@minionry/minion 0.7.36

package/bin/commands/login.js

@@ -0,0 +1,400 @@
+
+import { exec } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { arch, hostname, type } from 'node:os';
+import { launchFlagSuffix } from '../launch-env.js';
+import { resolveClientId, rotateClientId } from '../machine-identity.js';
+import { ensureMachineDir, machineFile } from '../machine-layout.js';
+import { resolvePlatformUrl } from '../platform-endpoints.js';
+
+const colors = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  blue: '\x1b[34m',
+  red: '\x1b[31m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+};
+
+function log(msg, color = '') {
+  console.log(`${color}${msg}${colors.reset}`);
+}
+
+function accountLabel(email) {
+  if (!email) return '';
+  const at = email.lastIndexOf('@');
+  if (at <= 0) return email;
+  return email.slice(at + 1).toLowerCase().startsWith('no-email.') ? email.slice(0, at) : email;
+}
+
+function applyAppOriginOverride(url) {
+  const override = process.env.APP_ORIGIN;
+  if (!override) return url;
+  try {
+    const target = new URL(url);
+    const base = new URL(override);
+    target.protocol = base.protocol;
+    target.host = base.host;
+    return target.toString();
+  } catch {
+    return url;
+  }
+}
+
+function credentialsFile() {
+  const env = process.env.MINIONRY_ENV || 'production';
+  return machineFile(env === 'dev' ? 'platformCredentialsDev' : 'platformCredentials');
+}
+
+function resolveIdentity() {
+  const outcome = resolveClientId();
+  if (outcome.rotated) {
+    announceRebind();
+  }
+  return { clientId: outcome.clientId, fingerprint: outcome.fingerprint };
+}
+
+function announceRebind() {
+  log('');
+  log('  This home directory was last used on a different machine.', colors.yellow);
+  log('  Registering as a new device so the original keeps its Space.', colors.dim);
+  log('');
+}
+
+async function loadE2eeIdentityModule() {
+  try {
+    return await import('../../dist/server/services/e2ee-identity.js');
+  } catch {
+    try {
+      const tsx = await import('tsx/esm/api');
+      return await tsx.tsImport('../../server/services/e2ee-identity.ts', import.meta.url);
+    } catch {
+      return null;
+    }
+  }
+}
+
+async function prepareE2eeIdentity() {
+  try {
+    const mod = await loadE2eeIdentityModule();
+    if (!mod?.ensureE2eeIdentity) return null;
+    const status = await mod.ensureE2eeIdentity();
+    const key = status?.publicKey;
+    return typeof key === 'string' && /^[A-Za-z0-9_-]{43}$/.test(key) ? key : null;
+  } catch {
+    return null;
+  }
+}
+
+function isLoggedIn() {
+  if (!existsSync(credentialsFile())) {
+    return false;
+  }
+
+  try {
+    const creds = JSON.parse(readFileSync(credentialsFile(), 'utf-8'));
+    return !!(creds.token && creds.userId && creds.email);
+  } catch {
+    return false;
+  }
+}
+
+function getCredentials() {
+  if (!existsSync(credentialsFile())) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync(credentialsFile(), 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function saveCredentials(creds) {
+  ensureMachineDir('credentials');
+  writeFileSync(credentialsFile(), JSON.stringify(creds, null, 2), { mode: 0o600 });
+}
+
+function openBrowser(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    log(`\n  Invalid URL received. Please open this URL manually:`, colors.yellow);
+    log(`  ${url}\n`, colors.cyan);
+    return;
+  }
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    log(`\n  Unexpected URL protocol. Please open this URL manually:`, colors.yellow);
+    log(`  ${url}\n`, colors.cyan);
+    return;
+  }
+
+  const platform = process.platform;
+  let cmd;
+
+  if (platform === 'darwin') {
+    cmd = `open "${parsed.href}"`;
+  } else if (platform === 'win32') {
+    cmd = `start "" "${parsed.href}"`;
+  } else {
+    cmd = `xdg-open "${parsed.href}"`;
+  }
+
+  exec(cmd, (err) => {
+    if (err) {
+      log(`\n  Could not open browser automatically.`, colors.yellow);
