@swipt/cli 0.1.0-nightly.43 → 0.1.0-nightly.45

package/sideload.mjs

@@ -0,0 +1,649 @@
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import readline from "node:readline";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+
+import { UsageError, open } from "./client.mjs";
+import { apps, coreDevice, devicectl } from "./coredevice.mjs";
+import { printScriptError } from "./output.mjs";
+import { LogLevel } from "./proto/common_pb.js";
+
+const bundleId = "io.nekohasekai.swipt";
+const repository = "swipt-automation/swipt";
+const teamPattern = /^[A-Z0-9]{10}$/;
+const sideloadedPattern = new RegExp(
+  `^${bundleId.replaceAll(".", "\\.")}\\.([A-Z0-9]{10})$`,
+);
+
+const accountsHint = "Xcode › Settings › Accounts";
+
+const passcodeTypes = ["pin", "numeric", "alphanumeric"];
+
+function passcodeOf(options) {
+  const type = options["passcode-type"] ?? "pin";
+  if (!passcodeTypes.includes(type)) {
+    throw new UsageError(
+      `invalid argument ${JSON.stringify(type)} for --passcode-type: it is ${passcodeTypes.join(", ")}`,
+    );
+  }
+  const passcode = options.passcode ?? process.env.SWIPT_PASSCODE;
+  if (!passcode) {
+    return undefined;
+  }
+  const digits = /^\d+$/.test(passcode);
+  if (type === "pin" && !(digits && [4, 6].includes(passcode.length))) {
+    throw new UsageError(
+      "a pin passcode is 4 or 6 digits; a custom one needs --passcode-type numeric or alphanumeric",
+    );
+  }
+  if (type === "numeric" && !digits) {
+    throw new UsageError("a numeric passcode is digits only");
+  }
+  if (!/^[\x20-\x7e]{1,64}$/.test(passcode)) {
+    throw new UsageError("a passcode is up to 64 printable ASCII characters");
+  }
+  return { passcode, type };
+}
+
+function headers(accept) {
+  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  return {
+    Accept: accept,
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "swipt-cli",
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+  };
+}
+
+async function github(url, accept, signal) {
+  let response = await fetch(url, {
+    headers: headers(accept),
+    signal,
+    redirect: "manual",
+  });
+  if (response.status >= 300 && response.status < 400) {
+    response = await fetch(response.headers.get("location"), { signal });
+  }
+  if (!response.ok) {
+    let message = `GitHub answered ${response.status} for ${url}`;
+    if ([401, 403, 404, 429].includes(response.status)) {
+      message += `; ${process.env.GITHUB_TOKEN || process.env.GH_TOKEN ? "GITHUB_TOKEN" : "set GITHUB_TOKEN to a token that"} must read the repository and stay under the rate limit`;
+    }
+    throw new Error(message);
+  }
+  return response;
+}
+
+async function findRelease(nightly, signal) {
+  const release = await (
+    await github(
+      `https://api.github.com/repos/${repository}/releases/${nightly ? "tags/nightly" : "latest"}`,
+      "application/vnd.github+json",
+      signal,
+    )
+  ).json();
+  const asset = (name) => {
+    const found = release.assets.find((it) => it.name === name);
+    if (!found) {
+      throw new Error(`release ${release.tag_name} has no ${name}`);
+    }
+    return found.url;
+  };
+  const metadata = await (
+    await github(asset("metadata.json"), "application/octet-stream", signal)
+  ).json();
+  return {
+    tag: release.tag_name,
+    version: metadata.version,
+    build: Number(metadata.build),
+    ipa: asset("Swipt.ipa"),
+  };
+}
+
+async function download(url, file, signal) {
+  const response = await github(url, "application/octet-stream", signal);
+  await pipeline(Readable.fromWeb(response.body), fs.createWriteStream(file), {
+    signal,
+  });
+}
+
+function unpack(ipa, directory) {
+  execFileSync("unzip", ["-q", ipa, "-d", directory]);
+  const payload = path.join(directory, "Payload");
+  const app = fs.readdirSync(payload).find((name) => name.endsWith(".app"));
+  if (app === undefined) {
+    throw new Error("the IPA has no app in Payload");
+  }
+  return path.join(payload, app);
+}
+
+const pbxproj = (id, team) => `// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 56;
+	objects = {
