@openchambery/web 1.18.2-beta.2 → 1.18.2-beta.21

package/server/lib/config-sync/receiver.js

@@ -0,0 +1,330 @@
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+import {
+  OPENCODE_AGENTS_ROOT_PROBE_MARKER,
+  OPENCODE_AUTH_FILE_PROBE_MARKER,
+  OPENCODE_CONFIG_SYNC_ALLOWLIST,
+  OPENCODE_CONFIG_SYNC_MAX_BYTES,
+  OPENCODE_CONFIG_SYNC_MAX_FILES,
+} from './constants.js';
+import { CREDENTIAL_SYNC_UNAUTHORIZED_CODE } from './credential-auth.js';
+import {
+  extractTarGzBuffer,
+  finalizeLocalSyncDestination,
+  prepareLocalSyncDestination,
+} from './local-backup.js';
+import { walkAllowlistDirectory } from './plan.js';
+import { sanitizeSyncRunIdForPath } from './scripts.js';
+
+const INBOUND_CREDENTIAL_SETTINGS_KEY = 'configSyncInboundCredentialAuthorized';
+
+/**
+ * In-process receiver for HTTP config-sync (direct/relay hosts).
+ * One inflight sync at a time; backups use the same local generational helpers as pull.
+ */
+export const createConfigSyncReceiver = (deps = {}) => {
+  const {
+    homedir = () => os.homedir(),
+    readSettings = async () => ({}),
+    writeSettingsPatch = async () => {},
+  } = deps;
+
+  let inflight = null;
+
+  const beginInflight = (syncRunId) => {
+    const id = sanitizeSyncRunIdForPath(syncRunId);
+    if (inflight) {
+      const error = new Error(`Config sync already in progress (${inflight.syncRunId})`);
+      error.code = 'sync_in_progress';
+      error.syncRunId = inflight.syncRunId;
+      throw error;
+    }
+    inflight = { syncRunId: id, startedAt: Date.now(), prepared: false, kinds: new Set() };
+    return inflight;
+  };
+
+  const requireInflight = (syncRunId) => {
+    const id = sanitizeSyncRunIdForPath(syncRunId);
+    if (!inflight || inflight.syncRunId !== id) {
+      const error = new Error('No matching in-flight config sync');
+      error.code = 'sync_not_prepared';
+      throw error;
+    }
+    return inflight;
+  };
+
+  const clearInflight = (syncRunId) => {
+    if (inflight && inflight.syncRunId === sanitizeSyncRunIdForPath(syncRunId)) {
+      inflight = null;
+    }
+  };
+
+  const buildInventory = () => {
+    const home = homedir();
+    const root = path.join(home, '.config', 'opencode');
+    const files = [];
+    const directories = [];
+    const remoteExisting = [];
+
+    for (const group of OPENCODE_CONFIG_SYNC_ALLOWLIST.fileGroups) {
+      for (const member of group) {
+        const abs = path.join(root, member);
+        try {
+          const st = fs.statSync(abs);
+          if (!st.isFile()) continue;
+          files.push({ path: member, bytes: st.size });
+          remoteExisting.push(member);
+          break;
+        } catch {
+          // missing
+        }
+      }
+    }
+    for (const name of OPENCODE_CONFIG_SYNC_ALLOWLIST.singleFiles) {
+      const abs = path.join(root, name);
+      try {
+        const st = fs.statSync(abs);
+        if (!st.isFile()) continue;
+        files.push({ path: name, bytes: st.size });
+        remoteExisting.push(name);
+      } catch {
+        // missing
+      }
+    }
+    for (const dirSpec of OPENCODE_CONFIG_SYNC_ALLOWLIST.directories) {
+      const abs = path.join(root, dirSpec.path);
+      try {
+        const st = fs.statSync(abs);
+        if (!st.isDirectory()) continue;
+        const excludeNames = new Set(Array.isArray(dirSpec.excludeNames) ? dirSpec.excludeNames : []);
+        const walked = walkAllowlistDirectory(abs, excludeNames, new Set());
+        directories.push({ path: dirSpec.path, fileCount: walked.fileCount, bytes: walked.bytes });
+        remoteExisting.push(dirSpec.path);
+      } catch {
+        // missing
+      }
+    }
+
+    let agentsRoot = null;
