@peakinc/cli 0.0.1

package/dist/client.js

@@ -0,0 +1,128 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, lstat, open } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export class ClientError extends Error {
+    code;
+    retryAfter;
+    constructor(code, message, retryAfter) {
+        super(message);
+        this.code = code;
+        this.retryAfter = retryAfter;
+    }
+}
+export function apiOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new ClientError('invalid_origin', 'Use an HTTPS API origin.');
+    }
+    if ((url.protocol !== 'https:' &&
+        !(url.protocol === 'http:' &&
+            ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) ||
+        url.username ||
+        url.password ||
+        url.pathname !== '/' ||
+        url.search ||
+        url.hash) {
+        throw new ClientError('invalid_origin', 'Use an HTTPS API origin, or localhost for development.');
+    }
+    return url.origin;
+}
+function credentialFile(origin, directory) {
+    return join(directory, `${createHash('sha256').update(origin).digest('hex')}.json`);
+}
+export function configDirectory() {
+    return process.env.PEAK_CONFIG_DIR || join(homedir(), '.config', 'peak');
+}
+export async function readCredential(origin, directory = configDirectory()) {
+    const path = credentialFile(origin, directory);
+    try {
+        const stat = await lstat(path);
+        if (stat.isSymbolicLink() ||
+            (process.platform !== 'win32' && stat.mode & 0o077)) {
+            throw new ClientError('unsafe_credentials', 'Credential file must be private (mode 600).');
+        }
+        const data = JSON.parse(await readFile(path, 'utf8'));
+        if (data.origin !== origin ||
+            typeof data.access_token !== 'string' ||
+            typeof data.expires_at !== 'string' ||
+            typeof data.token_id !== 'string') {
+            throw new Error('Invalid credential file');
+        }
+        return {
+            access_token: data.access_token,
+            token_id: data.token_id,
+            expires_at: data.expires_at,
+        };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        if (error instanceof ClientError)
+            throw error;
+        throw new ClientError('invalid_credentials', 'Credential file is invalid. Remove it and log in again.');
+    }
+}
+export async function saveCredential(origin, credential, directory = configDirectory()) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    if ((await lstat(directory)).isSymbolicLink())
+        throw new ClientError('unsafe_credentials', 'Credential directory cannot be a symlink.');
+    const path = credentialFile(origin, directory), temporary = `${path}.${randomUUID()}.tmp`;
+    try {
+        const file = await open(temporary, 'wx', 0o600);
+        try {
+            await file.writeFile(JSON.stringify({ origin, ...credential }) + '\n');
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+export async function removeCredential(origin, directory = configDirectory()) {
+    await rm(credentialFile(origin, directory), { force: true });
+}
+export async function request(origin, path, options = {}) {
+    let response;
+    try {
+        response = await fetch(`${origin}${path}`, {
+            method: options.method ?? 'GET',
+            redirect: 'error',
+            signal: AbortSignal.timeout(15_000),
+            headers: {
+                Accept: 'application/json',
+                ...(options.body ? { 'Content-Type': 'application/json' } : {}),
+                ...(options.token ? { Authorization: `Bearer ${options.token}` } : {}),
+            },
+            body: options.body ? JSON.stringify(options.body) : undefined,
+        });
+    }
+    catch {
+        throw new ClientError('connection_failed', 'Cannot reach Peak. Check the API URL and connection.');
+    }
+    let result;
+    try {
+        result = await response.json();
+    }
+    catch {
+        throw new ClientError('invalid_response', 'Peak returned an invalid response.');
+    }
+    if (!response.ok) {
+        const code = typeof result.error?.code === 'string'
+            ? result.error.code
+            : 'request_failed';
+        const message = typeof result.error?.message === 'string'
+            ? result.error.message
+            : 'Request failed.';
+        const retryAfter = Number(response.headers.get('retry-after'));
+        throw new ClientError(code, message.replace(/[\u0000-\u001f\u007f]/g, '').slice(0, 300), retryAfter || undefined);
+    }
+    return result;
+}

package/dist/main.js

@@ -0,0 +1,213 @@
+#!/usr/bin/env node
+import { createHash, randomBytes } from 'node:crypto';
+import { hostname } from 'node:os';
