@hienlh/ppm 0.18.8 → 0.18.9

package/src/server/routes/resources.ts

@@ -1,88 +1,134 @@
+/**
+ * Whole-machine metrics routes, mounted under `/api/system` behind auth.
+ *
+ *   GET    /resources?processes=0|1          latest snapshot for that tier (or null)
+ *   GET    /resources/stream?processes=0|1   SSE: `session` frame, then `snapshot` frames
+ *   POST   /resources/stream/:sid/ping       renew the subscriber lease
+ *   DELETE /resources/stream/:sid            drop the subscriber
+ *   POST   /resources/kill                   guarded kill (JSON + X-PPM-Request header)
+ */
 import { Hono } from "hono";
-import { resourceMonitor, type ResourceSnapshot } from "../../services/resource-monitor.service.ts";
+import type { MetricsSnapshot, MetricsTier } from "../../types/system-metrics.ts";
 import { ok, err } from "../../types/api.ts";
+import {
+  systemMetricsService, MAX_STREAM_SUBSCRIBERS, type SystemMetricsService,
+} from "../../services/system-metrics/system-metrics.service.ts";
+import { isValidSid } from "../../services/system-metrics/metrics-subscriber-registry.ts";
 
-export const resourceRoutes = new Hono();
+/** Frames a stalled client failed to take before the stream is closed. Metrics
+ *  are lossy by nature; `ReadableStream`'s queue is not, and 30-60 KB every 2 s
+ *  toward a dead mobile client is ~54 MB/hour of heap. */
+export const MAX_DROPPED_FRAMES = 10;
 
-const MAX_SSE_CLIENTS = 5;
-let sseClientCount = 0;
+const tierOf = (raw: string | undefined): MetricsTier => (raw === "1" || raw === "true" ? "full" : "light");
 
-/** GET /resources — latest snapshot as JSON */
-resourceRoutes.get("/resources", (c) => {
-  return c.json(ok(resourceMonitor.getLatest()));
-});
+export function createResourceRoutes(service: SystemMetricsService = systemMetricsService): Hono {
+  const routes = new Hono();
 
-/** GET /resources/history — full ring buffer */
-resourceRoutes.get("/resources/history", (c) => {
-  return c.json(ok(resourceMonitor.getHistory()));
-});
+  routes.get("/resources", (c) => c.json(ok(service.getLatest(tierOf(c.req.query("processes"))))));
 
-/** POST /resources/kill/:pid — send SIGTERM to a process in PPM's tree */
-resourceRoutes.post("/resources/kill/:pid", async (c) => {
-  const pid = parseInt(c.req.param("pid"), 10);
-  if (isNaN(pid) || pid <= 0) {
-    return c.json(err("Invalid PID"), 400);
-  }
-  // Safety: only allow killing processes in PPM's own tree
-  const snapshot = resourceMonitor.getLatest();
-  if (!snapshot) {
-    return c.json(err("No resource data available"), 400);
-  }
-  const allPids = snapshot.groups.flatMap((g) => g.processes.map((p) => p.pid));
-  if (!allPids.includes(pid)) {
-    return c.json(err("PID not in PPM process tree"), 403);
-  }
-  // Don't allow killing the server itself
-  if (pid === process.pid) {
-    return c.json(err("Cannot kill PPM server process"), 403);
-  }
-  try {
-    process.kill(pid, "SIGTERM");
-    return c.json(ok({ pid, signal: "SIGTERM" }));
-  } catch (e: any) {
-    return c.json(err(`Failed to kill PID ${pid}: ${e.message}`), 500);
-  }
-});
+  routes.get("/resources/stream", (c) => {
+    const tier = tierOf(c.req.query("processes"));
+    // A 429 is only possible before the body starts, so reap expired leases and
+    // check the cap here — BEFORE the stream is built, because `start()` runs
+    // synchronously at construction. subscribe() re-checks in case two opens race.
+    service.reapExpired();
+    if (service.liveCount() >= MAX_STREAM_SUBSCRIBERS) {
+      return c.json(err("Too many metrics subscribers"), 429);
+    }
 
-/** GET /resources/stream — SSE stream of snapshots every 3s */
-resourceRoutes.get("/resources/stream", (c) => {
-  if (sseClientCount >= MAX_SSE_CLIENTS) {
-    return c.json({ ok: false, error: "Too many SSE clients" }, 429);
-  }
+    const encoder = new TextEncoder();
+    let sid: string | null = null;
+    let drops = 0;
 
