@jlongo78/agent-spaces 1.0.0 → 1.0.1

package/bin/lib/remote.js

@@ -52,18 +52,20 @@ function validateDestination(dest) {
  */
 /**
  * `command` run through the remote user's login shell with nvm loaded — the
- * PATH an interactive session would have. `command` is spliced inside single
- * quotes, so it must never contain one; every caller passes a constant or
- * something built only from validated parts.
+ * PATH an interactive session would have — and ~/.local/bin first on it,
+ * where `--remote` installs Spaces when npm's own global folder belongs to
+ * root. `command` is spliced inside single quotes, so it must never contain
+ * one; every caller passes a constant or something built only from
+ * validated parts.
  */
 function inLoginShell(command) {
   if (command.includes("'")) throw new Error('a remote command cannot contain a single quote');
-  return `"\${SHELL:-sh}" -lc '[ -s "$HOME/.nvm/nvm.sh" ] && . "$HOME/.nvm/nvm.sh" >/dev/null 2>&1; ${command}'`;
+  return `"\${SHELL:-sh}" -lc '[ -s "$HOME/.nvm/nvm.sh" ] && . "$HOME/.nvm/nvm.sh" >/dev/null 2>&1; PATH="$HOME/.local/bin:$PATH"; ${command}'`;
 }
 
-function sshStartArgs(dest, { loginShell = false } = {}) {
-  const command = loginShell ? inLoginShell('spaces start --print-token') : 'spaces start --print-token';
-  return ['-o', 'ConnectTimeout=15', '--', dest, command];
+function sshStartArgs(dest, { loginShell = false, login = false } = {}) {
+  const start = `spaces start --print-token${login ? ' --print-login' : ''}`;
+  return ['-o', 'ConnectTimeout=15', '--', dest, loginShell ? inLoginShell(start) : start];
 }
 
 // ─── Installing and updating the remote ────────────────────
@@ -88,8 +90,48 @@ const PROBE = inLoginShell([
   'else echo SPACES_MISSING=1; fi',
 ].join(' '));
 
-function sshProbeArgs(dest) {
-  return ['-o', 'ConnectTimeout=15', '--', dest, PROBE];
+function sshProbeArgs(dest, { batch = false } = {}) {
+  return [...(batch ? ['-o', 'BatchMode=yes'] : []), '-o', 'ConnectTimeout=15', '--', dest, PROBE];
+}
+
+// ─── Signing in with a key ──────────────────────────────────
+
+/** The private keys plain `ssh` tries by default, in the order it tries them. */
+const DEFAULT_KEYS = ['id_ed25519', 'id_ecdsa', 'id_rsa'];
+
+/**
+ * Why a no-prompt (`BatchMode`) ssh failed: `'password'` (the server wants a
+ * password, or another key), `'hostkey'` (ssh would have asked about an
+ * unknown host key), or `'other'`.
+ */
+function classifySshFailure(stderr) {
+  const text = String(stderr);
+  if (/Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED/i.test(text)) return 'hostkey';
+  if (/Permission denied/i.test(text)) return 'password';
+  return 'other';
+}
+
+/**
+ * One public key line, as `ssh-keygen` writes it, or null. It travels to the
+ * remote on stdin rather than in the command, but is still checked: it is
+ * about to be trusted for every future sign-in there.
+ */
+function publicKeyLine(text) {
+  const line = String(text).split(/\r?\n/)[0].trim();
+  return /^(ssh-ed25519|ecdsa-sha2-nistp(256|384|521)|ssh-rsa|sk-ssh-ed25519@openssh\.com) [A-Za-z0-9+/]+=*( [^\r\n]*)?$/.test(line)
+    ? line
+    : null;
+}
+
+/**
+ * Adds the public key on stdin to ~/.ssh/authorized_keys on the remote,
+ * once, creating the file with the permissions sshd insists on. `sh -c`
+ * so it runs the same whatever the remote user's own shell is.
+ */
+const AUTHORIZE_KEY = `sh -c 'umask 077; mkdir -p "$HOME/.ssh" && k=$(cat) && touch "$HOME/.ssh/authorized_keys" && { grep -qxF "$k" "$HOME/.ssh/authorized_keys" || printf "%s\\n" "$k" >> "$HOME/.ssh/authorized_keys"; }'`;
+
+function sshAuthorizeKeyArgs(dest) {
+  return ['-o', 'ConnectTimeout=15', '--', dest, AUTHORIZE_KEY];
 }
 
 const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
@@ -165,12 +207,21 @@ function installSpec(localVersion, override) {
 }
 
