@repo-os/repoos 0.5.45

package/dist/core/toml-validate.js

@@ -0,0 +1,335 @@
+/**
+ * Dependency-free TOML syntax validator (#0375).
+ *
+ * The Settings page's raw editor writes `repoos.toml` verbatim, so a malformed
+ * save must be rejected *before* it reaches disk — `loadConfig`'s reader is
+ * deliberately forgiving (it skips lines it can't parse), which would turn a
+ * typo into a silently-ignored config instead of an error the user can see.
+ *
+ * This is a validator, not a parser: it walks the document and reports the
+ * first structural problem it finds (unterminated string/array, missing `=`,
+ * bad table header, invalid scalar) with a 1-based line number. It accepts the
+ * TOML shapes RepoOS itself emits plus the common hand-written ones (dotted
+ * and quoted keys, literal strings, single-line arrays, dates/times,
+ * hex/octal/binary numbers). It deliberately does not enforce key uniqueness
+ * or table-redefinition rules — those are valid-TOML concerns that never
+ * affect what `loadConfig` reads, and rejecting on them would make the escape
+ * hatch stricter than the loader it feeds.
+ *
+ * Crucially, it rejects the *valid TOML* shapes that `parseFlatToml`
+ * (`config.ts`) cannot read: multi-line strings, multi-line arrays, and inline
+ * tables. Those would otherwise sail through a save and then be silently
+ * misread (the first line of a multi-line array parses as the string `"["`,
+ * an inline table as a plain string), so a whole save could take no effect
+ * with no error — the exact silent-config failure this gate exists to stop.
+ */
+class TomlSyntaxError extends Error {
+    line;
+    constructor(message, line) {
+        super(message);
+        this.line = line;
+        this.name = "TomlSyntaxError";
+    }
+}
+const BARE_KEY_CHAR = /^[A-Za-z0-9_-]$/;
+const INT_DECIMAL = /^[+-]?(0|[1-9](_?[0-9])*)$/;
+const INT_HEX = /^[+-]?0x[0-9A-Fa-f](_?[0-9A-Fa-f])*$/;
+const INT_OCTAL = /^[+-]?0o[0-7](_?[0-7])*$/;
+const INT_BINARY = /^[+-]?0b[01](_?[01])*$/;
+const FLOAT = /^[+-]?(0|[1-9](_?[0-9])*)(\.[0-9](_?[0-9])*)?([eE][+-]?[0-9](_?[0-9])*)?$/;
+const SPECIAL_FLOAT = /^[+-]?(inf|nan)$/;
+const DATETIME = /^\d{4}-\d{2}-\d{2}([Tt ]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})?)?$/;
+const LOCALTIME = /^\d{2}:\d{2}:\d{2}(\.\d+)?$/;
+function isBareValue(token) {
+    if (token === "true" || token === "false")
+        return true;
+    return (INT_DECIMAL.test(token) ||
+        INT_HEX.test(token) ||
+        INT_OCTAL.test(token) ||
+        INT_BINARY.test(token) ||
+        FLOAT.test(token) ||
+        SPECIAL_FLOAT.test(token) ||
+        DATETIME.test(token) ||
+        LOCALTIME.test(token));
+}
+class TomlScanner {
+    source;
+    i = 0;
+    line = 1;
+    constructor(source) {
+        this.source = source;
+    }
+    eof() {
+        return this.i >= this.source.length;
+    }
+    /** Current 1-based line, for callers that need to detect a value spanning lines. */
+    get lineNumber() {
+        return this.line;
+    }
+    peek(offset = 0) {
+        return this.source[this.i + offset] ?? "";
+    }
+    advance() {
+        const ch = this.source[this.i++];
+        if (ch === "\n")
+            this.line++;
+        return ch;
+    }
+    fail(message) {
+        throw new TomlSyntaxError(message, this.line);
+    }
+    /** Spaces and tabs only — never crosses a line boundary. */
+    skipInlineWhitespace() {
+        while (!this.eof()) {
+            const ch = this.peek();
+            if (ch === " " || ch === "\t")
+                this.advance();
+            else
+                break;
+        }
+    }
+    skipWhitespace() {
+        while (!this.eof()) {
+            const ch = this.peek();
+            if (ch === " " || ch === "\t" || ch === "\r" || ch === "\n")
+                this.advance();
+            else
+                break;
+        }
+    }
+    skipComment() {
+        if (this.peek() !== "#")
+            return;
+        while (!this.eof() && this.peek() !== "\n")
+            this.advance();
+    }
