@opentig/cli 0.1.4 → 0.1.6

package/dist/chunks/service-manager-DkpSHxsP.mjs

@@ -0,0 +1,394 @@
+import { readFile, writeFile, rename, rm, mkdir } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execute = promisify(execFile);
+const SERVICE_NAME = "opentig.service";
+const serviceUnitPath = () => path.join(os.homedir(), ".config/systemd/user", SERVICE_NAME);
+const stableVersion = (value) => typeof value === "string" && /^\d+\.\d+\.\d+$/.test(value);
+function newerVersion(a, b) {
+  if (!stableVersion(a) || !stableVersion(b)) return false;
+  const left = a.split(".").map(Number), right = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) if (left[i] !== right[i]) return left[i] > right[i];
+  return false;
+}
+function packageDirectory(home, install) {
+  if (!stableVersion(install.version) || !["flat", "npm"].includes(install.layout)) throw new Error("Invalid managed service version.");
+  const base = path.join(home, "service", `app-${install.version}`);
+  return install.layout === "flat" ? base : path.join(base, "node_modules/@opentig/cli");
+}
+async function readInstallation(home) {
+  let value;
+  try {
+    value = JSON.parse(await readFile(path.join(home, "service/installation.json"), "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  if (value.manager !== void 0 && !["systemd", "launchd", "windows-task"].includes(value.manager) || value.schema !== 1 || !stableVersion(value.version) || !["flat", "npm"].includes(value.layout) || typeof value.host !== "string" || !/^[a-zA-Z0-9.:[\]-]+$/.test(value.host) || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || value.environmentPath !== void 0 && (typeof value.environmentPath !== "string" || /[\0\r\n]/.test(value.environmentPath)) || typeof value.node !== "string" || !path.isAbsolute(value.node) || /[\0\r\n]/.test(value.node)) throw new Error("Invalid managed service installation.");
+  return value;
+}
+async function atomicWrite(file, contents) {
+  const temporary = `${file}.${process.pid}.tmp`;
+  await writeFile(temporary, contents, { mode: 384 });
+  await rename(temporary, file);
+}
+async function saveInstallation(home, installation) {
+  await atomicWrite(path.join(home, "service/installation.json"), JSON.stringify(installation));
+}
+async function systemctl(...args) {
+  return (await execute("systemctl", ["--user", ...args], { timeout: 3e4 })).stdout.trim();
+}
+function renderSystemdUnit(input) {
+  const args = [
+    input.nodeExecutable,
+    input.cliEntrypoint,
+    "serve",
+    "--host",
+    input.host,
+    "--port",
+    String(input.port),
+    "--home",
+    input.home
+  ];
+  return `[Unit]
+Description=OpenTig browser Git client
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=${systemdWorkingDirectory(input.home)}
+ExecStart=${args.map((arg) => systemdQuote(arg.replaceAll("$", () => "$$"))).join(" ")}
+Environment=NODE_ENV=production
+${input.environmentPath === void 0 ? "" : `Environment=${systemdQuote(`PATH=${input.environmentPath}`)}
+`}Restart=on-failure
+RestartSec=3
+KillSignal=SIGTERM
+TimeoutStopSec=10
+
+[Install]
+WantedBy=default.target
+`;
+}
+function systemdQuote(value) {
+  if (value.includes("\0") || value.includes("\r") || value.includes("\n")) throw new Error("Service paths and arguments cannot contain control characters.");
+  return `"${value.replaceAll("%", "%%").replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+function systemdWorkingDirectory(value) {
+  if (!path.isAbsolute(value) || /[\0\r\n]/.test(value)) throw new Error("Service home must be an absolute single-line path.");
+  return `${value.replaceAll("%", "%%")}/`;
+}
+function xml(value) {
+  if ([...value].some((char) => char.charCodeAt(0) < 32 && !["	", "\n", "\r"].includes(char))) throw new Error("Service arguments cannot contain control characters.");
