@nowcrew/daemon 0.5.28 → 0.5.29

package/dist/computer-profile.js

@@ -0,0 +1,364 @@
+import { access, chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, posix, resolve, win32 } from "node:path";
+import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { z } from "zod";
+import { acquireProfileSaveLock, } from "./computer-profile-lock.js";
+import { formatDaemonText } from "./i18n.js";
+const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
+const ServerUrlSchema = z.string().url().max(2048).refine((value) => {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+}, "serverUrl must be an HTTP(S) URL without embedded credentials");
+const ProfileSchema = z.object({
+    version: z.literal(1),
+    name: z.string().regex(PROFILE_NAME),
+    serverUrl: ServerUrlSchema,
+    machineToken: z.string().startsWith("sk_machine_").max(4096),
+    agentsRoot: z.string().min(1).optional(),
+    runtimePath: z.string().min(1).max(32768).refine((value) => !value.includes("\0") && !value.includes("\n") && !value.includes("\r"), "runtimePath must be a single line").optional(),
+}).strict();
+const ProfileAgentsRootCandidateSchema = ProfileSchema.pick({
+    name: true,
+    serverUrl: true,
+    agentsRoot: true,
+}).strict();
+const StoredPlainProfileSchema = ProfileSchema;
+const StoredProtectedProfileSchema = ProfileSchema.omit({ machineToken: true }).extend({
+    machineTokenProtected: z.object({
+        scheme: z.literal("dpapi-current-user"),
+        ciphertext: z.string().min(1).max(16384),
+    }).strict(),
+}).strict();
+const StoredProfileSchema = z.union([StoredPlainProfileSchema, StoredProtectedProfileSchema]);
+export const PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE = "Profile '{{profile}}' conflicts with profile '{{conflict}}': both resolve to agents root '{{agentsRoot}}'. Save it with a unique root, for example: {{command}}";
+export class ProfileAgentsRootConflictError extends Error {
+    profile;
+    conflict;
+    agentsRoot;
+    command;
+    constructor(input) {
+        const quote = input.platform === "win32" ? quotePowerShellArgument : quotePosixArgument;
+        const pathApi = input.platform === "win32" ? win32 : posix;
+        const suggestedRoot = resolveAgentsRoot(pathApi.join(input.userHome, ".crew", `agents-${input.profile}`), input.userHome, input.platform);
+        const command = [
+            "crew-daemon profile save",
+            quote(input.profile),
+            "--server-url",
+            quote(input.serverUrl),
+            "--agents-root",
+            quote(suggestedRoot),
+            "--token-stdin",
+        ].join(" ");
+        super(formatDaemonText("en", PROFILE_AGENTS_ROOT_CONFLICT_MESSAGE, {
+            profile: input.profile,
+            conflict: input.conflict,
+            agentsRoot: input.agentsRoot,
+            command,
+        }));
+        this.name = "ProfileAgentsRootConflictError";
+        this.profile = input.profile;
+        this.conflict = input.conflict;
+        this.agentsRoot = input.agentsRoot;
+        this.command = command;
+    }
+}
+const quotePosixArgument = (value) => `'${value.replaceAll("'", `'"'"'`)}'`;
+const quotePowerShellArgument = (value) => `'${value.replaceAll("'", "''")}'`;
+export function daemonHome(env = process.env) {
+    return resolve(env.CREW_DAEMON_HOME ?? resolve(homedir(), ".crew/daemon"));
+}
+export function resolveAgentsRoot(configured, userHome = homedir(), platform = process.platform) {
+    const pathApi = platform === "win32" ? win32 : posix;
+    const normalizedHome = pathApi.resolve(userHome);
+    if (configured === undefined)
+        return canonicalizeRoot(pathApi.resolve(normalizedHome, ".crew", "agents"), platform);
+    const expanded = configured === "~"
+        ? normalizedHome
+        : configured.startsWith("~/") || (platform === "win32" && configured.startsWith("~\\"))
+            ? pathApi.resolve(normalizedHome, configured.slice(2))
+            : configured;
+    return canonicalizeRoot(pathApi.resolve(expanded), platform);
+}
+function canonicalizeRoot(path, platform) {
+    const compatibleHost = (platform === "win32") === (process.platform === "win32");
+    if (!compatibleHost)
+        return path;
+    try {
+        return realpathSync.native(path);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOTDIR")
+            return path;
+        if (code !== "ENOENT")
+            throw error;
+    }
+    const pathApi = platform === "win32" ? win32 : posix;
+    const missingSegments = [];
+    let ancestor = path;
+    for (;;) {
+        const parent = pathApi.dirname(ancestor);
+        if (parent === ancestor)
+            return path;
+        missingSegments.unshift(pathApi.basename(ancestor));
+        ancestor = parent;
+        try {
+            return pathApi.resolve(realpathSync.native(ancestor), ...missingSegments);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOTDIR")
+                return path;
+            if (code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function comparableAgentsRoot(path, platform) {
