@nowcrew/daemon 0.6.88-beta.3 → 0.6.88-beta.30

package/dist/computer-setup-client.js

@@ -0,0 +1,318 @@
+import { z } from "zod";
+import { hostname } from "node:os";
+import { MachineTokenSchema } from "./computer-profile.js";
+import { systemCommandRunner, } from "./computer-service.js";
+const HttpUrlSchema = z.string().url().refine((value) => {
+    const url = new URL(value);
+    return (url.protocol === "http:" || url.protocol === "https:")
+        && url.username.length === 0
+        && url.password.length === 0;
+}, "expected an HTTP(S) URL without embedded credentials");
+const ServerOriginSchema = HttpUrlSchema.refine((value) => {
+    const url = new URL(value);
+    return (url.pathname === "" || url.pathname === "/")
+        && url.search.length === 0
+        && url.hash.length === 0;
+}, "expected a server origin without a path, query, or hash");
+const SetupStartSchema = z.object({
+    deviceCode: z.string().min(16).max(512),
+    userCode: z.string().min(4).max(128),
+    verificationUri: HttpUrlSchema,
+    expiresAt: z.string().datetime({ offset: true }),
+    intervalSeconds: z.number().int().positive().max(300),
+}).strict();
+const SetupBootstrapSchema = z.object({
+    setupId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    workspaceSlug: z.string().min(1).max(80).optional(),
+    machineId: z.string().uuid(),
+    serverUrl: ServerOriginSchema,
+    environment: z.string().min(1).max(64),
+    environmentId: z.string().min(1).max(128).optional(),
+    profile: z.string().min(1).max(128),
+    minimumConnectionEpoch: z.number().int().nonnegative(),
+    daemonVersion: z.string().min(1).max(128).optional(),
+    releaseTag: z.enum(["latest", "beta"]).optional(),
+    registryUrl: HttpUrlSchema.optional(),
+    storageId: z.string().min(1).max(256).optional(),
+    expiresAt: z.string().datetime({ offset: true }).optional(),
+    machineToken: MachineTokenSchema,
+}).strict();
+const SetupPendingSchema = z.object({
+    status: z.enum(["authorization_pending", "pending"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupSlowDownSchema = z.object({
+    status: z.literal("slow_down"),
+    intervalSeconds: z.number().int().positive().max(300),
+}).strict();
+const SetupDeniedSchema = z.object({
+    status: z.enum(["access_denied", "denied"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupExpiredSchema = z.object({
+    status: z.enum(["expired_token", "expired"]),
+    intervalSeconds: z.number().int().positive().max(300).optional(),
+}).strict();
+const SetupReadySchema = z.object({
+    status: z.literal("ready"),
+    machineId: z.string().uuid(),
+    workspaceId: z.string().min(1).max(256),
+    environment: z.string().min(1).max(64),
+    profile: z.string().min(1).max(128),
+    storageId: z.string().min(1).max(256).optional(),
+    daemonHome: z.string().min(1).max(32768),
+    agentsRoot: z.string().min(1).max(32768),
+}).strict();
+export class ComputerSetupHttpError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.name = "ComputerSetupHttpError";
+        this.status = status;
+        this.code = code;
+    }
+}
+export function redactSetupSecrets(value, secrets = []) {
+    let redacted = value.replace(/\bsk_machine_[A-Za-z0-9_-]+\b/gu, "<redacted>");
+    for (const secret of secrets) {
+        if (secret.length > 0)
+            redacted = redacted.replaceAll(secret, "<redacted>");
+    }
+    return redacted;
+}
+export function computerSetupRecoveryGuidance(target) {
+    const localTarget = [
+        ...(target.profile === undefined ? [] : [`profile '${target.profile}'`]),
+        ...(target.serviceId === undefined ? [] : [`service '${target.serviceId}'`]),
+        ...(target.daemonHome === undefined ? [] : [`daemon home '${target.daemonHome}'`]),
+    ];
+    return `Local profile/service state was preserved${localTarget.length === 0 ? "" : ` for ${localTarget.join(", ")}`}. `
+        + `Do not restore old credentials. Check Computer '${target.machineId}' in Workspace '${target.workspaceId}' `
+        + `on ${target.serverUrl}. Resolve the reported error and check connectivity, then rerun nowwork-computer setup to reconcile the installation.`;
+}
+function normalizeServerUrl(value) {
+    const parsed = new URL(ServerOriginSchema.parse(value));
+    return `${parsed.protocol}//${parsed.host}`;
+}
+function pathForMachine(machineId, suffix) {
+    return `/api/machines/${encodeURIComponent(machineId)}/setup/${suffix}`;
+}
+function parseBootstrap(raw) {
+    const value = (raw !== null && typeof raw === "object" && "bootstrap" in raw)
+        ? raw.bootstrap
+        : raw;
+    const candidate = value !== null && typeof value === "object"
+        ? (() => {
+            const record = value;
