@stanleysun233/oneproxy-cli 1.0.10 → 1.0.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/commands.js +1 -0
- package/dist/commands.js.map +1 -1
- package/dist/control-plane.d.ts +1 -0
- package/dist/control-plane.js +58 -9
- package/dist/control-plane.js.map +1 -1
- package/dist/daemon/http-proxy.d.ts +2 -1
- package/dist/daemon/http-proxy.js +14 -8
- package/dist/daemon/http-proxy.js.map +1 -1
- package/dist/daemon/lifecycle.d.ts +1 -0
- package/dist/daemon/lifecycle.js +2 -1
- package/dist/daemon/lifecycle.js.map +1 -1
- package/dist/daemon/router.d.ts +2 -1
- package/dist/daemon/router.js +12 -2
- package/dist/daemon/router.js.map +1 -1
- package/dist/main.js +18 -4
- package/dist/main.js.map +1 -1
- package/dist/run-isolation.d.ts +22 -0
- package/dist/run-isolation.js +249 -0
- package/dist/run-isolation.js.map +1 -0
- package/dist/session-env.d.ts +7 -5
- package/dist/session-env.js +109 -101
- package/dist/session-env.js.map +1 -1
- package/dist/shell-detect.d.ts +8 -0
- package/dist/shell-detect.js +69 -0
- package/dist/shell-detect.js.map +1 -0
- package/dist/shell.js +9 -21
- package/dist/shell.js.map +1 -1
- package/dist/storage.d.ts +2 -0
- package/dist/storage.js.map +1 -1
- package/dist/update-check.d.ts +2 -0
- package/dist/update-check.js +141 -0
- package/dist/update-check.js.map +1 -0
- package/package.json +1 -1
package/dist/main.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC1H,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC9G,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAQzD,KAAK,UAAU,cAAc;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;IAC9H,OAAO,WAAW,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACtC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,KAAK;IACZ,OAAO;QACL,iCAAiC;QACjC,EAAE;QACF,WAAW;QACX,QAAQ;QACR,WAAW;QACX,SAAS;QACT,UAAU;QACV,oEAAoE;QACpE,gCAAgC;QAChC,+BAA+B;QAC/B,QAAQ;QACR,mBAAmB;QACnB,gBAAgB;QAChB,SAAS;QACT,oBAAoB;QACpB,wBAAwB;QACxB,wEAAwE;QACxE,gCAAgC;QAChC,+BAA+B;QAC/B,oCAAoC;QACpC,mBAAmB;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB,EAAE,OAAe;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAmC;IAC/C,OAAO,EAAE,KAAK,IAAI,EAAE;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,KAAK;IACL,IAAI,EAAE,WAAW;IACjB,MAAM;IACN,IAAI;IACJ,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,WAAW;IACjB,MAAM;IACN,OAAO,EAAE,cAAc;IACvB,GAAG,EAAE,MAAM;IACX,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,YAAY;IACnB,OAAO,EAAE,cAAc;IACvB,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,WAAW,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,yCAAyC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oBAAoB,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,cAAc,EAAE,CAAC,EAAE,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC;AAED,IAAI,EAAE;KACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACf,UAAU,CAAC;QACT,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,gBAAgB;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;KACxC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
export type IsolatedRunInput = {
|
|
2
|
+
executable: string;
|
|
3
|
+
args: string[];
|
|
4
|
+
env: NodeJS.ProcessEnv;
|
|
5
|
+
proxyPort: number;
|
|
6
|
+
};
|
|
7
|
+
type FirewallRule = {
|
|
8
|
+
command: 'iptables' | 'ip6tables';
|
|
9
|
+
add: string[];
|
|
10
|
+
remove: string[];
|
|
11
|
+
};
|
|
12
|
+
export declare function runProxyOnlyIsolatedCommand(input: IsolatedRunInput): Promise<number>;
|
|
13
|
+
export declare function runProxyOnlyBestEffortCommand(input: IsolatedRunInput): Promise<number>;
|
|
14
|
+
export declare function isProxyIsolationUnavailable(error: unknown): boolean;
|
|
15
|
+
export declare function proxyIsolationHelp(error: unknown): string[];
|
|