+    let remoteAgentsRootExists = false;
+    try {
+      const agentsAbs = path.join(home, '.agents');
+      const st = fs.statSync(agentsAbs);
+      if (st.isDirectory()) {
+        remoteAgentsRootExists = true;
+        const walked = walkAllowlistDirectory(agentsAbs, new Set(), new Set());
+        agentsRoot = { fileCount: walked.fileCount, bytes: walked.bytes };
+      }
+    } catch {
+      // missing
+    }
+
+    let authFile = null;
+    let remoteAuthFileExists = false;
+    try {
+      const authAbs = path.join(home, '.local', 'share', 'opencode', 'auth.json');
+      const st = fs.statSync(authAbs);
+      if (st.isFile()) {
+        remoteAuthFileExists = true;
+        authFile = { bytes: st.size };
+      }
+    } catch {
+      // missing
+    }
+
+    return {
+      inventory: { files, directories, agentsRoot, authFile },
+      remoteExisting,
+      remoteAgentsRootExists,
+      remoteAuthFileExists,
+      markers: {
+        agentsRoot: OPENCODE_AGENTS_ROOT_PROBE_MARKER,
+        authFile: OPENCODE_AUTH_FILE_PROBE_MARKER,
+      },
+    };
+  };
+
+  const isInboundCredentialAuthorized = async () => {
+    const settings = await readSettings();
+    return settings?.[INBOUND_CREDENTIAL_SETTINGS_KEY] === true;
+  };
+
+  const setInboundCredentialAuthorized = async (authorized) => {
+    await writeSettingsPatch({
+      [INBOUND_CREDENTIAL_SETTINGS_KEY]: authorized === true,
+    });
+    return { authorized: authorized === true };
+  };
+
+  const probe = async (plan) => {
+    const snapshot = buildInventory();
+    const existing = new Set(snapshot.remoteExisting);
+    const planPaths = [
+      ...(Array.isArray(plan?.files) ? plan.files.map((entry) => entry.path) : []),
+      ...(Array.isArray(plan?.directories) ? plan.directories.map((entry) => entry.path) : []),
+      ...(Array.isArray(plan?.deletes) ? plan.deletes : []),
+    ];
+    return {
+      ...snapshot,
+      remoteExisting: [...new Set(planPaths.filter((rel) => existing.has(rel)))],
+      inboundCredentialAuthorized: await isInboundCredentialAuthorized(),
+    };
+  };
+
+  const prepare = async (plan, { syncRunId }) => {
+    const flight = beginInflight(syncRunId);
+    try {
+      await prepareLocalSyncDestination(homedir(), plan, { syncRunId: flight.syncRunId });
+      flight.prepared = true;
+      flight.plan = plan;
+      return { ok: true, syncRunId: flight.syncRunId, ready: true };
+    } catch (error) {
+      clearInflight(syncRunId);
+      throw error;
+    }
+  };
+
+  const readStreamToBuffer = async (stream, { maxBytes }) => {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of stream) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buf.byteLength;
+      if (total > maxBytes) {
+        const error = new Error(`Config sync payload exceeds size limit (${maxBytes} bytes)`);
+        error.code = 'sync_payload_too_large';
+        throw error;
+      }
+      chunks.push(buf);
+    }
+    return Buffer.concat(chunks, total);
+  };
+
+  const put = async ({ syncRunId, kind, stream }) => {
+    const flight = requireInflight(syncRunId);
+    if (!flight.prepared) {
+      const error = new Error('Config sync prepare must complete before put');
+      error.code = 'sync_not_prepared';
+      throw error;
+    }
+    if (kind === 'auth') {
+      const authorized = await isInboundCredentialAuthorized();
+      if (!authorized) {
+        const error = new Error('Credential sync is not authorized on this host');
+        error.code = CREDENTIAL_SYNC_UNAUTHORIZED_CODE;
+        throw error;
+      }
+    }
+    const buffer = await readStreamToBuffer(stream, { maxBytes: OPENCODE_CONFIG_SYNC_MAX_BYTES });
+    const home = homedir();