+    /** After a complete statement: trailing whitespace, an optional comment, then EOL/EOF. */
+    finishStatement() {
+        this.skipInlineWhitespace();
+        this.skipComment();
+        if (this.eof())
+            return;
+        if (this.peek() === "\n" || this.peek() === "\r") {
+            if (this.peek() === "\r")
+                this.advance();
+            if (this.peek() === "\n")
+                this.advance();
+            return;
+        }
+        this.fail(`unexpected character ${JSON.stringify(this.peek())} after statement`);
+    }
+}
+/** Parse a dotted key path (`a.b`, `"a b".c`); validates but discards the value. */
+function parseKey(sc) {
+    parseSimpleKey(sc);
+    sc.skipInlineWhitespace();
+    while (sc.peek() === ".") {
+        sc.advance();
+        sc.skipInlineWhitespace();
+        parseSimpleKey(sc);
+        sc.skipInlineWhitespace();
+    }
+}
+function parseSimpleKey(sc) {
+    const ch = sc.peek();
+    if (ch === '"') {
+        readBasicString(sc);
+        return;
+    }
+    if (ch === "'") {
+        readLiteralString(sc);
+        return;
+    }
+    let key = "";
+    while (!sc.eof() && BARE_KEY_CHAR.test(sc.peek()))
+        key += sc.advance();
+    if (!key)
+        sc.fail("expected a key");
+}
+function readBasicString(sc) {
+    sc.advance(); // opening quote
+    while (!sc.eof()) {
+        const ch = sc.peek();
+        if (ch === "\n" || ch === "\r")
+            sc.fail("unterminated string");
+        if (ch === '"') {
+            sc.advance();
+            return;
+        }
+        if (ch === "\\") {
+            sc.advance();
+            if (sc.eof())
+                sc.fail("unterminated string");
+            sc.advance();
+            continue;
+        }
+        sc.advance();
+    }
+    sc.fail("unterminated string");
+}
+function readLiteralString(sc) {
+    sc.advance(); // opening quote
+    while (!sc.eof()) {
+        const ch = sc.peek();
+        if (ch === "\n" || ch === "\r")
+            sc.fail("unterminated string");
+        if (ch === "'") {
+            sc.advance();
+            return;
+        }
+        sc.advance();
+    }
+    sc.fail("unterminated string");
+}
+const MULTILINE_UNSUPPORTED = "multi-line strings aren't supported — keep each value on one line";
+function readArray(sc) {
+    sc.advance(); // [
+    while (true) {
+        sc.skipWhitespace();
+        sc.skipComment();
+        sc.skipWhitespace();
+        if (sc.eof())
+            sc.fail("unterminated array");
+        if (sc.peek() === "]") {
+            sc.advance();
+            return;
+        }
+        readValue(sc);
+        sc.skipWhitespace();
+        sc.skipComment();
+        sc.skipWhitespace();
+        if (sc.peek() === ",") {
+            sc.advance();
+            continue;
+        }
+        if (sc.peek() === "]") {
+            sc.advance();
+            return;
+        }
+        sc.fail("expected ',' or ']' in array");
+    }
+}
+function readBareValue(sc) {
+    let token = "";
+    while (!sc.eof()) {
+        const ch = sc.peek();
+        if (ch === " " ||
+            ch === "\t" ||
+            ch === "\r" ||
+            ch === "\n" ||
+            ch === "," ||
+            ch === "]" ||
+            ch === "}" ||
+            ch === "#") {
+            break;
+        }
+        token += sc.advance();
+    }
+    if (!token)
+        sc.fail("expected a value");
+    if (!isBareValue(token))
+        sc.fail(`invalid value ${JSON.stringify(token)}`);
+}
+function readValue(sc) {
+    const ch = sc.peek();
+    if (ch === '"') {
+        if (sc.peek(1) === '"' && sc.peek(2) === '"')
+            sc.fail(MULTILINE_UNSUPPORTED);
+        readBasicString(sc);
+        return;
+    }
+    if (ch === "'") {
+        if (sc.peek(1) === "'" && sc.peek(2) === "'")
+            sc.fail(MULTILINE_UNSUPPORTED);
+        readLiteralString(sc);
+        return;
+    }
+    if (ch === "[") {
+        readArray(sc);
+        return;
+    }
+    if (ch === "{") {
+        sc.fail("inline tables aren't supported — use a [section] or [[array-of-tables]] block instead");
