@orb44/cli 0.1.0

package/README.md

@@ -0,0 +1,20 @@
+# orb44
+
+Watch satellite for [Orb44](https://github.com/ephemeral172/orb44). Sends a pulse (load, listeners, hardening) to the cabinet. The cabinet does not run commands on the host.
+
+Node 18+. Linux or macOS.
+
+```bash
+npx @orb44/cli login --url https://your-orb44
+```
+
+Open the printed link in a browser where you are already signed in, confirm the domain, then optionally install the systemd daemon (default no). After a global install the command is `orb44`.
+
+```bash
+npx @orb44/cli status
+npx @orb44/cli pulse
+npx @orb44/cli install     # later: background pulse, starts after reboot
+npx @orb44/cli logout
+```
+
+Device key: `~/.config/orb44/device.json` (mode 0600). Not a shell token.

package/bin/orb44.mjs

@@ -0,0 +1,561 @@
+#!/usr/bin/env node
+import os from "node:os";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { stdin as input, stdout as output } from "node:process";
+import { collectPulse, formatPulsePreview } from "../server/pulse.mjs";
+import { LANGS, LANG_LABEL, detectLang, normalizeLang, t } from "../server/sat-i18n.mjs";
+import { pickFromList } from "../server/cli-menu.mjs";
+
+const DEVICE_FILE = process.env.ORB44_DEVICE_FILE || path.join(os.homedir(), ".config", "orb44", "device.json");
+const CLI_FILE = process.env.ORB44_CLI_FILE || path.join(path.dirname(DEVICE_FILE), "cli.json");
+const SCRIPT = fileURLToPath(import.meta.url);
+
+function args() {
+  const out = { _: [] };
+  const argv = process.argv.slice(2);
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--yes" || a === "-y") out.yes = true;
+    else if (a === "--system") out.system = true;
+    else if (a === "--daemon") out.daemon = true;
+    else if (a === "--url" || a === "--code" || a === "--name" || a === "--interval" || a === "--lang") {
+      out[a.slice(2)] = argv[++i];
+    } else if (!a.startsWith("-")) out._.push(a);
+  }
+  return out;
+}
+
+function intervalSec(raw) {
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return 300;
+  return Math.max(60, Math.min(1800, Math.round(n)));
+}
+
+function loadCli() {
+  try {
+    return JSON.parse(fs.readFileSync(CLI_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function saveCli(row) {
+  fs.mkdirSync(path.dirname(CLI_FILE), { recursive: true });
+  fs.writeFileSync(CLI_FILE, JSON.stringify(row, null, 2), { mode: 0o600 });
+}
+
+function storedLang() {
+  return normalizeLang(loadCli().lang);
+}
+
+let lang = detectLang();
+
+function storedOrFlag(opts) {
+  return normalizeLang(opts.lang) || storedLang() || detectLang();
+}
+
+function loadDevice() {
+  try {
+    return JSON.parse(fs.readFileSync(DEVICE_FILE, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function saveDevice(row) {
+  fs.mkdirSync(path.dirname(DEVICE_FILE), { recursive: true });
+  fs.writeFileSync(DEVICE_FILE, JSON.stringify(row, null, 2), { mode: 0o600 });
+}
+
+function clearDevice() {
+  try {
+    fs.unlinkSync(DEVICE_FILE);
+  } catch {
+    /* missing */
+  }
+}
+
+async function api(url, pathname, { method = "GET", json, secret } = {}) {
+  const headers = { "Content-Type": "application/json", Accept: "application/json" };
+  if (secret) headers.Authorization = `Bearer ${secret}`;
+  const r = await fetch(`${url.replace(/\/$/, "")}${pathname}`, {
+    method,
+    headers,
+    body: json ? JSON.stringify(json) : undefined,
+  });
+  const body = await r.json().catch(() => ({}));
+  return { ok: r.ok, status: r.status, body };
+}
+
+function dim(s) {
+  return `\x1b[2m${s}\x1b[0m`;
+}
+
+function bold(s) {
+  return `\x1b[1m${s}\x1b[0m`;
+}
+
+function quote(p) {
+  const s = String(p);
+  return /[\s"$]/.test(s) ? `"${s.replace(/"/g, '\\"')}"` : s;
+}
+
+function banner() {
