@mechasm/cli 0.0.0-stage → 0.1.1

package/src/api-client.js

@@ -0,0 +1,424 @@
+import { constants } from 'node:fs';
+import { mkdir, open, readFile, rename, rm, stat } from 'node:fs/promises';
+import { homedir, hostname } from 'node:os';
+import { createHash, randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { spawn } from 'node:child_process';
+import { setTimeout as delay } from 'node:timers/promises';
+
+export const DEFAULT_API_URL = 'https://api.mechasm.ai';
+const REQUEST_TIMEOUT_MS = 30_000;
+const REFRESH_EARLY_MS = 60_000;
+const MAX_TOKEN_TTL_SECONDS = 24 * 60 * 60;
+
+export class CliError extends Error {
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+}
+
+export function apiUrl(value = DEFAULT_API_URL) {
+  let url;
+  try { url = new URL(value); } catch { throw new CliError('Invalid --api-url.', 2); }
+  const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  const loopback = host === 'localhost' || host === '127.0.0.1' || host === '::1';
+  if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) ||
+      url.username || url.password || url.search || url.hash || (url.pathname !== '/' && url.pathname !== '')) {
+    throw new CliError('--api-url must be an HTTPS origin (or HTTP loopback for local development).', 2);
+  }
+  return new URL(url.origin);
+}
+
+export function cliConfigDirectory() {
+  const base = process.platform === 'win32'
+    ? process.env.LOCALAPPDATA || join(homedir(), 'AppData', 'Local')
+    : process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+  return join(base, 'mechasm');
+}
+
+function credentialPath(origin) {
+  const key = createHash('sha256').update(origin).digest('hex').slice(0, 20);
+  return join(cliConfigDirectory(), `credentials-${key}.json`);
+}
+
+async function ensureConfigDirectory() {
+  const directory = cliConfigDirectory();
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  if (process.platform !== 'win32') await (await import('node:fs/promises')).chmod(directory, 0o700);
+  return directory;
+}
+
+async function readCredentials(path) {
+  let handle;
+  try {
+    const flags = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0);
+    handle = await open(path, flags);
+    const info = await handle.stat();
+    if (!info.isFile()) throw new CliError('Credential file is not a regular file.');
+    if (process.platform !== 'win32' && (info.uid !== process.getuid?.() || (info.mode & 0o077))) {
+      throw new CliError('Credential file permissions are unsafe; remove it and sign in again.');
+    }
+    return JSON.parse(await handle.readFile('utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    if (error instanceof SyntaxError) throw new CliError('Credential file is invalid; remove it and sign in again.');
+    throw error;
+  } finally {
+    await handle?.close();
+  }
+}
+
+async function writeCredentials(path, value) {
+  const directory = await ensureConfigDirectory();
+  const temporary = join(directory, `.credentials-${process.pid}-${randomBytes(6).toString('hex')}.tmp`);
+  let handle;
+  try {
+    handle = await open(temporary, 'wx', 0o600);
+    await handle.writeFile(`${JSON.stringify(value)}\n`, 'utf8');
+    await handle.sync();
+    await handle.close();
+    handle = null;
+    await rename(temporary, path);
+  } finally {
+    await handle?.close();
+    await rm(temporary, { force: true });
+  }
+}
+
+function pidIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid < 1) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error.code === 'EPERM'; }
+}
+
+async function withCredentialLock(path, action) {
+  await ensureConfigDirectory();
+  const lockPath = `${path}.lock`;
+  const deadline = Date.now() + 30_000;
+  while (true) {
+    try {
+      const lock = await open(lockPath, 'wx', 0o600);
+      try { await lock.writeFile(JSON.stringify({ pid: process.pid, startedAt: Date.now() })); }
+      finally { await lock.close(); }
+      try { return await action(); }
+      finally { await rm(lockPath, { force: true }); }
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      try {
+        const [info, content] = await Promise.all([stat(lockPath), readFile(lockPath, 'utf8')]);
