@pellux/goodvibes-tui 0.24.1 → 0.25.0

package/src/daemon/remote/backends/cloud-terminal.ts

@@ -0,0 +1,137 @@
+import { mkdir, writeFile, chmod, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import type { PeerRecord } from '../peer-registry.ts';
+import type { CloudTerminalBackendConfig } from '../peer-registry.ts';
+import {
+  type Backend,
+  type BackendContext,
+  type BackendDispatchResult,
+  type DispatchPayload,
+  BackendDispatchError,
+  resolveTimeout,
+} from './types.ts';
+import { runProcess } from './process-runner.ts';
+import { tokenizeCommand } from './local-process.ts';
+
+/**
+ * Cloud-terminal backend: executes a command in a managed cloud shell / VM via
+ * the provider CLI (gcloud / aws / az). The provider credential is resolved from
+ * the daemon credential store and supplied to the CLI via a 0600 credentials
+ * file or a provider-specific env var — never as an argv token, never logged.
+ */
+export function createCloudTerminalBackend(ctx: BackendContext): Backend {
+  const credDir = join(ctx.homeDirectory, '.goodvibes', 'tui', 'operator', 'cloud-creds');
+
+  async function writeCredentialFile(peerId: string, value: string): Promise<string> {
+    await mkdir(credDir, { recursive: true });
+    await chmod(credDir, 0o700).catch(() => {});
+    const suffix = randomBytes(4).toString('hex');
+    const path = join(credDir, `${peerId}.${suffix}.cred`);
+    await writeFile(path, value, { mode: 0o600 });
+    await chmod(path, 0o600).catch(() => {});
+    return path;
+  }
+
+  function buildArgs(
+    config: CloudTerminalBackendConfig,
+    remoteCommand: string,
+  ): { args: string[]; credEnvKey?: string } {
+    switch (config.provider) {
+      case 'gcp': {
+        // gcloud compute ssh runs `command` on the target Cloud Shell / instance.
+        const args = ['gcloud', 'compute', 'ssh'];
+        if (config.projectId) args.push('--project', config.projectId);
+        if (config.location) args.push('--zone', config.location);
+        args.push(config.instance ?? 'cloudshell', '--command', remoteCommand);
+        return { args, credEnvKey: 'CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE' };
+      }
+      case 'aws': {
+        // aws ssm send-command style: run shell command on a managed instance.
+        const args = ['aws', 'ssm', 'start-session'];
+        if (config.location) args.push('--region', config.location);
+        if (config.instance) args.push('--target', config.instance);
+        args.push(
+          '--document-name', 'AWS-StartInteractiveCommand',
+          '--parameters', `command=${remoteCommand}`,
+        );
+        return { args, credEnvKey: 'AWS_SHARED_CREDENTIALS_FILE' };
+      }
+      case 'azure': {
+        // az vm run-command invoke executes a script on the target VM.
+        const args = ['az', 'vm', 'run-command', 'invoke'];
+        if (config.projectId) args.push('--resource-group', config.projectId);
+        if (config.instance) args.push('--name', config.instance);
+        args.push(
+          '--command-id', 'RunShellScript',
+          '--scripts', remoteCommand,
+        );
+        return { args, credEnvKey: 'AZURE_AUTH_LOCATION' };
+      }
+      default:
+        throw new BackendDispatchError(
+          `Unsupported cloud provider: ${String(config.provider)}`,
+          'REMOTE_BACKEND_UNSUPPORTED_PROVIDER',
+        );
+    }
+  }
+
+  return {
+    kind: 'cloud-terminal',
+    async dispatch(
+      peer: PeerRecord,
+      command: string,
+      payload?: DispatchPayload,
+    ): Promise<BackendDispatchResult> {
+      if (peer.backendConfig.kind !== 'cloud-terminal') {
+        throw new BackendDispatchError(
+          `Peer '${peer.peerId}' is not a cloud-terminal peer.`,
+          'REMOTE_BACKEND_KIND_MISMATCH',
+        );
+      }
+      const config = peer.backendConfig as { kind: 'cloud-terminal' } & CloudTerminalBackendConfig;
+      if (tokenizeCommand(command).length === 0) {
+        throw new BackendDispatchError('Empty command.', 'REMOTE_BACKEND_BAD_COMMAND');
+      }
+      const credential = await ctx.credentials.resolveRef(config.credentialRef);
+      if (!credential || credential.length === 0) {
+        throw new BackendDispatchError(
+          `Could not resolve cloud credential for peer '${peer.peerId}'.`,
+          'REMOTE_BACKEND_CREDENTIAL_MISSING',
+        );
+      }
+      const remoteCommand = payload?.args && payload.args.length > 0
+        ? `${command} ${payload.args.join(' ')}`
+        : command;
+      const { args, credEnvKey } = buildArgs(config, remoteCommand);
+      const credPath = await writeCredentialFile(peer.peerId, credential);
+      const env: Record<string, string> = { ...(payload?.env ?? {}) };
+      if (credEnvKey) env[credEnvKey] = credPath;
+
+      ctx.logger.info('remote cloud-terminal dispatch', {
+        peerId: peer.peerId,
+        provider: config.provider,
+      });
+      try {
+        const result = await runProcess({
+          args,
+          timeoutMs: resolveTimeout(payload),
+          env,
+          ...(payload?.stdin !== undefined ? { stdin: payload.stdin } : {}),
+        });
+        return {
+          exitCode: result.timedOut ? 124 : result.exitCode,
+          stdout: result.stdout,
+          stderr: result.timedOut
+            ? `${result.stderr}\n[remote] cloud command timed out`
+            : result.stderr,
+        };
+      } finally {
+        // The plaintext provider credential file is single-use: remove it as
+        // soon as the CLI has run (or failed) so credentials never accumulate
+        // on disk under cloud-creds/.
+        await rm(credPath, { force: true }).catch(() => {});
+      }
+    },
+  };
+}

