@sealant/mend 0.8.0 → 0.10.0

package/dist/main.js

@@ -8,6 +8,7 @@ import * as path from "node:path";
 import { doctorCommand } from "./doctor.js";
 import { readSyncFiles, scanDotfileCandidates } from "./dotfiles.js";
 import { formatLoadReport } from "./env.js";
+import { loginCommand } from "./login.js";
 import { pairCommand, qrCommand } from "./pair.js";
 import { isComposeFile, proposeFromCompose, proposeFromPackageJson, proposeFromWorkspacePackage, renderMendToml, workspaceGlobs, } from "./service-init.js";
 import { agentIsLive, agentOutcome, cwdFacts, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, parseLaunchArgs, } from "./shared.js";
@@ -30,9 +31,12 @@ const loadConfig = () => {
             fail(`could not parse ${CONFIG_PATH}`);
         }
     }
+    const configuredUrl = process.env["MEND_URL"] ?? fileConfig.url ?? null;
     return {
-        url: process.env["MEND_URL"] ?? fileConfig.url ?? "http://localhost:3105",
+        url: configuredUrl ?? "http://localhost:3105",
+        configuredUrl,
         token: process.env["MEND_TOKEN"] ?? fileConfig.token ?? null,
+        deviceId: fileConfig.deviceId ?? null,
     };
 };
 const fail = (message) => {
@@ -547,7 +551,7 @@ const serviceUrl = (service) => service.browserUrl ??
  * authority is our own address; on a remote one it is an address on the
  * server's network — the honest client path is the authenticated tunnel.
  */
-const printServiceAccess = (config, service) => {
+const printServiceAccess = (config, service, tunneling = false) => {
     const gate = "no Mend sign-in on this port — network reach is the only gate";
     if (serverIsLocal(config)) {
         if (service.authority !== null)
@@ -561,8 +565,11 @@ const printServiceAccess = (config, service) => {
         }
         return;
     }
-    const local = service.hostPort ?? service.workspacePort;
-    say(`  ${cobalt(`mend service connect ${service.label}`)} ${dim(`→ 127.0.0.1:${local} on this machine, authenticated as you`)}`);
+    if (!tunneling) {
+        // Suggest the tunnel only when this command is not about to open it.
+        const local = service.hostPort ?? service.workspacePort;
+        say(`  ${cobalt(`mend service connect ${service.label}`)} ${dim(`→ 127.0.0.1:${local} on this machine, authenticated as you`)}`);
+    }
     if (service.authority !== null) {
         say(`  ${dim(`server-side listener ${service.authority} · ${gate}`)}`);
     }
@@ -573,8 +580,8 @@ const printWorkspaceTtlFailure = (service) => {
     say(amber(`  workspace TTL renewal failed · ${service.workspaceTtlRenewalError}`));
     say(dim(`  last renewed ${service.workspaceTtlRenewedAt ?? "unknown"} · known expiry ${service.workspaceExpiresAt ?? "unknown"} · failed ${service.workspaceTtlRenewalFailedAt ?? "unknown"}`));
 };
-const printServiceEndpoint = (config, service) => {
-    printServiceAccess(config, service);
+const printServiceEndpoint = (config, service, tunneling = false) => {
+    printServiceAccess(config, service, tunneling);
     printWorkspaceTtlFailure(service);
 };
 const printService = (config, service) => {
@@ -670,10 +677,22 @@ const findLiveService = async (config, needle) => {
  * declared port to answer, then exposes it like any Service. The command
  * never occupies the agent's terminal or a tool call.
  */
+/**
+ * The point of starting a Service is reaching it. On a local server the
+ * bound authority already answers on this machine, so start-and-return is
+ * complete. On a remote server nothing local answers — stay attached and
+ * tunnel the port here, exactly what `mend service connect` would do next.
+ * Ctrl-C closes the tunnel, never the Service.