+        let pid = 0;
+        try { pid = JSON.parse(content).pid; } catch { /* incomplete lock */ }
+        if (Date.now() - info.mtimeMs > 30_000 && !pidIsAlive(pid)) {
+          await rm(lockPath, { force: true });
+          continue;
+        }
+      } catch (lockError) {
+        if (lockError.code === 'ENOENT') continue;
+        throw lockError;
+      }
+      if (Date.now() >= deadline) throw new CliError('Timed out waiting for another CLI command to refresh credentials.');
+      await delay(75);
+    }
+  }
+}
+
+function responseError(status, body) {
+  const message = typeof body?.error?.message === 'string' ? body.error.message : `API request failed (${status}).`;
+  const code = status === 401 ? 3 : status === 403 ? 4 : 1;
+  const error = new CliError(message.slice(0, 300), code);
+  error.apiCode = body?.error?.code ?? body?.code;
+  error.retryable = body?.error?.retryable === true || body?.retryable === true;
+  return error;
+}
+
+export function createCliClient(rawApiUrl) {
+  const base = apiUrl(rawApiUrl);
+  const origin = base.origin;
+  const path = credentialPath(origin);
+
+  async function request(route, { method = 'GET', body, token, responseType = 'json', signal, idempotencyKey, timeoutMs = REQUEST_TIMEOUT_MS } = {}) {
+    const headers = { accept: 'application/json' };
+    if (body !== undefined) headers['content-type'] = 'application/json';
+    if (token) headers.authorization = `Bearer ${token}`;
+    if (idempotencyKey) headers['idempotency-key'] = idempotencyKey;
+    let response;
+    try {
+      response = await fetch(new URL(`/cli/v1${route}`, base), {
+        method,
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        redirect: 'manual',
+        signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs),
+      });
+    } catch (error) {
+      if (signal?.aborted) throw Object.assign(new Error('Request cancelled.'), { name: 'AbortError' });
+      throw new CliError(`Could not reach ${origin}: ${error.message}`);
+    }
+    if (response.status >= 300 && response.status < 400) {
+      throw new CliError('API redirect refused. Check --api-url.');
+    }
+    if (response.status === 204) return { status: response.status, data: null, headers: response.headers };
+    if (responseType === 'stream') {
+      if (!response.ok) {
+        let data = null;
+        try { data = await response.json(); } catch { /* handled below */ }
+        throw responseError(response.status, data);
+      }
+      return { status: response.status, data: response.body, headers: response.headers };
+    }
+    let data = null;
+    try { data = await response.json(); } catch { /* handled below */ }
+    if (!response.ok) throw responseError(response.status, data);
+    return { status: response.status, data, headers: response.headers };
+  }
+
+  function readExternalToken(stdinToken) {
+    const token = stdinToken ?? process.env.MECHASM_ACCESS_TOKEN;
+    if (!token) return null;
+    if (!/^mca_[A-Za-z0-9_-]+$/.test(token)) throw new CliError('External access token has invalid format.', 2);
+    return token;
+  }
+
+  async function accessToken(stdinToken) {
+    const external = readExternalToken(stdinToken);
+    if (external) return { token: external, external: true };
+    return withCredentialLock(path, async () => {
+      const current = await readCredentials(path);
+      if (!current?.accessToken || !current.refreshToken) throw new CliError('Not logged in. Run `mechasm login` first.', 3);
+      if (current.expiresAt > Date.now() + REFRESH_EARLY_MS) return { token: current.accessToken, external: false };
+      const next = await refreshCredentials(current);
+      return { token: next.accessToken, external: false };
+    });
+  }
+
+  async function authorized(route, options = {}) {
+    const auth = await accessToken(options.stdinToken);
+    const requestOptions = { method: options.method, body: options.body, responseType: options.responseType, signal: options.signal, idempotencyKey: options.idempotencyKey, timeoutMs: options.timeoutMs };
+    try {
