@logicseek/hello-cc 0.1.8 → 1.0.0

package/lib/web/runtime.mjs

@@ -1,19 +1,21 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import https from 'node:https';
 import process from 'node:process';
 import { randomBytes } from 'node:crypto';
 import { intOpt } from '../cli-args.mjs';
+import { withRuntimeApiVersionHeader } from './api-version.mjs';
 import { CliError } from '../shared/errors.mjs';
 import { sanitizePeerPart } from '../core/peers/format.mjs';
-import { globalWebTokenPath } from '../runtime/paths.mjs';
+import { globalStateDir } from '../runtime/paths.mjs';
 
 export function runtimeConnectHost(host) {
   if (host === '0.0.0.0' || host === '::') return '127.0.0.1';
   return host;
 }
 
-export function runtimeBaseUrl(host, port) {
-  return `http://${runtimeConnectHost(host)}:${port}`;
+export function runtimeBaseUrl(host, port, tls = false) {
+  return `${tls ? 'https' : 'http'}://${runtimeConnectHost(host)}:${port}`;
 }
 
 export function runtimeApiUrl(runtime, route) {
@@ -81,31 +83,87 @@ export function publicRuntimeUrl(runtime, projectRoot = null) {
   const host = runtime.host === '0.0.0.0' || runtime.host === '::'
     ? '<machine-ip>'
     : runtime.host || runtimeConnectHost(runtime.host || '127.0.0.1');
-  return `http://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
+  const scheme = runtime.tls ? 'https' : 'http';
+  return `${scheme}://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
 }
 
 export function localRuntimeUrl(runtime, projectRoot = null) {
   const host = runtimeConnectHost(runtime.host || '127.0.0.1');
-  return `http://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
-}
-
-export function readStoredWebToken() {
-  const file = globalWebTokenPath();
-  if (!fs.existsSync(file)) return '';
-  try {
-    return fs.readFileSync(file, 'utf8').trim();
-  } catch {
-    return '';
+  const scheme = runtime.tls ? 'https' : 'http';
+  return `${scheme}://${host}:${runtime.port}/${runtimeUrlQuery(runtime, projectRoot)}`;
+}
+
+// Issue a request to a runtime API route. Returns { ok, status, text }.
+// Plaintext: the global fetch (mockable, no CA needed). TLS: the node https
+// client with a CA agent so the CLI can trust its own self-signed cert (global
+// fetch cannot take a per-call CA without undici's Agent). TLS sockets are not
+// pooled so the CLI process can exit promptly.
+// Both transports must serialize the request body identically: the global
+// fetch rejects object bodies while https.request needs a string/buffer, so
+// normalize once up front instead of letting the branches diverge.
+export function normalizeRequestBody(body) {
+  if (body === null || body === undefined) return null;
+  return typeof body === 'string' ? body : JSON.stringify(body);
+}
+
+export async function runtimeHttpRequest(rt, route, { method = 'GET', headers = {}, body = null, timeoutMs = 8000, signal } = {}) {
+  const url = runtimeApiUrl(rt, route);
+  const requestBody = normalizeRequestBody(body);
+  const requestHeaders = withRuntimeApiVersionHeader(headers);
+  if (url.protocol !== 'https:') {
+    // xx-03: the plaintext branch must respect the deadline too — a stalled
+    // runtime must not hang the CLI forever. Combine the caller signal with a
+    // hard timeout.
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const combinedSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+    const response = await fetch(url, {
+      method,
+      headers: requestHeaders,
+      body: requestBody === null ? undefined : requestBody,
+      signal: combinedSignal
+    });
+    return { ok: response.ok, status: response.status, text: await response.text() };
   }
-}
-
-export function writeStoredWebToken(token) {
-  if (!token) return '';
-  const file = globalWebTokenPath();
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, `${token}\n`, { mode: 0o600 });
-  fs.chmodSync(file, 0o600);
-  return file;
+  const tlsCa = rt?.tls_ca || rt?.tls_cert || (rt?.tls_ca_file
+    ? fs.readFileSync(rt.tls_ca_file, 'utf8')
+    : null);
+  const agent = new https.Agent({
+    ...(tlsCa ? { ca: tlsCa } : {}),
+    rejectUnauthorized: true,
+    keepAlive: false
+  });
+  const options = {
+    method,
+    hostname: url.hostname,
+    port: url.port || 443,
+    path: url.pathname + url.search,
+    headers: requestHeaders,
+    agent,
+    signal
+  };
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const cleanup = () => { try { agent.destroy(); } catch {} };
+    const done = (fn, value) => { if (settled) return; settled = true; cleanup(); clearTimeout(deadline); fn(value); };
+    // CLIENT-2: absolute wall-clock deadline (not just socket-idle) so a
+    // slow-drip response body cannot hold the promise open forever.
+    const deadline = setTimeout(() => done(reject, new Error('runtime request timeout')), timeoutMs);
+    const req = https.request(options, (res) => {
+      let text = '';
+      res.setEncoding('utf8');
+      res.on('data', (chunk) => { text += chunk; });
+      res.on('end', () => {
+        done(resolve, { ok: res.statusCode >= 200 && res.statusCode < 300, status: res.statusCode, text });
+      });
+      // CLIENT-2: a connection that errors mid-body must settle the promise.
+      res.on('error', (err) => done(reject, err));
+      res.on('aborted', () => done(reject, new Error('runtime response aborted')));
+    });
+    req.on('error', (err) => done(reject, err));
+    req.setTimeout(timeoutMs, () => done(reject, new Error('runtime request timeout')));
+    if (requestBody !== null) req.write(requestBody);
+    req.end();
+  });
 }
 
