@minionry/minion 0.7.36

package/bin/commands/whoami.js

@@ -0,0 +1,153 @@
+
+import { existsSync, readFileSync } from 'node:fs';
+import { arch, hostname, type } from 'node:os';
+import { APP_NAME } from '../branding.js';
+import { launchFlagSuffix } from '../launch-env.js';
+import { machineFile } from '../machine-layout.js';
+import { resolvePlatformUrl } from '../platform-endpoints.js';
+
+const colors = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+};
+
+function log(msg, color = '') {
+  console.log(`${color}${msg}${colors.reset}`);
+}
+
+function usernameFromEmail(email) {
+  if (!email) return '';
+  const at = email.lastIndexOf('@');
+  return at > 0 ? email.slice(0, at) : email;
+}
+
+const PLATFORM_URL = resolvePlatformUrl();
+
+function credentialsFile() {
+  const env = process.env.MINIONRY_ENV || 'production';
+  return machineFile(env === 'dev' ? 'platformCredentialsDev' : 'platformCredentials');
+}
+
+function getCredentials() {
+  if (!existsSync(credentialsFile())) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync(credentialsFile(), 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function getClientId() {
+  const clientIdFile = machineFile('clientId');
+  if (!existsSync(clientIdFile)) {
+    return null;
+  }
+  try {
+    return readFileSync(clientIdFile, 'utf-8').trim();
+  } catch {
+    return null;
+  }
+}
+
+async function verifyToken(token) {
+  try {
+    const response = await fetch(`${PLATFORM_URL}/api/auth/device/verify`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      },
+    });
+
+    if (!response.ok) {
+      const data = await response.json();
+      return { valid: false, error: data.error };
+    }
+
+    return await response.json();
+  } catch (_err) {
+    return { valid: false, error: 'Network error' };
+  }
+}
+
+function formatDate(dateStr) {
+  if (!dateStr) return 'Unknown';
+  const date = new Date(dateStr);
+  return date.toLocaleDateString('en-US', {
+    year: 'numeric',
+    month: 'short',
+    day: 'numeric',
+    hour: '2-digit',
+    minute: '2-digit',
+  });
+}
+
+export async function whoami(args = []) {
+  const verbose = args.includes('--verbose') || args.includes('-v');
+  const env = process.env.MINIONRY_ENV || 'production';
+  const envSuffix = launchFlagSuffix(env);
+
+  log(`\n  ${APP_NAME} Account\n`, colors.bold + colors.cyan);
+
+  const creds = getCredentials();
+  const clientId = getClientId();
+
+  if (!creds) {
+    log('  Not logged in.', colors.yellow);
+    log(`  Use "minion login${envSuffix}" to sign in.\n`, colors.dim);
+    process.exit(1);
+  }
+
+  const offline = args.includes('--offline');
+  let verified = null;
+
+  if (!offline) {
+    process.stdout.write('  Verifying with server...');
+    verified = await verifyToken(creds.token);
+
+    if (!verified.valid) {
+      console.log('');
+      log('');
+      log(`  Session invalid: ${verified.error}`, colors.red);
+      log(`  Use "minion login${envSuffix}" to re-authenticate.\n`, colors.dim);
+      process.exit(1);
+    }
+
+    process.stdout.write('\r                            \r');
+  }
+
+  const user = verified?.user || creds;
+
+  log(`  Username: ${usernameFromEmail(user.email)}`, colors.bold);
+  if (user.name) {
+    log(`  Name:     ${user.name}`, colors.dim);
+  }
+
+  log('');
+  log('  Device Information', colors.bold);
+  log(`  Hostname: ${hostname()}`, colors.dim);
+  log(`  OS:       ${type()} (${arch()})`, colors.dim);
+  log(`  Node:     ${process.version}`, colors.dim);
+
+  if (verbose) {
+    log('');
+    log('  Credentials', colors.bold);
+    log(`  Client ID:  ${clientId || 'Not set'}`, colors.dim);
