@opengsd/gsd-pi 1.7.0 → 1.8.1-dev.897b3c90

package/packages/gsd-cloud/dist/cli.js

@@ -0,0 +1,160 @@
+// Project/App: Open GSD
+// File Purpose: Standalone gsd-cloud CLI — login / status / connect / disconnect.
+//
+// Wires device-flow + CloudRuntime + a selected Executor adapter DIRECTLY. It has
+// no dependency on any Daemon or Orchestrator class; the only cloud behaviour is
+// the WS relay client driving the local GSD runtime through the Executor seam.
+import { parseArgs } from "node:util";
+import { resolveConfigPath, loadConfig } from "./config.js";
+import { Logger } from "./logger.js";
+import { clearCloudConfig, exchangePairingCode, redactedCloudStatus, saveCloudConfig, } from "./cloud-config.js";
+import { runDeviceFlow } from "./device-flow.js";
+import { CloudRuntime } from "./cloud-runtime.js";
+import { selectExecutor } from "./executors/index.js";
+export async function handleCloudCommand(argv, opts) {
+    if (argv[0] === "--help" || argv[0] === "-h") {
+        process.stdout.write(formatUsage(opts.binaryName));
+        process.exit(0);
+    }
+    const command = argv[0];
+    const { values } = parseArgs({
+        args: argv.slice(1),
+        options: {
+            config: { type: "string", short: "c" },
+            gateway: { type: "string" },
+            code: { type: "string" },
+            "runtime-name": { type: "string" },
+            verbose: { type: "boolean", short: "v", default: false },
+            help: { type: "boolean", short: "h", default: false },
+        },
+        strict: true,
+    });
+    if (values.help || !command) {
+        process.stdout.write(formatUsage(opts.binaryName));
+        process.exit(0);
+    }
+    const configPath = resolveConfigPath(values.config);
+    if (command === "status") {
+        process.stdout.write(`${JSON.stringify(redactedCloudStatus(loadConfig(configPath)), null, 2)}\n`);
+        return;
+    }
+    if (command === "disconnect") {
+        clearCloudConfig(configPath);
+        process.stdout.write(`${opts.binaryName}: cloud runtime disconnected locally.\n`);
+        return;
+    }
+    if (command === "login") {
+        if (!values.gateway) {
+            throw new Error("login requires --gateway");
+        }
+        const runtimeName = values["runtime-name"];
+        const { deviceToken, runtimeId, gatewayUrl } = await runDeviceFlow({
+            gatewayUrl: values.gateway,
+            configPath,
+            runtimeName,
+            binaryName: opts.binaryName,
+        });
+        const config = saveCloudConfig(configPath, {
+            gateway_url: gatewayUrl,
+            device_token: deviceToken,
+            runtime_id: runtimeId,
+            ...(runtimeName ? { runtime_name: runtimeName } : {}),
+            enabled: true,
+        });
+        process.stdout.write(`${opts.binaryName}: cloud runtime ${runtimeId} paired — connecting...\n`);
+        await runCloudRuntime(config, opts.binaryName, values.verbose);
+        return;
+    }
+    if (command === "pair") {
+        if (!values.gateway || !values.code) {
+            throw new Error("pair requires --gateway and --code");
+        }
+        const runtimeName = values["runtime-name"];
+        const result = await exchangePairingCode({
+            gatewayUrl: values.gateway,
+            code: values.code,
+            runtimeName,
+        });
+        saveCloudConfig(configPath, {
+            gateway_url: values.gateway,
+            device_token: result.deviceToken,
+            runtime_id: result.runtimeId,
+            ...(runtimeName ? { runtime_name: runtimeName } : {}),
+            enabled: true,
+        });
+        process.stdout.write(`${opts.binaryName}: paired cloud runtime ${result.runtimeId}.\n`);
+        return;
+    }
+    if (command === "connect") {
+        const config = loadConfig(configPath);
+        if (!config.cloud?.device_token || !config.cloud.runtime_id) {
+            throw new Error("cloud runtime is not paired; run `login` first");
+        }
+        await runCloudRuntime(config, opts.binaryName, values.verbose);
+        return;
+    }
+    throw new Error(`Unknown cloud runtime command: ${command}`);
+}
+/**
+ * Start the WS relay and block until the process is signalled. This is the whole
+ * "daemon" for the standalone agent: one CloudRuntime + one Executor, no Discord,
+ * no scanner, no session-manager class.
+ */
+async function runCloudRuntime(config, binaryName, verbose) {
+    if (!config.cloud)
+        throw new Error("cloud runtime is not configured");
+    if (config.cloud.enabled === false) {
+        throw new Error("cloud runtime is disabled in config; set cloud.enabled to true to connect");
+    }
+    const logger = new Logger({
+        filePath: config.log.file,
+        level: config.log.level,
+        verbose,
+    });
+    const executor = selectExecutor(logger);
+    const runtime = new CloudRuntime(config.cloud, executor, logger);
+    await runtime.start();
+    process.stdout.write(`${binaryName}: connected to ${config.cloud.gateway_url}. Press Ctrl+C to stop.\n`);
+    await new Promise((resolve) => {
+        const shutdown = () => {
+            runtime.stop();
+            void Promise.resolve(executor.close?.()).finally(() => {
+                void logger.close().finally(() => resolve());
+            });
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+    });
+}
+export function formatUsage(binaryName) {
+    return `Usage: ${binaryName} login [--gateway <url>] [--runtime-name <name>] [--config <path>]
+       ${binaryName} status [--config <path>]
+       ${binaryName} pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]
+       ${binaryName} connect [--config <path>] [--verbose]
+       ${binaryName} disconnect [--config <path>]
+
+Commands:
+  login      (Recommended) Browser-based pairing — opens an approval URL in the
+             terminal, polls for authorization, then auto-connects. Defaults to
+             the public GSD Cloud gateway.
