@pasko70/pibo 2.5.2 → 3.0.1

package/dist/previews/network.js

@@ -0,0 +1,198 @@
+import { readdirSync, readFileSync, readlinkSync } from "node:fs";
+import { connect } from "node:net";
+const RESERVED_PREVIEW_PORTS = new Set([
+    2375,
+    2376,
+    3306,
+    4788,
+    4789,
+    4808,
+    4809,
+    5432,
+    6379,
+    9200,
+    9222,
+    9223,
+    27017,
+]);
+const targetIdentityCache = new Map();
+export function validatePreviewPort(port) {
+    if (!Number.isInteger(port) || port < 1024 || port > 65535) {
+        throw new Error("Preview port must be an integer between 1024 and 65535");
+    }
+    if (RESERVED_PREVIEW_PORTS.has(port)) {
+        throw new Error(`Port ${port} is reserved and cannot be exposed as a Pibo preview`);
+    }
+    return port;
+}
+export async function probePreviewTarget(port, options = {}) {
+    validatePreviewPort(port);
+    for (const host of ["127.0.0.1", "::1"]) {
+        const startedAt = performance.now();
+        const reachable = await new Promise((resolve) => {
+            const socket = connect({ host, port });
+            let settled = false;
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                socket.destroy();
+                resolve(value);
+            };
+            socket.setTimeout(options.timeoutMs ?? 750);
+            socket.once("connect", () => finish(true));
+            socket.once("timeout", () => finish(false));
+            socket.once("error", () => finish(false));
+        });
+        if (reachable)
+            return { host, latencyMs: Math.max(0, Math.round(performance.now() - startedAt)) };
+    }
+    return undefined;
+}
+export function previewProcessStartTicks(pid) {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8").trim();
+        const closingParen = stat.lastIndexOf(")");
+        if (closingParen < 0)
+            return undefined;
+        return stat.slice(closingParen + 1).trim().split(/\s+/)[19];
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isPiboYieldedProcess(pid) {
+    if (process.platform !== "linux")
+        return false;
+    try {
+        return /(?:^|\/)pibo-yielded-[^/\n]+\.service(?:$|\/)/m.test(readFileSync(`/proc/${pid}/cgroup`, "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
+export function isPiboControlProcess(pid) {
+    if (pid === process.pid)
+        return true;
+    if (process.platform !== "linux")
+        return false;
+    try {
+        const cgroup = readFileSync(`/proc/${pid}/cgroup`, "utf8");
+        if (/(?:^|\/)pibo-(?:web|gateway|dev|fallback)[^/\n]*\.service(?:$|\/)/m.test(cgroup))
+            return true;
+    }
+    catch {
+        // Fall through to command-line inspection.
+    }
+    try {
+        const argv = readFileSync(`/proc/${pid}/cmdline`)
+            .toString("utf8")
+            .split("\0")
+            .filter(Boolean);
+        const command = argv.join(" ");
+        return /(?:^|\s)(?:pibo|[^\s/]*\/pibo)(?:\s|$)/.test(command) &&
+            /(?:^|\s)gateway(?::web)?(?:\s|$)/.test(command) ||
+            /(?:dist|src)\/bin\/pibo\.(?:js|ts).*\bgateway(?::web)?\b/.test(command);
+    }
+    catch {
+        return false;
+    }
+}
+function loopbackSocketInodes(host, port) {
+    if (process.platform !== "linux")
+        return new Set();
+    const portHex = port.toString(16).toUpperCase().padStart(4, "0");
+    const sources = host === "127.0.0.1"
+        ? [["/proc/net/tcp", "0100007F"]]
+        : [["/proc/net/tcp6", "00000000000000000000000001000000"]];
+    const inodes = new Set();
+    for (const [path, address] of sources) {
+        let lines;
+        try {
+            lines = readFileSync(path, "utf8").split("\n").slice(1);
+        }
+        catch {
+            continue;
+        }
+        for (const line of lines) {
+            const fields = line.trim().split(/\s+/);
+            if (fields.length < 10 || fields[3] !== "0A")
+                continue;
+            const [localAddress, localPort] = fields[1].split(":");
+            if (localAddress === address && localPort === portHex && fields[9])
+                inodes.add(fields[9]);
+        }
+    }
+    return inodes;
+}
+function processOwnsSocket(pid, inodes) {
+    if (inodes.size === 0)
+        return false;
+    let descriptors;
+    try {
+        descriptors = readdirSync(`/proc/${pid}/fd`);
+    }
+    catch {
+        return false;
+    }
+    for (const descriptor of descriptors) {
+        try {
+            const target = readlinkSync(`/proc/${pid}/fd/${descriptor}`);
+            const match = target.match(/^socket:\[(\d+)]$/);
+            if (match && inodes.has(match[1]))
+                return true;
+        }
+        catch {
+            // File descriptors can disappear while being inspected.