+            const { token: legacyToken, ...rest } = record;
+            return {
+                ...rest,
+                ...(rest.machineToken === undefined && typeof legacyToken === "string"
+                    ? { machineToken: legacyToken }
+                    : {}),
+            };
+        })()
+        : value;
+    const parsed = SetupBootstrapSchema.parse(candidate);
+    return {
+        setupId: parsed.setupId,
+        workspaceId: parsed.workspaceId,
+        ...(parsed.workspaceSlug === undefined ? {} : { workspaceSlug: parsed.workspaceSlug }),
+        machineId: parsed.machineId,
+        serverUrl: parsed.serverUrl,
+        environment: parsed.environment,
+        profile: parsed.profile,
+        minimumConnectionEpoch: parsed.minimumConnectionEpoch,
+        machineToken: parsed.machineToken,
+        ...(parsed.environmentId === undefined ? {} : { environmentId: parsed.environmentId }),
+        ...(parsed.daemonVersion === undefined ? {} : { daemonVersion: parsed.daemonVersion }),
+        ...(parsed.releaseTag === undefined ? {} : { releaseTag: parsed.releaseTag }),
+        ...(parsed.registryUrl === undefined ? {} : { registryUrl: parsed.registryUrl }),
+        ...(parsed.storageId === undefined ? {} : { storageId: parsed.storageId }),
+        ...(parsed.expiresAt === undefined ? {} : { expiresAt: parsed.expiresAt }),
+    };
+}
+function parseStart(raw) {
+    return SetupStartSchema.parse(raw);
+}
+function parsePoll(raw) {
+    if (raw !== null && typeof raw === "object" && "status" in raw
+        && raw.status === "authorized") {
+        const record = raw;
+        if ("bootstrap" in raw) {
+            return { status: "authorized", bootstrap: parseBootstrap(raw) };
+        }
+        if (record.target === undefined || typeof record.token !== "string") {
+            throw new Error("Invalid authorized computer setup response");
+        }
+        return {
+            status: "authorized",
+            bootstrap: parseBootstrap({
+                ...record.target,
+                setupId: record.setupId,
+                machineToken: record.token,
+            }),
+        };
+    }
+    const pending = SetupPendingSchema.safeParse(raw);
+    if (pending.success) {
+        return {
+            status: "authorization_pending",
+            intervalSeconds: pending.data.intervalSeconds ?? 5,
+        };
+    }
+    const slowDown = SetupSlowDownSchema.safeParse(raw);
+    if (slowDown.success)
+        return slowDown.data;
+    const denied = SetupDeniedSchema.safeParse(raw);
+    if (denied.success) {
+        return {
+            status: "access_denied",
+            intervalSeconds: denied.data.intervalSeconds ?? 5,
+        };
+    }
+    const expired = SetupExpiredSchema.safeParse(raw);
+    if (expired.success) {
+        return {
+            status: "expired_token",
+            intervalSeconds: expired.data.intervalSeconds ?? 5,
+        };
+    }
+    throw new Error("Invalid computer setup polling response");
+}
+function parseHello(raw) {
+    if (raw !== null && typeof raw === "object" && "helloConfirmed" in raw
+        && raw.helloConfirmed === true) {
+        const value = raw;
+        const parsed = SetupReadySchema.parse({
+            status: "ready",
+            machineId: value.machineId,
+            workspaceId: value.workspaceId,
+            environment: value.environment,
+            profile: value.profile,
+            ...(value.storageId === undefined ? {} : { storageId: value.storageId }),
+            ...(value.daemonHome === undefined ? {} : { daemonHome: value.daemonHome }),
+            ...(value.agentsRoot === undefined ? {} : { agentsRoot: value.agentsRoot }),
+        });
+        return {
+            status: "ready",
+            machineId: parsed.machineId,
+            workspaceId: parsed.workspaceId,
+            environment: parsed.environment,
+            profile: parsed.profile,
+            ...(parsed.storageId === undefined ? {} : { storageId: parsed.storageId }),
+            daemonHome: parsed.daemonHome,
+            agentsRoot: parsed.agentsRoot,
+        };
+    }
+    const ready = SetupReadySchema.safeParse(raw);
+    if (ready.success) {
+        return {
+            status: "ready",
+            machineId: ready.data.machineId,
+            workspaceId: ready.data.workspaceId,
+            environment: ready.data.environment,
+            profile: ready.data.profile,
+            ...(ready.data.storageId === undefined ? {} : { storageId: ready.data.storageId }),
+            daemonHome: ready.data.daemonHome,
+            agentsRoot: ready.data.agentsRoot,
+        };
+    }
+    const pending = z.object({