 export function validateWebTokenOpts(opts) {
@@ -118,15 +176,8 @@ export function makeWebToken(opts) {
   validateWebTokenOpts(opts);
   if (opts['no-token']) return '';
   const explicitToken = opts.token || process.env.HCC_WEB_TOKEN || '';
-  if (explicitToken) {
-    writeStoredWebToken(explicitToken);
-    return explicitToken;
-  }
-  const stored = readStoredWebToken();
-  if (stored) return stored;
-  const generated = randomBytes(24).toString('base64url');
-  writeStoredWebToken(generated);
-  return generated;
+  if (explicitToken) return explicitToken;
+  return randomBytes(24).toString('base64url');
 }
 
 export function expectedWebHost(opts) {
@@ -136,6 +187,12 @@ export function expectedWebHost(opts) {
 export function webRuntimeMatchesRequest(runtime, opts) {
   if (!runtime) return false;
   if (opts['no-token'] && (opts.token || process.env.HCC_WEB_TOKEN)) return false;
+  const runtimeTls = runtime.tls === undefined
+    ? /^https:/i.test(String(runtime.base_url || ''))
+    : Boolean(runtime.tls);
+  if (runtimeTls !== Boolean(opts.tls)) return false;
+  if (Boolean(runtime.trust_proxy) !== Boolean(opts['trust-proxy'])) return false;
+  if ((runtime.proxy_origin || '') !== (opts['proxy-origin'] || '')) return false;
   const expectedHost = expectedWebHost(opts);
   if (runtime.host !== expectedHost) return false;
   const expectedPort = intOpt(opts, 'port', 8787);
@@ -147,8 +204,6 @@ export function webRuntimeMatchesRequest(runtime, opts) {
 }
 
 export function rememberRuntimeToken(runtime, opts) {
-  if (!runtime?.token || opts['no-token']) return;
-  const explicitToken = opts.token || process.env.HCC_WEB_TOKEN || '';
-  if (explicitToken && runtime.token !== explicitToken) return;
-  writeStoredWebToken(runtime.token);
+  // Generated tokens live only in the runtime pointer. Keeping this no-op
+  // compatibility export avoids reintroducing a long-lived bearer credential.
 }

