@newly/cli 0.1.2 → 0.1.91

package/dist/commands/boxAccess.js

@@ -0,0 +1,349 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
+import { homedir, hostname as localHostname } from 'node:os';
+import { join } from 'node:path';
+import WebSocket, { createWebSocketStream } from 'ws';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials } from '../config.js';
+export function noteDeprecated(oldCommand, replacement) {
+    process.stderr.write(`runcloud: '${oldCommand}' is deprecated — use '${replacement}'\n`);
+}
+function api() {
+    const credentials = requireCredentials();
+    return new ApiClient(credentials.apiUrl, credentials.token);
+}
+async function resolveBox(client, reference) {
+    const response = await client.get('/run-cloud/boxes');
+    const boxes = (response?.items ?? []);
+    const box = boxes.find((item) => item.id === reference ||
+        item.sandboxId === reference ||
+        item.name === reference ||
+        item.hostname === reference);
+    if (!box) {
+        throw new Error(`No exposed sandbox matches ${reference}. Publish it first with \`runcloud sandbox expose ${reference} --name <name>\`, or use \`runcloud sandbox shell ${reference}\` without SSH.`);
+    }
+    return box;
+}
+async function resolveSandboxId(client, reference) {
+    const response = await client.get('/run-cloud/sandboxes');
+    const sandboxes = (response?.items ?? []);
+    const sandbox = sandboxes.find((item) => item.id === reference || item.name === reference);
+    if (sandbox?.id)
+        return sandbox.id;
+    return (await resolveBox(client, reference)).sandboxId ?? reference;
+}
+export async function writeSandboxFile(client, sandboxId, path, content) {
+    const chunkSize = 512 * 1024;
+    const count = Math.max(1, Math.ceil(content.byteLength / chunkSize));
+    for (let index = 0; index < count; index += 1) {
+        const offset = index * chunkSize;
+        const chunk = content.subarray(offset, Math.min(content.byteLength, offset + chunkSize));
+        const response = await client.post(`/run-cloud/sandboxes/${encodeURIComponent(sandboxId)}/fs`, {
+            op: 'write',
+            path,
+            offset,
+            content: chunk.toString('base64'),
+            truncate: index === 0,
+        });
+        if (response?.error)
+            throw new Error(String(response.error));
+        const expectedNextOffset = offset + chunk.byteLength;
+        if (chunk.byteLength > 0
+            && (!Number.isSafeInteger(response?.next_offset)
+                || response.next_offset !== expectedNextOffset)) {
+            throw new Error('file write chunk was not acknowledged; the file may be incomplete');
+        }
+    }
+}
+async function readSandboxFile(client, sandboxId, path) {
+    const chunks = [];
+    let offset = 0;
+    for (;;) {
+        const response = await client.post(`/run-cloud/sandboxes/${encodeURIComponent(sandboxId)}/fs`, {
+            op: 'read',
+            path,
+            offset,
+            length: 512 * 1024,
+        });
+        if (response?.error)
+            throw new Error(String(response.error));
+        const chunk = Buffer.from(String(response?.content ?? ''), 'base64');
+        chunks.push(chunk);
+        const next = Number(response?.next_offset ?? offset + chunk.byteLength);
+        if (response?.eof === true || chunk.byteLength === 0)
+            break;
+        if (!Number.isSafeInteger(next) || next <= offset)
+            throw new Error('file read did not advance');
+        offset = next;
+    }
+    return Buffer.concat(chunks);
+}
+function sshHome() {
+    const base = process.env.RUN_CLOUD_HOME || join(homedir(), '.run-cloud');
+    return join(base, 'ssh');
+}
+function keyPath() {
+    return join(sshHome(), 'id_ed25519');
+}
+function exec(command, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: 'inherit' });
+        child.once('error', reject);
+        child.once('exit', (code, signal) => {
+            if (signal)
+                reject(new Error(`${command} exited on signal ${signal}`));
+            else
+                resolve(code ?? 1);
+        });
+    });
+}
+async function ensureSshKey(client, box) {
+    mkdirSync(sshHome(), { recursive: true, mode: 0o700 });
+    const privateKey = keyPath();
+    const publicKey = `${privateKey}.pub`;
+    if (!existsSync(privateKey) || !existsSync(publicKey)) {
+        const generated = spawnSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', `runcloud@${localHostname()}`, '-f', privateKey], { stdio: 'inherit' });
+        if (generated.error)
+            throw generated.error;
+        if (generated.status !== 0)
+            throw new Error(`ssh-keygen failed (${generated.status})`);
+    }
+    chmodSync(privateKey, 0o600);
+    await client.post(`/run-cloud/boxes/${encodeURIComponent(box.id)}/ssh-keys`, {
+        publicKey: readFileSync(publicKey, 'utf8').trim(),