+      return { ...(await request(route, { ...requestOptions, token: auth.token })), external: auth.external };
+    } catch (error) {
+      if (auth.external || error.exitCode !== 3) throw error;
+      const latest = await withCredentialLock(path, async () => {
+        const current = await readCredentials(path);
+        if (!current?.accessToken || !current.refreshToken) throw new CliError('Session expired. Run `mechasm login` again.', 3);
+        if (current.accessToken !== auth.token && current.expiresAt > Date.now()) return current;
+        return refreshCredentials(current);
+      });
+      return { ...(await request(route, { ...requestOptions, token: latest.accessToken })), external: false };
+    }
+  }
+
+  async function refreshCredentials(current) {
+    let refreshed;
+    try {
+      refreshed = (await request('/auth/refresh', { method: 'POST', body: { refreshToken: current.refreshToken } })).data;
+    } catch (error) {
+      if (error.exitCode === 3) throw new CliError('Session expired. Run `mechasm login` again.', 3);
+      throw error;
+    }
+    const next = credentialRecord(refreshed);
+    await writeCredentials(path, next);
+    return next;
+  }
+
+  return {
+    origin,
+    request,
+    async login({ deviceName = hostname().slice(0, 120), noBrowser = false, json = false } = {}) {
+      deviceName = String(deviceName).trim();
+      if (!deviceName || deviceName.length > 120) throw new CliError('--device-name must be 1 to 120 characters.', 2);
+      const device = (await request('/auth/device', { method: 'POST', body: { deviceName } })).data;
+      if (typeof device?.deviceCode !== 'string' || !/^mcd_[A-Za-z0-9_-]{43}$/.test(device.deviceCode) ||
+          typeof device?.userCode !== 'string' || !device.userCode || typeof device?.verificationUrl !== 'string' ||
+          !Number.isInteger(device.expiresIn) || device.expiresIn < 1 || device.expiresIn > 1800) {
+        throw new CliError('API returned an invalid device authorization response.');
+      }
+      const approval = trustedApprovalUrl(device.verificationUrl, device.userCode, base);
+      if (json) {
+        console.error(JSON.stringify({ status: 'pending', verificationUrl: approval.toString(), expiresIn: device.expiresIn }));
+      } else {
+        if (noBrowser) {
+          console.log(`Open this link to allow this device:\n${approval}`);
+        } else {
+          if (!(await openBrowser(approval.toString()))) {
+            console.log(`Could not open your browser. Open this link to allow this device:\n${approval}`);
+          }
+        }
+        console.log('Waiting for approval...');
+      }
+      if (!noBrowser && json) await openBrowser(approval.toString());
+      const expiresAt = Date.now() + device.expiresIn * 1000;
+      const interval = Math.max(1, Math.min(Number(device.interval) || 5, 30)) * 1000;
+      while (Date.now() < expiresAt) {
+        const result = await request('/auth/token', { method: 'POST', body: { deviceCode: device.deviceCode } });
+        if (result.status === 202) {
+          await delay(Math.min(interval, Math.max(0, expiresAt - Date.now())));
+          continue;
+        }
+        const saved = credentialRecord(result.data);
+        await withCredentialLock(path, () => writeCredentials(path, saved));
+        if (!json) console.log(`Logged in as ${deviceName}.`);
+        return { status: 'authorized', verificationUrl: approval.toString(), deviceId: saved.deviceId, expiresIn: result.data.expiresIn };
+      }
+      throw new CliError('Device authorization expired. Run `mechasm login` again.', 3);
+    },
+    async whoami(stdinToken, options = {}) {
+      const result = await authorized('/me', { stdinToken, timeoutMs: options.timeoutMs });
+      return { data: result.data, external: result.external };
+    },
+    async projects(stdinToken) {
+      const result = await authorized('/projects', { stdinToken });
+      return { data: result.data, external: result.external };
+    },
+    async listTeams(stdinToken) {
+      return (await authorized('/teams', { stdinToken })).data;
+    },
+    async createProject(body, stdinToken, idempotencyKey) {