package/src/daemon/remote/backends/docker.ts

@@ -0,0 +1,80 @@
+import type { PeerRecord } from '../peer-registry.ts';
+import type { DockerBackendConfig } from '../peer-registry.ts';
+import {
+  type Backend,
+  type BackendContext,
+  type BackendDispatchResult,
+  type DispatchPayload,
+  BackendDispatchError,
+  resolveTimeout,
+} from './types.ts';
+import { runProcess } from './process-runner.ts';
+import { tokenizeCommand } from './local-process.ts';
+
+/**
+ * Docker backend: runs `docker exec {containerName} {command}` against the local
+ * Docker socket (or a configured DOCKER_HOST). The command is executed inside
+ * the target container via `sh -c` so shell semantics survive the hop, while the
+ * docker argv itself is fully tokenized (no shell on the daemon side).
+ */
+export function createDockerBackend(ctx: BackendContext): Backend {
+  return {
+    kind: 'docker',
+    async dispatch(
+      peer: PeerRecord,
+      command: string,
+      payload?: DispatchPayload,
+    ): Promise<BackendDispatchResult> {
+      if (peer.backendConfig.kind !== 'docker') {
+        throw new BackendDispatchError(
+          `Peer '${peer.peerId}' is not a docker peer.`,
+          'REMOTE_BACKEND_KIND_MISMATCH',
+        );
+      }
+      const config = peer.backendConfig as { kind: 'docker' } & DockerBackendConfig;
+      if (tokenizeCommand(command).length === 0) {
+        throw new BackendDispatchError('Empty command.', 'REMOTE_BACKEND_BAD_COMMAND');
+      }
+
+      // Resolve DOCKER_HOST. When it is a secret reference, pull the real value
+      // from the credential store and pass it via env (never argv).
+      const env: Record<string, string> = { ...(payload?.env ?? {}) };
+      if (config.dockerHost) {
+        const resolved = config.dockerHost.startsWith('goodvibes://')
+          ? await ctx.credentials.resolveRef(config.dockerHost)
+          : config.dockerHost;
+        if (!resolved) {
+          throw new BackendDispatchError(
+            `Could not resolve dockerHost for peer '${peer.peerId}'.`,
+            'REMOTE_BACKEND_CREDENTIAL_MISSING',
+          );
+        }
+        env.DOCKER_HOST = resolved;
+      }
+
+      const innerCommand = payload?.args && payload.args.length > 0
+        ? `${command} ${payload.args.join(' ')}`
+        : command;
+
+      const args = ['docker', 'exec'];
+      if (payload?.stdin !== undefined) args.push('-i');
+      args.push(config.containerName, 'sh', '-c', innerCommand);
+
+      ctx.logger.info('remote docker dispatch', {
+        peerId: peer.peerId,
+        container: config.containerName,
+      });
+      const result = await runProcess({
+        args,
+        timeoutMs: resolveTimeout(payload),
+        env,
+        ...(payload?.stdin !== undefined ? { stdin: payload.stdin } : {}),
+      });
+      return {
+        exitCode: result.timedOut ? 124 : result.exitCode,
+        stdout: result.stdout,
+        stderr: result.timedOut ? `${result.stderr}\n[remote] docker exec timed out` : result.stderr,
+      };
+    },
+  };
+}

