@rome-os/node 0.1.0 → 0.1.2

package/dist/daemon.js

@@ -1,208 +0,0 @@
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { spawn } from "node:child_process";
-import { createServer } from "node:http";
-import { setTimeout as delay } from "node:timers/promises";
-import { actionError, isRecord } from "./actions.js";
-import { DeviceConnector } from "./connector.js";
-import { configRoot, daemonPort, daemonStatePath, readCallerCredential } from "./local.js";
-import { MAX_MESSAGE_BYTES } from "./protocol.js";
-import { readPrivateJson, writePrivateJson } from "./storage.js";
-async function readDaemonState() {
-    const value = await readPrivateJson(daemonStatePath());
-    if (!isRecord(value) ||
-        typeof value.token !== "string" ||
-        !/^romenode_[A-Za-z0-9_-]{43}$/.test(value.token) ||
-        value.port !== daemonPort() ||
-        typeof value.pid !== "number" ||
-        !Number.isSafeInteger(value.pid) ||
-        value.pid <= 0)
-        return null;
-    return { token: value.token, port: daemonPort(), pid: value.pid };
-}
-async function request(state, path, body) {
-    return fetch(`http://127.0.0.1:${state.port}${path}`, {
-        method: body === undefined ? "GET" : "POST",
-        redirect: "error",
-        signal: AbortSignal.timeout(path === "/status" ? 1000 : 85_000),
-        headers: { authorization: `Bearer ${state.token}`, "content-type": "application/json" },
-        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-    });
-}
-export async function daemonStatus() {
-    const state = await readDaemonState();
-    if (!state)
-        return null;
-    try {
-        const response = await request(state, "/status");
-        const value = await response.json();
-        return response.ok && isRecord(value) && value.pid === state.pid ? state : null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function startDaemon() {
-    const current = await daemonStatus();
-    if (current)
-        return current;
-    await readCallerCredential();
-    const child = spawn(process.execPath, [process.argv[1], "daemon", "serve"], {
-        detached: true,
-        stdio: "ignore",
-        windowsHide: true,
-        env: { ...process.env, ROME_NODE_CONFIG_DIR: configRoot() },
-    });
-    let failed = false;
-    child.on("error", () => {
-        failed = true;
-    });
-    child.unref();
-    const deadline = Date.now() + 5000;
-    while (Date.now() < deadline && !failed) {
-        const state = await daemonStatus();
-        if (state)
-            return state;
-        await delay(50);
-    }
-    throw new Error("Could not start the CLI daemon. Run rome-node daemon serve to inspect the error. If its port is occupied, set ROME_NODE_DAEMON_PORT.");
-}
-export async function stopDaemon() {
-    const state = await daemonStatus();
-    if (!state)
-        return;
-    const response = await request(state, "/stop", {});
-    if (!response.ok)
-        throw new Error("Could not stop the CLI daemon.");
-    const deadline = Date.now() + 5000;
-    while (Date.now() < deadline) {
-        try {
-            const status = await request(state, "/status");
-            if (status.status === 401)
-                return;
-        }
-        catch {
-            return;
-        }
-        await delay(50);
-    }
-    throw new Error("The CLI daemon has not stopped yet.");
-}
-export async function callDaemon(path, body) {
-    const state = await startDaemon();
-    try {
-        return await request(state, path, body);
-    }
-    catch {
-        throw new Error("CLI daemon connection failed. Execution outcome may be unknown; do not automatically retry.");
-    }
-}
-function json(response, status, value) {
-    response.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
-    response.end(JSON.stringify(value));
-}
-async function readBody(request) {
-    let size = 0;
-    const chunks = [];
-    for await (const chunk of request) {
