@khemsok/tunl 0.1.2 → 0.1.4

package/dist/cli.js

@@ -27633,6 +27633,11 @@ var init_chunk_bdqvmfwv = __esm(async () => {
   import_react_devtools_core.default.connectToDevTools();
 });
 
+// src/cli.tsx
+import { existsSync as existsSync9, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+
 // node_modules/@opentui/core/index-qr7b6cvh.js
 import { Buffer as Buffer2 } from "buffer";
 import { EventEmitter } from "events";
@@ -55095,9 +55100,6 @@ var useTerminalDimensions = () => {
   return dimensions;
 };
 
-// src/cli.tsx
-import { execSync as execSync3 } from "child_process";
-
 // src/app.tsx
 var import_react21 = __toESM(require_react(), 1);
 
@@ -56692,14 +56694,136 @@ function recordSession(durationMinutes) {
 }
 
 // src/lib/blocker.ts
+import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2 } from "fs";
+import { execSync as execSync2 } from "child_process";
+import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
+
+// src/lib/pf.ts
 import { existsSync as existsSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync2, unlinkSync } from "fs";
 import { execSync } from "child_process";
 import { homedir as homedir2 } from "os";
 import { join as join3 } from "path";
+var PF_ANCHOR_PATH = "/etc/pf.anchors/tunl";
+var PF_CONF_PATH = "/etc/pf.conf";
+var PF_TOKEN_PATH = join3(homedir2(), ".tunl-pf-token");
+var ANCHOR_NAME = "tunl";
+function isValidDomain(domain) {
+  return /^[a-zA-Z0-9.-]+$/.test(domain);
+}
+function digRecords(domain, recordType) {
+  try {
+    return execSync(`dig +short ${recordType} ${domain} 2>/dev/null`, {
+      encoding: "utf-8",
+      timeout: 5000
+    }).trim().split(`
+`);
+  } catch {
+    return [];
+  }
+}
+function resolveIPs(domain) {
+  if (!isValidDomain(domain))
+    return [];
+  const v4 = digRecords(domain, "A").filter((line) => /^\d+\.\d+\.\d+\.\d+$/.test(line));
+  const v6 = digRecords(domain, "AAAA").filter((line) => line.includes(":"));
+  return [...v4, ...v6];
+}
+function generateRules(sites) {
+  const lines = [
+    "# tunl packet filter rules",
+    "set block-policy drop",
+    'set fingerprints "/etc/pf.os"',
+    "set skip on lo0",
+    ""
+  ];
+  const allDomains = sites.flatMap((s) => [s, `www.${s}`]);
+  const seenIPs = new Set;
+  for (const domain of allDomains) {
+    const ips = resolveIPs(domain);
+    for (const ip of ips) {
+      if (seenIPs.has(ip))
+        continue;
+      seenIPs.add(ip);
+      lines.push(`block return out proto tcp from any to ${ip}`);
+      lines.push(`block return out proto udp from any to ${ip}`);
+    }
+  }
+  return lines.join(`
+`) + `
+`;
+}
+function addAnchorToConf() {