+      log(`  Please open this URL manually:`, colors.dim);
+      log(`  ${url}\n`, colors.cyan);
+    }
+  });
+}
+
+
+const SLOW_DOWN_STEP_SECONDS = 5;
+
+const MAX_POLL_INTERVAL_SECONDS = 60;
+
+const DEFAULT_AUTH_EXPIRY_SECONDS = 900;
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function jitteredMs(seconds) {
+  return seconds * 1000 * (0.9 + Math.random() * 0.2);
+}
+
+function retryAfterSeconds(response, fallbackSeconds) {
+  const parsed = Number.parseInt(response.headers.get('retry-after') ?? '', 10);
+  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds;
+  return Math.min(seconds, MAX_POLL_INTERVAL_SECONDS);
+}
+
+async function requestDeviceCode(clientId, platformUrl, force = false, e2eePublicKey = null, machineFingerprint = null) {
+  const machineHostname = hostname();
+  const osType = type().toLowerCase();
+  const cpuArch = arch();
+  const nodeVersion = process.version;
+
+  const response = await fetch(`${platformUrl}/api/auth/device/request`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      clientId,
+      machineHostname,
+      osType,
+      cpuArch,
+      nodeVersion,
+      ...(force ? { force: true } : {}),
+      ...(e2eePublicKey ? { e2eePublicKey } : {}),
+      ...(machineFingerprint ? { machineFingerprint } : {}),
+    }),
+  });
+
+  const text = await response.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (_e) {
+    throw new Error(`Server returned invalid JSON (status ${response.status}): ${text.slice(0, 200)}`);
+  }
+
+  if (response.status === 429) {
+    const wait = retryAfterSeconds(response, Number(data.retryAfterSeconds) || SLOW_DOWN_STEP_SECONDS);
+    throw new Error(`Too many device logins from this network right now. Try again in ${wait}s.`);
+  }
+
+  if (!response.ok) {
+    throw new Error(data.error || data.message || 'Failed to request device code');
+  }
+
+  return data;
+}
+
+async function pollOnce(platformUrl, deviceCode) {
+  let response;
+  try {
+    response = await fetch(`${platformUrl}/api/auth/device/poll`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ deviceCode }),
+    });
+  } catch {
+    return null;
+  }
+
+  const text = await response.text();
+  try {
+    return { response, data: JSON.parse(text) };
+  } catch (_e) {
+    throw new Error(`Server returned invalid JSON (status ${response.status}): ${text.slice(0, 200)}`);
+  }
+}
+
+export async function pollForAuth(deviceCode, interval, platformUrl, expiresInSeconds) {
+  let intervalSeconds = interval || SLOW_DOWN_STEP_SECONDS;
+  const deadline = Date.now() + (expiresInSeconds || DEFAULT_AUTH_EXPIRY_SECONDS) * 1000;
+
+  while (Date.now() < deadline) {
+    await sleep(jitteredMs(intervalSeconds));
+
+    const result = await pollOnce(platformUrl, deviceCode);
+    if (!result) {
+      process.stdout.write('x');
+      continue;
+    }
+
+    const { response, data } = result;
+    if (response.ok) {
+      return data;
+    }
+
+    if (response.status === 429) {
+      intervalSeconds = retryAfterSeconds(response, intervalSeconds + SLOW_DOWN_STEP_SECONDS);
+      process.stdout.write('~');
+      continue;
+    }
+
+    switch (data.error) {
+      case 'authorization_pending':
+        process.stdout.write('.');
+        break;
+
+      case 'slow_down':
+        intervalSeconds = Math.min(intervalSeconds + SLOW_DOWN_STEP_SECONDS, MAX_POLL_INTERVAL_SECONDS);
+        process.stdout.write('.');
+        break;
+
+      case 'expired_token':
+        throw new Error('Authorization request expired. Please try again.');
+
+      case 'access_denied':
+        throw new Error('Authorization denied by user.');
+
+      default:
+        throw new Error(data.error || 'Unknown error during authorization');
+    }
+  }
+
+  throw new Error('Authorization timed out. Please try again.');
+}
+
+async function deregisterOldDevice(platformUrl) {
+  const existingCreds = getCredentials();
+  if (!existingCreds?.token) return;
+  try {