-        const buffer = Buffer.from(chunk);
-        size += buffer.length;
-        if (size > MAX_MESSAGE_BYTES)
-            throw new Error("message_too_large");
-        chunks.push(buffer);
-    }
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-}
-export async function serveDaemon() {
-    const credential = await readCallerCredential();
-    const connector = new DeviceConnector({ credential });
-    const state = {
-        port: daemonPort(),
-        pid: process.pid,
-        token: `romenode_${randomBytes(32).toString("base64url")}`,
-    };
-    let closing = false;
-    const server = createServer((req, res) => {
-        void handle(req, res).catch(() => {
-            if (!res.headersSent)
-                json(res, 503, actionError("gateway_unavailable", "The device service is unavailable."));
-            else
-                res.destroy();
-        });
-    });
-    server.requestTimeout = 10_000;
-    server.headersTimeout = 10_000;
-    const close = () => {
-        if (closing)
-            return;
-        closing = true;
-        connector.stop();
-        server.close();
-        server.closeIdleConnections();
-        const timer = setTimeout(() => server.closeAllConnections(), 1000);
-        timer.unref();
-    };
-    async function handle(req, res) {
-        const actual = Buffer.from(req.headers.authorization ?? "");
-        const expected = Buffer.from(`Bearer ${state.token}`);
-        if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
-            json(res, 401, actionError("unauthorized", "A CLI daemon credential is required."));
-            return;
-        }
-        if (closing) {
-            json(res, 503, actionError("daemon_stopped", "The CLI daemon is stopping."));
-        }
-        else if (req.method === "GET" && req.url === "/status") {
-            json(res, 200, { pid: state.pid });
-        }
-        else if (req.method === "POST" && req.url === "/stop") {
-            json(res, 200, { stopped: true });
-            close();
-        }
-        else if (req.method === "GET" && req.url === "/devices") {
-            json(res, 200, await connector.list());
-        }
-        else if (req.method === "POST" && req.url === "/run") {
-            if (Number(req.headers["content-length"]) > MAX_MESSAGE_BYTES) {
-                json(res, 413, actionError("message_too_large", "The request exceeds 128 KiB."));
-                req.resume();
-                return;
-            }
-            let body;
-            try {
-                body = await readBody(req);
-            }
-            catch (error) {
-                const tooLarge = error instanceof Error && error.message === "message_too_large";
-                json(res, tooLarge ? 413 : 400, actionError(tooLarge ? "message_too_large" : "invalid_request", "Invalid device request."));
-                return;
-            }
-            if (!isRecord(body) || typeof body.deviceId !== "string" || typeof body.action !== "string") {
-                json(res, 400, actionError("invalid_request", "A device ID and action are required."));
-                return;
-            }
-            json(res, 200, await connector.run(body.deviceId, body.action, body.args ?? {}));
-        }
-        else {
-            json(res, 404, actionError("not_found", "Unknown CLI daemon operation."));
-        }
-    }
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(state.port, "127.0.0.1", () => {
-            server.removeListener("error", reject);
-            resolve();
-        });
-    });
-    const finished = new Promise((resolve) => server.once("close", resolve));
-    process.once("SIGINT", close);
-    process.once("SIGTERM", close);
-    try {
-        await writePrivateJson(daemonStatePath(), state);
-        await finished;
-    }
-    finally {
-        close();
-        process.removeListener("SIGINT", close);
-        process.removeListener("SIGTERM", close);
-    }
-}

