@swipt/cli 0.1.0-nightly.44 → 0.1.0-nightly.46

package/connection.mjs

@@ -155,7 +155,7 @@ const requiresToken = (found) =>
   `${found.name} requires a token: swipt device add ${withToken(found.url)}`;
 
 export async function attach(context) {
-  const given = context.options.device ?? process.env.SWIPT_DEVICE;
+  const given = context.options.device;
   const stored = load();
   let device;
   if (given && /[:/]/.test(given)) {
@@ -197,7 +197,7 @@ export async function attach(context) {
     }
     if (names.length > 1) {
       throw new Error(
-        `there is more than one device: ${names.join(", ")}; choose one with -d or SWIPT_DEVICE`,
+        `there is more than one device: ${names.join(", ")}; choose one with -d`,
       );
     }
     device = parseURL(stored[names[0]]);

package/coredevice.mjs

@@ -0,0 +1,74 @@
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { label, sameName } from "./connection.mjs";
+
+export function devicectl(args, { parse = false } = {}) {
+  const output = parse
+    ? path.join(os.tmpdir(), `devicectl-${process.pid}.json`)
+    : undefined;
+  const result = spawnSync(
+    "xcrun",
+    ["devicectl", ...args, ...(parse ? ["--json-output", output] : [])],
+    { encoding: "utf8" },
+  );
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    const text = `${result.stdout}${result.stderr}`;
+    if (text.includes("4016")) {
+      throw new Error(
+        "CoreDevice cannot reach the device while its loopback VPN is on; turn off Swipt's VPN on the device, then run this again",
+      );
+    }
+    throw new Error(text.trim() || `devicectl exited with ${result.status}`);
+  }
+  if (!parse) {
+    return undefined;
+  }
+  const parsed = JSON.parse(fs.readFileSync(output, "utf8"));
+  fs.rmSync(output);
+  return parsed;
+}
+
+export function coreDevice(given, { required = false } = {}) {
+  const devices = devicectl(["list", "devices"], { parse: true })
+    .result.devices.filter(
+      (device) =>
+        device.hardwareProperties.platform === "iOS" &&
+        device.hardwareProperties.reality === "physical",
+    )
+    .map((device) => ({
+      name: device.deviceProperties.name,
+      udid: device.hardwareProperties.udid,
+    }));
+  const matches = given
+    ? devices.filter(
+        (device) =>
+          sameName(device.udid, given) ||
+          sameName(label(device.name), label(given)),
+      )
+    : required
+      ? []
+      : devices;
+  if (matches.length !== 1) {
+    const reason = !given
+      ? "choose a device with -d NAME|UDID"
+      : matches.length === 0
+        ? `no iOS device is named ${given}`
+        : `more than one iOS device is named ${given}; choose one by UDID`;
+    throw new Error(
+      devices.length === 0
+        ? `${reason}; no iOS device is paired with this Mac`
+        : `${reason}; paired iOS devices:\n${devices.map((device) => `  ${device.name}  ${device.udid}`).join("\n")}`,
+    );
+  }
+  return matches[0];
+}
+
+export const apps = (udid) =>
+  devicectl(["device", "info", "apps", "--device", udid], { parse: true })
+    .result.apps;

package/device.mjs

@@ -84,6 +84,12 @@ export const logs = (context) =>
     }
   });
 
+export const stop = (context) =>
+  session(context, async (client) => {
+    await client.system.shutdown({}, { signal: context.signal });
+    console.log("stopped");
+  });
+
 function readInput(value) {
   if (value === undefined || value === "") {
     return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swipt/cli",
-  "version": "0.1.0-nightly.44",
+  "version": "0.1.0-nightly.46",
   "license": "GPL-3.0-or-later",
   "repository": {
     "type": "git",
@@ -13,7 +13,8 @@
   },
   "files": [
     "*.mjs",
-    "proto"
+    "proto",
+    "sideload"
   ],
   "publishConfig": {
     "access": "public"
@@ -31,7 +32,11 @@
     "react-native-worklets": "0.13.0"
   },
   "peerDependencies": {
-    "@swipt/api": "0.1.0-nightly.44"
+    "@swipt/api": "0.1.0-nightly.46"
+  },
+  "optionalDependencies": {
+    "@swipt/server-darwin-arm64": "0.1.0-nightly.46",
+    "@swipt/server-darwin-x64": "0.1.0-nightly.46"
   },
   "devDependencies": {
     "@bufbuild/protoc-gen-es": "^2.16.0"