+        status: z.literal("pending"),
+        intervalSeconds: z.number().int().positive().max(300).optional(),
+    }).safeParse(raw);
+    if (pending.success)
+        return { status: "pending", intervalSeconds: pending.data.intervalSeconds ?? 2 };
+    throw new Error("Invalid computer setup hello response");
+}
+export function createComputerSetupClient(options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const serverUrl = normalizeServerUrl(options.serverUrl);
+    const requestTimeoutMs = options.requestTimeoutMs ?? 15_000;
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => {
+        setTimeout(resolve, milliseconds);
+    }));
+    const now = options.now ?? Date.now;
+    let activeMachineId;
+    const request = async (method, path, body, bearer) => {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), requestTimeoutMs);
+        try {
+            const response = await fetchImpl(`${serverUrl}${path}`, {
+                method,
+                headers: {
+                    ...(body === undefined ? {} : { "content-type": "application/json" }),
+                    ...(bearer === undefined ? {} : { authorization: `Bearer ${bearer}` }),
+                },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                signal: controller.signal,
+            });
+            const payload = await response.json();
+            if (!response.ok || payload?.success === false) {
+                const message = redactSetupSecrets(payload?.error?.message ?? `computer setup request failed (HTTP ${response.status})`);
+                throw new ComputerSetupHttpError(message, response.status, payload?.error?.code ?? `HTTP_${response.status}`);
+            }
+            return (payload?.success === true ? payload.data : payload);
+        }
+        catch (error) {
+            if (controller.signal.aborted)
+                throw new Error("computer setup request timed out");
+            if (error instanceof ComputerSetupHttpError)
+                throw error;
+            throw new Error(redactSetupSecrets(error instanceof Error ? error.message : String(error)));
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    };
+    return {
+        start: async (input) => {
+            activeMachineId = input.machineId;
+            return parseStart(await request("POST", "/api/auth/computer-setup/start", {
+                ...(input.workspace.kind === "id"
+                    ? { workspaceId: input.workspace.value }
+                    : { workspaceSlug: input.workspace.value }),
+                machineId: input.machineId,
+                deviceName: (input.deviceName ?? hostname()).trim().slice(0, 120) || "computer",
+                serverUrl,
+            }));
+        },
+        poll: async (deviceCode) => {
+            if (activeMachineId === undefined)
+                throw new Error("computer setup polling has no active machine");
+            return parsePoll(await request("POST", "/api/auth/computer-setup/poll", { deviceCode }));
+        },
+        waitForHello: async (input) => {
+            const timeoutMs = input.timeoutMs ?? 120_000;
+            const deadline = now() + timeoutMs;
+            for (;;) {
+                const status = parseHello(await request("GET", `/daemon/computer-setup/status?machine_id=${encodeURIComponent(input.machineId)}&workspace_id=${encodeURIComponent(input.workspaceId)}&profile=${encodeURIComponent(input.profile)}&setup_id=${encodeURIComponent(input.setupId)}&minimum_connection_epoch=${encodeURIComponent(String(input.minimumConnectionEpoch))}`, undefined, input.machineToken));
+                if (status.status === "ready")
+                    return status;
+                if (now() >= deadline)
+                    throw new Error("Timed out waiting for machine hello");
+                await sleep(Math.min(status.intervalSeconds * 1_000, Math.max(0, deadline - now())));
+            }
+        },
+        finalize: async (input) => {
+            const result = await request("POST", "/daemon/computer-setup/finalize", { setupId: input.setupId }, input.machineToken);
+            if (result?.finalized !== true)
+                throw new Error("computer setup credential finalization not confirmed");
+        },
+        rollback: async (input) => {
+            const result = await request("POST", "/daemon/computer-setup/rollback", { setupId: input.setupId }, input.machineToken);
+            return result.rolledBack === true;
+        },
+    };
+}
+export async function openSetupBrowser(url, platform = process.platform, runner = systemCommandRunner) {
+    const command = platform === "win32" ? "explorer.exe" : platform === "darwin" ? "open" : "xdg-open";
+    const args = [url];