+  console.log(`\n🛰️  ${bold(t(lang, "banner_title"))}`);
+  console.log(dim(`${t(lang, "banner_sub")}\n`));
+}
+
+async function ensureLang(opts) {
+  const flagged = normalizeLang(opts.lang);
+  if (flagged) {
+    lang = flagged;
+    saveCli({ ...loadCli(), lang });
+    return lang;
+  }
+  const saved = storedLang();
+  if (saved) {
+    lang = saved;
+    return lang;
+  }
+  lang = detectLang();
+  if (opts.yes || !input.isTTY || !output.isTTY) {
+    saveCli({ ...loadCli(), lang });
+    return lang;
+  }
+  const start = Math.max(0, LANGS.indexOf(lang));
+  const idx = await pickFromList({
+    title: t(lang, "lang_pick"),
+    items: LANGS.map((id) => LANG_LABEL[id]),
+    index: start,
+    hint: "↑↓  Enter",
+    stdin: input,
+    stdout: output,
+  });
+  lang = LANGS[idx] || lang;
+  saveCli({ ...loadCli(), lang });
+  console.log(dim(t(lang, "lang_saved", { label: LANG_LABEL[lang] })));
+  return lang;
+}
+
+async function wantDaemon(opts) {
+  if (opts.daemon) return true;
+  if (opts.yes) return false;
+  if (!input.isTTY || !output.isTTY) return false;
+  const idx = await pickFromList({
+    title: t(lang, "ask_daemon"),
+    items: [t(lang, "daemon_no"), t(lang, "daemon_yes")],
+    index: 0,
+    hint: "↑↓  Enter",
+    stdin: input,
+    stdout: output,
+  });
+  return idx === 1;
+}
+
+function printAdvice(notes) {
+  const list = Array.isArray(notes) ? notes.filter((n) => n?.title) : [];
+  if (!list.length) return;
+  console.log(`\n${bold("📋  " + t(lang, "advice_title"))}`);
+  console.log(dim(t(lang, "advice_sub")));
+  for (const n of list.slice(0, 8)) {
+    console.log(`   • ${n.title}`);
+    if (n.do) console.log(dim(`     ${n.do}`));
+  }
+}
+
+async function sendPulse(device, { preview = true } = {}) {
+  const pulse = collectPulse();
+  if (preview) {
+    console.log(bold("📡 " + t(lang, "payload")));
+    console.log(formatPulsePreview(pulse, lang));
+  }
+  const out = await api(device.api, `/api/satellites/${device.id}/pulse`, {
+    method: "POST",
+    secret: device.secret,
+    json: pulse,
+  });
+  return { out, pulse };
+}
+
+async function cmdLogin(opts) {
+  await ensureLang(opts);
+  banner();
+  const url = String(opts.url || process.env.ORB44_API || "http://127.0.0.1:8787").replace(/\/$/, "");
+  const prev = loadDevice();
+  if (prev?.secret) {
+    await api(prev.api, "/api/satellites/logout", { method: "POST", json: { secret: prev.secret } }).catch(() => {});
+    clearDevice();
+  }
+  const hostname = os.hostname();
+  const name = opts.name || hostname;
+  const begin = await api(url, "/api/satellites/pair/begin", {
+    method: "POST",
+    json: { hostname, name },
+  });
+  if (!begin.ok || !begin.body.pollToken) {
+    console.error(`⚠️  ${begin.body.error || t(lang, "pair_fail")}`);
+    process.exit(1);
+  }
+  console.log(`🔗  API ${url}`);
+  console.log(`🌐  ${t(lang, "open_link")}\n`);
+  console.log(`  ${bold(begin.body.verifyUrl)}`);
+  console.log(dim(`  ${t(lang, "code", { code: begin.body.userCode })}\n`));
+  console.log("⏳  " + t(lang, "waiting"));
+  const deadline = Date.now() + (Number(begin.body.expiresInSec) || 600) * 1000;
+  let issued = null;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 1500));
+    const poll = await api(url, "/api/satellites/pair/poll", {
+      method: "POST",
+      json: { pollToken: begin.body.pollToken },
+    });
+    if (poll.body?.status === "done") {
+      issued = poll.body;
+      break;
+    }
+    if (poll.status === 404) {
+      console.error("\n⚠️  " + t(lang, "code_expired"));
+      process.exit(1);
+    }
+    process.stdout.write(".");
+  }
+  if (!issued?.secret) {
+    console.error("\n⚠️  " + t(lang, "no_confirm"));
+    process.exit(1);
+  }
+  const device = {
+    api: url,
+    id: issued.id,
