@opentig/cli 0.2.3 → 0.2.4

package/dist/chunks/{service-manager-Jyx-MWo-.mjs → service-manager-BxSmV_8Z.mjs}

@@ -1,10 +1,59 @@
-import { execFile } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { c as redactSensitiveText } from "./network-settings-CdFeKFRB.mjs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { randomUUID } from "node:crypto";
 import os from "node:os";
+import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { setTimeout } from "node:timers/promises";
+//#region src/cli-errors.ts
+/** Operational errors retain a stable identity independently of their wording. */
+var CliError = class extends Error {
+	code;
+	actions;
+	constructor(code, message, actions = [], options) {
+		super(message, options);
+		this.code = code;
+		this.actions = actions;
+		this.name = "CliError";
+	}
+};
+function cliCommand(home, ...args) {
+	const quote = (value) => `'${value.replaceAll("'", process.platform === "win32" ? "''" : "'\\''")}'`;
+	return `opentig ${args.map((arg) => /^[a-zA-Z0-9_.:=/-]+$/.test(arg) ? arg : quote(arg)).join(" ")} --home ${quote(home)}`;
+}
+function errorCode(error) {
+	return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+function diagnostic(error) {
+	const message = error instanceof Error ? error.message : "An unexpected error occurred.";
+	return redactSensitiveText(error instanceof CliError ? `${message}\n${error.actions.join("\n")}`.trim() : message);
+}
+function operationError(error, home, operation) {
+	if (error instanceof CliError) return error;
+	const code = errorCode(error);
+	const checks = [`Check: ${cliCommand(home, "service", "status")}`, `Server log: ${path.join(home, "logs/server.log")}`];
+	if (code === "EACCES" || code === "EPERM") return new CliError("PERMISSION_DENIED", `Cannot ${operation}: permission was denied.`, [`Check this user's access to ${home} and the user service manager. Organization policies may restrict service tasks.`, "Use your normal OS account; do not switch to a different account or run the server as administrator."], { cause: error });
+	if (code === "ENOSPC") return new CliError("DISK_FULL", `Cannot ${operation}: the disk is full.`, [`Free space on the volume containing ${home}, then retry.`], { cause: error });
+	if (code === "ECONNREFUSED" || code === "ECONNRESET" || code === "UND_ERR_CONNECT_TIMEOUT" || error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError" || error.message === "fetch failed")) return new CliError("CONNECTION_FAILED", `Cannot ${operation}: the server could not be reached or did not respond in time.`, checks, { cause: error });
+	return new CliError("OPERATION_FAILED", `Cannot ${operation}.`, ["The cause could not be determined automatically.", ...checks], { cause: error });
+}
+function serviceError(error, home, action) {
+	if (error instanceof CliError) return error;
+	const verb = action === "status" ? "inspect" : action;
+	if ([
+		"EACCES",
+		"EPERM",
+		"ENOSPC"
+	].includes(errorCode(error) ?? "")) return operationError(error, home, `${verb} the service`);
+	return new CliError("SUPERVISOR_FAILED", `Could not ${verb} the OpenTig user service.`, [
+		process.platform === "win32" ? "Check Task Scheduler access and organization policies for your Windows account." : process.platform === "darwin" ? "Check the user LaunchAgent in an active macOS GUI login session." : "Check the systemd user manager in your login session.",
+		`Check: ${cliCommand(home, "service", "status")}`,
+		`Service startup output: ${path.join(home, "logs/service-stderr.log")} (Windows), or the user supervisor's logs.`,
+		"The requested operation may be incomplete. Inspect its state before retrying."
