@lamalibre/create-lamaste 4.3.0 → 4.4.0

package/vendor/server/src/commands/plugins.js

@@ -27,8 +27,9 @@
  *   hooks <name>         The plugin's lifecycle hooks and what needs approval: the relay
  *                        hook set (stages, routes, fail-open hooks, effects), the agent
  *                        half Lamaste installs, the approval digest; agent hooks
- *   approve-hooks <name> --digest <sha256>
- *                        Approve with the approval digest `hooks` shows (or a pending update's)
+ *   approve-hooks <name> --digest <sha256> [--version <v>]
+ *                        Approve with the approval digest `hooks` shows; a pending update with
+ *                        its version too (`--version` alone when it has no digest)
  *   auto-approve <name> on|off
  *                        Approve what this plugin's later versions bring automatically (audited)
  *   update <name> [--version <v>]
@@ -45,6 +46,12 @@
  *                        followed to its end
  *   forget-data <name> --agent <label>
  *                        Drop only the relay's record of it; the data stays on the agent
+ *   settings <name>      An agent-hosted plugin's settings: each field's value (a secret
+ *                        only as set or not), whether it still needs configuration,
+ *                        where the values come from, the hosting
+ *   configure <name> [--set key=value]... [--clear key]... [--secrets-stdin]
+ *                        Change them (kept by its agent half); in a terminal without
+ *                        flags, field by field — a secret never on the command line
  *
  * Every subcommand goes through the running panel (`/api/plugins/*`, admin
  * certificate): the panel owns the plugin registry (SQLite `state.db`), runs
@@ -61,6 +68,14 @@ import { AGENT_LABEL_REGEX } from '@lamalibre/lamaste';
 import { PANEL_SERVICE } from '../config.js';
 import { panelRequest } from '../panel-api.js';
 import { emit, emitStep, emitError, emitComplete, emitLog } from '../ndjson.js';
+import { configureCmd, settingsCmd } from './plugin-settings.js';
+import { settingsDiffLines, terminalText } from '../plugin-settings.js';
+import {
+  APPROVE_HOOKS_USAGE,
+  approveHooksCommand,
+  parseApproveArgs,
+  pendingUpdateReasons,
+} from '../plugin-approval.js';
 
 /** npm runs inside the panel for install and uninstall (its own limit is 120 s). */
 const NPM_CALL_TIMEOUT_MS = 180_000;
@@ -115,6 +130,10 @@ export async function runPlugins(args, { json }) {
       return purgeDataCmd(args.slice(1), { json });
     case 'forget-data':
       return forgetDataCmd(args.slice(1), { json });
+    case 'settings':
+      return settingsCmd(args.slice(1), { json });
+    case 'configure':
+      return configureCmd(args.slice(1), { json });
     default:
       printPluginUsage();
       process.exit(sub ? 1 : 0);
@@ -148,8 +167,9 @@ ${b('Subcommands:')}
   ${c('rotate-hosting-secret <name>')}
                        New installation secret (the agent fetches it on its next sync)
   ${c('hooks <name>')}         Lifecycle hooks and what needs approval: relay hooks, agent half
-  ${c('approve-hooks <name> --digest <sha256>')}
-                       Approve with the approval digest "hooks" showed (or a pending update's)
+  ${c('approve-hooks <name> --digest <sha256> [--version <v>]')}
+                       Approve with the approval digest "hooks" showed; a pending update
+                       with its version too (--version alone when it has no digest)
   ${c('auto-approve <name> on|off')}
                        Approve what this plugin's later versions bring automatically
   ${c('update <name> [--version <v>]')}
@@ -164,6 +184,13 @@ ${b('Subcommands:')}
                        Delete it on the agent — its data directory and account (a push)
   ${c('forget-data <name> --agent <label>')}
                        Drop only the relay's record; the data stays on the agent
+  ${c('settings <name>')}      Settings of an agent-hosted plugin: values (secrets only as set or
+                       not), what is missing, where they come from, the hosting
+  ${c('configure <name> [--set key=value]... [--clear key]... [--secrets-stdin]')}
+                       Change them: --set parses by the field's type (never a secret),
+                       --clear puts a field back to its default or clears a secret,
+                       --secrets-stdin reads {"key": "value" | null} from stdin;
+                       in a terminal without flags, asked field by field
 `);
 }
 