package/dist/executor.d.ts

@@ -1,5 +0,0 @@
-import { type InboundEnvelope, type OutboundEnvelope } from "./protocol.js";
-export declare function createExecutor(name: string, send: (message: OutboundEnvelope) => boolean, secrets?: string[]): {
-    receive(message: InboundEnvelope): Promise<void>;
-    disconnect(): void;
-};

package/dist/executor.js

@@ -1,121 +0,0 @@
-import { spawn } from "node:child_process";
-import { platform } from "node:os";
-import { actionError, isRecord } from "./actions.js";
-import { byteLength, MAX_MESSAGE_BYTES, } from "./protocol.js";
-export function createExecutor(name, send, secrets = []) {
-    const children = new Set();
-    let generation = 0;
-    const handlers = {
-        "system.info": async () => ({
-            type: "response",
-            ok: true,
-            result: {
-                name,
-                platform: platform() === "darwin" ? "macos" : platform() === "win32" ? "windows" : platform(),
-                actions: ["system.info", "exec"],
-            },
-        }),
-        exec: async (input) => {
-            if (!isRecord(input) ||
-                typeof input.command !== "string" ||
-                !input.command ||
-                input.command.includes("\0") ||
-                (input.args !== undefined &&
-                    (!Array.isArray(input.args) ||
-                        !input.args.every((arg) => typeof arg === "string" && !arg.includes("\0")))) ||
-                (input.cwd !== undefined && (typeof input.cwd !== "string" || input.cwd.includes("\0"))))
-                return actionError("invalid_args", "exec requires command, optional string args[], and optional cwd.");
-            if (children.size >= 8)
-                return actionError("busy", "The computer is already running eight programs.");
-            const command = input.command;
-            const args = (input.args ?? []);
-            const cwd = input.cwd;
-            return new Promise((resolve) => {
-                const environment = Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^(?:ROME_.*(?:TOKEN|SECRET|CREDENTIAL)|NODE_OPTIONS)$/i.test(key)));
-                let child;
-                try {
-                    child = spawn(command, args, {
-                        cwd,
-                        env: environment,
-                        shell: false,
-                        windowsHide: true,
-                        stdio: ["ignore", "pipe", "pipe"],
-                    });
-                }
-                catch {
-                    resolve(actionError("exec_failed", "Could not start the program."));
-                    return;
-                }
-                children.add(child);
-                const output = { stdout: Buffer.alloc(0), stderr: Buffer.alloc(0) };
-                const truncated = { stdout: false, stderr: false };
-                for (const stream of ["stdout", "stderr"]) {
-                    child[stream]?.on("data", (chunk) => {
-                        const remaining = 48 * 1024 - output[stream].length;
-                        if (chunk.length > remaining)
-                            truncated[stream] = true;
-                        output[stream] = Buffer.concat([output[stream], chunk.subarray(0, remaining)]);
-                    });
-                }
-                child.once("error", () => {
-                    children.delete(child);
-                    resolve(actionError("exec_failed", "Could not start the program. Check the executable and working directory."));
-                });
-                child.once("close", (exitCode, signal) => {
-                    children.delete(child);
-                    const redact = (value) => secrets.reduce((text, secret) => text.replaceAll(secret, "[redacted]"), value.toString("utf8"));
-                    resolve({
-                        type: "response",
-                        ok: true,
-                        result: {
-                            exitCode,
-                            signal,
-                            stdout: redact(output.stdout),
-                            stderr: redact(output.stderr),
-                            truncated,
-                        },
-                    });
-                });
-            });
-        },
-    };
-    return {
-        async receive(message) {
-            const request = message.payload;
-            if (!isRecord(request) || request.type !== "request" || typeof request.action !== "string")
-                return;
-            const current = generation;
-            const handler = Object.hasOwn(handlers, request.action)
-                ? handlers[request.action]
-                : undefined;
-            const payload = handler
-                ? await handler(request.args).catch(() => actionError("exec_failed", "The action failed."))
-                : actionError("unsupported_action", "The computer does not support this action.");
-            const reply = { id: message.id, to: message.from, payload };
-            if (payload.ok && isRecord(payload.result) && isRecord(payload.result.truncated)) {
-                const result = payload.result;
-                while (byteLength(JSON.stringify(reply)) > MAX_MESSAGE_BYTES) {
-                    for (const stream of ["stdout", "stderr"]) {
-                        if (typeof result[stream] === "string" && result[stream].length > 0) {
-                            result[stream] = result[stream].slice(0, Math.floor(result[stream].length * 0.75));
-                            result.truncated[stream] = true;
-                        }
-                    }
-                }
-            }
-            if (current === generation)
-                send(reply);
-        },
-        disconnect() {
-            generation++;
-            for (const child of children) {
-                child.kill("SIGTERM");
-                const timer = setTimeout(() => {
-                    if (child.exitCode === null && child.signalCode === null)
-                        child.kill("SIGKILL");
-                }, 1000);
-                timer.unref();
-            }
-        },
-    };
-}