+      return (await authorized('/projects', { method: 'POST', body, stdinToken, idempotencyKey })).data;
+    },
+    async projectVariables(projectId, stdinToken) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/variables`, { stdinToken })).data;
+    },
+    async setProjectVariable(projectId, key, value, stdinToken) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/variables`, { method: 'PUT', body: { key, value }, stdinToken })).data;
+    },
+    async unsetProjectVariable(projectId, key, stdinToken) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/variables`, { method: 'DELETE', body: { key }, stdinToken })).data;
+    },
+    async createTest(projectId, body, stdinToken, idempotencyKey) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/tests`, { method: 'POST', body, stdinToken, idempotencyKey })).data;
+    },
+    async editTest(projectId, testId, body, stdinToken, idempotencyKey) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/tests/${encodeURIComponent(testId)}`, { method: 'PATCH', body, stdinToken, idempotencyKey })).data;
+    },
+    async listTests(projectId, stdinToken, { offset, limit } = {}) {
+      const query = new URLSearchParams();
+      if (offset !== undefined) query.set('offset', String(offset));
+      if (limit !== undefined) query.set('limit', String(limit));
+      const suffix = query.size ? `?${query}` : '';
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/tests${suffix}`, { stdinToken })).data;
+    },
+    async getTest(projectId, testId, stdinToken) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/tests/${encodeURIComponent(testId)}`, { stdinToken })).data;
+    },
+    async runTest(projectId, testId, stdinToken, idempotencyKey) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/tests/${encodeURIComponent(testId)}/runs`, { method: 'POST', stdinToken, idempotencyKey })).data;
+    },
+    async stopRun(projectId, runId, stdinToken) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/runs/${encodeURIComponent(runId)}/stop`, { method: 'POST', stdinToken })).data;
+    },
+    async getRun(projectId, runId, stdinToken) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/runs/${encodeURIComponent(runId)}`, { stdinToken })).data;
+    },
+    async runLogs(projectId, runId, after, stdinToken, { wait = false, signal } = {}) {
+      const query = new URLSearchParams();
+      if (after != null) query.set('after', after);
+      if (wait) query.set('wait', '1');
+      const suffix = query.size ? `?${query}` : '';
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/runs/${encodeURIComponent(runId)}/logs${suffix}`, { stdinToken, signal })).data;
+    },
+    async runVariables(projectId, runId, stdinToken) {
+      return (await authorized(`/projects/${encodeURIComponent(projectId)}/runs/${encodeURIComponent(runId)}/variables`, { stdinToken })).data;
+    },
+    async downloadRunArtifact(projectId, runId, artifact, stdinToken) {
+      const result = await authorized(`/projects/${encodeURIComponent(projectId)}/runs/${encodeURIComponent(runId)}/${artifact}`, { stdinToken, responseType: 'stream' });
+      return { body: result.data, contentType: result.headers.get('content-type'), contentDisposition: result.headers.get('content-disposition') };
+    },
+    async registerLocal(projectId, url, ports, stdinToken) {
+      return (await authorized('/local/register', { method: 'POST', body: { projectId, url, ports }, stdinToken })).data;
+    },
+    async unregisterLocal(projectId, stdinToken) {
+      return (await authorized(`/local/register?projectId=${encodeURIComponent(projectId)}`, { method: 'DELETE', stdinToken })).data;
+    },
+    async localDevices(projectId, stdinToken) {
+      return (await authorized(`/local/devices?projectId=${encodeURIComponent(projectId)}`, { stdinToken })).data;
+    },
+    async selectLocalRunner(projectId, deviceId, stdinToken) {
+      return (await authorized(`/local/projects/${encodeURIComponent(projectId)}/runner`, { method: 'PUT', body: { deviceId }, stdinToken })).data;
+    },
+    async localProject(projectId, stdinToken) {
+      return (await authorized(`/local/projects/${encodeURIComponent(projectId)}`, { stdinToken })).data;
