@rytuz/machine-access 0.1.0

package/bin/rytuz-machine-access.js

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+"use strict";
+
+const crypto = require("crypto");
+const fs = require("fs");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+const RUNTIME_RELEASE = Object.freeze({
+  schemaVersion: "1.0",
+  version: "0.1.0-standard.1",
+  platform: "win32",
+  arch: "x64",
+  sha256: "036f1f0d9699b0ca06bda20afd5f702b3e62793ccf7e21c2ef4b244218583ea6",
+  size: 11137124,
+  relativePath: path.join(
+    "..",
+    "payload",
+    "windows-x64",
+    "rytuz-machine-access-standard.zip"
+  )
+});
+
+function fail(message) {
+  const error = new Error(message);
+  error.name = "RytuzBootstrapError";
+  throw error;
+}
+
+function stateRoot(env = process.env) {
+  const local =
+    typeof env.LOCALAPPDATA === "string" ? env.LOCALAPPDATA.trim() : "";
+  if (!local) fail("LOCALAPPDATA is required for Rytuz Standard");
+  return path.resolve(local, "Rytuz", "MachineAccess");
+}
+
+function validateRelease(release = RUNTIME_RELEASE) {
+  if (
+    release.schemaVersion !== "1.0" ||
+    release.platform !== "win32" ||
+    release.arch !== "x64" ||
+    typeof release.version !== "string" ||
+    !/^[0-9]+\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9.-]+)?$/.test(release.version) ||
+    typeof release.sha256 !== "string" ||
+    !/^[a-f0-9]{64}$/.test(release.sha256) ||
+    !Number.isSafeInteger(release.size) ||
+    release.size <= 0 ||
+    release.size > 64 * 1024 * 1024
+  ) {
+    fail("bundled Rytuz runtime metadata is invalid");
+  }
+  return release;
+}
+
+function sha256File(filePath) {
+  const hash = crypto.createHash("sha256");
+  const fd = fs.openSync(filePath, "r");
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  try {
+    for (;;) {
+      const count = fs.readSync(fd, buffer, 0, buffer.length, null);
+      if (count === 0) break;
+      hash.update(buffer.subarray(0, count));
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  return hash.digest("hex");
+}
+
+function verifyPayload(filePath, release = RUNTIME_RELEASE) {
+  validateRelease(release);
+  if (!fs.existsSync(filePath) || !fs.statSync(filePath).isFile()) {
+    fail("bundled Rytuz runtime payload is missing");
+  }
+  const stat = fs.statSync(filePath);
+  if (stat.size !== release.size) {
+    fail("bundled Rytuz runtime payload size verification failed");
+  }
+  const digest = sha256File(filePath);
+  if (digest !== release.sha256) {
+    fail("bundled Rytuz runtime payload SHA-256 verification failed");
+  }
+  return filePath;
+}
+
+function bundledPayloadPath() {
+  return path.resolve(__dirname, RUNTIME_RELEASE.relativePath);
+}
+
+function powershellPath(env = process.env) {
+  const systemRoot = env.SystemRoot || env.SYSTEMROOT || "C:\\Windows";
+  return path.join(
+    systemRoot,
+    "System32",
+    "WindowsPowerShell",
+    "v1.0",
+    "powershell.exe"
+  );
+}
+
+function expandVerifiedPayload(zipPath, release, root, env = process.env) {
+  const runtimes = path.join(root, "runtime");
+  const target = path.join(runtimes, release.version);
+  const marker = path.join(target, ".rytuz-runtime.json");
+  fs.mkdirSync(runtimes, { recursive: true });
+
+  if (fs.existsSync(marker)) {
+    try {
+      const existing = JSON.parse(fs.readFileSync(marker, "utf8"));
+      if (
+        existing.version === release.version &&
+        existing.sha256 === release.sha256 &&
+        fs.existsSync(path.join(target, "python.exe")) &&
+        fs.existsSync(
+          path.join(target, "app", "oryx_access", "standard_agent.py")
+        )
+      ) {
+        return target;
+      }
+    } catch {
+      // Invalid/incomplete runtime is replaced below.
+    }
+    fs.rmSync(target, { recursive: true, force: true });
+  }
+
+  const staging = target + ".staging-" + process.pid;
+  fs.rmSync(staging, { recursive: true, force: true });
+  fs.mkdirSync(staging, { recursive: true });
+
+  const script = [