package/src/daemon/remote/backends/index.ts

@@ -0,0 +1,34 @@
+import type { BackendKind } from '../peer-registry.ts';
+import { type Backend, type BackendContext } from './types.ts';
+import { createLocalProcessBackend } from './local-process.ts';
+import { createDockerBackend } from './docker.ts';
+import { createSshBackend } from './ssh.ts';
+import { createCloudTerminalBackend } from './cloud-terminal.ts';
+
+export type { Backend, BackendContext, BackendDispatchResult, DispatchPayload } from './types.ts';
+export { BackendDispatchError, DEFAULT_SYNC_TIMEOUT_MS, MAX_SYNC_TIMEOUT_MS, resolveTimeout } from './types.ts';
+export { createLocalProcessBackend } from './local-process.ts';
+export { createDockerBackend } from './docker.ts';
+export { createSshBackend } from './ssh.ts';
+export { createCloudTerminalBackend } from './cloud-terminal.ts';
+export { tokenizeCommand } from './local-process.ts';
+export { runProcess } from './process-runner.ts';
+export type { RunOptions, RunResult } from './process-runner.ts';
+
+/**
+ * Build the full backend registry keyed by backendKind. The dispatcher selects
+ * a backend by the peer's backendKind.
+ */
+export function createBackends(ctx: BackendContext): Map<BackendKind, Backend> {
+  const backends: Backend[] = [
+    createLocalProcessBackend(ctx),
+    createDockerBackend(ctx),
+    createSshBackend(ctx),
+    createCloudTerminalBackend(ctx),
+  ];
+  const registry = new Map<BackendKind, Backend>();
+  for (const backend of backends) {
+    registry.set(backend.kind, backend);
+  }
+  return registry;
+}