+import { spawn } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { parseArgs } from 'node:util';
+import { previewWorkflowFile } from './workflow.js';
+import { apiOrigin, ClientError, readCredential, removeCredential, request, saveCredential, } from './client.js';
+const { values, positionals } = parseArgs({
+    allowPositionals: true,
+    options: {
+        'api-url': { type: 'string' },
+        json: { type: 'boolean' },
+        'no-browser': { type: 'boolean' },
+        name: { type: 'string' },
+        job: { type: 'string' },
+        runner: { type: 'string' },
+        runs: { type: 'boolean' },
+        repository: { type: 'string' },
+        branch: { type: 'string' },
+        status: { type: 'string' },
+        architecture: { type: 'string' },
+        limit: { type: 'string' },
+        after: { type: 'string' },
+        help: { type: 'boolean', short: 'h' },
+    },
+});
+const json = Boolean(values.json);
+const output = (value, message) => console.log(json ? JSON.stringify(value) : message);
+async function main() {
+    const [command = 'help', subcommand] = positionals;
+    if (values.help || command === 'help') {
+        console.log('Peak\n\n  peak login             Connect this device\n  peak login --runs      Include run history access\n  peak status            Show your workspace\n  peak logout            Revoke this device’s token\n  peak api workspace     Read workspace details\n  peak api audit-events  Read activity (audit:read)\n  peak api runner-types  List released runner types\n  peak runners list      List configured runners\n  peak runs list         List jobs (runs:read)\n  peak runs view <id>     Show a job (runs:read)\n  peak workflow preview <file> --job <id> --runner <label>\n                         Preview a workflow change\n\n  Run filters: --repository <id>, --branch <name>,\n  --status <in_progress|completed>, --architecture <x64|arm64>\n  Pagination: --limit <1-100>, --after <cursor>\n\n  --json                 Machine-readable output\n  --no-browser           Print the approval URL\n  --api-url <origin>     API origin (or PEAK_API_URL)\n\nAgents can supply PEAK_TOKEN instead of logging in.');
+        return;
+    }
+    const origin = apiOrigin(values['api-url'] ?? process.env.PEAK_API_URL ?? 'https://staging.peak.inc');
+    if (command === 'login') {
+        const previous = await readCredential(origin);
+        const verifier = randomBytes(32).toString('base64url');
+        const challenge = createHash('sha256').update(verifier).digest('base64url');
+        const started = await request(origin, '/api/v1/device/authorize', {
+            method: 'POST',
+            body: {
+                name: values.name ?? `Terminal · ${hostname()}`.slice(0, 64),
+                code_challenge: challenge,
+                scopes: values.runs
+                    ? ['workspace:read', 'runs:read']
+                    : ['workspace:read'],
+            },
+        });
+        // Never launch a URL outside the configured Peak origin.
+        const verification = new URL(started.verification_uri_complete);
+        if (verification.origin !== origin ||
+            verification.pathname !== '/agent/authorize')
+            throw new ClientError('invalid_response', 'Invalid approval URL.');
+        output({
+            event: 'authorization_required',
+            verification_url: verification.href,
+            user_code: started.user_code,
+            expires_in: started.expires_in,
+        }, `Open ${verification.href}\n\nCode: ${started.user_code}\nWaiting for approval…`);
+        if (!json &&
+            !values['no-browser'] &&
+            process.stderr.isTTY &&
+            ['darwin', 'linux'].includes(process.platform)) {
+            const child = spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [verification.href], { stdio: 'ignore', detached: true });
+            child.on('error', () => { });
+            child.unref();
+        }
+        const deadline = Date.now() + Math.min(started.expires_in, 600) * 1000;
+        let interval = Math.max(5, started.interval);
+        while (Date.now() < deadline) {
+            await sleep(interval * 1000);
+            let credential;
+            try {
+                credential = await request(origin, '/api/v1/device/token', {
+                    method: 'POST',
+                    body: { device_code: started.device_code, code_verifier: verifier },
+                });
+            }
+            catch (error) {
+                if (error instanceof ClientError &&
+                    ['authorization_pending', 'slow_down'].includes(error.code)) {
+                    interval = Math.max(interval, error.retryAfter ??