+  const conf = readFileSync2(PF_CONF_PATH, "utf-8");
+  if (conf.includes(`/etc/pf.anchors/${ANCHOR_NAME}`))
+    return;
+  const addition = `
+anchor "${ANCHOR_NAME}"
+load anchor "${ANCHOR_NAME}" from "/etc/pf.anchors/${ANCHOR_NAME}"
+`;
+  const newConf = conf.trimEnd() + addition;
+  const tmpConf = join3(homedir2(), ".tunl-pf-conf.tmp");
+  writeFileSync2(tmpConf, newConf);
+  execSync(`sudo cp "${tmpConf}" ${PF_CONF_PATH}`);
+  unlinkSync(tmpConf);
+}
+function removeAnchorFromConf() {
+  const conf = readFileSync2(PF_CONF_PATH, "utf-8");
+  if (!conf.includes(ANCHOR_NAME))
+    return;
+  const cleaned = conf.split(`
+`).filter((line) => !line.includes(ANCHOR_NAME)).join(`
+`).replace(/\n{3,}/g, `
+
+`).trimEnd() + `
+`;
+  const tmpConf = join3(homedir2(), ".tunl-pf-conf.tmp");
+  writeFileSync2(tmpConf, cleaned);
+  execSync(`sudo cp "${tmpConf}" ${PF_CONF_PATH}`);
+  unlinkSync(tmpConf);
+}
+function blockPF(sites) {
+  const rules = generateRules(sites);
+  const tmpAnchor = join3(homedir2(), ".tunl-pf-anchor.tmp");
+  writeFileSync2(tmpAnchor, rules);
+  execSync(`sudo cp "${tmpAnchor}" ${PF_ANCHOR_PATH}`);
+  unlinkSync(tmpAnchor);
+  addAnchorToConf();
+  const output = execSync(`sudo pfctl -E -f ${PF_CONF_PATH} -F states 2>&1`, { encoding: "utf-8" });
+  const tokenMatch = output.match(/Token\s*:\s*(\S+)/);
+  if (tokenMatch) {
+    writeFileSync2(PF_TOKEN_PATH, tokenMatch[1]);
+  }
+}
+function unblockPF() {
+  try {
+    const tmpEmpty = join3(homedir2(), ".tunl-pf-empty.tmp");
+    writeFileSync2(tmpEmpty, "");
+    execSync(`sudo cp "${tmpEmpty}" ${PF_ANCHOR_PATH}`);
+    unlinkSync(tmpEmpty);
+  } catch {}
+  try {
+    removeAnchorFromConf();
+  } catch {}
+  try {
+    if (existsSync5(PF_TOKEN_PATH)) {
+      const token = readFileSync2(PF_TOKEN_PATH, "utf-8").trim();
+      if (token) {
+        execSync(`sudo pfctl -X ${token} -f ${PF_CONF_PATH} 2>/dev/null`);
+      }
+      unlinkSync(PF_TOKEN_PATH);
+    }
+  } catch {}
+}
+function hasStalePFBlock() {
+  return existsSync5(PF_TOKEN_PATH);
+}
+
+// src/lib/blocker.ts
 var HOSTS_PATH = "/etc/hosts";
 var START_MARKER = "# --- tunl start ---";
 var END_MARKER = "# --- tunl end ---";
-var PID_PATH = join3(homedir2(), ".tunl.pid");
+var PID_PATH = join4(homedir3(), ".tunl.pid");
 function validateSite(site) {
   return /^[a-zA-Z0-9.-]+$/.test(site);
 }
@@ -56712,41 +56836,41 @@ function blockHosts(sites) {
     `:: www.${s}`
   ]).join(`
 `);
-  const currentHosts = readFileSync2(HOSTS_PATH, "utf-8").trimEnd();
+  const currentHosts = readFileSync3(HOSTS_PATH, "utf-8").trimEnd();
   const block = `${currentHosts}
 ${START_MARKER}
 ${entries}