+        }
+    }
+    return false;
+}
+export function findPreviewTargetProcess(host, port) {
+    const inodes = loopbackSocketInodes(host, port);
+    if (inodes.size === 0)
+        return undefined;
+    let entries;
+    try {
+        entries = readdirSync("/proc");
+    }
+    catch {
+        return undefined;
+    }
+    const owners = [];
+    for (const entry of entries) {
+        if (!/^\d+$/.test(entry))
+            continue;
+        const pid = Number(entry);
+        if (!processOwnsSocket(pid, inodes))
+            continue;
+        const startTicks = previewProcessStartTicks(pid);
+        if (startTicks)
+            owners.push({ pid, startTicks });
+    }
+    return owners.length === 1 ? owners[0] : undefined;
+}
+export function isPreviewTargetProcessCurrent(exposure, options = {}) {
+    if (process.platform !== "linux")
+        return true;
+    if (!exposure.targetProcessId || !exposure.targetProcessStartTicks)
+        return false;
+    const cacheMs = options.cacheMs ?? 1_000;
+    const cacheKey = [
+        exposure.id,
+        exposure.targetHost,
+        exposure.targetPort,
+        exposure.targetProcessId,
+        exposure.targetProcessStartTicks,
+    ].join(":");
+    const cached = targetIdentityCache.get(cacheKey);
+    const now = Date.now();
+    if (cached && now - cached.checkedAt < cacheMs)
+        return cached.current;
+    const current = previewProcessStartTicks(exposure.targetProcessId) === exposure.targetProcessStartTicks &&
+        processOwnsSocket(exposure.targetProcessId, loopbackSocketInodes(exposure.targetHost, exposure.targetPort));
+    if (targetIdentityCache.size >= 1_024)
+        targetIdentityCache.clear();
+    targetIdentityCache.set(cacheKey, { checkedAt: now, current });
+    return current;
+}

package/dist/previews/plugin.js

@@ -0,0 +1,11 @@
+import { definePiboPlugin } from "../plugins/registry.js";
+import { createPreviewWebApp } from "./web-app.js";
+export function createPiboPreviewPlugin(options = {}) {
+    return definePiboPlugin({
+        id: "pibo.session-live-previews",
+        name: "Pibo Session Live Previews",
+        register(api) {
+            api.registerWebApp(createPreviewWebApp(options));
+        },
+    });
+}

package/dist/previews/process-supervisor.js

@@ -0,0 +1,38 @@
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename } from "node:path";
+const command = process.env.PIBO_PREVIEW_START_COMMAND;
+if (!command)
+    throw new Error("Preview supervisor requires a start command");
+const environment = { ...process.env };
+delete environment.PIBO_PREVIEW_START_COMMAND;
+const shell = previewShell();
+const child = spawn(shell.command, shell.args(command), {
+    env: environment,
+    stdio: "ignore",
+    windowsHide: true,
+});
+child.once("error", (error) => {
+    console.error(`Preview supervisor could not start its command: ${error.message}`);
+    process.exitCode = 1;
+});
+child.once("exit", (code, signal) => {
+    process.exitCode = code ?? (signal ? 1 : 0);
+});
+function previewShell() {
+    if (process.platform === "win32") {
+        return {
+            command: process.env.ComSpec ?? "cmd.exe",
+            args: (value) => ["/d", "/s", "/c", value],
+        };
+    }
+    const shell = process.env.SHELL && existsSync(process.env.SHELL)
+        ? process.env.SHELL
+        : existsSync("/bin/bash")
+            ? "/bin/bash"
+            : "/bin/sh";
+    return {
+        command: shell,
+        args: (value) => basename(shell).includes("bash") ? ["-lc", value] : ["-c", value],
+    };
+}

package/dist/previews/proxy.js

@@ -0,0 +1,387 @@
+import { request as httpRequest } from "node:http";
+import { isIP } from "node:net";
+export const PREVIEW_SESSION_COOKIE = "__Host-pibo_preview_session";
+export const PREVIEW_INSECURE_SESSION_COOKIE = "pibo_preview_session";
+export const DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS = 128;
+export const DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS_PER_PREVIEW = 32;
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+export class PreviewProxyLimiter {
+    maxTotal;
+    maxPerPreview;
+    total = 0;
+    perPreview = new Map();
+    constructor(maxTotal = DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS, maxPerPreview = DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS_PER_PREVIEW) {
+        this.maxTotal = maxTotal;
+        this.maxPerPreview = maxPerPreview;
+        if (!Number.isInteger(maxTotal) || maxTotal < 1 || maxTotal > 10_000) {
+            throw new Error("Preview proxy total connection limit must be between 1 and 10000");
+        }
+        if (!Number.isInteger(maxPerPreview) || maxPerPreview < 1 || maxPerPreview > maxTotal) {