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function serviceOwnerMarker(home) {
+  return `OpenTig CLI home: ${Buffer.from(home, "utf8").toString("base64")}`;
+}
+function psQuote(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function encodedPowerShell(script) {
+  return Buffer.from(script, "utf16le").toString("base64");
+}
+function serviceArgs(input) {
+  return [input.cliEntrypoint, "serve", "--host", input.host, "--port", String(input.port), "--home", input.home];
+}
+function renderLaunchAgent(input, label) {
+  const args = [input.nodeExecutable, ...serviceArgs(input)];
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>${xml(label)}</string>
+<key>ProgramArguments</key><array>${args.map((arg) => `<string>${xml(arg)}</string>`).join("")}</array>
+<key>WorkingDirectory</key><string>${xml(input.home)}</string>
+<key>EnvironmentVariables</key><dict>
+<key>NODE_ENV</key><string>production</string>
+<key>OPENTIG_SERVICE_HOME</key><string>${xml(input.home)}</string>
+${input.environmentPath === void 0 ? "" : `<key>PATH</key><string>${xml(input.environmentPath)}</string>`}
+</dict>
+<key>RunAtLoad</key><true/>
+<key>KeepAlive</key><true/>
+<key>ThrottleInterval</key><integer>3</integer>
+<key>ExitTimeOut</key><integer>10</integer>
+</dict></plist>
+`;
+}
+function windowsServerScript(input) {
+  return `$ErrorActionPreference = 'Stop'; $env:NODE_ENV = 'production'; $env:OPENTIG_SERVICE_HOME = ${psQuote(input.home)}; ` + (input.environmentPath === void 0 ? "" : `$env:PATH = ${psQuote(input.environmentPath)}; `) + `& ${[input.nodeExecutable, ...serviceArgs(input)].map(psQuote).join(" ")} *> $null; exit $LASTEXITCODE`;
+}
+function renderWindowsTask(input) {
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+<RegistrationInfo><Description>${serviceOwnerMarker(input.home)}</Description></RegistrationInfo>
+<Triggers>${input.worker ? "" : `<LogonTrigger><Enabled>true</Enabled><UserId>${xml(input.sid)}</UserId></LogonTrigger>`}</Triggers>
+<Principals><Principal id="Owner"><UserId>${xml(input.sid)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+<Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>true</StartWhenAvailable><AllowStartOnDemand>true</AllowStartOnDemand><Enabled>true</Enabled><ExecutionTimeLimit>${input.worker ? "PT5M" : "PT0S"}</ExecutionTimeLimit>${input.worker ? "" : "<RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure>"}</Settings>
+<Actions Context="Owner"><Exec><Command>${xml(input.powershell)}</Command><Arguments>-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encodedPowerShell(input.script)}</Arguments><WorkingDirectory>${xml(input.home)}</WorkingDirectory></Exec></Actions>
+</Task>`;
+}
+async function fileOrNull(file) {
+  try {
+    return await readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function writeDefinition(file, definition) {
+  await mkdir(path.dirname(file), { recursive: true, mode: 448 });
+  await atomicWrite(file, definition);
+}
+function managerKind(platform = process.platform) {
+  if (platform === "linux") return "systemd";
+  if (platform === "darwin") return "launchd";
+  if (platform === "win32") return "windows-task";
+  throw new Error("Managed CLI services support Linux, macOS, and Windows.");
+}
+function assertManager(installation, kind) {
+  if ((installation.manager ?? "systemd") !== kind) throw new Error("This service was installed for another operating system.");
+}
+async function createServiceManager(home, identity) {
+  switch (managerKind()) {
+    case "systemd":
+      return linuxManager(home, identity);
+    case "launchd":
+      return macManager(home);
+    case "windows-task":
+      return windowsManager(home);
+  }
+}
+function linuxManager(home, identity) {
+  const name = SERVICE_NAME;