+ */
+const willAutoConnect = (config, service, optOut) => !optOut && !serverIsLocal(config) && service.protocol !== "udp";
+const autoConnect = async (config, service) => {
+    say(dim("  remote server — tunneling the port here · Ctrl-C stops the tunnel, not the Service"));
+    await tunnelServices(config, [service], null);
+};
 const serviceRun = async (config, args) => {
     const dashdash = args.indexOf("--");
-    const usage = "usage: mend service run [session] --port <port> [--name <n>] [--udp] [--http|--https] -- <command...>\n" +
-        "       mend service run [session] <name>          (a declared recipe)";
+    const usage = "usage: mend service run [session] --port <port> [--name <n>] [--udp] [--http|--https] [--no-connect] -- <command...>\n" +
+        "       mend service run [session] <name> [--no-connect]          (a declared recipe)";
     // No explicit command = a DECLARED Service: resolve the name against the
     // session worktree's mend.toml and start (or adopt) its recipe.
     if (dashdash === -1) {
@@ -698,9 +717,12 @@ const serviceRun = async (config, args) => {
                 : `starting ${recipe.name} — waiting for :${recipe.port} to answer…`, mutateService(config, "POST", `/sessions/${session.id}/services/recipe`, {
             name: recipe.name,
         }));
+        const tunneling = willAutoConnect(config, service, args.includes("--no-connect"));
         say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-        printServiceEndpoint(config, service);
+        printServiceEndpoint(config, service, tunneling);
         say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+        if (tunneling)
+            await autoConnect(config, service);
         return;
     }
     const argv = args.slice(dashdash + 1);
@@ -732,9 +754,12 @@ const serviceRun = async (config, args) => {
         protocol,
         browserScheme,
     }));
+    const tunneling = willAutoConnect(config, service, head.includes("--no-connect"));
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    printServiceEndpoint(config, service);
+    printServiceEndpoint(config, service, tunneling);
     say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+    if (tunneling)
+        await autoConnect(config, service);
 };
 /** Read sequence-addressed PTY output without attaching an input-capable terminal. */
 const serviceLogs = async (config, args) => {
@@ -881,34 +906,14 @@ const serviceInit = async (args) => {
     say(`${green("✓")} wrote ${target} — commit it, then: mend service run ${proposals[0]?.name}`);
 };
 /**
- * `mend service connect [name…] [--port <n>]`: the location-independent data
- * plane for Services. The server's own listener binds the SERVER's
- * interfaces (`MEND_SERVICE_HOSTS`) — exactly right when the server is this
- * machine, unreachable when it is a Pod or a VPS. This binds each Service's
- * port on THIS machine's loopback instead and pumps every accepted
- * connection over one authenticated WebSocket to the server, which dials the
- * same workspace forward the listener uses. No ports are opened anywhere but
- * here, and every connection carries the caller's Mend auth.
+ * The location-independent data plane for Services: bind each Service's port
+ * on THIS machine's loopback and pump every accepted connection over one
+ * authenticated WebSocket to the server, which dials the same workspace
+ * forward the server-side listener uses. No ports are opened anywhere but
+ * here, and every connection carries the caller's Mend auth. Blocks until
+ * interrupted — the listeners keep the process alive.
  */
-const serviceConnect = async (config, args) => {
-    const portFlag = args.indexOf("--port");
-    const portOverride = portFlag === -1 ? null : Number(args[portFlag + 1]);
-    if (portOverride !== null && !Number.isInteger(portOverride)) {
-        return fail("--port takes a port number");
-    }
-    const names = args.filter((a, i) => !a.startsWith("--") && i !== portFlag + 1);
-    const live = (await fetchServices(config)).filter((s) => s.protocol === "tcp");
-    const picked = names.length === 0
-        ? live
-        : live.filter((s) => names.some((n) => s.label === n || s.id.startsWith(n)));
-    if (picked.length === 0) {
-        return fail(names.length === 0
-            ? "no live TCP services — mend service run starts one"
-            : `no live TCP service matches "${names.join('", "')}"`);
-    }
-    if (portOverride !== null && picked.length !== 1) {
-        return fail("--port applies to exactly one service — name it");
-    }
+const tunnelServices = async (config, services, portOverride) => {
     const tunnelUrl = (serviceId) => {
         const url = parseMendUrl(`${config.url}/api/service-tunnel`);
         url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
@@ -917,7 +922,7 @@ const serviceConnect = async (config, args) => {
             url.searchParams.set("token", config.token);
         return url;
     };
-    for (const service of picked) {
+    for (const service of services) {
         const port = portOverride ?? service.hostPort ?? service.workspacePort;
         const server = net.createServer((socket) => {
             // Hold local bytes until the tunnel is open; loopback buffers are tiny.
