@minionry/minion 0.7.36

package/bin/commands/sandboxes.js

@@ -0,0 +1,309 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+
+
+import {
+  buildMemoryInspectArgs,
+  buildRenameCommands,
+  buildSandboxListArgs,
+  buildUncapCommands,
+  findSandbox,
+  formatMemoryCap,
+  parseMemoryCaps,
+  parseRenameArgs,
+  parseRestartArgs,
+  parseSandboxRows,
+  SANDBOX_IMAGE_TAG,
+  sandboxNames,
+  sandboxVolume,
+  validateSandboxName,
+  withoutSeccompProfile,
+} from '../sandbox-config.js';
+import {
+  confirm,
+  createAsker,
+  IMAGE_BUILD_ARGS,
+  imagePathFor,
+  requireDocker,
+  runCapture,
+  takenDockerNames,
+} from './create-sandbox.js';
+
+const colors = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+};
+
+function log(msg, color = '') {
+  console.log(`${color}${msg}${colors.reset}`);
+}
+
+async function loadSandboxes() {
+  const listed = await runCapture('docker', buildSandboxListArgs());
+  if (!listed.ok) {
+    log(`\n  Could not list containers: ${listed.stderr.trim() || `docker exited with code ${listed.code}`}\n`, colors.red);
+    process.exit(1);
+  }
+
+  const rows = parseSandboxRows(listed.stdout);
+  if (rows.length === 0) return [];
+
+  const inspected = await runCapture('docker', buildMemoryInspectArgs(rows.map((row) => row.container)));
+  const caps = inspected.ok ? parseMemoryCaps(inspected.stdout) : new Map();
+
+  return rows
+    .map((row) => ({ ...row, memoryBytes: caps.get(row.container) ?? 0 }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+function printNoSandboxes() {
+  log('\n  No sandboxes on this machine yet.\n', colors.bold);
+  log('  Create one:', colors.bold);
+  log('    minion create sandbox', colors.cyan);
+  log('');
+}
+
+function diskCell(row) {
+  if (row.diskGb && row.diskCapped) return `${row.diskGb} GB cap`;
+  if (row.diskGb) return `${row.diskGb} GB (not enforced)`;
+  return 'uncapped';
+}
+
+function printUncapHelp(capped) {
+  const [first, ...rest] = capped;
+  log('  A memory cap is fixed for the life of a container. Lift one by replacing the', colors.dim);
+  log('  container — its disk volume, and everything in /home/minion, survives:', colors.dim);
+  log(`    minion restart sandbox ${first.name} --uncap`, colors.cyan);
+  if (rest.length > 0) {
+    log(`  Same for: ${rest.map((row) => row.name).join(', ')}`, colors.dim);
+  }
+  log('');
+}
+
+export async function listSandboxes() {
+  await requireDocker();
+  const sandboxes = await loadSandboxes();
+  if (sandboxes.length === 0) {
+    printNoSandboxes();
+    return;
+  }
+
+  const headers = ['SANDBOX', 'STATUS', 'MEMORY', 'DISK'];
+  const rows = sandboxes.map((row) => {
+    const cap = formatMemoryCap(row.memoryBytes);
+    return [row.name, row.status, cap ? `${cap} cap` : 'uncapped', diskCell(row)];
+  });
+  const widths = headers.map((header, i) => Math.max(header.length, ...rows.map((cells) => cells[i].length)));
+  const line = (cells, color = '') =>
+    `    ${cells.map((cell, i) => `${color}${i === cells.length - 1 ? cell : cell.padEnd(widths[i])}${colors.reset}`).join('  ')}`;
+
+  log('');
+  console.log(line(headers, colors.dim));
+  for (const cells of rows) console.log(line(cells));
+  log('');
+  log('  Enter one:', colors.bold);
+  const running = sandboxes.find((row) => row.status.startsWith('Up')) ?? sandboxes[0];
+  log(`    docker exec -it ${running.container} zsh`, colors.cyan);
+  log('');
+  log('  Rename one:', colors.bold);
+  log(`    minion rename sandbox ${running.name} <new-name>`, colors.cyan);
+  log('');
+
+  const capped = sandboxes.filter((row) => row.memoryBytes > 0);
+  if (capped.length > 0) printUncapHelp(capped);
+}
+
+function printCarryOver() {
+  log('  The volume is remounted, so /home/minion — the toolchain, your Spaces,', colors.dim);
+  log('  everything in it — carries over untouched. Anything installed OUTSIDE', colors.dim);
+  log('  /home/minion (apt packages, /etc edits) is not in the volume and would', colors.dim);
+  log('  need doing again.\n', colors.dim);
+}
+