+    await fetch(`${platformUrl}/api/auth/device/deregister`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${existingCreds.token}`,
+      },
+    });
+  } catch {
+  }
+}
+
+async function runDeviceCodeFlow(identity, platformUrl, forceReauth, e2eePublicKey) {
+  const { clientId, fingerprint } = identity;
+  const { deviceCode, userCode, verificationUrlComplete, interval, expiresIn } = await requestDeviceCode(clientId, platformUrl, forceReauth, e2eePublicKey, fingerprint);
+
+  const verifyUrl = applyAppOriginOverride(verificationUrlComplete);
+
+  log(`Your authorization code: ${userCode}`, colors.bold);
+  log('');
+  log('Opening browser to complete login...', colors.dim);
+  log(` If browser doesn't open, visit: ${verifyUrl}`, colors.dim);
+  log('');
+
+  openBrowser(verifyUrl);
+
+  log('  Waiting for authorization', colors.dim);
+  process.stdout.write('  ');
+
+  const result = await pollForAuth(deviceCode, interval, platformUrl, expiresIn);
+
+  const credentials = {
+    token: result.accessToken,
+    userId: result.user.id,
+    email: result.user.email,
+    name: result.user.name,
+    clientId,
+    createdAt: new Date().toISOString(),
+  };
+
+  saveCredentials(credentials);
+  return result;
+}
+
+async function runDeviceCodeFlowWithRecovery(identity, platformUrl, forceReauth, e2eePublicKey) {
+  try {
+    return await runDeviceCodeFlow(identity, platformUrl, forceReauth, e2eePublicKey);
+  } catch (err) {
+    if (/client_id_conflict/i.test(err.message)) {
+      announceRebind();
+      return runDeviceCodeFlow(rotateIdentity(), platformUrl, false, e2eePublicKey);
+    }
+    if (forceReauth || !/already registered/i.test(err.message)) {
+      throw err;
+    }
+    log('  This machine was already registered — re-authenticating...', colors.dim);
+    await deregisterOldDevice(platformUrl);
+    return runDeviceCodeFlow(identity, platformUrl, true, e2eePublicKey);
+  }
+}
+
+function rotateIdentity() {
+  const outcome = rotateClientId();
+  return { clientId: outcome.clientId, fingerprint: outcome.fingerprint };
+}
+
+export async function login(args = [], options = {}) {
+  const { inline = false } = options;
+  const forceReauth = args.includes('--force') || args.includes('-f');
+  const env = process.env.MINIONRY_ENV || 'production';
+  const platformUrl = resolvePlatformUrl();
+  const envSuffix = launchFlagSuffix(env);
+
+  if (env !== 'production') {
+    log(`[${env.toUpperCase()}] Using ${platformUrl}${process.env.APP_ORIGIN ? ` (web app ${process.env.APP_ORIGIN})` : ''}\n`, colors.yellow);
+  }
+
+  if (!inline && isLoggedIn() && !forceReauth) {
+    const creds = getCredentials();
+    log(`  Already logged in as ${accountLabel(creds.email)}`, colors.green);
+    log(`  Use "minion logout${envSuffix}" to sign out, or "minion login${envSuffix} --force" to re-authenticate.\n`, colors.dim);
+    return false;
+  }
+
+  const identity = resolveIdentity();
+
+  const e2eePublicKey = await prepareE2eeIdentity();
+
+  if (forceReauth) {
+    await deregisterOldDevice(platformUrl);
+  }
+
+  log('Requesting authorization...', colors.dim);
+
+  try {
+    const result = await runDeviceCodeFlowWithRecovery(identity, platformUrl, forceReauth, e2eePublicKey);
+
+    log('');
+    log('');
+    log(`  Logged in as ${accountLabel(result.user.email)}`, colors.bold + colors.green);
+    log('');
+
+    return true;
+  } catch (err) {
+    if (inline) {
+      throw err;
+    }
+    log('');
+    log(`  Login failed: ${err.message}`, colors.red);
+    log('');
+    process.exit(1);
+  }
+}
+
+export default login;

package/bin/commands/logout.js

@@ -0,0 +1,93 @@
+
+import { existsSync, readFileSync, unlinkSync } from 'node:fs';
+import { APP_NAME } from '../branding.js';
+import { launchFlagSuffix } from '../launch-env.js';
+import { machineFile } from '../machine-layout.js';
+import { resolvePlatformUrl } from '../platform-endpoints.js';
+
+const colors = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+};
+
+function log(msg, color = '') {