package/lib/web/startup.mjs

@@ -0,0 +1,333 @@
+// Web startup helpers extracted from bin/hcc.mjs.
+// hcc web process matching, orphan runtime reaping, exposure/token checks,
+// background child launch, readiness polling, and runtime banner printing.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { URL } from 'node:url';
+import { spawn, spawnSync } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { CliError } from '../shared/errors.mjs';
+import { redactCliArgs } from '../shared/redact.mjs';
+import { intOpt, parseOpts, splitGlobalArgs, validateOpts } from '../cli-args.mjs';
+import { printResult } from '../format.mjs';
+import { commandPath, tailFile } from '../cli-runtime.mjs';
+import { registerProject } from '../runtime/projects.mjs';
+import { runtimePath, globalRuntimePath, webLogPath } from '../runtime/paths.mjs';
+import { readHealthyGlobalRuntime, writeRuntime } from '../runtime/state.mjs';
+import { runtimeRequest } from '../runtime/client.mjs';
+import {
+  expectedWebHost,
+  isLoopbackHost,
+  localRuntimeUrl,
+  publicRuntimeUrl,
+  rememberRuntimeToken,
+  validateWebTokenOpts,
+  webRuntimeMatchesRequest
+} from '../web/runtime.mjs';
+import { requestOriginMatches } from '../web/http.mjs';
+import { WEB_CHILD_ENV } from '../core/sessions/launch.mjs';
+import { API_VERSION } from '../web/api-version.mjs';
+import { ensureTmuxAvailable } from '../tmux.mjs';
+
+export function createWebStartup(deps) {
+  const {
+    splitProcessArgs, sameResolvedPath,
+    redactedLogText, CLI_NAME, PRODUCT_NAME, now,
+    prepareLocalBus
+  } = deps;
+
+function hccWebProcessMatches(line, ctx) {
+  const args = splitProcessArgs(line);
+  const hccIndex = args.findIndex((arg) => sameResolvedPath(arg, commandPath()) || arg.endsWith('/hcc.mjs'));
+  if (hccIndex < 0) return false;
+  const hccArgs = args.slice(hccIndex + 1);
+  const { global, rest } = splitGlobalArgs(hccArgs);
+  if (rest[0] !== 'web') return false;
+  return sameResolvedPath(global.root, ctx.root) ||
+    sameResolvedPath(global.db, ctx.dbPath);
+}
+
+function currentProcessAncestorPids(ppidByPid) {
+  const ancestors = new Set();
+  let pid = process.ppid;
+  while (Number.isFinite(pid) && pid > 0 && !ancestors.has(pid)) {
+    ancestors.add(pid);
+    pid = ppidByPid.get(pid);
+  }
+  return ancestors;
+}
+
+async function stopOrphanWebRuntimes(ctx, keepPid = null) {
+  if (process.platform === 'win32') return;
+  let output = '';
+  try {
+    output = spawnSync('ps', ['-eo', 'pid=,ppid=,args='], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore']
+    }).stdout || '';
+  } catch {
+    return;
+  }
+
+  const rows = [];
+  const ppidByPid = new Map();
+  for (const line of output.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const match = trimmed.match(/^(\d+)\s+(\d+)\s+(.*)$/);
+    if (!match) continue;
+    const pid = Number.parseInt(match[1], 10);
+    const ppid = Number.parseInt(match[2], 10);
+    if (!Number.isFinite(pid)) continue;
+    if (Number.isFinite(ppid)) ppidByPid.set(pid, ppid);
+    rows.push({ pid, args: match[3] });
+  }
+
+  const ancestorPids = currentProcessAncestorPids(ppidByPid);
+  const pids = [];
+  for (const row of rows) {
+    if (row.pid === process.pid || row.pid === keepPid || ancestorPids.has(row.pid)) continue;