+    log(`  Logged in:  ${formatDate(creds.createdAt)}`, colors.dim);
+    if (creds.lastRefreshedAt) {
+      log(`  Refreshed:  ${formatDate(creds.lastRefreshedAt)}`, colors.dim);
+    }
+    log(`  Creds file: ${credentialsFile()}`, colors.dim);
+  }
+
+  log('');
+}
+
+export default whoami;

package/bin/launch-env.js

@@ -0,0 +1,35 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+
+import { readFileSync } from 'node:fs'
+
+
+export function readLaunchFlags(manifestUrl = new URL('../package.json', import.meta.url)) {
+  try {
+    return JSON.parse(readFileSync(manifestUrl, 'utf-8')).minionry?.launchFlags ?? {}
+  } catch {
+    return {}
+  }
+}
+
+export function resolveLaunchTargets(args, flags = readLaunchFlags()) {
+  let minionryEnv = null
+  let appOrigin = null
+  let fixedServer = null
+  let argServer = null
+  for (const [flag, spec] of Object.entries(flags)) {
+    const at = args.indexOf(flag)
+    if (at === -1) continue
+    minionryEnv ??= spec.env ?? null
+    appOrigin ??= spec.appOrigin ?? null
+    fixedServer ??= spec.server ?? null
+    if (spec.serverArg && args[at + 1]) argServer ??= args[at + 1]
+  }
+  return { minionryEnv: minionryEnv ?? 'production', appOrigin, serverUrl: argServer ?? fixedServer }
+}
+
+export function launchFlagSuffix(env, flags = readLaunchFlags()) {
+  if (!env || env === 'production') return ''
+  const flag = Object.entries(flags).find(([, spec]) => spec.env === env)?.[0]
+  return flag ? ` ${flag}` : ''
+}

package/bin/machine-identity.js

@@ -0,0 +1,221 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+
+
+import { execFileSync } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { hostname, networkInterfaces, platform } from 'node:os';
+import { ensureMachineDir, machineFile } from './machine-layout.js';
+
+const BINDING_VERSION = 1;
+
+const MAX_REMEMBERED_MACS = 32;
+
+const NULL_MAC = '00:00:00:00:00:00';
+
+const DISABLE_ENV = 'MINIONRY_NO_CLONE_DETECTION';
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+
+function runCommand(file, args) {
+  try {
+    return execFileSync(file, args, {
+      encoding: 'utf-8',
+      timeout: 2000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return null;
+  }
+}
+
+function linuxMachineId() {
+  for (const path of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+    try {
+      if (!existsSync(path)) continue;
+      const value = readFileSync(path, 'utf-8').trim();
+      if (value) return value;
+    } catch {
+    }
+  }
+  return null;
+}
+
+function darwinMachineId() {
+  const out = runCommand('/usr/sbin/ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice']);
+  return out?.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)?.[1] ?? null;
+}
+
+function windowsMachineId() {
+  const out = runCommand('reg', [
+    'query',
+    'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography',
+    '/v',
+    'MachineGuid',
+  ]);
+  return out?.match(/MachineGuid\s+REG_SZ\s+(\S+)/i)?.[1] ?? null;
+}
+
+const MACHINE_ID_SOURCES = Object.freeze({
+  linux: linuxMachineId,
+  darwin: darwinMachineId,
+  win32: windowsMachineId,
+});
+
+export function readPlatformMachineId() {
+  try {
+    return MACHINE_ID_SOURCES[platform()]?.() ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function readMacAddresses() {
+  const found = new Set();
+  try {
+    for (const addresses of Object.values(networkInterfaces())) {
+      for (const address of addresses ?? []) {
+        if (address.internal) continue;
+        const mac = address.mac?.toLowerCase();
+        if (mac && mac !== NULL_MAC) found.add(mac);
+      }
+    }
+  } catch {
+  }
+  return [...found].sort();
