@ours.network/fleet 1.2.0-nightly.5 → 1.2.0-nightly.50

package/dist/web/service.d.ts

@@ -1,6 +1,7 @@
 import { type Exec } from '../exec.js';
 export declare const WEB_SYSTEMD_UNIT = "ours-fleet-web.service";
 export declare const WEB_LAUNCHD_LABEL = "network.ours.fleet.web";
+type ServiceEnvironment = Partial<Record<'OURS_CONFIG' | 'OURS_FLEET_HOME' | 'PATH', string>>;
 interface ServiceMetadata {
     version: 3;
     platform: 'linux' | 'darwin';
@@ -10,6 +11,7 @@ interface ServiceMetadata {
     configuration?: string;
     bind?: string;
     publicOrigin?: string;
+    environment?: ServiceEnvironment;
 }
 export interface WebServiceOptions {
     platform?: NodeJS.Platform;
@@ -18,6 +20,7 @@ export interface WebServiceOptions {
     stateDir?: string;
     uid?: number;
     runtimeExecutable?: string;
+    environment?: NodeJS.ProcessEnv;
 }
 export declare class WebServiceManager {
     private readonly platform;
@@ -26,6 +29,7 @@ export declare class WebServiceManager {
     private readonly stateDir;
     private readonly uid;
     private readonly runtimeExecutable;
+    private readonly environment;
     constructor(options?: WebServiceOptions);
     get metadataPath(): string;
     get definitionPath(): string;
@@ -33,6 +37,11 @@ export declare class WebServiceManager {
         bind?: string;
         publicOrigin?: string;
     }): Promise<string[]>;
+    /** Persist an enrollment bind fallback, reloading launchd's cached definition. */
+    retainBoundPort(script: string, port: number, configuration?: string, web?: {
+        bind?: string;
+        publicOrigin?: string;
+    }): Promise<void>;
     start(): Promise<void>;
     stop(): Promise<void>;
     restart(): Promise<void>;
@@ -45,9 +54,9 @@ export declare class WebServiceManager {
 export declare function systemdUnit(runtime: string, script: string, port: number, configuration?: string, web?: {
     bind?: string;
     publicOrigin?: string;
-}): string;
+}, environment?: ServiceEnvironment): string;
 export declare function launchdPlist(runtime: string, script: string, port: number, configuration?: string, web?: {
     bind?: string;
     publicOrigin?: string;
-}): string;
+}, environment?: ServiceEnvironment): string;
 export {};