+  const file = identity ? path.join(path.dirname(serviceUnitPath()), name) : serviceUnitPath();
+  const status = async () => {
+    const properties = await systemctl("show", name, "--property=MainPID,ActiveState,UnitFileState");
+    const values = Object.fromEntries(properties.split("\n").map((line) => line.split("=")));
+    return { running: values.ActiveState === "active", enabled: values.UnitFileState === "enabled", pid: Number(values.MainPID) };
+  };
+  return {
+    kind: "systemd",
+    location: file,
+    startup: "Starts at boot and continues after logout (systemd user service with lingering).",
+    preflight: async () => {
+      await systemctl("show-environment");
+      try {
+        await execute("loginctl", ["enable-linger"], { timeout: 15e3 });
+      } catch {
+        throw new Error("Lingering is required. Ask an administrator to run: sudo loginctl enable-linger <your-user>. Then retry service install as your normal user.");
+      }
+    },
+    render: renderSystemdUnit,
+    read: () => fileOrNull(file),
+    owns: (definition) => definition.includes(`WorkingDirectory=${home.replaceAll("%", "%%")}/
+`),
+    write: (definition) => writeDefinition(file, definition),
+    restart: async () => {
+      await systemctl("daemon-reload");
+      await systemctl("enable", name);
+      await systemctl("restart", name);
+    },
+    stop: async () => {
+      await systemctl("disable", "--now", name);
+    },
+    remove: async () => {
+      await rm(file, { force: true });
+      await systemctl("daemon-reload");
+    },
+    status,
+    ownsProcess: async () => Boolean(process.env.INVOCATION_ID) && await systemctl("show", name, "--property=FragmentPath", "--value") === file && (await status()).pid === process.pid,
+    launchWorker: async (node, entry) => {
+      const unit = `opentig-update-${randomUUID()}`;
+      await execute("systemd-run", ["--user", "--collect", "--unit", unit, "--property=Type=exec", node, entry, home], { timeout: 15e3 });
+      return { running: async () => ["active", "activating", "deactivating"].includes(await systemctl("show", unit, "--property=ActiveState", "--value").catch(() => "inactive")), cleanup: async () => void 0 };
+    },
+    cleanupWorker: async () => void 0
+  };
+}
+function macManager(home, identity) {
+  const label = "com.opentig.cli";
+  const domain = `gui/${process.getuid()}`;
+  const job = `${domain}/${label}`;
+  const file = path.join(os.homedir(), "Library/LaunchAgents", `${label}.plist`);
+  const launchctl = async (...args) => (await execute("/bin/launchctl", args, { timeout: 3e4 })).stdout;
+  const inspect = async (target) => {
+    try {
+      return await launchctl("print", target);
+    } catch (error) {
+      if (error.code === 113) return null;
+      throw error;
+    }
+  };
+  const stop = async () => {
+    const info = await inspect(job);
+    if (info === null) return;
+    const pid = Number(info.match(/\bpid = (\d+)/)?.[1]);
+    await launchctl("bootout", job);
+    for (let i = 0; i < 150; i++) {
+      let alive = false;
+      if (pid > 0) {
+        try {
+          process.kill(pid, 0);
+          alive = true;
+        } catch (error) {
+          if (error.code !== "ESRCH") throw error;
+        }
+      }
+      if (!alive && await inspect(job) === null) return;
+      await setTimeout(100);
+    }
+    throw new Error("The macOS service did not finish stopping.");
+  };
+  return {
+    kind: "launchd",
+    location: file,
+    startup: "Starts at macOS login and stops at logout. Keep the user signed in and the Mac awake for remote access.",
+    preflight: async () => {
+      try {
+        await launchctl("print", domain);
+      } catch {
+        throw new Error("No macOS login session is available. Sign in on the Mac, then run service install as that user.");