+}
+
+export function collectMachineSignals() {
+  return {
+    machineId: readPlatformMachineId(),
+    macs: readMacAddresses(),
+    hostname: hostname() || null,
+  };
+}
+
+export function fingerprintOf(signals) {
+  const canonical = JSON.stringify({
+    machineId: signals.machineId ?? '',
+    macs: [...signals.macs].sort(),
+    hostname: signals.hostname ?? '',
+  });
+  return createHash('sha256').update(canonical).digest('hex').slice(0, 32);
+}
+
+
+export function classifyMachineChange(recorded, current) {
+  if (!recorded) return 'unknown';
+
+  const knownMacs = recorded.macs ?? [];
+  const haveMacsBothSides = knownMacs.length > 0 && current.macs.length > 0;
+
+  if (haveMacsBothSides && current.macs.some((mac) => knownMacs.includes(mac))) {
+    return 'same';
+  }
+
+  if (!haveMacsBothSides) return 'unknown';
+
+  const machineIdDiffers =
+    !!recorded.machineId && !!current.machineId && recorded.machineId !== current.machineId;
+  const hostnameDiffers =
+    !!recorded.hostname && !!current.hostname && recorded.hostname !== current.hostname;
+
+  return machineIdDiffers || hostnameDiffers ? 'cloned' : 'unknown';
+}
+
+
+function bindingPath() {
+  return machineFile('clientIdBinding');
+}
+
+function readBinding() {
+  try {
+    const path = bindingPath();
+    if (!existsSync(path)) return null;
+    const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+    if (parsed?.v !== BINDING_VERSION || typeof parsed.clientId !== 'string') return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function writeBinding(clientId, signals, knownMacs) {
+  try {
+    ensureMachineDir('state');
+    const record = {
+      v: BINDING_VERSION,
+      clientId,
+      machineId: signals.machineId,
+      hostname: signals.hostname,
+      macs: knownMacs.slice(0, MAX_REMEMBERED_MACS),
+      boundAt: new Date().toISOString(),
+    };
+    writeFileSync(bindingPath(), JSON.stringify(record, null, 2), { mode: 0o600 });
+  } catch {
+  }
+}
+
+function mergeKnownMacs(recorded, current) {
+  return [...new Set([...current.macs, ...(recorded?.macs ?? [])])];
+}
+
+
+function readClientIdFile() {
+  try {
+    const path = machineFile('clientId');
+    if (!existsSync(path)) return null;
+    const id = readFileSync(path, 'utf-8').trim();
+    return UUID_RE.test(id) ? id : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeClientIdFile(clientId) {
+  ensureMachineDir('state');
+  writeFileSync(machineFile('clientId'), clientId, 'utf-8');
+  return clientId;
+}
+
+export function resolveClientId() {
+  const signals = collectMachineSignals();
+  const fingerprint = fingerprintOf(signals);
+  const existing = readClientIdFile();
+  const binding = readBinding();
+
+  if (!existing) {
+    const minted = writeClientIdFile(randomUUID());
+    writeBinding(minted, signals, signals.macs);
+    return { clientId: minted, fingerprint, rotated: false, previousClientId: null };
+  }
+
+  const baseline = binding?.clientId === existing ? binding : null;
+  const verdict = process.env[DISABLE_ENV] ? 'same' : classifyMachineChange(baseline, signals);
+
+  if (verdict !== 'cloned') {
+    writeBinding(existing, signals, mergeKnownMacs(baseline, signals));
+    return { clientId: existing, fingerprint, rotated: false, previousClientId: null };
+  }
+
+  const minted = writeClientIdFile(randomUUID());
+  writeBinding(minted, signals, signals.macs);
+  return { clientId: minted, fingerprint, rotated: true, previousClientId: existing };
+}
+
+export function rotateClientId() {
+  const signals = collectMachineSignals();
+  const previousClientId = readClientIdFile();