+  status     Show current cloud runtime configuration and connection status.
+  pair       Exchange a pairing code for a device token (headless/CI environments).
+  connect    Connect using a previously paired device token.
+  disconnect Remove cloud runtime configuration from the local config file.
+
+Options:
+  --config <path>        Path to YAML config file (default: ~/.gsd/daemon.yaml)
+  --gateway <url>        Cloud gateway URL (login defaults to https://cloud.opengsd.net)
+  --code <code>          Pairing code from the gateway (pair only)
+  --runtime-name <name>  Friendly name for this local GSD runtime
+  --verbose              Print log entries to stderr in addition to the log file
+  --help                 Show this help message and exit
+
+Environment:
+  GSD_CLOUD_PROJECTS     Path-delimiter separated project dirs to advertise
+                         (default: current working directory)
+  GSD_CLI_PATH           Path to the gsd binary (default: gsd on PATH)
+  GSD_CLOUD_EXECUTOR     Backend adapter: gsd-pi (default), codex, claude
+`;
+}
+//# sourceMappingURL=cli.js.map

package/packages/gsd-cloud/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,kFAAkF;AAClF,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,+EAA+E;AAE/E,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAc,EAAE,IAExD;IACC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnB,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;YACxD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;SACtD;QACD,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEpD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,yCAAyC,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC;YACjE,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,UAAU;YACV,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE;YACzC,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,SAAS;YACrB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,mBAAmB,SAAS,2BAA2B,CAAC,CAAC;QAChG,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW;SACZ,CAAC,CAAC;QACH,eAAe,CAAC,UAAU,EAAE;YAC1B,WAAW,EAAE,MAAM,CAAC,OAAO;YAC3B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,MAAoB,EAAE,UAAkB,EAAE,OAAgB;IACvF,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;QACzB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;QACvB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,kBAAkB,MAAM,CAAC,KAAK,CAAC,WAAW,2BAA2B,CAAC,CAAC;IAEzG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACpD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,OAAO,UAAU,UAAU;SACpB,UAAU;SACV,UAAU;SACV,UAAU;SACV,UAAU;;;;;;;;;;;;;;;;;;;;;;;;CAwBlB,CAAC;AACF,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Standalone gsd-cloud CLI — login / status / connect / disconnect.\n//\n// Wires device-flow + CloudRuntime + a selected Executor adapter DIRECTLY. It has\n// no dependency on any Daemon or Orchestrator class; the only cloud behaviour is\n// the WS relay client driving the local GSD runtime through the Executor seam.\n\nimport { parseArgs } from \"node:util\";\nimport { resolveConfigPath, loadConfig } from \"./config.js\";\nimport { Logger } from \"./logger.js\";\nimport {\n  clearCloudConfig,\n  exchangePairingCode,\n  redactedCloudStatus,\n  saveCloudConfig,\n} from \"./cloud-config.js\";\nimport { runDeviceFlow } from \"./device-flow.js\";\nimport { CloudRuntime } from \"./cloud-runtime.js\";\nimport { selectExecutor } from \"./executors/index.js\";\nimport type { DaemonConfig } from \"./types.js\";\n\nexport async function handleCloudCommand(argv: string[], opts: {\n  binaryName: string;\n}): Promise<void> {\n  if (argv[0] === \"--help\" || argv[0] === \"-h\") {\n    process.stdout.write(formatUsage(opts.binaryName));\n    process.exit(0);\n  }\n\n  const command = argv[0];\n  const { values } = parseArgs({\n    args: argv.slice(1),\n    options: {\n      config: { type: \"string\", short: \"c\" },\n      gateway: { type: \"string\" },\n      code: { type: \"string\" },\n      \"runtime-name\": { type: \"string\" },\n      verbose: { type: \"boolean\", short: \"v\", default: false },\n      help: { type: \"boolean\", short: \"h\", default: false },\n    },\n    strict: true,\n  });\n\n  if (values.help || !command) {\n    process.stdout.write(formatUsage(opts.binaryName));\n    process.exit(0);\n  }\n\n  const configPath = resolveConfigPath(values.config);\n\n  if (command === \"status\") {\n    process.stdout.write(`${JSON.stringify(redactedCloudStatus(loadConfig(configPath)), null, 2)}\\n`);\n    return;\n  }\n\n  if (command === \"disconnect\") {\n    clearCloudConfig(configPath);\n    process.stdout.write(`${opts.binaryName}: cloud runtime disconnected locally.\\n`);\n    return;\n  }\n\n  if (command === \"login\") {\n    if (!values.gateway) {\n      throw new Error(\"login requires --gateway\");\n    }\n    const runtimeName = values[\"runtime-name\"];\n    const { deviceToken, runtimeId, gatewayUrl } = await runDeviceFlow({\n      gatewayUrl: values.gateway,\n      configPath,\n      runtimeName,\n      binaryName: opts.binaryName,\n    });\n    const config = saveCloudConfig(configPath, {\n      gateway_url: gatewayUrl,\n      device_token: deviceToken,\n      runtime_id: runtimeId,\n      ...(runtimeName ? { runtime_name: runtimeName } : {}),\n      enabled: true,\n    });\n    process.stdout.write(`${opts.binaryName}: cloud runtime ${runtimeId} paired — connecting...\\n`);\n    await runCloudRuntime(config, opts.binaryName, values.verbose);\n    return;\n  }\n\n  if (command === \"pair\") {\n    if (!values.gateway || !values.code) {\n      throw new Error(\"pair requires --gateway and --code\");\n    }\n    const runtimeName = values[\"runtime-name\"];\n    const result = await exchangePairingCode({\n      gatewayUrl: values.gateway,\n      code: values.code,\n      runtimeName,\n    });\n    saveCloudConfig(configPath, {\n      gateway_url: values.gateway,\n      device_token: result.deviceToken,\n      runtime_id: result.runtimeId,\n      ...(runtimeName ? { runtime_name: runtimeName } : {}),\n      enabled: true,\n    });\n    process.stdout.write(`${opts.binaryName}: paired cloud runtime ${result.runtimeId}.