+    secret: issued.secret,
+    host: issued.host,
+    name: issued.name,
+    pairedAt: Date.now(),
+  };
+  saveDevice(device);
+  console.log(`\n\n✅  ${t(lang, "paired", { host: device.host, name: device.name })}`);
+  console.log(dim(`🔑  ${t(lang, "key_file", { file: DEVICE_FILE })}\n`));
+
+  const { out } = await sendPulse(device);
+  if (!out.ok) {
+    console.error(`⚠️  ${out.body.error || t(lang, "pulse_fail")}`);
+    process.exit(1);
+  }
+  console.log("\n📡  " + t(lang, "pulse_ok"));
+  printAdvice(out.body?.notes);
+  if (await wantDaemon(opts)) {
+    if (cmdInstall(opts, { enable: true })) {
+      console.log("\n" + t(lang, "login_done"));
+    }
+  } else {
+    console.log(dim("\n" + t(lang, "daemon_skip")));
+  }
+  process.exit(0);
+}
+
+function applyLang(opts) {
+  lang = storedOrFlag(opts);
+  return lang;
+}
+
+async function cmdPulse() {
+  applyLang(opts);
+  const device = loadDevice();
+  if (!device?.secret) {
+    console.error("⚠️  " + t(lang, "need_login"));
+    process.exit(1);
+  }
+  banner();
+  const { out } = await sendPulse(device);
+  if (!out.ok) {
+    console.error(
+      "⚠️  " +
+        (out.body.error === "bad_secret" || out.body.error === "not_found" ? t(lang, "key_revoked") : out.body.error || t(lang, "pulse_fail"))
+    );
+    process.exit(1);
+  }
+  console.log("\n📡  " + t(lang, "pulse_ok"));
+  printAdvice(out.body?.notes);
+}
+
+async function cmdDaemon(opts) {
+  applyLang(opts);
+  const device = loadDevice();
+  if (!device?.secret) {
+    console.error("⚠️  " + t(lang, "need_login"));
+    process.exit(1);
+  }
+  const sec = intervalSec(opts.interval);
+  console.log(`🛰️  ${t(lang, "daemon_run", { sec, host: device.host })}`);
+  const tick = async () => {
+    const { out, pulse } = await sendPulse(device, { preview: false });
+    const hh = new Date().toISOString().slice(11, 19);
+    if (!out.ok) {
+      const gone = out.body.error === "bad_secret" || out.body.error === "not_found";
+      console.error(`⚠️  ${hh} ${gone ? t(lang, "daemon_revoked") : out.body.error || t(lang, "pulse_fail")}`);
+      return;
+    }
+    console.log(`📡  ${hh} ok  load ${pulse.load1}  ${pulse.gradeInside || "—"}`);
+  };
+  await tick();
+  const id = setInterval(tick, sec * 1000);
+  const stop = () => {
+    clearInterval(id);
+    process.exit(0);
+  };
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  await new Promise(() => {});
+}
+
+function systemdUnit({ node, script, deviceFile, interval, user }) {
+  const lines = [
+    "[Unit]",
+    "Description=Orb44 satellite pulse",
+    "After=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+  ];
+  if (user) {
+    lines.push(`User=${user}`, `Group=${user}`);
+  }
+  lines.push(
+    `ExecStart=${quote(node)} ${quote(script)} daemon --interval ${interval}`,
+    "Restart=on-failure",
+    "RestartSec=20",
+    `Environment=ORB44_DEVICE_FILE=${deviceFile}`,
+    `Environment=ORB44_LANG=${lang}`,
+    "NoNewPrivileges=true",
+    "",
+    "[Install]",
+    `WantedBy=${user ? "multi-user.target" : "default.target"}`
+  );
+  return `${lines.join("\n")}\n`;
+}
+
+function satServerDir() {
+  return path.join(path.dirname(SCRIPT), "..", "server");
+}
+
+function installSystemTree() {
+  const lib = "/usr/lib/orb44-sat";
+  const serverSrc = satServerDir();
+  fs.mkdirSync(path.join(lib, "bin"), { recursive: true, mode: 0o755 });
+  fs.mkdirSync(path.join(lib, "server"), { recursive: true, mode: 0o755 });
+  const copies = [
+    [SCRIPT, path.join(lib, "bin", "orb44.mjs")],
+    [path.join(serverSrc, "pulse.mjs"), path.join(lib, "server", "pulse.mjs")],
+    [path.join(serverSrc, "sat-i18n.mjs"), path.join(lib, "server", "sat-i18n.mjs")],
+    [path.join(serverSrc, "cli-menu.mjs"), path.join(lib, "server", "cli-menu.mjs")],