+    if (kind === 'config') {
+      await extractTarGzBuffer(buffer, path.join(home, '.config', 'opencode'));
+    } else if (kind === 'agents') {
+      await extractTarGzBuffer(buffer, home);
+    } else if (kind === 'auth') {
+      await fsp.mkdir(path.join(home, '.local', 'share', 'opencode'), { recursive: true });
+      await extractTarGzBuffer(buffer, path.join(home, '.local', 'share', 'opencode'));
+    } else {
+      const error = new Error(`Unsupported put kind: ${String(kind)}`);
+      error.code = 'sync_invalid_kind';
+      throw error;
+    }
+    flight.kinds.add(kind);
+    return { ok: true, kind, bytes: buffer.byteLength };
+  };
+
+  const collectTarGz = (cwd, entries) => new Promise((resolve, reject) => {
+    if (!entries.length) {
+      resolve(Buffer.alloc(0));
+      return;
+    }
+    const child = spawn('tar', ['-h', '-czf', '-', '-C', cwd, ...entries], {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      ...(process.platform === 'win32' ? { windowsHide: true } : {}),
+    });
+    const chunks = [];
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+    child.stderr?.on('data', (chunk) => { stderr += chunk.toString(); });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code !== 0) {
+        reject(new Error((stderr || 'Local tar failed').trim()));
+        return;
+      }
+      resolve(Buffer.concat(chunks));
+    });
+  });
+
+  const download = async ({ kind }) => {
+    const home = homedir();
+    if (kind === 'config') {
+      const snapshot = buildInventory();
+      const entries = [
+        ...snapshot.inventory.files.map((entry) => entry.path),
+        ...snapshot.inventory.directories.map((entry) => entry.path),
+      ];
+      if (entries.length > OPENCODE_CONFIG_SYNC_MAX_FILES) {
+        const error = new Error('Config sync exceeds file count limit');
+        error.code = 'sync_too_many_files';
+        throw error;
+      }
+      return collectTarGz(path.join(home, '.config', 'opencode'), entries);
+    }
+    if (kind === 'agents') {
+      return collectTarGz(home, ['.agents']);
+    }
+    if (kind === 'auth') {
+      const authorized = await isInboundCredentialAuthorized();
+      if (!authorized) {
+        const error = new Error('Credential sync is not authorized on this host');
+        error.code = CREDENTIAL_SYNC_UNAUTHORIZED_CODE;
+        throw error;
+      }
+      return collectTarGz(path.join(home, '.local', 'share', 'opencode'), ['auth.json']);
+    }
+    const error = new Error(`Unsupported download kind: ${String(kind)}`);
+    error.code = 'sync_invalid_kind';
+    throw error;
+  };
+
+  const finalize = async ({ syncRunId }) => {
+    const flight = requireInflight(syncRunId);
+    await finalizeLocalSyncDestination(homedir(), { syncRunId: flight.syncRunId });
+    const receipt = {
+      ok: true,
+      syncRunId: flight.syncRunId,
+      kinds: [...flight.kinds],
+      endedAt: new Date().toISOString(),
+    };
+    clearInflight(syncRunId);
+    return receipt;
+  };
+
+  const abort = ({ syncRunId } = {}) => {
+    if (!syncRunId) {
+      inflight = null;
+      return { ok: true };
+    }
+    clearInflight(syncRunId);
+    return { ok: true };
+  };
+
+  return {
+    INBOUND_CREDENTIAL_SETTINGS_KEY,
+    probe,
+    prepare,
+    put,
+    download,
+    finalize,
+    abort,
+    getInflight: () => inflight,
+    isInboundCredentialAuthorized,
+    setInboundCredentialAuthorized,
+    buildInventory,
+  };
+};

package/server/lib/config-sync/routes.js

@@ -0,0 +1,141 @@
+import { createConfigSyncReceiver } from './receiver.js';
+
+/**
+ * Register HTTP config-sync receive/download routes for direct (and later relay) hosts.