\\n`);\n    return;\n  }\n\n  if (command === \"connect\") {\n    const config = loadConfig(configPath);\n    if (!config.cloud?.device_token || !config.cloud.runtime_id) {\n      throw new Error(\"cloud runtime is not paired; run `login` first\");\n    }\n    await runCloudRuntime(config, opts.binaryName, values.verbose);\n    return;\n  }\n\n  throw new Error(`Unknown cloud runtime command: ${command}`);\n}\n\n/**\n * Start the WS relay and block until the process is signalled. This is the whole\n * \"daemon\" for the standalone agent: one CloudRuntime + one Executor, no Discord,\n * no scanner, no session-manager class.\n */\nasync function runCloudRuntime(config: DaemonConfig, binaryName: string, verbose: boolean): Promise<void> {\n  if (!config.cloud) throw new Error(\"cloud runtime is not configured\");\n  if (config.cloud.enabled === false) {\n    throw new Error(\"cloud runtime is disabled in config; set cloud.enabled to true to connect\");\n  }\n  const logger = new Logger({\n    filePath: config.log.file,\n    level: config.log.level,\n    verbose,\n  });\n  const executor = selectExecutor(logger);\n  const runtime = new CloudRuntime(config.cloud, executor, logger);\n  await runtime.start();\n  process.stdout.write(`${binaryName}: connected to ${config.cloud.gateway_url}. Press Ctrl+C to stop.\\n`);\n\n  await new Promise<void>((resolve) => {\n    const shutdown = () => {\n      runtime.stop();\n      void Promise.resolve(executor.close?.()).finally(() => {\n        void logger.close().finally(() => resolve());\n      });\n    };\n    process.once(\"SIGINT\", shutdown);\n    process.once(\"SIGTERM\", shutdown);\n  });\n}\n\nexport function formatUsage(binaryName: string): string {\n  return `Usage: ${binaryName} login [--gateway <url>] [--runtime-name <name>] [--config <path>]\n       ${binaryName} status [--config <path>]\n       ${binaryName} pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]\n       ${binaryName} connect [--config <path>] [--verbose]\n       ${binaryName} disconnect [--config <path>]\n\nCommands:\n  login      (Recommended) Browser-based pairing — opens an approval URL in the\n             terminal, polls for authorization, then auto-connects. Defaults to\n             the public GSD Cloud gateway.\n  status     Show current cloud runtime configuration and connection status.\n  pair       Exchange a pairing code for a device token (headless/CI environments).\n  connect    Connect using a previously paired device token.\n  disconnect Remove cloud runtime configuration from the local config file.\n\nOptions:\n  --config <path>        Path to YAML config file (default: ~/.gsd/daemon.yaml)\n  --gateway <url>        Cloud gateway URL (login defaults to https://cloud.opengsd.net)\n  --code <code>          Pairing code from the gateway (pair only)\n  --runtime-name <name>  Friendly name for this local GSD runtime\n  --verbose              Print log entries to stderr in addition to the log file\n  --help                 Show this help message and exit\n\nEnvironment:\n  GSD_CLOUD_PROJECTS     Path-delimiter separated project dirs to advertise\n                         (default: current working directory)\n  GSD_CLI_PATH           Path to the gsd binary (default: gsd on PATH)\n  GSD_CLOUD_EXECUTOR     Backend adapter: gsd-pi (default), codex, claude\n`;\n}\n"]}

package/packages/gsd-cloud/dist/cloud-config.d.ts

@@ -0,0 +1,19 @@
+import type { LookupFunction } from "node:net";
+import type { DaemonConfig } from "./types.js";
+export interface PairingExchangeResult {
+    runtimeId: string;
+    deviceToken: string;
+}
+export declare function exchangePairingCode(params: {
+    gatewayUrl: string;
+    code: string;
+    runtimeName?: string;
+}): Promise<PairingExchangeResult>;
+export declare function parseCloudGatewayUrl(value: string): URL;
+export declare function saveCloudConfig(configPath: string, nextCloud: NonNullable<DaemonConfig["cloud"]>): DaemonConfig;
+export declare function clearCloudConfig(configPath: string): DaemonConfig;
+export declare function redactedCloudStatus(config: DaemonConfig): Record<string, unknown>;
+export declare function validateGatewayNetworkTarget(url: URL): void;
+export declare function createGatewayLookup(url: URL): LookupFunction;
+export declare function postJsonToValidatedGateway(url: URL, payload: Record<string, unknown>, timeoutMs?: number): Promise<Record<string, unknown>>;
+//# sourceMappingURL=cloud-config.d.ts.map

package/packages/gsd-cloud/dist/cloud-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAUjC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CA2BvD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,YAAY,CAgB/G;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAWjE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWjF;AAeD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAK3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAkC5D;AAiCD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,GAAE,MAAmC,GAC7C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsClC"}

package/packages/gsd-cloud/dist/cloud-config.js

@@ -0,0 +1,231 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { lookup } from "node:dns";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { dirname } from "node:path";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { loadConfig } from "./config.js";
+import { protectCloudDeviceToken } from "./cloud-token.js";
+export async function exchangePairingCode(params) {
+    const pairingUrl = new URL("/pairing/exchange", parseCloudGatewayUrl(params.gatewayUrl));
+    const body = await postJsonToValidatedGateway(pairingUrl, {
+        code: params.code,
+        runtimeName: params.runtimeName,
+    });
+    if (typeof body.runtimeId !== "string" || typeof body.deviceToken !== "string") {
+        throw new Error("Pairing response did not include runtimeId and deviceToken");
+    }
+    return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };
+}
+export function parseCloudGatewayUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Cloud gateway URL must be an absolute HTTP(S) URL");
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new Error("Cloud gateway URL must use http or https");
+    }
+    if (url.username || url.password) {
+        throw new Error("Cloud gateway URL must not include credentials");