 /**
- * Installs `spec` on the remote; for an update, `spaces restart` then puts
- * the new version in charge — the freshly installed one, which knows to go
- * through the service when there is one.
+ * Installs `spec` on the remote and starts it, in one SSH session — each
+ * session can mean another password prompt. Into npm's global folder when
+ * this account can write there (nvm's always can), else into ~/.local,
+ * which needs no root. For an update, `spaces restart` first puts the new
+ * version in charge: the freshly installed one, which knows to go through
+ * the service when there is one. Ends with what `spaces start
+ * --print-token` prints, so the caller need not ask again.
  */
-function sshInstallArgs(dest, spec, { restart = false } = {}) {
-  const command = `npm install -g ${spec}${restart ? ' && spaces restart' : ''}`;
+function sshInstallArgs(dest, spec, { restart = false, login = false } = {}) {
+  const command = [
+    `if [ -w "$(npm prefix -g)/lib" ]; then npm install -g ${spec};`,
+    `else npm install -g --prefix "$HOME/.local" ${spec}; fi`,
+    restart ? '&& spaces restart' : '',
+    `&& spaces start --print-token${login ? ' --print-login' : ''}`,
+  ].filter(Boolean).join(' ');
   return ['-o', 'ConnectTimeout=15', '--', dest, inLoginShell(command)];
 }
 
@@ -209,9 +260,13 @@ function installFailureHint(kind, dest, spec) {
   }
 }
 
-/** `ssh` arguments for the tunnel: local port → the remote server's loopback. */
+/**
+ * `ssh` arguments for the tunnel: local port → the remote server's loopback.
+ * `-v` so its log says when the forward is up (see tunnelReady).
+ */
 function sshTunnelArgs(dest, localPort, remotePort) {
   return [
+    '-v',
     '-N',
     '-o', 'ExitOnForwardFailure=yes',
     '-o', 'ServerAliveInterval=30',
@@ -221,6 +276,27 @@ function sshTunnelArgs(dest, localPort, remotePort) {
   ];
 }
 
+/**
+ * Whether the tunnel's `ssh -v` log says the forward from `localPort` is
+ * listening. Waiting on the log rather than probing the port: a probe is a
+ * child process, and on Windows each one that exits resets the console,
+ * which garbles a password being typed into ssh's prompt meanwhile.
+ */
+function tunnelReady(log, localPort) {
+  const port = String(localPort).replace(/\D/g, '');
+  return new RegExp(`Local forwarding listening on 127\\.0\\.0\\.1 port ${port}\\b|Local connections to 127\\.0\\.0\\.1:${port} forwarded`).test(String(log));
+}
+
+/** Whether the tunnel's log shows ssh got past authentication. */
+function tunnelAuthenticated(log) {
+  return /^Authenticated to /m.test(String(log));
+}
+
+/** An `ssh -v` log without its debug chatter, for showing a failure. */
+function withoutDebug(log) {
+  return String(log).split(/\r?\n/).filter((l) => !/^(debug\d:|OpenSSH_)/.test(l)).join('\n');
+}
+
 /** The port `spaces start` reported, or null. */
 function parseStartOutput(stdout) {
   const m = PORT_LINE.exec(String(stdout));
@@ -229,6 +305,29 @@ function parseStartOutput(stdout) {
   return port >= 1 && port <= 65535 ? port : null;
 }
 
+/** The browser sign-in code `spaces start --print-login` reported, or null. */
+function parseStartLogin(stdout) {
+  const m = /^SPACES_LOGIN=([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)\s*$/m.exec(String(stdout));
+  return m ? m[1] : null;
+}
+
+/** The path the remote serves the web app under, or '' (also when malformed). */
+function parseStartBasePath(stdout) {
+  const m = /^SPACES_BASE_PATH=(\/[A-Za-z0-9._~\/-]*?)\/?\s*$/m.exec(String(stdout));
+  return m ? m[1] : '';
+}
+
+/**
+ * The local port `spaces open --remote` tunnels from, the same each time for
+ * the same destination, so the address stays put in the browser's history.
+ * Within 41000–41999; another is used when this one is taken.
+ */
+function preferredLocalPort(dest) {
+  let h = 0;
+  for (const c of String(dest)) h = (h * 31 + c.charCodeAt(0)) >>> 0;
+  return 41000 + (h % 1000);
+}
+
 /** The session token `spaces start --print-token` reported, or null. */
 function parseStartToken(stdout) {
   const m = TOKEN_LINE.exec(String(stdout));
@@ -283,11 +382,21 @@ module.exports = {
   sshTunnelArgs,
   parseStartOutput,
   parseStartToken,
+  parseStartLogin,
+  parseStartBasePath,
+  preferredLocalPort,
   classifyStartFailure,
   installHint,
   splitRemote,
   PACKAGE,
+  DEFAULT_KEYS,
+  classifySshFailure,
+  publicKeyLine,
+  sshAuthorizeKeyArgs,
   inLoginShell,
+  tunnelReady,
+  tunnelAuthenticated,
+  withoutDebug,
   sshProbeArgs,
   parseProbe,
   nodeIsSupported,