+                        (error.code === 'slow_down' ? interval + 5 : interval));
+                    continue;
+                }
+                throw error;
+            }
+            try {
+                await saveCredential(origin, credential);
+            }
+            catch (error) {
+                await request(origin, '/api/v1/token', {
+                    method: 'DELETE',
+                    token: credential.access_token,
+                }).catch(() => { });
+                throw error;
+            }
+            if (previous)
+                await request(origin, '/api/v1/token', {
+                    method: 'DELETE',
+                    token: previous.access_token,
+                }).catch(() => { });
+            const workspace = await request(origin, '/api/v1/workspace', { token: credential.access_token });
+            output({
+                event: 'authenticated',
+                workspace,
+                token_id: credential.token_id,
+                expires_at: credential.expires_at,
+            }, `Connected to ${workspace.name}.`);
+            return;
+        }
+        throw new ClientError('expired_token', 'Login expired. Run peak login again.');
+    }
+    const stored = process.env.PEAK_TOKEN ? null : await readCredential(origin);
+    const token = process.env.PEAK_TOKEN || stored?.access_token;
+    if (!token)
+        throw new ClientError('not_authenticated', 'Run peak login or set PEAK_TOKEN.');
+    if (command === 'logout') {
+        try {
+            await request(origin, '/api/v1/token', { method: 'DELETE', token });
+        }
+        catch (error) {
+            if (!(error instanceof ClientError && error.code === 'unauthorized'))
+                throw error;
+        }
+        if (!process.env.PEAK_TOKEN)
+            await removeCredential(origin);
+        output({ event: 'signed_out' }, 'Signed out.');
+        return;
+    }
+    if (command === 'status' ||
+        (command === 'api' && subcommand === 'workspace')) {
+        const workspace = await request(origin, '/api/v1/workspace', { token });
+        output(workspace, `${workspace.name}\n${workspace.id}`);
+        return;
+    }
+    if (command === 'api' && subcommand === 'audit-events') {
+        const events = await request(origin, '/api/v1/audit-events', {
+            token,
+        });
+        console.log(JSON.stringify(events, null, json ? undefined : 2));
+        return;
+    }
+    if (command === 'api' && subcommand === 'runner-types') {
+        const runners = await request(origin, '/api/v1/runner-types', {
+            token,
+        });
+        console.log(JSON.stringify(runners, null, json ? undefined : 2));
+        return;
+    }
+    if (command === 'runs') {
+        let path;
+        if (subcommand === 'list' && positionals.length === 2) {
+            const params = new URLSearchParams();
+            for (const key of [
+                'repository',
+                'branch',
+                'status',
+                'architecture',
+                'limit',
+                'after',
+            ]) {
+                const value = values[key];
+                if (value !== undefined)
+                    params.set(key === 'repository' ? 'repository_id' : key, value);
+            }
+            path = `/api/v1/runs?${params}`;
+        }
+        else if (subcommand === 'view' &&
+            positionals.length === 3 &&
+            /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/.test(positionals[2])) {
+            path = `/api/v1/runs/${positionals[2]}`;
+        }
+        else {
+            throw new ClientError('invalid_arguments', 'Use peak runs list or peak runs view <id>.');
+        }
+        const result = await request(origin, path, { token });
+        console.log(JSON.stringify(result, null, json ? undefined : 2));
+        return;
+    }
+    if (command === 'runners' && subcommand === 'list') {
+        if (positionals.length !== 2)
+            throw new ClientError('invalid_arguments', 'Use peak runners list.');
+        const params = new URLSearchParams();
+        if (values.limit !== undefined)
+            params.set('limit', values.limit);
+        if (values.after !== undefined)
+            params.set('after', values.after);
+        const result = await request(origin, `/api/v1/runners${params.size ? `?${params}` : ''}`, { token });
+        console.log(JSON.stringify(result, null, json ? undefined : 2));