16
|
+
declare function firewallRules(proxyPort: number, cgroupPath: string): FirewallRule[];
|
|
17
|
+
export declare const runIsolationInternals: {
|
|
18
|
+
isProxyIsolationUnavailable: typeof isProxyIsolationUnavailable;
|
|
19
|
+
proxyIsolationHelp: typeof proxyIsolationHelp;
|
|
20
|
+
firewallRules: typeof firewallRules;
|
|
21
|
+
};
|
|
22
|
+
export {};
|
|
@@ -0,0 +1,249 @@
|
|
|
1
|
+
import { execFile } from 'node:child_process';
|
|
2
|
+
import { spawn } from 'node:child_process';
|
|
3
|
+
import * as fs from 'node:fs/promises';
|
|
4
|
+
import * as fsSync from 'node:fs';
|
|
5
|
+
import * as path from 'node:path';
|
|
6
|
+
import { promisify } from 'node:util';
|
|
7
|
+
const execFileAsync = promisify(execFile);
|
|
8
|
+
const cgroupRoot = '/sys/fs/cgroup';
|
|
9
|
+
export async function runProxyOnlyIsolatedCommand(input) {
|
|
10
|
+
await requireProxyIsolationSupport();
|
|
11
|
+
const cgroup = await createRunCgroup().catch((error) => {
|
|
12
|
+
throw proxyIsolationUnavailable('cgroup_create_failed', 'onep run could not create cgroup isolation.', error);
|
|
13
|
+
});
|
|
14
|
+
const rules = firewallRules(input.proxyPort, cgroup.relativePath);
|
|
15
|
+
const installed = [];
|
|
16
|
+
try {
|
|
17
|
+
for (const rule of [...rules].reverse()) {
|
|
18
|
+
await execFileAsync(rule.command, rule.add).catch((error) => {
|
|
19
|
+
throw proxyIsolationUnavailable('firewall_install_failed', 'onep run could not install proxy isolation firewall rules.', error);
|
|
20
|
+
});
|
|
21
|
+
installed.push(rule);
|
|
22
|
+
}
|
|
23
|
+
return await spawnInCgroup(input, cgroup.path);
|
|
24
|
+
}
|
|
25
|
+
finally {
|
|
26
|
+
await killCgroupProcesses(cgroup.path);
|
|
27
|
+
for (const rule of installed) {
|
|
28
|
+
await execFileAsync(rule.command, rule.remove).catch(() => { });
|
|
29
|
+
}
|
|
30
|
+
await fs.rm(cgroup.path, { recursive: true, force: true });
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
export async function runProxyOnlyBestEffortCommand(input) {
|
|
34
|
+
const child = spawn(input.executable, input.args, {
|
|
35
|
+
stdio: 'inherit',
|
|
36
|
+
env: input.env
|
|
37
|
+
});
|
|
38
|
+
if (!child.pid) {
|
|
39
|
+
throw Object.assign(new Error('Unable to start command.'), { code: 'COMMAND_NOT_FOUND' });
|
|
40
|
+
}
|
|
41
|
+
const signalHandlers = installSignalHandlers(child.pid);
|
|
42
|
+
try {
|
|
43
|
+
return await waitForChild(child);
|
|
44
|
+
}
|
|
45
|
+
finally {
|
|
46
|
+
for (const [signal, handler] of signalHandlers) {
|
|
47
|
+
process.off(signal, handler);
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
export function isProxyIsolationUnavailable(error) {
|
|
52
|
+
return typeof error === 'object' && error !== null && 'code' in error && error.code === 'PROXY_ISOLATION_REQUIRED';
|
|
53
|
+
}
|
|
54
|
+
export function proxyIsolationHelp(error) {
|
|
55
|
+
if (!isProxyIsolationUnavailable(error)) {
|
|
56
|
+
return [];
|
|
57
|
+
}
|
|
58
|
+
const reason = error.reason;
|
|
59
|
+
switch (reason) {
|
|
60
|
+
case 'not_root':
|
|
61
|
+
return ['For strict isolation, run: sudo onep run <command...>'];
|
|
62
|
+
case 'missing_iptables':
|
|
63
|
+
return [
|
|
64
|
+
'Install iptables/ip6tables for strict isolation:',
|
|
65
|
+
' Debian/Ubuntu: sudo apt-get install iptables',
|
|
66
|
+
' Fedora/RHEL: sudo dnf install iptables iptables-nft',
|
|
67
|
+
' Arch: sudo pacman -S iptables'
|
|
68
|
+
];
|
|
69
|
+
case 'missing_cgroup_v2':
|
|
70
|
+
return [
|
|
71
|
+
'Enable cgroup v2 at /sys/fs/cgroup for strict isolation.',
|
|
72
|
+
'cgroup v2 is a Linux host capability, not a OneProxy package dependency.',
|
|
73
|
+
'On systemd Linux, /sys/fs/cgroup should be mounted as cgroup2fs.'