+		A1 = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = main.c; sourceTree = "<group>"; };
+		A2 = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Stub.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		A3 = {isa = PBXBuildFile; fileRef = A1; };
+		B1 = {isa = PBXGroup; children = (B2, B3); sourceTree = "<group>"; };
+		B2 = {isa = PBXGroup; children = (A1); path = Stub; sourceTree = "<group>"; };
+		B3 = {isa = PBXGroup; children = (A2); name = Products; sourceTree = "<group>"; };
+		C1 = {isa = PBXSourcesBuildPhase; buildActionMask = 2147483647; files = (A3); runOnlyForDeploymentPostprocessing = 0; };
+		D1 = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = E1;
+			buildPhases = (C1);
+			buildRules = ();
+			dependencies = ();
+			name = Stub;
+			productName = Stub;
+			productReference = A2;
+			productType = "com.apple.product-type.application";
+		};
+		E1 = {isa = XCConfigurationList; buildConfigurations = (F1); defaultConfigurationIsVisible = 0; defaultConfigurationName = Release; };
+		E2 = {isa = XCConfigurationList; buildConfigurations = (F2); defaultConfigurationIsVisible = 0; defaultConfigurationName = Release; };
+		F1 = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_STYLE = Automatic;
+				DEVELOPMENT_TEAM = "${team}";
+				GENERATE_INFOPLIST_FILE = YES;
+				PRODUCT_BUNDLE_IDENTIFIER = "${id}";
+				PRODUCT_NAME = Stub;
+				SDKROOT = iphoneos;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Release;
+		};
+		F2 = {isa = XCBuildConfiguration; buildSettings = {}; name = Release; };
+		G1 = {
+			isa = PBXProject;
+			buildConfigurationList = E2;
+			compatibilityVersion = "Xcode 14.0";
+			mainGroup = B1;
+			productRefGroup = B3;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (D1);
+		};
+	};
+	rootObject = G1;
+}
+`;
+
+function explain(output, team) {
+  const errors = [
+    ...new Set(
+      output
+        .split("\n")
+        .filter((line) => /^(xcodebuild: )?error: /.test(line))
+        .map((line) => line.replace(/^(xcodebuild: )?error: /, "")),
+    ),
+  ].join("; ");
+  if (/No Accounts?\b/.test(output)) {
+    return `Xcode has no account for team ${team}; sign in with its Apple Account at ${accountsHint}`;
+  }
+  if (/signing certificate|certificateType/i.test(output)) {
+    return `Xcode could not make a development certificate for team ${team}; add one at ${accountsHint} › Manage Certificates (${errors})`;
+  }
+  if (/requires Xcode|xcode-select/.test(output)) {
+    return "xcodebuild needs Xcode; install it and select it with xcode-select";
+  }
+  return errors || output.trim();
+}
+
+function provision(work, id, team, device) {
+  const stub = path.join(work, "Stub");
+  const products = path.join(stub, "Products");
+  fs.mkdirSync(path.join(stub, "Stub.xcodeproj"), { recursive: true });
+  fs.mkdirSync(path.join(stub, "Stub"));
+  fs.writeFileSync(
+    path.join(stub, "Stub/main.c"),
+    "int main(void) { return 0; }\n",
+  );
+  fs.writeFileSync(
+    path.join(stub, "Stub.xcodeproj/project.pbxproj"),
+    pbxproj(id, team),
+  );
+  const result = spawnSync(
+    "xcodebuild",
+    [
+      "build",
+      "-project",
+      path.join(stub, "Stub.xcodeproj"),
+      "-target",
+      "Stub",
+      "-configuration",
+      "Release",
+      "-destination",
+      `id=${device.udid}`,
+      `CONFIGURATION_BUILD_DIR=${products}`,
+      `OBJROOT=${path.join(stub, "Objects")}`,
+      "-allowProvisioningUpdates",
+      "-allowProvisioningDeviceRegistration",
+    ],
+    { encoding: "utf8" },
+  );
+  if (result.error) {
+    throw result.error.code === "ENOENT"
+      ? new Error("xcodebuild is missing; install Xcode")
+      : result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(explain(`${result.stdout}${result.stderr}`, team));
+  }
+  const app = path.join(products, "Stub.app");
+  const certificates = path.join(work, "certificate");
+  const stdio = ["ignore", "pipe", "ignore"];
+  execFileSync(
+    "codesign",
+    ["-d", `--extract-certificates=${certificates}`, app],
+    { stdio },
+  );
+  const entitlements = path.join(work, "entitlements.plist");
+  fs.writeFileSync(
+    entitlements,
