@oar-sh/oar 0.9.0

package/server/services/cli-process-runner.mjs

@@ -0,0 +1,181 @@
+'use strict';
+
+/**
+ * Mechanical helpers for driving a provider CLI as a child process.
+ *
+ * Lifted verbatim out of claude-auth-service.mjs, which held the only copy:
+ * the CLI install service and the Grok auth service need the same escape
+ * stripping, secret scrubbing, process-group kill and run-to-completion
+ * wrapper, and a second hand-rolled copy of any of them is exactly how two
+ * spawn paths drift apart.
+ *
+ * Only the pieces with no state of their own moved. The Claude auth state
+ * machine is live-verified and stayed where it is; claude-auth-service.mjs
+ * re-exports the helpers it used to export, so every importer and test of it
+ * is untouched.
+ */
+
+/** Refusal used by every spawn path when the relay runs with CLI spawns off. */
+export const CLI_SPAWN_DISABLED_ERROR = 'cli spawns disabled';
+
+/** Retained-output ceiling shared by every capture path (auth, install). */
+export const MAX_CAPTURED_OUTPUT_CHARS = 16_000;
+const MAX_ERROR_TAIL_CHARS = 600;
+
+// Any OSC sequence (hyperlinks, window-title sets, clipboard writes): ESC ]
+// <payload> (BEL | ST). Stripped whole so no `0;title` residue reaches the
+// prompt/JSON/error parsers.
+const OSC_PATTERN = /\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+// Any CSI sequence (SGR colours, cursor moves, erases).
+const CSI_PATTERN = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
+// Remaining single-character / other escape sequences.
+const OTHER_ESCAPE_PATTERN = /\x1b[@-Z\\-_]/g;
+// `script` gives a CLI an 80-column PTY, and CLIs hard-wrap their own output at
+// that width. Only a line that is *exactly* that wide is treated as continued:
+// a line that merely ends in a long token ended because the CLI printed a
+// newline, and gluing the next line onto it would corrupt the match. On a
+// differently-sized terminal this degrades to the pre-wrap behaviour.
+const PTY_WRAP_COLUMNS = 80;
+
+function normalizeText(value) {
+  return String(value == null ? '' : value).trim();
+}
+
+/**
+ * Removes OSC sequences (including OSC-8 hyperlink wrappers), ANSI CSI
+ * sequences and the CR the PTY adds to every line, leaving the human-visible
+ * text.
+ */
+export function stripTerminalEscapes(value) {
+  return String(value == null ? '' : value)
+    .replace(OSC_PATTERN, '')
+    .replace(CSI_PATTERN, '')
+    .replace(OTHER_ESCAPE_PATTERN, '')
+    .replace(/\r/g, '');
+}
+
+/**
+ * Rejoins lines the PTY hard-wrapped mid-token: a wrap fills the terminal width
+ * and leaves no trailing space, so a full-width line is stitched onto the line
+ * that follows it (repeatedly, for a URL spanning three or more rows).
+ */
+export function joinWrappedLines(value) {
+  const lines = String(value == null ? '' : value).split('\n');
+  const joined = [];
+  let previousWrapped = false;
+  for (const line of lines) {
+    if (previousWrapped && joined.length && /^\S/.test(line)) {
+      joined[joined.length - 1] = `${joined[joined.length - 1]}${line}`;
+    } else {
+      joined.push(line);
+    }
+    previousWrapped = line.length === PTY_WRAP_COLUMNS && /\S$/.test(line);
+  }
+  return joined.join('\n');
+}
+
+/**
+ * Redacts anything token-shaped plus an exact secret the caller knows it
+ * handed over (the pasted Claude login code), so an error tail can be surfaced
+ * to the UI without leaking a credential. Long PKCE segments in an authorize
+ * URL get caught by the generic rule too, which is fine: the URL is already
+ * carried in the login payload.
