@serfab/cadre-host 0.10.0 → 0.12.0

package/src/installer/__tests__/wizard.test.ts

@@ -1,64 +1,64 @@
-import { describe, expect, it } from 'vitest';
-
-import { runWizardWith, type WizardDefaults } from '../wizard.js';
-
-const defaults: WizardDefaults = {
-  dataDir: '/data/cadre-host',
-  uiPort: 8765,
-  libp2pPort: 4001,
-  upnpEnabled: true,
-  ownCadre: false,
-};
-
-function scripted(answers: ReadonlyArray<string>): (label: string, fallback: string) => Promise<string> {
-  let i = 0;
-  return async (_label, _fallback) => {
-    if (i >= answers.length) throw new Error(`wizard asked more questions than scripted (i=${i})`);
-    return answers[i++]!;
-  };
-}
-
-describe('runWizardWith', () => {
-  it('returns the defaults when every answer is blank', async () => {
-    const out = await runWizardWith(defaults, scripted(['', '', '', '', '', '']));
-    expect(out).toEqual({
-      dataDir: '/data/cadre-host',
-      uiPort: 8765,
-      libp2pPort: 4001,
-      upnpEnabled: true,
-      configureDdns: false,
-      ownCadre: false,
-    });
-  });
-
-  it('respects overrides', async () => {
-    const out = await runWizardWith(defaults, scripted([
-      '/srv/host',
-      '9000',
-      '5000',
-      'n',
-      'y',
-      'y',
-    ]));
-    expect(out).toEqual({
-      dataDir: '/srv/host',
-      uiPort: 9000,
-      libp2pPort: 5000,
-      upnpEnabled: false,
-      configureDdns: true,
-      ownCadre: true,
-    });
-  });
-
-  it('rejects invalid port input', async () => {
-    await expect(
-      runWizardWith(defaults, scripted(['', 'banana', '', '', ''])),
-    ).rejects.toThrow(/Invalid port/);
-  });
-
-  it('rejects unrecognized yes/no answers', async () => {
-    await expect(
-      runWizardWith(defaults, scripted(['', '', '', 'maybe', ''])),
-    ).rejects.toThrow(/Invalid yes\/no/);
-  });
-});
+import { describe, expect, it } from 'vitest';
+
+import { runWizardWith, type WizardDefaults } from '../wizard.js';
+
+const defaults: WizardDefaults = {
+  dataDir: '/data/cadre-host',
+  uiPort: 8765,
+  libp2pPort: 4001,
+  upnpEnabled: true,
+  ownCadre: false,
+};
+
+function scripted(answers: ReadonlyArray<string>): (label: string, fallback: string) => Promise<string> {
+  let i = 0;
+  return async (_label, _fallback) => {
+    if (i >= answers.length) throw new Error(`wizard asked more questions than scripted (i=${i})`);
+    return answers[i++]!;
+  };
+}
+
+describe('runWizardWith', () => {
+  it('returns the defaults when every answer is blank', async () => {
+    const out = await runWizardWith(defaults, scripted(['', '', '', '', '', '']));
+    expect(out).toEqual({
+      dataDir: '/data/cadre-host',
+      uiPort: 8765,
+      libp2pPort: 4001,
+      upnpEnabled: true,
+      configureDdns: false,
+      ownCadre: false,
+    });
+  });
+
+  it('respects overrides', async () => {
+    const out = await runWizardWith(defaults, scripted([
+      '/srv/host',
+      '9000',
+      '5000',
+      'n',
+      'y',
+      'y',
+    ]));
+    expect(out).toEqual({
+      dataDir: '/srv/host',
+      uiPort: 9000,
+      libp2pPort: 5000,
+      upnpEnabled: false,
+      configureDdns: true,
+      ownCadre: true,
+    });
+  });
+
+  it('rejects invalid port input', async () => {
+    await expect(
+      runWizardWith(defaults, scripted(['', 'banana', '', '', ''])),
+    ).rejects.toThrow(/Invalid port/);
+  });
+
+  it('rejects unrecognized yes/no answers', async () => {
+    await expect(
+      runWizardWith(defaults, scripted(['', '', '', 'maybe', ''])),
+    ).rejects.toThrow(/Invalid yes\/no/);
+  });
+});