+    const result = await runner(command, args);
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to open the computer setup browser: ${redactSetupSecrets(result.stderr.trim() || `exit ${result.exitCode}`)}`);
+    }
+}

package/dist/computer-setup-orchestration.js

@@ -0,0 +1,203 @@
+import { computerSetupRecoveryGuidance, redactSetupSecrets, } from "./computer-setup-client.js";
+import { isProductionServerHostname, serverUrlsMatch } from "./server-url.js";
+import { posix, win32 } from "node:path";
+import { resolveAgentsRoot } from "./computer-profile.js";
+function safeError(error, machineToken) {
+    const message = redactSetupSecrets(error instanceof Error ? error.message : String(error), machineToken === undefined ? [] : [machineToken]);
+    return new Error(message, error instanceof Error ? { cause: error } : undefined);
+}
+function assertBootstrapMatches(bootstrap, input) {
+    if (bootstrap.machineId !== input.args.machineId) {
+        throw new Error("setup bootstrap machine does not match --machine");
+    }
+    const workspaceMatches = input.args.workspace.kind === "id"
+        ? input.args.workspace.value === bootstrap.workspaceId
+        : bootstrap.workspaceSlug !== undefined && input.args.workspace.value === bootstrap.workspaceSlug;
+    if (!workspaceMatches)
+        throw new Error("setup bootstrap Workspace does not match the requested Workspace");
+    const bootstrapUrl = new URL(bootstrap.serverUrl);
+    const requestedUrl = new URL(input.serverUrl);
+    if (!serverUrlsMatch(bootstrapUrl.origin, requestedUrl.origin)) {
+        throw new Error("setup bootstrap server does not match the requested server context");
+    }
+    const hostname = bootstrapUrl.hostname.toLowerCase();
+    const knownEnvironment = hostname === "nowwork-dev.nowcoder.com"
+        ? "dev"
+        : isProductionServerHostname(hostname)
+            ? "production"
+            : null;
+    if (knownEnvironment !== null) {
+        const expectedReleaseTag = knownEnvironment === "dev" ? "beta" : "latest";
+        if (bootstrap.environment !== knownEnvironment) {
+            throw new Error("setup bootstrap environment does not match the server hostname");
+        }
+        if (bootstrap.releaseTag !== undefined && bootstrap.releaseTag !== expectedReleaseTag) {
+            throw new Error("setup bootstrap release tag does not match the server hostname");
+        }
+    }
+}
+function secondsUntil(expiresAt, now) {
+    const remaining = Date.parse(expiresAt) - now();
+    return Math.max(0, Math.ceil(remaining / 1_000));
+}
+function localPathsMatch(left, right, platform) {
+    const paths = platform === "win32" ? win32 : posix;
+    if (!paths.isAbsolute(left) || !paths.isAbsolute(right))
+        return false;
+    const normalize = (value) => {
+        const resolved = resolveAgentsRoot(value, undefined, platform);
+        return platform === "win32" ? win32.normalize(resolved).toLocaleLowerCase("en-US") : resolved;
+    };
+    return normalize(left) === normalize(right);
+}
+async function obtainBootstrap(input, deps) {
+    const pairing = await deps.client.start({
+        workspace: input.args.workspace,
+        machineId: input.args.machineId,
+    });
+    deps.reportPairing(`Open ${pairing.verificationUri}`);
+    deps.reportPairing(`Code ${pairing.userCode}`);
+    try {
+        await deps.openBrowser(pairing.verificationUri);
+    }
+    catch (error) {
+        deps.reportPairing(`Browser open skipped: ${redactSetupSecrets(error.message)}`);
+    }
+    let intervalSeconds = pairing.intervalSeconds;
+    for (;;) {
+        const remainingSeconds = secondsUntil(pairing.expiresAt, deps.now);
+        if (remainingSeconds <= 0)
+            throw new Error("computer setup pairing expired");
+        await deps.sleep(Math.min(intervalSeconds * 1_000, remainingSeconds * 1_000));
+        const result = await deps.client.poll(pairing.deviceCode);
+        if (result.status === "authorization_pending" || result.status === "slow_down") {
+            intervalSeconds = result.intervalSeconds;
+            continue;
+        }
+        if (result.status === "access_denied")
+            throw new Error("computer setup pairing was denied");
+        if (result.status === "expired_token")
+            throw new Error("computer setup pairing expired");
+        return result.bootstrap;
+    }
+}
+export async function runComputerSetupOrchestration(input, deps) {
+    let machineToken;
+    let bootstrap;
+    let credentialFinalized = false;
+    let verifiedStorageId;
+    let rollbackAttempt;
+    const confirmRollback = () => {
+        // Reuse both success and failure so an outer catch cannot change the recovery decision.