@@ -732,11 +759,14 @@ function printAgentHalf(agentHalf, title) {
 
 /**
  * Print what a version brings that needs approval — the approval digest
- * (the one value `approve-hooks` takes), its relay hook set and the agent
- * half Lamaste installs.
+ * (what `approve-hooks` takes; none for an update that brings neither
+ * relay hooks nor an agent half Lamaste installs), its relay hook set and
+ * the agent half Lamaste installs.
  */
 function printApprovalContents({ digest, relay, agentHalf }) {
-  console.log(`    approval digest: ${chalk.cyan(digest)}`);
+  console.log(
+    `    approval digest: ${digest ? chalk.cyan(digest) : chalk.dim('none — no relay hooks, no agent half Lamaste installs')}`,
+  );
   if (relay) {
     console.log('');
     printRelayHookSet(relay, 'Relay hooks — run in a sandbox on the relay');
@@ -747,9 +777,43 @@ function printApprovalContents({ digest, relay, agentHalf }) {
   }
 }
 
-/** The command that approves `digest` for plugin `name`. */
-function approveCommand(name, digest) {
-  return chalk.cyan(`lamaste-server plugins approve-hooks ${name} --digest ${digest}`);
+/**
+ * Print an update that waits for approval under `title`: why it waits
+ * (`approvalRequired` — a secret turned plain in red), what it brings
+ * (its digest, relay hook set and agent half), how it changes the settings
+ * schema (outside the digest) — fields added and removed with their types,
+ * retyped ones, newly required ones, and a warning for secrets that become
+ * plain values — what auto-approve could not cover beyond the reasons, and
+ * the command that approves it.
+ */
+function printPendingUpdate(name, update, title) {
+  console.log('');
+  console.log(chalk.bold(`  ${title}`));
+  const { required, notCovered } = pendingUpdateReasons(update);
+  for (const line of required) {
+    console.log(line.warning ? chalk.red(`    - ${line.text}`) : `    - ${line.text}`);
+  }
+  console.log('');
+  printApprovalContents(update);
+  const lines = settingsDiffLines(update.settings);
+  if (lines.length > 0) {
+    console.log('');
+    console.log(chalk.bold('  Settings — what this version changes (not part of the digest)'));
+    for (const line of lines) {
+      console.log(`    ${line.warning ? chalk.red(line.text) : line.text}`);
+    }
+  }
+  if (notCovered.length > 0) {
+    console.log('');
+    console.log(chalk.bold('  Auto-approve does not cover it'));
+    for (const reason of notCovered) console.log(chalk.yellow(`    ${reason}`));
+  }
+  console.log(`\n    Approve and update with: ${approveCommand(name, update)}`);
+}
+
+/** The command that approves the installed version (`{ digest }`) or a pending update (`{ digest, version }`). */
+function approveCommand(name, target) {
+  return chalk.cyan(approveHooksCommand(name, target));
 }
 
 /**
@@ -794,7 +858,7 @@ async function hooksCmd(name, { json }) {
       `\n    auto-approve for later versions: ${hooks.autoApprove ? chalk.yellow('on') : 'off'}`,
     );
     if (approval.state !== 'approved') {
-      console.log(`\n    Approve with: ${approveCommand(name, approval.digest)}`);
+      console.log(`\n    Approve with: ${approveCommand(name, { digest: approval.digest })}`);
     }
   }
   if (hooks.agent) {
@@ -805,10 +869,11 @@ async function hooksCmd(name, { json }) {
   }
   if (hooks.pendingUpdate) {
     const update = hooks.pendingUpdate;
-    console.log('');
-    console.log(chalk.bold(`  Update to ${update.version} — waits for approval`));
-    printApprovalContents(update);
-    console.log(`\n    Approve and update with: ${approveCommand(name, update.digest)}`);
+    printPendingUpdate(
+      name,
+      update,
+      `Update to ${terminalText(update.version)} — waits for your approval:`,
+    );
   }
   console.log('');
 }
@@ -819,18 +884,16 @@ async function hooksCmd(name, { json }) {
  * @param {{ json: boolean }} options
  */
 async function approveHooksCmd(name, rest, { json }) {
-  const idx = rest.indexOf('--digest');
-  const digest = idx !== -1 ? rest[idx + 1] : undefined;
-  if (!name || !digest || !/^[a-f0-9]{64}$/.test(digest)) {
-    fail(
-      'Usage: lamaste-server plugins approve-hooks <name> --digest <sha256> (the approval digest `hooks <name>` shows)',
-      json,
-    );
-  }
+  if (!name) fail(APPROVE_HOOKS_USAGE, json);
+  const args = parseApproveArgs(rest);
+  if (args.error) fail(args.error, json);
+  const { digest, version } = args;
   let result;
   try {
+    // A version names the pending update; its digest, when it has one, goes with it.
     result = await panelRequest('POST', `/api/plugins/${encodeURIComponent(name)}/hooks/approve`, {
       digest,
+      ...(version ? { version } : {}),
     });
   } catch (err) {
     // Approving a pending update starts it: its agent half is a push.
@@ -899,10 +962,12 @@ async function updateCmd(name, rest, { json }) {
       return;
     }
     const update = result.pendingUpdate;
+    printPendingUpdate(
+      name,
+      update,
+      `${name} ${terminalText(update.version)} waits for your approval:`,
+    );
     console.log('');
-    console.log(chalk.bold(`  ${name} ${update.version} waits for approval`));
-    printApprovalContents(update);
-    console.log(`\n    Approve and update with: ${approveCommand(name, update.digest)}\n`);
     return;
   }
   if (!json) console.log(`\n  Updating ${chalk.cyan(name)}`);
@@ -1111,7 +1176,9 @@ async function installPluginCmd(packageName, { json }) {
       agentHalf: result.hooks.agentHalf,
     });
     if (approval.state === 'pending') {
-      console.log(`\n    Approve with: ${approveCommand(plugin.name, approval.digest)}`);
+      console.log(
+        `\n    Approve with: ${approveCommand(plugin.name, { digest: approval.digest })}`,
+      );
     }
     console.log('');
   }

