@sealant/mend 0.6.0 → 0.8.0

package/dist/dashboard.js

@@ -261,6 +261,14 @@ const App = ({ ctx, onQuit }) => {
         let outcome;
         try {
             outcome = await ctx.attachTty(session.id, session.harness);
+            if (outcome === "unavailable") {
+                // A live session whose terminal ended (idle: a workspace held open,
+                // no PTY behind it). Enter still means "get me in" — open a fresh
+                // shell in the same workspace and attach to that.
+                const shell = await ctx.api("POST", `/sessions/${session.id}/shell`);
+                process.stdout.write(`no live terminal — opened a shell in the workspace\n\n`);
+                outcome = await ctx.attachTty(session.id, "shell", shell.id);
+            }
         }
         catch (error) {
             say(error instanceof Error ? error.message : String(error));

package/dist/main.js

@@ -533,17 +533,39 @@ const flattenService = (view) => {
 const fetchServiceViews = (config, all = false) => api(config, "GET", `/services${all ? "?all=1" : ""}`);
 const fetchServices = async (config, all = false) => (await fetchServiceViews(config, all)).map(flattenService);
 const mutateService = async (config, method, endpointPath, body) => flattenService(await api(config, method, endpointPath, body));
+/** Is the configured server this machine? Only then is its bind authority OUR address. */
+const serverIsLocal = (config) => {
+    const host = parseMendUrl(config.url).hostname;
+    return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+};
 const serviceUrl = (service) => service.browserUrl ??
     (service.authority === null
         ? "unbound"
         : `${service.authority}${service.protocol === "udp" ? " (udp)" : ""}`);
-const serviceExposure = (service) => {
-    if (service.exposureScope === null)
-        return "";
-    if (service.exposureScope === "private") {
-        return "No Mend sign-in protects this port. Anyone who can reach this private address can connect.";
+/**
+ * Where THIS terminal reaches the Service. On a local server the bind
+ * authority is our own address; on a remote one it is an address on the
+ * server's network — the honest client path is the authenticated tunnel.
+ */
+const printServiceAccess = (config, service) => {
+    const gate = "no Mend sign-in on this port — network reach is the only gate";
+    if (serverIsLocal(config)) {
+        if (service.authority !== null)
+            say(`  ${cobalt(serviceUrl(service))}  ${dim(gate)}`);
+        return;
+    }
+    if (service.protocol === "udp") {
+        // No tunnel for UDP: the server-side listener is the only path.
+        if (service.authority !== null) {
+            say(`  ${cobalt(serviceUrl(service))} ${dim(`on the server's network · ${gate}`)}`);
+        }
+        return;
+    }
+    const local = service.hostPort ?? service.workspacePort;
+    say(`  ${cobalt(`mend service connect ${service.label}`)} ${dim(`→ 127.0.0.1:${local} on this machine, authenticated as you`)}`);
+    if (service.authority !== null) {
+        say(`  ${dim(`server-side listener ${service.authority} · ${gate}`)}`);
     }
-    return `Loopback only · Mend auth: ${service.mendAuthentication ?? "unknown"}`;
 };
 const printWorkspaceTtlFailure = (service) => {
     if (service.workspaceTtlRenewalError === null)
@@ -551,15 +573,17 @@ const printWorkspaceTtlFailure = (service) => {
     say(amber(`  workspace TTL renewal failed · ${service.workspaceTtlRenewalError}`));
     say(dim(`  last renewed ${service.workspaceTtlRenewedAt ?? "unknown"} · known expiry ${service.workspaceExpiresAt ?? "unknown"} · failed ${service.workspaceTtlRenewalFailedAt ?? "unknown"}`));
 };
-const printServiceEndpoint = (service) => {
-    const exposure = serviceExposure(service);
-    say(`  ${cobalt(serviceUrl(service))}${exposure === "" ? "" : `  ${dim(exposure)}`}`);
+const printServiceEndpoint = (config, service) => {
+    printServiceAccess(config, service);
     printWorkspaceTtlFailure(service);
 };
-const printService = (service) => {
+const printService = (config, service) => {
     const status = service.status === "reachable" ? green(service.status) : amber(service.status);
-    const exposure = serviceExposure(service);
-    say(`${(service.label ?? service.id.slice(0, 8)).padEnd(12)}  ${dim(`:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""} →`)} ${serviceUrl(service)}  ${status}  ${dim(service.id.slice(0, 8))}${exposure === "" ? "" : `  ${dim(exposure)}`}`);
+    const port = `:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""}`;
+    // Pad around the colored status by its bare length — ANSI codes break padEnd.
