@runneth/cli 0.0.0-sha.19a36f654ef6.production

package/dist/ssh-stdio.js

@@ -0,0 +1,608 @@
+import { spawn, } from "node:child_process";
+import { rm } from "node:fs/promises";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+const ALLOWED_PROCESS_SIGNALS = [
+    "SIGHUP",
+    "SIGINT",
+    "SIGKILL",
+    "SIGTERM",
+];
+const DEFAULT_EXEC_TIMEOUT_MS = 600_000;
+const DEFAULT_MASTER_READY_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_FRAME_BYTES = 1_048_576;
+const DEFAULT_MAX_PROCESSES = 16;
+const PROCESS_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/u;
+const nowIso = () => {
+    return new Date().toISOString();
+};
+const isRecord = (value) => {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+};
+const errorMessage = (error) => {
+    return error instanceof Error ? error.message : String(error);
+};
+const parseString = (record, key) => {
+    const value = record[key];
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`${key} must be a non-empty string`);
+    }
+    return value;
+};
+const parseProcessId = (value) => {
+    if (!PROCESS_ID_PATTERN.test(value)) {
+        throw new Error(`Invalid process id: ${value}. Use letters, numbers, dot, underscore, dash, and colon only.`);
+    }
+    return value;
+};
+const parsePositiveInteger = (record, key) => {
+    const value = record[key];
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Number.isInteger(value) || typeof value !== "number" || value <= 0) {
+        throw new Error(`${key} must be a positive integer`);
+    }
+    return value;
+};
+const parseParams = (record) => {
+    const params = record.params;
+    if (!isRecord(params)) {
+        throw new Error("params must be a JSON object");
+    }
+    return params;
+};
+const parseProcessSignal = (record) => {
+    const value = parseString(record, "signal");
+    if (!ALLOWED_PROCESS_SIGNALS.includes(value)) {
+        throw new Error(`Unsupported signal: ${value}`);
+    }
+    return value;
+};
+export const parseRunnethSshStdioRequest = (value) => {
+    if (!isRecord(value)) {
+        throw new Error("Request must be a JSON object");
+    }
+    const id = parseProcessId(parseString(value, "id"));
+    const method = parseString(value, "method");
+    switch (method) {
+        case "exec": {
+            const params = parseParams(value);
+            const timeoutMs = parsePositiveInteger(params, "timeoutMs");
+            return {
+                id,
+                method,
+                params: {
+                    command: parseString(params, "command"),
+                    ...(timeoutMs === undefined ? {} : { timeoutMs }),
+                },
+            };
+        }
+        case "spawn": {
+            const params = parseParams(value);
+            return {
+                id,
+                method,
+                params: {
+                    command: parseString(params, "command"),
+                },
+            };
+        }
+        case "stdin": {
+            const params = parseParams(value);
+            const data = params.data;
+            if (typeof data !== "string") {
+                throw new Error("data must be a string");
+            }
+            return {
+                id,
+                method,
+                params: {
+                    data,
+                },
+            };
+        }
+        case "signal": {
+            const params = parseParams(value);
+            return {
+                id,
+                method,
+                params: {
+                    signal: parseProcessSignal(params),
+                },
+            };
+        }
+        case "close":
+        case "list":
+        case "ping": {
+            return {
+                id,
+                method,
+            };
+        }
+        default: {
+            throw new Error(`Unknown SSH stdio method: ${method}`);
+        }
+    }
+};
+const writeChunk = async (stream, chunk) => {
+    if (stream.write(chunk)) {
+        return;
+    }
+    await new Promise((resolve) => {
+        stream.once("drain", () => {
+            resolve();
+        });
+    });
+};
+class JsonLineWriter {
+    #stream;
+    #queue = Promise.resolve();
+    constructor(stream) {
+        this.#stream = stream;
+    }
+    async flush() {
+        await this.#queue;
+    }
+    write(payload) {
+        const line = `${JSON.stringify(payload)}\n`;
+        const next = this.#queue.then(async () => {
+            await writeChunk(this.#stream, line);
+        });
+        this.#queue = next.then(() => undefined, () => undefined);
+        return next;
+    }
+}
+const waitForChildExit = async (child) => {
+    return await new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", (code, signal) => {
+            resolve({ code, signal });
+        });
+    });
+};
+const runProcessExitCode = async (input) => {
+    return await new Promise((resolve, reject) => {
+        const child = spawn(input.sshCommand, [...input.args], {