+    }
+    if (url.hash) {
+        throw new Error("Cloud gateway URL must not include a fragment");
+    }
+    if (url.protocol === "http:" && !isLoopbackHost(url.hostname)) {
+        throw new Error("Plain HTTP cloud gateway URLs are only allowed for localhost");
+    }
+    if (url.protocol === "https:" && isPrivateIpHost(url.hostname)) {
+        throw new Error("Cloud gateway URL must not target private or loopback IP addresses");
+    }
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    return url;
+}
+export function saveCloudConfig(configPath, nextCloud) {
+    let raw = {};
+    try {
+        raw = parseYaml(readFileSync(configPath, "utf-8")) ?? {};
+    }
+    catch {
+        raw = {};
+    }
+    const { device_token: deviceToken, ...cloud } = nextCloud;
+    raw.cloud = {
+        ...cloud,
+        gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),
+        ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),
+    };
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeConfigFile(configPath, stringifyYaml(raw));
+    return loadConfig(configPath);
+}
+export function clearCloudConfig(configPath) {
+    let raw = {};
+    try {
+        raw = parseYaml(readFileSync(configPath, "utf-8")) ?? {};
+    }
+    catch {
+        raw = {};
+    }
+    delete raw.cloud;
+    mkdirSync(dirname(configPath), { recursive: true });
+    writeConfigFile(configPath, stringifyYaml(raw));
+    return loadConfig(configPath);
+}
+export function redactedCloudStatus(config) {
+    const cloud = config.cloud;
+    if (!cloud)
+        return { configured: false };
+    return {
+        configured: true,
+        enabled: cloud.enabled ?? true,
+        gateway_url: cloud.gateway_url,
+        runtime_id: cloud.runtime_id ?? null,
+        runtime_name: cloud.runtime_name ?? null,
+        ["device_" + "token"]: cloud.device_token ? "[redacted]" : null,
+    };
+}
+function isLoopbackHost(hostname) {
+    const host = hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+function isPrivateIpHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost")
+        return true;
+    if (isIP(host) === 4)
+        return isPrivateIpv4(host);
+    if (isIP(host) === 6)
+        return isPrivateIpv6(host);
+    return false;
+}
+export function validateGatewayNetworkTarget(url) {
+    if (url.protocol === "http:" && isLoopbackHost(url.hostname))
+        return;
+    if (isPrivateIpHost(url.hostname)) {
+        throw new Error("Cloud gateway URL must not target private or loopback IP addresses");
+    }
+}
+export function createGatewayLookup(url) {
+    const allowLoopback = url.protocol === "http:" && isLoopbackHost(url.hostname);
+    const rejected = (address) => !address || (!allowLoopback && isPrivateIpHost(address));
+    // Node's socket connect (autoSelectFamily / Happy Eyeballs, default-on since
+    // Node 20) calls a custom lookup with `all: true` and expects an ARRAY
+    // callback. Forcing `all: false` + a scalar callback made every real gateway
+    // request throw "Invalid IP address: undefined". Honor both forms; the SSRF
+    // guard is applied to every resolved address (reject the whole lookup if any
+    // is private/loopback — an attacker-controlled resolver must not slip one in).
+    return ((hostname, options, callback) => {
+        const wantsAll = typeof options === "object" && options !== null && options.all === true;
+        const base = typeof options === "number" ? { family: options } : { ...options };
+        if (wantsAll) {
+            lookup(hostname, { ...base, all: true }, (err, addresses) => {
+                if (err)
+                    return callback(err);
+                const list = addresses;
+                if (!list.length || list.some((entry) => rejected(entry.address))) {
+                    return callback(new Error("Cloud gateway URL resolved to a private or loopback address"));
+                }
+                callback(null, list);
+            });
+            return;
+        }
+        lookup(hostname, { ...base, all: false }, (err, address, family) => {
+            if (err)
+                return callback(err, address, family);
+            if (rejected(address)) {
+                return callback(new Error("Cloud gateway URL resolved to a private or loopback address"), address, family);
+            }
+            callback(null, address, family);
+        });
+    });
+}
+function isPrivateIpv4(host) {
+    const octets = host.split(".").map((part) => Number(part));
+    if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return true;
+    const [a, b] = octets;
+    if (a === 10 || a === 127 || a === 0)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    if (a === 192 && b === 0)
+        return true;
+    if (a === 198 && (b === 18 || b === 19))
+        return true;
+    if (a >= 224)
+        return true;
+    return false;
+}
+function isPrivateIpv6(host) {
+    return host === "::"
+        || host === "::1"
+        || host.startsWith("fc")
+        || host.startsWith("fd")
+        || host.startsWith("fe80:")
+        || host.startsWith("2001:db8:");
+}
+function writeConfigFile(configPath, contents) {
+    writeFileSync(configPath, contents, { encoding: "utf-8", mode: 0o600 });
+    chmodSync(configPath, 0o600);
+}
+const GATEWAY_REQUEST_TIMEOUT_MS = 30_000;
+export function postJsonToValidatedGateway(url, payload, timeoutMs = GATEWAY_REQUEST_TIMEOUT_MS) {
+    validateGatewayNetworkTarget(url);
+    const body = JSON.stringify(payload);
+    const requestImpl = url.protocol === "https:" ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        const req = requestImpl({
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port,
+            path: `${url.pathname}${url.search}`,
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "content-length": Buffer.byteLength(body),
+            },
+            lookup: createGatewayLookup(url),
+        }, (res) => {
+            const statusCode = res.statusCode ?? 0;
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+            res.on("end", () => {
+                const responseText = Buffer.concat(chunks).toString("utf-8");
+                const parsed = parseJsonObject(responseText);