+    }
+    readBareValue(sc);
+}
+function readTableHeader(sc) {
+    sc.advance(); // [
+    let array = false;
+    if (sc.peek() === "[") {
+        sc.advance();
+        array = true;
+    }
+    sc.skipInlineWhitespace();
+    parseKey(sc);
+    sc.skipInlineWhitespace();
+    if (array) {
+        if (!(sc.peek() === "]" && sc.peek(1) === "]")) {
+            sc.fail("expected ']]' to close an array-of-tables header");
+        }
+        sc.advance();
+        sc.advance();
+    }
+    else {
+        if (sc.peek() !== "]")
+            sc.fail("expected ']' to close a table header");
+        sc.advance();
+    }
+    sc.finishStatement();
+}
+function readKeyValue(sc) {
+    parseKey(sc);
+    sc.skipInlineWhitespace();
+    if (sc.peek() !== "=")
+        sc.fail("expected '=' after key");
+    sc.advance();
+    sc.skipInlineWhitespace();
+    const startLine = sc.lineNumber;
+    readValue(sc);
+    if (sc.lineNumber !== startLine) {
+        sc.fail("multi-line values aren't supported by RepoOS's config reader — keep arrays on a single line");
+    }
+    sc.finishStatement();
+}
+/**
+ * Validate a TOML document's syntax. Returns `{ ok: true }` when the whole
+ * document is structurally well-formed, or `{ ok: false, error, line }` with
+ * the first problem found. Never throws on malformed input.
+ */
+export function validateToml(source) {
+    const sc = new TomlScanner(source);
+    try {
+        while (!sc.eof()) {
+            sc.skipWhitespace();
+            if (sc.eof())
+                break;
+            const ch = sc.peek();
+            if (ch === "#") {
+                sc.skipComment();
+                continue;
+            }
+            if (ch === "[") {
+                readTableHeader(sc);
+                continue;
+            }
+            readKeyValue(sc);
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        if (err instanceof TomlSyntaxError) {
+            return { ok: false, error: err.message, line: err.line };
+        }
+        throw err;
+    }
+}
+/**
+ * Format a validation failure for display, with the line folded into the
+ * message so callers that only carry a string (the HTTP JSON error, the store)
+ * still surface it.
+ */
+export function formatTomlError(result) {
+    if (result.ok)
+        return "";
+    return `Invalid TOML on line ${result.line}: ${result.error}`;
+}

package/dist/core/tunnel-assistant.d.ts

@@ -0,0 +1,30 @@
+export type TunnelRunMode = "foreground" | "background";
+export interface TunnelPublishInput {
+    zone: string;
+    app: string;
+    port: number | string;
+    emails: string[] | string;
+    runMode: TunnelRunMode;
+    /** Skip Cloudflare Access entirely — fully public at the edge, native auth only. */
+    noAccess?: boolean;
+}
+export interface TunnelPublishPlan {
+    zone: string;
+    app: string;
+    port: number;
+    emails: string[];
+    runMode: TunnelRunMode;
+    noAccess: boolean;
+    hostname: string;
+    publicUrl: string;
+    localOrigin: string;
+    commands: {
+        setup: string;
+        create: string;
+        run: string;
+        status: string;
+    };
+    authNote: string;
+}
+export declare function validateTunnelPublishInput(input: TunnelPublishInput): string[];
+export declare function buildTunnelPublishPlan(input: TunnelPublishInput): TunnelPublishPlan;

package/dist/core/tunnel-assistant.js

@@ -0,0 +1,65 @@
+const isValidAppName = (value) => /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(value);
+const isValidEmail = (value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+export function validateTunnelPublishInput(input) {
+    const errors = [];
+    const zone = input.zone.trim().toLowerCase().replace(/\.$/, "");
+    if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(zone)) {
+        errors.push("Enter a valid Cloudflare zone such as repoos.org.");
+    }
+    const app = input.app.trim().toLowerCase();
+    if (!isValidAppName(app))
+        errors.push("App name must use letters, numbers, hyphens, or underscores.");
