@nomac/cli 0.2.5 → 0.3.0

package/src/transport-command.mjs

@@ -0,0 +1,91 @@
+import { createHash, randomBytes } from "node:crypto";
+import { readFileSync, statSync, writeFileSync, linkSync, unlinkSync } from "node:fs";
+import { resolve, dirname, join } from "node:path";
+import { CliError } from "./api.mjs";
+import { macRequest, sessionId } from "./mac-transport.mjs";
+
+const HELP = `Nomac 2.0 transport probe (an operator-configured SSH target; no allocation or billing)
+
+Set NOMAC_GATEWAY_URL and NOMAC_SESSION_TOKEN outside the project.
+  nomac tunnel <session>                          SSH ProxyCommand byte stream
+  nomac transport status <session>                connection capabilities
+  nomac transport exec <session> --request-key KEY [--timeout SECONDS] -- command args...
+  nomac transport job <session> <job>              inspect the existing job
+  nomac transport output <session> <job> [--cursor N] [--stream stdout|stderr]
+  nomac transport put <session> <file>             upload a checksummed probe blob (up to 8 MiB)
+  nomac transport get <session> <sha256> <file>     download a probe blob without overwriting
+
+Results are JSON. Output chunks are base64 with byte cursors, so binary output is lossless.
+Reuse the same request key after a lost response. Commands are never automatically rerun.
+Probe blobs do not yet implement project sync; ordinary SSH/rsync remains available.`;
+
+function parsed(args, allowed) {
+  const values = {};
+  for (let index = 0; index < args.length; index++) {
+    const flag = args[index];
+    if (flag === "--json") continue;
+    if (!allowed.includes(flag) || index + 1 >= args.length || values[flag] !== undefined) throw new CliError(`Unexpected transport option: ${flag}`);
+    values[flag] = args[++index];
+  }
+  return values;
+}
+
+export async function transportCommand(args, { request = macRequest, print = console.log } = {}) {
+  if (!args.length || ["help", "--help"].includes(args[0])) return print(HELP);
+  const [command, value, ...rest] = args;
+  const id = sessionId(value);
+  const base = `/api/v1/mac/sessions/${id}`;
+  let result;
+  if (command === "status") {
+    parsed(rest, []); result = await request("GET", base);
+  } else if (command === "exec") {
+    const separator = rest.indexOf("--");
+    if (separator === -1 || separator === rest.length - 1) throw new CliError("Use -- before the command and its arguments.");
+    const options = parsed(rest.slice(0, separator), ["--request-key", "--timeout"]);
+    if (!/^[A-Za-z0-9_.:-]{8,128}$/.test(options["--request-key"] ?? "")) throw new CliError("Supply a stable --request-key of 8 to 128 safe characters.");
+    const timeout = Number(options["--timeout"] ?? 60);
+    if (!Number.isInteger(timeout) || timeout < 1 || timeout > 600) throw new CliError("--timeout must be 1 to 600 seconds.");
+    result = await request("POST", `${base}/jobs`, { requestKey: options["--request-key"], body: { argv: rest.slice(separator + 1), timeout_seconds: timeout } });
+  } else if (command === "job" || command === "output") {
+    const [job, ...flags] = rest;
+    if (!/^job_[a-f0-9]{40}$/.test(job ?? "")) throw new CliError("Invalid job ID.");
+    const options = parsed(flags, command === "output" ? ["--cursor", "--stream"] : []);
+    const cursor = options["--cursor"] ?? "0", stream = options["--stream"] ?? "stdout";
+    if (!/^\d{1,16}$/.test(cursor) || !Number.isSafeInteger(Number(cursor)) || !["stdout", "stderr"].includes(stream)) throw new CliError("Invalid output stream or cursor.");
+    result = await request("GET", `${base}/jobs/${job}${command === "output" ? `/output?cursor=${cursor}&stream=${stream}` : ""}`);
+  } else if (command === "put") {
+    const [file, ...flags] = rest; parsed(flags, []);
+    if (!file) throw new CliError("Supply the file to upload.");
+    const info = statSync(file);
+    if (!info.isFile() || info.size > 8 * 1024 * 1024) throw new CliError("The probe accepts regular files up to 8 MiB.");
+    const data = readFileSync(file);
+    if (data.length > 8 * 1024 * 1024) throw new CliError("The file exceeded the probe limit.");
+    const digest = createHash("sha256").update(data).digest("hex");
+    let offset = 0;
+    do {
+      result = await request("PUT", `${base}/blobs/${digest}?size=${data.length}&offset=${offset}`, { raw: data.subarray(offset, offset + 256 * 1024) });
+      offset += 256 * 1024;
+    } while (offset < data.length && !result.complete);
+    if (!result.complete || result.id !== digest) throw new CliError("The upload was not confirmed. Retry the same file to resume.", undefined, undefined, "transfer_unconfirmed");
+  } else if (command === "get") {
+    const [digest, file, ...flags] = rest; parsed(flags, []);
+    if (!/^[a-f0-9]{64}$/.test(digest ?? "") || !file) throw new CliError("Supply the blob SHA-256 and destination file.");
+    const chunks = []; let cursor = 0, size;
+    for (;;) {
+      const chunk = await request("GET", `${base}/blobs/${digest}?cursor=${cursor}`);
+      const data = Buffer.from(chunk.data_base64 ?? "", "base64");
+      size ??= chunk.size;
+      if (chunk.id !== digest || !Number.isSafeInteger(size) || size < 0 || size > 8 * 1024 * 1024 || chunk.size !== size || chunk.cursor !== cursor || chunk.next_cursor !== cursor + data.length || chunk.next_cursor > size || (!data.length && !chunk.eof)) throw new CliError("Invalid file transfer response.", undefined, undefined, "transfer_unconfirmed");
+      chunks.push(data); cursor = chunk.next_cursor;
+      if (chunk.eof) break;
+    }
+    const data = Buffer.concat(chunks);
+    if (data.length !== size || createHash("sha256").update(data).digest("hex") !== digest) throw new CliError("Download checksum mismatch. No destination file was written.", undefined, undefined, "checksum_mismatch");
+    const destination = resolve(file), temporary = join(dirname(destination), `.nomac-download-${randomBytes(12).toString("hex")}`);
+    writeFileSync(temporary, data, { flag: "wx", mode: 0o600 });
+    try { linkSync(temporary, destination); } finally { unlinkSync(temporary); }
+    result = { id: digest, size: data.length, file: destination, complete: true };
+  } else throw new CliError(`Unknown transport command: ${command}`);
+  print(JSON.stringify(result));
+  return result;
+}

package/src/upload.mjs

@@ -9,7 +9,7 @@ export async function uploadSourceSnapshot(projectId, tarball) {
   } catch (error) {
     // Older servers have no grant route. Outages and authorization failures
     // should remain actionable, not silently retry through another transport.
-    if (!(error instanceof CliError) || error.status !== 404 || error.code) throw error;
+    if (!(error instanceof CliError) || error.status !== 404 || (error.code && error.code !== "bad_response")) throw error;
     if (tarball.length > 4 * 1024 * 1024) {
       throw new CliError("direct uploads unavailable", "This server does not support direct source uploads. Update the server or reduce the compressed archive to 4 MiB.");
     }