+    const statusPad = " ".repeat(Math.max(1, 12 - service.status.length));
+    say(`${(service.label ?? service.id.slice(0, 8)).padEnd(14)} ${status}${statusPad}${dim(port.padEnd(7))} ${dim(service.id.slice(0, 8))}`);
+    printServiceAccess(config, service);
     printWorkspaceTtlFailure(service);
 };
 /**
@@ -597,7 +621,7 @@ const serviceAdd = async (config, args) => {
         browserScheme,
     });
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    printServiceEndpoint(service);
+    printServiceEndpoint(config, service);
     if (protocol === "udp") {
         say(dim(`  udp — a reply is the only reachability signal; silence just relays`));
     }
@@ -612,7 +636,7 @@ const serviceList = async (config) => {
         return;
     }
     for (const service of services)
-        printService(service);
+        printService(config, service);
 };
 const serviceStop = async (config, args) => {
     const needle = args.find((a) => !a.startsWith("--"));
@@ -675,7 +699,7 @@ const serviceRun = async (config, args) => {
             name: recipe.name,
         }));
         say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-        printServiceEndpoint(service);
+        printServiceEndpoint(config, service);
         say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
         return;
     }
@@ -709,7 +733,7 @@ const serviceRun = async (config, args) => {
         browserScheme,
     }));
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    printServiceEndpoint(service);
+    printServiceEndpoint(config, service);
     say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
 };
 /** Read sequence-addressed PTY output without attaching an input-capable terminal. */
@@ -778,7 +802,7 @@ const serviceRestart = async (config, args) => {
     const service = await findLiveService(config, needle);
     const restarted = await withSpinner(`restarting ${service.label ?? service.id.slice(0, 8)}…`, mutateService(config, "POST", `/services/${service.id}/restart`));
     say(`${green("✓")} restarted · ${restarted.status}`);
-    printServiceEndpoint(restarted);
+    printServiceEndpoint(config, restarted);
 };
 /**
  * Scaffold mend.toml from the project's own manifests. Static suggestion,
@@ -856,6 +880,82 @@ const serviceInit = async (args) => {
     fs.writeFileSync(target, toml);
     say(`${green("✓")} wrote ${target} — commit it, then: mend service run ${proposals[0]?.name}`);
 };
+/**
+ * `mend service connect [name…] [--port <n>]`: the location-independent data
+ * plane for Services. The server's own listener binds the SERVER's
+ * interfaces (`MEND_SERVICE_HOSTS`) — exactly right when the server is this
+ * machine, unreachable when it is a Pod or a VPS. This binds each Service's
+ * port on THIS machine's loopback instead and pumps every accepted
+ * connection over one authenticated WebSocket to the server, which dials the
+ * same workspace forward the listener uses. No ports are opened anywhere but
+ * here, and every connection carries the caller's Mend auth.