+    const port = Number(input.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        errors.push("Local port must be an integer from 1 to 65535.");
+    }
+    if (!input.noAccess) {
+        const rawEmails = Array.isArray(input.emails) ? input.emails : input.emails.split(",");
+        const emails = rawEmails.map((email) => email.trim()).filter(Boolean);
+        if (!emails.length)
+            errors.push("Add at least one allowed email address (or skip Cloudflare Access).");
+        if (emails.some((email) => !isValidEmail(email)))
+            errors.push("Every allowed email must be a valid email address.");
+    }
+    if (input.runMode !== "foreground" && input.runMode !== "background") {
+        errors.push("Choose foreground or background run mode.");
+    }
+    return errors;
+}
+export function buildTunnelPublishPlan(input) {
+    const errors = validateTunnelPublishInput(input);
+    if (errors.length)
+        throw new Error(errors.join(" "));
+    const zone = input.zone.trim().toLowerCase().replace(/\.$/, "");
+    const app = input.app.trim().toLowerCase();
+    const port = Number(input.port);
+    const noAccess = !!input.noAccess;
+    const rawEmails = Array.isArray(input.emails) ? input.emails : input.emails.split(",");
+    const emails = noAccess
+        ? []
+        : [...new Set(rawEmails.map((email) => email.trim().toLowerCase()).filter(Boolean))];
+    const hostname = `${app}.${zone}`;
+    const allow = emails.join(",");
+    return {
+        zone,
+        app,
+        port,
+        emails,
+        runMode: input.runMode,
+        noAccess,
+        hostname,
+        publicUrl: `https://${hostname}`,
+        localOrigin: `http://localhost:${port}`,
+        commands: {
+            setup: "repoos tunnel setup",
+            create: noAccess
+                ? `repoos tunnel create ${app} --port ${port} --domain ${hostname} --no-access`
+                : `repoos tunnel create ${app} --port ${port} --domain ${hostname} --allow ${allow}`,
+            run: input.runMode === "background" ? "repoos tunnel install" : "repoos tunnel start",
+            status: "repoos tunnel status",
+        },
+        authNote: noAccess
+            ? "This app skips Cloudflare Access entirely — it's fully public at Cloudflare's edge. RepoOS native auth (auth.enabled = true in repoos.toml) is its ONLY gate, and `repoos tunnel create` will refuse --no-access unless it's already on."
+            : "When using a public Cloudflare Tunnel, enable RepoOS native auth (auth.enabled = true in repoos.toml) for an additional layer of access control beyond Cloudflare Access. This ensures RepoOS itself rejects unauthorized requests, even if the tunnel is publicly accessible.",
+    };
+}

package/dist/core/tunnel-registry.d.ts

@@ -0,0 +1,96 @@
+import { type TunnelApp, type TunnelConfig } from "./tunnel.js";
+/** A registry entry: a published app plus which repo checkout owns it. */
+export interface RegistryApp extends TunnelApp {
+    /** Absolute path to the repo checkout that created this app. */
+    ownerRoot: string;
+}
+/** The machine-level registry: one shared tunnel identity + every repo's apps. */
+export interface TunnelRegistry {
+    tunnelId: string;
+    tunnelName: string;
+    domain: string;
+    apps: Record<string, RegistryApp>;
+}
+export declare function emptyRegistry(): TunnelRegistry;
+/** Default location — one registry per machine, outside any repo. */
+export declare function registryPath(): string;
+export declare function parseRegistry(text: string): TunnelRegistry;
+export declare function serializeRegistry(reg: TunnelRegistry): string;
+/** Read the machine registry. Missing file reads as an empty registry. */
+export declare function readRegistry(path?: string): TunnelRegistry;
+/**
+ * Persist the machine registry (0600 — same treatment as the derived ingress
+ * config). Writes to a sibling temp file and renames it over the real path
+ * (atomic on POSIX) so a concurrent reader (another repo's `tunnel list`, or
+ * this same read done mid-write) never observes a truncated/partial file.
