@mechasm/cli 0.0.0-stage → 0.1.0

package/src/frp.js

@@ -0,0 +1,169 @@
+import { createHash } from 'node:crypto';
+import { access, chmod, copyFile, mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawn } from 'node:child_process';
+
+const version = '0.71.0';
+const archives = {
+  'linux-x64': ['linux_amd64.tar.gz', '84f27e39f11169f7adcef8e8b70c9329de17747b1f14dad9fb95eef5682ea716'],
+  'linux-arm64': ['linux_arm64.tar.gz', 'f33c293c275d8fc68c654b6fba8f10b2551d6463d09a9fc9cffb7227eae82266'],
+  'darwin-x64': ['darwin_amd64.tar.gz', '1b1b4e2f1836e21e8733f1dddaacd4ed9ae67d7dbee39046b9d7b7eda6253637'],
+  'darwin-arm64': ['darwin_arm64.tar.gz', '45be02b186860d375ed49a8941ae9569628a54bf14e67fc36b29c98c99dabcc6'],
+  'win32-x64': ['windows_amd64.zip', '9e5062e3e5cf07e67144a3a4acf175ef6a2486f3605dd6cf288bae34ab39819f'],
+  'win32-arm64': ['windows_arm64.zip', 'b56a5c2a1a2a55d11bc27aeef6edabd39f3d194360ea66660cc27281b502cb1c'],
+};
+
+function run(binary, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, { stdio: 'inherit' });
+    child.once('error', reject);
+    child.once('exit', (code) => code === 0 ? resolve() : reject(new Error(`${binary} exited with ${code}`)));
+  });
+}
+
+export async function ensureFrp(role) {
+  if (process.env.MECHASM_FRP_DIR) {
+    return join(process.env.MECHASM_FRP_DIR, `${role === 'relay' ? 'frps' : 'frpc'}${process.platform === 'win32' ? '.exe' : ''}`);
+  }
+  const archive = archives[`${process.platform}-${process.arch}`];
+  if (!archive) throw new Error(`No frp build for ${process.platform}-${process.arch}. Set MECHASM_FRP_DIR to your frp binaries.`);
+
+  const destination = join(homedir(), '.cache', 'mechasm-local', `frp-${version}`);
+  const binary = join(destination, `${role === 'relay' ? 'frps' : 'frpc'}${process.platform === 'win32' ? '.exe' : ''}`);
+  try {
+    await access(binary);
+    return binary;
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+
+  const [suffix, expectedHash] = archive;
+  const name = `frp_${version}_${suffix}`;
+  const temp = await mkdtemp(join(tmpdir(), 'mechasm-frp-'));
+  try {
+    const response = await fetch(`https://github.com/fatedier/frp/releases/download/v${version}/${name}`);
+    if (!response.ok) throw new Error(`frp download failed: HTTP ${response.status}`);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (createHash('sha256').update(bytes).digest('hex') !== expectedHash) {
+      throw new Error('frp download checksum did not match.');
+    }
+    const archivePath = join(temp, name);
+    await writeFile(archivePath, bytes, { mode: 0o600 });
+    await run('tar', ['-xf', archivePath, '-C', temp]);
+    await mkdir(destination, { recursive: true, mode: 0o700 });
+    for (const executable of ['frpc', 'frps']) {
+      const filename = `${executable}${process.platform === 'win32' ? '.exe' : ''}`;
+      const target = join(destination, filename);
+      await copyFile(join(temp, `frp_${version}_${suffix.replace(/\.tar\.gz$|\.zip$/, '')}`, filename), target);
+      if (process.platform !== 'win32') await chmod(target, 0o700);
+    }
+    return binary;
+  } finally {
+    await rm(temp, { recursive: true, force: true });
+  }
+}
+
+export async function runFrp(role, config) {
+  const binary = await ensureFrp(role);
+  const temp = await mkdtemp(join(tmpdir(), 'mechasm-tunnel-'));
+  const configPath = join(temp, 'frp.json');
+  await writeFile(configPath, JSON.stringify(config), { mode: 0o600 });
+  try {
+    await run(binary, ['verify', '-c', configPath]);
+    const child = spawn(binary, ['-c', configPath], { stdio: 'inherit' });
+    const stop = () => child.kill('SIGTERM');
+    process.on('SIGINT', stop);
+    process.on('SIGTERM', stop);
+    try {
+      await new Promise((resolve, reject) => {
+        child.once('error', reject);
