@nocoo/bat 3.1.2 → 3.2.0

package/dist/bat.js

@@ -3093,7 +3093,7 @@ var init_connect = () => {};
 var init_settings = () => {};
 
 // ../shared/dist/version.js
-var BAT_VERSION = "3.1.2";
+var BAT_VERSION = "3.2.0";
 
 // ../shared/dist/workstations.js
 function fail(error) {
@@ -3205,6 +3205,9 @@ function ipFamily(input) {
   }
   return null;
 }
+function isPkceS256Challenge(input) {
+  return PKCE_CHALLENGE_PATTERN.test(input);
+}
 function isPkceCodeVerifier(input) {
   return PKCE_VERIFIER_PATTERN.test(input);
 }
@@ -3665,7 +3668,65 @@ function validateWorkstationLoginExchange(input) {
     }
   };
 }
-var WORKSTATION_INTERVAL_SECONDS = 600, WORKSTATION_PING_COUNT = 3, WORKSTATION_MAX_TARGETS = 100, WORKSTATION_BODY_MAX_BYTES = 65536, WORKSTATION_REPORT_SKEW_SECONDS = 300, WORKSTATION_MAX_RUN_MS = 120000, WORKSTATION_STALE_AFTER_SECONDS, WORKSTATION_LIMITS, WORKSTATION_CONNECTIVITY_STATUSES, UUID_PATTERN, IPV4_PATTERN, PKCE_VERIFIER_PATTERN, WORKSTATION_TOKEN_PATTERN, IPV6_CHARS, REPORT_KEYS, CPU_KEYS, MEM_KEYS, DISK_KEYS, NETWORK_KEYS, INTERFACE_KEYS, ADDRESS_KEYS, CONNECTIVITY_KEYS, TARGET_KEYS, TARGETS_RESPONSE_KEYS, LOGIN_EXCHANGE_KEYS;
+function normalizePairingCode(input) {
+  const compact = input.replace(/[\s-]/g, "").toUpperCase();
+  if (compact.length !== WORKSTATION_PAIRING_LENGTH) {
+    return null;
+  }
+  for (const character of compact) {
+    if (!WORKSTATION_PAIRING_ALPHABET.includes(character)) {
+      return null;
+    }
+  }
+  return compact;
+}
+function formatPairingCode(code) {
+  const normalized = normalizePairingCode(code);
+  if (normalized === null) {
+    return code;
+  }
+  return `${normalized.slice(0, 4)}-${normalized.slice(4)}`;
+}
+function isPairingCode(input) {
+  return normalizePairingCode(input) !== null;
+}
+function validateWorkstationName(input) {
+  const name = readString("name", input, WORKSTATION_NAME_MAX_LENGTH);
+  if (!name.ok) {
+    return name;
+  }
+  if (name.value.trim() === "") {
+    return fail("name must not be blank");
+  }
+  return { ok: true, value: name.value.trim() };
+}
+function validateWorkstationPairStart(input) {
+  const root = readObject("pair", input, PAIR_START_KEYS);
+  if (!root.ok) {
+    return root;
+  }
+  const installationId = readUuid("installation_id", root.value.installation_id);
+  if (!installationId.ok) {
+    return installationId;
+  }
+  const name = validateWorkstationName(root.value.name);
+  if (!name.ok) {
+    return name;
+  }
+  const challenge = root.value.code_challenge;
+  if (typeof challenge !== "string" || !isPkceS256Challenge(challenge)) {
+    return fail("code_challenge must be a 43 character base64url S256 digest");
+  }
+  return {
+    ok: true,
+    value: {
+      installation_id: installationId.value,
+      name: name.value,
+      code_challenge: challenge
+    }
+  };
+}
+var WORKSTATION_INTERVAL_SECONDS = 600, WORKSTATION_PING_COUNT = 3, WORKSTATION_MAX_TARGETS = 100, WORKSTATION_BODY_MAX_BYTES = 65536, WORKSTATION_REPORT_SKEW_SECONDS = 300, WORKSTATION_MAX_RUN_MS = 120000, WORKSTATION_STALE_AFTER_SECONDS, WORKSTATION_NAME_MAX_LENGTH = 64, WORKSTATION_PAIRING_TTL_SECONDS = 300, WORKSTATION_PAIRING_ALPHABET = "ABCDEFGHJKMNPQRSTVWXYZ23456789", WORKSTATION_PAIRING_LENGTH = 8, WORKSTATION_LIMITS, WORKSTATION_CONNECTIVITY_STATUSES, UUID_PATTERN, IPV4_PATTERN, PKCE_CHALLENGE_PATTERN, PKCE_VERIFIER_PATTERN, WORKSTATION_TOKEN_PATTERN, IPV6_CHARS, REPORT_KEYS, CPU_KEYS, MEM_KEYS, DISK_KEYS, NETWORK_KEYS, INTERFACE_KEYS, ADDRESS_KEYS, CONNECTIVITY_KEYS, TARGET_KEYS, TARGETS_RESPONSE_KEYS, LOGIN_EXCHANGE_KEYS, PAIR_START_KEYS;
 var init_workstations = __esm(() => {
   WORKSTATION_STALE_AFTER_SECONDS = WORKSTATION_INTERVAL_SECONDS * 3;
   WORKSTATION_LIMITS = {
@@ -3701,6 +3762,7 @@ var init_workstations = __esm(() => {
   ];
   UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
   IPV4_PATTERN = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+  PKCE_CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
   PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
   WORKSTATION_TOKEN_PATTERN = /^batw_[A-Za-z0-9_-]{43}$/;
   IPV6_CHARS = /^[0-9a-f:.]+$/i;
@@ -3740,6 +3802,7 @@ var init_workstations = __esm(() => {
   TARGET_KEYS = ["server_id", "name", "address", "family"];
   TARGETS_RESPONSE_KEYS = ["data", "interval_seconds", "ping_count"];
   LOGIN_EXCHANGE_KEYS = ["code", "code_verifier", "installation_id"];
+  PAIR_START_KEYS = ["installation_id", "name", "code_challenge"];
 });
 
