@mh-gg/cli 0.1.1-alpha.20260613T085325975Z

package/runtime/bin/matterhorn.cjs

@@ -0,0 +1,501 @@
+#!/usr/bin/env node
+
+const { spawn } = require("node:child_process");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+let appModules;
+let appHostCommand;
+let deployCommand;
+let installCommand;
+let matterhornrc;
+let relayConfig;
+let relayIdentityModules;
+
+function matterhornApps() {
+  if (!appModules) appModules = require("./matterhornApps.cjs");
+  return appModules;
+}
+
+function appHost() {
+  if (!appHostCommand) appHostCommand = require("./appHostCommand.cjs");
+  return appHostCommand;
+}
+
+function deploy() {
+  if (!deployCommand) deployCommand = require("./matterhornDeploy.cjs");
+  return deployCommand;
+}
+
+function installs() {
+  if (!installCommand) installCommand = require("./matterhornInstall.cjs");
+  return installCommand;
+}
+
+function rc() {
+  if (!matterhornrc) matterhornrc = require("../host/matterhornrc.cjs");
+  return matterhornrc;
+}
+
+function relayDefaults() {
+  if (!relayConfig) relayConfig = require("../host/relayConfig.cjs");
+  return relayConfig;
+}
+
+function relayIdentity() {
+  if (!relayIdentityModules) relayIdentityModules = require("../host/relayIdentity.cjs");
+  return relayIdentityModules;
+}
+
+function dataDir() {
+  return process.env.MATTERHORN_DATA_DIR || rc().userDataDir();
+}
+
+function configFileForDisplay() {
+  try { return rc().usermatterhornrcFile(); } catch { return "~/.matterhornrc"; }
+}
+
+function defaultAppUrl() {
+  return process.env.APP_URL || process.env.HOST_URL || "https://launch.matterhorn.gg/";
+}
+
+function usage() {
+  console.log("Usage: npx --package matterhorn-sdk matterhorn <app-ref> <room-slug> [--serve [dev|built] [--frontend-port PORT]] [--local-peerjs] -- [host options]");
+  console.log("       npx --package matterhorn-sdk matterhorn launch <app-ref> [--room ROOM] [--relay RELAY] [--user USER]");
+  console.log("       npx --package matterhorn-sdk matterhorn run <install-id> [--room ROOM] [--relay RELAY] [--user USER]");
+  console.log("       npx --package matterhorn-sdk matterhorn deploy <app-ref> <room-slug> [--serve [dev|built] [--frontend-port PORT]] [--relay-peer ADDRESS]");
+  console.log("       npx --package matterhorn-sdk matterhorn host SESSION-ID --pack <app-pack-ref> [--player <player-pack-ref>]");
+  console.log("       npx --package matterhorn-sdk matterhorn launcher add-player --url <player-pack-ref>");
+  console.log("       npx --package matterhorn-sdk matterhorn relay [start] [--name NAME] [--addRelay matterhorn-relay:TOKEN]");
+  console.log("       npx --package matterhorn-sdk matterhorn relay invite [--name NAME]");
+  console.log("       npx --package matterhorn-sdk matterhorn relay add <matterhorn-relay:TOKEN|peerjs:ADDRESS|PINNED_ALIAS#0000> [--ipc-port 42777]");
+  console.log("       npx --package matterhorn-sdk matterhorn relay trust remove NAME");
+  console.log("       npx --package matterhorn-sdk matterhorn configure set host https://example.com");
+  console.log("Example: npx --package matterhorn-sdk matterhorn @app.matterhorn.events rooftop-disco --serve built");
+  console.log("Example: npx --package matterhorn-sdk matterhorn launch @app.matterhorn.events --room rooftop-disco --relay peerjs:other-relay --user alice");
+  console.log("Example: npx --package matterhorn-sdk matterhorn apps");
+  console.log("Example: npx --package matterhorn-sdk matterhorn doctor");
+  console.log("Example: npx --package matterhorn-sdk matterhorn deploy @app.matterhorn.events rooftop-disco --serve built --relay-peer peerjs:other-relay");
+  console.log("Example: npx --package matterhorn-sdk matterhorn ./examples/events rooftop-disco --serve built");
+  console.log("Example: npx --package matterhorn-sdk matterhorn ./examples/events test-slug --local-peerjs -- --app-url http://localhost:42729/");