 ${END_MARKER}
 `;
-  const tmpPath = join3(homedir2(), ".tunl-block.tmp");
-  writeFileSync2(tmpPath, block);
-  execSync(`sudo cp "${tmpPath}" ${HOSTS_PATH}`);
-  unlinkSync(tmpPath);
+  const tmpPath = join4(homedir3(), ".tunl-block.tmp");
+  writeFileSync3(tmpPath, block);
+  execSync2(`sudo cp "${tmpPath}" ${HOSTS_PATH}`);
+  unlinkSync2(tmpPath);
 }
 function unblockHosts() {
   try {
-    const hosts = readFileSync2(HOSTS_PATH, "utf-8");
+    const hosts = readFileSync3(HOSTS_PATH, "utf-8");
     const startIdx = hosts.indexOf(START_MARKER);
     const endIdx = hosts.indexOf(END_MARKER);
     if (startIdx === -1 || endIdx === -1)
       return;
     const cleaned = (hosts.slice(0, startIdx) + hosts.slice(endIdx + END_MARKER.length)).trimEnd() + `
 `;
-    const tmpPath = join3(homedir2(), ".tunl-hosts.tmp");
-    writeFileSync2(tmpPath, cleaned);
-    execSync(`sudo cp "${tmpPath}" ${HOSTS_PATH}`);
-    unlinkSync(tmpPath);
+    const tmpPath = join4(homedir3(), ".tunl-hosts.tmp");
+    writeFileSync3(tmpPath, cleaned);
+    execSync2(`sudo cp "${tmpPath}" ${HOSTS_PATH}`);
+    unlinkSync2(tmpPath);
   } catch {}
 }
 function flushDNS() {
   try {
-    execSync("sudo dscacheutil -flushcache 2>/dev/null");
+    execSync2("sudo dscacheutil -flushcache 2>/dev/null");
   } catch {}
   try {
-    execSync("sudo killall -HUP mDNSResponder 2>/dev/null");
+    execSync2("sudo killall -HUP mDNSResponder 2>/dev/null");
   } catch {}
   try {
-    execSync("sudo killall mDNSResponderHelper 2>/dev/null");
+    execSync2("sudo killall mDNSResponderHelper 2>/dev/null");
   } catch {}
 }
 function blockSites(sites) {
@@ -56754,22 +56878,33 @@ function blockSites(sites) {
   const validSites = sites.filter(validateSite);
   if (validSites.length === 0)
     return;
-  writeFileSync2(PID_PATH, String(process.pid));
+  writeFileSync3(PID_PATH, String(process.pid));
+  try {
+    blockPF(validSites);
+  } catch {}
   blockHosts(validSites);
   flushDNS();
 }
 function unblockSites() {
   unblockHosts();
+  try {
+    unblockPF();
+  } catch {}
   flushDNS();
   try {
-    if (existsSync5(PID_PATH))
-      unlinkSync(PID_PATH);
+    if (existsSync6(PID_PATH))
+      unlinkSync2(PID_PATH);
   } catch {}
 }
 function cleanupStaleBlocks() {
-  if (!existsSync5(PID_PATH))
+  if (hasStalePFBlock()) {
+    try {
+      unblockPF();
+    } catch {}
+  }
+  if (!existsSync6(PID_PATH))
     return;
-  const pid = parseInt(readFileSync2(PID_PATH, "utf-8").trim());
+  const pid = parseInt(readFileSync3(PID_PATH, "utf-8").trim());
   try {
     process.kill(pid, 0);
   } catch {
@@ -57167,10 +57302,10 @@ function TimerStatusMessage({
 }
 