+            env: input.env,
+            stdio: ["ignore", "ignore", "ignore"],
+        });
+        child.once("error", reject);
+        child.once("close", (code, signal) => {
+            if (signal !== null) {
+                resolve(1);
+                return;
+            }
+            resolve(code ?? 1);
+        });
+    });
+};
+class RunnethSshControlMaster {
+    #controlPath;
+    #env;
+    #masterReadyTimeoutMs;
+    #setup;
+    #sshCommand;
+    #master = null;
+    #masterClosed = false;
+    #masterExit = null;
+    #masterStderr = "";
+    constructor(options) {
+        this.#controlPath = options.controlPath;
+        this.#env = options.env;
+        this.#masterReadyTimeoutMs = options.masterReadyTimeoutMs;
+        this.#setup = options.setup;
+        this.#sshCommand = options.sshCommand;
+    }
+    async start() {
+        await rm(this.#controlPath, { force: true });
+        const master = spawn(this.#sshCommand, [
+            "-F",
+            this.#setup.configPath,
+            "-S",
+            this.#controlPath,
+            "-o",
+            "ControlMaster=yes",
+            "-o",
+            "ControlPersist=no",
+            "-N",
+            this.#setup.hostAlias,
+        ], {
+            env: this.#env,
+            stdio: ["ignore", "ignore", "pipe"],
+        });
+        this.#master = master;
+        master.stderr?.on("data", (chunk) => {
+            this.#masterStderr += String(chunk);
+        });
+        this.#masterExit = waitForChildExit(master).then((exit) => {
+            this.#masterClosed = true;
+            return exit;
+        });
+        const deadline = Date.now() + this.#masterReadyTimeoutMs;
+        while (Date.now() < deadline) {
+            if (this.#masterClosed) {
+                throw new Error(this.#formatMasterExitError());
+            }
+            if ((await this.check()) === 0) {
+                return;
+            }
+            await delay(50);
+        }
+        throw new Error(this.#formatMasterExitError("Timed out opening SSH master"));
+    }
+    async check() {
+        return await runProcessExitCode({
+            args: [
+                "-F",
+                this.#setup.configPath,
+                "-S",
+                this.#controlPath,
+                "-O",
+                "check",
+                this.#setup.hostAlias,
+            ],
+            env: this.#env,
+            sshCommand: this.#sshCommand,
+        });
+    }
+    async requireReady() {
+        if (this.#masterClosed || (await this.check()) !== 0) {
+            throw new Error(this.#formatMasterExitError("SSH master is not running"));
+        }
+    }
+    spawnRemoteCommand(command) {
+        return spawn(this.#sshCommand, [
+            "-F",
+            this.#setup.configPath,
+            "-S",
+            this.#controlPath,
+            "-o",
+            "ControlMaster=no",
+            this.#setup.hostAlias,
+            command,
+        ], {
+            env: this.#env,
+            stdio: "pipe",
+        });
+    }
+    async stop() {
+        const master = this.#master;
+        if (master === null || this.#masterExit === null || this.#masterClosed) {
+            await rm(this.#controlPath, { force: true });
+            return;
+        }
+        master.kill("SIGTERM");
+        const timeout = delay(5_000).then(() => {
+            if (!this.#masterClosed) {
+                master.kill("SIGKILL");
+            }
+        });
+        await Promise.race([this.#masterExit, timeout]);
+        await this.#masterExit;
+        await rm(this.#controlPath, { force: true });
+    }
+    #formatMasterExitError(prefix = "SSH master exited before it was ready") {
+        const stderr = this.#masterStderr.trim();
+        if (stderr.length === 0) {
+            return prefix;
+        }
+        return `${prefix}: ${stderr}`;
+    }
+}
+class RunnethSshStdioController {
+    #defaultTimeoutMs;
+    #master;
+    #maxFrameBytes;
+    #maxProcesses;
+    #processes = new Map();
+    #setup;
+    #stdin;
+    #stderr;
+    #writer;
+    #stopping = false;
+    constructor(options) {
+        const setup = options.setup;
+        const env = options.env ?? process.env;
+        const controlPath = path.join(path.dirname(setup.configPath), "control.sock");
+        this.#defaultTimeoutMs =
+            options.defaultTimeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
+        this.#maxFrameBytes = options.maxFrameBytes ?? DEFAULT_MAX_FRAME_BYTES;
+        this.#maxProcesses = options.maxProcesses ?? DEFAULT_MAX_PROCESSES;
+        this.#setup = setup;
+        this.#stdin = options.streams?.stdin ?? process.stdin;
+        this.#stderr = options.streams?.stderr ?? process.stderr;
+        this.#writer = new JsonLineWriter(options.streams?.stdout ?? process.stdout);
+        this.#master = new RunnethSshControlMaster({
+            controlPath,
+            env,
+            masterReadyTimeoutMs: options.masterReadyTimeoutMs ?? DEFAULT_MASTER_READY_TIMEOUT_MS,