package/vendor/server/src/panel-api.js

@@ -4,35 +4,158 @@
  * Used by tunnel/site commands that need the full dependency stack
  * (nginx, certbot, chisel) which lives in the running panel server.
  * Authenticates via the admin mTLS client certificate.
+ *
+ * The panel is verified before anything is sent: the CLI talks to nginx's IP
+ * vhost on loopback only when it should be listening, and checks it presents
+ * the panel's own certificate, read from disk (see `panel-identity.js`) —
+ * port 9292 is one any local user could listen on when nginx does not.
+ *
+ * Nothing secret is ever an argument of curl: other local users can read a
+ * process's command line (`ps`, `/proc/<pid>/cmdline`). The P12 password is
+ * in a private `-K` config file, and a request body — which can carry a
+ * credential, such as the token of `registry-credential set --token-stdin`
+ * — reaches curl on stdin.
  */
 
-import { readFile, writeFile, unlink } from 'node:fs/promises';
-import crypto from 'node:crypto';
+import { rmSync } from 'node:fs';
+import { mkdtemp, open, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { execa } from 'execa';
-import { PKI_DIR } from './config.js';
+import { SETTINGS_KEY_RE } from '@lamalibre/lamaste';
+import { PKI_DIR, readConfig } from './config.js';
+import { PANEL_LOOPBACK, assertPanelListener, readPanelIdentity } from './panel-identity.js';
+
+/**
+ * TLS 1.2 cipher suites the CLI offers: forward-secret ones only. With RSA
+ * key exchange a client sends its certificate before the server has proved
+ * it holds the key of the certificate it presented — and the panel's
+ * certificate is public — so a listener on the panel's port could collect
+ * the admin client certificate from the handshake. With ECDHE (and with
+ * TLS 1.3) the server signs first, and an impostor fails before the client
+ * presents anything. nginx's `HIGH` list offers these suites.
+ */
+const FORWARD_SECRET_CIPHERS = 'ECDHE+AESGCM:ECDHE+CHACHA20';
 
-const PANEL_URL = 'https://127.0.0.1:9292';
+/** The signals that remove a request's private curl config before the CLI dies. */
+const CLEANUP_SIGNALS = ['SIGINT', 'SIGTERM'];
 