|
|
74
|
+
];
|
|
75
|
+
case 'cgroup_create_failed':
|
|
76
|
+
return ['Check that cgroup v2 is mounted at /sys/fs/cgroup and writable by root.'];
|
|
77
|
+
case 'firewall_install_failed':
|
|
78
|
+
return [
|
|
79
|
+
'Check that iptables/ip6tables and the cgroup match module are available.',
|
|
80
|
+
' Debian/Ubuntu: sudo apt-get install iptables',
|
|
81
|
+
' Fedora/RHEL: sudo dnf install iptables iptables-nft',
|
|
82
|
+
' Arch: sudo pacman -S iptables'
|
|
83
|
+
];
|
|
84
|
+
case 'non_linux':
|
|
85
|
+
return ['Strict isolation is only available on Linux.'];
|
|
86
|
+
default:
|
|
87
|
+
return [];
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
async function requireProxyIsolationSupport() {
|
|
91
|
+
if (process.platform !== 'linux') {
|
|
92
|
+
throw proxyIsolationUnavailable('non_linux', 'onep run requires Linux proxy isolation.');
|
|
93
|
+
}
|
|
94
|
+
if (typeof process.getuid !== 'function' || process.getuid() !== 0) {
|
|
95
|
+
throw proxyIsolationUnavailable('not_root', 'onep run requires root so direct network egress can be blocked.');
|
|
96
|
+
}
|
|
97
|
+
if (!fsSync.existsSync(path.join(cgroupRoot, 'cgroup.controllers'))) {
|
|
98
|
+
throw proxyIsolationUnavailable('missing_cgroup_v2', 'onep run requires cgroup v2 at /sys/fs/cgroup.');
|
|
99
|
+
}
|
|
100
|
+
await Promise.all([
|
|
101
|
+
execFileAsync('iptables', ['--version']),
|
|
102
|
+
execFileAsync('ip6tables', ['--version'])
|
|
103
|
+
]).catch((error) => {
|
|
104
|
+
throw proxyIsolationUnavailable('missing_iptables', 'onep run requires iptables and ip6tables for proxy isolation.', error);
|
|
105
|
+
});
|
|
106
|
+
}
|
|
107
|
+
function proxyIsolationUnavailable(reason, message, cause) {
|
|
108
|
+
return Object.assign(new Error(message), { code: 'PROXY_ISOLATION_REQUIRED', exitCode: 2, reason, cause });
|
|
109
|
+
}
|
|
110
|
+
async function createRunCgroup() {
|
|
111
|
+
const relativePath = `oneproxy-run-${process.pid}-${Date.now()}`;
|
|
112
|
+
const cgroupPath = path.join(cgroupRoot, relativePath);
|
|
113
|
+
await fs.mkdir(cgroupPath, { mode: 0o700 });
|
|
114
|
+
return { path: cgroupPath, relativePath };
|
|
115
|
+
}
|
|
116
|
+
function firewallRules(proxyPort, cgroupPath) {
|
|
117
|
+
return [
|
|
118
|
+
rule('iptables', [
|
|
119
|
+
'-p', 'tcp',
|
|
120
|
+
'-m', 'cgroup', '--path', cgroupPath,
|
|
121
|
+
'-d', '127.0.0.1/32',
|
|
122
|
+
'--dport', String(proxyPort),
|
|
123
|
+
'-j', 'ACCEPT'
|
|
124
|
+
]),
|
|
125
|
+
rule('iptables', [
|
|
126
|
+
'-m', 'cgroup', '--path', cgroupPath,
|
|
127
|
+
'-j', 'REJECT'
|
|
128
|
+
]),
|
|
129
|
+
rule('ip6tables', [
|
|
130
|
+
'-m', 'cgroup', '--path', cgroupPath,
|
|
131
|
+
'-j', 'REJECT'
|
|
132
|
+
])
|
|
133
|
+
];
|
|
134
|
+
}
|
|
135
|
+
function rule(command, match) {
|
|
136
|
+
return {
|
|
137
|
+
command,
|
|
138
|
+
add: ['-I', 'OUTPUT', '1', ...match],
|
|
139
|
+
remove: ['-D', 'OUTPUT', ...match]
|
|
140
|
+
};
|
|
141
|
+
}
|
|
142
|
+
async function spawnInCgroup(input, cgroupPath) {
|
|
143
|
+
const child = spawn('/bin/sh', ['-c', 'kill -STOP $$; exec "$@"', 'onep-run-child', input.executable, ...input.args], {
|
|
144
|
+
stdio: 'inherit',
|
|
145
|
+
env: input.env,
|
|
146
|
+
...originalUserIdentity()
|
|
147
|
+
});
|
|
148
|
+
if (!child.pid) {
|
|
149
|
+
throw Object.assign(new Error('Unable to start isolated command.'), { code: 'COMMAND_NOT_FOUND' });
|
|
150
|
+
}
|
|
151
|
+
const signalHandlers = installSignalHandlers(child.pid);