@@ -950,12 +955,39 @@ const serviceConnect = async (config, args) => {
             });
             server.listen(port, "127.0.0.1", () => resolve());
         }).catch((error) => fail(error.message));
-        say(`${green("●")} ${service.label} → 127.0.0.1:${port} ${dim(`(tunnel to ${config.url})`)}`);
+        say(`${green("●")} ${service.label ?? service.id.slice(0, 8)} → 127.0.0.1:${port} ${dim(`(tunnel to ${config.url})`)}`);
     }
     say(dim("  connections are authenticated as you · Ctrl-C stops"));
     // The listeners keep the process alive until the user stops it.
     await new Promise(() => { });
 };
+/**
+ * `mend service connect [name…] [--port <n>]`: the standalone entry to the
+ * tunnel. The server's own listener binds the SERVER's interfaces
+ * (`MEND_SERVICE_HOSTS`) — exactly right when the server is this machine,
+ * unreachable when it is a Pod or a VPS; this brings the port here instead.
+ */
+const serviceConnect = async (config, args) => {
+    const portFlag = args.indexOf("--port");
+    const portOverride = portFlag === -1 ? null : Number(args[portFlag + 1]);
+    if (portOverride !== null && !Number.isInteger(portOverride)) {
+        return fail("--port takes a port number");
+    }
+    const names = args.filter((a, i) => !a.startsWith("--") && i !== portFlag + 1);
+    const live = (await fetchServices(config)).filter((s) => s.protocol === "tcp");
+    const picked = names.length === 0
+        ? live
+        : live.filter((s) => names.some((n) => s.label === n || s.id.startsWith(n)));
+    if (picked.length === 0) {
+        return fail(names.length === 0
+            ? "no live TCP services — mend service run starts one"
+            : `no live TCP service matches "${names.join('", "')}"`);
+    }
+    if (portOverride !== null && picked.length !== 1) {
+        return fail("--port applies to exactly one service — name it");
+    }
+    await tunnelServices(config, picked, portOverride);
+};
 const serviceCommand = async (config, args) => {
     const [verb, ...rest] = args;
     switch (verb) {
@@ -1069,106 +1101,48 @@ const connectCommand = async (config, args) => {
     const account = await withSpinner(`connecting ${provider}`, api(config, "POST", "/me/sealant/accounts", { provider, secret }));
     process.stdout.write(`${accountLine(account)}\n`);
 };
-// ─── login: obtain and save the bearer token ────────────────────────────────
+// ─── login: authorize this terminal through the browser (login.ts) ──────────
 const takeFlagValue = (args, flag) => {
     const at = args.indexOf(flag);
     return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
 };
-/**
- * Read a password: raw-mode without echo on a TTY; on a pipe, one line through the SAME readline
- * that read the email (a second reader would find the buffered pipe already drained).
- */
-const readSecretLine = async (prompt, rl) => {
-    if (process.stdin.isTTY !== true) {
-        return (await rl.question(prompt)).trim();
-    }
-    process.stdout.write(prompt);
-    return new Promise((resolve) => {
-        const stdin = process.stdin;
-        stdin.setRawMode(true);
-        stdin.resume();
-        stdin.setEncoding("utf8");
-        let buffer = "";
-        const onData = (chunk) => {
-            for (const char of chunk) {
-                if (char === "\r" || char === "\n") {
-                    stdin.setRawMode(false);
-                    stdin.pause();
-                    stdin.off("data", onData);
-                    process.stdout.write("\n");
-                    resolve(buffer);
-                    return;
-                }
-                if (char === "\u0003") {
-                    stdin.setRawMode(false);
-                    process.stdout.write("\n");
-                    process.exit(130);
-                }
-                if (char === "\u007f" || char === "\b") {
-                    buffer = buffer.slice(0, -1);
-                    continue;
-                }
-                buffer += char;
-            }
-        };
-        stdin.on("data", onData);
-    });
-};
+// Only these three fields persist; `configuredUrl` is derived on every load.