+  ];
+  for (const [from, to] of copies) {
+    fs.copyFileSync(from, to);
+    fs.chmodSync(to, 0o644);
+  }
+  return path.join(lib, "bin", "orb44.mjs");
+}
+
+function nologinShell() {
+  for (const p of ["/usr/sbin/nologin", "/sbin/nologin", "/bin/false"]) {
+    if (fs.existsSync(p)) return p;
+  }
+  return "/bin/false";
+}
+
+function ensureSystemServiceAccount(srcDeviceFile) {
+  const home = "/var/lib/orb44";
+  const dest = path.join(home, "device.json");
+  const hasUser = spawnSync("id", ["-u", "orb44"], { encoding: "utf8" }).status === 0;
+  if (!hasUser) {
+    const add = spawnSync("useradd", ["-r", "-s", nologinShell(), "-d", home, "-M", "orb44"], { encoding: "utf8" });
+    if (add.status !== 0) {
+      const err = (add.stderr || add.stdout || "useradd failed").trim();
+      return { ok: false, err: err.slice(0, 200) };
+    }
+  }
+  fs.mkdirSync(home, { recursive: true, mode: 0o750 });
+  fs.copyFileSync(srcDeviceFile, dest);
+  fs.chmodSync(dest, 0o600);
+  const chown = spawnSync("chown", ["-R", "orb44:orb44", home], { encoding: "utf8" });
+  if (chown.status !== 0) {
+    return { ok: false, err: (chown.stderr || "chown failed").trim().slice(0, 200) };
+  }
+  try {
+    const script = installSystemTree();
+    return { ok: true, user: "orb44", deviceFile: dest, script };
+  } catch (e) {
+    return { ok: false, err: String(e.message || e).slice(0, 200) };
+  }
+}
+
+function serviceIsActive(asSystem) {
+  const args = asSystem ? ["is-active", "orb44-satellite"] : ["--user", "is-active", "orb44-satellite"];
+  const r = spawnSync("systemctl", args, { encoding: "utf8" });
+  return (r.stdout || "").trim() === "active";
+}
+
+function tryEnable(asSystem) {
+  const args = asSystem
+    ? [
+        ["daemon-reload"],
+        ["enable", "--now", "orb44-satellite"],
+      ]
+    : [
+        ["--user", "daemon-reload"],
+        ["--user", "enable", "--now", "orb44-satellite"],
+      ];
+  for (const a of args) {
+    const r = spawnSync("systemctl", a, { encoding: "utf8" });
+    if (r.status !== 0) {
+      const err = (r.stderr || r.stdout || r.error?.message || "").trim();
+      return { ok: false, err: err.slice(0, 240) };
+    }
+  }
+  const t0 = Date.now();
+  while (Date.now() - t0 < 2500) {
+    if (serviceIsActive(asSystem)) return { ok: true };
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200);
+  }
+  const st = spawnSync(
+    "systemctl",
+    asSystem ? ["status", "--no-pager", "-l", "orb44-satellite"] : ["--user", "status", "--no-pager", "-l", "orb44-satellite"],
+    { encoding: "utf8" }
+  );
+  return { ok: false, err: (st.stdout || st.stderr || "not active").trim().slice(0, 240) };
+}
+
+function cmdInstall(opts, { enable = false } = {}) {
+  applyLang(opts);
+  const device = loadDevice();
+  if (!device?.secret) {
+    console.error("⚠️  " + t(lang, "need_login"));
+    process.exit(1);
+  }
+  const asSystem = Boolean(opts.system) || process.getuid?.() === 0;
+  const interval = intervalSec(opts.interval);
+  let deviceFile = DEVICE_FILE;
+  let user = null;
+  let script = SCRIPT;
+  if (asSystem) {
+    const acct = ensureSystemServiceAccount(DEVICE_FILE);
+    if (acct.ok) {
+      deviceFile = acct.deviceFile;
+      user = acct.user;
+      script = acct.script;
+      console.log(dim(t(lang, "daemon_user", { user, file: deviceFile })));
+    } else {
+      console.log(dim(t(lang, "daemon_user_fail", { err: acct.err ? `: ${acct.err}` : "" })));
+    }
+  }
+  const unit = systemdUnit({
+    node: process.execPath,
+    script,
+    deviceFile,
+    interval,
+    user,
+  });
+  const unitPath = asSystem
+    ? "/etc/systemd/system/orb44-satellite.service"
+    : path.join(os.homedir(), ".config", "systemd", "user", "orb44-satellite.service");