+ */
+export function scrubSecrets(text, submittedCode = '') {
+  let output = String(text == null ? '' : text);
+  const code = normalizeText(submittedCode);
+  if (code.length >= 4) {
+    output = output.split(code).join('[redacted]');
+  }
+  return output
+    .replace(/sk-ant-[A-Za-z0-9_-]+/g, '[redacted]')
+    .replace(/[A-Za-z0-9_-]{32,}/g, '[redacted]');
+}
+
+/** Collapses captured output into one short single-line tail for an error. */
+export function tailOf(text, limit = MAX_ERROR_TAIL_CHARS) {
+  const lines = String(text || '')
+    .split('\n')
+    .map((line) => line.trimEnd())
+    .filter((line) => line.trim());
+  const joined = lines.join(' · ');
+  return joined.length > limit ? `…${joined.slice(-limit)}` : joined;
+}
+
+/**
+ * Signals the child's whole process group where the platform has one, so a
+ * `script`/`bash -lc` wrapper cannot leave the real CLI running behind it.
+ * A child that has already exited is left alone.
+ */
+export function killTree(child, signal, {
+  platform = process.platform,
+  processKillImpl = process.kill.bind(process),
+} = {}) {
+  if (!child || child.exitCode !== null) return;
+  const pid = Number(child.pid);
+  if (platform !== 'win32' && Number.isInteger(pid) && pid > 0) {
+    try {
+      processKillImpl(-pid, signal);
+      return;
+    } catch {}
+  }
+  try { child.kill(signal); } catch {}
+}
+
+/**
+ * Runs one already-configured child to completion and resolves (never rejects)
+ * with `{ok, code, output, error}`.
+ *
+ * `spawnChild` is a thunk so the caller keeps ownership of how the process is
+ * built — PTY or not, which stdio, which environment — and so a refused spawn
+ * (the CLI kill switch) surfaces as a result rather than a throw. `onChild`
+ * hands the live handle back for cancellation, and `onOutput` sees each raw
+ * chunk for callers that stream a log while it runs.
+ */
+export function runToCompletion(spawnChild, {
+  timeoutMs,
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+  killChild = (child, signal) => killTree(child, signal),
+  maxOutputChars = MAX_CAPTURED_OUTPUT_CHARS,
+  onChild = null,
+  onOutput = null,
+} = {}) {
+  return new Promise((resolve) => {
+    let child = null;
+    try {
+      child = spawnChild();
+    } catch (error) {
+      resolve({ ok: false, code: null, output: '', error: error?.message || String(error) });
+      return;
+    }
+    try { onChild?.(child); } catch {}
+    let output = '';
+    let settled = false;
+    const append = (chunk) => {
+      const text = chunk.toString();
+      output = `${output}${text}`.slice(-maxOutputChars);
+      try { onOutput?.(text); } catch {}
+    };
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeoutImpl(timer);
+      resolve(result);
+    };
+    const timer = setTimeoutImpl(() => {
+      killChild(child, 'SIGTERM');
+      finish({ ok: false, code: null, output, error: `timed out after ${timeoutMs}ms` });
+    }, timeoutMs);
+    timer?.unref?.();
+    child.stdout?.on?.('data', append);
+    child.stderr?.on?.('data', append);
+    child.stdin?.end?.();
+    child.on('error', (error) => finish({
+      ok: false, code: null, output, error: error?.message || String(error),
+    }));
+    child.on('close', (code) => finish({
+      ok: code === 0, code, output, error: null,
+    }));
+  });
+}

package/server/services/cloudflared-tunnel-service.mjs

@@ -0,0 +1,358 @@
+'use strict';
+
+import path from 'path';
+import fs from 'fs';
+import { createRequire } from 'module';
+import { spawn } from 'child_process';
+
+const requireFromHere = createRequire(import.meta.url);
+
+const BACKOFF_STEPS = [5_000, 10_000, 20_000, 40_000, 60_000];
+const READINESS_WINDOW_MS = 5_000;
+const STABLE_CONNECTION_MS = 30_000;
+const FAST_EXIT_MS = 10_000;
+const MAX_CONSECUTIVE_FAST_EXITS = 3;
+
+function toText(value) {
+  return String(value || '').trim();
+}
+
+function normalizeTunnelMode(raw = {}) {
+  const mode = toText(raw.mode).toLowerCase();
+  if (mode === 'disabled' || mode === 'managed') return mode;
+  if (raw.enabled === true) return 'managed';
+  return 'disabled';
+}
+
+function normalizeExtraArgs(rawValue) {
+  if (!Array.isArray(rawValue)) return [];
+  return rawValue.map((entry) => toText(entry)).filter(Boolean);
+}
+
+// The npm `cloudflared` package downloads the official binary on demand; it is an
+// optional dependency, so absence must degrade to a config error, never a crash.