+ * Auth is the global `/api` UI/client-token gate. Credential kinds additionally
+ * require inbound credential authorization on this host.
+ *
+ * @param {import('express').Express} app
+ * @param {{
+ *   receiver?: ReturnType<typeof createConfigSyncReceiver>,
+ *   readSettingsFromDiskMigrated?: () => Promise<object>,
+ *   persistSettings?: (changes: object) => Promise<object>,
+ *   express?: typeof import('express'),
+ * }} deps
+ */
+export const registerConfigSyncRoutes = (app, deps = {}) => {
+  const {
+    readSettingsFromDiskMigrated,
+    persistSettings,
+    express,
+  } = deps;
+
+  const receiver = deps.receiver || createConfigSyncReceiver({
+    readSettings: async () => (typeof readSettingsFromDiskMigrated === 'function'
+      ? readSettingsFromDiskMigrated()
+      : {}),
+    writeSettingsPatch: async (patch) => {
+      if (typeof persistSettings === 'function') {
+        await persistSettings(patch);
+      }
+    },
+  });
+
+  const sendError = (res, error, fallbackStatus = 500) => {
+    const code = typeof error?.code === 'string' ? error.code : undefined;
+    const status = code === 'credential_sync_unauthorized' ? 403
+      : code === 'sync_in_progress' ? 409
+        : code === 'sync_not_prepared' ? 409
+          : code === 'sync_payload_too_large' || code === 'sync_too_many_files' ? 413
+            : code === 'sync_invalid_kind' ? 400
+              : fallbackStatus;
+    res.status(status).json({
+      error: error instanceof Error ? error.message : String(error),
+      ...(code ? { code } : {}),
+      ...(error?.syncRunId ? { syncRunId: error.syncRunId } : {}),
+    });
+  };
+
+  app.post('/api/openchamber/config-sync/probe', express?.json?.({ limit: '1mb' }) || ((req, _res, next) => next()), async (req, res) => {
+    try {
+      const plan = req.body?.plan && typeof req.body.plan === 'object' ? req.body.plan : {};
+      const result = await receiver.probe(plan);
+      res.json(result);
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  app.post('/api/openchamber/config-sync/prepare', express?.json?.({ limit: '1mb' }) || ((req, _res, next) => next()), async (req, res) => {
+    try {
+      const plan = req.body?.plan && typeof req.body.plan === 'object' ? req.body.plan : null;
+      const syncRunId = typeof req.body?.syncRunId === 'string' ? req.body.syncRunId.trim() : '';
+      if (!plan || !syncRunId) {
+        return res.status(400).json({ error: 'plan and syncRunId are required' });
+      }
+      const result = await receiver.prepare(plan, { syncRunId });
+      res.json(result);
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  app.put('/api/openchamber/config-sync/put/:kind', async (req, res) => {
+    try {
+      const kind = String(req.params.kind || '').trim();
+      const syncRunId = typeof req.query.syncRunId === 'string' ? req.query.syncRunId.trim() : '';
+      if (!syncRunId) {
+        return res.status(400).json({ error: 'syncRunId is required' });
+      }
+      const result = await receiver.put({ syncRunId, kind, stream: req });
+      res.json(result);
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  app.get('/api/openchamber/config-sync/download/:kind', async (req, res) => {
+    try {
+      const kind = String(req.params.kind || '').trim();
+      const buffer = await receiver.download({ kind });
+      res.setHeader('Content-Type', 'application/gzip');
+      res.setHeader('Content-Length', String(buffer.byteLength));
+      res.send(buffer);
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  app.post('/api/openchamber/config-sync/finalize', express?.json?.({ limit: '64kb' }) || ((req, _res, next) => next()), async (req, res) => {