+    },
+    async updateLocalProject(projectId, body, stdinToken) {
+      return (await authorized(`/local/projects/${encodeURIComponent(projectId)}`, { method: 'PUT', body, stdinToken })).data;
+    },
+    async localHeartbeat(stdinToken, signal) {
+      return await authorized('/local/heartbeat', { method: 'POST', stdinToken, signal });
+    },
+    async nextLocalLease(stdinToken, signal) {
+      return await authorized('/local/leases/next?wait=20', { stdinToken, signal });
+    },
+    async getLocalLease(leaseId, stdinToken, signal) {
+      return (await authorized(`/local/leases/${encodeURIComponent(leaseId)}`, { stdinToken, signal })).data;
+    },
+    async heartbeatLocalLease(leaseId, stdinToken, signal) {
+      return (await authorized(`/local/leases/${encodeURIComponent(leaseId)}/heartbeat`, { method: 'POST', stdinToken, signal })).data;
+    },
+    async readyLocalLease(leaseId, stdinToken, signal) {
+      return await authorized(`/local/leases/${encodeURIComponent(leaseId)}/ready`, { method: 'POST', stdinToken, signal });
+    },
+    async closeLocalLease(leaseId, stdinToken) {
+      return await authorized(`/local/leases/${encodeURIComponent(leaseId)}`, { method: 'DELETE', stdinToken });
+    },
+    async logout(stdinToken) {
+      const external = readExternalToken(stdinToken);
+      if (external) return request('/auth/logout', { method: 'POST', token: external });
+      return withCredentialLock(path, async () => {
+        let current = await readCredentials(path);
+        if (!current?.accessToken || !current.refreshToken) throw new CliError('Not logged in. Run `mechasm login` first.', 3);
+        if (current.expiresAt <= Date.now() + REFRESH_EARLY_MS) current = await refreshCredentials(current);
+        try {
+          await request('/auth/logout', { method: 'POST', token: current.accessToken });
+        } catch (error) {
+          if (error.exitCode !== 3) throw error;
+          current = await refreshCredentials(current);
+          await request('/auth/logout', { method: 'POST', token: current.accessToken });
+        }
+        await rm(path, { force: true });
+      });
+    },
+  };
+}
+
+function credentialRecord(data) {
+  if (typeof data?.accessToken !== 'string' || !/^mca_[A-Za-z0-9_-]{43}$/.test(data.accessToken) ||
+      typeof data?.refreshToken !== 'string' || !/^mcr_[A-Za-z0-9_-]{64}$/.test(data.refreshToken) ||
+      !Number.isInteger(data.expiresIn) || data.expiresIn < 1 || data.expiresIn > MAX_TOKEN_TTL_SECONDS ||
+      typeof data?.deviceId !== 'string' || !data.deviceId.trim()) {
+    throw new CliError('API returned an invalid token response.');
+  }
+  return {
+    accessToken: data.accessToken,
+    refreshToken: data.refreshToken,
+    expiresAt: Date.now() + data.expiresIn * 1000,
+    deviceId: data.deviceId,
+  };
+}
+
+function trustedApprovalUrl(value, userCode, api) {
+  let url;
+  try { url = new URL(value); } catch { throw new CliError('API returned an invalid approval URL.'); }
+  const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+  const localHost = (name) => ['localhost', '127.0.0.1', '::1'].includes(name.replace(/^\[|\]$/g, '').toLowerCase());
+  const trustedSite = host === 'mechasm.ai' || host.endsWith('.mechasm.ai');
+  const trustedLocal = api.protocol === 'http:' && localHost(host) && url.protocol === 'http:';
+  if (url.username || url.password || (url.protocol !== 'https:' && !trustedLocal) || (!trustedSite && !trustedLocal)) {
+    throw new CliError('API returned an untrusted approval URL; refusing to open it.');
+  }
+  url.searchParams.set('code', userCode);
+  return url;
+}
+
+async function openBrowser(url) {
+  const [file, args] = process.platform === 'darwin'
+    ? ['open', [url]]
+    : process.platform === 'win32'
+      ? ['rundll32.exe', ['url.dll,FileProtocolHandler', url]]
+      : ['xdg-open', [url]];
+  return new Promise((resolve) => {
+    const child = spawn(file, args, { detached: true, stdio: 'ignore' });
+    child.once('error', () => resolve(false));
+    child.once('spawn', () => { child.unref(); resolve(true); });
+  });
+}