+                if (statusCode < 200 || statusCode >= 300) {
+                    reject(new Error(typeof parsed.error === "string" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));
+                    return;
+                }
+                resolve(parsed);
+            });
+        });
+        req.setTimeout(timeoutMs, () => {
+            req.destroy(new Error(`Gateway request timed out after ${timeoutMs}ms`));
+        });
+        req.on("error", reject);
+        req.end(body);
+    });
+}
+function parseJsonObject(value) {
+    try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=cloud-config.js.map

package/packages/gsd-cloud/dist/cloud-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQ3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAIzC;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAA6C;IAC/F,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1D,GAAG,CAAC,KAAK,GAAG;QACV,GAAG,KAAK;QACR,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;QACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACjB,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAQ;IACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAW,EAAE,CAC5C,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,OAAO,CAAC,CAAC,QAAgB,EAAE,OAAgB,EAAE,QAAsC,EAAE,EAAE;QACrF,MAAM,QAAQ,GACZ,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAK,OAAyB,CAAC,GAAG,KAAK,IAAI,CAAC;QAC7F,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAI,OAAyB,EAAE,CAAC;QACxF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBAC1D,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,SAAuD,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAClE,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC;gBAC5F,CAAC;gBACD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACjE,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7G,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAA8B,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,IAAI;WACf,IAAI,KAAK,KAAK;WACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;WACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAgB;IAC3D,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,MAAM,UAAU,0BAA0B,CACxC,GAAQ,EACR,OAAgC,EAChC,YAAoB,0BAA0B;IAE9C,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;aAC1C;YACD,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9G,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,SAAS,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { lookup } from \"node:dns\";\nimport type { LookupOptions } from \"node:dns\";\nimport { request as httpRequest } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP } from \"node:net\";\nimport type { LookupFunction } from \"node:net\";\nimport { dirname } from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { loadConfig } from \"./config.js\";\nimport { protectCloudDeviceToken } from \"./cloud-token.js\";\nimport type { DaemonConfig } from \"./types.js\";\n\nexport interface PairingExchangeResult {\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport async function exchangePairingCode(params: {\n  gatewayUrl: string;\n  code: string;\n  runtimeName?: string;\n}): Promise<PairingExchangeResult> {\n  const pairingUrl = new URL(\"/pairing/exchange\", parseCloudGatewayUrl(params.gatewayUrl));\n  const body = await postJsonToValidatedGateway(pairingUrl, {\n    code: params.code,\n    runtimeName: params.runtimeName,\n  });\n  if (typeof body.runtimeId !== \"string\" || typeof body.deviceToken !== \"string\") {\n    throw new Error(\"Pairing response did not include runtimeId and deviceToken\");\n  }\n  return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };\n}\n\nexport function parseCloudGatewayUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Cloud gateway URL must be an absolute HTTP(S) URL\");\n  }\n\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"Cloud gateway URL must use http or https\");\n  }\n  if (url.username || url.password) {\n    throw new Error(\"Cloud gateway URL must not include credentials\");\n  }\n  if (url.hash) {\n    throw new Error(\"Cloud gateway URL must not include a fragment\");\n  }\n  if (url.protocol === \"http:\" && !isLoopbackHost(url.hostname)) {\n    throw new Error(\"Plain HTTP cloud gateway URLs are only allowed for localhost\");\n  }\n  if (url.protocol === \"https:\" && isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n\n  url.pathname = url.pathname.replace(/\\/+$/, \"\");\n  url.search = \"\";\n  return url;\n}\n\nexport function saveCloudConfig(configPath: string, nextCloud: NonNullable<DaemonConfig[\"cloud\"]>): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  const { device_token: deviceToken, ...cloud } = nextCloud;\n  raw.cloud = {\n    ...cloud,\n    gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),\n    ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),\n  };\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function clearCloudConfig(configPath: string): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  delete raw.cloud;\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function redactedCloudStatus(config: DaemonConfig): Record<string, unknown> {\n  const cloud = config.cloud;\n  if (!cloud) return { configured: false };\n  return {\n    configured: true,\n    enabled: cloud.enabled ?? true,\n    gateway_url: cloud.gateway_url,\n    runtime_id: cloud.runtime_id ?? null,\n    runtime_name: cloud.runtime_name ?? null,\n    [\"device_\" + \"token\"]: cloud.device_token ? \"[redacted]\" : null,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase();\n  return host === \"localhost\" || host === \"127.0.0.1\" || host === \"::1\" || host === \"[::1]\";\n}\n\nfunction isPrivateIpHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host === \"localhost\") return true;\n  if (isIP(host) === 4) return isPrivateIpv4(host);\n  if (isIP(host) === 6) return isPrivateIpv6(host);\n  return false;\n}\n\nexport function validateGatewayNetworkTarget(url: URL): void {\n  if (url.protocol === \"http:\" && isLoopbackHost(url.hostname)) return;\n  if (isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n}\n\nexport function createGatewayLookup(url: URL): LookupFunction {\n  const allowLoopback = url.protocol === \"http:\" && isLoopbackHost(url.hostname);\n  const rejected = (address: string): boolean =>\n    !address || (!allowLoopback && isPrivateIpHost(address));\n  // Node's socket connect (autoSelectFamily / Happy Eyeballs, default-on since\n  // Node 20) calls a custom lookup with `all: true` and expects an ARRAY\n  // callback. Forcing `all: false` + a scalar callback made every real gateway\n  // request throw \"Invalid IP address: undefined\". Honor both forms; the SSRF\n  // guard is applied to every resolved address (reject the whole lookup if any\n  // is private/loopback — an attacker-controlled resolver must not slip one in).