {
+  const timeoutMs = Math.max(1, options.timeoutMs ?? 1);
+  const killGraceMs = Math.max(1, options.killGraceMs ?? 1000);
+  const helperDir = mkdtempSync(join3(tmpdir(), "machines-timeout-helper-"));
+  const pgidFile = join3(helperDir, "pgid");
+  const helper = spawnSync2(process.execPath, ["--eval", PROCESS_GROUP_TIMEOUT_HELPER], {
+    input: JSON.stringify({ command: resolved.command, args: resolved.args }),
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      HASNA_MACHINES_COMMAND_TIMEOUT_MS: String(timeoutMs),
+      HASNA_MACHINES_COMMAND_KILL_GRACE_MS: String(killGraceMs),
+      HASNA_MACHINES_COMMAND_PGID_FILE: pgidFile
+    },
+    timeout: timeoutMs + killGraceMs + 2000,
+    killSignal: "SIGKILL",
+    maxBuffer: 64 * 1024 * 1024
+  });
+  try {
+    const parsed = parseHelperResult(helper.stdout);
+    if (parsed) {
+      return {
+        machineId,
+        source: resolved.source,
+        stdout: parsed.stdout,
+        stderr: parsed.stderr,
+        exitCode: parsed.exitCode,
+        timedOut: parsed.timedOut,
+        signal: parsed.signal
+      };
+    }
+    const helperTimedOut = Boolean(helper.error && "code" in helper.error && helper.error.code === "ETIMEDOUT");
+    if (helperTimedOut)
+      killPublishedProcessGroup(pgidFile);
+    const timeoutMessage = helperTimedOut ? `Command timed out after ${timeoutMs}ms; timeout helper exceeded cleanup grace ${killGraceMs}ms.` : "";
+    const stderr = [helper.stderr || "", timeoutMessage].filter(Boolean).join(helper.stderr ? `
+` : "");
+    return {
+      machineId,
+      source: resolved.source,
+      stdout: "",
+      stderr,
+      exitCode: helperTimedOut ? 124 : helper.status ?? 1,
+      timedOut: helperTimedOut,
+      signal: helper.signal
+    };
+  } finally {
+    rmSync(helperDir, { recursive: true, force: true });
+  }
+}
+function killPublishedProcessGroup(pgidFile) {
+  if (!existsSync5(pgidFile))
+    return;
+  try {
+    const pid = Number.parseInt(readFileSync3(pgidFile, "utf8").trim(), 10);
+    if (!Number.isInteger(pid) || pid <= 1)
+      return;
+    process.kill(-pid, "SIGKILL");
+  } catch {}
+}
+function parseHelperResult(stdout) {
+  if (!stdout)
+    return null;
+  try {
+    const parsed = JSON.parse(stdout);
+    if (typeof parsed.stdout !== "string" || typeof parsed.stderr !== "string" || typeof parsed.exitCode !== "number")
+      return null;
+    return {
+      machineId: "",
+      source: "local",
+      stdout: parsed.stdout,
+      stderr: parsed.stderr,
+      exitCode: parsed.exitCode,
+      timedOut: parsed.timedOut === true,
+      signal: typeof parsed.signal === "string" ? parsed.signal : null
+    };
+  } catch {
+    return null;
+  }
+}
+var PROCESS_GROUP_TIMEOUT_HELPER = `
+	const { spawn } = require("node:child_process");
+	const { readFileSync, writeFileSync } = require("node:fs");
+
+	const plan = JSON.parse(readFileSync(0, "utf8"));
+	const command = String(plan.command || "");
+	const args = Array.isArray(plan.args) ? plan.args.map(String) : [];
+	const timeoutMs = Math.max(1, Number.parseInt(process.env.HASNA_MACHINES_COMMAND_TIMEOUT_MS || "1", 10));
+	const killGraceMs = Math.max(1, Number.parseInt(process.env.HASNA_MACHINES_COMMAND_KILL_GRACE_MS || "1000", 10));
+	const pgidFile = process.env.HASNA_MACHINES_COMMAND_PGID_FILE || "";
+	let stdout = "";
+	let stderr = "";
+	let timedOut = false;
+	let finished = false;
+let timeoutTimer;
+let killTimer;
+let sigkillSent = false;
+let pendingExit = null;
+
+const child = spawn(command, args, {
+  detached: true,
+  stdio: ["ignore", "pipe", "pipe"],
+	  env: process.env,
+	});
+
+	if (pgidFile && child.pid) {
+	  try {
+	    writeFileSync(pgidFile, String(child.pid), { mode: 0o600 });
+	  } catch {}
+	}
+
+function appendText(target, chunk) {
+  return target + String(chunk);
+}
+
+	function killTarget(signal) {
+	  if (!child.pid) return;
+	  if (process.platform === "win32") {
+	    try {
+	      process.kill(child.pid, signal);
+	    } catch {}
+	    return;
+	  }
+	  try {
+	    process.kill(-child.pid, signal);
+	  } catch {}
+	}
+
+	function finish(code, signal) {
+	  if (finished) return;
+  if (timedOut && !sigkillSent) {
+    pendingExit = { code, signal };
+    return;
+  }
+  finished = true;
+  if (timeoutTimer) clearTimeout(timeoutTimer);
+  if (killTimer) clearTimeout(killTimer);
+	  if (timedOut) {
+	    stderr = [stderr, "Command timed out after " + timeoutMs + "ms."].filter(Boolean).join(stderr ? "\\n" : "");
+	  }
+	  const exitCode = timedOut ? 124 : code ?? 1;
+	  process.stdout.write(JSON.stringify({
+	    stdout,
+	    stderr,
+	    exitCode,
+	    timedOut,
+	    signal: signal ?? null,
+	  }), () => process.exit(exitCode));
+	}
+
+	child.stdout.setEncoding("utf8");
+	child.stderr.setEncoding("utf8");
+	child.stdout.on("data", (chunk) => { stdout = appendText(stdout, chunk); });
+	child.stderr.on("data", (chunk) => { stderr = appendText(stderr, chunk); });
+	let childExit = { code: null, signal: null };
+	child.on("error", (error) => {
+	    stderr = [stderr, error instanceof Error ? error.message : String(error)].filter(Boolean).join(stderr ? "\\n" : "");
+	    finish(1, null);
+	});
+	child.on("exit", (code, signal) => {
+	  childExit = { code, signal };
+	});
+	child.on("close", (code, signal) => {
+	  finish(code ?? childExit.code, signal ?? childExit.signal);
+	});
+
+timeoutTimer = setTimeout(() => {
+  timedOut = true;
+  killTarget("SIGTERM");
+  killTimer = setTimeout(() => {
+    sigkillSent = true;
+    killTarget("SIGKILL");
+    if (pendingExit) finish(pendingExit.code, pendingExit.signal);
+  }, killGraceMs);
+}, timeoutMs);
+`;
 function describeMachineCommandFailure(operation, result) {
   const detail = (result.stderr || result.stdout || "").trim();
   const suffix = detail ? `: ${detail}` : "";