+async function replaceContainer(sandbox, { commands, explain, confirmText }) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    log('\n  This replaces the sandbox\'s container, so it asks first — run it from a terminal.\n', colors.red);
+    process.exit(1);
+  }
+
+  if (!(await runCapture('docker', ['image', 'inspect', SANDBOX_IMAGE_TAG])).ok) {
+    log(`\n  The ${SANDBOX_IMAGE_TAG} image is gone, so the container cannot be rebuilt.`, colors.red);
+    log('  Nothing was changed. Restore the image first, then re-run this:', colors.dim);
+    log(`    docker build ${IMAGE_BUILD_ARGS.join(' ')}`, colors.cyan);
+    log('');
+    process.exit(1);
+  }
+
+  const [remove, run] = commands;
+  explain();
+  log(`    docker ${remove.join(' ')}`, colors.cyan);
+  log(`    docker ${run.join(' ')}`, colors.cyan);
+  log('');
+
+  const { rl, question } = createAsker();
+  const confirmed = await confirm(question, confirmText, { defaultYes: false });
+  rl.close();
+  if (!confirmed) {
+    log('\n  Cancelled — nothing was changed.\n', colors.dim);
+    process.exit(0);
+  }
+
+  log(`\n  Replacing ${sandbox.container}...`, colors.bold);
+  const removed = await runCapture('docker', remove);
+  if (!removed.ok) {
+    log(`\n  docker rm failed: ${removed.stderr.trim()}`, colors.red);
+    log('  The sandbox was left exactly as it was.\n', colors.dim);
+    process.exit(1);
+  }
+
+  let started = await runCapture('docker', run);
+  if (!started.ok && /seccomp/i.test(started.stderr)) {
+    log(`  This Docker daemon rejected the browser seccomp profile — retrying without it: ${started.stderr.trim()}`, colors.yellow);
+    await runCapture('docker', ['rm', '-f', run[run.indexOf('--name') + 1]]);
+    started = await runCapture('docker', withoutSeccompProfile(run));
+  }
+  if (!started.ok) {
+    log(`\n  The container was removed but did not come back: ${started.stderr.trim()}`, colors.red);
+    log('  The disk volume is untouched — nothing in /home/minion was lost. Retry with:', colors.dim);
+    log(`    docker ${run.join(' ')}`, colors.cyan);
+    log('');
+    process.exit(1);
+  }
+}
+
+async function uncapSandbox(sandbox) {
+  const cap = formatMemoryCap(sandbox.memoryBytes);
+  if (!cap) {
+    log(`\n  "${sandbox.name}" has no memory cap — nothing to lift.`, colors.dim);
+    return false;
+  }
+
+  await replaceContainer(sandbox, {
+    commands: buildUncapCommands(sandbox),
+    confirmText: `  Replace "${sandbox.name}" now?`,
+    explain: () => {
+      log(`\n  Sandbox "${sandbox.name}" has a ${cap} memory cap.\n`, colors.bold);
+      log('  A cap is fixed for the life of a container, so lifting it means replacing', colors.dim);
+      log('  the container.', colors.dim);
+      printCarryOver();
+    },
+  });
+
+  log(`  Sandbox "${sandbox.name}" is running with no memory cap.\n`, colors.bold + colors.green);
+  log('  Enter it:', colors.bold);
+  log(`    docker exec -it ${sandbox.container} zsh`, colors.cyan);
+  log('');
+  return true;
+}
+
+async function resolveSandbox(input) {
+  await requireDocker();
+  const sandboxes = await loadSandboxes();
+  if (sandboxes.length === 0) {
+    printNoSandboxes();
+    process.exit(1);
+  }
+
+  const sandbox = findSandbox(sandboxes, input);
+  if (!sandbox) {
+    log(`\n  No sandbox named "${input}" on this machine.`, colors.red);
+    log(`  You have: ${sandboxes.map((row) => row.name).join(', ')}\n`, colors.dim);
+    process.exit(1);
+  }
+  return sandbox;
+}
+
+async function requireFreeContainerName(newName) {
+  const { container } = sandboxNames(newName);
+  if (!(await takenDockerNames()).includes(container)) return;
+
+  log(`\n  The name "${newName}" is taken — a container called "${container}" already exists.`, colors.red);
+  log('  Nothing was changed. Pick another name, or clear that one first:', colors.dim);
+  log(`    docker rm -f ${container}`, colors.cyan);
+  log('');
+  process.exit(1);
+}
+
+export async function renameSandbox(args = []) {
+  const parsed = parseRenameArgs(args);
+  if (!parsed.ok) {
+    log(`\n  ${parsed.error}`, colors.red);
+    log('  Usage: minion rename sandbox <current-name> <new-name>', colors.dim);