|
|
152
|
+
try {
|
|
153
|
+
await fs.writeFile(path.join(cgroupPath, 'cgroup.procs'), String(child.pid));
|
|
154
|
+
process.kill(child.pid, 'SIGCONT');
|
|
155
|
+
return await waitForChild(child);
|
|
156
|
+
}
|
|
157
|
+
catch (error) {
|
|
158
|
+
try {
|
|
159
|
+
process.kill(child.pid, 'SIGKILL');
|
|
160
|
+
}
|
|
161
|
+
catch { }
|
|
162
|
+
throw error;
|
|
163
|
+
}
|
|
164
|
+
finally {
|
|
165
|
+
for (const [signal, handler] of signalHandlers) {
|
|
166
|
+
process.off(signal, handler);
|
|
167
|
+
}
|
|
168
|
+
}
|
|
169
|
+
}
|
|
170
|
+
function installSignalHandlers(childPid) {
|
|
171
|
+
const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
|
|
172
|
+
return signals.map((signal) => {
|
|
173
|
+
const handler = () => {
|
|
174
|
+
try {
|
|
175
|
+
process.kill(childPid, signal);
|
|
176
|
+
}
|
|
177
|
+
catch { }
|
|
178
|
+
};
|
|
179
|
+
process.on(signal, handler);
|
|
180
|
+
return [signal, handler];
|
|
181
|
+
});
|
|
182
|
+
}
|
|
183
|
+
function waitForChild(child) {
|
|
184
|
+
return new Promise((resolve, reject) => {
|
|
185
|
+
child.once('error', (error) => {
|
|
186
|
+
if (error.code === 'ENOENT') {
|
|
187
|
+
reject(Object.assign(new Error(`Command not found: ${child.spawnfile}`), { code: 'COMMAND_NOT_FOUND' }));
|
|
188
|
+
return;
|
|
189
|
+
}
|
|
190
|
+
reject(error);
|
|
191
|
+
});
|
|
192
|
+
child.once('exit', (code, signal) => resolve(signal ? 1 : code ?? 0));
|
|
193
|
+
});
|
|
194
|
+
}
|
|
195
|
+
async function killCgroupProcesses(cgroupPath) {
|
|
196
|
+
for (let attempt = 0; attempt < 20; attempt += 1) {
|
|
197
|
+
const pids = await readCgroupPids(cgroupPath);
|
|
198
|
+
if (pids.length === 0) {
|
|
199
|
+
return;
|
|
200
|
+
}
|
|
201
|
+
for (const pid of pids) {
|
|
202
|
+
try {
|
|
203
|
+
process.kill(pid, 'SIGKILL');
|
|
204
|
+
}
|
|
205
|
+
catch { }
|
|
206
|
+
}
|
|
207
|
+
await new Promise((resolve) => setTimeout(resolve, 25));
|
|
208
|
+
}
|
|
209
|
+
const pids = await readCgroupPids(cgroupPath);
|
|
210
|
+
if (pids.length > 0) {
|
|
211
|
+
throw Object.assign(new Error('Unable to stop isolated child processes; firewall rules were left installed to prevent direct egress.'), { code: 'PROXY_ISOLATION_CLEANUP_FAILED' });
|
|
212
|
+
}
|
|
213
|
+
}
|
|
214
|
+
async function readCgroupPids(cgroupPath) {
|
|
215
|
+
try {
|
|
216
|
+
const body = await fs.readFile(path.join(cgroupPath, 'cgroup.procs'), 'utf8');
|
|
217
|
+
return body
|
|
218
|
+
.split(/\s+/)
|
|
219
|
+
.map((value) => Number(value))
|
|
220
|
+
.filter((pid) => Number.isInteger(pid) && pid > 0);
|
|
221
|
+
}
|
|
222
|
+
catch {
|
|
223
|
+
return [];
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
function originalUserIdentity() {
|
|
227
|
+
if (typeof process.getuid !== 'function' || process.getuid() !== 0) {
|
|
228
|
+
return {};
|
|
229
|
+
}
|
|
230
|
+
const uid = numericEnv('SUDO_UID');
|
|
231
|
+
const gid = numericEnv('SUDO_GID');
|
|
232
|
+
if (uid === undefined || gid === undefined || uid === 0 || gid === 0) {
|
|
233
|
+
return {};
|
|
234
|
+
}
|
|
235
|
+
return { uid, gid };
|
|
236
|
+
}
|
|
237
|
+
function numericEnv(key) {
|
|
238
|
+
const value = process.env[key];
|
|
239
|
+
if (!value || !/^\d+$/.test(value)) {
|
|
240
|
+
return undefined;
|
|
241
|
+
}
|
|
242
|
+
return Number(value);
|
|
243
|
+
}
|
|
244
|
+
export const runIsolationInternals = {
|
|
245
|
+
isProxyIsolationUnavailable,
|
|
246
|
+
proxyIsolationHelp,
|
|
247
|
+