package/proto/system_pb.js

@@ -10,7 +10,7 @@ import { file_common } from "./common_pb.js";
  * Describes the file system.proto.
  */
 export const file_system = /*@__PURE__*/
-  fileDesc("CgxzeXN0ZW0ucHJvdG8SBXN3aXB0IqgBCg9HZXRJbmZvUmVzcG9uc2USFgoOc2VydmVyX3ZlcnNpb24YASABKAkSEwoLZGV2aWNlX25hbWUYAiABKAkSDAoEdWRpZBgDIAEoCRIyChFkZXZpY2VfY29ubmVjdGlvbhgEIAEoCzIXLnN3aXB0LkRldmljZUNvbm5lY3Rpb24SEwoLYXBwX3ZlcnNpb24YBSABKAkSEQoJYXBwX2J1aWxkGAYgASgJMkoKDVN5c3RlbVNlcnZpY2USOQoHR2V0SW5mbxIWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eRoWLnN3aXB0LkdldEluZm9SZXNwb25zZUIyWjBnaXRodWIuY29tL3N3aXB0LWF1dG9tYXRpb24vc3dpcHQvaW50ZXJuYWwvcHJvdG9iBnByb3RvMw", [file_google_protobuf_empty, file_common]);
+  fileDesc("CgxzeXN0ZW0ucHJvdG8SBXN3aXB0IqgBCg9HZXRJbmZvUmVzcG9uc2USFgoOc2VydmVyX3ZlcnNpb24YASABKAkSEwoLZGV2aWNlX25hbWUYAiABKAkSDAoEdWRpZBgDIAEoCRIyChFkZXZpY2VfY29ubmVjdGlvbhgEIAEoCzIXLnN3aXB0LkRldmljZUNvbm5lY3Rpb24SEwoLYXBwX3ZlcnNpb24YBSABKAkSEQoJYXBwX2J1aWxkGAYgASgJMoYBCg1TeXN0ZW1TZXJ2aWNlEjkKB0dldEluZm8SFi5nb29nbGUucHJvdG9idWYuRW1wdHkaFi5zd2lwdC5HZXRJbmZvUmVzcG9uc2USOgoIU2h1dGRvd24SFi5nb29nbGUucHJvdG9idWYuRW1wdHkaFi5nb29nbGUucHJvdG9idWYuRW1wdHlCMlowZ2l0aHViLmNvbS9zd2lwdC1hdXRvbWF0aW9uL3N3aXB0L2ludGVybmFsL3Byb3RvYgZwcm90bzM", [file_google_protobuf_empty, file_common]);
 
 /**
  * Describes the message swipt.GetInfoResponse.