+  fs.mkdirSync(path.dirname(unitPath), { recursive: true });
+  fs.writeFileSync(unitPath, unit, { mode: 0o644 });
+  console.log("⚙️  " + t(lang, "unit_written", { path: unitPath }));
+  if (enable) {
+    const on = tryEnable(asSystem);
+    if (on.ok) {
+      console.log("✅  " + t(lang, "daemon_on"));
+      return true;
+    }
+    console.log("⚠️  " + t(lang, "unit_enable_fail", { err: on.err ? `: ${on.err}` : "" }));
+  }
+  if (asSystem) {
+    console.log(dim("   " + t(lang, "install_root")));
+    console.log(dim("   useradd -r -s /usr/sbin/nologin -d /var/lib/orb44 orb44"));
+    console.log(dim("   " + t(lang, "copy_key")));
+    console.log("   systemctl daemon-reload && systemctl enable --now orb44-satellite");
+  } else {
+    console.log("   systemctl --user daemon-reload && systemctl --user enable --now orb44-satellite");
+  }
+  return false;
+}
+
+function cmdStatus() {
+  applyLang(opts);
+  const device = loadDevice();
+  banner();
+  if (!device) {
+    console.log("⚠️  " + t(lang, "not_paired"));
+    return;
+  }
+  console.log(`🔗  API  ${device.api}`);
+  console.log(`🌐  ${device.host}`);
+  console.log(`📛  ${device.name}`);
+  console.log(`🆔  ${device.id}`);
+  console.log(dim(`🔑  ${DEVICE_FILE}`));
+  const pulse = collectPulse();
+  console.log(`\n${bold("📡 " + t(lang, "now_on_box"))}`);
+  console.log(formatPulsePreview(pulse, lang));
+}
+
+async function cmdLogout() {
+  applyLang(opts);
+  const device = loadDevice();
+  if (device?.secret) {
+    await api(device.api, "/api/satellites/logout", { method: "POST", json: { secret: device.secret } });
+  }
+  clearDevice();
+  console.log("✅  " + t(lang, "logged_out"));
+}
+
+async function cmdLang(flags) {
+  const want = normalizeLang(flags._[1] || flags.lang);
+  if (want) {
+    lang = want;
+    saveCli({ ...loadCli(), lang });
+    console.log(t(lang, "lang_saved", { label: LANG_LABEL[lang] }));
+    return;
+  }
+  applyLang(flags);
+  if (input.isTTY && output.isTTY) {
+    const idx = await pickFromList({
+      title: t(lang, "lang_pick"),
+      items: LANGS.map((id) => LANG_LABEL[id]),
+      index: Math.max(0, LANGS.indexOf(lang)),
+      hint: "↑↓  Enter",
+      stdin: input,
+      stdout: output,
+    });
+    lang = LANGS[idx] || lang;
+    saveCli({ ...loadCli(), lang });
+    console.log(t(lang, "lang_saved", { label: LANG_LABEL[lang] }));
+    return;
+  }
+  console.log(t(lang, "lang_now", { label: LANG_LABEL[lang] }));
+}
+
+function help() {
+  applyLang(opts);
+  console.log(t(lang, "help", { file: DEVICE_FILE }));
+}
+
+const opts = args();
+const cmd = opts._[0] || "help";
+const run = {
+  login: () => cmdLogin(opts),
+  pulse: cmdPulse,
+  daemon: () => cmdDaemon(opts),
+  install: () => cmdInstall(opts, { enable: true }),
+  status: cmdStatus,
+  logout: cmdLogout,
+  lang: () => cmdLang(opts),
+  help,
+};
+const fn = run[cmd];
+if (!fn) {
+  help();
+  process.exit(1);
+}
+await fn();

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@orb44/cli",
+  "version": "0.1.0",
+  "description": "Orb44 Watch satellite: outgoing pulse from the host. Not a remote shell.",
+  "type": "module",
+  "bin": {
+    "orb44": "bin/orb44.mjs"
+  },
+  "files": [
+    "bin/orb44.mjs",
+    "server/pulse.mjs",
+    "server/sat-i18n.mjs",
+    "server/cli-menu.mjs"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ephemeral172/orb44.git",
+    "directory": "packages/orb44"
+  },
+  "homepage": "https://github.com/ephemeral172/orb44",
+  "bugs": {
+    "url": "https://github.com/ephemeral172/orb44/issues"
+  },
+  "keywords": [
+    "orb44",
+    "watch",
+    "satellite",
+    "pulse"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "prepack": "node ../../scripts/stage-orb44-npm.mjs"
+  }
+}