firewallRules
|
|
248
|
+
};
|
|
249
|
+
//# sourceMappingURL=run-isolation.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"run-isolation.js","sourceRoot":"","sources":["../src/run-isolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAuBpC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAuB;IACvE,MAAM,4BAA4B,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACrD,MAAM,yBAAyB,CAAC,sBAAsB,EAAE,6CAA6C,EAAE,KAAK,CAAC,CAAC;IAChH,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAClE,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC1D,MAAM,yBAAyB,CAAC,yBAAyB,EAAE,4DAA4D,EAAE,KAAK,CAAC,CAAC;YAClI,CAAC,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,MAAM,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAAuB;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE;QAChD,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,0BAA0B,CAAC;AAC7I,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAI,KAA2C,CAAC,MAAM,CAAC;IACnE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU;YACb,OAAO,CAAC,uDAAuD,CAAC,CAAC;QACnE,KAAK,kBAAkB;YACrB,OAAO;gBACL,kDAAkD;gBAClD,gDAAgD;gBAChD,uDAAuD;gBACvD,iCAAiC;aAClC,CAAC;QACJ,KAAK,mBAAmB;YACtB,OAAO;gBACL,0DAA0D;gBAC1D,0EAA0E;gBAC1E,kEAAkE;aACnE,CAAC;QACJ,KAAK,sBAAsB;YACzB,OAAO,CAAC,yEAAyE,CAAC,CAAC;QACrF,KAAK,yBAAyB;YAC5B,OAAO;gBACL,0EAA0E;gBAC1E,gDAAgD;gBAChD,uDAAuD;gBACvD,iCAAiC;aAClC,CAAC;QACJ,KAAK,WAAW;YACd,OAAO,CAAC,8CAA8C,CAAC,CAAC;QAC1D;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,yBAAyB,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,yBAAyB,CAAC,UAAU,EAAE,iEAAiE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,yBAAyB,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,aAAa,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC;QACxC,aAAa,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC;KAC1C,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACjB,MAAM,yBAAyB,CAAC,kBAAkB,EAAE,+DAA+D,EAAE,KAAK,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA4B,EAAE,OAAe,EAAE,KAAe;IAC/F,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,YAAY,GAAG,gBAAgB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,UAAkB;IAC1D,OAAO;QACL,IAAI,CAAC,UAAU,EAAE;YACf,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU;YACpC,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;YAC5B,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,IAAI,CAAC,UAAU,EAAE;YACf,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU;YACpC,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,IAAI,CAAC,WAAW,EAAE;YAChB,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU;YACpC,IAAI,EAAE,QAAQ;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAgC,EAAE,KAAe;IAC7D,OAAO;QACL,OAAO;QACP,GAAG,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAuB,EAAE,UAAkB;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;QACpH,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,oBAAoB,EAAE;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnC,OAAO,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,cAAc,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5B,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAA+B;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBACzG,OAAO;YACT,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACnD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uGAAuG,CAAC,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACtL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,OAAO,IAAI;aACR,KAAK,CAAC,KAAK,CAAC;aACZ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,2BAA2B;IAC3B,kBAAkB;IAClB,aAAa;CACd,CAAC"}