 /**
- * The curl argument vector for one panel request. Pure, exported for tests.
+ * One curl config directive, `name = "value"`, with backslashes and double
+ * quotes escaped for curl's quoted values. A value holding a line break or
+ * NUL is refused: curl reads its config line by line, so a line break would
+ * start a directive of the value's choosing. The error never repeats the
+ * value. Pure, exported for tests.
+ *
+ * @param {string} name
+ * @param {string} value
+ * @returns {string}
+ */
+export function curlConfigLine(name, value) {
+  if (/[\r\n\0]/.test(value)) {
+    throw new Error(`The curl config value of "${name}" contains a line break or NUL`);
+  }
+  return `${name} = "${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"\n`;
+}
+
+/**
+ * Run `fn` with the path of a curl config file holding `content`. The file
+ * is created exclusively (`wx`, 0600) in a fresh private directory
+ * (`mkdtemp`, 0700): the CLI runs as root and the shared temporary
+ * directory belongs to every local user, none of whom may read the file or
+ * put a file or a link at its path first. The directory is removed on every
+ * path — also when the CLI is interrupted (Ctrl-C) or terminated while the
+ * request runs: SIGINT and SIGTERM handlers, installed for exactly that long,
+ * remove it and then let the signal end the process as it would have
+ * (status 130 / 143 to the shell). The CLI has no other use for them.
+ *
+ * @template T
+ * @param {string} content
+ * @param {(configPath: string) => Promise<T>} fn
+ * @returns {Promise<T>}
+ */
+export async function withCurlConfig(content, fn) {
+  /** @type {string | undefined} */
+  let dir;
+  const onSignal = (signal) => {
+    if (dir !== undefined) {
+      try {
+        rmSync(dir, { recursive: true, force: true });
+      } catch {
+        // Nothing more can be done on the way out.
+      }
+    }
+    for (const sig of CLEANUP_SIGNALS) process.off(sig, onSignal);
+    // Without listeners the signal's default action applies again: re-raised,
+    // it ends the process. (A listener still installed — execa's, killing
+    // curl — re-raises it in turn once it is the last one.)
+    process.kill(process.pid, signal);
+  };
+  for (const sig of CLEANUP_SIGNALS) process.on(sig, onSignal);
+  try {
+    dir = await mkdtemp(join(tmpdir(), 'lamalibre-lamaste-curl-'));
+    const configPath = join(dir, 'curl.conf');
+    const fh = await open(configPath, 'wx', 0o600);
+    try {
+      await fh.writeFile(content, 'utf-8');
+    } finally {
+      await fh.close();
+    }
+    return await fn(configPath);
+  } finally {
+    for (const sig of CLEANUP_SIGNALS) process.off(sig, onSignal);
+    if (dir !== undefined) await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * The curl invocation for one panel request: its argument vector, and the
+ * JSON body curl reads on stdin (`--data-binary @-`; `undefined` without a
+ * body). The body is never an argument. Pure, exported for tests.
+ *
+ * The panel is verified as `identity` says (`readPanelIdentity`): curl
+ * trusts nothing but its certificate (`--cacert`), checks it is issued for
+ * the address in the request's URL, and connects to that address on
+ * loopback (`--connect-to`) — the certificate names the server's public
+ * address, and the CLI never leaves the machine. curl reads no `.curlrc`
+ * (`-q`, which must come first), which could switch verification off, and
+ * uses no proxy. Never `-k`.
  *
  * The JSON content type and the body travel together: a `Content-Type:
  * application/json` header on a body-less DELETE made Fastify answer 400
  * ("Body cannot be empty when content-type is set"), so `registry-credential
  * clear`, `tunnels delete` and `sites delete` never reached their routes.
  *
- * @param {{ method: string, path: string, body?: Record<string, unknown> | null, p12Path: string, configPath: string }} request
- * @returns {string[]}
+ * @param {{ identity: { certPath: string, address: string, port: number }, method: string, path: string, body?: Record<string, unknown> | null, p12Path: string, configPath: string }} request
+ * @returns {{ args: string[], input: string | undefined }}
  */
-export function buildPanelCurlArgs({ method, path, body = null, p12Path, configPath }) {
+export function buildPanelCurlRequest({
+  identity,
+  method,
+  path,
+  body = null,
+  p12Path,
+  configPath,
+}) {
+  const { certPath, address, port } = identity;
   const args = [
+    '-q', // No .curlrc — it must be the first argument
     '-K',
     configPath,
     '--cert-type',
     'P12',
     '--cert',
     p12Path,
-    '-k', // Server uses self-signed cert on localhost
+    '--cacert',
+    certPath,
+    '--connect-to',
+    `${address}:${port}:${PANEL_LOOPBACK}:${port}`,
+    '--ciphers',
+    FORWARD_SECRET_CIPHERS,
+    '--proto',
+    '=https',
+    '--noproxy',
+    '*',
     '-s', // Silent
     '-S', // Show errors
     '-X',
@@ -40,13 +163,66 @@ export function buildPanelCurlArgs({ method, path, body = null, p12Path, configP
     '-H',
     'Accept: application/json',
   ];
+  let input;
   if (body !== null && body !== undefined) {
-    args.push('-H', 'Content-Type: application/json', '-d', JSON.stringify(body));
+    args.push('-H', 'Content-Type: application/json', '--data-binary', '@-');
+    input = JSON.stringify(body);
   }
   // Append the HTTP status on its own line so an error response is not
   // mistaken for a result — the panel answers errors with a JSON body.
-  args.push('-w', '\n%{http_code}', `${PANEL_URL}${path}`);
-  return args;
+  args.push('-w', '\n%{http_code}', `https://${address}:${port}${path}`);
+  return { args, input };
+}
+
+/**
+ * The error for a curl run that did not complete, saying what went wrong in
+ * the panel's terms: curl's own last line, never its command line. Pure,
+ * exported for tests.
+ *
+ * @param {{ exitCode?: number, stderr?: string, timedOut?: boolean, code?: string }} failure
+ * @param {{ certPath: string, port: number }} identity
+ * @param {{ p12Path: string, timeoutMs: number }} request
+ * @returns {Error}
+ */
+export function curlFailure(failure, identity, { p12Path, timeoutMs }) {
+  const reason =
+    String(failure.stderr ?? '')
+      .split('\n')
+      .map((line) => line.trim())
+      .filter(Boolean)
+      .pop() ?? '';
+  const listener = `${PANEL_LOOPBACK}:${identity.port}`;
+  let message;
+  if (failure.timedOut) {
+    message = `The panel did not answer within ${Math.round(timeoutMs / 1000)} s`;
+  } else if (failure.code === 'ENOENT') {
+    message = 'curl is not installed';
+  } else {
+    switch (failure.exitCode) {
+      case 7:
+        message = `Nothing listens on ${listener} — is nginx running? (systemctl status nginx)`;
+        break;
+      // The TLS handshake failed: certificate not trusted, issued for another
+      // address, another key — or no suite in common with an impostor.
+      case 35:
+      case 51:
+      case 60:
+      case 90:
+        message =
+          `The listener on ${listener} did not prove it is the panel: it must present ` +
+          `${identity.certPath}. Nothing was sent to it. If the certificate was regenerated, ` +
+          `reload nginx (systemctl reload nginx).`;
+        break;
+      case 58:
+        message = `curl could not use the admin client certificate ${p12Path}`;
+        break;
+      default:
+        message = `curl failed${failure.exitCode === undefined ? '' : ` (exit ${failure.exitCode})`}`;
+    }
+  }
+  const err = new Error(reason ? `${message} (${reason})` : message);
+  if (typeof failure.exitCode === 'number') err.curlExitCode = failure.exitCode;
+  return err;
 }
 