+            throw new Error("Preview proxy per-preview connection limit must be positive and no greater than the total limit");
+        }
+    }
+    tryAcquire(previewId) {
+        const current = this.perPreview.get(previewId) ?? 0;
+        if (this.total >= this.maxTotal || current >= this.maxPerPreview)
+            return undefined;
+        this.total += 1;
+        this.perPreview.set(previewId, current + 1);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.total -= 1;
+            const next = (this.perPreview.get(previewId) ?? 1) - 1;
+            if (next > 0)
+                this.perPreview.set(previewId, next);
+            else
+                this.perPreview.delete(previewId);
+        };
+    }
+    snapshot() {
+        return { total: this.total, previews: this.perPreview.size };
+    }
+}
+export function previewSessionCookieName(protocol) {
+    return protocol === "https:" ? PREVIEW_SESSION_COOKIE : PREVIEW_INSECURE_SESSION_COOKIE;
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+export function cookieValue(header, name) {
+    for (const item of header?.split(";") ?? []) {
+        const separator = item.indexOf("=");
+        if (separator < 0)
+            continue;
+        if (item.slice(0, separator).trim() !== name)
+            continue;
+        try {
+            return decodeURIComponent(item.slice(separator + 1).trim());
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+function isPiboCredentialCookie(name) {
+    const normalized = name.toLowerCase();
+    return normalized.startsWith("pibo_") ||
+        normalized.startsWith("__host-pibo_") ||
+        normalized.startsWith("__secure-pibo_") ||
+        normalized.includes("better-auth");
+}
+function withoutPiboCredentialCookies(header) {
+    const cookies = (header?.split(";") ?? [])
+        .map((item) => item.trim())
+        .filter((item) => {
+        const separator = item.indexOf("=");
+        if (!item || separator < 0)
+            return false;
+        return !isPiboCredentialCookie(item.slice(0, separator).trim());
+    });
+    return cookies.length ? cookies.join("; ") : undefined;
+}
+function isCredentialOrProxyMetadataHeader(name) {
+    return name === "authorization" ||
+        name === "forwarded" ||
+        name === "proxy-authorization" ||
+        name === "remote-user" ||
+        name === "x-real-ip" ||
+        name.startsWith("x-pibo-") ||
+        name.startsWith("x-forwarded-") ||
+        name.startsWith("x-auth-") ||
+        name.startsWith("x-original-") ||
+        name.startsWith("x-goog-authenticated-user-") ||
+        name.startsWith("cf-access-");
+}
+function upstreamOrigin(exposure) {
+    const host = exposure.targetHost === "::1" ? `[::1]` : exposure.targetHost;
+    return `http://${host}:${exposure.targetPort}`;
+}
+function rewriteOriginHeader(value, exposure) {
+    if (!value)
+        return undefined;
+    if (value === "null")
+        return value;
+    try {
+        const parsed = new URL(value);
+        const upstream = new URL(upstreamOrigin(exposure));
+        parsed.protocol = upstream.protocol;
+        parsed.hostname = upstream.hostname;
+        parsed.port = upstream.port;
+        return parsed.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+function requestHeaders(incoming, exposure, requestURL, websocket) {
+    const headers = {};
+    for (const [name, value] of Object.entries(incoming)) {
+        const normalized = name.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(normalized) || normalized === "host" || isCredentialOrProxyMetadataHeader(normalized))
+            continue;
+        if (normalized === "cookie") {
+            const cookie = withoutPiboCredentialCookies(firstHeader(value));
+            if (cookie)
+                headers.cookie = cookie;
+            continue;
+        }
+        if (normalized === "origin") {
+            const origin = rewriteOriginHeader(firstHeader(value), exposure);
+            if (origin)
+                headers.origin = origin;
+            continue;
+        }
+        if (normalized === "referer") {
+            const referer = rewriteOriginHeader(firstHeader(value), exposure);
+            if (referer)
+                headers.referer = referer;
+            continue;
+        }
+        headers[normalized] = value;
+    }
+    const targetHost = exposure.targetHost === "::1" ? `[::1]` : exposure.targetHost;
+    headers.host = `${targetHost}:${exposure.targetPort}`;
+    headers["x-forwarded-host"] = requestURL.host;
+    headers["x-forwarded-proto"] = requestURL.protocol.slice(0, -1);
+    if (websocket) {
+        headers.connection = "Upgrade";
+        headers.upgrade = incoming.upgrade ?? "websocket";
+    }
+    return headers;
+}