|
package/dist/session-env.d.ts
CHANGED
|
@@ -1,11 +1,13 @@
|
|
|
1
1
|
import type { CliContext } from './main.ts';
|
|
2
2
|
import { type DaemonBindings } from './storage.ts';
|
|
3
3
|
export declare function ensureSessionProxyBindings(): Promise<DaemonBindings>;
|
|
4
|
-
export declare function proxyEnv(bindings: DaemonBindings): Record<string, string>;
|
|
5
|
-
export declare function
|
|
6
|
-
export declare function
|
|
7
|
-
export declare function
|
|
8
|
-
export declare function
|
|
4
|
+
export declare function proxyEnv(bindings: DaemonBindings, extraNoProxyHosts?: string[]): Record<string, string>;
|
|
5
|
+
export declare function proxyOnlyEnv(bindings: DaemonBindings): Record<string, string>;
|
|
6
|
+
export declare function sessionProxyEnv(bindings?: DaemonBindings): Promise<Record<string, string>>;
|
|
7
|
+
export declare function parseEnvCommandArgs(argv: string[]): {};
|
|
8
|
+
export declare function envOn(args?: string[]): Promise<void>;
|
|
9
|
+
export declare function envOff(args?: string[]): Promise<void>;
|
|
10
|
+
export declare function runCommand(args: string[], context: CliContext): Promise<number>;
|
|
9
11
|
export declare function parseRunCommandArgs(argv: string[]): {
|
|
10
12
|
args: string[];
|
|
11
13
|
tui: boolean;
|
package/dist/session-env.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import {
|
|
3
|
-
import {
|
|
1
|
+
import { isProxyIsolationUnavailable, proxyIsolationHelp, runProxyOnlyBestEffortCommand, runProxyOnlyIsolatedCommand } from "./run-isolation.js";
|
|
2
|
+
import { detectShellFamily } from "./shell-detect.js";
|
|
3
|
+
import { readConfig, readState } from "./storage.js";
|
|
4
4
|
const preservedProxyVariables = [
|
|
5
5
|
'HTTP_PROXY',
|
|
6
6
|
'HTTPS_PROXY',
|
|
@@ -27,34 +27,74 @@ export async function ensureSessionProxyBindings() {
|
|
|
27
27
|
}
|
|
28
28
|
return lifecycle;
|
|
29
29
|
}
|
|
30
|
-
export function proxyEnv(bindings) {
|
|
30
|
+
export function proxyEnv(bindings, extraNoProxyHosts = []) {
|
|
31
31
|
const httpProxy = `http://${bindings.host}:${bindings.httpPort}`;
|
|
32
32
|
const httpsProxy = `http://${bindings.host}:${bindings.httpsPort}`;
|
|
33
|
+
const noProxy = noProxyValue(extraNoProxyHosts);
|
|
33
34
|
return {
|
|
34
35
|
HTTP_PROXY: httpProxy,
|
|
35
36
|
HTTPS_PROXY: httpsProxy,
|
|
36
37
|
ALL_PROXY: httpProxy,
|
|
37
|
-
NO_PROXY:
|
|
38
|
+
NO_PROXY: noProxy,
|
|
39
|
+
http_proxy: httpProxy,
|
|
40
|
+
https_proxy: httpsProxy,
|
|
41
|
+
all_proxy: httpProxy,
|
|
42
|
+
no_proxy: noProxy,
|
|
38
43
|
ONEPROXY_ACTIVE: '1',
|
|
39
44
|
ONEPROXY_HTTP_PORT: String(bindings.httpPort),
|
|
40
45
|
ONEPROXY_HTTPS_PORT: String(bindings.httpsPort)
|
|
41
46
|
};
|
|
42
47
|
}
|
|
43
|
-
export
|
|
44
|
-
|
|
48
|
+
export function proxyOnlyEnv(bindings) {
|
|
49
|
+
if (!bindings.proxyOnlyPort) {
|
|
50
|
+
throw Object.assign(new Error('Daemon did not return proxy-only binding'), { code: 'DAEMON_UNAVAILABLE' });
|
|
51
|
+
}
|
|
52
|
+
const proxy = `http://${bindings.host}:${bindings.proxyOnlyPort}`;
|
|
53
|
+
return {
|
|
54
|
+
HTTP_PROXY: proxy,
|
|
55
|
+
HTTPS_PROXY: proxy,
|
|
56
|
+
ALL_PROXY: proxy,
|
|
57
|
+
NO_PROXY: '',
|
|
58
|
+
http_proxy: proxy,
|
|
59
|
+
https_proxy: proxy,
|
|
60
|
+
all_proxy: proxy,
|
|
61
|
+
no_proxy: '',
|
|
62
|
+
ONEPROXY_ACTIVE: '1',
|
|
63
|
+
ONEPROXY_PROXY_ONLY: '1',
|
|
64
|
+
ONEPROXY_HTTP_PORT: String(bindings.proxyOnlyPort),