package/dist/local.d.ts

@@ -1,9 +0,0 @@
-export declare function configRoot(): string;
-export declare const callerCredentialPath: () => string;
-export declare const daemonStatePath: () => string;
-export declare function daemonPort(): number;
-export interface CallerCredential {
-    cloudUrl: string;
-    token: string;
-}
-export declare function readCallerCredential(): Promise<CallerCredential>;

package/dist/local.js

@@ -1,33 +0,0 @@
-import { createHash } from "node:crypto";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-import { isRecord } from "./actions.js";
-import { cloudOrigin } from "./cloud.js";
-import { readPrivateJson } from "./storage.js";
-export function configRoot() {
-    return resolve(process.env.ROME_NODE_CONFIG_DIR ||
-        (process.platform === "win32"
-            ? join(process.env.LOCALAPPDATA || homedir(), "RomeNode")
-            : join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "rome-node")));
-}
-export const callerCredentialPath = () => join(configRoot(), "caller.json");
-export const daemonStatePath = () => join(configRoot(), "daemon.json");
-export function daemonPort() {
-    const override = process.env.ROME_NODE_DAEMON_PORT;
-    if (override !== undefined) {
-        const port = Number(override);
-        if (!Number.isInteger(port) || port < 1024 || port > 65535)
-            throw new Error("ROME_NODE_DAEMON_PORT must be a port between 1024 and 65535.");
-        return port;
-    }
-    return 20000 + (createHash("sha256").update(configRoot()).digest().readUInt32BE(0) % 40000);
-}
-export async function readCallerCredential() {
-    const value = await readPrivateJson(callerCredentialPath());
-    if (!isRecord(value) ||
-        typeof value.cloudUrl !== "string" ||
-        typeof value.token !== "string" ||
-        !/^romedev_[A-Za-z0-9_-]{43}$/.test(value.token))
-        throw new Error("Configure a communication token with rome-node auth --cloud <origin> using stdin first.");
-    return { cloudUrl: cloudOrigin(value.cloudUrl), token: value.token };
-}

package/dist/login.d.ts

@@ -1,6 +0,0 @@
-export interface DeviceSession {
-    cloudUrl: string;
-    token: string;
-    deviceId: string;
-}
-export declare function loginDevice(cloudUrl: string, name: string, signal: AbortSignal): Promise<DeviceSession>;