package/src/daemon/remote/backends/local-process.ts

@@ -0,0 +1,113 @@
+import type { PeerRecord } from '../peer-registry.ts';
+import type { LocalProcessBackendConfig } from '../peer-registry.ts';
+import {
+  type Backend,
+  type BackendContext,
+  type BackendDispatchResult,
+  type DispatchPayload,
+  BackendDispatchError,
+  resolveTimeout,
+} from './types.ts';
+import { runProcess } from './process-runner.ts';
+
+/** Split a command string into argv, honoring single/double quotes. */
+export function tokenizeCommand(command: string): string[] {
+  const tokens: string[] = [];
+  let current = '';
+  let quote: '"' | "'" | null = null;
+  let escaped = false;
+  let started = false;
+  for (const ch of command) {
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      started = true;
+      continue;
+    }
+    if (ch === '\\' && quote !== "'") {
+      escaped = true;
+      started = true;
+      continue;
+    }
+    if (quote) {
+      if (ch === quote) {
+        quote = null;
+      } else {
+        current += ch;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      started = true;
+      continue;
+    }
+    if (ch === ' ' || ch === '\t' || ch === '\n') {
+      if (started) {
+        tokens.push(current);
+        current = '';
+        started = false;
+      }
+      continue;
+    }
+    current += ch;
+    started = true;
+  }
+  if (started) tokens.push(current);
+  if (quote) {
+    throw new BackendDispatchError('Unterminated quote in command string.', 'REMOTE_BACKEND_BAD_COMMAND');
+  }
+  return tokens;
+}
+
+/**
+ * Local-process backend: spawns the command directly on the daemon host. This is
+ * the lowest-friction backend, used for self-hosted peers. An optional
+ * allowlist on backendConfig restricts which executables may run.
+ */
+export function createLocalProcessBackend(ctx: BackendContext): Backend {
+  return {
+    kind: 'local-process',
+    async dispatch(
+      peer: PeerRecord,
+      command: string,
+      payload?: DispatchPayload,
+    ): Promise<BackendDispatchResult> {
+      if (peer.backendConfig.kind !== 'local-process') {
+        throw new BackendDispatchError(
+          `Peer '${peer.peerId}' is not a local-process peer.`,
+          'REMOTE_BACKEND_KIND_MISMATCH',
+        );
+      }
+      const config = peer.backendConfig as { kind: 'local-process' } & LocalProcessBackendConfig;
+      const tokens = tokenizeCommand(command);
+      if (tokens.length === 0) {
+        throw new BackendDispatchError('Empty command.', 'REMOTE_BACKEND_BAD_COMMAND');
+      }
+      const executable = tokens[0]!;
+      if (config.allowedCommands && config.allowedCommands.length > 0) {
+        if (!config.allowedCommands.includes(executable)) {
+          throw new BackendDispatchError(
+            `Command '${executable}' is not in the peer allowlist.`,
+            'REMOTE_BACKEND_COMMAND_DENIED',
+          );
+        }
+      }
+      const args = [...tokens, ...(payload?.args ?? [])];
+      const cwd = payload?.cwd ?? config.cwd;
+      ctx.logger.info('remote local-process dispatch', { peerId: peer.peerId, executable });
+      const result = await runProcess({
+        args,
+        timeoutMs: resolveTimeout(payload),
+        ...(cwd !== undefined ? { cwd } : {}),
+        ...(payload?.env !== undefined ? { env: payload.env } : {}),
+        ...(payload?.stdin !== undefined ? { stdin: payload.stdin } : {}),
+      });
+      return {
+        exitCode: result.timedOut ? 124 : result.exitCode,
+        stdout: result.stdout,
+        stderr: result.timedOut ? `${result.stderr}\n[remote] command timed out` : result.stderr,
+      };
+    },
+  };
+}