package/dist/web/service.js

@@ -15,6 +15,7 @@ export class WebServiceManager {
     stateDir;
     uid;
     runtimeExecutable;
+    environment;
     constructor(options = {}) {
         const platform = options.platform ?? process.platform;
         if (platform !== 'linux' && platform !== 'darwin')
@@ -25,6 +26,7 @@ export class WebServiceManager {
         this.stateDir = options.stateDir ?? join(stateRoot(), 'web');
         this.uid = options.uid ?? process.getuid?.() ?? 501;
         this.runtimeExecutable = options.runtimeExecutable ?? process.execPath;
+        this.environment = serviceEnvironment(options.environment ?? process.env);
     }
     get metadataPath() { return join(this.stateDir, 'service.json'); }
     get definitionPath() {
@@ -42,13 +44,14 @@ export class WebServiceManager {
         const config = configuration ? resolve(configuration) : undefined;
         const metadata = {
             version: VERSION, platform: this.platform, runtime, script: resolvedScript, port,
+            environment: this.environment,
             ...(config ? { configuration: config } : {}),
             ...(web.bind ? { bind: web.bind } : {}),
             ...(web.publicOrigin ? { publicOrigin: web.publicOrigin } : {}),
         };
         replaceFileAtomically(this.definitionPath, this.platform === 'linux'
-            ? systemdUnit(runtime, resolvedScript, port, config, web)
-            : launchdPlist(runtime, resolvedScript, port, config, web), 0o600);
+            ? systemdUnit(runtime, resolvedScript, port, config, web, this.environment)
+            : launchdPlist(runtime, resolvedScript, port, config, web, this.environment), 0o600);
         replaceFileAtomically(this.metadataPath, JSON.stringify(metadata, null, 2) + '\n', 0o600);
         if (this.platform === 'linux') {
             await this.must('systemctl', ['--user', 'daemon-reload']);
@@ -63,6 +66,14 @@ export class WebServiceManager {
         }
         return [`installed ${this.definitionPath}`, 'launchd service starts at login'];
     }
+    /** Persist an enrollment bind fallback, reloading launchd's cached definition. */
+    async retainBoundPort(script, port, configuration, web = {}) {
+        await this.install(script, port, configuration, web);
+        if (this.platform === 'darwin') {
+            await this.stop();
+            await this.start();
+        }
+    }
     async start() {
         this.requireInstalled();
         if (this.platform === 'linux') {
@@ -159,19 +170,20 @@ function validatePort(port) {
 function systemdQuote(value) {
     return `"${value.replace(/[%\\"]/g, char => char === '%' ? '%%' : `\\${char}`)}"`;
 }
-export function systemdUnit(runtime, script, port, configuration, web = {}) {
+export function systemdUnit(runtime, script, port, configuration, web = {}, environment = {}) {
     const config = configuration ? ` --configuration ${systemdQuote(configuration)}` : '';
     const access = `${web.bind ? ` --bind ${systemdQuote(web.bind)}` : ''}`
         + `${web.publicOrigin ? ` --public-origin ${systemdQuote(web.publicOrigin)}` : ''}`;
     return `[Unit]\nDescription=ours-fleet localhost web console\nAfter=default.target\n\n`
         + `[Service]\nType=simple\nExecStart=${systemdQuote(runtime)} ${systemdQuote(script)} web serve --port ${port} --no-open${config}${access}\n`
+        + Object.entries(serviceEnvironment(environment)).map(([key, value]) => `Environment=${systemdQuote(`${key}=${value}`)}\n`).join('')
         + `Restart=on-failure\nRestartSec=5\nTimeoutStopSec=15\n\n`
         + `[Install]\nWantedBy=default.target\n`;
 }
 const xml = (value) => value.replace(/[&<>"']/g, char => ({
     '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;',
 }[char]));
-export function launchdPlist(runtime, script, port, configuration, web = {}) {
+export function launchdPlist(runtime, script, port, configuration, web = {}, environment = {}) {
     const config = configuration
         ? `<string>--configuration</string><string>${xml(configuration)}</string>` : '';
     const access = `${web.bind ? `<string>--bind</string><string>${xml(web.bind)}</string>` : ''}`
@@ -181,6 +193,20 @@ export function launchdPlist(runtime, script, port, configuration, web = {}) {
         + `<plist version="1.0"><dict>\n<key>Label</key><string>${WEB_LAUNCHD_LABEL}</string>\n`
         + `<key>ProgramArguments</key><array><string>${xml(runtime)}</string><string>${xml(script)}</string><string>web</string>`
         + `<string>serve</string><string>--port</string><string>${port}</string><string>--no-open</string>${config}${access}</array>\n`
+        + `<key>EnvironmentVariables</key><dict>${Object.entries(serviceEnvironment(environment)).map(([key, value]) => `<key>${key}</key><string>${xml(value)}</string>`).join('')}</dict>\n`
         + `<key>RunAtLoad</key><true/><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>\n`
         + `<key>ProcessType</key><string>Background</string>\n</dict></plist>\n`;
 }
+// Retain only profile/tool paths, never inherited credentials or arbitrary environment.
+function serviceEnvironment(source) {
+    const result = {};
+    for (const key of ['OURS_CONFIG', 'OURS_FLEET_HOME', 'PATH']) {
+        const value = source[key];
+        if (!value)
+            continue;
+        if (/[\r\n\0]/.test(value))
+            throw new FleetError('invalid_request', `invalid service path setting: ${key}`);
+        result[key] = key === 'PATH' ? value : resolve(value);
+    }
+    return result;
+}