 // src/lib/browser-dns.ts
-import { existsSync as existsSync6, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2 } from "fs";
-import { execSync as execSync2 } from "child_process";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3 } from "fs";
+import { execSync as execSync3 } from "child_process";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
 var BROWSERS = [
   "com.google.Chrome",
   "com.google.Chrome.canary",
@@ -57180,19 +57315,73 @@ var BROWSERS = [
   "com.vivaldi.Vivaldi",
   "com.operasoftware.Opera"
 ];
-var DNS_SETUP_FLAG = join4(homedir3(), ".tunl-dns-setup");
+var DNS_SETUP_FLAG = join5(homedir4(), ".tunl-dns-setup");
 function setupBrowserDNS() {
-  if (existsSync6(DNS_SETUP_FLAG))
+  if (existsSync7(DNS_SETUP_FLAG))
     return false;
   for (const bundle of BROWSERS) {
     try {
-      execSync2(`defaults write ${bundle} BuiltInDnsClientEnabled -bool false 2>/dev/null`);
-      execSync2(`defaults write ${bundle} DnsOverHttpsMode -string "off" 2>/dev/null`);
+      execSync3(`defaults write ${bundle} BuiltInDnsClientEnabled -bool false 2>/dev/null`);
+      execSync3(`defaults write ${bundle} DnsOverHttpsMode -string "off" 2>/dev/null`);
     } catch {}
   }
-  writeFileSync3(DNS_SETUP_FLAG, new Date().toISOString());
+  writeFileSync4(DNS_SETUP_FLAG, new Date().toISOString());
   return true;
 }
+function restoreBrowserDNS() {
+  for (const bundle of BROWSERS) {
+    try {
+      execSync3(`defaults delete ${bundle} BuiltInDnsClientEnabled 2>/dev/null`);
+      execSync3(`defaults delete ${bundle} DnsOverHttpsMode 2>/dev/null`);
+    } catch {}
+  }
+  try {
+    unlinkSync3(DNS_SETUP_FLAG);
+  } catch {}
+}
+
+// src/lib/sudo-setup.ts
+import { existsSync as existsSync8, writeFileSync as writeFileSync5 } from "fs";
+import { execSync as execSync4 } from "child_process";
+import { userInfo } from "os";
+function buildRules() {
+  const username = userInfo().username;
+  return [
+    `${username} ALL=(root) NOPASSWD: /bin/cp */.tunl-block.tmp /etc/hosts`,
+    `${username} ALL=(root) NOPASSWD: /bin/cp */.tunl-hosts.tmp /etc/hosts`,
+    `${username} ALL=(root) NOPASSWD: /usr/sbin/dscacheutil -flushcache`,
+    `${username} ALL=(root) NOPASSWD: /usr/bin/killall -HUP mDNSResponder`,
+    `${username} ALL=(root) NOPASSWD: /usr/bin/killall mDNSResponderHelper`,
+    `${username} ALL=(root) NOPASSWD: /sbin/pfctl *`,
+    `${username} ALL=(root) NOPASSWD: /bin/cp */.tunl-pf-anchor.tmp /etc/pf.anchors/tunl`,
+    `${username} ALL=(root) NOPASSWD: /bin/cp */.tunl-pf-empty.tmp /etc/pf.anchors/tunl`,
+    `${username} ALL=(root) NOPASSWD: /bin/cp */.tunl-pf-conf.tmp /etc/pf.conf`
+  ].join(`
+`);
+}
+var SUDOERS_PATH = "/etc/sudoers.d/tunl";
+function sudoersInstalled() {
+  return existsSync8(SUDOERS_PATH);
+}
+function installSudoers() {
+  const rules = buildRules();
+  const content = `# tunl - terminal focus timer
+# allows site blocking without password prompts
+${rules}
+`;
+  const tmpPath = "/tmp/tunl-sudoers";
+  writeFileSync5(tmpPath, content, { mode: 288 });
+  execSync4(`sudo visudo -cf ${tmpPath}`);
+  execSync4(`sudo install -m 0440 ${tmpPath} ${SUDOERS_PATH}`);
+  execSync4(`rm ${tmpPath}`);
+}
+function removeSudoers() {
+  if (existsSync8(SUDOERS_PATH)) {
+    try {
+      execSync4(`sudo rm ${SUDOERS_PATH}`);
+    } catch {}
+  }
+}
 