+// `requireImpl` is a seam: the package is optional, so a suite running under
+// `npm ci --omit=optional` (or after a failed postinstall download) must still be
+// able to exercise this logic instead of silently testing the host's install state.
+export function resolveCloudflaredBinaryFromPackage({
+  existsSync = fs.existsSync,
+  requireImpl = requireFromHere,
+} = {}) {
+  try {
+    const mod = requireImpl('cloudflared');
+    const bin = toText(mod?.bin);
+    // `bin` is where the package *will* place the binary; it only exists after
+    // the on-demand download has run, so an un-downloaded path is not usable.
+    if (bin && existsSync(bin)) return bin;
+  } catch {}
+  return null;
+}
+
+export function normalizeCloudflaredTunnelConfig(rawConfig = {}, {
+  env = process.env,
+  resolveBinary = resolveCloudflaredBinaryFromPackage,
+  configBaseDir = process.cwd(),
+  pathImpl = path,
+} = {}) {
+  const raw = rawConfig && typeof rawConfig === 'object' ? rawConfig : {};
+  const envMode = toText(env?.COPILOT_CLOUDFLARED_MODE).toLowerCase();
+  const mode = envMode === 'disabled' || envMode === 'managed'
+    ? envMode
+    : normalizeTunnelMode(raw);
+  const required = raw.required === true;
+  const token = toText(env?.COPILOT_CLOUDFLARED_TOKEN) || toText(raw.token);
+  const binaryInput = toText(env?.COPILOT_CLOUDFLARED_BINARY) || toText(raw.binary);
+  const extraArgs = normalizeExtraArgs(raw.extraArgs);
+
+  let binary = '';
+  let binarySource = null;
+  if (binaryInput) {
+    binary = binaryInput.includes('/') || binaryInput.includes('\\')
+      ? pathImpl.resolve(configBaseDir, binaryInput)
+      : binaryInput;
+    binarySource = 'config';
+  } else {
+    let packageBinary = null;
+    try {
+      packageBinary = toText(typeof resolveBinary === 'function' ? resolveBinary() : '');
+    } catch {
+      packageBinary = null;
+    }
+    if (packageBinary) {
+      binary = packageBinary;
+      binarySource = 'package';
+    } else {
+      binary = 'cloudflared';
+      binarySource = 'path';
+    }
+  }
+
+  const errors = [];
+  if (mode === 'managed') {
+    if (!token) errors.push('cloudflaredTunnel.token is required when cloudflaredTunnel.mode is "managed"');
+    if (!binary) errors.push('cloudflaredTunnel.binary could not be resolved (install the "cloudflared" package or set cloudflaredTunnel.binary)');
+  }
+
+  return {
+    mode,
+    enabled: mode === 'managed',
+    valid: errors.length === 0,
+    errors,
+    required,
+    token,
+    binary,
+    binarySource,
+    extraArgs,
+  };
+}
+
+export function buildCloudflaredArgs(tunnelConfig) {
+  return ['tunnel', 'run', '--token', tunnelConfig.token, ...tunnelConfig.extraArgs];
+}
+
+export function redactCloudflaredArgs(args = []) {
+  const out = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === '--token') {
+      out.push('--token', '<redacted>');
+      i += 1;
+      continue;
+    }
+    out.push(args[i]);
+  }
+  return out;
+}
+
+function buildSpawnOptions(platform, stdio) {
+  if (platform === 'win32') return { stdio, windowsHide: true };
+  return { stdio };
+}
+
+function isRegistrationLine(text) {
+  return /registered tunnel connection|connection .* registered|registered connection/i.test(text);
+}
+
+export function createCloudflaredTunnelManager({
+  tunnelConfig: rawTunnelConfig = {},
+  runtimeLogPrefix = () => '',
+  io = null,
+  logger = console,
+  runtimeShutdownRef = () => false,