+	], { cause: error });
+}
+//#endregion
 //#region src/service-installation.ts
 var execute = promisify(execFile);
 var SERVICE_NAME = "opentig.service";
@@ -17,7 +66,7 @@ function newerVersion(a, b) {
 	return false;
 }
 function packageDirectory(home, install) {
-	if (!stableVersion(install.version) || !["flat", "npm"].includes(install.layout)) throw new Error("Invalid managed service version.");
+	if (!stableVersion(install.version) || !["flat", "npm"].includes(install.layout)) throw new CliError("SERVICE_METADATA_INVALID", "Invalid managed service version.", ["Inspect the service installation metadata and restore a trusted backup before retrying."]);
 	const base = path.join(home, "service", `app-${install.version}`);
 	return install.layout === "flat" ? base : path.join(base, "node_modules/@opentig/cli");
 }
@@ -25,15 +74,15 @@ async function readInstallation(home) {
 	let value;
 	try {
 		value = JSON.parse(await readFile(path.join(home, "service/installation.json"), "utf8"));
-	} catch (error) {
-		if (error.code === "ENOENT") return null;
-		throw error;
+	} catch (cause) {
+		if (cause.code === "ENOENT") return null;
+		throw new CliError("SERVICE_METADATA_INVALID", "Could not read managed service installation metadata.", [`Check permissions and JSON in ${path.join(home, "service/installation.json")}. Do not remove the entire home or paired browser data.`], { cause });
 	}
-	if (value.manager !== void 0 && ![
+	if (!value || typeof value !== "object" || value.manager !== void 0 && ![
 		"systemd",
 		"launchd",
 		"windows-task"
-	].includes(value.manager) || value.schema !== 1 || !stableVersion(value.version) || !["flat", "npm"].includes(value.layout) || typeof value.host !== "string" || !/^[a-zA-Z0-9.:[\]-]+$/.test(value.host) || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || value.environmentPath !== void 0 && (typeof value.environmentPath !== "string" || /[\0\r\n]/.test(value.environmentPath)) || typeof value.node !== "string" || !path.isAbsolute(value.node) || /[\0\r\n]/.test(value.node)) throw new Error("Invalid managed service installation.");
+	].includes(value.manager) || value.schema !== 1 || !stableVersion(value.version) || !["flat", "npm"].includes(value.layout) || typeof value.host !== "string" || !/^[a-zA-Z0-9.:[\]-]+$/.test(value.host) || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || value.environmentPath !== void 0 && (typeof value.environmentPath !== "string" || /[\0\r\n]/.test(value.environmentPath)) || typeof value.node !== "string" || !path.isAbsolute(value.node) || /[\0\r\n]/.test(value.node)) throw new CliError("SERVICE_METADATA_INVALID", "Invalid managed service installation.", [`Inspect ${path.join(home, "service/installation.json")} and restore valid installation metadata before retrying.`]);
 	return value;
 }
 async function atomicWrite(file, contents) {
@@ -70,6 +119,7 @@ Type=simple
 WorkingDirectory=${systemdWorkingDirectory(input.home)}
 ExecStart=${args.map((arg) => systemdQuote(arg.replaceAll("$", () => "$$"))).join(" ")}
 Environment=NODE_ENV=production
+Environment=${systemdQuote(`OPENTIG_SERVICE_HOME=${input.home}`)}
 ${input.environmentPath === void 0 ? "" : `Environment=${systemdQuote(`PATH=${input.environmentPath}`)}\n`}Restart=on-failure
 RestartSec=3
 KillSignal=SIGTERM
@@ -138,7 +188,8 @@ ${input.environmentPath === void 0 ? "" : `<key>PATH</key><string>${xml(input.en
 }
 /** Keep a recognizable parent attached so service stop can terminate its process tree. */
 function windowsServerScript(input) {
-	return `$ErrorActionPreference = 'Stop'; $env:NODE_ENV = 'production'; $env:OPENTIG_SERVICE_HOME = ${psQuote(input.home)}; ` + (input.environmentPath === void 0 ? "" : `$env:PATH = ${psQuote(input.environmentPath)}; `) + `& ${[input.nodeExecutable, ...serviceArgs(input)].map(psQuote).join(" ")} *> $null; exit $LASTEXITCODE`;
+	const log = path.win32.join(input.home, "logs", "service-stderr.log");
+	return `$ErrorActionPreference = 'Stop'; $env:NODE_ENV = 'production'; $env:OPENTIG_SERVICE_HOME = ${psQuote(input.home)}; ` + (input.environmentPath === void 0 ? "" : `$env:PATH = ${psQuote(input.environmentPath)}; `) + `$null = New-Item -ItemType Directory -Force -Path ${psQuote(path.win32.dirname(log))}; if (Test-Path -LiteralPath ${psQuote(log)}) { Move-Item -LiteralPath ${psQuote(log)} -Destination ${psQuote(`${log}.1`)} -Force }; & ${[input.nodeExecutable, ...serviceArgs(input)].map(psQuote).join(" ")} > $null 2>> ${psQuote(log)}; exit $LASTEXITCODE`;