+ */
+const serviceConnect = async (config, args) => {
+    const portFlag = args.indexOf("--port");
+    const portOverride = portFlag === -1 ? null : Number(args[portFlag + 1]);
+    if (portOverride !== null && !Number.isInteger(portOverride)) {
+        return fail("--port takes a port number");
+    }
+    const names = args.filter((a, i) => !a.startsWith("--") && i !== portFlag + 1);
+    const live = (await fetchServices(config)).filter((s) => s.protocol === "tcp");
+    const picked = names.length === 0
+        ? live
+        : live.filter((s) => names.some((n) => s.label === n || s.id.startsWith(n)));
+    if (picked.length === 0) {
+        return fail(names.length === 0
+            ? "no live TCP services — mend service run starts one"
+            : `no live TCP service matches "${names.join('", "')}"`);
+    }
+    if (portOverride !== null && picked.length !== 1) {
+        return fail("--port applies to exactly one service — name it");
+    }
+    const tunnelUrl = (serviceId) => {
+        const url = parseMendUrl(`${config.url}/api/service-tunnel`);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        url.searchParams.set("service", serviceId);
+        if (config.token !== null)
+            url.searchParams.set("token", config.token);
+        return url;
+    };
+    for (const service of picked) {
+        const port = portOverride ?? service.hostPort ?? service.workspacePort;
+        const server = net.createServer((socket) => {
+            // Hold local bytes until the tunnel is open; loopback buffers are tiny.
+            socket.pause();
+            const ws = new WebSocket(tunnelUrl(service.id));
+            ws.binaryType = "arraybuffer";
+            ws.addEventListener("open", () => socket.resume(), { once: true });
+            ws.addEventListener("message", (event) => {
+                if (typeof event.data === "string")
+                    return; // no text frames come down
+                socket.write(Buffer.from(event.data));
+            });
+            ws.addEventListener("close", () => socket.end(), { once: true });
+            ws.addEventListener("error", () => socket.destroy(), { once: true });
+            // Copy per chunk: the WS client wants an ArrayBuffer-backed view, and
+            // Buffer pools share their backing store.
+            socket.on("data", (chunk) => ws.send(new Uint8Array(chunk)));
+            socket.on("end", () => {
+                if (ws.readyState === WebSocket.OPEN)
+                    ws.send(JSON.stringify({ t: "eof" }));
+            });
+            socket.on("close", () => ws.close());
+            socket.on("error", () => ws.close());
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", (error) => {
+                reject(new Error(error.code === "EADDRINUSE"
+                    ? `127.0.0.1:${port} is already in use here — pick one with: mend service connect ${service.label} --port <n>`
+                    : error.message));
+            });
+            server.listen(port, "127.0.0.1", () => resolve());
+        }).catch((error) => fail(error.message));
+        say(`${green("●")} ${service.label} → 127.0.0.1:${port} ${dim(`(tunnel to ${config.url})`)}`);
+    }
+    say(dim("  connections are authenticated as you · Ctrl-C stops"));
+    // The listeners keep the process alive until the user stops it.
+    await new Promise(() => { });
+};
 const serviceCommand = async (config, args) => {
     const [verb, ...rest] = args;
     switch (verb) {
@@ -865,6 +965,8 @@ const serviceCommand = async (config, args) => {
             return serviceAdd(config, rest);
         case "init":
             return serviceInit(rest);
+        case "connect":
+            return serviceConnect(config, rest);
         case "list":
         case undefined:
             return serviceList(config);
@@ -1862,7 +1964,7 @@ const dashboard = async (config) => {
         config,
         cwd: process.cwd(),
         api: (method, route, body) => request(config, method, route, body),
-        attachTty: (sessionId, harness) => attachTty(config, sessionId, harness, 0n),
+        attachTty: (sessionId, harness, processId) => attachTty(config, sessionId, harness, 0n, processId),
     });
 };
 // ─── entry ──────────────────────────────────────────────────────────────────
@@ -1912,6 +2014,9 @@ everything else
   mend service init [--yes]             scaffold mend.toml from package.json + compose ports
   mend service add [session] <port> [--name <n>] [--udp]
                                         adopt a listening workspace port — reachable on this machine
+  mend service connect [name…] [--port <p>]
+                                        bring live Services to THIS machine's loopback — each
+                                        connection tunnels through the server, authenticated as you
   mend service list                     every live service and its observed state
   mend service logs <name-or-id>        follow a supervised service's output (replay, then live)
   mend service restart <name-or-id>     re-run its recorded command — same URL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/mend",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "The mend CLI: adopt a repository into Mend's store, launch your coding agent in a recorded session worktree, detach and reattach from any terminal",
   "keywords": [
     "claude-code",