\n  return ((hostname: string, options: unknown, callback: (...args: unknown[]) => void) => {\n    const wantsAll =\n      typeof options === \"object\" && options !== null && (options as LookupOptions).all === true;\n    const base: LookupOptions =\n      typeof options === \"number\" ? { family: options } : { ...(options as LookupOptions) };\n    if (wantsAll) {\n      lookup(hostname, { ...base, all: true }, (err, addresses) => {\n        if (err) return callback(err);\n        const list = addresses as Array<{ address: string; family: number }>;\n        if (!list.length || list.some((entry) => rejected(entry.address))) {\n          return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"));\n        }\n        callback(null, list);\n      });\n      return;\n    }\n    lookup(hostname, { ...base, all: false }, (err, address, family) => {\n      if (err) return callback(err, address, family);\n      if (rejected(address)) {\n        return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"), address, family);\n      }\n      callback(null, address, family);\n    });\n  }) as unknown as LookupFunction;\n}\n\nfunction isPrivateIpv4(host: string): boolean {\n  const octets = host.split(\".\").map((part) => Number(part));\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;\n  const [a, b] = octets;\n  if (a === 10 || a === 127 || a === 0) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv6(host: string): boolean {\n  return host === \"::\"\n    || host === \"::1\"\n    || host.startsWith(\"fc\")\n    || host.startsWith(\"fd\")\n    || host.startsWith(\"fe80:\")\n    || host.startsWith(\"2001:db8:\");\n}\n\nfunction writeConfigFile(configPath: string, contents: string): void {\n  writeFileSync(configPath, contents, { encoding: \"utf-8\", mode: 0o600 });\n  chmodSync(configPath, 0o600);\n}\n\nconst GATEWAY_REQUEST_TIMEOUT_MS = 30_000;\n\nexport function postJsonToValidatedGateway(\n  url: URL,\n  payload: Record<string, unknown>,\n  timeoutMs: number = GATEWAY_REQUEST_TIMEOUT_MS,\n): Promise<Record<string, unknown>> {\n  validateGatewayNetworkTarget(url);\n  const body = JSON.stringify(payload);\n  const requestImpl = url.protocol === \"https:\" ? httpsRequest : httpRequest;\n\n  return new Promise((resolve, reject) => {\n    const req = requestImpl({\n      protocol: url.protocol,\n      hostname: url.hostname,\n      port: url.port,\n      path: `${url.pathname}${url.search}`,\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        \"content-length\": Buffer.byteLength(body),\n      },\n      lookup: createGatewayLookup(url),\n    }, (res) => {\n      const statusCode = res.statusCode ?? 0;\n      const chunks: Buffer[] = [];\n      res.on(\"data\", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));\n      res.on(\"end\", () => {\n        const responseText = Buffer.concat(chunks).toString(\"utf-8\");\n        const parsed = parseJsonObject(responseText);\n        if (statusCode < 200 || statusCode >= 300) {\n          reject(new Error(typeof parsed.error === \"string\" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));\n          return;\n        }\n        resolve(parsed);\n      });\n    });\n\n    req.setTimeout(timeoutMs, () => {\n      req.destroy(new Error(`Gateway request timed out after ${timeoutMs}ms`));\n    });\n    req.on(\"error\", reject);\n    req.end(body);\n  });\n}\n\nfunction parseJsonObject(value: string): Record<string, unknown> {\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/packages/gsd-cloud/dist/cloud-config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-config.test.d.ts.map

package/packages/gsd-cloud/dist/cloud-config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.test.d.ts","sourceRoot":"","sources":["../src/cloud-config.test.ts"],"names":[],"mappings":""}

package/packages/gsd-cloud/dist/cloud-config.test.js

@@ -0,0 +1,118 @@
+// Project/App: Open GSD
+// File Purpose: Tests for the cloud gateway config module. Two independent suites:
+//   1. SSRF-guard matrix for parseCloudGatewayUrl / validateGatewayNetworkTarget —
+//      loosening any branch (plain-HTTP carve-out, private/loopback IP rejection,
+//      protocol/credential/fragment checks) turns a case red.
+//   2. postJsonToValidatedGateway's request timeout — a hung gateway must reject
+//      rather than hang the pairing/device flow.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { parseCloudGatewayUrl, validateGatewayNetworkTarget, postJsonToValidatedGateway, } from "./cloud-config.js";
+// Each rejected case pairs an untrusted input with the substring the guard must
+// report — so a message change is deliberate, not accidental.
+const REJECTED = [
+    // Plain HTTP is only allowed for loopback hosts.
+    { input: "http://evil.example", message: /only allowed for localhost/ },
+    // RFC1918 private ranges over HTTPS.
+    { input: "https://10.0.0.1", message: /private or loopback/ },
+    { input: "https://192.168.1.1", message: /private or loopback/ },
+    { input: "https://172.16.0.1", message: /private or loopback/ },
+    // Link-local / cloud metadata endpoint.
+    { input: "https://169.254.169.254", message: /private or loopback/ },
+    // Loopback over HTTPS (IPv4 and IPv6 forms) and the localhost hostname.
+    { input: "https://127.0.0.1", message: /private or loopback/ },
+    { input: "https://[::1]", message: /private or loopback/ },
+    { input: "https://localhost", message: /private or loopback/ },
+    // Non-HTTP protocol.
+    { input: "ftp://gateway.example", message: /must use http or https/ },
+    // Embedded credentials / fragments are rejected outright.