+  console.log(`${color}${msg}${colors.reset}`);
+}
+
+function credentialsFile() {
+  const env = process.env.MINIONRY_ENV || 'production';
+  return machineFile(env === 'dev' ? 'platformCredentialsDev' : 'platformCredentials');
+}
+
+function getCredentials() {
+  if (!existsSync(credentialsFile())) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync(credentialsFile(), 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+async function deregisterDevice(token, platformUrl) {
+  try {
+    const response = await fetch(`${platformUrl}/api/auth/device/deregister`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${token}`,
+      },
+    });
+
+    if (!response.ok) {
+      const data = await response.json().catch(() => ({}));
+      log(`  Warning: Could not deregister device from server: ${data.error || response.statusText}`, colors.yellow);
+    }
+  } catch {
+    log('  Warning: Could not reach server to deregister device. Local credentials will still be removed.', colors.yellow);
+  }
+}
+
+export async function logout() {
+  const platformUrl = resolvePlatformUrl();
+  const envSuffix = launchFlagSuffix(process.env.MINIONRY_ENV);
+
+  log(`\n  ${APP_NAME} Logout\n`, colors.bold + colors.cyan);
+
+  const creds = getCredentials();
+
+  if (!creds) {
+    log('  Not currently logged in.', colors.yellow);
+    log(`  Use "minion login${envSuffix}" to sign in.\n`, colors.dim);
+    return;
+  }
+
+  const email = creds.email;
+
+  try {
+    if (creds.token) {
+      await deregisterDevice(creds.token, platformUrl);
+    }
+
+    if (existsSync(credentialsFile())) {
+      unlinkSync(credentialsFile());
+    }
+
+    log(`  Logged out from ${email}`, colors.green);
+    log('');
+    log('  Your device credentials have been removed.', colors.dim);
+    log(`  Use "minion login${envSuffix}" to sign in again.\n`, colors.dim);
+  } catch (err) {
+    log(`  Failed to logout: ${err.message}`, colors.red);
+    log('');
+    process.exit(1);
+  }
+}
+
+export default logout;

package/bin/commands/minions.js

@@ -0,0 +1,211 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+
+
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { machineFile, machineRoot } from '../machine-layout.js';
+
+const colors = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+};
+
+function log(msg, color = '') {
+  console.log(`${color}${msg}${colors.reset}`);
+}
+
+function readRegistry(registryPath) {
+  if (!existsSync(registryPath)) return [];
+  try {
+    const parsed = JSON.parse(readFileSync(registryPath, 'utf-8'));
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+export function mergeInstanceRows(legacy, current) {
+  const byPid = new Map();
+  for (const instance of [...legacy, ...current]) {
+    if (instance && typeof instance.pid === 'number') byPid.set(instance.pid, instance);
+  }
+  return [...byPid.values()];
+}
+
+function loadInstances() {
+  const current = readRegistry(machineFile('instances'));
+  const legacy = readRegistry(join(machineRoot(), 'instances.json'));
+  return mergeInstanceRows(legacy, current);
+}
+
+export function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === 'EPERM';
+  }
+}
+
+export function describeMinions(instances = loadInstances()) {
+  return instances
+    .map((instance) => ({
+      pid: instance.pid,
+      port: instance.port,
+      environment: instance.environment ?? 'production',
+      workingDirectory: instance.workingDirectory ?? '',
+      alive: isPidAlive(instance.pid),
+    }))
+    .sort((a, b) => a.port - b.port);
+}
+
+function printNoMinions() {
+  log('\n  No minion servers registered on this machine.\n', colors.bold);
+  log('  Start one:', colors.bold);
+  log('    minion', colors.cyan);
+  log('');
+}
+
+export function listMinions() {
+  const rows = describeMinions();
+  if (rows.length === 0) {
+    printNoMinions();
+    return;
+  }
+
+  const headers = ['PID', 'PORT', 'ENVIRONMENT', 'STATUS', 'SPACE'];
+  const cells = rows.map((row) => [