+  platform = process.platform,
+  spawnImpl = spawn,
+  nowIso = () => new Date().toISOString(),
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+  configBaseDir = process.cwd(),
+  env = process.env,
+  resolveBinary = resolveCloudflaredBinaryFromPackage,
+  pathImpl = path,
+} = {}) {
+  const tunnelConfig = normalizeCloudflaredTunnelConfig(rawTunnelConfig, {
+    env,
+    resolveBinary,
+    configBaseDir,
+    pathImpl,
+  });
+  const log = (msg) => logger.log(`${runtimeLogPrefix()}[cloudflared-tunnel] ${msg}`);
+  const warn = (msg) => logger.warn(`${runtimeLogPrefix()}[cloudflared-tunnel] ${msg}`);
+
+  for (const error of tunnelConfig.errors) {
+    warn(error);
+  }
+
+  const state = {
+    mode: tunnelConfig.mode,
+    enabled: tunnelConfig.enabled && tunnelConfig.valid,
+    valid: tunnelConfig.valid,
+    required: tunnelConfig.required,
+    connected: false,
+    reconnectAttempts: 0,
+    fastExits: 0,
+    connectedSince: null,
+    blocking: tunnelConfig.required && tunnelConfig.mode === 'managed',
+    lastError: tunnelConfig.errors[0] || null,
+    lastEventAt: nowIso(),
+    binary: tunnelConfig.binary || null,
+    proc: null,
+    backoffTimer: null,
+  };
+
+  const emitStatus = () => {
+    state.lastEventAt = nowIso();
+    io?.emit?.('cloudflared_tunnel_status', {
+      connected: state.connected,
+      mode: state.mode,
+      enabled: state.enabled,
+      required: state.required,
+      blocking: state.blocking,
+      reconnectAttempts: state.reconnectAttempts,
+      connectedSince: state.connectedSince,
+      lastError: state.lastError,
+    });
+  };
+
+  const updateBlockingState = () => {
+    state.blocking = state.required && state.mode === 'managed' && !state.connected;
+  };
+
+  const scheduleReconnect = (spawnTunnel, { slowest = false } = {}) => {
+    if (runtimeShutdownRef()) return;
+    if (state.backoffTimer) {
+      clearTimeoutImpl(state.backoffTimer);
+      state.backoffTimer = null;
+    }
+    const stepIndex = slowest
+      ? BACKOFF_STEPS.length - 1
+      : Math.min(state.reconnectAttempts, BACKOFF_STEPS.length - 1);
+    const base = BACKOFF_STEPS[stepIndex];
+    const delay = Math.round(base + (Math.random() * base * 0.2));
+    state.reconnectAttempts += 1;
+    log(`Reconnecting in ${Math.round(delay / 1000)}s (attempt ${state.reconnectAttempts})...`);
+    state.backoffTimer = setTimeoutImpl(spawnTunnel, delay);
+    if (typeof state.backoffTimer?.unref === 'function') state.backoffTimer.unref();
+  };
+
+  const spawnTunnel = () => {
+    if (!state.enabled || runtimeShutdownRef()) return;
+    if (state.proc && state.proc.exitCode === null) {
+      log('Spawn skipped: existing cloudflared process is still running.');
+      return;
+    }
+
+    const args = buildCloudflaredArgs(tunnelConfig);
+    log(`Spawning: ${tunnelConfig.binary} ${redactCloudflaredArgs(args).join(' ')}`);
+    const proc = spawnImpl(tunnelConfig.binary, args, buildSpawnOptions(platform, ['ignore', 'pipe', 'pipe']));
+    state.proc = proc;
+    state.lastError = null;
+    updateBlockingState();
+    emitStatus();
+
+    const startedAt = Date.now();
+    let readinessTimer = null;
+
+    const clearReadinessTimer = () => {
+      if (!readinessTimer) return;
+      clearTimeoutImpl(readinessTimer);
+      readinessTimer = null;
+    };
+
+    const markConnected = (reason) => {
+      if (state.connected) return;