 /**
@@ -69,12 +245,31 @@ function detailsText(details) {
   return [...new Set(found)].join('; ');
 }
 
+/**
+ * The per-field messages of a refused settings change (`errors`: a setting
+ * key, or `_` for the change as a whole, to a message), or null when the
+ * panel sent none. Only string messages under a key a setting can have are
+ * kept — the panel's and the agent half's messages never contain a value.
+ *
+ * @param {unknown} errors
+ * @returns {Record<string, string> | null}
+ */
+function settingsErrors(errors) {
+  if (errors === null || typeof errors !== 'object' || Array.isArray(errors)) return null;
+  const kept = Object.entries(errors).filter(
+    ([key, message]) => (key === '_' || SETTINGS_KEY_RE.test(key)) && typeof message === 'string',
+  );
+  return kept.length > 0 ? Object.fromEntries(kept) : null;
+}
+
 /**
  * Split curl's output (`<payload>\n<status>`) and turn a non-2xx status
  * into an error carrying the panel's `error` (and `details`) in its message,
  * the status as `statusCode`, and what a caller acts on beyond the message
- * when the panel sent it: `code` (e.g. `agent_not_eligible`), `reasons` and
- * a running operation's `operationId`. Pure, exported for tests.
+ * when the panel sent it: `code` (e.g. `agent_not_eligible`), `reasons`, a
+ * running operation's `operationId`, and for a refused settings change its
+ * per-field `errors`, the current `revision` (`revision_mismatch`) and the
+ * `hosting` (`hosting_offline`). Pure, exported for tests.
  *
  * @param {string} stdout
  * @param {string} method
@@ -107,20 +302,75 @@ export function parsePanelResponse(stdout, method, path) {
       err.reasons = parsed.reasons.filter((r) => typeof r === 'string');
     }
     if (typeof parsed.operationId === 'string') err.operationId = parsed.operationId;
+    const errors = settingsErrors(parsed.errors);
+    if (errors) err.errors = errors;
+    if (Number.isSafeInteger(parsed.revision) && parsed.revision >= 0) {
+      err.revision = parsed.revision;
+    }
+    if (
+      parsed.hosting === null ||
+      (typeof parsed.hosting === 'object' && !Array.isArray(parsed.hosting))
+    ) {
+      err.hosting = parsed.hosting;
+    }
     throw err;
   }
 