+        return;
+    }
+    if (command === 'workflow' && subcommand === 'preview') {
+        if (positionals.length !== 3 || !values.job || !values.runner)
+            throw new ClientError('invalid_arguments', 'Use peak workflow preview <file> --job <id> --runner <label>.');
+        const preview = await previewWorkflowFile(origin, positionals[2], values.job, values.runner, token);
+        output(preview, preview.changed
+            ? `${preview.job}\n- runs-on: ${preview.change.before}\n+ runs-on: ${preview.change.after}\n\nPreview only. File unchanged.`
+            : `${preview.job}: already configured. File unchanged.`);
+        return;
+    }
+    throw new ClientError('unknown_command', 'Unknown command. Run peak --help.');
+}
+main().catch((error) => {
+    const code = error instanceof ClientError ? error.code : 'unexpected_error';
+    const message = error instanceof ClientError
+        ? error.message
+        : 'Peak could not complete the request.';
+    console.error(json ? JSON.stringify({ error: { code, message } }) : message);
+    process.exitCode = 1;
+});

package/dist/workflow.js

@@ -0,0 +1,70 @@
+import { createHash } from 'node:crypto';
+import { open } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { ClientError, request } from './client.js';
+export async function previewWorkflowFile(origin, path, job, runner, token) {
+    let workflow;
+    try {
+        const file = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+        try {
+            const stat = await file.stat();
+            if (!stat.isFile() || stat.size > 128 * 1024)
+                throw new Error();
+            const bytes = Buffer.alloc(128 * 1024 + 1);
+            let length = 0;
+            while (length < bytes.length) {
+                const read = await file.read(bytes, length, bytes.length - length, length);
+                if (!read.bytesRead)
+                    break;
+                length += read.bytesRead;
+            }
+            if (length > 128 * 1024)
+                throw new Error();
+            workflow = new TextDecoder('utf-8', {
+                fatal: true,
+                ignoreBOM: true,
+            }).decode(bytes.subarray(0, length));
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch {
+        throw new ClientError('invalid_workflow_file', 'Use a UTF-8 workflow file of up to 128 KiB.');
+    }
+    const preview = await request(origin, '/api/v1/workflow-preview', {
+        method: 'POST',
+        token,
+        body: { workflow, job, runner_label: runner },
+    });
+    const digest = (value) => createHash('sha256').update(value).digest('hex');
+    const change = preview?.change;
+    const rollback = preview?.rollback;
+    if (preview?.object !== 'workflow_preview' ||
+        preview.job !== job ||
+        preview.runner?.label !== runner ||
+        preview.source_sha256 !== digest(workflow) ||
+        typeof preview.updated_workflow !== 'string' ||
+        preview.updated_sha256 !== digest(preview.updated_workflow) ||
+        !change ||
+        !Number.isInteger(change.start) ||
+        !Number.isInteger(change.end) ||
+        change.start < 0 ||
+        change.end < change.start ||
+        change.end > workflow.length ||
+        typeof change.before !== 'string' ||
+        typeof change.after !== 'string' ||
+        workflow.slice(change.start, change.end) !== change.before ||
+        workflow.slice(0, change.start) +
+            change.after +
+            workflow.slice(change.end) !==
+            preview.updated_workflow ||
+        preview.changed !== (change.before !== change.after) ||
+        !rollback ||
+        rollback.start !== change.start ||
+        rollback.end !== change.start + change.after.length ||
+        rollback.before !== change.after ||
+        rollback.after !== change.before)
+        throw new ClientError('invalid_response', 'Peak returned an invalid workflow preview.');
+    return preview;
+}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@peakinc/cli",
+  "version": "0.0.1",
+  "description": "Peak command line: log in, read your workspace, preview a workflow change.",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PeakInc/source.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://peak.inc",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "bin": {
+    "peak": "dist/main.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  }
+}