+    log('         See what you have: minion list sandboxes\n', colors.dim);
+    process.exit(1);
+  }
+
+  const invalid = validateSandboxName(parsed.to);
+  if (invalid) {
+    log(`\n  ${invalid}\n`, colors.red);
+    process.exit(1);
+  }
+
+  const sandbox = await resolveSandbox(parsed.from);
+  if (sandbox.name === parsed.to) {
+    log(`\n  Sandbox "${sandbox.name}" is already called that — nothing to do.\n`, colors.dim);
+    return;
+  }
+  await requireFreeContainerName(parsed.to);
+
+  const wasStopped = !sandbox.status.startsWith('Up');
+
+  await replaceContainer(sandbox, {
+    commands: buildRenameCommands(sandbox, parsed.to),
+    confirmText: `  Rename "${sandbox.name}" to "${parsed.to}" now?`,
+    explain: () => {
+      log(`\n  Renaming "${sandbox.name}" to "${parsed.to}" replaces its container.\n`, colors.bold);
+      log('  A sandbox\'s name is also its hostname — the machine name it reports to', colors.dim);
+      log('  Minionry — and a hostname is fixed for the life of a container, so the', colors.dim);
+      log('  container is rebuilt under the new name. Its memory cap, disk cap and', colors.dim);
+      log('  restart policy come across unchanged.', colors.dim);
+      printCarryOver();
+      log('  The disk keeps the name it was made with — Docker cannot rename a volume —', colors.dim);
+      log(`  which is why the command below still mounts ${sandboxVolume(sandbox)}.`, colors.dim);
+      if (sandbox.diskCapped) log(`  Its disk image stays at ${imagePathFor(sandbox.name)}.`, colors.dim);
+      log('');
+      if (wasStopped) log('  The sandbox is stopped; the replacement brings it back up.\n', colors.yellow);
+    },
+  });
+
+  const renamed = sandboxNames(parsed.to);
+  log(`  Sandbox "${sandbox.name}" is now "${parsed.to}".\n`, colors.bold + colors.green);
+  log('  Enter it:', colors.bold);
+  log(`    docker exec -it ${renamed.container} zsh`, colors.cyan);
+  log('');
+  log(`  ${colors.dim}Every minion command now takes "${parsed.to}" — "${sandbox.name}" no longer resolves.${colors.reset}`);
+  log(`  ${colors.dim}Inside the sandbox, re-run "minion" so it re-registers under the new hostname.${colors.reset}`);
+  log('');
+}
+
+export async function restartSandbox(args = []) {
+  const parsed = parseRestartArgs(args);
+  if (!parsed.ok) {
+    log(`\n  ${parsed.error}`, colors.red);
+    log('  Usage: minion restart sandbox <name> [--uncap]', colors.dim);
+    log('         See what you have: minion list sandboxes\n', colors.dim);
+    process.exit(1);
+  }
+
+  const sandbox = await resolveSandbox(parsed.name);
+
+  if (parsed.uncap && (await uncapSandbox(sandbox))) return;
+
+  log(`\n  Restarting ${sandbox.name}...`, colors.bold);
+  const restart = await runCapture('docker', ['restart', sandbox.container]);
+  if (!restart.ok) {
+    log(`\n  docker restart failed: ${restart.stderr.trim()}`, colors.red);
+    log(`  Inspect it with: docker logs ${sandbox.container}\n`, colors.dim);
+    process.exit(1);
+  }
+
+  log(`  Sandbox "${sandbox.name}" is running.\n`, colors.bold + colors.green);
+  log('  Enter it:', colors.bold);
+  log(`    docker exec -it ${sandbox.container} zsh`, colors.cyan);
+  log('');
+}

package/bin/commands/status.js

@@ -0,0 +1,298 @@
+
+import { existsSync, readFileSync } from 'node:fs';
+import { arch, hostname, type } from 'node:os';
+import { APP_NAME } from '../branding.js';
+import { launchFlagSuffix } from '../launch-env.js';
+import { machineFile } from '../machine-layout.js';
+import { resolvePlatformUrl } from '../platform-endpoints.js';
+
+const colors = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+};
+
+function log(msg, color = '') {
+  console.log(`${color}${msg}${colors.reset}`);
+}
+
+function usernameFromEmail(email) {
+  if (!email) return '';
+  const at = email.lastIndexOf('@');
+  return at > 0 ? email.slice(0, at) : email;
+}
+
+const PLATFORM_URL = resolvePlatformUrl();
+
+function credentialsFile() {
+  const env = process.env.MINIONRY_ENV || 'production';