+ */
+export declare function writeRegistry(reg: TunnelRegistry, path?: string): void;
+/**
+ * Hold an exclusive lock on the registry while running `fn`. Two `repoos
+ * tunnel` processes on the same machine — the exact scenario this registry
+ * exists for — can otherwise race a read-modify-write and silently drop one
+ * another's change (last write wins). A sibling `<path>.lock` file created
+ * with the atomic create-if-absent (`wx`) flag serves as a simple
+ * cross-process mutex: a lock older than {@link LOCK_STALE_MS} is assumed to
+ * be left behind by a crashed process and is stolen rather than waited on
+ * forever.
+ */
+export declare function withRegistryLock<T>(path: string, fn: () => T): T;
+/**
+ * Reconcile a repo's tunnel identity against the registry's. A machine runs
+ * ONE Cloudflare Tunnel, so if the registry already has an identity and this
+ * repo's disagrees, refuse rather than silently picking one — returns an
+ * error message. When the registry has no identity yet, adopts the repo's
+ * (mutates `reg` in place). No-ops when the repo itself isn't set up yet.
+ */
+export declare function reconcileIdentity(reg: TunnelRegistry, tunnel: TunnelConfig): string | null;
+/** Add or replace a registry entry, tagging it with its owning repo. */
+export declare function upsertApp(reg: TunnelRegistry, name: string, app: TunnelApp, ownerRoot: string): void;
+/** Remove a registry entry (no-ops when absent). */
+export declare function removeApp(reg: TunnelRegistry, name: string): void;
+/** Strip `ownerRoot` back to plain `TunnelApp`s — the shape `renderCloudflaredConfig` expects. */
+export declare function unionApps(reg: TunnelRegistry): Record<string, TunnelApp>;
+/**
+ * Reconcile the registry against THIS repo's own `repoos.toml [tunnel.apps]`
+ * — still the git-tracked, hand-edited source of truth for the apps this
+ * repo publishes. Mutates `reg` in place and returns the names that were
+ * newly seeded (for the same one-time log line callers have always printed).
+ * Three cases, keyed entirely on `ownerRoot` so another repo's entries are
+ * never touched:
+ *
+ *  - in `tunnel.apps`, missing from the registry → seed it (first run after
+ *    upgrade, or a brand-new `create` on an otherwise-synced registry).
+ *  - in `tunnel.apps` AND already registered under THIS repo's `ownerRoot`,
+ *    but with different fields (hostname/port/access edited by hand in
+ *    repoos.toml rather than through `repoos tunnel`) → overwrite the
+ *    registry entry so it can't drift from the file that's supposed to be
+ *    authoritative for it.
+ *  - registered under THIS repo's `ownerRoot` but no longer in `tunnel.apps`
+ *    (deleted by hand rather than via `repoos tunnel destroy`) → drop it,
+ *    since this repo no longer declares it.
+ *
+ * An entry owned by a DIFFERENT repo is left alone in every case, even when
+ * this repo's own `tunnel.apps` happens to declare the same name (a
+ * pre-existing collision — surfaced to the user elsewhere, not silently
+ * resolved here).
+ *
+ * Deliberately per-app rather than gated on "registry is totally empty": on
+ * a machine with multiple PRE-EXISTING repos (each already publishing its
+ * own apps before this registry existed), each repo seeds its own apps into
+ * the registry the first time IT runs `create`/`install`/`start`, regardless
+ * of whether another repo got there first and seeded its own — that's
+ * exactly the scenario (celleris + dev on one tunnel) this registry exists
+ * to fix. For the common single-repo case this still behaves like a
+ * one-time full migration, since every app is missing on the first run and
+ * every run after that is a no-op unless repoos.toml itself changed.
+ */
+export declare function syncFromRepo(reg: TunnelRegistry, tunnel: TunnelConfig, root: string): string[];
+/** A registry entry annotated with whether its owning repo checkout still exists on disk. */
+export interface RegistryAppHealth {
+    name: string;
+    app: RegistryApp;
+    /** `ownerRoot` no longer exists on disk — the repo that published this app is gone. */
+    stale: boolean;
+}
+/** Every registry app, sorted by name, annotated with staleness. */
+export declare function annotateStale(reg: TunnelRegistry): RegistryAppHealth[];