+    String(row.pid),
+    String(row.port),
+    row.environment,
+    row.alive ? 'running' : 'stale',
+    row.workingDirectory,
+  ]);
+  const widths = headers.map((header, i) => Math.max(header.length, ...cells.map((row) => row[i].length)));
+  const line = (row, color = '') =>
+    `    ${row.map((cell, i) => `${color}${i === row.length - 1 ? cell : cell.padEnd(widths[i])}${colors.reset}`).join('  ')}`;
+
+  log('');
+  console.log(line(headers, colors.dim));
+  for (const row of cells) console.log(line(row));
+  log('');
+
+  const live = rows.filter((row) => row.alive);
+  if (live.length > 0) {
+    log('  Stop one:', colors.bold);
+    log(`    minion shutdown ${live[0].pid}`, colors.cyan);
+    log('');
+    log('  Stop all:', colors.bold);
+    log('    minion shutdown all', colors.cyan);
+    log('');
+  }
+
+  const stale = rows.length - live.length;
+  if (stale > 0) {
+    log(`  ${stale} row${stale === 1 ? '' : 's'} left behind by a server that died without deregistering.`, colors.dim);
+    log('  They hold no port and the next server start clears them.\n', colors.dim);
+  }
+}
+
+function stopMinion(row) {
+  if (!isPidAlive(row.pid)) return 'gone';
+  try {
+    process.kill(row.pid, 'SIGTERM');
+    return 'stopped';
+  } catch (err) {
+    if (err.code === 'ESRCH') return 'gone';
+    if (err.code === 'EPERM') return 'denied';
+    throw err;
+  }
+}
+
+function reportDenied(count) {
+  log(`  ${count} belong${count === 1 ? 's' : ''} to another user — rerun with sudo to stop ${count === 1 ? 'it' : 'them'}.`, colors.dim);
+}
+
+function shutdownAllMinions() {
+  const rows = describeMinions();
+  const live = rows.filter((row) => row.alive);
+  if (live.length === 0) {
+    log('\n  No minion servers running on this machine.\n', colors.bold);
+    return;
+  }
+
+  log('');
+  let stopped = 0;
+  let denied = 0;
+  for (const row of live) {
+    const result = stopMinion(row);
+    if (result === 'stopped') {
+      stopped += 1;
+      log(`  Stopped ${row.pid} on port ${row.port} (${row.workingDirectory})`, colors.green);
+    } else if (result === 'denied') {
+      denied += 1;
+      log(`  Could not stop ${row.pid} on port ${row.port} — permission denied`, colors.red);
+    } else {
+      log(`  ${row.pid} was already gone`, colors.dim);
+    }
+  }
+
+  log('');
+  log(`  Stopped ${stopped} minion server${stopped === 1 ? '' : 's'}.`, colors.bold);
+  if (denied > 0) reportDenied(denied);
+  log('');
+  if (denied > 0) process.exit(1);
+}
+
+function printShutdownUsage() {
+  log('\n  Usage: minion shutdown <pid>', colors.dim);
+  log('         minion shutdown all\n', colors.dim);
+  log('  Stops a minion server running on this machine. `minion list minions`', colors.dim);
+  log('  shows the pids.\n', colors.dim);
+}
+
+export function shutdownMinion(args = []) {
+  const target = args.find((a) => !a.startsWith('-'));
+  if (!target) {
+    printShutdownUsage();
+    process.exit(1);
+  }
+
+  if (target === 'all') {
+    shutdownAllMinions();
+    return;
+  }
+
+  const pid = Number(target);
+  if (!Number.isInteger(pid) || pid <= 0) {
+    log(`\n  "${target}" is not a pid.`, colors.red);
+    printShutdownUsage();
+    process.exit(1);
+  }
+
+  const row = describeMinions().find((candidate) => candidate.pid === pid);
+  if (!row) {
+    log(`\n  No minion server on this machine is registered with pid ${pid}.\n`, colors.red);
+    log('  See what is running:', colors.bold);
+    log('    minion list minions', colors.cyan);
+    log('');
+    process.exit(1);
+  }
+
+  const result = stopMinion(row);
+  if (result === 'stopped') {
+    log(`\n  Stopped minion ${pid} on port ${row.port} (${row.workingDirectory}).\n`, colors.green);
+    return;
+  }
+  if (result === 'denied') {
+    log(`\n  Could not stop ${pid} — permission denied.`, colors.red);
+    reportDenied(1);
+    log('');
+    process.exit(1);
+  }
+  log(`\n  Minion ${pid} was already gone; its registry row is stale.\n`, colors.dim);
+}