 // ../shared/dist/index.js
@@ -4058,6 +4121,54 @@ async function revokeWorkstationKey(workerUrl, token, options = {}) {
     throw err;
   }
 }
+async function startPairing(origins, input, options = {}) {
+  const validated = validateWorkstationPairStart(input);
+  if (!validated.ok) {
+    throw new Error(`invalid pairing request: ${validated.error}`);
+  }
+  const client = new HttpClient(origins.machine, undefined, options.timeoutMs ?? REQUEST_TIMEOUT_MS, options.signal);
+  const raw = await client.post("/api/workstation-auth/pair", validated.value);
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error("pairing start returned no object");
+  }
+  const record = raw;
+  if (typeof record.pairing_code !== "string" || !isPairingCode(record.pairing_code)) {
+    throw new Error("pairing start returned no valid pairing_code");
+  }
+  if (typeof record.code !== "string" || record.code.length < 32) {
+    throw new Error("pairing start returned no valid exchange code");
+  }
+  if (typeof record.expires_at !== "number" || !Number.isFinite(record.expires_at)) {
+    throw new Error("pairing start returned no expiry");
+  }
+  return {
+    pairing_code: record.pairing_code,
+    code: record.code,
+    name: typeof record.name === "string" ? record.name : "",
+    expires_at: record.expires_at
+  };
+}
+async function pairingStatus(origins, pairingCode, options = {}) {
+  const normalized = normalizePairingCode(pairingCode);
+  if (normalized === null) {
+    throw new Error("invalid pairing code");
+  }
+  const client = new HttpClient(origins.machine, undefined, options.timeoutMs ?? REQUEST_TIMEOUT_MS, options.signal);
+  const raw = await client.get(`/api/workstation-auth/pair/${normalized}`);
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error("pairing status returned no object");
+  }
+  const record = raw;
+  const status = record.status;
+  if (status !== "pending" && status !== "approved" && status !== "expired") {
+    throw new Error("pairing status returned an unknown state");
+  }
+  return {
+    status,
+    name: typeof record.name === "string" ? record.name : "",
+    expires_at: typeof record.expires_at === "number" ? record.expires_at : 0
+  };
+}
 var REQUEST_TIMEOUT_MS = 30000, UPLOAD_ATTEMPTS = 3, RETRY_BASE_MS = 500;
 var init_api2 = __esm(() => {
   init_dist4();
@@ -4506,6 +4617,89 @@ var init_store = __esm(() => {
   init_plan();
 });
 