package/src/installer/config.ts

@@ -5,10 +5,10 @@
  * orchestrator) each own their own files under `<dataDir>/`; this is NOT
  * an umbrella config.
  *
- * Schema versions:
- *   v1 — initial layout from 6.4.1.
- *   v2 — adds `updates: { autoApply, manifestUrl? }` for the update-flow
- *        (6.4.2). v1 files are silently upgraded on read with autoApply=false.
+ * Schema version: 2. `version` is a forward guard — a file whose version
+ * does not match `CURRENT_VERSION` is rejected on read rather than
+ * reinterpreted, so a future incompatible layout fails loudly instead of
+ * being silently misread.
  */
 
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
@@ -119,7 +119,7 @@ export function updateHostConfig(
     ...current,
     ...patch,
     updates: { ...current.updates, ...(patch.updates ?? {}) },
-    version: 2,
+    version: CURRENT_VERSION,
   };
   writeHostConfig(filePath, next);
   return next;
@@ -137,12 +137,6 @@ export function readHostConfig(filePath: string): HostConfigFile {
     throw new Error(`host.config.json at ${filePath} is not a JSON object`);
   }
   const obj = parsed as Record<string, unknown>;
-  if (obj.version === 1) {
-    // Silent in-place upgrade. v1 lacks `updates`; default to notify-only.
-    const upgraded = upgradeV1(obj, filePath);
-    writeHostConfig(filePath, upgraded);
-    return upgraded;
-  }
   if (obj.version !== CURRENT_VERSION) {
     throw new Error(
       `host.config.json at ${filePath} has unsupported version=${obj.version} (this build expects ${CURRENT_VERSION})`,
@@ -154,38 +148,6 @@ export function readHostConfig(filePath: string): HostConfigFile {
   return obj;
 }
 
-/** v1 → v2 migration: stamp `updates: { autoApply: false }` and bump version. */
-function upgradeV1(obj: Record<string, unknown>, filePath: string): HostConfigFile {
-  if (!isV1Shape(obj)) {
-    throw new Error(`host.config.json at ${filePath} is missing required v1 fields`);
-  }
-  return {
-    version: 2,
-    installId: obj.installId as string,
-    uiPort: obj.uiPort as number,
-    libp2pPort: obj.libp2pPort as number,
-    dataDir: obj.dataDir as string,
-    identityPath: obj.identityPath as string,
-    upnpEnabled: obj.upnpEnabled as boolean,
-    installedAt: obj.installedAt as string,
-    installerVersion: obj.installerVersion as string,
-    updates: { autoApply: false },
-  };
-}
-
-function isV1Shape(v: Record<string, unknown>): boolean {
-  return (
-    typeof v.installId === 'string' &&
-    typeof v.uiPort === 'number' &&
-    typeof v.libp2pPort === 'number' &&
-    typeof v.dataDir === 'string' &&
-    typeof v.identityPath === 'string' &&
-    typeof v.upnpEnabled === 'boolean' &&
-    typeof v.installedAt === 'string' &&
-    typeof v.installerVersion === 'string'
-  );
-}
-
 function isHostConfigShape(v: unknown): v is HostConfigFile {
   if (!v || typeof v !== 'object') return false;
   const o = v as Record<string, unknown>;