package/dist/login.js

@@ -1,100 +0,0 @@
-import { createServer } from "node:http";
-import { createHash, randomBytes } from "node:crypto";
-import { platform } from "node:os";
-import { cloudOrigin } from "./cloud.js";
-import { validId } from "./protocol.js";
-export async function loginDevice(cloudUrl, name, signal) {
-    const cloud = new URL(cloudOrigin(cloudUrl));
-    const verifier = randomBytes(32).toString("base64url");
-    const state = randomBytes(32).toString("base64url");
-    return new Promise((resolve, reject) => {
-        if (signal.aborted) {
-            reject(new Error("Authorization canceled."));
-            return;
-        }
-        let redeeming = false;
-        const server = createServer(async (request, response) => {
-            const incoming = new URL(request.url ?? "/", "http://127.0.0.1");
-            if (request.method !== "GET" ||
-                incoming.pathname !== "/callback" ||
-                incoming.searchParams.get("state") !== state ||
-                incoming.searchParams.get("iss") !== cloud.origin ||
-                !incoming.searchParams.get("code") ||
-                redeeming) {
-                response.writeHead(400).end("Invalid authorization callback");
-                return;
-            }
-            redeeming = true;
-            try {
-                const result = await fetch(`${cloud.origin}/oauth2/token`, {
-                    method: "POST",
-                    signal: AbortSignal.any([signal, AbortSignal.timeout(5000)]),
-                    redirect: "error",
-                    body: new URLSearchParams({
-                        grant_type: "authorization_code",
-                        client_id: "rome-computer",
-                        redirect_uri: redirectUri,
-                        code: incoming.searchParams.get("code"),
-                        code_verifier: verifier,
-                        platform: platform() === "darwin" ? "macos" : platform() === "win32" ? "windows" : "linux",
-                    }),
-                });
-                if (!result.ok)
-                    throw new Error("Token exchange rejected");
-                const body = (await result.json());
-                if (typeof body.access_token !== "string" ||
-                    !/^romedev_[A-Za-z0-9_-]{43}$/.test(body.access_token) ||
-                    !validId(body.device_id))
-                    throw new Error("Invalid token response");
-                response
-                    .writeHead(200, { "content-type": "text/plain", "cache-control": "no-store" })
-                    .end("Device authorized. Return to Rome Node.");
-                resolve({ cloudUrl: cloud.origin, token: body.access_token, deviceId: body.device_id });
-            }
-            catch {
-                response.writeHead(400).end("Device authorization failed. Run rome-node connect to retry.");
-                reject(new Error("Device authorization failed"));
-            }
-            finally {
-                clearTimeout(timer);
-                signal.removeEventListener("abort", abort);
-                server.close();
-            }
-        });
-        let redirectUri;
-        const abort = () => {
-            clearTimeout(timer);
-            server.closeAllConnections();
-            server.close();
-            reject(new Error("Authorization canceled."));
-        };
-        const timer = setTimeout(() => {
-            server.close();
-            signal.removeEventListener("abort", abort);
-            reject(new Error("Login timed out"));
-        }, 5 * 60_000);
-        signal.addEventListener("abort", abort, { once: true });
-        server.on("error", () => {
-            clearTimeout(timer);
-            signal.removeEventListener("abort", abort);
-            reject(new Error("Loopback listener failed"));
-        });
-        server.listen(0, "127.0.0.1", () => {
-            const address = server.address();
-            if (!address || typeof address === "string")
-                return;
-            redirectUri = `http://127.0.0.1:${address.port}/callback`;
-            const url = new URL("/oauth2/authorize", cloud);
-            url.search = new URLSearchParams({
-                response_type: "code",
-                client_id: "rome-computer",
-                redirect_uri: redirectUri,
-                code_challenge: createHash("sha256").update(verifier).digest("base64url"),
-                code_challenge_method: "S256",
-                state,
-                display_name: name,
-            }).toString();
-            process.stderr.write(`Open this URL in your browser to authorize ${name}:\n${url}\n`);
-        });
-    });
-}

package/dist/protocol.d.ts

@@ -1,30 +0,0 @@
-export declare const MAX_MESSAGE_BYTES: number;
-export declare const MAX_CLIENT_BUFFER_BYTES: number;
-export declare const CLOSE: {
-    readonly revoked: 4001;
-    readonly superseded: 4002;
-    readonly outputLimit: 4003;
-    readonly invalid: 1008;
-    readonly tooLarge: 1009;
-};
-export interface OutboundEnvelope {
-    id: string;
-    to: string;
-    payload: unknown;
-}
-export interface InboundEnvelope {
-    id: string;
-    from: string;
-    payload: unknown;
-}
-interface RouteError {
-    id: string;
-    type: "error";
-    code: "target_unavailable" | "invalid_message" | "message_too_large";
-}
-export type GatewayMessage = InboundEnvelope | RouteError;
-export declare function validId(value: unknown): value is string;
-export declare function outboundEnvelope(value: unknown): OutboundEnvelope | null;
-export declare function gatewayMessage(value: unknown): GatewayMessage | null;
-export declare function byteLength(value: string): number;
-export {};