package/sideload/trust.js

@@ -0,0 +1,235 @@
+const [id] = args;
+const settings = "com.apple.Preferences";
+const developerPattern =
+  /(?:Apple Development|iPhone Developer): .+?\([A-Z0-9]{10}\)/;
+const tapTimeoutMs = 3_000;
+
+const sheet = async () => {
+  const screen = await accessibility.snapshot({ scope: "screen" });
+  return screen.find({ role: "sheet" });
+};
+
+const alertPresentMs = 600;
+
+async function dismiss(alert, buttons, index) {
+  await sleep(alertPresentMs);
+  for (let attempt = 0; attempt < 5; attempt++) {
+    await input.tap(buttons[index].point);
+    await sleep(alertPresentMs);
+    const shown = await sheet();
+    if (shown === null || shown.label !== alert.label) {
+      return;
+    }
+  }
+  throw new Error(`the alert stays: ${alert.label}`);
+}
+
+async function allowPrompts(name, waitMs) {
+  const until = Date.now() + waitMs;
+  do {
+    const alert = await sheet();
+    const buttons = alert?.findAll({ role: "button" }) ?? [];
+    if (buttons.length === 2 && alert.label?.includes(name)) {
+      await dismiss(alert, buttons, 1);
+      return;
+    }
+    await sleep(300);
+  } while (Date.now() < until);
+}
+
+async function launch(name) {
+  try {
+    await device.launchApplication(id, { restart: true });
+    await allowPrompts(name, 3_000);
+    return null;
+  } catch (error) {
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const alert = await sheet();
+      const buttons = alert?.findAll({ role: "button" }) ?? [];
+      if (buttons.length === 1) {
+        const developer = alert
+          .findAll({ role: "text" })
+          .map((text) => developerPattern.exec(text.label ?? "")?.[0])
+          .find((found) => found !== undefined);
+        await dismiss(alert, buttons, 0);
+        if (developer === undefined) {
+          throw new Error(`the alert names no developer: ${alert.label}`);
+        }
+        return developer;
+      }
+      await sleep(300);
+    }
+    throw error;
+  }
+}
+
+async function findScrolling(selector, bounds) {
+  for (let attempt = 0; attempt < 12; attempt++) {
+    const found = await accessibility.find(
+      { app: settings, ...selector },
+      { timeoutMs: 1_500, poll: true },
+    );
+    if (found !== null && !found.partial && !found.offScreen) {
+      return found;
+    }
+    const distance = found === null ? 0.5 : 0.25;
+    await input.swipe(
+      [bounds.width * 0.6, bounds.height * (0.3 + distance)],
+      [bounds.width * 0.6, bounds.height * 0.3],
+      { durationMs: 300 },
+    );
+    await sleep(500);
+  }
+  throw new Error(`Settings did not show ${JSON.stringify(selector)}`);
+}
+
+async function openRow(selector, bounds, loaded) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      await accessibility.tap(await findScrolling(selector, bounds), {
+        timeoutMs: tapTimeoutMs,
+      });
+    } catch (error) {
+      if (error.name !== "TimeoutError") {
+        throw error;
+      }
+      await input.pressHome();
+      await sleep(800);
+      await device.launchApplication(settings);
+      await sleep(1_000);
+      continue;
+    }
+    for (let wait = 0; wait < 10; wait++) {
+      await sleep(300);
+      if (loaded(await accessibility.snapshot({ scope: "frontApp" }))) {
+        return;
+      }
+    }
+  }
+  throw new Error(`Settings did not open ${JSON.stringify(selector)}`);
+}
+
+async function back() {
+  const button = await accessibility.find(
+    { app: settings, identifier: "BackButton" },
+    { timeoutMs: 3_000, poll: true },
+  );
+  if (button === null) {
+    throw new Error("Settings shows no back button");