+    "$ErrorActionPreference = 'Stop'",
+    "Expand-Archive -LiteralPath $env:RYTUZ_ARCHIVE -DestinationPath $env:RYTUZ_DEST -Force"
+  ].join("\n");
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  const child = spawnSync(
+    powershellPath(env),
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", encoded],
+    {
+      env: { ...env, RYTUZ_ARCHIVE: zipPath, RYTUZ_DEST: staging },
+      stdio: "pipe",
+      windowsHide: true
+    }
+  );
+  if (child.status !== 0) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fail("verified Rytuz runtime payload could not be expanded");
+  }
+
+  const python = path.join(staging, "python.exe");
+  const connectModule = path.join(
+    staging,
+    "app",
+    "oryx_access",
+    "standard_agent.py"
+  );
+  const runtimeMetadata = path.join(staging, "RYTUZ_RUNTIME.json");
+  if (
+    !fs.existsSync(python) ||
+    !fs.existsSync(connectModule) ||
+    !fs.existsSync(runtimeMetadata)
+  ) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fail("verified Rytuz runtime payload layout is invalid");
+  }
+
+  const metadata = JSON.parse(fs.readFileSync(runtimeMetadata, "utf8"));
+  if (
+    metadata.schema_version !== "1.0" ||
+    metadata.runtime_version !== release.version ||
+    metadata.platform !== "win32" ||
+    metadata.arch !== "x64"
+  ) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fail("verified Rytuz runtime identity is invalid");
+  }
+
+  fs.writeFileSync(
+    path.join(staging, ".rytuz-runtime.json"),
+    JSON.stringify(
+      {
+        schema_version: "1.0",
+        version: release.version,
+        sha256: release.sha256
+      },
+      null,
+      2
+    ) + "\n",
+    { encoding: "utf8", flag: "wx" }
+  );
+  if (fs.existsSync(target)) {
+    fs.rmSync(target, { recursive: true, force: true });
+  }
+  fs.renameSync(staging, target);
+  return target;
+}
+
+function runConnect(runtime, root, env = process.env) {
+  const python = path.join(runtime, "python.exe");
+  const childEnv = { ...env };
+  delete childEnv.PYTHONPATH;
+  delete childEnv.PYTHONHOME;
+  childEnv.PYTHONNOUSERSITE = "1";
+  childEnv.PYTHONSAFEPATH = "1";
+  const child = spawnSync(
+    python,
+    ["-B", "-S", "-m", "oryx_access.standard_agent", "connect"],
+    {
+      cwd: runtime,
+      env: childEnv,
+      stdio: "inherit",
+      windowsHide: false
+    }
+  );
+  if (child.error) throw child.error;
+  if (child.status !== 0) {
+    fail("Rytuz Standard agent exited with code " + child.status);
+  }
+}
+
+async function main(argv = process.argv.slice(2)) {
+  if (argv.length !== 1 || argv[0] !== "connect") {
+    console.error("Usage: npx @rytuz/machine-access@latest connect");
+    return 2;
+  }
+  if (process.platform !== "win32" || process.arch !== "x64") {
+    fail("Rytuz Standard bootstrap currently supports Windows x64 only");
+  }
+
+  const release = validateRelease();
+  const root = stateRoot();
+  fs.mkdirSync(root, { recursive: true });
+
+  const payload = verifyPayload(bundledPayloadPath(), release);
+  const runtime = expandVerifiedPayload(payload, release, root);
+  runConnect(runtime, root);
+  return 0;
+}
+
+if (require.main === module) {
+  main().then(
+    (code) => {
+      process.exitCode = code;
+    },
+    (error) => {
+      console.error(
+        "Rytuz connect failed:",
+        error && error.message ? error.message : error
+      );
+      process.exitCode = 1;
+    }
+  );
+}
+
+module.exports = {
+  RUNTIME_RELEASE,
+  stateRoot,
+  validateRelease,
+  sha256File,
+  verifyPayload,
+  bundledPayloadPath,
+  powershellPath
+};

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@rytuz/machine-access",
+  "version": "0.1.0",
+  "description": "Rytuz Machine Access Standard user-space bootstrap",
+  "license": "UNLICENSED",
+  "private": false,
+  "bin": {
+    "rytuz-machine-access": "bin/rytuz-machine-access.js"
+  },
+  "files": [
+    "bin",
+    "payload"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test"
+  }
+}