 const saveCliConfig = (next) => {
     fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(CONFIG_PATH, `${JSON.stringify({ url: next.url, token: next.token }, null, 2)}\n`, { mode: 0o600 });
+    fs.writeFileSync(CONFIG_PATH, `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}\n`, { mode: 0o600 });
     fs.chmodSync(CONFIG_PATH, 0o600);
 };
-/**
- * `mend login [--url <server>] [--email <address>]`: sign in with email + password against the
- * server's auth endpoint (the bearer plugin answers with a `set-auth-token` header) and save the
- * token 0600 in the CLI config. Nothing else asks for a password again.
- */
+/** `mend login [--url <server>]` — the browser authorize walk; login.ts owns the flow. */
 const login = async (config, args) => {
-    const url = takeFlagValue(args, "--url") ?? process.env["MEND_URL"] ?? config.url;
-    const emailFlag = takeFlagValue(args, "--email");
-    const readline = await import("node:readline/promises");
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const email = emailFlag ?? (await rl.question(`email for ${url}: `)).trim();
-    if (email === "") {
-        rl.close();
-        return fail("an email is required");
-    }
-    const password = await readSecretLine("password: ", rl);
-    rl.close();
-    if (password === "")
-        return fail("a password is required");
-    let response;
-    try {
-        response = await fetch(`${url}/api/auth/sign-in/email`, {
-            method: "POST",
-            // better-auth's CSRF check rejects the `Origin: null` a non-browser fetch sends; the
-            // server's own URL is always a trusted origin, so present that.
-            headers: { "content-type": "application/json", origin: url },
-            body: JSON.stringify({ email, password }),
-        });
-    }
-    catch {
-        return fail(`cannot reach the Mend server at ${url} — is it running?`);
-    }
-    if (response.status === 401 || response.status === 403 || response.status === 400) {
-        return fail(`sign-in refused for ${email} at ${url}`);
-    }
-    if (!response.ok)
-        return fail(`sign-in failed: ${url} responded ${response.status}`);
-    const token = response.headers.get("set-auth-token");
-    if (token === null || token === "") {
-        return fail("the server signed you in but returned no bearer token (bearer plugin missing?)");
-    }
-    saveCliConfig({ ...config, url, token });
-    say(`${green("✓")} signed in as ${email} · ${dim(`token saved to ${CONFIG_PATH}`)}`);
+    await loginCommand(args, {
+        configuredUrl: config.configuredUrl,
+        defaultUrl: config.url,
+        save: (next) => {
+            saveCliConfig({ url: next.url, token: next.token, deviceId: next.deviceId });
+            say(dim(`  token saved to ${CONFIG_PATH} (0600)`));
+        },
+    });
 };
-const logout = (config) => {
-    if (!fs.existsSync(CONFIG_PATH)) {
+/**
+ * Signing out revokes the device server-side when it can — merely forgetting
+ * a live token would leave it valid until someone found it in Settings →
+ * Devices. A server that cannot be reached still loses the local copy.