package/src/installer/identity.ts

@@ -1,49 +1,56 @@
-/**
- * Identity persistence for cadre-host.
- *
- * The host's libp2p peer identity is an Ed25519 keypair generated at
- * install time. The protobuf-encoded private key is written to
- * `<dataDir>/identity.key` with mode 0600 on POSIX. `cadre-host start`
- * later loads it with `privateKeyFromProtobuf`.
- *
- * We persist the protobuf form (not raw bytes) because that's the format
- * libp2p's `privateKeyFromProtobuf` consumes directly and it preserves the
- * key type tag — future migrations to a different key algorithm don't
- * require a schema change here.
- */
-
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
-import {
-  generateKeyPair,
-  privateKeyFromProtobuf,
-  privateKeyToProtobuf,
-} from '@libp2p/crypto/keys';
-import { peerIdFromPrivateKey } from '@libp2p/peer-id';
-import type { PrivateKey } from '@libp2p/interface';
-
-export interface IdentityRecord {
-  privateKey: PrivateKey;
-  /** Stringified libp2p peer ID (`12D3Koo…`). */
-  peerId: string;
-}
-
-/** Generate a fresh Ed25519 identity and persist it. Returns the in-memory record. */
-export async function generateIdentity(filePath: string): Promise<IdentityRecord> {
-  const privateKey = await generateKeyPair('Ed25519');
-  const bytes = privateKeyToProtobuf(privateKey);
-  mkdirSync(dirname(filePath), { recursive: true });
-  writeFileSync(filePath, bytes);
-  // 0600 — owner read/write only. No-op on Windows.
-  if (process.platform !== 'win32') {
-    chmodSync(filePath, 0o600);
-  }
-  return { privateKey, peerId: peerIdFromPrivateKey(privateKey).toString() };
-}
-
-/** Load an existing identity file. Throws if it doesn't decode. */
-export function loadIdentity(filePath: string): IdentityRecord {
-  const bytes = readFileSync(filePath);
-  const privateKey = privateKeyFromProtobuf(new Uint8Array(bytes));
-  return { privateKey, peerId: peerIdFromPrivateKey(privateKey).toString() };
-}
+/**
+ * Identity persistence for cadre-host.
+ *
+ * The host's libp2p peer identity is an Ed25519 keypair generated at
+ * install time. The protobuf-encoded private key is written to
+ * `<dataDir>/identity.key` with mode 0600 on POSIX. `cadre-host start`
+ * later loads it with `privateKeyFromProtobuf`.
+ *
+ * We persist the protobuf form (not raw bytes) because that's the format
+ * libp2p's `privateKeyFromProtobuf` consumes directly and it preserves the
+ * key type tag — future migrations to a different key algorithm don't
+ * require a schema change here. Raw bytes carry no type tag AND no way to tell
+ * a damaged file from a valid one: `privateKeyFromRaw` accepts any 64 bytes as
+ * an Ed25519 key without checking that the public half matches the private, so
+ * a truncated file would load as a *different* working identity.
+ *
+ * This is the repo-wide identity file format, not a cadre-host-local choice:
+ * `cadre enroll create` writes exactly these bytes, and `cadre-cli`'s
+ * `identity.keyFile` accepts nothing else (`config/loader.ts` → `loadIdentityKey`).
+ */
+
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import {
+  generateKeyPair,
+  privateKeyFromProtobuf,
+  privateKeyToProtobuf,
+} from '@libp2p/crypto/keys';
+import { peerIdFromPrivateKey } from '@libp2p/peer-id';
+import type { PrivateKey } from '@libp2p/interface';
+
+export interface IdentityRecord {
+  privateKey: PrivateKey;
+  /** Stringified libp2p peer ID (`12D3Koo…`). */
+  peerId: string;
+}
+
+/** Generate a fresh Ed25519 identity and persist it. Returns the in-memory record. */
+export async function generateIdentity(filePath: string): Promise<IdentityRecord> {
+  const privateKey = await generateKeyPair('Ed25519');
+  const bytes = privateKeyToProtobuf(privateKey);
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, bytes);
+  // 0600 — owner read/write only. No-op on Windows.
+  if (process.platform !== 'win32') {
+    chmodSync(filePath, 0o600);
+  }
+  return { privateKey, peerId: peerIdFromPrivateKey(privateKey).toString() };
+}
+
+/** Load an existing identity file. Throws if it doesn't decode. */
+export function loadIdentity(filePath: string): IdentityRecord {
+  const bytes = readFileSync(filePath);
+  const privateKey = privateKeyFromProtobuf(new Uint8Array(bytes));
+  return { privateKey, peerId: peerIdFromPrivateKey(privateKey).toString() };
+}