+        child.once('exit', (code, signal) => code === 0 || signal === 'SIGTERM' || signal === 'SIGINT' ? resolve() : reject(new Error(`frp exited with ${code}`)));
+      });
+    } finally {
+      process.off('SIGINT', stop);
+      process.off('SIGTERM', stop);
+    }
+  } finally {
+    await rm(temp, { recursive: true, force: true });
+  }
+}
+
+export async function startFrpClient(config, caPem, signal) {
+  const binary = await ensureFrp('client');
+  if (signal?.aborted) throw Object.assign(new Error('Tunnel start cancelled.'), { name: 'AbortError' });
+  const temp = await mkdtemp(join(tmpdir(), 'mechasm-lease-'));
+  const caPath = join(temp, 'relay-ca.pem');
+  const configPath = join(temp, 'frpc.json');
+  let child;
+  try {
+    await chmod(temp, 0o700);
+    await writeFile(caPath, caPem, { mode: 0o600, flag: 'wx' });
+    config.transport ??= {};
+    config.transport.tls = { ...(config.transport.tls || {}), enable: true, trustedCaFile: caPath };
+    await writeFile(configPath, JSON.stringify(config), { mode: 0o600, flag: 'wx' });
+    await new Promise((resolve, reject) => {
+      const verify = spawn(binary, ['verify', '-c', configPath], { stdio: 'ignore' });
+      let settled = false;
+      const finish = (error) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+        error ? reject(error) : resolve();
+      };
+      const abort = () => { verify.kill('SIGTERM'); finish(Object.assign(new Error('Tunnel start cancelled.'), { name: 'AbortError' })); };
+      const timer = setTimeout(() => {
+        verify.kill('SIGTERM');
+        finish(new Error('frpc config verification timed out.'));
+      }, 10_000);
+      if (signal?.aborted) abort();
+      else signal?.addEventListener('abort', abort, { once: true });
+      verify.once('error', (error) => finish(error));
+      verify.once('exit', (code) => code === 0 ? finish() : finish(new Error('frpc rejected the local tunnel configuration.')));
+    });
+    if (signal?.aborted) throw Object.assign(new Error('Tunnel start cancelled.'), { name: 'AbortError' });
+    child = spawn(binary, ['-c', configPath], { stdio: ['ignore', 'pipe', 'pipe'] });
+    let recent = '';
+    const waitForProxy = new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error(`frpc did not connect to the relay in time: ${recent.slice(-2000)}`)), 15_000);
+      const abort = () => { child.kill('SIGTERM'); reject(Object.assign(new Error('Tunnel start cancelled.'), { name: 'AbortError' })); };
+      const cleanup = () => { clearTimeout(timer); signal?.removeEventListener('abort', abort); };
+      const inspect = (chunk) => {
+        recent = (recent + chunk.toString()).slice(-8192);
+        const connected = config.proxies.every((proxy) => {
+          const name = String(proxy.name).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+          return new RegExp(`\\[${name}\\].{0,300}start proxy success`).test(recent);
+        });
+        if (connected) { cleanup(); resolve(); }
+      };
+      child.stdout.on('data', inspect);
+      child.stderr.on('data', inspect);
+      if (signal?.aborted) abort();
+      else signal?.addEventListener('abort', abort, { once: true });
+      child.once('error', (error) => { cleanup(); reject(error); });
+      child.once('exit', (code) => { cleanup(); reject(new Error(`frpc exited before connecting (${code}): ${recent.slice(-2000)}`)); });
+    });
+    await waitForProxy;
+    let stopped = false;
+    return {
+      child,
+      async stop() {
+        if (stopped) return;
+        stopped = true;
+        if (child.exitCode !== null || child.signalCode) { await rm(temp, { recursive: true, force: true }); return; }
+        child.kill('SIGTERM');
+        await Promise.race([
+          new Promise((resolve) => child.once('exit', resolve)),
+          new Promise((resolve) => setTimeout(resolve, 3000)),
+        ]);
+        if (child.exitCode === null && !child.signalCode) child.kill('SIGKILL');