+  return machineFile(env === 'dev' ? 'platformCredentialsDev' : 'platformCredentials');
+}
+
+function getCredentials() {
+  if (!existsSync(credentialsFile())) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync(credentialsFile(), 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function getClientId() {
+  const clientIdFile = machineFile('clientId');
+  if (!existsSync(clientIdFile)) {
+    return null;
+  }
+  try {
+    return readFileSync(clientIdFile, 'utf-8').trim();
+  } catch {
+    return null;
+  }
+}
+
+function getE2eePublicKey() {
+  const identityFile = machineFile('e2eeIdentity');
+  if (!existsSync(identityFile)) {
+    return null;
+  }
+  try {
+    const record = JSON.parse(readFileSync(identityFile, 'utf-8'));
+    const key = record?.publicKey;
+    return typeof key === 'string' && /^[A-Za-z0-9_-]{43}$/.test(key) ? key : null;
+  } catch {
+    return null;
+  }
+}
+
+async function checkPlatform() {
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 5000);
+
+    const response = await fetch(`${PLATFORM_URL}/health`, {
+      signal: controller.signal,
+    });
+
+    clearTimeout(timeoutId);
+
+    if (response.ok) {
+      const data = await response.json();
+      return { online: true, data };
+    }
+
+    return { online: false, error: `HTTP ${response.status}` };
+  } catch (err) {
+    return { online: false, error: err.name === 'AbortError' ? 'Timeout' : err.message };
+  }
+}
+
+async function verifyToken(token) {
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 5000);
+
+    const response = await fetch(`${PLATFORM_URL}/api/auth/device/verify`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      },
+      signal: controller.signal,
+    });
+
+    clearTimeout(timeoutId);
+
+    if (!response.ok) {
+      const data = await response.json();
+      return { valid: false, error: data.error };
+    }
+
+    return await response.json();
+  } catch (err) {
+    return { valid: false, error: err.name === 'AbortError' ? 'Timeout' : err.message };
+  }
+}
+
+async function getBrowserStatus() {
+  const ctx = readMinionryContext();
+  if (!ctx) return { transports: [] };
+
+  const transports = [];
+  for (const instance of ctx.aliveInstances) {
+    const data = await fetchBrowserTransport(instance.port, ctx.token);
+    if (!data) continue;
+    if (Array.isArray(data.transports)) transports.push(...data.transports);
+  }
+  return { transports };
+}
+
+function readMinionryContext() {
+  try {
+    const instancesPath = machineFile('instances');
+    const tokenPath = machineFile('sessionToken');
+    if (!existsSync(instancesPath) || !existsSync(tokenPath)) return null;
+
+    const instances = JSON.parse(readFileSync(instancesPath, 'utf-8'));
+    const token = readFileSync(tokenPath, 'utf-8').trim();
+    if (!Array.isArray(instances) || !token) return null;
+
+    const now = Date.now();
+    const aliveInstances = instances.filter(
+      (i) => now - i.lastHeartbeat < 2 * 60 * 1000,
+    );
+    return { token, aliveInstances };
+  } catch {
+    return null;
+  }
+}
+
+async function fetchBrowserTransport(port, token) {
+  try {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 1500);
+    const res = await fetch(`http://localhost:${port}/api/browser/transport`, {
+      headers: { 'x-session-token': token },
+      signal: controller.signal,
+    });
+    clearTimeout(timeoutId);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+const TRANSPORT_LABELS = {
+  'webrtc-x11-p2p': 'WebRTC P2P (x11)',
+  'webrtc-x11-turn': 'WebRTC TURN (x11)',
+  'webrtc-wayland-p2p': 'WebRTC P2P (wayland)',
+  'webrtc-wayland-turn': 'WebRTC TURN (wayland)',
+  'webrtc-macos-p2p': 'WebRTC P2P (macos)',
+  'webrtc-macos-turn': 'WebRTC TURN (macos)',
+  cdp: 'CDP screencast (fallback)',
+};
+
+function transportLabel(kind) {
+  return TRANSPORT_LABELS[kind] ?? kind;
+}
+
+export async function status() {
+  const env = process.env.MINIONRY_ENV || 'production';
+  const envSuffix = launchFlagSuffix(env);
+
+  log(`\n  ${APP_NAME} Status\n`, colors.bold + colors.cyan);
+
+  const creds = getCredentials();