+  console.log("Example: npx --package matterhorn-sdk matterhorn host rooftop-disco --pack workspace:@mh-gg/example-events#eventAppPack");
+  console.log("Example: npx --package matterhorn-sdk matterhorn relay start --name relay-a");
+  console.log("Example: npx --package matterhorn-sdk matterhorn relay start --name relay-b --addRelay matterhorn-relay:TOKEN_FROM_RELAY_A");
+  console.log("Example: npx --package matterhorn-sdk matterhorn relay add relay-a#0000");
+  console.log(`Config: ${configFileForDisplay()}`);
+  console.log(`Data: ${dataDir()}\\<room-slug>.json`);
+}
+
+function parseRelayAddArgs(args) {
+  const { DEFAULT_RELAY_IPC_HOST, DEFAULT_RELAY_IPC_PORT } = relayDefaults();
+  const parsed = {
+    ipcHost: process.env.MATTERHORN_RELAY_IPC_HOST || DEFAULT_RELAY_IPC_HOST,
+    ipcPort: Number(process.env.MATTERHORN_RELAY_IPC_PORT || DEFAULT_RELAY_IPC_PORT),
+    relayRef: ""
+  };
+
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === "--host" || token === "--ipc-host") {
+      parsed.ipcHost = args[index + 1];
+      index += 1;
+      continue;
+    }
+    if (token === "--port" || token === "--ipc-port") {
+      parsed.ipcPort = Number(args[index + 1]);
+      index += 1;
+      continue;
+    }
+    if (!token.startsWith("--") && !parsed.relayRef) parsed.relayRef = token;
+  }
+
+  return parsed;
+}
+
+function resolveRelayReferenceForCli(relayRef) {
+  const store = relayIdentity().createRelayTrustStore({ dataDir: dataDir() });
+  const resolved = store.resolveReference(relayRef);
+  if (!resolved.ok) throw new Error(resolved.message);
+  return resolved;
+}
+
+function relayIpcAuthForCli(parsed) {
+  const config = relayConfig().ensureRelayConfig({
+    dataDir: dataDir(),
+    ipcHost: parsed.ipcHost,
+    ipcPort: parsed.ipcPort
+  });
+  return { type: "relay-ipc", secret: config.ipcSecret };
+}
+
+function addRelay(args) {
+  const WebSocket = require("ws");
+  const parsed = parseRelayAddArgs(args);
+  if (!parsed.relayRef) {
+    usage();
+    process.exit(1);
+  }
+  let resolved;
+  try {
+    resolved = resolveRelayReferenceForCli(parsed.relayRef);
+  } catch (error) {
+    console.error(error.message || error);
+    process.exit(1);
+  }
+
+  const ipcUrl = `ws://${parsed.ipcHost}:${parsed.ipcPort}/room`;
+  console.log(`Connecting to relay IPC ${ipcUrl}`);
+  const socket = new WebSocket(ipcUrl);
+  const requestId = `relay_add_${Date.now()}`;
+  const timer = setTimeout(() => {
+    console.error(`Timed out adding relay ${parsed.relayRef}`);
+    socket.close();
+    process.exit(1);
+  }, 10000);
+  socket.on("open", () => {
+    console.log(`Adding relay ${parsed.relayRef}`);
+    socket.send(JSON.stringify({
+      type: "relay.add",
+      requestId,
+      auth: relayIpcAuthForCli(parsed),
+      relayRef: parsed.relayRef,
+      relayAddress: resolved.relayAddress,
+      relayClaim: resolved.relayClaim
+    }));
+  });
+  socket.on("message", (data) => {
+    const message = JSON.parse(data.toString("utf8"));
+    if (message.requestId !== requestId) return;
+    if (message.type === "relay.add.ok") {
+      clearTimeout(timer);
+      console.log(`Added relay ${message.relayAddress}`);
+      socket.close();
+      return;
+    }
+    clearTimeout(timer);
+    console.error(message.message || "Failed to add relay");
+    socket.close();
+    process.exitCode = 1;
+  });
+  socket.on("error", (error) => {
+    clearTimeout(timer);
+    console.error(`Failed to connect to relay IPC ${ipcUrl}: ${error.message}`);
+    process.exit(1);
+  });
+}
+
+function parseRelayIdentityArgs(args) {
+  const parsed = {
+    relayName: undefined,
+    relayPeerId: undefined
+  };
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === "--name" || token === "--relay-name") {