+        label: `${localHostname()} (Run Cloud CLI)`,
+    });
+    return privateKey;
+}
+function sshAlias(box) {
+    return `runcloud-${box.name}`;
+}
+function writeSshConfig(box, privateKey) {
+    const sshDir = join(homedir(), '.ssh');
+    const configPath = join(sshDir, 'config');
+    mkdirSync(sshDir, { recursive: true, mode: 0o700 });
+    const current = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
+    const start = `# BEGIN RUN CLOUD ${box.id}`;
+    const end = `# END RUN CLOUD ${box.id}`;
+    const block = [
+        start,
+        `Host ${sshAlias(box)}`,
+        `  HostName ${box.hostname}`,
+        '  User runcloud',
+        `  IdentityFile "${privateKey}"`,
+        '  IdentitiesOnly yes',
+        '  StrictHostKeyChecking accept-new',
+        `  UserKnownHostsFile "${join(sshHome(), 'known_hosts')}"`,
+        `  ProxyCommand runcloud sandbox proxy ${box.id}`,
+        end,
+    ].join('\n');
+    const pattern = new RegExp(`${start.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}[\\s\\S]*?${end.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\n?`, 'g');
+    const next = `${current.replace(pattern, '').trimEnd()}${current.trim() ? '\n\n' : ''}${block}\n`;
+    writeFileSync(configPath, next, { mode: 0o600 });
+    chmodSync(configPath, 0o600);
+    return sshAlias(box);
+}
+async function setupSsh(reference) {
+    const client = api();
+    const box = await resolveBox(client, reference);
+    const privateKey = await ensureSshKey(client, box);
+    return { box, alias: writeSshConfig(box, privateKey) };
+}
+function output(value, opts) {
+    if (opts.json)
+        console.log(JSON.stringify(value, null, 2));
+    else if (typeof value === 'string')
+        console.log(value);
+    else {
+        for (const [key, item] of Object.entries(value)) {
+            console.log(`${key}: ${typeof item === 'object' ? JSON.stringify(item) : String(item)}`);
+        }
+    }
+}
+function action(fn) {
+    return fn().catch((error) => {
+        console.error(friendlyApiError(error));
+        process.exitCode = 1;
+    });
+}
+function openUrl(url) {
+    if (process.platform === 'darwin')
+        return exec('open', [url]);
+    if (process.platform === 'win32')
+        return exec('cmd', ['/c', 'start', '', url]);
+    return exec('xdg-open', [url]);
+}
+const REFERENCE_HELP = 'sandbox id, box id, name, or hostname';
+export function registerAccessCommands(parent, opts = {}) {
+    const note = (verb) => {
+        if (opts.deprecated)
+            noteDeprecated(`box ${verb}`, `sandbox ${verb}`);
+    };
+    parent
+        .command('setup-ssh')
+        .description('Install a dedicated key and write this host to ~/.ssh/config')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .action((reference) => {
+        note('setup-ssh');
+        return action(async () => {
+            const configured = await setupSsh(reference);
+            console.log(`SSH configured: ssh ${configured.alias}`);
+        });
+    });
+    parent
+        .command('proxy', { hidden: true })
+        .description('Authenticated WebSocket transport used by SSH ProxyCommand')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .action((reference) => action(async () => {
+        const client = api();
+        const resolved = await resolveBox(client, reference);
+        const access = (await client.post(`/run-cloud/boxes/${encodeURIComponent(resolved.id)}/access-tickets`, { purpose: 'ssh' }));
+        if (!access.websocketUrl)
+            throw new Error('SSH ticket response has no WebSocket URL');
+        const socket = new WebSocket(access.websocketUrl, {
+            headers: { 'x-run-cloud-access-ticket': access.ticket },
+        });
+        const stream = createWebSocketStream(socket, { encoding: undefined });
+        process.stdin.pipe(stream);
+        stream.pipe(process.stdout);
+        await new Promise((resolve, reject) => {
+            stream.once('close', resolve);
+            stream.once('error', reject);
+            socket.once('error', reject);
+        });
+    }));
+    parent
+        .command('ssh')
+        .description('Open a shell in an exposed sandbox')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .argument('[command...]', 'optional remote command')
+        .action((reference, command) => {
+        note('ssh');
+        return action(async () => {
+            const configured = await setupSsh(reference);
+            const code = await exec('ssh', [configured.alias, ...command]);
+            if (code !== 0)
+                process.exitCode = code;
+        });
+    });
+    parent
+        .command('cp')
+        .description('Copy a file directly; prefix the remote path with a colon')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .argument('<source>', 'local path or :/remote/path')
+        .argument('<destination>', 'local path or :/remote/path')