package/dist/protocol.js

@@ -1,40 +0,0 @@
-export const MAX_MESSAGE_BYTES = 128 * 1024;
-export const MAX_CLIENT_BUFFER_BYTES = 1024 * 1024;
-export const CLOSE = {
-    revoked: 4001,
-    superseded: 4002,
-    outputLimit: 4003,
-    invalid: 1008,
-    tooLarge: 1009,
-};
-export function validId(value) {
-    return (typeof value === "string" &&
-        value.length > 0 &&
-        value.length <= 128 &&
-        !/[\u0000-\u0020\u007f]/.test(value));
-}
-export function outboundEnvelope(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return null;
-    const item = value;
-    if (!validId(item.id) || !validId(item.to) || !Object.hasOwn(item, "payload"))
-        return null;
-    return { id: item.id, to: item.to, payload: item.payload };
-}
-export function gatewayMessage(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return null;
-    const item = value;
-    if (!validId(item.id))
-        return null;
-    if (item.type === "error" &&
-        ["target_unavailable", "invalid_message", "message_too_large"].includes(String(item.code))) {
-        return item;
-    }
-    if (validId(item.from) && Object.hasOwn(item, "payload"))
-        return { id: item.id, from: item.from, payload: item.payload };
-    return null;
-}
-export function byteLength(value) {
-    return new TextEncoder().encode(value).byteLength;
-}

package/dist/socket.d.ts

@@ -1,2 +0,0 @@
-import type { ClientSocket } from "./client.js";
-export declare function createNodeSocket(url: string, authorization: string): ClientSocket;

package/dist/socket.js

@@ -1,27 +0,0 @@
-import WebSocket from "ws";
-import { MAX_MESSAGE_BYTES } from "./protocol.js";
-export function createNodeSocket(url, authorization) {
-    const socket = new WebSocket(url, {
-        headers: { Authorization: authorization },
-        handshakeTimeout: 10_000,
-        maxPayload: MAX_MESSAGE_BYTES,
-        followRedirects: false,
-    });
-    let alive = true;
-    const heartbeat = setInterval(() => {
-        if (socket.readyState !== WebSocket.OPEN)
-            return;
-        if (!alive) {
-            socket.terminate();
-            return;
-        }
-        alive = false;
-        socket.ping();
-    }, 30_000);
-    heartbeat.unref();
-    socket.on("pong", () => {
-        alive = true;
-    });
-    socket.on("close", () => clearInterval(heartbeat));
-    return socket;
-}

package/dist/storage.d.ts

@@ -1,2 +0,0 @@
-export declare function readPrivateJson(path: string): Promise<unknown>;
-export declare function writePrivateJson(path: string, value: unknown): Promise<void>;

package/dist/storage.js

@@ -1,37 +0,0 @@
-import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { randomUUID } from "node:crypto";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-export async function readPrivateJson(path) {
-    try {
-        return JSON.parse(await readFile(path, "utf8"));
-    }
-    catch (error) {
-        if (error instanceof SyntaxError || error.code === "ENOENT")
-            return null;
-        throw new Error("Could not read the local credential file.");
-    }
-}
-export async function writePrivateJson(path, value) {
-    const dir = dirname(path);
-    await mkdir(dir, { recursive: true, mode: 0o700 });
-    if (process.platform === "win32") {
-        const run = promisify(execFile);
-        const { stdout } = await run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
-        const sid = stdout.match(/S-1-\d+(?:-\d+)+/)?.[0];
-        if (!sid)
-            throw new Error("Could not determine the Windows account identity.");
-        await run("icacls.exe", [dir, "/inheritance:r", "/grant:r", `*${sid}:(OI)(CI)F`]);
-    }
-    else
-        await chmod(dir, 0o700);
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    try {
-        await writeFile(temporary, JSON.stringify(value), { mode: 0o600, flag: "wx" });
-        await rename(temporary, path);
-    }
-    finally {
-        await rm(temporary, { force: true });
-    }
-}