+  }
+  await accessibility.tap(button, { timeoutMs: tapTimeoutMs });
+  await sleep(600);
+}
+
+async function trust(developer, bounds) {
+  await device.launchApplication(settings, { restart: true });
+  await openRow(
+    { identifier: "com.apple.settings.general" },
+    bounds,
+    (opened) =>
+      opened.findAll({ identifier: /^com\.apple\.settings\.general\./ })
+        .length > 0,
+  );
+  await openRow(
+    { identifier: "com.apple.settings.general.vpnAndDeviceManagement" },
+    bounds,
+    (opened) =>
+      opened.findAll({ role: "button", identifier: "VPN" }).length > 0,
+  );
+  const candidates = (list) => {
+    const elsewhere = new Set(
+      list
+        .findAll({
+          role: "button",
+          within: {
+            identifier: "com.apple.settings.sidebar.collectionView",
+          },
+        })
+        .concat(
+          list.findAll({
+            role: "button",
+            within: { role: /^(navigationBar|searchField)$/ },
+          }),
+        )
+        .map((row) => row.identifier),
+    );
+    return list
+      .findAll({ role: "button" })
+      .filter(
+        (row) =>
+          row.identifier !== undefined &&
+          row.identifier !== "BackButton" &&
+          row.identifier !== "VPN" &&
+          row.identifier !== row.label &&
+          !elsewhere.has(row.identifier),
+      )
+      .map((row) => row.identifier);
+  };
+  let rows = [];
+  for (let attempt = 0; attempt < 15 && rows.length === 0; attempt++) {
+    await sleep(400);
+    rows = candidates(await accessibility.snapshot({ scope: "frontApp" }));
+  }
+  for (const row of rows) {
+    const button = await accessibility.find(
+      { app: settings, role: "button", identifier: row },
+      { timeoutMs: 3_000, poll: true },
+    );
+    if (button === null) {
+      continue;
+    }
+    await accessibility.tap(button, { timeoutMs: tapTimeoutMs });
+    let control = null;
+    for (let attempt = 0; attempt < 10 && control === null; attempt++) {
+      await sleep(300);
+      const opened = await accessibility.snapshot({ scope: "frontApp" });
+      if (
+        opened.findAll((it) => (it.label ?? "").includes(developer)).length > 0
+      ) {
+        control =
+          opened
+            .findAll({ role: "text" })
+            .find((it) => it.label !== row && it.label?.includes(row)) ?? null;
+        break;
+      }
+    }
+    if (control === null) {
+      await back();
+      continue;
+    }
+    await input.tap(control.point);
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const alert = await sheet();
+      const buttons = alert?.findAll({ role: "button" }) ?? [];
+      if (buttons.length === 2) {
+        await dismiss(alert, buttons, 0);
+        return;
+      }
+      await sleep(300);
+    }
+    throw new Error("Settings did not ask to allow the developer");
+  }
+  throw new Error(`Settings lists no app from ${developer}`);
+}
+
+async function main() {
+  await device.unlock().catch(() => {});
+  const name =
+    (await device.installedApplications()).find((app) => app.bundleId === id)
+      ?.name ?? "Swipt";
+  await allowPrompts(name, 0);
+  const developer = await launch(name);
+  if (developer === null) {
+    console.log(`${name} is running`);
+    return;
+  }
+  const { screen: bounds } = await device.info();
+  await trust(developer, bounds);
+  await sleep(1_000);
+  if ((await launch(name)) !== null) {
+    throw new Error(`${name} does not open after trusting ${developer}`);
+  }
+  console.log(`${name} is running; ${developer} is trusted`);
+}
+
+await main();