+    { input: "https://user:pass@gateway.example", message: /must not include credentials/ },
+    { input: "https://gateway.example/#frag", message: /must not include a fragment/ },
+    // Unparseable / non-absolute inputs.
+    { input: "", message: /absolute HTTP\(S\) URL/ },
+    { input: "not a url", message: /absolute HTTP\(S\) URL/ },
+];
+for (const { input, message } of REJECTED) {
+    test(`parseCloudGatewayUrl rejects ${JSON.stringify(input)}`, () => {
+        assert.throws(() => parseCloudGatewayUrl(input), message);
+    });
+}
+// Accepted: a public HTTPS host and the documented local-dev plain-HTTP loopback carve-out.
+const ACCEPTED = [
+    { input: "https://cloud-gateway.opengsd.net", hostname: "cloud-gateway.opengsd.net", protocol: "https:" },
+    { input: "http://localhost:8787", hostname: "localhost", protocol: "http:" },
+    { input: "http://127.0.0.1:8787", hostname: "127.0.0.1", protocol: "http:" },
+];
+for (const { input, hostname, protocol } of ACCEPTED) {
+    test(`parseCloudGatewayUrl accepts ${JSON.stringify(input)}`, () => {
+        const url = parseCloudGatewayUrl(input);
+        assert.equal(url.hostname, hostname);
+        assert.equal(url.protocol, protocol);
+        // Round-trips to a usable absolute URL for the same host.
+        assert.equal(new URL(url.toString()).hostname, hostname);
+    });
+}
+// validateGatewayNetworkTarget is the request-time defense-in-depth guard applied to
+// already-constructed URLs (device code/token endpoints). Cover its branches directly.
+test("validateGatewayNetworkTarget rejects private/loopback targets", () => {
+    assert.throws(() => validateGatewayNetworkTarget(new URL("https://169.254.169.254")), /private or loopback/);
+    assert.throws(() => validateGatewayNetworkTarget(new URL("https://10.0.0.1")), /private or loopback/);
+    assert.throws(() => validateGatewayNetworkTarget(new URL("https://[::1]")), /private or loopback/);
+});
+test("validateGatewayNetworkTarget allows a public HTTPS host and http loopback", () => {
+    assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL("https://cloud-gateway.opengsd.net")));
+    assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL("http://localhost:8787")));
+    assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL("http://127.0.0.1:8787")));
+});
+// Start a loopback server, returning its base URL; skips the test under sandbox EPERM.
+async function listenLoopback(t, handler) {
+    const server = createServer(handler);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(0, "127.0.0.1", resolve);
+        });
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return null;
+        }
+        throw err;
+    }
+    const address = server.address();
+    assert.ok(address && typeof address === "object");
+    return {
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        close: () => new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve())),
+    };
+}
+test("postJsonToValidatedGateway rejects when the gateway never responds", async (t) => {
+    // Handler that accepts the request but never sends a response — the hung-server case.
+    const server = await listenLoopback(t, () => { });
+    if (!server)
+        return;
+    try {
+        await assert.rejects(postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200), /timed out after 200ms/);
+    }
+    finally {
+        await server.close();
+    }
+});
+test("postJsonToValidatedGateway resolves a fast healthy response before the timeout", async (t) => {
+    const server = await listenLoopback(t, (_req, res) => {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end("{}");
+    });
+    if (!server)
+        return;
+    try {
+        const body = await postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200);
+        assert.deepEqual(body, {});
+    }
+    finally {
+        await server.close();
+    }
+});
+//# sourceMappingURL=cloud-config.test.js.map

package/packages/gsd-cloud/dist/cloud-config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.test.js","sourceRoot":"","sources":["../src/cloud-config.test.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,mFAAmF;AACnF,mFAAmF;AACnF,kFAAkF;AAClF,8DAA8D;AAC9D,iFAAiF;AACjF,iDAAiD;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAwB,MAAM,WAAW,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,gFAAgF;AAChF,8DAA8D;AAC9D,MAAM,QAAQ,GAA8C;IAC1D,iDAAiD;IACjD,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACvE,qCAAqC;IACrC,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC7D,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAChE,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC/D,wCAAwC;IACxC,EAAE,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACpE,wEAAwE;IACxE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC9D,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC1D,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE;IAC9D,qBAAqB;IACrB,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACrE,0DAA0D;IAC1D,EAAE,KAAK,EAAE,mCAAmC,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACvF,EAAE,KAAK,EAAE,+BAA+B,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAClF,qCAAqC;IACrC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAChD,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE;CAC1D,CAAC;AAEF,KAAK,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;IAC1C,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,MAAM,QAAQ,GAAiE;IAC7E,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACzG,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC5E,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE;CAC7E,CAAC;AAEF,KAAK,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;IACrD,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE;QACjE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,0DAA0D;QAC1D,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,uFAAuF;AACvF,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC7G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACtG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC,CAAC,CAAC;AAEH,uFAAuF;AACvF,KAAK,UAAU,cAAc,CAC3B,CAAkC,EAClC,OAAwB;IAExB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE;QAC3C,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KAC1G,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,oEAAoE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrF,sFAAsF;IACtF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,GAA4B,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,0BAA0B,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EACnE,uBAAuB,CACxB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjG,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Tests for the cloud gateway config module. Two independent suites:\n//   1. SSRF-guard matrix for parseCloudGatewayUrl / validateGatewayNetworkTarget —\n//      loosening any branch (plain-HTTP carve-out, private/loopback IP rejection,\n//      protocol/credential/fragment checks) turns a case red.