+      parsed.relayName = args[index + 1];
+      index += 1;
+      continue;
+    }
+    if (token === "--relay-peer-id") {
+      parsed.relayPeerId = args[index + 1];
+      index += 1;
+    }
+  }
+  return parsed;
+}
+
+function printRelayInvite(args, io = console) {
+  const parsed = parseRelayIdentityArgs(args);
+  const config = relayDefaults().ensureRelayConfig({
+    dataDir: dataDir(),
+    relayName: parsed.relayName,
+    relayPeerId: parsed.relayPeerId
+  });
+  const claim = relayIdentity().signRelayClaim(config.relayIdentity, {
+    relayAddress: config.relayAddress,
+    roomPeerId: config.relayPeerId,
+    relayMeshPeerId: config.relayMeshPeerId
+  });
+  const invite = relayIdentity().encodeRelayInvite(claim);
+  io.log(invite);
+  return invite;
+}
+
+function relayTrust(args, io = console) {
+  const [command, name] = args;
+  if (command !== "remove" || !name) {
+    usage();
+    process.exit(1);
+  }
+  const removed = relayIdentity().createRelayTrustStore({ dataDir: dataDir() }).remove(name);
+  io.log(removed ? `Removed relay trust pin for ${name}` : `No relay trust pin for ${name}`);
+  return removed;
+}
+
+function relayStartArgs(args) {
+  return args[0] === "start" ? args.slice(1) : args;
+}
+
+function listApps(io = console) {
+  const fallback = {
+    "@app.matterhorn.budget": "Budget",
+    "@app.matterhorn.crm": "CRM",
+    "@app.matterhorn.events": "Events",
+    "@app.matterhorn.kanban": "Kanban",
+    "@app.matterhorn.polls": "Polls",
+    "@app.matterhorn.wiki": "Wiki"
+  };
+  let registry;
+  try {
+    registry = matterhornApps().localWorkspaceRegistry();
+  } catch {
+    registry = Object.fromEntries(Object.entries(fallback).map(([alias, name]) => [alias, { name }]));
+  }
+  const aliases = Object.keys(registry).filter((name) => name.startsWith("@app.matterhorn.")).sort();
+  io.log("Available Matterhorn app aliases:");
+  for (const alias of aliases) {
+    const app = registry[alias];
+    const pack = app?.appPack || app?.eventAppPack || app?.kanbanAppPack || app?.wikiAppPack || app?.pollsAppPack || app?.budgetAppPack || app?.crmAppPack;
+    const label = pack?.name || app?.name || fallback[alias] || alias;
+    io.log(`  ${alias} - ${label}`);
+  }
+  return aliases;
+}
+
+function doctor(io = console) {
+  const checks = [];
+  const nodeMajor = Number(process.versions.node.split(".")[0]);
+  checks.push({ name: "Node", ok: nodeMajor >= 22, detail: process.versions.node });
+  checks.push({ name: "Config", ok: true, detail: rc().usermatterhornrcFile() });
+  checks.push({ name: "Data directory", ok: true, detail: dataDir() });
+  try {
+    require.resolve("ws");
+    checks.push({ name: "WebSocket dependency", ok: true, detail: "ws resolved" });
+  } catch (error) {
+    checks.push({ name: "WebSocket dependency", ok: false, detail: error.message });
+  }
+  try {
+    const manifest = require("../package.json");
+    const exports = manifest.exports || {};
+    const missing = Object.values(exports)
+      .flatMap((entry) => typeof entry === "string" ? [entry] : Object.values(entry || {}))
+      .filter((target) => typeof target === "string" && !target.includes("*"))
+      .filter((target) => !fs.existsSync(path.join(__dirname, "..", target)));
+    checks.push({ name: "Package exports", ok: missing.length === 0, detail: missing.length === 0 ? "all exported files exist" : `missing ${missing.join(", ")}` });
+    checks.push({ name: "Retired browser client export", ok: !Object.prototype.hasOwnProperty.call(exports, "./client/matterhorn-client.js"), detail: "matterhorn-sdk/client/matterhorn-client.js is not exported" });
+  } catch (error) {
+    checks.push({ name: "Package exports", ok: false, detail: error.message });
+  }
+  for (const key of ["MATTERHORN_TRUSTED_APP_CODE", "MATTERHORN_UNSAFE_APP_FULL_ENV", "MATTERHORN_UNSAFE_GIT_APP_REF"]) {