+    return platform === "win32" ? win32.normalize(path).toLocaleLowerCase("en-US") : path;
+}
+export function validateProfileName(name) {
+    if (!PROFILE_NAME.test(name)) {
+        throw new Error("profile name must match [a-z0-9][a-z0-9_-]{0,47}");
+    }
+    return name;
+}
+export function profilePath(name, home = daemonHome()) {
+    return resolve(home, "profiles", `${validateProfileName(name)}.json`);
+}
+async function atomicPrivateWrite(path, content, beforeCommit) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await chmod(dirname(path), 0o700);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await beforeCommit?.(temporary);
+        await rename(temporary, path);
+        await chmod(path, 0o600);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+const DPAPI_PROTECT = "$p=[Console]::In.ReadToEnd();$b=[Text.Encoding]::UTF8.GetBytes($p);$e=[Security.Cryptography.ProtectedData]::Protect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Convert]::ToBase64String($e)";
+const DPAPI_UNPROTECT = "$p=[Console]::In.ReadToEnd();$b=[Convert]::FromBase64String($p);$d=[Security.Cryptography.ProtectedData]::Unprotect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Text.Encoding]::UTF8.GetString($d))";
+async function powershellStdin(script, input) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.once("error", reject);
+        child.once("close", (code) => {
+            if (code !== 0) {
+                reject(new Error(`Windows DPAPI operation failed: ${Buffer.concat(stderr).toString("utf8").trim() || `exit ${code}`}`));
+                return;
+            }
+            resolvePromise(Buffer.concat(stdout).toString("utf8").trim());
+        });
+        child.stdin.end(input);
+    });
+}
+export const windowsDpapiProtector = {
+    protect: (plaintext) => powershellStdin(DPAPI_PROTECT, plaintext),
+    unprotect: (ciphertext) => powershellStdin(DPAPI_UNPROTECT, ciphertext),
+};
+function storageOptions(options) {
+    const platform = options.platform ?? process.platform;
+    return {
+        platform,
+        ...(options.protector ? { protector: options.protector } : platform === "win32" ? { protector: windowsDpapiProtector } : {}),
+        ...(options.harden ? { harden: options.harden } : {}),
+    };
+}
+function attachCleanupError(primaryError, cleanupError) {
+    try {
+        if (!(primaryError instanceof Error)
+            || !Object.isExtensible(primaryError)
+            || Object.prototype.hasOwnProperty.call(primaryError, "cleanupError"))
+            return;
+        Object.defineProperty(primaryError, "cleanupError", {
+            configurable: true,
+            value: cleanupError,
+        });
+    }
+    catch {
+        // Preserve the primary error even when it cannot accept diagnostics.
+    }
+}
+export async function saveProfile(input, home = daemonHome(), options = {}) {
+    const profile = ProfileSchema.parse({ version: 1, ...input });
+    const configured = storageOptions(options);
+    const release = await acquireProfileSaveLock(resolve(home, "profiles"), {
+        ...(options.lockTimeoutMs === undefined ? {} : { timeoutMs: options.lockTimeoutMs }),
+        ...(options.lockRetryMs === undefined ? {} : { retryMs: options.lockRetryMs }),
+        ...(options.lockNow === undefined ? {} : { now: options.lockNow }),
+        ...(options.lockWait === undefined ? {} : { wait: options.lockWait }),
+        ...(options.lockProcessController === undefined
+            ? {}
+            : { processController: options.lockProcessController }),
+        ...(options.lockHooks === undefined ? {} : { hooks: options.lockHooks }),
+    });
+    let bodyFailed = false;
+    let bodyError;
+    try {
+        await assertProfileAgentsRootUnique(profile, home, options.userHome ?? homedir(), options);
+        if (configured.platform === "win32") {
+            if (!configured.protector)
+                throw new Error("Windows profile storage requires CurrentUser DPAPI");
+            if (!configured.harden)
+                throw new Error("Windows profile storage requires ACL hardening");
+            const ciphertext = await configured.protector.protect(profile.machineToken);
+            if (!ciphertext)
+                throw new Error("Windows DPAPI returned an empty ciphertext");
+            const stored = StoredProtectedProfileSchema.parse({
+                version: 1,
+                name: profile.name,
+                serverUrl: profile.serverUrl,
+                ...(profile.agentsRoot ? { agentsRoot: profile.agentsRoot } : {}),
+                ...(profile.runtimePath ? { runtimePath: profile.runtimePath } : {}),
+                machineTokenProtected: { scheme: "dpapi-current-user", ciphertext },
+            });
+            await atomicPrivateWrite(profilePath(profile.name, home), `${JSON.stringify(stored, null, 2)}\n`, configured.harden);
+        }
+        else {
+            await atomicPrivateWrite(profilePath(profile.name, home), `${JSON.stringify(profile, null, 2)}\n`);
+        }
+    }
+    catch (error) {
+        bodyFailed = true;
+        bodyError = error;