package/sideload.mjs

@@ -0,0 +1,696 @@
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { X509Certificate, createHash } from "node:crypto";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import readline from "node:readline";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+
+import { UsageError, open } from "./client.mjs";
+import { apps, coreDevice, devicectl } from "./coredevice.mjs";
+import { printScriptError } from "./output.mjs";
+import { LogLevel } from "./proto/common_pb.js";
+
+const bundleId = "io.nekohasekai.swipt";
+const repository = "swipt-automation/swipt";
+const teamPattern = /^[A-Z0-9]{10}$/;
+const sideloadedPattern = new RegExp(
+  `^${bundleId.replaceAll(".", "\\.")}\\.([A-Z0-9]{10})$`,
+);
+
+const accountsHint = "Xcode › Settings › Accounts";
+
+const passcodeTypes = ["pin", "numeric", "alphanumeric"];
+
+function passcodeOf(options) {
+  const type = options["passcode-type"] ?? "pin";
+  if (!passcodeTypes.includes(type)) {
+    throw new UsageError(
+      `invalid argument ${JSON.stringify(type)} for --passcode-type: it is ${passcodeTypes.join(", ")}`,
+    );
+  }
+  const passcode = options.passcode;
+  if (!passcode) {
+    return undefined;
+  }
+  const digits = /^\d+$/.test(passcode);
+  if (type === "pin" && !(digits && [4, 6].includes(passcode.length))) {
+    throw new UsageError(
+      "a pin passcode is 4 or 6 digits; a custom one needs --passcode-type numeric or alphanumeric",
+    );
+  }
+  if (type === "numeric" && !digits) {
+    throw new UsageError("a numeric passcode is digits only");
+  }
+  if (!/^[\x20-\x7e]{1,64}$/.test(passcode)) {
+    throw new UsageError("a passcode is up to 64 printable ASCII characters");
+  }
+  return { passcode, type };
+}
+
+function headers(accept) {
+  const token = process.env.GITHUB_TOKEN;
+  return {
+    Accept: accept,
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "swipt-cli",
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+  };
+}
+
+async function github(url, accept, signal) {
+  let response = await fetch(url, {
+    headers: headers(accept),
+    signal,
+    redirect: "manual",
+  });
+  if (response.status >= 300 && response.status < 400) {
+    response = await fetch(response.headers.get("location"), { signal });
+  }
+  if (!response.ok) {
+    let message = `GitHub answered ${response.status} for ${url}`;
+    if ([401, 403, 404, 429].includes(response.status)) {
+      message += `; ${process.env.GITHUB_TOKEN ? "GITHUB_TOKEN" : "set GITHUB_TOKEN to a token that"} must read the repository and stay under the rate limit`;
+    }
+    throw new Error(message);
+  }
+  return response;
+}
+
+async function findRelease(nightly, signal) {
+  const release = await (
+    await github(
+      `https://api.github.com/repos/${repository}/releases/${nightly ? "tags/nightly" : "latest"}`,
+      "application/vnd.github+json",
+      signal,
+    )
+  ).json();
+  const asset = (name) => {
+    const found = release.assets.find((it) => it.name === name);
+    if (!found) {
+      throw new Error(`release ${release.tag_name} has no ${name}`);
+    }
+    return found.url;
+  };
+  const metadata = await (
+    await github(asset("metadata.json"), "application/octet-stream", signal)
+  ).json();
+  return {
+    tag: release.tag_name,
+    version: metadata.version,
+    build: Number(metadata.build),
+    ipa: asset("Swipt.ipa"),
+  };
+}
+
+async function download(url, file, signal) {
+  const response = await github(url, "application/octet-stream", signal);
+  await pipeline(Readable.fromWeb(response.body), fs.createWriteStream(file), {
+    signal,
+  });
+}
+
+function unpack(ipa, directory) {
+  execFileSync("unzip", ["-q", ipa, "-d", directory]);
+  const payload = path.join(directory, "Payload");
+  const app = fs.readdirSync(payload).find((name) => name.endsWith(".app"));
+  if (app === undefined) {
+    throw new Error("the IPA has no app in Payload");
+  }
+  return path.join(payload, app);
+}
+
+const pbxproj = (id, team) => `// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 56;
+	objects = {
+		A1 = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = main.c; sourceTree = "<group>"; };
+		A2 = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Stub.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		A3 = {isa = PBXBuildFile; fileRef = A1; };
+		B1 = {isa = PBXGroup; children = (B2, B3); sourceTree = "<group>"; };
+		B2 = {isa = PBXGroup; children = (A1); path = Stub; sourceTree = "<group>"; };
+		B3 = {isa = PBXGroup; children = (A2); name = Products; sourceTree = "<group>"; };
+		C1 = {isa = PBXSourcesBuildPhase; buildActionMask = 2147483647; files = (A3); runOnlyForDeploymentPostprocessing = 0; };
+		D1 = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = E1;
+			buildPhases = (C1);
+			buildRules = ();
+			dependencies = ();
+			name = Stub;
+			productName = Stub;
+			productReference = A2;
+			productType = "com.apple.product-type.application";
+		};