+        await rm(temp, { recursive: true, force: true });
+      },
+    };
+  } catch (error) {
+    child?.kill('SIGTERM');
+    await rm(temp, { recursive: true, force: true });
+    throw error;
+  }
+}

package/src/local-approvals.js

@@ -0,0 +1,125 @@
+import { constants } from 'node:fs';
+import { mkdir, open, rename, rm, chmod, readFile, stat } from 'node:fs/promises';
+import { createHash, randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { cliConfigDirectory, CliError } from './api-client.js';
+
+function approvalPath(origin) {
+  const key = createHash('sha256').update(origin).digest('hex').slice(0, 20);
+  return join(cliConfigDirectory(), `local-approvals-${key}.json`);
+}
+
+async function readApprovals(path) {
+  let file;
+  try {
+    file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const info = await file.stat();
+    if (!info.isFile() || (process.platform !== 'win32' && (info.uid !== process.getuid?.() || (info.mode & 0o077)))) {
+      throw new CliError('Local approval file permissions are unsafe.');
+    }
+    const data = JSON.parse(await file.readFile('utf8'));
+    if (data?.version !== 1 || !data.approvals || typeof data.approvals !== 'object' || Array.isArray(data.approvals)) {
+      throw new CliError('Local approval file is invalid.');
+    }
+    return data;
+  } catch (error) {
+    if (error.code === 'ENOENT') return { version: 1, approvals: {} };
+    if (error instanceof SyntaxError) throw new CliError('Local approval file is invalid.');
+    throw error;
+  } finally { await file?.close(); }
+}
+
+async function writeApprovals(path, data) {
+  await mkdir(cliConfigDirectory(), { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') await chmod(cliConfigDirectory(), 0o700);
+  const temp = join(cliConfigDirectory(), `.local-approvals-${randomBytes(8).toString('hex')}.tmp`);
+  let file;
+  try {
+    file = await open(temp, 'wx', 0o600);
+    await file.writeFile(`${JSON.stringify(data)}\n`, 'utf8');
+    await file.sync();
+    await file.close();
+    file = null;
+    await rename(temp, path);
+  } finally {
+    await file?.close();
+    await rm(temp, { force: true });
+  }
+}
+
+async function processStartTime(pid) {
+  if (process.platform !== 'linux') return null;
+  try {
+    const stat = await readFile(`/proc/${pid}/stat`, 'utf8');
+    return stat.slice(stat.lastIndexOf(')') + 2).trim().split(/\s+/)[19] || null;
+  } catch { return null; }
+}
+
+async function withApprovalLock(action) {
+  await mkdir(cliConfigDirectory(), { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') await chmod(cliConfigDirectory(), 0o700);
+  const lockPath = `${approvalPath('lock')}.lock`;
+  const deadline = Date.now() + 10_000;
+  while (true) {
+    try {
+      const lock = await open(lockPath, 'wx', 0o600);
+      try { await lock.writeFile(JSON.stringify({ pid: process.pid, processStartTime: await processStartTime(process.pid) })); }
+      finally { await lock.close(); }
+      try { return await action(); }
+      finally { await rm(lockPath, { force: true }); }
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      try {
+        const info = await stat(lockPath);
+        let owner;
+        try { owner = JSON.parse(await readFile(lockPath, 'utf8')); } catch { /* writer is still creating lock */ }
+        let alive = false;
+        if (Number.isInteger(owner?.pid) && owner.pid > 0) {
+          try { process.kill(owner.pid, 0); alive = true; } catch (checkError) { alive = checkError.code === 'EPERM'; }
+          if (alive && typeof owner.processStartTime === 'string') {
+            const currentStartTime = await processStartTime(owner.pid);
+            if (currentStartTime && currentStartTime !== owner.processStartTime) alive = false;
+          }
+        }
+        if (!alive && Date.now() - info.mtimeMs > 30_000) await rm(lockPath, { force: true });