+      }
+    },
+    render: (input) => renderLaunchAgent(input, label),
+    read: () => fileOrNull(file),
+    owns: (definition) => definition.includes(`<key>OPENTIG_SERVICE_HOME</key><string>${xml(home)}</string>`),
+    write: (definition) => writeDefinition(file, definition),
+    restart: async () => {
+      await stop();
+      await launchctl("enable", job);
+      await launchctl("bootstrap", domain, file);
+    },
+    stop,
+    remove: () => rm(file, { force: true }),
+    status: async () => {
+      const info = await inspect(job);
+      const disabled = await launchctl("print-disabled", domain);
+      return { running: /state = running/.test(info ?? ""), pid: Number(info?.match(/\bpid = (\d+)/)?.[1]), enabled: !disabled.includes(`"${label}" => true`) && await fileOrNull(file) !== null };
+    },
+    ownsProcess: async () => process.env.OPENTIG_SERVICE_HOME === home && Number((await inspect(job))?.match(/\bpid = (\d+)/)?.[1]) === process.pid,
+    launchWorker: async (node, entry) => {
+      const id = `com.opentig.update.${randomUUID()}`;
+      await launchctl("submit", "-l", id, "--", node, entry, home, id);
+      return { running: async () => /state = running/.test(await inspect(`${domain}/${id}`) ?? ""), cleanup: async () => {
+        if (await inspect(`${domain}/${id}`) !== null) await launchctl("bootout", `${domain}/${id}`);
+      } };
+    },
+    cleanupWorker: async (id) => {
+      if (/^com\.opentig\.update\.[a-f0-9-]+$/.test(id)) await launchctl("bootout", `${domain}/${id}`);
+    }
+  };
+}
+async function windowsManager(home, identity) {
+  const powershell = path.win32.join(process.env.SystemRoot ?? "C:\\Windows", "System32/WindowsPowerShell/v1.0/powershell.exe");
+  const ps = async (script) => (await execute(powershell, ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encodedPowerShell(`$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new(); ${script}`)], { timeout: 3e4, windowsHide: true, maxBuffer: 2e6 })).stdout.trim();
+  const sid = await ps("[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value");
+  if (!/^S-1-[\d-]+$/.test(sid)) throw new Error("Could not determine the Windows service owner.");
+  const name = `OpenTig CLI ${sid}`;
+  const connection = "$scheduler = New-Object -ComObject 'Schedule.Service'; $scheduler.Connect(); $folder = $scheduler.GetFolder('\\'); ";
+  const task = (taskName) => `${connection} $task = $null; try { $task = $folder.GetTask(${psQuote(taskName)}) } catch { $e = $_.Exception; while ($null -ne $e.InnerException) { $e = $e.InnerException }; if ($e.HResult -ne -2147024894) { throw } }; `;
+  const register = async (taskName, definition) => {
+    const file = path.join(home, "service", `.task-${randomUUID()}.xml`);
+    await mkdir(path.dirname(file), { recursive: true, mode: 448 });
+    try {
+      await writeFile(file, definition, { encoding: "utf16le", mode: 384 });
+      await ps(`${connection} $xml = [IO.File]::ReadAllText(${psQuote(file)}, [Text.Encoding]::Unicode); $null = $folder.RegisterTask(${psQuote(taskName)}, $xml, 6, ${psQuote(sid)}, $null, 3, $null)`);
+    } finally {
+      await rm(file, { force: true });
+    }
+  };
+  const stopTask = async (taskName) => {
+    await ps(`${task(taskName)}
+if ($null -ne $task) {
+  $task.Enabled = $false
+  $action = $task.Definition.Actions.Item(1)
+  $arguments = [string]$action.Arguments
+  if ($arguments -notmatch '-EncodedCommand ([A-Za-z0-9+/=]+)$') { throw 'Unexpected OpenTig task action' }
+  $encoded = $Matches[1]
+  $pattern = '(?i)(?:^|\\s)-EncodedCommand\\s+"?' + [regex]::Escape($encoded) + '"?\\s*$'
+  # Stop the PowerShell wrapper AND its descendants before Scheduler loses the
+  # parent PID. Stop() alone can leave Node running and holding the data directory.