+        .option('-r, --recursive', 'copy directories recursively', false)
+        .action((reference, source, destination, cmdOpts) => {
+        note('cp');
+        return action(async () => {
+            if (source.startsWith(':') === destination.startsWith(':')) {
+                throw new Error('Exactly one path must be remote (prefix it with :)');
+            }
+            if (!cmdOpts.recursive) {
+                const client = api();
+                const sandboxId = await resolveSandboxId(client, reference);
+                if (source.startsWith(':')) {
+                    writeFileSync(destination, await readSandboxFile(client, sandboxId, source.slice(1)));
+                }
+                else {
+                    await writeSandboxFile(client, sandboxId, destination.slice(1), readFileSync(source));
+                }
+                return;
+            }
+            const configured = await setupSsh(reference);
+            const remote = (path) => path.startsWith(':') ? `${configured.alias}:${path.slice(1)}` : path;
+            const args = [
+                ...(cmdOpts.recursive ? ['-r'] : []),
+                '--',
+                remote(source),
+                remote(destination),
+            ];
+            const code = await exec('scp', args);
+            if (code !== 0)
+                process.exitCode = code;
+        });
+    });
+    parent
+        .command('code')
+        .description('Open an exposed sandbox in VS Code Remote SSH')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .argument('[path]', 'remote folder', '/workspace')
+        .option('--no-open', 'print the VS Code URL without opening it')
+        .action((reference, path, cmdOpts) => {
+        note('code');
+        return action(async () => {
+            const configured = await setupSsh(reference);
+            const remotePath = path.startsWith('/') ? path : `/${path}`;
+            const url = `vscode://vscode-remote/ssh-remote+${encodeURIComponent(configured.alias)}` +
+                remotePath.split('/').map(encodeURIComponent).join('/');
+            if (cmdOpts.open === false)
+                console.log(url);
+            else
+                await openUrl(url);
+        });
+    });
+    const domain = parent.command('domain').description('Manage custom domains');
+    const domainNote = (verb) => {
+        if (opts.deprecated)
+            noteDeprecated(`box domain ${verb}`, `sandbox domain ${verb}`);
+    };
+    domain
+        .command('add')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .argument('<hostname>', 'custom hostname')
+        .option('--json', 'output JSON', false)
+        .action((reference, hostname, cmdOpts) => {
+        domainNote('add');
+        return action(async () => {
+            const client = api();
+            const resolved = await resolveBox(client, reference);
+            output(await client.post(`/run-cloud/boxes/${encodeURIComponent(resolved.id)}/domains`, {
+                hostname,
+            }), cmdOpts);
+        });
+    });
+    domain
+        .command('list')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .option('--json', 'output JSON', false)
+        .action((reference, cmdOpts) => {
+        domainNote('list');
+        return action(async () => {
+            const client = api();
+            const resolved = await resolveBox(client, reference);
+            const response = await client.get(`/run-cloud/boxes/${encodeURIComponent(resolved.id)}/domains`);
+            const items = response?.items ?? [];
+            if (cmdOpts.json)
+                console.log(JSON.stringify(items, null, 2));
+            else
+                for (const item of items)
+                    output(item, cmdOpts);
+        });
+    });
+    domain
+        .command('status')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .argument('<domain-id>', 'domain id from `domain list`')
+        .option('--json', 'output JSON', false)
+        .action((reference, domainId, cmdOpts) => {
+        domainNote('status');
+        return action(async () => {
+            const client = api();
+            const resolved = await resolveBox(client, reference);
+            output(await client.post(`/run-cloud/boxes/${encodeURIComponent(resolved.id)}/domains/${encodeURIComponent(domainId)}/refresh`), cmdOpts);
+        });
+    });
+    domain
+        .command('rm')
+        .argument('<sandbox>', REFERENCE_HELP)
+        .argument('<domain-id>', 'domain id from `domain list`')
+        .action((reference, domainId) => {
+        domainNote('rm');
+        return action(async () => {
+            const client = api();
+            const resolved = await resolveBox(client, reference);
+            await client.delete(`/run-cloud/boxes/${encodeURIComponent(resolved.id)}/domains/${encodeURIComponent(domainId)}`);
+            console.log(`removed custom domain ${domainId}`);
+        });
+    });
+}