package/src/daemon/remote/backends/process-runner.ts

@@ -0,0 +1,151 @@
+// Shared subprocess runner built on Bun.spawn. Captures stdout/stderr/exit code
+// with a hard timeout. Used by every backend that shells out (docker/ssh/cloud/
+// local-process). No credentials are ever passed as argv — callers pass key
+// material via files or the `env` overlay.
+
+export interface RunOptions {
+  args: string[];
+  cwd?: string;
+  env?: Record<string, string>;
+  stdin?: string;
+  timeoutMs: number;
+}
+
+export interface RunResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+}
+
+interface BunSubprocessLike {
+  readonly stdout: ReadableStream<Uint8Array> | null;
+  readonly stderr: ReadableStream<Uint8Array> | null;
+  readonly stdin: { write(chunk: string): void; end(): void | Promise<void> } | null;
+  readonly exited: Promise<number>;
+  kill(signal?: number | string): void;
+}
+
+interface BunSpawnOptions {
+  cwd?: string;
+  env?: Record<string, string | undefined>;
+  stdin?: 'pipe' | 'ignore';
+  stdout: 'pipe';
+  stderr: 'pipe';
+}
+
+type BunSpawn = (cmd: string[], options: BunSpawnOptions) => BunSubprocessLike;
+
+function getBunSpawn(): BunSpawn {
+  const globalBun = (globalThis as { Bun?: { spawn?: unknown } }).Bun;
+  if (!globalBun || typeof globalBun.spawn !== 'function') {
+    throw new Error('Bun.spawn is unavailable in this runtime.');
+  }
+  return globalBun.spawn as unknown as BunSpawn;
+}
+
+type StreamReader = ReadableStreamDefaultReader<Uint8Array>;
+
+async function drainReader(reader: StreamReader | null): Promise<string> {
+  if (!reader) return '';
+  const decoder = new TextDecoder();
+  let out = '';
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) out += decoder.decode(value, { stream: true });
+    }
+    out += decoder.decode();
+  } catch {
+    // Reader was cancelled (e.g. on timeout) or errored — return what we have.
+  } finally {
+    try {
+      reader.releaseLock();
+    } catch {
+      // lock already released
+    }
+  }
+  return out;
+}
+
+/**
+ * Spawn a subprocess and capture its output with a hard timeout. The first
+ * element of `args` is the executable. Throws only on spawn failure; non-zero
+ * exit codes are returned in the result.
+ */
+export async function runProcess(options: RunOptions): Promise<RunResult> {
+  if (options.args.length === 0) {
+    throw new Error('runProcess requires at least one argument (the executable).');
+  }
+  const spawn = getBunSpawn();
+  const mergedEnv: Record<string, string | undefined> = {
+    ...process.env,
+    ...(options.env ?? {}),
+  };
+
+  const child = spawn(options.args, {
+    ...(options.cwd !== undefined ? { cwd: options.cwd } : {}),
+    env: mergedEnv,
+    stdin: options.stdin !== undefined ? 'pipe' : 'ignore',
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+
+  if (options.stdin !== undefined && child.stdin) {
+    child.stdin.write(options.stdin);
+    await child.stdin.end();
+  }
+
+  // Begin draining stdout/stderr immediately, holding the readers so we can
+  // cancel them on timeout. Otherwise a killed shell whose grandchild (e.g.
+  // `sh -c 'sleep 5'`) inherited the stdout pipe keeps the stream open until
+  // that orphan exits, blocking us for the child's full lifetime.
+  const stdoutReader = child.stdout ? child.stdout.getReader() : null;
+  const stderrReader = child.stderr ? child.stderr.getReader() : null;
+  const stdoutPromise = drainReader(stdoutReader);
+  const stderrPromise = drainReader(stderrReader);
+
+  let timedOut = false;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeoutPromise = new Promise<void>((resolve) => {
+    timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        child.kill('SIGKILL');
+      } catch {
+        // process may have already exited
+      }
+      resolve();
+    }, options.timeoutMs);
+  });
+
+  // Resolve as soon as the process exits OR the timeout fires.
+  await Promise.race([child.exited, timeoutPromise]);
+  if (timer) clearTimeout(timer);
+
+  if (timedOut) {
+    // Unblock the drains in case an orphaned grandchild still holds the pipe.
+    try {
+      await stdoutReader?.cancel();
+    } catch {
+      // already closed
+    }
+    try {
+      await stderrReader?.cancel();
+    } catch {
+      // already closed
+    }
+  }
+
+  const stdout = await stdoutPromise;
+  const stderr = await stderrPromise;
+  const exitCode = await child.exited.catch(() => -1);
+
+  return {
+    exitCode: typeof exitCode === 'number' ? exitCode : -1,
+    stdout,
+    stderr,
+    timedOut,
+  };
+}