   return parsed;
 }
 
+/**
+ * Send one request to the panel with curl: the panel verified as
+ * `identity` says, the client certificate, its password in a private `-K`
+ * config file, and the body on stdin. Resolves and rejects as
+ * `panelRequest` does. `identity` is `readPanelIdentity()`'s (tests
+ * describe a local server).
+ *
+ * @param {{ identity: { certPath: string, address: string, port: number }, method: string, path: string, body?: Record<string, unknown> | null, p12Path: string, p12Password: string, timeoutMs?: number }} request
+ * @returns {Promise<Record<string, unknown>>}
+ */
+export async function curlPanelRequest({
+  identity,
+  method,
+  path,
+  body = null,
+  p12Path,
+  p12Password,
+  timeoutMs = 30000,
+}) {
+  return withCurlConfig(curlConfigLine('pass', p12Password), async (configPath) => {
+    const { args, input } = buildPanelCurlRequest({
+      identity,
+      method,
+      path,
+      body,
+      p12Path,
+      configPath,
+    });
+    const result = await execa('curl', args, {
+      timeout: timeoutMs,
+      reject: false,
+      ...(input === undefined ? {} : { input }),
+    });
+    if (result.failed) {
+      throw curlFailure(result, identity, { p12Path, timeoutMs });
+    }
+    return parsePanelResponse(result.stdout, method, path);
+  });
+}
+
 /**
  * Make an authenticated API request to the local panel server.
  *
- * Uses curl with the admin client certificate (mTLS) and a temporary
- * config file for the P12 password (never in process args). Resolves with
- * the JSON body; rejects with an Error (`statusCode`, the panel's `error`
- * in the message, a refusal's `code`, `reasons` and `operationId`) for any
- * non-2xx answer.
+ * Refuses before connecting when nginx does not listen on the panel's port
+ * (panel 2FA on, IP vhost off), and verifies the listener against the
+ * panel's certificate (see the top of this file). Uses curl with the admin
+ * client certificate (mTLS); neither the P12 password nor the body is ever
+ * in curl's arguments. Resolves with the JSON body; rejects with an Error
+ * (`statusCode`, the panel's `error` in the message, a refusal's `code`,
+ * `reasons` and `operationId`, a refused settings change's `errors`,
+ * `revision` and `hosting`) for any non-2xx answer, and with one that says
+ * why when the request could not be made.
  *
  * @param {string} method
  * @param {string} path  e.g. '/api/tunnels'
@@ -130,6 +380,17 @@ export function parsePanelResponse(stdout, method, path) {
  * @returns {Promise<Record<string, unknown>>}
  */
 export async function panelRequest(method, path, body = null, { timeoutMs = 30000 } = {}) {
+  let config;
+  try {
+    config = await readConfig();
+  } catch {
+    throw new Error(
+      'Cannot read panel.json. Ensure the server is properly installed and /etc/lamalibre/lamaste/panel.json exists.',
+    );
+  }
+  await assertPanelListener(config);
+  const identity = await readPanelIdentity();
+
   const p12Path = `${PKI_DIR}/client.p12`;
 
   // Read p12 password from the stored file
@@ -142,19 +403,5 @@ export async function panelRequest(method, path, body = null, { timeoutMs = 3000
     );
   }
 
-  // Write password to a temporary config file (never in process args)
-  const tmpConfigPath = `/tmp/lamalibre-lamaste-curl-${crypto.randomBytes(8).toString('hex')}`;
-  try {
-    await writeFile(tmpConfigPath, `--pass "${p12Password}"\n`, { mode: 0o600 });
-
-    const { stdout } = await execa(
-      'curl',
-      buildPanelCurlArgs({ method, path, body, p12Path, configPath: tmpConfigPath }),
-      { timeout: timeoutMs },
-    );
-
-    return parsePanelResponse(stdout, method, path);
-  } finally {
-    await unlink(tmpConfigPath).catch(() => {});
-  }
+  return curlPanelRequest({ identity, method, path, body, p12Path, p12Password, timeoutMs });
 }