+    execFileSync("codesign", ["-d", "--entitlements", "-", "--xml", app], {
+      stdio,
+    }),
+  );
+  return {
+    identity: createHash("sha1")
+      .update(fs.readFileSync(`${certificates}0`))
+      .digest("hex")
+      .toUpperCase(),
+    entitlements,
+    profile: path.join(app, "embedded.mobileprovision"),
+  };
+}
+
+function resign(app, id, signing) {
+  const info = path.join(app, "Info.plist");
+  execFileSync("plutil", [
+    "-replace",
+    "CFBundleIdentifier",
+    "-string",
+    id,
+    info,
+  ]);
+  let permitted;
+  try {
+    permitted = JSON.parse(
+      execFileSync("plutil", [
+        "-extract",
+        "BGTaskSchedulerPermittedIdentifiers",
+        "json",
+        "-o",
+        "-",
+        info,
+      ]),
+    );
+  } catch {
+    permitted = undefined;
+  }
+  if (permitted !== undefined) {
+    execFileSync("plutil", [
+      "-replace",
+      "BGTaskSchedulerPermittedIdentifiers",
+      "-json",
+      JSON.stringify(
+        permitted.map((it) =>
+          it.startsWith(`${bundleId}.`) ? id + it.slice(bundleId.length) : it,
+        ),
+      ),
+      info,
+    ]);
+  }
+  fs.copyFileSync(signing.profile, path.join(app, "embedded.mobileprovision"));
+  const codesign = ["--force", "--sign", signing.identity, "--timestamp=none"];
+  const frameworks = path.join(app, "Frameworks");
+  if (fs.existsSync(frameworks)) {
+    for (const name of fs.readdirSync(frameworks)) {
+      execFileSync("codesign", [...codesign, path.join(frameworks, name)]);
+    }
+  }
+  execFileSync("codesign", [
+    ...codesign,
+    "--entitlements",
+    signing.entitlements,
+    app,
+  ]);
+}
+
+function locate(options, device) {
+  const found = apps(device.udid)
+    .map((app) => ({
+      ...app,
+      team: sideloadedPattern.exec(app.bundleIdentifier)?.[1],
+    }))
+    .filter((app) => app.team !== undefined);
+  if (options.team !== undefined) {
+    if (!teamPattern.test(options.team)) {
+      throw new UsageError(
+        `invalid argument ${JSON.stringify(options.team)} for --team: it is the 10-character team ID shown in ${accountsHint}`,
+      );
+    }
+    return {
+      team: options.team,
+      current: found.find((app) => app.team === options.team),
+    };
+  }
+  if (found.length > 1) {
+    throw new Error(
+      `Swipt is sideloaded on ${device.name} by more than one team (${found.map((app) => app.team).join(", ")}); choose one with --team`,
+    );
+  }
+  return { team: found[0]?.team, current: found[0] };
+}
+
+const buildText = (app) => `Swipt ${app.version} (${app.bundleVersion})`;
+
+async function deploy(context, onlyNewer) {
+  const passcode = passcodeOf(context.options);
+  const device = coreDevice(context.options.device ?? process.env.SWIPT_DEVICE);
+  const { team, current } = locate(context.options, device);
+  if (team === undefined) {
+    throw new Error(
+      onlyNewer
+        ? `Swipt is not sideloaded on ${device.name}; install it with "swipt sideload install"`
+        : `Swipt is not sideloaded on ${device.name} yet; choose the team with --team ID, as shown in ${accountsHint}`,
+    );
+  }
+  const release = await findRelease(context.options.nightly, context.signal);
+  if (current !== undefined) {
+    const installed = Number(current.bundleVersion);
+    if (installed === release.build) {
+      console.log(
+        `${buildText(current)} on ${device.name} is already ${release.tag}`,
+      );
+      return;
+    }
+    if (onlyNewer && installed > release.build) {
+      console.log(
+        `${buildText(current)} on ${device.name} is newer than ${release.tag} (${release.build})`,
+      );
+      return;
+    }
+  }
+  const id = `${bundleId}.${team}`;
+  const work = fs.mkdtempSync(path.join(os.tmpdir(), "swipt-sideload-"));
+  try {
+    console.error(
+      `downloading Swipt ${release.version} (${release.build}) from ${release.tag}`,
+    );
+    const ipa = path.join(work, "Swipt.ipa");
+    await download(release.ipa, ipa, context.signal);
+    const app = unpack(ipa, work);
+    console.error(`signing ${id} with team ${team} through Xcode`);
+    resign(app, id, provision(work, id, team, device));