 }
 function renderWindowsTask(input) {
 	return `<?xml version="1.0" encoding="UTF-16"?>
@@ -171,10 +222,10 @@ function managerKind(platform = process.platform) {
 	if (platform === "linux") return "systemd";
 	if (platform === "darwin") return "launchd";
 	if (platform === "win32") return "windows-task";
-	throw new Error("Managed CLI services support Linux, macOS, and Windows.");
+	throw new CliError("PLATFORM_UNSUPPORTED", "Managed CLI services support Linux, macOS, and Windows.", ["Use opentig serve in a terminal on a supported Node.js host."]);
 }
 function assertManager(installation, kind) {
-	if ((installation.manager ?? "systemd") !== kind) throw new Error("This service was installed for another operating system.");
+	if ((installation.manager ?? "systemd") !== kind) throw new CliError("SERVICE_PLATFORM_MISMATCH", "This service was installed for another operating system.", ["Use the original OS and home to manage this service; do not copy its installation metadata to this machine."]);
 }
 /** Optional identity is only for isolated native integration tests, never CLI input. */
 async function createServiceManager(home, identity) {
@@ -206,7 +257,7 @@ function linuxManager(home, identity) {
 			try {
 				await execute("loginctl", ["enable-linger"], { timeout: 15e3 });
 			} catch {
-				throw new Error("Lingering is required. Ask an administrator to run: sudo loginctl enable-linger <your-user>. Then retry service install as your normal user.");
+				throw new CliError("LINGERING_REQUIRED", "Lingering is required for the Linux user service.", ["Ask an administrator to run: sudo loginctl enable-linger <your-user>", "Then retry service install as your normal user."]);
 			}
 		},
 		render: renderSystemdUnit,
@@ -291,7 +342,7 @@ function macManager(home, identity) {
 			try {
 				await launchctl("print", domain);
 			} catch {
-				throw new Error("No macOS login session is available. Sign in on the Mac, then run service install as that user.");
+				throw new CliError("LOGIN_SESSION_REQUIRED", "No macOS login session is available.", ["Sign in to a GUI session on the Mac, then run service install as that user."]);
 			}
 		},
 		render: (input) => renderLaunchAgent(input, label),
@@ -426,6 +477,29 @@ if ($null -ne $task) {
 		stop: () => stopTask(name),
 		remove: () => removeTask(name),
 		status: () => state(name),
+		ownsRuntime: async (pid) => {
+			if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+			return await ps(`${task(name)}
+if ($null -eq $task -or $task.State -ne 4) { 'false'; exit }
+$action = $task.Definition.Actions.Item(1)
+$arguments = [string]$action.Arguments
+if ($arguments -notmatch '-EncodedCommand ([A-Za-z0-9+/=]+)$') { 'false'; exit }
+$encoded = $Matches[1]
+$processes = @(Get-CimInstance Win32_Process)
+$cursor = ${pid}
+$owned = $false
+for ($depth = 0; $depth -lt 16 -and $cursor -gt 0; $depth++) {
+  $current = $processes | Where-Object { $_.ProcessId -eq $cursor } | Select-Object -First 1
+  if ($null -eq $current) { break }
+  if ($current.ExecutablePath -eq $action.Path -and $current.CommandLine -match ('(?i)-EncodedCommand\\s+"?' + [regex]::Escape($encoded) + '"?\\s*$')) {
+    $owner = Invoke-CimMethod -InputObject $current -MethodName GetOwnerSid
+    $owned = $owner.ReturnValue -eq 0 -and $owner.Sid -eq ${psQuote(sid)}
+    break
+  }
+  $cursor = $current.ParentProcessId
+}
+$owned.ToString().ToLowerInvariant()`) === "true";
+		},
 		ownsProcess: async () => process.env.OPENTIG_SERVICE_HOME === home && (await state(name)).running,
 		launchWorker: async (node, entry) => {
 			const id = `OpenTig Update ${randomUUID()}`;
@@ -466,4 +540,4 @@ if ($null -ne $task) {
 	};
 }
 //#endregion
-export { newerVersion as a, saveInstallation as c, execute as i, stableVersion as l, createServiceManager as n, packageDirectory as o, atomicWrite as r, readInstallation as s, assertManager as t };
+export { newerVersion as a, saveInstallation as c, cliCommand as d, diagnostic as f, serviceError as h, execute as i, stableVersion as l, operationError as m, createServiceManager as n, packageDirectory as o, errorCode as p, atomicWrite as r, readInstallation as s, assertManager as t, CliError as u };