package/dist/cross-project-types.d.ts

@@ -23,4 +23,3 @@ export interface CrossRef {
 }
 /** Reserved key inside `metadata` for cross-project references. */
 export declare const CROSSREFS_KEY: "_crossRefs";
-//# sourceMappingURL=cross-project-types.d.ts.map

package/dist/db.d.ts

@@ -49,4 +49,3 @@ export declare function countRuns(table: "setup_runs" | "sync_runs"): number;
 export declare function setHeartbeatStatus(machineId: string, pid: number, status: "online" | "offline"): void;
 export declare function recordSetupRun(machineId: string, status: string, details: unknown): void;
 export declare function recordSyncRun(machineId: string, status: string, actions: unknown): void;
-//# sourceMappingURL=db.d.ts.map

package/dist/index.d.ts

@@ -14,10 +14,11 @@ export * from "./commands/dns.js";
 export * from "./commands/daemon.js";
 export * from "./commands/doctor.js";
 export * from "./commands/manifest.js";
+export * from "./commands/mutation-approval.js";
 export * from "./commands/diff.js";
 export * from "./commands/install-claude.js";
 export * from "./commands/install-tailscale.js";
-export * from "./commands/notifications.js";
+export { addNotificationChannel, dispatchNotificationEvent, getDefaultNotificationConfig, listNotificationChannels, readNotificationConfig, removeNotificationChannel, testNotificationChannel, writeNotificationConfig, } from "./commands/notifications.js";
 export * from "./commands/ports.js";
 export * from "./commands/runtime.js";
 export * from "./commands/self-test.js";
@@ -32,4 +33,3 @@ export * from "./mcp/server.js";
 export { MACHINES_STORAGE_ENV, MACHINES_STORAGE_FALLBACK_ENV, MACHINES_STORAGE_MODE_ENV, MACHINES_STORAGE_MODE_FALLBACK_ENV, MACHINES_STORAGE_TABLES, STORAGE_DATABASE_ENV, STORAGE_MODE_ENV, STORAGE_TABLES, getStorageDatabaseEnv, getStorageDatabaseEnvName, getStorageDatabaseUrl, getStorageMode, getStoragePg, getStorageStatus, getSyncMetaAll, parseStorageTables, resolveTables, runStorageMigrations, storagePull, storagePush, storageSync, } from "./storage.js";
 export type { StorageEnv, StorageMode, StorageStatus, SyncMeta, SyncResult as StorageSyncResult } from "./storage.js";
 export * from "./version.js";
-//# sourceMappingURL=index.d.ts.map