+  const minted = writeClientIdFile(randomUUID());
+  writeBinding(minted, signals, signals.macs);
+  return {
+    clientId: minted,
+    fingerprint: fingerprintOf(signals),
+    rotated: true,
+    previousClientId,
+  };
+}
+
+export const CLONE_DETECTION_DISABLE_ENV = DISABLE_ENV;

package/bin/machine-layout.js

@@ -0,0 +1,200 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+
+
+import { chmodSync, existsSync, linkSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+export const MACHINE_DIRNAME = '.minionry';
+
+export const MACHINE_LAYOUT = Object.freeze({
+  credentials: 'credentials',
+  config: 'config',
+  state: 'state',
+  cache: 'cache',
+  run: 'run',
+  logs: 'logs',
+  native: 'native',
+  sandboxes: 'sandboxes',
+  prompts: 'prompts',
+  snippets: 'snippets',
+});
+
+export const MACHINE_FILES = Object.freeze({
+  platformCredentials: Object.freeze(['credentials', 'platform.json']),
+  platformCredentialsDev: Object.freeze(['credentials', 'platform-dev.json']),
+  sessionToken: Object.freeze(['credentials', 'session-token']),
+  e2eeIdentity: Object.freeze(['credentials', 'e2ee-identity']),
+  engineCredentials: Object.freeze(['credentials', 'auth.json']),
+  modelProfiles: Object.freeze(['credentials', 'model-profiles.json']),
+  settings: Object.freeze(['config', 'settings.json']),
+  telemetry: Object.freeze(['config', 'telemetry.json']),
+  devEnv: Object.freeze(['config', '.env']),
+  clientId: Object.freeze(['state', 'client-id']),
+  clientIdBinding: Object.freeze(['state', 'client-id-binding']),
+  instances: Object.freeze(['state', 'instances.json']),
+  appGrants: Object.freeze(['state', 'app-grants.json']),
+  frecency: Object.freeze(['state', 'autocomplete-frecency.json']),
+  ptySetupDismissed: Object.freeze(['state', 'pty-setup-dismissed']),
+  modelCatalog: Object.freeze(['cache', 'model-catalog.json']),
+  updateCheck: Object.freeze(['cache', 'update-check.json']),
+  sessionSlots: Object.freeze(['run', 'session-slots']),
+});
+
+export const LEGACY_MACHINE_MOVES = Object.freeze([
+  Object.freeze(['credentials.json', 'platformCredentials', 'copy']),
+  Object.freeze(['credentials-dev.json', 'platformCredentialsDev', 'copy']),
+  Object.freeze(['session-token', 'sessionToken', 'copy']),
+  Object.freeze(['e2ee-identity', 'e2eeIdentity', 'copy']),
+  Object.freeze(['settings.json', 'settings', 'copy']),
+  Object.freeze(['client-id', 'clientId', 'copy']),
+  Object.freeze(['app-grants.json', 'appGrants', 'move']),
+  Object.freeze(['config.json', 'telemetry', 'move']),
+  Object.freeze(['.env', 'devEnv', 'move']),
+  Object.freeze(['instances.json', 'instances', 'move']),
+  Object.freeze(['autocomplete-frecency.json', 'frecency', 'move']),
+  Object.freeze(['.pty-setup-dismissed', 'ptySetupDismissed', 'move']),
+  Object.freeze(['model-catalog.json', 'modelCatalog', 'move']),
+  Object.freeze(['update-check.json', 'updateCheck', 'move']),
+]);
+
+const LEGACY_MCP_CONFIG_RE = /^mcp-config(?:-[0-9a-f-]{36})?\.json$/i;
+const LEGACY_MCP_CONFIG_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+export function machineRoot() {
+  return join(homedir(), MACHINE_DIRNAME);
+}
+
+export function machinePath(entry, ...rest) {
+  const dirname = MACHINE_LAYOUT[entry];
+  if (typeof dirname !== 'string') throw new TypeError(`Unknown machine layout entry: ${String(entry)}`);
+  ensureMachineLayout();
+  const path = join(machineRoot(), dirname, ...rest);
+  return legacyFallbacks.get(path) ?? path;
+}
+
+export function machineFile(key) {
+  const spec = MACHINE_FILES[key];
+  if (!spec) throw new TypeError(`Unknown machine file: ${String(key)}`);
+  return machinePath(spec[0], spec[1]);