+    if (hccWebProcessMatches(row.args, ctx)) pids.push(row.pid);
+  }
+  if (!pids.length) return;
+
+  for (const pid of pids) {
+    try { process.kill(pid, 'SIGTERM'); } catch {}
+  }
+  await sleep(250);
+  for (const pid of pids) {
+    try {
+      process.kill(pid, 0);
+      process.kill(pid, 'SIGKILL');
+    } catch {}
+  }
+}
+
+function assertWebTokenForHost(host, hasToken) {
+  if (!isLoopbackHost(host) && !hasToken) {
+    throw new CliError('WEB_EXPOSED_WITHOUT_TOKEN',
+      `Refusing to expose the web console on ${host} without a token. A tokenless ` +
+      `terminal on a non-loopback address lets anyone on the network run commands as you. ` +
+      `Use --local to bind loopback only, or drop --no-token so a token is required.`);
+  }
+}
+
+function webExposureWarning(host, port) {
+  return `WARNING: hello-cc web is bound to ${host}:${port}, exposing a writable terminal ` +
+    `(remote code execution surface) to your network. Anyone who reaches this port with the ` +
+    `token can run commands as you. Prefer '--local' + 'ssh -L ${port}:127.0.0.1:${port}', ` +
+    `or put it behind a TLS reverse proxy.`;
+}
+
+// Same-origin check for the WebSocket terminal upgrade. Browsers always send an
+// Origin header on WebSocket handshakes, so a cross-site page attempting a
+// cross-site WebSocket hijack (CSWSH) is rejected. Non-browser clients (the CLI,
+// the `ws` library, regression tests) send no Origin and are allowed through to
+// the token gate.
+function webSocketOriginAllowed(req, options = {}) {
+  const origin = req.headers.origin;
+  if (!origin) return true;
+  return requestOriginMatches(req, options);
+}
+
+function proxyOriginForOpts(opts) {
+  const trustProxy = Boolean(opts['trust-proxy']);
+  const value = String(opts['proxy-origin'] || '');
+  if (!trustProxy && value) throw new CliError('BAD_ARGS', '--proxy-origin requires --trust-proxy');
+  if (!trustProxy) return '';
+  if (!value) throw new CliError('BAD_ARGS', '--trust-proxy requires --proxy-origin');
+  try {
+    const parsed = new URL(value);
+    if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password ||
+        parsed.pathname !== '/' || parsed.search || parsed.hash) throw new Error('invalid origin');
+    return parsed.origin;
+  } catch {
+    throw new CliError('BAD_ARGS', '--proxy-origin must be an http(s) origin without a path, query, or credentials');
+  }
+}
+
+async function startWebBackground(ctx, args) {
+  const opts = parseOpts(args, { booleans: ['local', 'no-token', 'no-guidance', 'no-discover', 'tls', 'trust-proxy'] });
+  validateOpts('web', opts, ['host', 'port', 'token', 'local', 'no-token', 'no-guidance', 'no-discover', 'tls', 'trust-proxy', 'proxy-origin']);
+  const requestedProxyOrigin = proxyOriginForOpts(opts);
+  if (requestedProxyOrigin) opts['proxy-origin'] = requestedProxyOrigin;
+  validateWebTokenOpts(opts);
+  const requestedHost = expectedWebHost(opts);
+  assertWebTokenForHost(requestedHost, !opts['no-token']);
+  if (!isLoopbackHost(requestedHost)) console.error(redactedLogText(webExposureWarning(requestedHost, intOpt(opts, 'port', 8787)) + (opts.tls ? '' : ' Consider --tls to encrypt this connection.')));
+  ensureTmuxAvailable({ autoInstall: true });