+ */
+const logout = async (config) => {
+    if (!fs.existsSync(CONFIG_PATH) && config.token === null) {
         say(dim("nothing saved — already signed out"));
         return;
     }
-    saveCliConfig({ ...config, token: null });
+    if (config.token !== null && config.deviceId !== null) {
+        try {
+            await request(config, "DELETE", `/me/devices/${config.deviceId}`);
+            say(`${green("✓")} device revoked on ${config.url}`);
+        }
+        catch {
+            say(dim("  could not revoke on the server — end it under Settings → Devices"));
+        }
+    }
+    saveCliConfig({ ...config, token: null, deviceId: null });
     say(`${green("✓")} signed out · ${dim(`token removed from ${CONFIG_PATH}`)}`);
 };
 // ─── keys: the machine's Mend deploy key (docs/GIT-ACCESS.md) ───────────────
@@ -1450,33 +1424,106 @@ const envLoad = async (config, args) => {
 };
 const envShow = async (config, args) => {
     const project = await findProject(config, takeFlagValue(args, "--project"));
-    const [environment, secrets] = await Promise.all([
+    const [environment, secrets, cluster] = await Promise.all([
         api(config, "GET", `/projects/${project.id}/environment`),
         api(config, "GET", `/projects/${project.id}/secrets`),
+        api(config, "GET", `/projects/${project.id}/cluster-bindings`),
     ]);
-    say(`${project.name} ${dim(`· configuration r${environment.revision} · secrets r${secrets.revision}`)}`);
-    if (environment.variables.length === 0 && secrets.secrets.length === 0) {
+    say(`${project.name} ${dim(`· configuration r${environment.revision} · secrets r${secrets.revision} · cluster r${cluster.revision}`)}`);
+    if (environment.variables.length === 0 &&
+        secrets.secrets.length === 0 &&
+        cluster.bindings.length === 0 &&
+        cluster.serviceAccount === null) {
         say(dim(`  nothing stored — load a file: ${cobalt("mend env load")}`));
         return;
     }
-    const width = Math.max(...environment.variables.map((v) => v.name.length), ...secrets.secrets.map((s) => s.name.length));
+    const bindingNames = cluster.bindings.map((b) => `${b.kind}/${b.objectName}`);
+    const width = Math.max(0, ...environment.variables.map((v) => v.name.length), ...secrets.secrets.map((s) => s.name.length), ...bindingNames.map((name) => name.length));
     for (const variable of environment.variables) {
         say(`  ${variable.name.padEnd(width)}  configuration ${dim("· plaintext")}`);
     }
     for (const secret of secrets.secrets) {
         say(`  ${secret.name.padEnd(width)}  secret ${dim("· value set, never shown")}`);
     }
+    for (const name of bindingNames) {
+        say(`  ${name.padEnd(width)}  cluster binding ${dim("· resolved by the platform at launch · contents unknown to Mend")}`);
+    }
+    if (cluster.serviceAccount !== null) {
+        say(`  ${cluster.serviceAccount.padEnd(width)}  service account ${dim("· workspace pod identity · allowlisted by the operator")}`);
+    }
+    if (!cluster.clusterCapable && (cluster.bindings.length > 0 || cluster.serviceAccount !== null)) {
+        say(amber(`  ${cluster.bindings.length} cluster binding${cluster.bindings.length === 1 ? "" : "s"}${cluster.serviceAccount === null ? "" : " · service account set"} · local runner — cluster bindings do not resolve here`));
+    }
+};
+/**
+ * Cluster bindings (`.plans/cluster-env-sources.md`): NAMES of Kubernetes Secrets/ConfigMaps the
+ * platform resolves at launch — Mend never holds the values. Every verb works on every install
+ * (a non-cluster install must be able to remove bindings to launch); only resolution is
+ * Kubernetes-only, and the platform refuses launches there, readably.