+    try {
+      const syncRunId = typeof req.body?.syncRunId === 'string' ? req.body.syncRunId.trim() : '';
+      if (!syncRunId) {
+        return res.status(400).json({ error: 'syncRunId is required' });
+      }
+      const result = await receiver.finalize({ syncRunId });
+      res.json(result);
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  app.post('/api/openchamber/config-sync/abort', express?.json?.({ limit: '64kb' }) || ((req, _res, next) => next()), async (req, res) => {
+    try {
+      const syncRunId = typeof req.body?.syncRunId === 'string' ? req.body.syncRunId.trim() : '';
+      res.json(receiver.abort({ syncRunId: syncRunId || undefined }));
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  app.get('/api/openchamber/config-sync/credential-auth', async (_req, res) => {
+    try {
+      const authorized = await receiver.isInboundCredentialAuthorized();
+      res.json({ authorized });
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  app.put('/api/openchamber/config-sync/credential-auth', express?.json?.({ limit: '16kb' }) || ((req, _res, next) => next()), async (req, res) => {
+    try {
+      const authorized = req.body?.authorized === true;
+      const result = await receiver.setInboundCredentialAuthorized(authorized);
+      res.json(result);
+    } catch (error) {
+      sendError(res, error);
+    }
+  });
+
+  return { receiver };
+};

package/server/lib/config-sync/routes.test.js

@@ -0,0 +1,154 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import express from 'express';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import request from 'supertest';
+
+import { createConfigSyncReceiver } from './receiver.js';
+import { registerConfigSyncRoutes } from './routes.js';
+import { CREDENTIAL_SYNC_UNAUTHORIZED_CODE } from './credential-auth.js';
+
+const tempDirs = [];
+
+const makeTempDir = async () => {
+  const dir = await fsp.mkdtemp(path.join(os.tmpdir(), 'oc-config-sync-http-'));
+  tempDirs.push(dir);
+  return dir;
+};
+
+afterEach(async () => {
+  while (tempDirs.length > 0) {
+    await fsp.rm(tempDirs.pop(), { recursive: true, force: true });
+  }
+});
+
+const createApp = async () => {
+  const home = await makeTempDir();
+  const configDir = path.join(home, '.config', 'opencode');
+  await fsp.mkdir(configDir, { recursive: true });
+  await fsp.writeFile(path.join(configDir, 'opencode.jsonc'), '{}\n');
+  await fsp.writeFile(path.join(configDir, 'AGENTS.md'), 'hi\n');
+
+  let settings = {};
+  const receiver = createConfigSyncReceiver({
+    homedir: () => home,
+    readSettings: async () => ({ ...settings }),
+    writeSettingsPatch: async (patch) => {
+      settings = { ...settings, ...patch };
+    },
+  });
+
+  const app = express();
+  registerConfigSyncRoutes(app, { receiver, express });
+  return { app, home, receiver, getSettings: () => settings };
+};
+
+describe('config-sync HTTP routes', () => {
+  it('runs probe → prepare → finalize (empty payload) and keeps backup generation', async () => {
+    const { app, home } = await createApp();
+    const plan = {
+      direction: 'push',
+      files: [{ path: 'opencode.jsonc', bytes: 3 }],
+      directories: [],
+      deletes: ['config.json', 'opencode.json'],
+      agentsRoot: null,
+      authFile: null,
+      totalBytes: 3,
+    };
+
+    const probe = await request(app).post('/api/openchamber/config-sync/probe').send({ plan });
+    expect(probe.status).toBe(200);
+    expect(probe.body.inventory.files.some((entry) => entry.path === 'opencode.jsonc')).toBe(true);
+
+    const prepare = await request(app)