package/dist/web/workspace-devices.d.ts

@@ -0,0 +1,36 @@
+import { FleetError } from '../application/errors.js';
+/** Only failure of the enrolled device check may invalidate the App's saved credential. */
+export declare class WorkspaceDeviceAuthError extends FleetError {
+    constructor(message?: string);
+}
+export interface WorkspaceDevice {
+    id: string;
+    label: string;
+    createdAt: number;
+    lastUsedAt: number;
+    expiresAt: number;
+    revokedAt: number | null;
+}
+export declare class WorkspaceDeviceStore {
+    private readonly now;
+    private readonly db;
+    readonly workspaceId: string;
+    constructor(dir?: string, now?: () => number);
+    mint(issuer?: string | null): {
+        enrollment: string;
+        workspaceId: string;
+        expiresAt: number;
+    };
+    enroll(enrollment: string, workspaceId: string, label: string): {
+        token: string;
+        device: WorkspaceDevice;
+        workspaceId: string;
+    };
+    authenticate(token: string): WorkspaceDevice;
+    valid(id: string): boolean;
+    list(): WorkspaceDevice[];
+    revoke(id: string): void;
+    /** Retire account links without changing the installation's stable host ID or other data. */
+    revokeAll(): void;
+    close(): void;
+}

package/dist/web/workspace-devices.js

@@ -0,0 +1,101 @@
+import { createRequire } from 'node:module';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { mkdirSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+import { FleetError } from '../application/errors.js';
+const opaque = () => randomBytes(32).toString('base64url');
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+/** Only failure of the enrolled device check may invalidate the App's saved credential. */
+export class WorkspaceDeviceAuthError extends FleetError {
+    constructor(message = 'workspace device is missing, expired, or revoked') { super('unauthorized', message); }
+}
+export class WorkspaceDeviceStore {
+    now;
+    db;
+    workspaceId;
+    constructor(dir = join(stateRoot(), 'web'), now = Date.now) {
+        this.now = now;
+        const { DatabaseSync } = createRequire(import.meta.url)('node:sqlite');
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        chmodSync(dir, 0o700);
+        const path = join(dir, 'workspace-devices.db');
+        this.db = new DatabaseSync(path);
+        chmodSync(path, 0o600);
+        this.db.exec(`PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;
+      CREATE TABLE IF NOT EXISTS metadata(key TEXT PRIMARY KEY,value TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS devices(id TEXT PRIMARY KEY,hash TEXT NOT NULL,label TEXT NOT NULL,createdAt INTEGER NOT NULL,lastUsedAt INTEGER NOT NULL,expiresAt INTEGER NOT NULL,revokedAt INTEGER);
+      CREATE TABLE IF NOT EXISTS enrollments(hash TEXT PRIMARY KEY,expiresAt INTEGER NOT NULL,issuer TEXT);`);
+        this.db.prepare('INSERT OR IGNORE INTO metadata VALUES(?,?)').run('workspaceId', opaque());
+        this.workspaceId = String(this.db.prepare('SELECT value FROM metadata WHERE key=?').get('workspaceId').value);
+    }
+    mint(issuer = null) {
+        const now = this.now(), enrollment = opaque(), expiresAt = now + 5 * 60000;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            this.db.prepare('DELETE FROM enrollments WHERE expiresAt<=?').run(now);
+            const count = Number(this.db.prepare('SELECT count(*) AS n FROM enrollments').get().n);
+            if (count >= 32)
+                throw new FleetError('rate_limited', 'too many pending device links');
+            this.db.prepare('INSERT INTO enrollments VALUES(?,?,?)').run(hash(enrollment), expiresAt, issuer);
+            this.db.exec('COMMIT');
+            return { enrollment, workspaceId: this.workspaceId, expiresAt };
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    enroll(enrollment, workspaceId, label) {
+        if (workspaceId !== this.workspaceId || typeof enrollment !== 'string' || !/^[\w-]{43}$/.test(enrollment))
+            throw new FleetError('unauthorized', 'invalid device enrollment');
+        if (typeof label !== 'string' || !label.trim() || label.length > 100 || /[\x00-\x1f\x7f]/.test(label))
+            throw new FleetError('invalid_request', 'device name must contain 1–100 printable characters');
+        const now = this.now(), id = opaque(), token = `${id}.${opaque()}`;
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            const code = this.db.prepare('DELETE FROM enrollments WHERE hash=? AND expiresAt>? RETURNING issuer').get(hash(enrollment), now);
+            if (!code)
+                throw new FleetError('unauthorized', 'device enrollment is expired or already used');
+            if (code.issuer && !this.db.prepare('SELECT id FROM devices WHERE id=? AND revokedAt IS NULL AND expiresAt>?').get(code.issuer, now))
+                throw new FleetError('unauthorized', 'issuing device has been revoked');
+            const count = Number(this.db.prepare('SELECT count(*) AS n FROM devices WHERE revokedAt IS NULL AND expiresAt>?').get(now).n);
+            if (count >= 128)
+                throw new FleetError('rate_limited', 'authorized device limit reached');
+            const device = { id, label: label.trim(), createdAt: now, lastUsedAt: now, expiresAt: now + 90 * 86400000, revokedAt: null };
+            this.db.prepare('INSERT INTO devices VALUES(?,?,?,?,?,?,NULL)').run(id, hash(token), device.label, now, now, device.expiresAt);
+            this.db.exec('COMMIT');
+            return { token, device, workspaceId };
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    authenticate(token) {
+        const id = typeof token === 'string' ? token.split('.')[0] : '', now = this.now();
+        const row = this.db.prepare('SELECT * FROM devices WHERE id=? AND revokedAt IS NULL AND expiresAt>?').get(id, now);
+        const supplied = Buffer.from(hash(token || '')), expected = Buffer.from(String(row?.hash || '0'.repeat(64)));
+        if (!row || !timingSafeEqual(supplied, expected))
+            throw new WorkspaceDeviceAuthError();
+        this.db.prepare('UPDATE devices SET lastUsedAt=? WHERE id=?').run(now, id);
+        return { id, label: String(row.label), createdAt: Number(row.createdAt), lastUsedAt: now, expiresAt: Number(row.expiresAt), revokedAt: null };
+    }
+    valid(id) { return Boolean(this.db.prepare('SELECT id FROM devices WHERE id=? AND revokedAt IS NULL AND expiresAt>?').get(id, this.now())); }
+    list() { return this.db.prepare('SELECT id,label,createdAt,lastUsedAt,expiresAt,revokedAt FROM devices ORDER BY createdAt DESC LIMIT 256').all().map(row => ({ id: String(row.id), label: String(row.label), createdAt: Number(row.createdAt), lastUsedAt: Number(row.lastUsedAt), expiresAt: Number(row.expiresAt), revokedAt: row.revokedAt === null ? null : Number(row.revokedAt) })); }
+    revoke(id) { this.db.prepare('UPDATE devices SET revokedAt=? WHERE id=? AND revokedAt IS NULL').run(this.now(), id); this.db.prepare('DELETE FROM enrollments WHERE issuer=?').run(id); }
+    /** Retire account links without changing the installation's stable host ID or other data. */
+    revokeAll() {
+        this.db.exec('BEGIN IMMEDIATE');
+        try {
+            this.db.prepare('UPDATE devices SET revokedAt=? WHERE revokedAt IS NULL').run(this.now());
+            this.db.exec('DELETE FROM enrollments');
+            this.db.exec('COMMIT');
+        }
+        catch (error) {
+            this.db.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    close() { this.db.close(); }
+}