+function isForbiddenLocalRedirectHost(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (normalized === "localhost" || normalized.endsWith(".localhost"))
+        return true;
+    const family = isIP(normalized);
+    if (family === 4) {
+        const [a, b] = normalized.split(".").map(Number);
+        return a === 0 || a === 10 || a === 127 || a >= 224 ||
+            a === 169 && b === 254 ||
+            a === 172 && b >= 16 && b <= 31 ||
+            a === 192 && b === 168 ||
+            a === 100 && b >= 64 && b <= 127;
+    }
+    if (family === 6) {
+        return normalized === "::" || normalized === "::1" ||
+            normalized.startsWith("fc") || normalized.startsWith("fd") ||
+            normalized.startsWith("fe8") || normalized.startsWith("fe9") ||
+            normalized.startsWith("fea") || normalized.startsWith("feb") ||
+            normalized.startsWith("::ffff:");
+    }
+    return false;
+}
+export function sanitizePreviewRedirectLocation(value, exposure, previewOrigin) {
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        return undefined;
+    try {
+        const location = new URL(value, previewOrigin);
+        const upstream = new URL(upstreamOrigin(exposure));
+        if (location.origin === upstream.origin) {
+            const preview = new URL(previewOrigin);
+            location.protocol = preview.protocol;
+            location.hostname = preview.hostname;
+            location.port = preview.port;
+        }
+        if (location.protocol !== "http:" && location.protocol !== "https:")
+            return undefined;
+        if (location.origin !== previewOrigin && isForbiddenLocalRedirectHost(location.hostname))
+            return undefined;
+        return location.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+export function sanitizePreviewSetCookie(value) {
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        return undefined;
+    const [nameValue, ...attributes] = value.split(";");
+    const separator = nameValue?.indexOf("=") ?? -1;
+    if (!nameValue || separator <= 0 || isPiboCredentialCookie(nameValue.slice(0, separator).trim()))
+        return undefined;
+    const rewritten = [nameValue, ...attributes.filter((attribute) => !/^\s*domain\s*=/i.test(attribute))];
+    return rewritten.filter(Boolean).join(";");
+}
+function rewriteFrameAncestors(value, piboOrigin) {
+    if (!piboOrigin)
+        return value;
+    const directives = (value ?? "")
+        .split(";")
+        .map((item) => item.trim())
+        .filter((item) => item && !item.toLowerCase().startsWith("frame-ancestors"));
+    directives.push(`frame-ancestors ${piboOrigin}`);
+    return directives.join("; ");
+}
+function responseHeaders(incoming, exposure, previewOrigin, piboOrigin) {
+    const headers = {};
+    for (const [name, value] of Object.entries(incoming)) {
+        const normalized = name.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(normalized) || normalized === "x-frame-options" || normalized.startsWith("x-pibo-"))
+            continue;
+        if (normalized === "set-cookie") {
+            const values = (Array.isArray(value) ? value : value ? [value] : [])
+                .map(sanitizePreviewSetCookie)
+                .filter((item) => Boolean(item));
+            if (values.length)
+                headers[normalized] = values;
+            continue;
+        }
+        if (normalized === "location") {
+            const location = sanitizePreviewRedirectLocation(firstHeader(value) ?? "", exposure, previewOrigin);
+            if (location)
+                headers.location = location;
+            continue;
+        }
+        if (normalized === "content-security-policy") {
+            headers[normalized] = rewriteFrameAncestors(firstHeader(value), piboOrigin);
+            continue;
+        }
+        if (normalized === "access-control-allow-origin" && typeof value === "string") {
+            headers[normalized] = value === upstreamOrigin(exposure) ? previewOrigin : value;
+            continue;
+        }
+        headers[normalized] = value;
+    }
+    if (!headers["content-security-policy"] && piboOrigin) {
+        headers["content-security-policy"] = `frame-ancestors ${piboOrigin}`;
+    }
+    headers["referrer-policy"] = "no-referrer";
+    return headers;
+}
+function targetOptions(exposure, path, headers, method) {
+    return {
+        host: exposure.targetHost,
+        port: exposure.targetPort,
+        method: method ?? "GET",
+        path,
+        headers,
+    };
+}
+function upstreamRequestPath(requestURL) {
+    return `${requestURL.pathname}${requestURL.search}`;
+}
+export function proxyPreviewHttp(input) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let upstreamRequest;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve();