 // src/utils/args.ts
 function parseArgs(argv) {
@@ -57203,7 +57392,8 @@ function parseArgs(argv) {
     sites: undefined,
     showConfig: false,
     showStats: false,
-    resetConfig: false
+    resetConfig: false,
+    uninstall: false
   };
   for (let i = 0;i < argv.length; i++) {
     const arg = argv[i];
@@ -57224,6 +57414,8 @@ function parseArgs(argv) {
       opts.showStats = true;
     } else if (arg === "--reset") {
       opts.resetConfig = true;
+    } else if (arg === "--uninstall") {
+      opts.uninstall = true;
     } else if (arg === "--help" || arg === "-h") {
       printHelp();
       process.exit(0);
@@ -57244,6 +57436,7 @@ function printHelp() {
     tunl --stats                 Show focus stats and streaks
     tunl --config                Show current saved config
     tunl --reset                 Reset config (re-run onboarding)
+    tunl --uninstall             Remove all tunl system files (sudoers, config, DNS settings)
     tunl --help                  Show this help
 
   Controls:
@@ -57265,7 +57458,11 @@ async function main2() {
     process.exit(0);
   }
   if (args.resetConfig) {
-    await resetConfig();
+    resetConfig();
+    process.exit(0);
+  }
+  if (args.uninstall) {
+    uninstall();
     process.exit(0);
   }
   if (args.sites) {
@@ -57275,34 +57472,24 @@ async function main2() {
 `);
   }
   if (!args.noblock) {
-    const needsRestart = setupBrowserDNS();
-    if (needsRestart) {
+    setupBrowserDNS();
+    if (!sudoersInstalled()) {
       console.log(`
-  \u25C9 tunl \u2014 first-time setup
+  \u25C9 tunl \u2014 setup
 `);
-      console.log("  Disabled browser built-in DNS so site blocking works.");
-      console.log("  Please restart your browser (Chrome/Arc/Edge) for this to take effect.");
-      console.log(`  This only needs to happen once.
+      console.log("  tunl needs to install a passwordless sudo rule so it can");
+      console.log("  block sites without prompting you every time.");
+      console.log(`  You'll enter your password once \u2014 never again after this.
 `);
-    }
-  }
-  if (!args.noblock) {
-    console.log(`
-  \u25C9 tunl \u2014 Terminal Focus Timer
-`);
-    console.log("  tunl needs sudo access to block distracting sites.");
-    console.log(`  You'll be prompted for your password.
-`);
-    try {
-      execSync3("sudo -v", { stdio: "inherit" });
-      console.log(`
-  \u2713 Ready! Entering focus mode...
+      try {
+        installSudoers();
+        console.log(`  \u2713 sudo rule installed. No more password prompts!
 `);
-    } catch {
-      console.log(`
-  \u2715 Could not get sudo access. Running without site blocking.
+      } catch {
+        console.log(`  \u2715 Could not install sudo rule. Running without site blocking.
 `);
-      args.noblock = true;
+        args.noblock = true;
+      }
     }
   }
   const renderer = await createCliRenderer({
@@ -57345,13 +57532,10 @@ function printConfig() {
   console.log(`  First run: ${config.isFirstRun}
 `);
 }
-async function resetConfig() {
-  const { unlinkSync: unlinkSync3, existsSync: existsSync4 } = await import("fs");
-  const { homedir: homedir4 } = await import("os");
-  const { join: join5 } = await import("path");
-  const configPath = join5(homedir4(), ".tunl.json");
-  if (existsSync4(configPath)) {
-    unlinkSync3(configPath);
+function resetConfig() {
+  const configPath = join6(homedir5(), ".tunl.json");
+  if (existsSync9(configPath)) {
+    unlinkSync4(configPath);
     console.log(`
   \u2713 Config reset. Next run will show onboarding.
 `);
@@ -57361,6 +57545,47 @@ async function resetConfig() {
 `);
   }
 }
+function uninstall() {
+  console.log(`
+  \u25C9 tunl \u2014 uninstall
+`);
+  if (sudoersInstalled()) {
+    try {
+      removeSudoers();
+      console.log("  \u2713 Removed sudo rule (/etc/sudoers.d/tunl)");
+    } catch {
+      console.log("  \u2715 Could not remove sudo rule (may need manual sudo)");
+    }
+  } else {
+    console.log("  - No sudo rule found");
+  }
+  const configPath = join6(homedir5(), ".tunl.json");
+  if (existsSync9(configPath)) {
+    unlinkSync4(configPath);
+    console.log("  \u2713 Removed config (~/.tunl.json)");
+  } else {
+    console.log("  - No config found");
+  }
+  const dnsFlag = join6(homedir5(), ".tunl-dns-setup");
+  if (existsSync9(dnsFlag)) {
+    unlinkSync4(dnsFlag);
+    console.log("  \u2713 Removed DNS setup flag");
+  }
+  const pidPath = join6(homedir5(), ".tunl.pid");
+  if (existsSync9(pidPath)) {
+    unlinkSync4(pidPath);
+    console.log("  \u2713 Removed PID file");
+  }
+  try {
+    unblockPF();
+    console.log("  \u2713 Cleaned up firewall rules");
+  } catch {
+    console.log("  - No firewall rules to clean");
+  }
+  restoreBrowserDNS();
+  console.log("  \u2713 Restored browser DNS settings");
+  console.log("\n  All clean. Run `bun remove -g @khemsok/tunl` to finish.\n");
+}
 main2().catch((err) => {
   const renderer = globalThis.__tunl_renderer;
   if (renderer) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@khemsok/tunl",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Terminal focus timer that blocks distracting sites and progressively reveals animated ASCII art",
   "type": "module",
   "bin": {
@@ -12,6 +12,11 @@
   },
   "scripts": {
     "dev": "bun run src/cli.tsx",
+    "dev:noblock": "bun run src/cli.tsx --noblock",
+    "dev:reset": "bun run src/cli.tsx --reset",
+    "dev:stats": "bun run src/cli.tsx --stats",
+    "dev:config": "bun run src/cli.tsx --config",
+    "dev:uninstall": "bun run src/cli.tsx --uninstall",
     "build": "bun build src/cli.tsx --outdir dist --target bun",
     "postinstall": "bun run build"
   },