+        throw error;
+    }
+    finally {
+        try {
+            await release();
+        }
+        catch (cleanupError) {
+            if (!bodyFailed)
+                throw cleanupError;
+            attachCleanupError(bodyError, cleanupError);
+        }
+    }
+    return profile;
+}
+export async function loadProfile(name, home = daemonHome(), options = {}) {
+    const path = profilePath(name, home);
+    try {
+        const stored = StoredProfileSchema.parse(JSON.parse(await readFile(path, "utf8")));
+        const configured = storageOptions(options);
+        if (configured.platform === "win32") {
+            if (!("machineTokenProtected" in stored)) {
+                throw new Error(`Computer profile '${name}' contains a plaintext token and is refused on Windows`);
+            }
+            if (!configured.protector)
+                throw new Error("Windows profile storage requires CurrentUser DPAPI");
+            return ProfileSchema.parse({
+                version: stored.version,
+                name: stored.name,
+                serverUrl: stored.serverUrl,
+                ...(stored.agentsRoot ? { agentsRoot: stored.agentsRoot } : {}),
+                ...(stored.runtimePath ? { runtimePath: stored.runtimePath } : {}),
+                machineToken: await configured.protector.unprotect(stored.machineTokenProtected.ciphertext),
+            });
+        }
+        if (!("machineToken" in stored)) {
+            throw new Error(`Computer profile '${name}' is DPAPI-protected and can only be loaded by its Windows user`);
+        }
+        return stored;
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error(`Computer profile '${name}' does not exist`);
+        }
+        throw error;
+    }
+}
+export async function listProfiles(home = daemonHome()) {
+    const root = resolve(home, "profiles");
+    try {
+        const entries = await readdir(root, { withFileTypes: true });
+        return entries
+            .filter((entry) => entry.isFile() && entry.name.endsWith(".json"))
+            .map((entry) => entry.name.slice(0, -5))
+            .filter((name) => PROFILE_NAME.test(name))
+            .sort();
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+export async function inspectProfileAgentsRoot(profile, home = daemonHome(), userHome = homedir(), options = {}) {
+    const platform = storageOptions(options).platform;
+    const agentsRoot = resolveAgentsRoot(profile.agentsRoot, userHome, platform);
+    const comparableRoot = comparableAgentsRoot(agentsRoot, platform);
+    const names = (await listProfiles(home)).filter((name) => name !== profile.name);
+    const profiles = await Promise.all(names.map((name) => loadProfile(name, home, options)));
+    return {
+        agentsRoot,
+        duplicateProfiles: profiles
+            .filter((candidate) => comparableAgentsRoot(resolveAgentsRoot(candidate.agentsRoot, userHome, platform), platform) === comparableRoot)
+            .map((candidate) => candidate.name),
+    };
+}
+export async function assertProfileAgentsRootUnique(profile, home = daemonHome(), userHome = homedir(), options = {}) {
+    const candidate = ProfileAgentsRootCandidateSchema.parse({
+        name: profile.name,
+        serverUrl: profile.serverUrl,
+        ...(profile.agentsRoot === undefined ? {} : { agentsRoot: profile.agentsRoot }),
+    });
+    const inspection = await inspectProfileAgentsRoot(candidate, home, userHome, options);
+    const conflict = inspection.duplicateProfiles[0];
+    if (conflict === undefined)
+        return;
+    throw new ProfileAgentsRootConflictError({
+        profile: candidate.name,
+        conflict,
+        agentsRoot: inspection.agentsRoot,
+        serverUrl: candidate.serverUrl,
+        userHome,
+        platform: storageOptions(options).platform,
+    });
+}
+export async function removeProfile(name, home = daemonHome()) {
+    await rm(profilePath(name, home), { force: true });
+}
+export async function profileIsPrivate(name, home = daemonHome(), platform = process.platform) {
+    const path = profilePath(name, home);
+    await access(path, constants.R_OK);
+    if (platform === "win32") {
+        const stored = StoredProfileSchema.parse(JSON.parse(await readFile(path, "utf8")));
+        return "machineTokenProtected" in stored && stored.machineTokenProtected.scheme === "dpapi-current-user";
+    }
+    const { mode } = await stat(path);
+    return (mode & 0o077) === 0;
+}
+export function publicProfile(profile) {
+    return {
+        version: profile.version,
+        name: profile.name,
+        serverUrl: profile.serverUrl,
+        machineTokenConfigured: true,
+        ...(profile.agentsRoot ? { agentsRoot: profile.agentsRoot } : {}),
+    };
+}
+export function applyProfileToEnv(profile, env) {
+    env.CREW_SERVER_URL = profile.serverUrl;
+    env.CREW_MACHINE_TOKEN = profile.machineToken;
+    if (profile.agentsRoot)
+        env.CREW_AGENTS_ROOT = profile.agentsRoot;
+    else
+        delete env.CREW_AGENTS_ROOT;
+    if (profile.runtimePath)
+        env.PATH = profile.runtimePath;
+}