+  const setup = await prepareLocalBus(ctx, {
+    ...opts,
+    installShims: process.env.HCC_SKIP_SHIM_INSTALL === '1' ? false : true
+  });
+  registerProject(ctx);
+
+  const existing = await readHealthyGlobalRuntime();
+  if (existing) {
+    if (webRuntimeMatchesRequest(existing, opts)) {
+      await stopOrphanWebRuntimes(ctx, existing.pid || null);
+      rememberRuntimeToken(existing, opts);
+      try {
+        await runtimeRequest(ctx, 'POST', '/api/projects', { root: ctx.root, db: ctx.dbPath }, existing);
+      } catch {}
+      writeRuntime(ctx, {
+        ...existing,
+        api_version: API_VERSION,
+        root: ctx.root,
+        db: ctx.dbPath,
+        project_root: ctx.root,
+        global_runtime: true
+      });
+      return printWebRuntime(ctx, existing, { already: true, logFile: webLogPath(ctx), setup });
+    }
+    // TLS-2: an idempotent `hcc web` must not silently stop a TLS runtime and
+    // downgrade to plaintext (or vice versa) when only --tls/--trust-proxy
+    // differ. Refuse loudly instead; host/port/token mismatches below still
+    // take the normal stop-and-restart path (legitimate reconfiguration).
+    const runtimeTls = existing.tls === undefined
+      ? /^https:/i.test(String(existing.base_url || ''))
+      : Boolean(existing.tls);
+    if (runtimeTls !== Boolean(opts.tls) ||
+        Boolean(existing.trust_proxy) !== Boolean(opts['trust-proxy']) ||
+        (existing.proxy_origin || '') !== (opts['proxy-origin'] || '')) {
+      throw new CliError('RUNTIME_CONFIG_CONFLICT',
+        `A ${runtimeTls ? 'TLS' : 'plaintext'} web runtime is already running${existing.trust_proxy ? ' with --trust-proxy' : ''} on port ${existing.port}. ` +
+        `Run ${CLI_NAME} down first, or re-run with matching flags (${opts.tls ? '--tls' : 'no --tls'}${opts['trust-proxy'] ? ', --trust-proxy' : ''}).`);
+    }
+    try { await runtimeRequest(ctx, 'POST', '/api/runtime/stop', {}, existing); } catch {}
+    await sleep(250);
+  }
+  await stopOrphanWebRuntimes(ctx);
+
+  try { fs.rmSync(runtimePath(ctx), { force: true }); } catch {}
+  try { fs.rmSync(globalRuntimePath(), { force: true }); } catch {}
+
+  const logFile = webLogPath(ctx);
+  fs.mkdirSync(path.dirname(logFile), { recursive: true });
+  // bg-05: rotate web.log once it grows past 5 MB (keep the previous .1).
+  try {
+    if (fs.statSync(logFile).size > 5 * 1024 * 1024) {
+      try { fs.rmSync(`${logFile}.1`, { force: true }); } catch {}
+      try { fs.renameSync(logFile, `${logFile}.1`); } catch {}
+    }
+  } catch {}
+  const redactedStart = redactedLogText(`${CLI_NAME} web ${redactCliArgs(args).join(' ')}`);
+  fs.appendFileSync(logFile, `\n[${new Date().toISOString()}] ${redactedStart}\n`, { mode: 0o600 });
+  // The runtime echoes token-bearing URLs into web.log; keep it owner-only so a
+  // co-tenant on the machine cannot read the token (net-02).
+  try { fs.chmodSync(logFile, 0o600); } catch {}
+  const logFd = fs.openSync(logFile, 'a');
+
+  const childArgs = [
+    commandPath(),
+    '--root', ctx.root,
+    '--db', ctx.dbPath,
+    'web',
+    ...args
+  ];
+  const childEnv = {
+    ...process.env,
+    [WEB_CHILD_ENV]: '1',
+    HCC_ROOT: ctx.root,
+    HCC_DB: ctx.dbPath
+  };
+
+  let child;
+  try {
+    child = spawn(process.execPath, childArgs, {