+    checks.push({ name: `Unsafe env ${key}`, ok: process.env[key] !== "1", detail: process.env[key] === "1" ? "set for this process" : "unset" });
+  }
+  try {
+    const { buildMatterhornCommandEnv } = require("./appFrontend/commandEnv.cjs");
+    const previous = process.env.NPM_TOKEN;
+    process.env.NPM_TOKEN = "doctor-secret";
+    const env = buildMatterhornCommandEnv({ trust: "trusted-installed" });
+    if (previous === undefined) delete process.env.NPM_TOKEN;
+    else process.env.NPM_TOKEN = previous;
+    checks.push({ name: "App command env policy", ok: env.NPM_TOKEN === undefined, detail: "full env inheritance disabled by default" });
+  } catch (error) {
+    checks.push({ name: "App command env policy", ok: false, detail: error.message });
+  }
+  try {
+    const { loadMatterhornApp } = require("./matterhornAppLoader.cjs");
+    const previous = process.env.MATTERHORN_TRUSTED_APP_CODE;
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "matterhorn-doctor-app-"));
+    const packageDir = path.join(tmp, "node_modules", "doctor-js-app");
+    fs.mkdirSync(packageDir, { recursive: true });
+    fs.writeFileSync(path.join(packageDir, "package.json"), JSON.stringify({ name: "doctor-js-app", version: "1.0.0", main: "index.cjs" }));
+    fs.writeFileSync(path.join(packageDir, "index.cjs"), "throw new Error('doctor package JavaScript executed');\n");
+    let blocked = false;
+    try {
+      process.env.MATTERHORN_TRUSTED_APP_CODE = "1";
+      loadMatterhornApp("doctor-js-app", { cwd: tmp });
+    } catch {
+      blocked = true;
+    } finally {
+      if (previous === undefined) delete process.env.MATTERHORN_TRUSTED_APP_CODE;
+      else process.env.MATTERHORN_TRUSTED_APP_CODE = previous;
+      fs.rmSync(tmp, { recursive: true, force: true });
+    }
+    checks.push({ name: "Remote package JS descriptor policy", ok: blocked, detail: "package refs require static JSON or per-source trust" });
+  } catch (error) {
+    checks.push({ name: "Remote package JS descriptor policy", ok: false, detail: error.message });
+  }
+  try {
+    const { DEFAULT_RELAY_IPC_HOST } = relayDefaults();
+    checks.push({ name: "Relay IPC default binding", ok: DEFAULT_RELAY_IPC_HOST === "127.0.0.1", detail: `default host ${DEFAULT_RELAY_IPC_HOST}` });
+  } catch (error) {
+    checks.push({ name: "Relay IPC default binding", ok: false, detail: error.message });
+  }
+  try {
+    const { HostPluginRuntime, createOperationRoleKeyGrant, createRoleKeyAuthenticator, generateOperationRoleKeyPair } = require("@mh-gg/host-runtime");
+    let atomicBlocked = false;
+    try {
+      new HostPluginRuntime({
+        room: { id: "doctor", appPack: { id: "app", hash: "sha256-app" } },
+        plugins: [{ id: "plugin", version: "1", schemas: { state: {}, operations: {} }, createInitialState: () => ({}), authorize: () => ({ ok: false }), reduce: (_ctx, state) => state }],
+        productionRuntime: true
+      });
+    } catch (error) {
+      atomicBlocked = error.code === "ATOMIC_COMMIT_REQUIRED";
+    }
+    checks.push({ name: "Production atomic store policy", ok: atomicBlocked, detail: "production runtime requires commitStateAndOperation" });
+
+    const key = generateOperationRoleKeyPair({ role: "user" });
+    const grant = createOperationRoleKeyGrant({ roomId: "doctor", appPackId: "app", appPackHash: "sha256-app", credentialId: "cred", role: "user", publicKeyPem: key.publicKeyPem, issuedAt: 1 });
+    const auth = createRoleKeyAuthenticator({ roomId: "doctor", appPackId: "app", appPackHash: "sha256-app", grants: [grant], productionRuntime: true });
+    checks.push({ name: "Production role-key grant policy", ok: auth.matterhornRoleKeyAuthenticator === true && auth.requireSignedGrants === true, detail: "production authenticators require signed grants" });