+    console.error(`installing on ${device.name}`);
+    devicectl(["device", "install", "app", "--device", device.udid, app]);
+    if (current === undefined) {
+      console.error(`pairing with ${device.name}`);
+      pair(device, id, work);
+      if (passcode !== undefined) {
+        setUpAutoUnlock(device, id, work, passcode);
+      }
+    }
+  } finally {
+    fs.rmSync(work, { recursive: true, force: true });
+  }
+  const result = locate({ team }, device).current;
+  if (result === undefined || Number(result.bundleVersion) !== release.build) {
+    throw new Error(
+      `${device.name} ${result === undefined ? `does not list ${id}` : `has ${buildText(result)}`} after the install`,
+    );
+  }
+  console.log(
+    `${buildText(result)} is ${current === undefined ? "installed" : "updated"} on ${device.name}`,
+  );
+  try {
+    devicectl([
+      "device",
+      "process",
+      "launch",
+      "--terminate-existing",
+      "--device",
+      device.udid,
+      id,
+    ]);
+  } catch (error) {
+    if (/trusted by the user/.test(error.message)) {
+      console.log(
+        `it opens once the team's developer app is trusted in Settings › General › VPN & Device Management on ${device.name}`,
+      );
+    } else if (/BSErrorCodeDescription = Locked/.test(error.message)) {
+      console.log(`it opens once ${device.name} is unlocked`);
+    } else {
+      throw error;
+    }
+  }
+}
+
+export const install = (context) => deploy(context, false);
+
+export const update = (context) => deploy(context, true);
+
+const serverHint =
+  "swipt-server is missing; install @swipt/cli with its optional dependencies, or name it with SWIPT_SERVER_PATH";
+
+function serverPath() {
+  if (process.env.SWIPT_SERVER_PATH) {
+    return process.env.SWIPT_SERVER_PATH;
+  }
+  let packaged;
+  try {
+    packaged = path.join(
+      path.dirname(
+        createRequire(import.meta.url).resolve(
+          `@swipt/server-${process.platform}-${process.arch}/package.json`,
+        ),
+      ),
+      "swipt-server",
+    );
+  } catch {
+    return "swipt-server";
+  }
+  return fs.existsSync(packaged) ? packaged : "swipt-server";
+}
+
+const schema = [
+  "CREATE TABLE grdb_migrations (identifier TEXT NOT NULL PRIMARY KEY)",
+  'CREATE TABLE "preferences" ("name" TEXT PRIMARY KEY NOT NULL, "data" BLOB NOT NULL)',
+  'CREATE TABLE "swiplets" ("id" TEXT PRIMARY KEY NOT NULL, "position" INTEGER NOT NULL, "etag" TEXT NOT NULL)',
+  'CREATE TABLE "repositories" ("url" TEXT PRIMARY KEY NOT NULL, "position" INTEGER NOT NULL, "name" TEXT NOT NULL, "localizedNames" TEXT, "iconColor" TEXT, "iconSymbol" TEXT, "image" BLOB, "etag" TEXT NOT NULL)',
+  'CREATE TABLE "repositorySwiplets" ("repository" TEXT NOT NULL REFERENCES "repositories"("url") ON DELETE CASCADE, "position" INTEGER NOT NULL, "id" TEXT NOT NULL, "name" TEXT NOT NULL, "localizedNames" TEXT NOT NULL, "description" TEXT NOT NULL, "version" TEXT NOT NULL, "versionCode" INTEGER NOT NULL, "iconColor" TEXT, "iconSymbol" TEXT, "url" TEXT NOT NULL, "sha256" TEXT NOT NULL, PRIMARY KEY ("repository", "id"))',
+  "INSERT INTO grdb_migrations VALUES ('0.1.0')",
+];
+
+function setUpAutoUnlock(device, id, work, passcode) {
+  const database = path.join(work, "Swipt.sqlite");
+  const preferences = {
+    serverAutoUnlocks: true,
+    serverAutoUnlockPasscodeType: passcodeTypes.indexOf(passcode.type),
+    serverAutoUnlockPasscode: passcode.passcode,
+    autoUnlockSetUp: true,
+  };
+  const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+  execFileSync("sqlite3", [database], {
+    input: [
+      ...schema,
+      ...Object.entries(preferences).map(
+        ([name, value]) =>
+          `INSERT INTO preferences VALUES (${quote(name)}, CAST(${quote(JSON.stringify(value))} AS BLOB))`,
+      ),
+    ]
+      .map((statement) => `${statement};\n`)
+      .join(""),
+  });
+  devicectl([
+    "device",
+    "copy",
+    "to",
+    "--device",
+    device.udid,
+    "--source",
+    database,
+    "--destination",
+    "Library/Application Support/Swipt.sqlite",
+    "--domain-type",