package/src/installer/paths.ts

@@ -1,109 +1,109 @@
-/**
- * Per-platform default paths for the installer.
- *
- * Linux:   XDG_DATA_HOME / ~/.local/share/cadre-host
- * macOS:   ~/Library/Application Support/CadreHost
- * Windows: %LocalAppData%\CadreHost
- *
- * The package root (where the installed `dist/bin/host.js` and `service/`
- * directory live) is resolved at runtime relative to this module. The
- * installer needs both: the data dir is per-user state, while the package
- * root is what the service-host unit's `ExecStart` line points at.
- */
-
-import { homedir } from 'node:os';
-import { posix, win32, join, resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import type { SupportedPlatform } from './platform.js';
-
-/** Use the path joiner the *target* platform would use, not the runtime's. */
-function joinFor(platform: SupportedPlatform, ...parts: string[]): string {
-  return platform === 'win32' ? win32.join(...parts) : posix.join(...parts);
-}
-
-export interface InstallerEnv {
-  HOME?: string;
-  XDG_DATA_HOME?: string;
-  XDG_CONFIG_HOME?: string;
-  LocalAppData?: string;
-}
-
-/** Default data dir for the given platform. Honors XDG_DATA_HOME / LocalAppData. */
-export function defaultDataDir(
-  platform: SupportedPlatform,
-  env: InstallerEnv = process.env as InstallerEnv,
-  home: string = homedir(),
-): string {
-  switch (platform) {
-    case 'linux': {
-      const base = env.XDG_DATA_HOME?.trim() || joinFor(platform, env.HOME?.trim() || home, '.local', 'share');
-      return joinFor(platform, base, 'cadre-host');
-    }
-    case 'darwin': {
-      return joinFor(platform, env.HOME?.trim() || home, 'Library', 'Application Support', 'CadreHost');
-    }
-    case 'win32': {
-      // %LocalAppData% is the canonical per-user, non-roaming app data dir.
-      const base = env.LocalAppData?.trim();
-      if (!base) {
-        // Fallback: derive from HOME (works under cygwin/MSYS test envs too).
-        return joinFor(platform, home, 'AppData', 'Local', 'CadreHost');
-      }
-      return joinFor(platform, base, 'CadreHost');
-    }
-  }
-}
-
-/** Path on disk for the installed cadre-host CLI entrypoint. */
-export function defaultHostJs(): string {
-  // dist/installer/paths.js -> ../../dist/bin/host.js
-  // src/installer/paths.ts  -> ../bin/host.ts (only used by tests; build emits dist)
-  const here = dirname(fileURLToPath(import.meta.url));
-  return resolve(here, '..', 'bin', 'host.js');
-}
-
-/** Directory containing service templates (cadre-host.service.tmpl etc.). */
-export function defaultServiceDir(): string {
-  // dist/installer/paths.js -> ../../service/
-  const here = dirname(fileURLToPath(import.meta.url));
-  return resolve(here, '..', '..', 'service');
-}
-
-/** Where the wizard writes the JSON config. */
-export function configPath(dataDir: string): string {
-  return join(dataDir, 'host.config.json');
-}
-
-/** Where the wizard writes the Ed25519 identity. */
-export function identityPath(dataDir: string): string {
-  return join(dataDir, 'identity.key');
-}
-
-/** Logs directory (used by launchd / NSSM unit templates). */
-export function logsDir(dataDir: string): string {
-  return join(dataDir, 'logs');
-}
-
-/** Per-platform install dir for the rendered service unit file. */
-export function serviceInstallPath(
-  platform: SupportedPlatform,
-  env: InstallerEnv = process.env as InstallerEnv,
-  home: string = homedir(),
-): string {
-  const hd = env.HOME?.trim() || home;
-  switch (platform) {
-    case 'linux': {
-      const base = env.XDG_CONFIG_HOME?.trim() || joinFor(platform, hd, '.config');
-      return joinFor(platform, base, 'systemd', 'user', 'cadre-host.service');
-    }
-    case 'darwin': {
-      return joinFor(platform, hd, 'Library', 'LaunchAgents', 'com.serfab.cadre-host.plist');
-    }
-    case 'win32': {
-      // NSSM stores service config in the registry; this path is unused
-      // on Windows but returned for symmetry / logging.
-      return 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\CadreHost';