|
|
65
|
+
ONEPROXY_HTTPS_PORT: String(bindings.proxyOnlyPort)
|
|
66
|
+
};
|
|
67
|
+
}
|
|
68
|
+
export async function sessionProxyEnv(bindings) {
|
|
69
|
+
const resolvedBindings = bindings ?? await ensureSessionProxyBindings();
|
|
70
|
+
const env = proxyEnv(resolvedBindings);
|
|
71
|
+
const noProxy = noProxyValue(await proxyBypassHosts());
|
|
72
|
+
return {
|
|
73
|
+
...env,
|
|
74
|
+
NO_PROXY: noProxy,
|
|
75
|
+
no_proxy: noProxy
|
|
76
|
+
};
|
|
45
77
|
}
|
|
46
|
-
function
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
78
|
+
function noProxyValue(extraHosts = []) {
|
|
79
|
+
return [...new Set(['localhost', '127.0.0.1', '::1', ...extraHosts].map((item) => item.trim()).filter(Boolean))].join(',');
|
|
80
|
+
}
|
|
81
|
+
async function proxyBypassHosts() {
|
|
82
|
+
const [config, state] = await Promise.all([readConfig(), readState()]);
|
|
83
|
+
return [
|
|
84
|
+
hostnameFromUrl(config.controlPlaneUrl),
|
|
85
|
+
...(state.bootstrap?.entryNodes ?? []).map((node) => node.host)
|
|
86
|
+
].filter(Boolean);
|
|
87
|
+
}
|
|
88
|
+
function hostnameFromUrl(value) {
|
|
89
|
+
if (!value) {
|
|
90
|
+
return '';
|
|
50
91
|
}
|
|
51
|
-
|
|
52
|
-
return
|
|
92
|
+
try {
|
|
93
|
+
return new URL(value).hostname;
|
|
53
94
|
}
|
|
54
|
-
|
|
55
|
-
return '
|
|
95
|
+
catch {
|
|
96
|
+
return '';
|
|
56
97
|
}
|
|
57
|
-
return 'posix';
|
|
58
98
|
}
|
|
59
99
|
function quotePosix(value) {
|
|
60
100
|
return `'${value.replace(/'/g, "'\\''")}'`;
|
|
@@ -148,9 +188,8 @@ function cmdOff() {
|
|
|
148
188
|
}
|
|
149
189
|
return `${lines.join('\r\n')}\r\n`;
|
|
150
190
|
}
|
|
151
|
-
function activationScript(
|
|
152
|
-
|
|
153
|
-
switch (shellFamily()) {
|
|
191
|
+
function activationScript(env) {
|
|
192
|
+
switch (detectShellFamily()) {
|
|
154
193
|
case 'fish':
|
|
155
194
|
return fishOn(env);
|
|
156
195
|
case 'powershell':
|
|
@@ -162,7 +201,7 @@ function activationScript(bindings) {
|
|
|
162
201
|
}
|
|
163
202
|
}
|
|
164
203
|
function deactivationScript() {
|
|
165
|
-
switch (
|
|
204
|
+
switch (detectShellFamily()) {
|
|
166
205
|
case 'fish':
|
|
167
206
|
return fishOff();
|
|
168
207
|
case 'powershell':
|
|
@@ -173,72 +212,69 @@ function deactivationScript() {
|
|
|
173
212
|
return posixOff();
|
|
174
213
|
}
|
|
175
214
|
}
|
|
176
|
-
export
|
|
177
|
-
|
|
178
|
-
}
|
|
179
|
-
|
|
180
|
-
|
|
215
|
+
export function parseEnvCommandArgs(argv) {
|
|
216
|
+
for (const value of argv) {
|
|
217
|
+
throw Object.assign(new Error(`Unknown env option: ${value}`), { code: 'SYNTAX_ERROR', exitCode: 2 });
|
|
218
|
+
}
|
|
219
|
+
return {};
|
|
181
220
|
}
|
|
182
|
-
function
|
|
183
|
-
|
|
221
|
+
export async function envOn(args = []) {
|
|
222
|
+
parseEnvCommandArgs(args);
|
|
223
|
+
process.stdout.write(activationScript(await sessionProxyEnv()));
|
|
184
224
|
}
|
|
185
|
-
function
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
return spawn(shell, ['/d', '/s', '/c', command], {
|
|
189
|
-
stdio: 'inherit',
|
|
190
|
-
windowsHide: false,
|
|
191
|
-
env
|
|
192
|
-
});
|
|
225
|
+
export async function envOff(args = []) {
|
|
226
|
+
parseEnvCommandArgs(args);
|
|
227
|
+
process.stdout.write(deactivationScript());
|
|
193
228
|
}
|
|
194
|
-
export async function runCommand(args,
|
|
229
|
+
export async function runCommand(args, context) {
|
|
195
230
|
const parsed = parseRunCommandArgs(args);
|
|
196
231
|
const executable = parsed.args[0];
|
|
197
232
|