+      cwd: ctx.cwd,
+      env: childEnv,
+      detached: true,
+      stdio: ['ignore', logFd, logFd]
+    });
+  } finally {
+    try { fs.closeSync(logFd); } catch {}
+  }
+
+  const runtime = await waitForStartedRuntime(ctx, child, logFile);
+  child.unref();
+  return printWebRuntime(ctx, runtime, { already: false, logFile, setup });
+}
+
+async function waitForStartedRuntime(ctx, child, logFile) {
+  let exitInfo = null;
+  child.once('exit', (code, signal) => {
+    exitInfo = { code, signal };
+  });
+
+  const deadline = Date.now() + 15000;
+  while (Date.now() < deadline) {
+    const runtime = await readHealthyGlobalRuntime();
+    if (runtime) return runtime;
+    if (exitInfo) {
+      const detail = redactedLogText(tailFile(logFile));
+      throw new CliError('RUNTIME_START_FAILED',
+        `${PRODUCT_NAME} runtime exited before it became healthy` +
+        ` (code=${exitInfo.code ?? ''}${exitInfo.signal ? ` signal=${exitInfo.signal}` : ''}).` +
+        `${detail ? `\n\nLast log lines:\n${detail}` : ''}`,
+        { log: logFile });
+    }
+    await sleep(150);
+  }
+
+  try {
+    if (process.platform === 'win32') process.kill(child.pid, 'SIGTERM');
+    else process.kill(-child.pid, 'SIGTERM');
+  } catch {}
+  const detail = redactedLogText(tailFile(logFile));
+  throw new CliError('RUNTIME_START_TIMEOUT',
+    `${PRODUCT_NAME} runtime did not become healthy within 15s.` +
+    `${detail ? `\n\nLast log lines:\n${detail}` : ''}`,
+    { log: logFile });
+}
+
+function printWebRuntime(ctx, runtime, opts = {}) {
+  const logFile = opts.logFile || webLogPath(ctx);
+  const data = {
+    status: opts.already ? 'already_running' : 'started',
+    pid: runtime.pid || null,
+    root: ctx.root,
+    db: ctx.dbPath,
+    host: runtime.host || null,
+    port: runtime.port || null,
+    url: publicRuntimeUrl(runtime, ctx.root),
+    local_url: localRuntimeUrl(runtime, ctx.root),
+    runtime: runtimePath(ctx),
+    log: logFile,
+    stop: `${CLI_NAME} down`
+  };
+  return printResult(ctx, data, (r) => {
+    const lines = [
+      opts.already
+        ? `${PRODUCT_NAME} web already running in background`
+        : `${PRODUCT_NAME} web started in background`,
+      `pid: ${r.pid}`,
+      `project: ${r.root}`,
+      `database: ${r.db}`,
+      `runtime: ${r.runtime}`,
+      `log: ${r.log}`,
+      `open: ${r.url}`
+    ];
+    if (r.local_url !== r.url) lines.push(`local: ${r.local_url}`);
+    if (opts.setup?.shims?.installed?.length) {
+      lines.push(`shims: installed ${opts.setup.shims.installed.map((p) => path.basename(p)).join(', ')}`);
+      if (opts.setup.shims.pathUpdated && opts.setup.shims.rcFile) {
+        lines.push(`PATH updated in ${opts.setup.shims.rcFile}; open a new terminal or source it`);
+      }
+    }
+    if (opts.setup?.warnings?.length) {
+      lines.push(...opts.setup.warnings.map((warning) => `warning: ${warning}`));
+    }
+    lines.push(`stop: ${r.stop}`);
+    return lines.join('\n');
+  });
+}
+
+  return {
+    hccWebProcessMatches, currentProcessAncestorPids, stopOrphanWebRuntimes,
+    assertWebTokenForHost, webExposureWarning, webSocketOriginAllowed,
+    proxyOriginForOpts, startWebBackground, waitForStartedRuntime, printWebRuntime
+  };
+}