+            setup,
+            sshCommand: options.sshCommand ?? "ssh",
+        });
+    }
+    async start() {
+        await this.#master.start();
+        await writeChunk(this.#stderr, `SSH stdio master ${this.#setup.hostAlias} ready\n`);
+        await this.#writer.write({
+            hostAlias: this.#setup.hostAlias,
+            ok: true,
+            protocol: "runneth-ssh-stdio",
+            type: "ready",
+            version: 1,
+            ...(this.#setup.targetName === undefined
+                ? {}
+                : { targetName: this.#setup.targetName }),
+        });
+    }
+    async run() {
+        let buffer = "";
+        for await (const chunk of this.#stdin) {
+            buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+            let newlineIndex = buffer.indexOf("\n");
+            while (newlineIndex !== -1) {
+                const rawLine = buffer.slice(0, newlineIndex);
+                buffer = buffer.slice(newlineIndex + 1);
+                if (Buffer.byteLength(rawLine, "utf8") > this.#maxFrameBytes) {
+                    await this.#writer.write({
+                        message: `SSH stdio frame exceeds ${String(this.#maxFrameBytes)} bytes`,
+                        ok: false,
+                        type: "error",
+                    });
+                    return;
+                }
+                if (rawLine.trim().length > 0) {
+                    await this.#handleLine(rawLine);
+                }
+                newlineIndex = buffer.indexOf("\n");
+            }
+            if (Buffer.byteLength(buffer, "utf8") > this.#maxFrameBytes) {
+                await this.#writer.write({
+                    message: `SSH stdio frame exceeds ${String(this.#maxFrameBytes)} bytes`,
+                    ok: false,
+                    type: "error",
+                });
+                return;
+            }
+        }
+    }
+    async stop() {
+        this.#stopping = true;
+        for (const processInfo of this.#processes.values()) {
+            processInfo.child.kill("SIGTERM");
+        }
+        await this.#master.stop();
+        await this.#writer.flush();
+    }
+    async #handleLine(rawLine) {
+        let request;
+        try {
+            request = parseRunnethSshStdioRequest(JSON.parse(rawLine));
+        }
+        catch (error) {
+            await this.#writer.write({
+                message: errorMessage(error),
+                ok: false,
+                type: "error",
+            });
+            return;
+        }
+        try {
+            switch (request.method) {
+                case "exec": {
+                    void this.#exec(request).catch((error) => {
+                        void this.#writeRequestError(request.id, error);
+                    });
+                    return;
+                }
+                case "spawn": {
+                    await this.#spawn(request);
+                    return;
+                }
+                case "stdin": {
+                    await this.#writeProcessStdin(request);
+                    return;
+                }
+                case "signal": {
+                    await this.#signalProcess(request);
+                    return;
+                }
+                case "close": {
+                    await this.#closeProcess(request.id);
+                    return;
+                }
+                case "list": {
+                    await this.#writer.write({
+                        id: request.id,
+                        ok: true,
+                        processes: [...this.#processes.values()].map((processInfo) => {
+                            return {
+                                command: processInfo.command,
+                                processId: processInfo.processId,
+                                startedAt: processInfo.startedAt,
+                            };
+                        }),
+                        type: "list",
+                    });
+                    return;
+                }
+                case "ping": {
+                    await this.#writer.write({
+                        id: request.id,
+                        ok: true,
+                        type: "pong",
+                    });
+                    return;
+                }
+                default: {
+                    const exhaustiveCheck = request;
+                    return exhaustiveCheck;
+                }
+            }
+        }
+        catch (error) {
+            await this.#writeRequestError(request.id, error);
+        }
+    }
+    async #exec(request) {
+        await this.#master.requireReady();
+        const child = this.#master.spawnRemoteCommand(request.params.command);
+        const timeoutMs = request.params.timeoutMs ?? this.#defaultTimeoutMs;
+        let timedOut = false;
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            void this.#writer.write({
+                id: request.id,