package/dist/web/workspace-tunnel.d.ts

@@ -0,0 +1 @@
+export declare function startWorkspaceTunnel(origin: string): () => Promise<void>;

package/dist/web/workspace-tunnel.js

@@ -0,0 +1,34 @@
+import { spawn } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { stateRoot } from '../paths.js';
+export function startWorkspaceTunnel(origin) {
+    const dir = join(stateRoot(), 'workspace'), file = join(dir, 'tunnel.json');
+    if (!existsSync(file))
+        return async () => { };
+    const config = JSON.parse(readFileSync(file, 'utf8'));
+    if (config.origin !== origin)
+        throw Error('Workspace tunnel requires its configured public origin');
+    const tokenFile = join(dir, 'connector');
+    if (config.tokenFile !== tokenFile)
+        throw Error('Unexpected connector credential path');
+    const stat = lstatSync(tokenFile);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.())
+        throw Error('Connector credential must be an owned private file');
+    let stopped = false, child, timer, backoff = 1000;
+    const launch = () => {
+        if (stopped)
+            return;
+        child = spawn('cloudflared', ['tunnel', '--no-autoupdate', 'run', '--token-file', tokenFile], { stdio: 'ignore' });
+        let scheduled = false;
+        // Keep an error listener for the child's whole lifetime, including shutdown.
+        const retry = () => { if (scheduled || stopped)
+            return; scheduled = true; timer = setTimeout(launch, backoff); backoff = Math.min(30000, backoff * 2); };
+        child.on('error', retry);
+        child.once('exit', retry);
+    };
+    launch();
+    // A failed spawn has no pid and reports error/close rather than exit.
+    return async () => { stopped = true; clearTimeout(timer); const current = child; if (!current?.pid || current.exitCode !== null || current.signalCode !== null)
+        return; await new Promise(resolve => { const timeout = setTimeout(() => { current.kill('SIGKILL'); resolve(); }, 5000); current.once('close', () => { clearTimeout(timeout); resolve(); }); current.kill('SIGTERM'); }); };
+}