+  } catch (error) {
+    checks.push({ name: "Production runtime policy", ok: false, detail: error.message });
+  }
+  for (const check of checks) io.log(`${check.ok ? "✓" : "✗"} ${check.name}: ${check.detail}`);
+  return checks;
+}
+
+function configure(args) {
+  const [command, key, value] = args;
+  const file = rc().usermatterhornrcFile();
+  const current = rc().readmatterhornrc(file);
+
+  if (command === "set" && key === "host" && value) {
+    rc().writematterhornrc({ ...current, host: value }, file);
+    console.log(`Saved host ${value} to ${file}`);
+    return;
+  }
+
+  if (command === "get" && key === "host") {
+    console.log(current.host || "");
+    return;
+  }
+
+  if (command === "list") {
+    console.log(JSON.stringify(current, null, 2));
+    return;
+  }
+
+  usage();
+  process.exit(1);
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
+    usage();
+    process.exit(args.length === 0 ? 1 : 0);
+  }
+  if (args[0] === "apps") {
+    listApps(console);
+    return;
+  }
+  if (args[0] === "doctor") {
+    const checks = doctor(console);
+    process.exitCode = checks.every((check) => check.ok) ? 0 : 1;
+    return;
+  }
+  if (args[0] === "configure") {
+    rc().applymatterhornrcDefaults();
+    configure(args.slice(1));
+    return;
+  }
+  rc().applymatterhornrcDefaults();
+  if (args[0] === "relay") {
+    if (args[1] === "add") {
+      addRelay(args.slice(2));
+      return;
+    }
+    if (args[1] === "invite") {
+      printRelayInvite(args.slice(2));
+      return;
+    }
+    if (args[1] === "trust") {
+      relayTrust(args.slice(2));
+      return;
+    }
+    const relayPath = path.join(__dirname, "..", "host", "relay.cjs");
+    const child = spawn(process.execPath, [relayPath, ...relayStartArgs(args.slice(1))], {
+      stdio: "inherit"
+    });
+
+    child.on("exit", (code, signal) => {
+      if (signal) {
+        process.kill(process.pid, signal);
+        return;
+      }
+      process.exit(code ?? 0);
+    });
+    return;
+  }
+  if (args[0] === "host") {
+    await matterhornApps().handleAppHostCommand(args.slice(1));
+    return;
+  }
+  if (args[0] === "launcher") {
+    matterhornApps().handleLauncherCommand(args.slice(1));
+    return;
+  }
+  if (args[0] === "launch") {
+    const code = await installs().runAppLaunchCommand(args.slice(1), console, {
+      matterhornHome: dataDir(),
+      dataDir: dataDir(),
+      defaultAppUrl: defaultAppUrl()
+    });
+    process.exitCode = code;
+    return;
+  }
+  if (args[0] === "install") {
+    const code = await installs().runAppInstallCommand(args.slice(1), console, {
+      matterhornHome: dataDir(),
+      dataDir: dataDir(),
+      defaultAppUrl: defaultAppUrl()
+    });
+    process.exitCode = code;
+    return;
+  }
+  if (args[0] === "run") {
+    const code = await installs().runInstalledAppCommand(args.slice(1), console, {
+      matterhornHome: dataDir(),
+      dataDir: dataDir(),
+      defaultAppUrl: defaultAppUrl()
+    });
+    process.exitCode = code;
+    return;
+  }
+  if (args[0] === "deploy") {
+    const code = await deploy().runAppDeployCommand(args.slice(1), console, {
+      dataDir: dataDir(),
+      defaultAppUrl: defaultAppUrl()
+    });
+    process.exitCode = code;
+    return;
+  }
+
+  const code = await appHost().runAppHostCommand(args, console, {
+    dataDir: dataDir(),
+    defaultAppUrl: defaultAppUrl()
+  });
+  process.exitCode = code;
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    console.error(error.message || error);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  addRelay,
+  configure,
+  doctor,
+  listApps,
+  main,
+  parseRelayAddArgs,
+  printRelayInvite,
+  relayStartArgs,
+  relayTrust,
+  resolveRelayReferenceForCli,
+  usage
+};