+  $wrappers = @(Get-CimInstance Win32_Process -Filter "Name = 'powershell.exe'" | Where-Object {
+    $_.ExecutablePath -eq $action.Path -and $_.CommandLine -match $pattern
+  })
+  foreach ($wrapper in $wrappers) {
+    $owner = Invoke-CimMethod -InputObject $wrapper -MethodName GetOwnerSid
+    if ($owner.ReturnValue -ne 0 -or $owner.Sid -ne ${psQuote(sid)}) { throw 'Cannot verify OpenTig task process owner' }
+    & "$env:SystemRoot\\System32\\taskkill.exe" /PID $wrapper.ProcessId /T /F | Out-Null
+    if ($LASTEXITCODE -ne 0 -and (Get-Process -Id $wrapper.ProcessId -ErrorAction SilentlyContinue)) { throw 'OpenTig process tree did not stop' }
+  }
+  $task.Stop(0)
+  for ($i = 0; $i -lt 100 -and $task.State -in @(2, 4); $i++) {
+    Start-Sleep -Milliseconds 100
+    $task = $folder.GetTask(${psQuote(taskName)})
+  }
+  if ($task.State -in @(2, 4)) { throw 'OpenTig task did not stop' }
+}`);
+  };
+  const removeTask = async (taskName) => {
+    await ps(`${task(taskName)} if ($null -ne $task) { $folder.DeleteTask(${psQuote(taskName)}, 0) }`);
+  };
+  const startTask = async (taskName) => {
+    await ps(`${task(taskName)} if ($null -eq $task) { throw 'OpenTig task is missing' }; $task.Enabled = $true; $null = $task.Run($null)`);
+  };
+  const state = async (taskName) => JSON.parse(await ps(`${task(taskName)} @{ running = ($null -ne $task -and $task.State -eq 4); enabled = ($null -ne $task -and $task.Enabled); starting = ($null -ne $task -and $task.State -eq 2) } | ConvertTo-Json -Compress`));
+  return {
+    kind: "windows-task",
+    location: `Task Scheduler: ${name}`,
+    startup: "Starts at Windows login and stops at logout. Keep the user signed in and the PC awake for remote access.",
+    preflight: async () => {
+      await ps(connection);
+    },
+    render: (input) => renderWindowsTask({ sid, powershell, home, script: windowsServerScript(input) }),
+    read: async () => await ps(`${task(name)} if ($null -ne $task) { $task.Xml }`) || null,
+    owns: (definition) => definition.includes(`<Description>${serviceOwnerMarker(home)}</Description>`),
+    // Stop using the OLD action before overwriting its identifying arguments.
+    write: async (definition) => {
+      await stopTask(name);
+      await register(name, definition);
+    },
+    restart: async () => {
+      await stopTask(name);
+      await startTask(name);
+    },
+    stop: () => stopTask(name),
+    remove: () => removeTask(name),
+    status: () => state(name),
+    ownsProcess: async () => process.env.OPENTIG_SERVICE_HOME === home && (await state(name)).running,
+    launchWorker: async (node, entry) => {
+      const id = `OpenTig Update ${randomUUID()}`;
+      const script = `& ${[node, entry, home, id].map(psQuote).join(" ")}; exit $LASTEXITCODE`;
+      await register(id, renderWindowsTask({ sid, powershell, script, home, worker: true }));
+      try {
+        await startTask(id);
+      } catch (error) {
+        await removeTask(id);
+        throw error;
+      }
+      return { running: async () => {
+        const current = await state(id);
+        return current.running || current.starting === true;
+      }, cleanup: async () => {
+        await stopTask(id);
+        await removeTask(id);
+      } };
+    },
+    cleanupWorker: async (id) => {
+      if (/^OpenTig Update [a-f0-9-]+$/.test(id)) await removeTask(id);
+    }
+  };
+}
+export {
+  assertManager as a,
+  atomicWrite as b,
+  createServiceManager as c,
+  stableVersion as d,
+  execute as e,
+  newerVersion as n,
+  packageDirectory as p,
+  readInstallation as r,
+  saveInstallation as s
+};