+    "appDataContainer",
+    "--domain-identifier",
+    id,
+  ]);
+}
+
+function pair(device, id, work) {
+  const record = path.join(work, "PairingRecord.plist");
+  const result = spawnSync(
+    serverPath(),
+    ["pair", "-d", device.udid, "-o", record],
+    { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] },
+  );
+  if (result.error?.code === "ENOENT") {
+    console.error(`${serverHint}; Swipt pairs in Settings instead`);
+    return;
+  }
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    console.error(
+      `pairing failed, so Swipt pairs in Settings instead: ${result.stderr.trim()}`,
+    );
+    return;
+  }
+  devicectl([
+    "device",
+    "copy",
+    "to",
+    "--device",
+    device.udid,
+    "--source",
+    record,
+    "--destination",
+    "Library/Application Support/PairingRecord.plist",
+    "--domain-type",
+    "appDataContainer",
+    "--domain-identifier",
+    id,
+  ]);
+}
+
+function serve(udid, passcode, signal) {
+  const server = spawn(
+    serverPath(),
+    ["-d", udid, ...(passcode ? ["--passcode-type", passcode.type] : [])],
+    {
+      env: {
+        ...process.env,
+        ...(passcode ? { SWIPT_PASSCODE: passcode.passcode } : {}),
+      },
+      stdio: ["ignore", "pipe", "pipe"],
+      signal,
+    },
+  );
+  let logs = "";
+  server.stderr.on("data", (chunk) => {
+    logs += chunk;
+  });
+  const exited = new Promise((resolve) => server.once("close", resolve));
+  const url = new Promise((resolve, reject) => {
+    server.once("error", (error) =>
+      reject(error.code === "ENOENT" ? new Error(serverHint) : error),
+    );
+    exited.then((code) =>
+      reject(
+        new Error(
+          `swipt-server exited with ${code ?? "a signal"}${logs.trim() === "" ? "" : `: ${logs.trim()}`}`,
+        ),
+      ),
+    );
+    readline.createInterface({ input: server.stdout }).on("line", (line) => {
+      const found = /^Swipt API: (\S+)/.exec(line);
+      if (found) {
+        const parsed = new URL(found[1]);
+        parsed.hostname = "127.0.0.1";
+        resolve(parsed.origin);
+      }
+    });
+  });
+  return {
+    url,
+    stop() {
+      server.kill("SIGTERM");
+      return exited;
+    },
+  };
+}
+
+export async function start(context) {
+  const passcode = passcodeOf(context.options);
+  const device = coreDevice(context.options.device ?? process.env.SWIPT_DEVICE);
+  const { team, current } = locate(context.options, device);
+  if (current === undefined) {
+    throw new Error(
+      `Swipt is not sideloaded on ${device.name}${team === undefined ? "" : ` by team ${team}`}`,
+    );
+  }
+  const server = serve(device.udid, passcode, context.signal);
+  try {
+    const client = open({ url: await server.url, token: "" });
+    let failure;
+    for await (const response of client.repl.execute(
+      {
+        code: fs.readFileSync(
+          new URL("sideload/trust.js", import.meta.url),
+          "utf8",
+        ),
+        args: [current.bundleIdentifier],
+        program: true,
+      },
+      { signal: context.signal },
+    )) {
+      switch (response.part.case) {
+        case "console": {
+          const output = response.part.value;
+          (output.level === LogLevel.ERROR || output.level === LogLevel.WARN
+            ? console.error
+            : console.log)(output.text);
+          break;
+        }
+        case "error":
+          failure = response.part.value;
+          break;
+      }
+    }
+    if (failure) {
+      throw printScriptError(failure);
+    }
+  } finally {
+    await server.stop();
+  }
+}
+
+export function uninstall(context) {
+  const device = coreDevice(context.options.device ?? process.env.SWIPT_DEVICE);
+  const { team, current } = locate(context.options, device);
+  if (current === undefined) {
+    throw new Error(
+      `Swipt is not sideloaded on ${device.name}${team === undefined ? "" : ` by team ${team}`}`,
+    );
+  }
+  devicectl([
+    "device",
+    "uninstall",
+    "app",
+    "--device",
+    device.udid,
+    current.bundleIdentifier,
+  ]);
+  console.log(`removed ${buildText(current)} from ${device.name}`);
+}