+// src/workstation/headless.ts
+async function performHeadlessLogin(deps) {
+  const now = deps.now ?? (() => Math.floor(Date.now() / 1000));
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const installationId = await ensureInstallationId(deps.paths, deps.store);
+  const pkce = generatePkce();
+  let start;
+  try {
+    start = await (deps.start ?? startPairing)(deps.origins, {
+      installation_id: installationId,
+      name: deps.name,
+      code_challenge: pkce.challenge
+    });
+  } catch (err) {
+    error(`Pairing failed: ${err.message}`);
+    return null;
+  }
+  (deps.announce ?? defaultAnnounce)({
+    code: formatPairingCode(start.pairing_code),
+    url: `${deps.origins.dashboard}/workstations`,
+    name: start.name,
+    expiresAt: start.expires_at
+  });
+  const deadline = Math.min(start.expires_at, now() + WORKSTATION_PAIRING_TTL_SECONDS);
+  for (;; ) {
+    if (deps.signal?.aborted) {
+      error("Pairing cancelled");
+      return null;
+    }
+    if (now() >= deadline) {
+      error("Pairing code expired before it was approved");
+      return null;
+    }
+    await sleep(PAIRING_POLL_MS);
+    let status;
+    try {
+      status = await (deps.status ?? pairingStatus)(deps.origins, start.pairing_code, {
+        ...deps.signal ? { signal: deps.signal } : {}
+      });
+    } catch (err) {
+      error(`Pairing status failed: ${err.message}`);
+      return null;
+    }
+    if (status.status === "expired") {
+      error("Pairing code expired before it was approved");
+      return null;
+    }
+    if (status.status === "approved") {
+      break;
+    }
+  }
+  let credential;
+  try {
+    credential = await (deps.exchange ?? exchangeLogin)(deps.origins, {
+      code: start.code,
+      code_verifier: pkce.verifier,
+      installation_id: installationId
+    });
+  } catch (err) {
+    error(`Login exchange failed: ${err.message}`);
+    return null;
+  }
+  await writeCredential(deps.paths, credential, deps.store);
+  return { installationId, credential };
+}
+function defaultAnnounce(text) {
+  info(`Pairing code: ${text.code}`);
+  info(`  name: ${text.name}`);
+  info(`  approve at: ${text.url} → "Pair a workstation"`);
+  info(`  expires: ${new Date(text.expiresAt * 1000).toLocaleTimeString()}`);
+  info("");
+  info("Waiting for approval...");
+  success("(leave this terminal open)");
+}
+var PAIRING_POLL_MS = 5000;
+var init_headless = __esm(() => {
+  init_dist4();
+  init_output();
+  init_api2();
+  init_login2();
+  init_store();
+});
+
 // src/workstation/login.ts
 import { createHash, randomBytes as randomBytes2 } from "node:crypto";
 import { hostname as osHostname } from "node:os";
@@ -4565,8 +4759,18 @@ async function performWorkstationLogin(deps) {
 async function runWorkstationLogin(deps) {
   info(`Dashboard: ${deps.origins.dashboard}`);
   info(`Ingest: ${deps.origins.machine}`);
-  info("Opening browser for workstation authorization...");
-  const outcome = await performWorkstationLogin(deps);
+  if (deps.headless === undefined) {
+    info("Opening browser for workstation authorization...");
+  } else {
+    info(`Headless pairing for "${deps.headless.name}" — no browser on this machine.`);
+  }
+  const outcome = deps.headless === undefined ? await performWorkstationLogin(deps) : await performHeadlessLogin({
+    paths: deps.paths,
+    origins: deps.origins,
+    name: deps.headless.name,
+    ...deps.store ? { store: deps.store } : {},
+    ...deps.headless.announce ? { announce: deps.headless.announce } : {}
+  });
   if (!outcome) {
     return { exitCode: 1 };
   }
@@ -4593,6 +4797,7 @@ var init_login2 = __esm(() => {
   init_dist3();
   init_output();
   init_api2();
+  init_headless();
   init_store();
 });
 
@@ -4703,10 +4908,15 @@ async function runLoginCommand(deps = {}) {
     const paths = getWorkstationPaths();
     const origins = resolveOrigins(deps.loopbackUrl);
     const store = storeDepsFor(process.platform);
+    if (deps.headless === true && (deps.name ?? "").trim() === "") {
+      error("Headless login needs --name so the workstation is identifiable before approval.");
+      return 1;
+    }
     const { exitCode, report } = await runWorkstationLogin({
       paths,
       origins,
-      ...store ? { store } : {}
+      ...store ? { store } : {},
+      ...deps.headless === true ? { headless: { name: (deps.name ?? "").trim() } } : {}
     });
     if (exitCode !== 0 || !report) {
       return exitCode;
@@ -4734,11 +4944,21 @@ var init_login3 = __esm(() => {
       "loopback-url": {
         type: "string",
         description: "Loopback Worker origin for local acceptance (never production)"
+      },
+      headless: {
+        type: "boolean",
+        description: "Print a five minute pairing code instead of opening a browser"
+      },
+      name: {
+        type: "string",
+        description: "Display name claimed by a headless pairing"
       }
     },
     async run({ args }) {
       process.exitCode = await runLoginCommand({
-        ...args["loopback-url"] ? { loopbackUrl: args["loopback-url"] } : {}
+        ...args["loopback-url"] ? { loopbackUrl: args["loopback-url"] } : {},
+        ...args.headless ? { headless: true } : {},
+        ...typeof args.name === "string" ? { name: args.name } : {}
       });
     }
   });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nocoo/bat",
-	"version": "3.1.2",
+	"version": "3.2.0",
 	"description": "bat CLI — manage agents, assets and bindings for bat.hexly.ai",
 	"type": "module",
 	"bin": {