+        };
+        input.response.once("finish", finish);
+        const headers = requestHeaders(input.request.headers, input.exposure, input.requestURL, false);
+        const upstream = httpRequest(targetOptions(input.exposure, upstreamRequestPath(input.requestURL), headers, input.request.method), (upstreamResponse) => {
+            upstream.setTimeout(0);
+            input.response.writeHead(upstreamResponse.statusCode ?? 502, upstreamResponse.statusMessage, responseHeaders(upstreamResponse.headers, input.exposure, input.requestURL.origin, input.piboOrigin));
+            upstreamResponse.pipe(input.response);
+            upstreamResponse.once("error", () => {
+                if (!input.response.writableEnded)
+                    input.response.destroy();
+            });
+        });
+        upstreamRequest = upstream;
+        upstream.setTimeout(5_000, () => upstream.destroy(new Error("Preview upstream connection timed out")));
+        upstream.once("error", (error) => {
+            if (!input.response.headersSent) {
+                input.response.writeHead(502, { "content-type": "application/json", "cache-control": "no-store" });
+                input.response.end(JSON.stringify({ error: "Preview upstream unavailable" }));
+            }
+            else if (!input.response.writableEnded)
+                input.response.destroy(error);
+        });
+        input.request.once("aborted", () => upstream.destroy());
+        input.response.once("close", () => {
+            upstreamRequest?.destroy();
+            finish();
+        });
+        input.request.pipe(upstream);
+    });
+}
+function writeUpgradeResponse(socket, response, exposure, previewOrigin) {
+    const lines = ["HTTP/1.1 101 Switching Protocols", "Connection: Upgrade", "Upgrade: websocket"];
+    const headers = responseHeaders(response.headers, exposure, previewOrigin);
+    for (const [name, rawValue] of Object.entries(headers)) {
+        if (name === "connection" || name === "upgrade" || name === "content-length")
+            continue;
+        for (const value of Array.isArray(rawValue) ? rawValue : rawValue === undefined ? [] : [rawValue]) {
+            lines.push(`${name}: ${value}`);
+        }
+    }
+    socket.write(`${lines.join("\r\n")}\r\n\r\n`);
+}
+export function proxyPreviewWebSocket(input) {
+    return new Promise((resolve) => {
+        let settled = false;
+        let upstreamSocket;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve();
+        };
+        const headers = requestHeaders(input.request.headers, input.exposure, input.requestURL, true);
+        const upstreamRequest = httpRequest(targetOptions(input.exposure, upstreamRequestPath(input.requestURL), headers, "GET"));
+        let upgraded = false;
+        const closeFromClient = () => {
+            upstreamRequest.destroy();
+            upstreamSocket?.destroy();
+            finish();
+        };
+        input.socket.once("end", closeFromClient);
+        input.socket.once("close", closeFromClient);
+        input.socket.once("error", closeFromClient);
+        upstreamRequest.setTimeout(5_000, () => upstreamRequest.destroy(new Error("Preview WebSocket connection timed out")));
+        upstreamRequest.once("upgrade", (response, socket, upstreamHead) => {
+            upgraded = true;
+            upstreamSocket = socket;
+            upstreamRequest.setTimeout(0);
+            writeUpgradeResponse(input.socket, response, input.exposure, input.requestURL.origin);
+            if (input.head.length)
+                socket.write(input.head);
+            if (upstreamHead.length)
+                input.socket.write(upstreamHead);
+            socket.pipe(input.socket);
+            input.socket.pipe(socket);
+            const closeBoth = () => {
+                socket.destroy();
+                input.socket.destroy();
+                finish();
+            };
+            socket.once("error", closeBoth);
+            input.socket.once("error", closeBoth);
+            socket.once("close", () => {
+                input.socket.destroy();
+                finish();
+            });
+        });
+        upstreamRequest.once("response", (response) => {
+            if (upgraded)
+                return;
+            response.resume();
+            input.socket.end(`HTTP/1.1 ${response.statusCode ?? 502} ${response.statusMessage ?? "Bad Gateway"}\r\nConnection: close\r\n\r\n`);
+            finish();
+        });
+        upstreamRequest.once("error", () => {
+            if (!input.socket.destroyed)
+                input.socket.end("HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n");
+            finish();
+        });
+        upstreamRequest.end();
+    });
+}