-    }
-  }
-}
+/**
+ * Per-platform default paths for the installer.
+ *
+ * Linux:   XDG_DATA_HOME / ~/.local/share/cadre-host
+ * macOS:   ~/Library/Application Support/CadreHost
+ * Windows: %LocalAppData%\CadreHost
+ *
+ * The package root (where the installed `dist/bin/host.js` and `service/`
+ * directory live) is resolved at runtime relative to this module. The
+ * installer needs both: the data dir is per-user state, while the package
+ * root is what the service-host unit's `ExecStart` line points at.
+ */
+
+import { homedir } from 'node:os';
+import { posix, win32, join, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import type { SupportedPlatform } from './platform.js';
+
+/** Use the path joiner the *target* platform would use, not the runtime's. */
+function joinFor(platform: SupportedPlatform, ...parts: string[]): string {
+  return platform === 'win32' ? win32.join(...parts) : posix.join(...parts);
+}
+
+export interface InstallerEnv {
+  HOME?: string;
+  XDG_DATA_HOME?: string;
+  XDG_CONFIG_HOME?: string;
+  LocalAppData?: string;
+}
+
+/** Default data dir for the given platform. Honors XDG_DATA_HOME / LocalAppData. */
+export function defaultDataDir(
+  platform: SupportedPlatform,
+  env: InstallerEnv = process.env as InstallerEnv,
+  home: string = homedir(),
+): string {
+  switch (platform) {
+    case 'linux': {
+      const base = env.XDG_DATA_HOME?.trim() || joinFor(platform, env.HOME?.trim() || home, '.local', 'share');
+      return joinFor(platform, base, 'cadre-host');
+    }
+    case 'darwin': {
+      return joinFor(platform, env.HOME?.trim() || home, 'Library', 'Application Support', 'CadreHost');
+    }
+    case 'win32': {
+      // %LocalAppData% is the canonical per-user, non-roaming app data dir.
+      const base = env.LocalAppData?.trim();
+      if (!base) {
+        // Fallback: derive from HOME (works under cygwin/MSYS test envs too).
+        return joinFor(platform, home, 'AppData', 'Local', 'CadreHost');
+      }
+      return joinFor(platform, base, 'CadreHost');
+    }
+  }
+}
+
+/** Path on disk for the installed cadre-host CLI entrypoint. */
+export function defaultHostJs(): string {
+  // dist/installer/paths.js -> ../../dist/bin/host.js
+  // src/installer/paths.ts  -> ../bin/host.ts (only used by tests; build emits dist)
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolve(here, '..', 'bin', 'host.js');
+}
+
+/** Directory containing service templates (cadre-host.service.tmpl etc.). */
+export function defaultServiceDir(): string {
+  // dist/installer/paths.js -> ../../service/
+  const here = dirname(fileURLToPath(import.meta.url));
+  return resolve(here, '..', '..', 'service');
+}
+
+/** Where the wizard writes the JSON config. */
+export function configPath(dataDir: string): string {
+  return join(dataDir, 'host.config.json');
+}
+
+/** Where the wizard writes the Ed25519 identity. */
+export function identityPath(dataDir: string): string {
+  return join(dataDir, 'identity.key');
+}
+
+/** Logs directory (used by launchd / NSSM unit templates). */
+export function logsDir(dataDir: string): string {
+  return join(dataDir, 'logs');
+}
+
+/** Per-platform install dir for the rendered service unit file. */
+export function serviceInstallPath(
+  platform: SupportedPlatform,
+  env: InstallerEnv = process.env as InstallerEnv,
+  home: string = homedir(),
+): string {
+  const hd = env.HOME?.trim() || home;
+  switch (platform) {
+    case 'linux': {
+      const base = env.XDG_CONFIG_HOME?.trim() || joinFor(platform, hd, '.config');
+      return joinFor(platform, base, 'systemd', 'user', 'cadre-host.service');
+    }
+    case 'darwin': {
+      return joinFor(platform, hd, 'Library', 'LaunchAgents', 'com.serfab.cadre-host.plist');
+    }
+    case 'win32': {
+      // NSSM stores service config in the registry; this path is unused
+      // on Windows but returned for symmetry / logging.
+      return 'HKLM\\SYSTEM\\CurrentControlSet\\Services\\CadreHost';
+    }
+  }
+}