+        rollbackAttempt ??= (async () => {
+            if (credentialFinalized)
+                throw new Error("computer setup credentials already finalized");
+            if (bootstrap === undefined || machineToken === undefined)
+                throw new Error("computer setup credentials unavailable");
+            for (let attempt = 0;; attempt += 1) {
+                try {
+                    const confirmed = await deps.client.rollback({ setupId: bootstrap.setupId, machineToken });
+                    if (confirmed !== true)
+                        throw new Error("computer setup rollback not confirmed");
+                    return;
+                }
+                catch (error) {
+                    if (attempt >= 2)
+                        throw error;
+                    await deps.sleep(1_000);
+                }
+            }
+        })();
+        return rollbackAttempt;
+    };
+    try {
+        const authorized = await obtainBootstrap(input, deps);
+        const token = authorized.machineToken;
+        bootstrap = authorized;
+        machineToken = token;
+        assertBootstrapMatches(authorized, input);
+        const installation = await deps.installAutomatically({
+            serverUrl: authorized.serverUrl,
+            machineToken: token,
+            workspaceId: authorized.workspaceId,
+            machineId: authorized.machineId,
+            ...(authorized.profile === undefined ? {} : { requestedProfile: authorized.profile }),
+            ...(authorized.releaseTag === "latest" || authorized.releaseTag === "beta"
+                ? { requestedReleaseTag: authorized.releaseTag }
+                : {}),
+            ...(authorized.registryUrl === undefined ? {} : { requestedRegistryUrl: authorized.registryUrl }),
+            beforeRollback: confirmRollback,
+            verifyAfterStart: async (candidate) => {
+                const hello = await deps.client.waitForHello({
+                    machineToken: token,
+                    machineId: authorized.machineId,
+                    workspaceId: authorized.workspaceId,
+                    profile: candidate.profile,
+                    setupId: authorized.setupId,
+                    minimumConnectionEpoch: authorized.minimumConnectionEpoch,
+                });
+                if (hello.machineId !== authorized.machineId)
+                    throw new Error("machine hello identity mismatch");
+                if (hello.workspaceId !== authorized.workspaceId)
+                    throw new Error("machine hello workspace identity mismatch");
+                if (hello.environment !== authorized.environment)
+                    throw new Error("machine hello environment identity mismatch");
+                if (hello.profile !== candidate.profile)
+                    throw new Error("machine hello profile identity mismatch");
+                const platform = deps.platform ?? process.platform;
+                if (!localPathsMatch(hello.daemonHome, candidate.daemonHome, platform))
+                    throw new Error("machine hello daemon home mismatch");
+                if (!localPathsMatch(hello.agentsRoot, candidate.agentsRoot, platform))
+                    throw new Error("machine hello agents root mismatch");
+                if (authorized.storageId !== undefined && hello.storageId !== authorized.storageId) {
+                    throw new Error("machine hello storage identity mismatch");
+                }
+                verifiedStorageId = hello.storageId;
+                let finalizeError;
+                for (let attempt = 0; attempt < 3; attempt += 1) {
+                    try {
+                        await deps.client.finalize({ setupId: authorized.setupId, machineToken: token });
+                        credentialFinalized = true;
+                        finalizeError = undefined;
+                        break;
+                    }
+                    catch (error) {
+                        finalizeError = error;
+                        if (attempt < 2)
+                            await deps.sleep(1_000);
+                    }
+                }
+                if (!credentialFinalized) {
+                    throw finalizeError ?? new Error("computer setup credential finalization failed");
+                }
+            },
+        });
+        return {
+            workspaceId: authorized.workspaceId,
+            machineId: authorized.machineId,
+            environment: authorized.environment,
+            profile: installation.profile,
+            daemonVersion: installation.version,
+            serviceId: installation.serviceId,
+            serviceStatus: "running",
+            helloConfirmed: true,
+            ...(authorized.environmentId === undefined ? {} : { environmentId: authorized.environmentId }),
+            ...(verifiedStorageId === undefined ? {} : { storageId: verifiedStorageId }),
+            localNowworkHome: installation.localHome,
+            daemonHome: installation.daemonHome,
+            agentsRoot: installation.agentsRoot,
+        };
+    }
+    catch (error) {
+        if (bootstrap !== undefined && machineToken !== undefined && !credentialFinalized && rollbackAttempt === undefined) {
+            try {
+                await confirmRollback();
+            }
+            catch (rollbackError) {
+                error = new Error(`${error.message}; computer setup rollback failed: ${rollbackError.message}; `
+                    + `local recovery blocked. ${computerSetupRecoveryGuidance(bootstrap)}`, { cause: error });
+            }
+        }
+        throw safeError(error, machineToken);
+    }
+}