+ */
+const envCluster = async (config, args) => {
+    const explicitProject = takeFlagValue(args, "--project");
+    const positional = args.filter((arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project");
+    const [verb, ...rest] = positional;
+    const usage = "try: mend env cluster add secret <name> | add configmap <name> | remove <kind>/<name> | sa <name> | sa --clear";
+    const project = await findProject(config, explicitProject);
+    const route = `/projects/${project.id}/cluster-bindings`;
+    const appliesLine = () => say(dim("  applies from the next workspace launch; running workspaces keep what they started with"));
+    if (verb === "add") {
+        const [kind, objectName] = rest;
+        if ((kind !== "secret" && kind !== "configmap") || objectName === undefined) {
+            return fail(`env cluster add takes a kind and an object name — ${usage}`);
+        }
+        const result = await api(config, "POST", route, {
+            kind,
+            objectName,
+        });
+        say(`${green("✓")} bound ${kind}/${objectName} ${dim(`· cluster r${result.revision}`)}`);
+        say(dim("  resolved by the platform at launch · contents unknown to Mend"));
+        return appliesLine();
+    }
+    if (verb === "remove") {
+        const [ref] = rest;
+        const [kind, objectName] = ref?.split("/", 2) ?? [];
+        if ((kind !== "secret" && kind !== "configmap") || objectName === undefined) {
+            return fail(`env cluster remove takes <kind>/<name>, e.g. secret/app-env — ${usage}`);
+        }
+        const snapshot = await api(config, "GET", route);
+        const binding = snapshot.bindings.find((b) => b.kind === kind && b.objectName === objectName);
+        if (binding === undefined)
+            return fail(`${kind}/${objectName} is not bound on ${project.name}`);
+        const result = await api(config, "DELETE", `${route}/${binding.id}`);
+        say(`${green("✓")} removed ${kind}/${objectName} ${dim(`· cluster r${result.revision}`)}`);
+        return appliesLine();
+    }
+    if (verb === "sa") {
+        const clear = args.includes("--clear");
+        const [name] = rest;
+        if (!clear && name === undefined)
+            return fail(`env cluster sa takes a name or --clear — ${usage}`);
+        const result = await api(config, "PUT", `${route}/service-account`, { serviceAccount: clear ? null : name });
+        say(result.serviceAccount === null
+            ? `${green("✓")} cleared the workspace service account ${dim(`· cluster r${result.revision}`)}`
+            : `${green("✓")} service account ${result.serviceAccount} ${dim(`· cluster r${result.revision}`)}`);
+        if (result.serviceAccount !== null) {
+            say(amber("  the session agent holds this role's full permissions for the whole session — bind a least-privilege role intended for untrusted code; names outside the platform allowlist fail the launch"));
+        }
+        return appliesLine();
+    }
+    return fail(`unknown env cluster command "${verb ?? ""}" — ${usage}`);
 };
 const envCommand = async (config, args) => {
     const [verb, ...rest] = args;
     switch (verb) {
         case "load":
             return envLoad(config, rest);
+        case "cluster":
+            return envCluster(config, rest);
         case "show":
         case undefined:
             return envShow(config, rest);
         default:
-            return fail(`unknown env command "${verb}" — try: mend env load | show`);
+            return fail(`unknown env command "${verb}" — try: mend env load | show | cluster`);
     }
 };
 const dotfilesCommand = async (config, args) => {
@@ -1971,7 +2018,10 @@ const dashboard = async (config) => {
 const HELP = `mend — the agent workbench
 
 start
-  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend login [--url <server>]           sign this terminal in through the browser: opens
+                                        <server>/authorize, you press Authorize there, and the
+                                        CLI saves a revocable device token (0600); no password
+                                        is ever typed here
   mend connect <provider> [--from-stdin] [--remove]
                                         send THIS machine's claude/codex/github credential to the
                                         platform under your own user (reads the file the provider's
@@ -1992,7 +2042,7 @@ start
 
 everything else
   mend                                  the dashboard: every project and session, live
-  mend logout                           forget the saved token
+  mend logout                           revoke this terminal's device token and forget it
   mend keys init                        generate the machine's Mend deploy key (ed25519)
   mend keys show                        print the public key — add it as a deploy key on your git host
   mend env load [file] [--secret [A,B]] load a .env into the project: ordinary names → configuration,
@@ -2032,7 +2082,7 @@ everything else
 
   server: MEND_URL (default http://localhost:3105) · auth: MEND_TOKEN
   detach key: Ctrl+] (set MEND_DETACH_KEY=none when an outer multiplexer owns detaching)
-  config file: ~/.config/mend/cli.json { "url": ..., "token": ... }
+  config file: ~/.config/mend/cli.json { "url": ..., "token": ..., "deviceId": ... }
 `;
 const main = async () => {
     const [command, ...rest] = process.argv.slice(2);