-  let callbackRef: ((s: ResourceSnapshot) => void) | null = null;
-
-  const stream = new ReadableStream({
-    start(controller) {
-      sseClientCount++;
-      const encoder = new TextEncoder();
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        const close = () => { try { controller.close(); } catch { /* already closed */ } };
+        const result = service.subscribe({
+          tier,
+          close,
+          deliver: (snapshot: MetricsSnapshot) => {
+            // `enqueue` never throws on backpressure, only on a closed controller,
+            // so `desiredSize` is the only signal that the client stopped reading.
+            if ((controller.desiredSize ?? 1) <= 0) {
+              if (++drops >= MAX_DROPPED_FRAMES) {
+                if (sid) service.unsubscribe(sid);
+                close();
+              }
+              return;
+            }
+            drops = 0;
+            try {
+              controller.enqueue(encoder.encode(`event: snapshot\ndata: ${JSON.stringify(snapshot)}\n\n`));
+            } catch {
+              if (sid) service.unsubscribe(sid);
+            }
+          },
+        });
+        if (!result) {
+          controller.enqueue(encoder.encode(`event: error\ndata: ${JSON.stringify({ error: "Too many metrics subscribers" })}\n\n`));
+          close();
+          return;
+        }
+        sid = result.sid;
+        controller.enqueue(encoder.encode("retry: 5000\n\n"));
+        controller.enqueue(encoder.encode(`event: session\ndata: ${JSON.stringify(result)}\n\n`));
+      },
+      cancel() {
+        // Best effort only — a proxy may keep this request alive after the
+        // browser left, which is what the lease + DELETE route are for.
+        if (sid) service.unsubscribe(sid);
+      },
+    });
 
-      // Send retry hint for reconnect interval
-      controller.enqueue(encoder.encode("retry: 5000\n\n"));
+    return new Response(stream, {
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive",
+      },
+    });
+  });
 
-      callbackRef = (snapshot: ResourceSnapshot) => {
-        try {
-          const data = `event: snapshot\ndata: ${JSON.stringify(snapshot)}\n\n`;
-          controller.enqueue(encoder.encode(data));
-        } catch {
-          // Client disconnected — cleanup happens in cancel
-        }
-      };
+  routes.post("/resources/stream/:sid/ping", (c) => {
+    const sid = c.req.param("sid");
+    if (!isValidSid(sid) || !service.ping(sid)) return c.json(err("Unknown or expired stream session"), 404);
+    return c.json(ok({ alive: true }));
+  });
 
-      resourceMonitor.subscribe(callbackRef);
-    },
-    cancel() {
-      sseClientCount = Math.max(0, sseClientCount - 1);
-      if (callbackRef) resourceMonitor.unsubscribe(callbackRef);
-      callbackRef = null;
-    },
+  routes.delete("/resources/stream/:sid", (c) => {
+    const sid = c.req.param("sid");
+    const stopped = isValidSid(sid) ? service.unsubscribe(sid) : false;
+    return c.json(ok({ stopped }));
   });
 
-  return new Response(stream, {
-    headers: {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      "Connection": "keep-alive",
-    },
+  routes.post("/resources/kill", async (c) => {
+    // CSRF hardening for the auth-disabled configuration: a cross-origin HTML
+    // form can set neither a JSON content type nor a custom header, so both
+    // force a preflight that the browser will refuse.
+    const contentType = c.req.header("content-type") ?? "";
+    if (!contentType.toLowerCase().startsWith("application/json")) {
+      return c.json(err("Content-Type must be application/json"), 400);
+    }
+    if (c.req.header("x-ppm-request") !== "1") return c.json(err("Missing X-PPM-Request header"), 400);
+    let body: unknown;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json(err("Invalid JSON body"), 400);
+    }
+    try {
+      const outcome = await service.kill(body);
+      return c.json(outcome.body, outcome.status);
+    } catch (e) {
+      // The live re-query itself failed (collector down, session restarting);
+      // nothing was signalled, so the client can simply retry.
+      console.error("[SystemMetrics] kill re-query failed:", (e as Error)?.message ?? e);
+      return c.json(err("Could not verify the process — try again"), 500);
+    }
   });
-});
+
+  return routes;
+}
+
+export const resourceRoutes = createResourceRoutes();

package/src/services/autostart-generator.ts

@@ -205,18 +205,90 @@ export function buildRegDeleteCommand(): string[] {
 // by third-party "startup cleaner" utilities that only target Run keys and
 // the Startup folder. No admin required for a current-user logon task.
 