+  const clientId = getClientId();
+
+  printDeviceBlock(clientId);
+  const platformStatus = await printPlatformBlock();
+  if (!(await printAuthBlock(creds, platformStatus, envSuffix))) return;
+  printEncryptionBlock();
+  await printBrowserBlock();
+  printCommandsBlock(envSuffix);
+}
+
+function printEncryptionBlock() {
+  const publicKey = getE2eePublicKey();
+  log('  Encryption', colors.bold);
+  if (publicKey) {
+    log(`    Status:     ${colors.green}End-to-end ready${colors.reset}`, colors.dim);
+    log(`    Key:        ${publicKey.slice(0, 12)}...`, colors.dim);
+    log(`    ${colors.dim}Run "minion fingerprint" to verify a browser is talking to this machine.${colors.reset}`, colors.dim);
+  } else {
+    log(`    Status:     ${colors.yellow}Not set up${colors.reset} (this machine will connect in cleartext)`, colors.dim);
+  }
+  log('');
+}
+
+function printDeviceBlock(clientId) {
+  log('  Device', colors.bold);
+  log(`    Hostname:   ${hostname()}`, colors.dim);
+  log(`    OS:         ${type()} (${arch()})`, colors.dim);
+  log(`    Node:       ${process.version}`, colors.dim);
+  log(`    Client ID:  ${clientId ? `${clientId.slice(0, 8)}...` : 'Not set'}`, colors.dim);
+  log('');
+}
+
+async function printPlatformBlock() {
+  log('  Platform', colors.bold);
+  log(`    URL:        ${PLATFORM_URL}`, colors.dim);
+  process.stdout.write('    Status:     Checking...');
+  const platformStatus = await checkPlatform();
+  process.stdout.write('\r                              \r');
+
+  if (platformStatus.online) {
+    log(`    Status:     ${colors.green}Online${colors.reset}`, colors.dim);
+    if (platformStatus.data?.relay) {
+      const relay = platformStatus.data.relay;
+      log(`    Apps:        ${relay.pairedClients || 0} connected`, colors.dim);
+    }
+  } else {
+    log(`    Status:     ${colors.red}Offline${colors.reset} (${platformStatus.error})`, colors.dim);
+  }
+  log('');
+  return platformStatus;
+}
+
+async function printAuthBlock(creds, platformStatus, envSuffix) {
+  log('  Authentication', colors.bold);
+  if (!creds) {
+    log(`    Status:     ${colors.yellow}Not logged in${colors.reset}`, colors.dim);
+    log('');
+    log(`  Run "minion login${envSuffix}" to authenticate this device.`, colors.dim);
+    log('');
+    return false;
+  }
+  log(`    Username:   ${usernameFromEmail(creds.email)}`, colors.dim);
+  if (platformStatus.online) {
+    await printSessionStatus(creds.token, envSuffix);
+  } else {
+    log(`    Session:    ${colors.yellow}Cannot verify (platform offline)${colors.reset}`, colors.dim);
+  }
+  log('');
+  return true;
+}
+
+async function printBrowserBlock() {
+  const browser = await getBrowserStatus();
+  if (browser.transports.length === 0) return;
+  log('  Browser', colors.bold);
+  for (const t of browser.transports) {
+    const label = transportLabel(t.kind);
+    const reason = t.reason ? `  ${colors.dim}(reason: ${t.reason})${colors.reset}` : '';
+    log(`    Transport:  ${label}${reason}`, colors.dim);
+  }
+  log('');
+}
+
+async function printSessionStatus(token, envSuffix) {
+  process.stdout.write('    Session:    Verifying...');
+  const tokenStatus = await verifyToken(token);
+  process.stdout.write('\r                              \r');
+  if (tokenStatus.valid) {
+    log(`    Session:    ${colors.green}Valid${colors.reset}`, colors.dim);
+    return;
+  }
+  log(`    Session:    ${colors.red}Invalid${colors.reset} (${tokenStatus.error})`, colors.dim);
+  log('');
+  log(`  Run "minion login${envSuffix}" to re-authenticate.`, colors.dim);
+}
+
+function printCommandsBlock(envSuffix) {
+  log('  Commands', colors.bold);
+  log(`    minion${envSuffix}             Start a machine`, colors.dim);
+  log(`    minion login${envSuffix}       Sign in to your account`, colors.dim);
+  log(`    minion logout${envSuffix}      Sign out`, colors.dim);
+  log(`    minion whoami${envSuffix}      Show account details`, colors.dim);
+  log(`    minion fingerprint${envSuffix} Verify encryption (safety number)`, colors.dim);
+  log('');
+}
+
+export default status;