package/src/installer/platform.ts

@@ -1,27 +1,27 @@
-/**
- * Platform detection helpers for the installer.
- *
- * Kept narrow on purpose — `process.platform` everywhere else in the
- * installer is funneled through here so tests can stub a single point.
- */
-
-export type SupportedPlatform = 'linux' | 'darwin' | 'win32';
-
-const SUPPORTED: ReadonlySet<NodeJS.Platform> = new Set<NodeJS.Platform>([
-  'linux',
-  'darwin',
-  'win32',
-]);
-
-export function detectPlatform(p: NodeJS.Platform = process.platform): SupportedPlatform {
-  if (!SUPPORTED.has(p)) {
-    throw new Error(
-      `Unsupported platform: ${p}. cadre-host install supports linux, darwin, win32.`,
-    );
-  }
-  return p as SupportedPlatform;
-}
-
-export function isPosix(p: SupportedPlatform): boolean {
-  return p === 'linux' || p === 'darwin';
-}
+/**
+ * Platform detection helpers for the installer.
+ *
+ * Kept narrow on purpose — `process.platform` everywhere else in the
+ * installer is funneled through here so tests can stub a single point.
+ */
+
+export type SupportedPlatform = 'linux' | 'darwin' | 'win32';
+
+const SUPPORTED: ReadonlySet<NodeJS.Platform> = new Set<NodeJS.Platform>([
+  'linux',
+  'darwin',
+  'win32',
+]);
+
+export function detectPlatform(p: NodeJS.Platform = process.platform): SupportedPlatform {
+  if (!SUPPORTED.has(p)) {
+    throw new Error(
+      `Unsupported platform: ${p}. cadre-host install supports linux, darwin, win32.`,
+    );
+  }
+  return p as SupportedPlatform;
+}
+
+export function isPosix(p: SupportedPlatform): boolean {
+  return p === 'linux' || p === 'darwin';
+}

package/src/installer/service-host/index.ts

@@ -1,21 +1,21 @@
-/**
- * Pick the right service-host impl for the current platform.
- */
-
-import { detectPlatform, type SupportedPlatform } from '../platform.js';
-import { SystemdServiceHost } from './systemd.js';
-import { LaunchdServiceHost } from './launchd.js';
-import { NssmServiceHost } from './nssm.js';
-import type { ServiceHost } from './types.js';
-
-export type { ServiceHost, ServiceHostContext, ServiceHostStatus } from './types.js';
-
-export function createServiceHost(platform: SupportedPlatform = detectPlatform()): ServiceHost {
-  switch (platform) {
-    case 'linux':  return new SystemdServiceHost();
-    case 'darwin': return new LaunchdServiceHost();
-    case 'win32':  return new NssmServiceHost();
-  }
-}
-
-export { SystemdServiceHost, LaunchdServiceHost, NssmServiceHost };
+/**
+ * Pick the right service-host impl for the current platform.
+ */
+
+import { detectPlatform, type SupportedPlatform } from '../platform.js';
+import { SystemdServiceHost } from './systemd.js';
+import { LaunchdServiceHost } from './launchd.js';
+import { NssmServiceHost } from './nssm.js';
+import type { ServiceHost } from './types.js';
+
+export type { ServiceHost, ServiceHostContext, ServiceHostStatus } from './types.js';
+
+export function createServiceHost(platform: SupportedPlatform = detectPlatform()): ServiceHost {
+  switch (platform) {
+    case 'linux':  return new SystemdServiceHost();
+    case 'darwin': return new LaunchdServiceHost();
+    case 'win32':  return new NssmServiceHost();
+  }
+}
+
+export { SystemdServiceHost, LaunchdServiceHost, NssmServiceHost };