+}
+
+export function machineLockPath(name) {
+  return machinePath('run', `${name}.lock`);
+}
+
+export function ensureMachineDir(entry) {
+  const dir = machinePath(entry);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  return dir;
+}
+
+
+const migratedRoots = new Set();
+const legacyFallbacks = new Map();
+function report(message, err) {
+  if (err === undefined) console.warn(`[MachineLayout] ${message}`);
+  else console.warn(`[MachineLayout] ${message}`, err);
+}
+
+export function ensureMachineLayout() {
+  const root = machineRoot();
+  if (migratedRoots.has(root)) return;
+  migratedRoots.add(root);
+  if (!existsSync(root)) return;
+
+  const credentialsDir = join(root, MACHINE_LAYOUT.credentials);
+  try {
+    mkdirSync(credentialsDir, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32') chmodSync(credentialsDir, 0o700);
+  } catch (err) {
+    report(`Could not restrict ${credentialsDir} to 0700:`, err);
+  }
+
+  for (const [legacyName, key, strategy] of LEGACY_MACHINE_MOVES) {
+    const [entry, name] = MACHINE_FILES[key];
+    migrateLegacyEntry(join(root, legacyName), join(root, MACHINE_LAYOUT[entry], name), strategy);
+  }
+
+  sweepStaleRootMcpConfigs(root);
+}
+
+function migrateLegacyEntry(from, to, strategy) {
+  if (!existsSync(from)) return;
+  if (existsSync(to)) {
+    if (strategy === 'move') {
+      report(`${from} is a leftover from before the machine layout and is ignored; ${to} is the live copy`);
+    } else if (isNewerThan(from, to)) {
+      report(`${from} was written after its copy at ${to}, by a \`minion\` started before this layout; that change is not visible at the new location — restart every \`minion\` on this machine, then delete the root copy`);
+    }
+    return;
+  }
+  try {
+    mkdirSync(join(to, '..'), { recursive: true, mode: 0o700 });
+    if (strategy === 'copy') {
+      placeCopy(from, to);
+      report(`Copied ${from} → ${to}; the original stays for \`minion\` processes started before this layout and can be deleted once they are all restarted`);
+    } else if (placeNoClobber(from, to)) {
+      unlinkSync(from);
+      report(`Moved ${from} → ${to}`);
+    }
+  } catch (err) {
+    if (existsSync(to)) return;
+    legacyFallbacks.set(to, from);
+    report(`Could not bring ${from} to ${to}; this process keeps using the old location and will retry on its next start:`, err);
+  }
+}
+
+function placeCopy(from, to) {
+  const mode = statSync(from).mode & 0o777;
+  const staging = `${to}.${process.pid}.tmp`;
+  writeFileSync(staging, readFileSync(from), { mode });
+  chmodSync(staging, mode);
+  try {
+    placeNoClobber(staging, to);
+  } finally {
+    rmSync(staging, { force: true });
+  }
+}
+
+function placeNoClobber(from, to) {
+  try {
+    linkSync(from, to);
+    return true;
+  } catch (err) {
+    const code = err?.code;
+    if (code === 'EEXIST') return false;
+    if (code === 'EXDEV' || code === 'EPERM' || code === 'ENOTSUP' || code === 'EACCES') {
+      renameSync(from, to);
+      return true;
+    }
+    throw err;
+  }
+}
+
+function isNewerThan(from, to) {
+  try {
+    return statSync(from).mtimeMs > statSync(to).mtimeMs + 1000;
+  } catch {
+    return false;
+  }
+}
+
+function sweepStaleRootMcpConfigs(root) {
+  let names = [];
+  try {
+    names = readdirSync(root);
+  } catch {
+    return;
+  }
+  const now = Date.now();
+  for (const name of names) {
+    if (!LEGACY_MCP_CONFIG_RE.test(name)) continue;
+    const file = join(root, name);
+    try {
+      if (now - statSync(file).mtimeMs > LEGACY_MCP_CONFIG_MAX_AGE_MS) rmSync(file, { force: true });
+    } catch {
+    }
+  }
+}