package/src/daemon/remote/backends/ssh.ts

@@ -0,0 +1,120 @@
+import { mkdir, writeFile, rm, chmod } from 'node:fs/promises';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import type { PeerRecord } from '../peer-registry.ts';
+import type { SshBackendConfig } from '../peer-registry.ts';
+import {
+  type Backend,
+  type BackendContext,
+  type BackendDispatchResult,
+  type DispatchPayload,
+  BackendDispatchError,
+  resolveTimeout,
+} from './types.ts';
+import { runProcess } from './process-runner.ts';
+import { tokenizeCommand } from './local-process.ts';
+
+/**
+ * Persistent-key material is written to {homeDirectory}/.goodvibes/tui/operator/
+ * ssh-keys/{peerId}.key with 0600 permissions and reused across invocations
+ * (connection pooling via the OpenSSH ControlMaster multiplexer). The key value
+ * itself comes only from the daemon credential store — never argv, never logs.
+ */
+interface PooledIdentity {
+  keyPath: string;
+  controlPath: string;
+  identityRef: string;
+}
+
+export function createSshBackend(ctx: BackendContext): Backend {
+  const pool = new Map<string, PooledIdentity>();
+  const keyDir = join(ctx.homeDirectory, '.goodvibes', 'tui', 'operator', 'ssh-keys');
+
+  async function ensureIdentity(
+    peer: PeerRecord,
+    config: SshBackendConfig,
+  ): Promise<PooledIdentity> {
+    const existing = pool.get(peer.peerId);
+    if (existing && existing.identityRef === config.identityRef) {
+      return existing;
+    }
+    const key = await ctx.credentials.resolveRef(config.identityRef);
+    if (!key || key.length === 0) {
+      throw new BackendDispatchError(
+        `Could not resolve SSH identity for peer '${peer.peerId}'.`,
+        'REMOTE_BACKEND_CREDENTIAL_MISSING',
+      );
+    }
+    await mkdir(keyDir, { recursive: true });
+    await chmod(keyDir, 0o700).catch(() => {});
+    const suffix = randomBytes(4).toString('hex');
+    const keyPath = join(keyDir, `${peer.peerId}.${suffix}.key`);
+    const normalizedKey = key.endsWith('\n') ? key : `${key}\n`;
+    await writeFile(keyPath, normalizedKey, { mode: 0o600 });
+    await chmod(keyPath, 0o600).catch(() => {});
+    const controlPath = join(keyDir, `${peer.peerId}.${suffix}.ctl`);
+    const identity: PooledIdentity = { keyPath, controlPath, identityRef: config.identityRef };
+    // Replace any prior identity for this peer and clean up its key file.
+    if (existing) await rm(existing.keyPath, { force: true }).catch(() => {});
+    pool.set(peer.peerId, identity);
+    return identity;
+  }
+
+  return {
+    kind: 'ssh',
+    async dispatch(
+      peer: PeerRecord,
+      command: string,
+      payload?: DispatchPayload,
+    ): Promise<BackendDispatchResult> {
+      if (peer.backendConfig.kind !== 'ssh') {
+        throw new BackendDispatchError(
+          `Peer '${peer.peerId}' is not an ssh peer.`,
+          'REMOTE_BACKEND_KIND_MISMATCH',
+        );
+      }
+      const config = peer.backendConfig as { kind: 'ssh' } & SshBackendConfig;
+      if (tokenizeCommand(command).length === 0) {
+        throw new BackendDispatchError('Empty command.', 'REMOTE_BACKEND_BAD_COMMAND');
+      }
+      const identity = await ensureIdentity(peer, config);
+      const port = config.sshPort ?? 22;
+      const target = `${config.sshUser}@${config.sshHost}`;
+      const remoteCommand = payload?.args && payload.args.length > 0
+        ? `${command} ${payload.args.join(' ')}`
+        : command;
+
+      const args = [
+        'ssh',
+        '-i', identity.keyPath,
+        '-p', String(port),
+        '-o', 'StrictHostKeyChecking=accept-new',
+        '-o', 'BatchMode=yes',
+        '-o', 'ConnectTimeout=15',
+        // Connection pooling: reuse a multiplexed master for ~60s.
+        '-o', 'ControlMaster=auto',
+        '-o', `ControlPath=${identity.controlPath}`,
+        '-o', 'ControlPersist=60',
+        target,
+        remoteCommand,
+      ];
+
+      ctx.logger.info('remote ssh dispatch', {
+        peerId: peer.peerId,
+        host: config.sshHost,
+        port,
+      });
+      const result = await runProcess({
+        args,
+        timeoutMs: resolveTimeout(payload),
+        ...(payload?.env !== undefined ? { env: payload.env } : {}),
+        ...(payload?.stdin !== undefined ? { stdin: payload.stdin } : {}),
+      });
+      return {
+        exitCode: result.timedOut ? 124 : result.exitCode,
+        stdout: result.stdout,
+        stderr: result.timedOut ? `${result.stderr}\n[remote] ssh command timed out` : result.stderr,
+      };
+    },
+  };
+}