+      } catch (lockError) { if (lockError.code !== 'ENOENT') throw lockError; }
+      if (Date.now() >= deadline) throw new CliError('Timed out waiting to update local port approvals.');
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+  }
+}
+
+export async function setLocalApproval(origin, projectId, deviceId, ports, preferredLocalIP = '127.0.0.1') {
+  if (typeof projectId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(projectId) || !deviceId ||
+      !['127.0.0.1', '::1'].includes(preferredLocalIP) || !Array.isArray(ports) || ports.length < 1 || ports.length > 16 ||
+      ports.some((port) => !Number.isInteger(port) || port < 1 || port > 65535)) {
+    throw new CliError('Invalid local runner approval.');
+  }
+  const path = approvalPath(origin);
+  await withApprovalLock(async () => {
+    const data = await readApprovals(path);
+    data.approvals[projectId] = { deviceId, ports: [...new Set(ports)], preferredLocalIP, updatedAt: new Date().toISOString() };
+    await writeApprovals(path, data);
+  });
+}
+
+export async function clearLocalApproval(origin, projectId) {
+  if (typeof projectId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(projectId)) throw new CliError('Invalid project ID.');
+  const path = approvalPath(origin);
+  await withApprovalLock(async () => {
+    const data = await readApprovals(path);
+    delete data.approvals[projectId];
+    await writeApprovals(path, data);
+  });
+}
+
+export async function approvedLocalPorts(origin, projectId, deviceId) {
+  if (typeof projectId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(projectId)) return [];
+  const approvals = (await readApprovals(approvalPath(origin))).approvals;
+  const record = Object.hasOwn(approvals, projectId) ? approvals[projectId] : null;
+  if (!record || record.deviceId !== deviceId || !Array.isArray(record.ports)) return null;
+  return {
+    ports: record.ports.filter((port) => Number.isInteger(port) && port >= 1 && port <= 65535),
+    preferredLocalIP: ['127.0.0.1', '::1'].includes(record.preferredLocalIP) ? record.preferredLocalIP : '127.0.0.1',
+  };
+}

package/src/notifier.js

@@ -0,0 +1,35 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { cliConfigDirectory } from './api-client.js';
+import { CLI_VERSION } from './version.js';
+
+const REGISTRY_URL = 'https://registry.npmjs.org/@mechasm%2fcli/latest';
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+export async function notifyUpdate() {
+  if (process.env.CI || process.env.MECHASM_NO_UPDATE_NOTIFIER || !process.stderr.isTTY || process.argv.includes('--json')) return;
+  const cachePath = join(cliConfigDirectory(), 'update-notice.json');
+  try {
+    const cache = JSON.parse(await readFile(cachePath, 'utf8'));
+    const age = Date.now() - cache.checkedAt;
+    if (Number.isFinite(cache.checkedAt) && age >= 0 && age < DAY_MS) return;
+  } catch { /* missing or invalid cache: check registry */ }
+  try {
+    const response = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(1500), redirect: 'error', headers: { accept: 'application/json' } });
+    if (!response.ok) return;
+    const data = await response.json();
+    if (typeof data.version === 'string' && /^\d+\.\d+\.\d+$/.test(data.version)) {
+      const current = CLI_VERSION.split('.').map(Number);
+      const latest = data.version.split('.').map(Number);
+      if (latest.some((part, index) => part > current[index] && latest.slice(0, index).every((n, i) => n === current[i]))) {
+        console.error(`Mechasm CLI ${data.version} available. Upgrade: npm install -g @mechasm/cli@latest`);
+      }
+    }
+  } catch { /* update checks are optional */ }
+  finally {
+    try {
+      await mkdir(cliConfigDirectory(), { recursive: true, mode: 0o700 });
+      await writeFile(cachePath, JSON.stringify({ checkedAt: Date.now() }), { mode: 0o600 });
+    } catch { /* cache is best-effort */ }
+  }
+}