+      .post('/api/openchamber/config-sync/prepare')
+      .send({ plan, syncRunId: 'run-http-1' });
+    expect(prepare.status).toBe(200);
+    expect(prepare.body.ready).toBe(true);
+
+    const finalize = await request(app)
+      .post('/api/openchamber/config-sync/finalize')
+      .send({ syncRunId: 'run-http-1' });
+    expect(finalize.status).toBe(200);
+    expect(finalize.body.ok).toBe(true);
+    expect(finalize.body.syncRunId).toBe('run-http-1');
+
+    const backup = path.join(home, '.config', 'opencode', '.openchamber.sync-backup', 'run-http-1');
+    await expect(fsp.stat(backup)).resolves.toMatchObject({ });
+  });
+
+  it('rejects auth put without inbound credential authorization', async () => {
+    const { app } = await createApp();
+    const plan = {
+      direction: 'push',
+      files: [],
+      directories: [],
+      deletes: [],
+      agentsRoot: null,
+      authFile: { bytes: 2 },
+      totalBytes: 2,
+    };
+    await request(app).post('/api/openchamber/config-sync/prepare').send({ plan, syncRunId: 'run-auth' });
+    const put = await request(app)
+      .put('/api/openchamber/config-sync/put/auth?syncRunId=run-auth')
+      .set('Content-Type', 'application/gzip')
+      .send(Buffer.from('xx'));
+    expect(put.status).toBe(403);
+    expect(put.body.code).toBe(CREDENTIAL_SYNC_UNAUTHORIZED_CODE);
+    await request(app).post('/api/openchamber/config-sync/abort').send({ syncRunId: 'run-auth' });
+  });
+
+  it('rejects a second concurrent prepare', async () => {
+    const { app } = await createApp();
+    const plan = {
+      direction: 'push',
+      files: [{ path: 'AGENTS.md', bytes: 2 }],
+      directories: [],
+      deletes: [],
+      agentsRoot: null,
+      authFile: null,
+      totalBytes: 2,
+    };
+    const first = await request(app).post('/api/openchamber/config-sync/prepare').send({ plan, syncRunId: 'run-a' });
+    expect(first.status).toBe(200);
+    const second = await request(app).post('/api/openchamber/config-sync/prepare').send({ plan, syncRunId: 'run-b' });
+    expect(second.status).toBe(409);
+    expect(second.body.code).toBe('sync_in_progress');
+    await request(app).post('/api/openchamber/config-sync/abort').send({ syncRunId: 'run-a' });
+  });
+
+  it('aggregates chunked put streams and rejects oversized payloads', async () => {
+    const { app, receiver } = await createApp();
+    const plan = {
+      direction: 'push',
+      files: [],
+      directories: [],
+      deletes: [],
+      agentsRoot: null,
+      authFile: null,
+      totalBytes: 0,
+    };
+    await request(app).post('/api/openchamber/config-sync/prepare').send({ plan, syncRunId: 'run-stream' });
+    await receiver.setInboundCredentialAuthorized(true);
+
+    // Tiny invalid tar still proves chunk aggregation reached extract.
+    await expect(receiver.put({
+      syncRunId: 'run-stream',
+      kind: 'auth',
+      stream: Readable.from([Buffer.from('aa'), Buffer.from('bb')]),
+    })).rejects.toThrow(/tar|failed|Local tar extract/i);
+
+    await request(app).post('/api/openchamber/config-sync/abort').send({ syncRunId: 'run-stream' });
+  });
+
+  it('persists inbound credential authorization flag', async () => {
+    const { app, getSettings } = await createApp();
+    const before = await request(app).get('/api/openchamber/config-sync/credential-auth');
+    expect(before.body.authorized).toBe(false);
+    const after = await request(app).put('/api/openchamber/config-sync/credential-auth').send({ authorized: true });
+    expect(after.body.authorized).toBe(true);
+    expect(getSettings().configSyncInboundCredentialAuthorized).toBe(true);
+  });
+});