+                message: `Command timed out after ${String(timeoutMs)}ms`,
+                ok: false,
+                type: "error",
+            });
+            child.kill("SIGTERM");
+        }, timeoutMs);
+        child.stdout.on("data", (chunk) => {
+            void this.#writer.write({
+                data: String(chunk),
+                id: request.id,
+                type: "stdout",
+            });
+        });
+        child.stderr.on("data", (chunk) => {
+            void this.#writer.write({
+                data: String(chunk),
+                id: request.id,
+                type: "stderr",
+            });
+        });
+        child.once("error", (error) => {
+            clearTimeout(timeout);
+            void this.#writeRequestError(request.id, error);
+        });
+        child.once("close", (code, signal) => {
+            clearTimeout(timeout);
+            void this.#writer.write({
+                code,
+                id: request.id,
+                ok: !timedOut,
+                signal,
+                type: "exit",
+            });
+        });
+    }
+    async #spawn(request) {
+        if (this.#processes.has(request.id)) {
+            throw new Error(`Process is already running: ${request.id}`);
+        }
+        if (this.#processes.size >= this.#maxProcesses) {
+            throw new Error(`SSH stdio process limit reached: ${String(this.#maxProcesses)}`);
+        }
+        await this.#master.requireReady();
+        const child = this.#master.spawnRemoteCommand(request.params.command);
+        const processInfo = {
+            child,
+            command: request.params.command,
+            processId: request.id,
+            startedAt: nowIso(),
+        };
+        this.#processes.set(request.id, processInfo);
+        child.once("spawn", () => {
+            void this.#writer.write({
+                command: request.params.command,
+                id: request.id,
+                ok: true,
+                processId: request.id,
+                type: "started",
+            });
+        });
+        child.stdout.on("data", (chunk) => {
+            void this.#writer.write({
+                data: String(chunk),
+                id: request.id,
+                processId: request.id,
+                type: "stdout",
+            });
+        });
+        child.stderr.on("data", (chunk) => {
+            void this.#writer.write({
+                data: String(chunk),
+                id: request.id,
+                processId: request.id,
+                type: "stderr",
+            });
+        });
+        child.once("error", (error) => {
+            this.#processes.delete(request.id);
+            void this.#writeRequestError(request.id, error);
+        });
+        child.once("close", (code, signal) => {
+            this.#processes.delete(request.id);
+            if (this.#stopping) {
+                return;
+            }
+            void this.#writer.write({
+                code,
+                id: request.id,
+                ok: true,
+                processId: request.id,
+                signal,
+                type: "exit",
+            });
+        });
+    }
+    async #writeProcessStdin(request) {
+        const processInfo = this.#requireProcess(request.id);
+        await writeChunk(processInfo.child.stdin, request.params.data);
+        await this.#writer.write({
+            id: request.id,
+            ok: true,
+            type: "ack",
+        });
+    }
+    async #signalProcess(request) {
+        const processInfo = this.#requireProcess(request.id);
+        if (!processInfo.child.kill(request.params.signal)) {
+            throw new Error(`Unable to signal process: ${request.id}`);
+        }
+        await this.#writer.write({
+            id: request.id,
+            ok: true,
+            signal: request.params.signal,
+            type: "ack",
+        });
+    }
+    async #closeProcess(processId) {
+        const processInfo = this.#requireProcess(processId);
+        if (!processInfo.child.kill("SIGTERM")) {
+            throw new Error(`Unable to close process: ${processId}`);
+        }
+        await this.#writer.write({
+            id: processId,
+            ok: true,
+            type: "ack",
+        });
+    }
+    #requireProcess(processId) {
+        const processInfo = this.#processes.get(processId);
+        if (processInfo === undefined) {
+            throw new Error(`Process is not running: ${processId}`);
+        }
+        return processInfo;
+    }
+    async #writeRequestError(id, error) {
+        await this.#writer.write({
+            id,
+            message: errorMessage(error),
+            ok: false,
+            type: "error",
+        });
+    }
+}
+export const runRunnethSshStdio = async (options) => {
+    const controller = new RunnethSshStdioController(options);
+    await controller.start();
+    try {
+        await controller.run();
+    }
+    finally {
+        await controller.stop();
+    }
+};