package/dist/workspace-enrollment.d.ts

@@ -0,0 +1,82 @@
+import { type AttachOursClientOptions, type OursClient } from '@ours.network/sdk/client';
+export interface WorkspacePayload {
+    version: 1;
+    appOrigin: string;
+    hostname: string;
+    rootName: string;
+    name: string;
+    surname: string;
+    connectorToken?: string;
+    invitation: string;
+    serverCid: string;
+    challenge: {
+        nonce: string;
+        workspaceId: string;
+        accountId: string;
+        expiresAt: number;
+    };
+}
+export declare function readWorkspacePayload(file: string): WorkspacePayload;
+export declare function decodeWorkspacePayload(input: string, options?: {
+    allowExpired?: boolean;
+}): WorkspacePayload;
+/** Credential-free renewal is allowed only on the host already holding this private connector. */
+export declare function checkWorkspaceConnector(payload: WorkspacePayload): void;
+type DaemonClient = Pick<OursClient, 'listIdentities' | 'chooseIdentity' | 'addContact' | 'listContacts' | 'sendCommand' | 'removeContact' | 'releaseLease' | 'close'>;
+/** How tunnel setup reaches this host's daemon; replaced only by tests. */
+export type AttachDaemonClient = (options: AttachOursClientOptions) => Promise<DaemonClient>;
+/**
+ * Check the Fleet configuration tunnel setup will use, before the one-time command is used.
+ * Reads only; an existing Owner is compared with this host's own Messenger identity.
+ */
+export declare function checkWorkspaceConfiguration(configuration?: string, attach?: AttachDaemonClient): Promise<void>;
+export declare function enrollWorkspace(payload: WorkspacePayload, configuration?: string, options?: {
+    migrateAppOrigin?: boolean;
+    preserveProfile?: boolean;
+    replacingWorkspace?: string;
+    attach?: AttachDaemonClient;
+    contactWaitMs?: number;
+    afterInvitation?: () => void;
+}): Promise<{
+    origin: string;
+    hostWorkspaceId: string;
+    rootCid: string;
+}>;
+/** Only the existing signed-root receipt authorizes the scoped tunnel target. */
+/**
+ * The enrollment server contact exists only to carry the signed binding. Once the account has confirmed
+ * that binding, remove exactly that contact from this host's Messenger, so it does not stay in the
+ * person's chats. The server identity is the one recorded with the binding; nothing else is touched.
+ */
+export declare function removeEnrollmentContact(attach?: AttachDaemonClient): Promise<boolean>;
+export declare function configureWorkspacePort(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number): Promise<void>;
+/**
+ * Point the tunnel at this host's port. The account answers only for a confirmed signed binding, and
+ * only after that answer is the enrollment contact removed; a refused or unconfirmed target leaves it,
+ * so the setup can be finished later. A removal that fails is reported and does not undo the setup.
+ */
+export declare function confirmWorkspaceTarget(payload: Pick<WorkspacePayload, 'appOrigin' | 'challenge'>, hostWorkspaceId: string, rootCid: string, port: number, cleanupFailed?: (error: unknown) => void): Promise<void>;
+/** Retire exactly the original registration using the same signed Human root that bound it. */
+export declare function unregisterWorkspace(previous: {
+    workspaceId: string;
+    hostWorkspaceId: string;
+    appOrigin: string;
+    serverCid: string;
+    proofRootCid?: string;
+}, payload: WorkspacePayload, operationNonce: string, attach?: AttachDaemonClient, options?: {
+    request?: typeof fetch;
+    waitMs?: number;
+    checkOnly?: boolean;
+    beforeSend?: () => void;
+    operationExpiresAt?: number;
+    onReceipt?: (status: {
+        deleted?: boolean;
+        retired?: boolean;
+        absent?: boolean;
+        rejected?: boolean;
+        expired?: boolean;
+        deadlineEnforced?: boolean;
+        oldBindingPresent?: boolean;
+    }) => void;
+}): Promise<string>;
+export {};