if (!executable) {
|
|
198
233
|
throw Object.assign(new Error('run requires a command.'), { code: 'COMMAND_NOT_FOUND', exitCode: 2 });
|
|
199
234
|
}
|
|
200
|
-
if (!_context.json) {
|
|
201
|
-
const tuiExitCode = await tryRunCommandTui(executable, parsed.args.slice(1));
|
|
202
|
-
if (tuiExitCode !== null) {
|
|
203
|
-
return tuiExitCode;
|
|
204
|
-
}
|
|
205
|
-
}
|
|
206
235
|
const lifecycle = (await import("./daemon/lifecycle.js"));
|
|
207
236
|
const session = await lifecycle.startDaemonSession?.();
|
|
208
237
|
if (!session) {
|
|
209
238
|
throw Object.assign(new Error('Daemon lifecycle is unavailable'), { code: 'DAEMON_UNAVAILABLE' });
|
|
210
239
|
}
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
|
|
241
|
-
|
|
240
|
+
try {
|
|
241
|
+
const proxyOnlyPort = session.metadata.bindings.proxyOnlyPort;
|
|
242
|
+
if (!proxyOnlyPort) {
|
|
243
|
+
throw Object.assign(new Error('Daemon did not return proxy-only binding'), { code: 'DAEMON_UNAVAILABLE' });
|
|
244
|
+
}
|
|
245
|
+
const runInput = {
|
|
246
|
+
executable,
|
|
247
|
+
args: parsed.args.slice(1),
|
|
248
|
+
env: {
|
|
249
|
+
...process.env,
|
|
250
|
+
...proxyOnlyEnv(session.metadata.bindings)
|
|
251
|
+
},
|
|
252
|
+
proxyPort: proxyOnlyPort
|
|
253
|
+
};
|
|
254
|
+
try {
|
|
255
|
+
return await runProxyOnlyIsolatedCommand(runInput);
|
|
256
|
+
}
|
|
257
|
+
catch (error) {
|
|
258
|
+
if (!isProxyIsolationUnavailable(error)) {
|
|
259
|
+
throw error;
|
|
260
|
+
}
|
|
261
|
+
if (!context.json) {
|
|
262
|
+
process.stderr.write(proxyIsolationFallbackMessage(error));
|
|
263
|
+
}
|
|
264
|
+
return await runProxyOnlyBestEffortCommand(runInput);
|
|
265
|
+
}
|
|
266
|
+
}
|
|
267
|
+
finally {
|
|
268
|
+
await session.end();
|
|
269
|
+
}
|
|
270
|
+
}
|
|
271
|
+
function proxyIsolationFallbackMessage(error) {
|
|
272
|
+
const lines = [
|
|
273
|
+
'onep run: strict proxy isolation is unavailable; falling back to proxy environment mode.',
|
|
274
|
+
'Programs that ignore HTTP_PROXY/HTTPS_PROXY/ALL_PROXY may bypass OneProxy.',
|
|
275
|
+
...proxyIsolationHelp(error)
|
|
276
|
+
];
|
|
277
|
+
return `${lines.join('\n')}\n`;
|
|
242
278
|
}
|
|
243
279
|
export function parseRunCommandArgs(argv) {
|
|
244
280
|
return stripTuiFlag(argv);
|
|
@@ -256,32 +292,4 @@ function stripTuiFlag(argv) {
|
|
|
256
292
|
}
|
|
257
293
|
return { args, tui };
|
|
258
294
|
}
|
|
259
|
-
async function tryRunCommandTui(executable, args) {
|
|
260
|
-
const lifecycle = (await import("./daemon/lifecycle.js"));
|
|
261
|
-
const session = await lifecycle.startDaemonSession?.();
|
|
262
|
-
if (!session) {
|
|
263
|
-
throw Object.assign(new Error('Daemon lifecycle is unavailable'), { code: 'DAEMON_UNAVAILABLE' });
|
|
264
|
-
}
|
|
265
|
-
try {
|
|
266
|
-
const result = await runTuiCommand({
|
|
267
|
-
executable,
|
|
268
|
-
args,
|
|
269
|
-
env: {
|
|
270
|
-
...process.env,
|
|
271
|
-
...proxyEnv(session.metadata.bindings)
|
|
272
|
-
},
|
|
273
|
-
status: await buildTuiStatusSnapshot()
|
|
274
|
-
});
|
|
275
|
-
if (!result.available) {
|
|
276
|
-
return null;
|
|
277
|
-
}
|
|
278
|
-
if (typeof result.exitCode !== 'number') {
|
|
279
|
-
throw Object.assign(new Error('TUI exited without a child exit code'), { code: 'TUI_RUNTIME_ERROR' });
|
|
280
|
-
}
|
|
281
|
-
return result.exitCode;
|
|
282
|
-
}
|
|
283
|
-
finally {
|
|
284
|
-
await session.end();
|
|
285
|
-
}
|
|
286
|
-
}
|
|
287
295
|
//# sourceMappingURL=session-env.js.map
|