-/** wscript runs the VBS without a console window; VBS in turn launches bun hidden. */
-function buildTaskRunString(vbsPath: string): string {
-  return `wscript.exe "${vbsPath}"`;
+/**
+ * The account the task runs as, and whose logon fires it — `DOMAIN\user`, or
+ * bare user name when the machine reports no domain.
+ */
+export function getCurrentWindowsUserId(): string {
+  const user = process.env.USERNAME ?? "";
+  const domain = process.env.USERDOMAIN ?? process.env.COMPUTERNAME ?? "";
+  return domain ? `${domain}\\${user}` : user;
+}
+
+export function getTaskXmlPath(): string {
+  return resolve(homedir(), ".ppm", "ppm-task.xml");
+}
+
+/**
+ * Task Scheduler XML for the At-logon task.
+ *
+ * `schtasks /SC ONLOGON` cannot express *which* user's logon fires the task:
+ * it always emits a LogonTrigger with no UserId, meaning "any user logs on",
+ * and registering that is an all-users change the Task Scheduler refuses for a
+ * standard account — the create fails with "ERROR: Access is denied." even
+ * when /RU names the caller, because /RU sets the run-as principal, not the
+ * trigger scope. Registering from XML lets the trigger carry a UserId, which
+ * scopes it to this account and needs no elevation.
+ *
+ * ExecutionTimeLimit must be PT0S (unlimited): schtasks would have defaulted to
+ * PT72H and killed the supervisor after three days of uptime.
+ */
+export function generateTaskXml(vbsPath: string, userId = getCurrentWindowsUserId()): string {
+  const user = escapeXml(userId);
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo>
+    <Description>PPM - starts the PPM supervisor at logon</Description>
+    <URI>\\${TASK_NAME}</URI>
+  </RegistrationInfo>
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+      <UserId>${user}</UserId>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <UserId>${user}</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>false</StartWhenAvailable>
+    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
+    <IdleSettings>
+      <StopOnIdleEnd>false</StopOnIdleEnd>
+      <RestartOnIdle>false</RestartOnIdle>
+    </IdleSettings>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>false</Hidden>
+    <RunOnlyIfIdle>false</RunOnlyIfIdle>
+    <WakeToRun>false</WakeToRun>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <Priority>7</Priority>
+  </Settings>
+  <Actions Context="Author">
+    <Exec>
+      <Command>wscript.exe</Command>
+      <Arguments>"${escapeXml(vbsPath)}"</Arguments>
+    </Exec>
+  </Actions>
+</Task>
+`;
 }
 
-/** Build schtasks command to create the At-logon task (no admin) */
-export function buildSchtasksCreateCommand(vbsPath: string): string[] {
+/** Build schtasks command to create the At-logon task from XML (no admin) */
+export function buildSchtasksCreateCommand(xmlPath: string): string[] {
   return [
     "schtasks", "/Create",
     "/TN", TASK_NAME,
-    "/TR", buildTaskRunString(vbsPath),
-    "/SC", "ONLOGON",
+    "/XML", xmlPath,
     "/F",
   ];
 }

package/src/services/autostart-register.ts

@@ -11,6 +11,8 @@ import {
   getServicePath,
   generateVbsWrapper,
   getVbsPath,
+  generateTaskXml,
+  getTaskXmlPath,
   buildRegDeleteCommand,
   buildSchtasksCreateCommand,
   buildSchtasksDeleteCommand,
@@ -300,18 +302,27 @@ function statusLinux(): AutoStartStatus {
 
 async function enableWindows(config: AutoStartConfig): Promise<string> {
   const vbsPath = getVbsPath();
+  const xmlPath = getTaskXmlPath();
   const vbsDir = dirname(vbsPath);
 
   if (!existsSync(vbsDir)) mkdirSync(vbsDir, { recursive: true });
   writeFileSync(vbsPath, generateVbsWrapper(config));
 
+  // Task Scheduler only accepts a definition file encoded as UTF-16 and reads
+  // the BOM to detect it; a UTF-8 file is rejected as malformed XML.
+  writeFileSync(xmlPath, `\ufeff${generateTaskXml(vbsPath)}`, "utf16le");
+
   // Register an At-logon scheduled task (no admin). More reliable than the
   // HKCU Run key, which startup-cleaner utilities sweep and which can silently
   // fail to fire at logon.
-  const cmd = buildSchtasksCreateCommand(vbsPath);
+  const cmd = buildSchtasksCreateCommand(xmlPath);
   const result = Bun.spawnSync({ cmd, stdout: "pipe", stderr: "pipe" });
 
   if (result.exitCode !== 0) {
+    // Leave nothing half-registered: a stale wrapper and definition on disk
+    // make the next `ppm autostart status` look configured when no task exists.
+    try { unlinkSync(vbsPath); } catch {}
+    try { unlinkSync(xmlPath); } catch {}
     const err = result.stderr.toString().trim() || result.stdout.toString().trim();
     throw new Error(`schtasks create failed: ${err}`);
   }
@@ -336,9 +347,11 @@ async function disableWindows(): Promise<void> {
   Bun.spawnSync({ cmd: buildSchtasksDeleteCommand(), stdout: "ignore", stderr: "ignore" });
   Bun.spawnSync({ cmd: buildRegDeleteCommand(), stdout: "ignore", stderr: "ignore" });
 
-  // Remove VBS wrapper
+  // Remove VBS wrapper and task definition
   const vbsPath = getVbsPath();
   try { if (existsSync(vbsPath)) unlinkSync(vbsPath); } catch {}
+  const xmlPath = getTaskXmlPath();
+  try { if (existsSync(xmlPath)) unlinkSync(xmlPath); } catch {}
 
   removeMetadata();
 }