\n//   2. postJsonToValidatedGateway's request timeout — a hung gateway must reject\n//      rather than hang the pairing/device flow.\nimport { test } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport { createServer, type RequestListener } from \"node:http\";\nimport {\n  parseCloudGatewayUrl,\n  validateGatewayNetworkTarget,\n  postJsonToValidatedGateway,\n} from \"./cloud-config.js\";\n\n// Each rejected case pairs an untrusted input with the substring the guard must\n// report — so a message change is deliberate, not accidental.\nconst REJECTED: Array<{ input: string; message: RegExp }> = [\n  // Plain HTTP is only allowed for loopback hosts.\n  { input: \"http://evil.example\", message: /only allowed for localhost/ },\n  // RFC1918 private ranges over HTTPS.\n  { input: \"https://10.0.0.1\", message: /private or loopback/ },\n  { input: \"https://192.168.1.1\", message: /private or loopback/ },\n  { input: \"https://172.16.0.1\", message: /private or loopback/ },\n  // Link-local / cloud metadata endpoint.\n  { input: \"https://169.254.169.254\", message: /private or loopback/ },\n  // Loopback over HTTPS (IPv4 and IPv6 forms) and the localhost hostname.\n  { input: \"https://127.0.0.1\", message: /private or loopback/ },\n  { input: \"https://[::1]\", message: /private or loopback/ },\n  { input: \"https://localhost\", message: /private or loopback/ },\n  // Non-HTTP protocol.\n  { input: \"ftp://gateway.example\", message: /must use http or https/ },\n  // Embedded credentials / fragments are rejected outright.\n  { input: \"https://user:pass@gateway.example\", message: /must not include credentials/ },\n  { input: \"https://gateway.example/#frag\", message: /must not include a fragment/ },\n  // Unparseable / non-absolute inputs.\n  { input: \"\", message: /absolute HTTP\\(S\\) URL/ },\n  { input: \"not a url\", message: /absolute HTTP\\(S\\) URL/ },\n];\n\nfor (const { input, message } of REJECTED) {\n  test(`parseCloudGatewayUrl rejects ${JSON.stringify(input)}`, () => {\n    assert.throws(() => parseCloudGatewayUrl(input), message);\n  });\n}\n\n// Accepted: a public HTTPS host and the documented local-dev plain-HTTP loopback carve-out.\nconst ACCEPTED: Array<{ input: string; hostname: string; protocol: string }> = [\n  { input: \"https://cloud-gateway.opengsd.net\", hostname: \"cloud-gateway.opengsd.net\", protocol: \"https:\" },\n  { input: \"http://localhost:8787\", hostname: \"localhost\", protocol: \"http:\" },\n  { input: \"http://127.0.0.1:8787\", hostname: \"127.0.0.1\", protocol: \"http:\" },\n];\n\nfor (const { input, hostname, protocol } of ACCEPTED) {\n  test(`parseCloudGatewayUrl accepts ${JSON.stringify(input)}`, () => {\n    const url = parseCloudGatewayUrl(input);\n    assert.equal(url.hostname, hostname);\n    assert.equal(url.protocol, protocol);\n    // Round-trips to a usable absolute URL for the same host.\n    assert.equal(new URL(url.toString()).hostname, hostname);\n  });\n}\n\n// validateGatewayNetworkTarget is the request-time defense-in-depth guard applied to\n// already-constructed URLs (device code/token endpoints). Cover its branches directly.\ntest(\"validateGatewayNetworkTarget rejects private/loopback targets\", () => {\n  assert.throws(() => validateGatewayNetworkTarget(new URL(\"https://169.254.169.254\")), /private or loopback/);\n  assert.throws(() => validateGatewayNetworkTarget(new URL(\"https://10.0.0.1\")), /private or loopback/);\n  assert.throws(() => validateGatewayNetworkTarget(new URL(\"https://[::1]\")), /private or loopback/);\n});\n\ntest(\"validateGatewayNetworkTarget allows a public HTTPS host and http loopback\", () => {\n  assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL(\"https://cloud-gateway.opengsd.net\")));\n  assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL(\"http://localhost:8787\")));\n  assert.doesNotThrow(() => validateGatewayNetworkTarget(new URL(\"http://127.0.0.1:8787\")));\n});\n\n// Start a loopback server, returning its base URL; skips the test under sandbox EPERM.\nasync function listenLoopback(\n  t: { skip: (msg: string) => void },\n  handler: RequestListener,\n): Promise<{ baseUrl: string; close: () => Promise<void> } | null> {\n  const server = createServer(handler);\n  try {\n    await new Promise<void>((resolve, reject) => {\n      server.once(\"error\", reject);\n      server.listen(0, \"127.0.0.1\", resolve);\n    });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return null;\n    }\n    throw err;\n  }\n  const address = server.address();\n  assert.ok(address && typeof address === \"object\");\n  return {\n    baseUrl: `http://127.0.0.1:${address.port}`,\n    close: () => new Promise<void>((resolve, reject) => server.close((err) => err ? reject(err) : resolve())),\n  };\n}\n\ntest(\"postJsonToValidatedGateway rejects when the gateway never responds\", async (t) => {\n  // Handler that accepts the request but never sends a response — the hung-server case.\n  const server = await listenLoopback(t, () => { /* never call res.end */ });\n  if (!server) return;\n  try {\n    await assert.rejects(\n      postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200),\n      /timed out after 200ms/,\n    );\n  } finally {\n    await server.close();\n  }\n});\n\ntest(\"postJsonToValidatedGateway resolves a fast healthy response before the timeout\", async (t) => {\n  const server = await listenLoopback(t, (_req, res) => {\n    res.writeHead(200, { \"content-type\": \"application/json\" });\n    res.end(\"{}\");\n  });\n  if (!server) return;\n  try {\n    const body = await postJsonToValidatedGateway(new URL(`${server.baseUrl}/x`), {}, 200);\n    assert.deepEqual(body, {});\n  } finally {\n    await server.close();\n  }\n});\n"]}

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-gateway-lookup.test.d.ts.map