+      state.connected = true;
+      state.connectedSince = nowIso();
+      state.lastError = null;
+      state.fastExits = 0;
+      updateBlockingState();
+      log(`Tunnel connected (${reason}).`);
+      emitStatus();
+    };
+
+    const armReadinessFallback = () => {
+      clearReadinessTimer();
+      readinessTimer = setTimeoutImpl(() => {
+        readinessTimer = null;
+        if (runtimeShutdownRef()) return;
+        if (state.proc !== proc) return;
+        if (proc.exitCode !== null) return;
+        markConnected('readiness-window');
+      }, READINESS_WINDOW_MS);
+      if (typeof readinessTimer?.unref === 'function') readinessTimer.unref();
+    };
+
+    const handleOutput = (text) => {
+      if (!text) return;
+      log(`stderr: ${text}`);
+      if (isRegistrationLine(text)) {
+        clearReadinessTimer();
+        markConnected('registration');
+      }
+    };
+
+    proc.stdout?.on?.('data', (d) => handleOutput(d.toString().trim()));
+    proc.stderr?.on?.('data', (d) => handleOutput(d.toString().trim()));
+    proc.on('spawn', armReadinessFallback);
+    proc.on('error', (error) => {
+      clearReadinessTimer();
+      state.lastError = error?.message || String(error);
+      updateBlockingState();
+      log(`Error: ${state.lastError}`);
+      emitStatus();
+    });
+    proc.on('close', (code) => {
+      clearReadinessTimer();
+      const wasConnected = state.connected;
+      const uptime = Date.now() - startedAt;
+      state.connected = false;
+      state.connectedSince = null;
+      state.proc = null;
+      if (wasConnected && uptime > STABLE_CONNECTION_MS) {
+        state.reconnectAttempts = 0;
+      }
+      updateBlockingState();
+
+      if (runtimeShutdownRef()) {
+        log(`Process exited (code=${code}) during shutdown.`);
+        emitStatus();
+        return;
+      }
+
+      if (uptime < FAST_EXIT_MS) {
+        state.fastExits += 1;
+      } else {
+        state.fastExits = 0;
+      }
+
+      if (state.fastExits >= MAX_CONSECUTIVE_FAST_EXITS) {
+        state.lastError = 'auth-or-config';
+        log(`Process exited (code=${code}) after ${state.fastExits} fast exits; treating as auth/config failure.`);
+        emitStatus();
+        scheduleReconnect(spawnTunnel, { slowest: true });
+        return;
+      }
+
+      state.lastError = `exit:${code ?? 'null'}`;
+      log(`Process exited (code=${code}). Scheduling reconnect...`);
+      emitStatus();
+      scheduleReconnect(spawnTunnel);
+    });
+  };
+
+  const start = () => {
+    if (state.mode === 'disabled') {
+      state.lastError = null;
+      state.blocking = false;
+      emitStatus();
+      log('Cloudflare tunnel mode disabled.');
+      return;
+    }
+    if (!state.enabled) {
+      state.lastError = state.lastError || 'invalid-config';
+      updateBlockingState();
+      emitStatus();
+      log('Managed cloudflared mode requested but configuration is invalid; tunnel not started.');
+      return;
+    }
+    log(`Cloudflare tunnel enabled (binary source: ${tunnelConfig.binarySource}).`);
+    spawnTunnel();
+  };
+
+  const stop = () => {
+    if (state.backoffTimer) {
+      clearTimeoutImpl(state.backoffTimer);
+      state.backoffTimer = null;
+    }
+    if (state.proc) {
+      try { state.proc.kill('SIGTERM'); } catch {}
+      state.proc = null;
+    }
+  };
+
+  return {
+    state,
+    config: tunnelConfig,
+    start,
+    stop,
+    emitStatus,
+  };
+}