+		E1 = {isa = XCConfigurationList; buildConfigurations = (F1); defaultConfigurationIsVisible = 0; defaultConfigurationName = Release; };
+		E2 = {isa = XCConfigurationList; buildConfigurations = (F2); defaultConfigurationIsVisible = 0; defaultConfigurationName = Release; };
+		F1 = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				CODE_SIGN_STYLE = Automatic;
+				DEVELOPMENT_TEAM = "${team}";
+				GENERATE_INFOPLIST_FILE = YES;
+				PRODUCT_BUNDLE_IDENTIFIER = "${id}";
+				PRODUCT_NAME = Stub;
+				SDKROOT = iphoneos;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Release;
+		};
+		F2 = {isa = XCBuildConfiguration; buildSettings = {}; name = Release; };
+		G1 = {
+			isa = PBXProject;
+			buildConfigurationList = E2;
+			compatibilityVersion = "Xcode 14.0";
+			mainGroup = B1;
+			productRefGroup = B3;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (D1);
+		};
+	};
+	rootObject = G1;
+}
+`;
+
+function explain(output, team) {
+  const errors = [
+    ...new Set(
+      output
+        .split("\n")
+        .filter((line) => /^(xcodebuild: )?error: /.test(line))
+        .map((line) => line.replace(/^(xcodebuild: )?error: /, "")),
+    ),
+  ].join("; ");
+  if (/No Accounts?\b/.test(output)) {
+    return `Xcode has no account for team ${team}; sign in with its Apple Account at ${accountsHint}`;
+  }
+  if (/signing certificate|certificateType/i.test(output)) {
+    return `Xcode could not make a development certificate for team ${team}; add one at ${accountsHint} › Manage Certificates (${errors})`;
+  }
+  if (/requires Xcode|xcode-select/.test(output)) {
+    return "xcodebuild needs Xcode; install it and select it with xcode-select";
+  }
+  return errors || output.trim();
+}
+
+function provision(work, id, team, device) {
+  const stub = path.join(work, "Stub");
+  const products = path.join(stub, "Products");
+  fs.mkdirSync(path.join(stub, "Stub.xcodeproj"), { recursive: true });
+  fs.mkdirSync(path.join(stub, "Stub"));
+  fs.writeFileSync(
+    path.join(stub, "Stub/main.c"),
+    "int main(void) { return 0; }\n",
+  );
+  fs.writeFileSync(
+    path.join(stub, "Stub.xcodeproj/project.pbxproj"),
+    pbxproj(id, team),
+  );
+  const result = spawnSync(
+    "xcodebuild",
+    [
+      "build",
+      "-project",
+      path.join(stub, "Stub.xcodeproj"),
+      "-target",
+      "Stub",
+      "-configuration",
+      "Release",
+      "-destination",
+      `id=${device.udid}`,
+      `CONFIGURATION_BUILD_DIR=${products}`,
+      `OBJROOT=${path.join(stub, "Objects")}`,
+      "-allowProvisioningUpdates",
+      "-allowProvisioningDeviceRegistration",
+    ],
+    { encoding: "utf8" },
+  );
+  if (result.error) {
+    throw result.error.code === "ENOENT"
+      ? new Error("xcodebuild is missing; install Xcode")
+      : result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(explain(`${result.stdout}${result.stderr}`, team));
+  }
+  const app = path.join(products, "Stub.app");
+  const certificates = path.join(work, "certificate");
+  const stdio = ["ignore", "pipe", "ignore"];
+  execFileSync(
+    "codesign",
+    ["-d", `--extract-certificates=${certificates}`, app],
+    { stdio },
+  );
+  const entitlements = path.join(work, "entitlements.plist");
+  fs.writeFileSync(
+    entitlements,
+    execFileSync("codesign", ["-d", "--entitlements", "-", "--xml", app], {
+      stdio,
+    }),
+  );
+  return {
+    identity: createHash("sha1")
+      .update(fs.readFileSync(`${certificates}0`))
+      .digest("hex")
+      .toUpperCase(),
+    entitlements,
+    profile: path.join(app, "embedded.mobileprovision"),
+  };
+}
+
+function resign(app, id, signing) {
+  const info = path.join(app, "Info.plist");
+  execFileSync("plutil", [
+    "-replace",
+    "CFBundleIdentifier",
+    "-string",
+    id,
+    info,
+  ]);
+  let permitted;
+  try {
+    permitted = JSON.parse(
+      execFileSync("plutil", [
+        "-extract",
+        "BGTaskSchedulerPermittedIdentifiers",
+        "json",
+        "-o",
+        "-",
+        info,
+      ]),
+    );
+  } catch {
+    permitted = undefined;
+  }
+  if (permitted !== undefined) {
+    execFileSync("plutil", [
+      "-replace",
+      "BGTaskSchedulerPermittedIdentifiers",
+      "-json",
+      JSON.stringify(
+        permitted.map((it) =>
+          it.startsWith(`${bundleId}.`) ? id + it.slice(bundleId.length) : it,
+        ),
+      ),
+      info,
+    ]);
+  }
+  fs.copyFileSync(signing.profile, path.join(app, "embedded.mobileprovision"));
+  const codesign = ["--force", "--sign", signing.identity, "--timestamp=none"];
+  const frameworks = path.join(app, "Frameworks");
+  if (fs.existsSync(frameworks)) {
+    for (const name of fs.readdirSync(frameworks)) {
+      execFileSync("codesign", [...codesign, path.join(frameworks, name)]);
+    }
+  }
+  execFileSync("codesign", [
+    ...codesign,
+    "--entitlements",
+    signing.entitlements,
+    app,
+  ]);
+}
+
+function xcodeTeams() {
+  const valid = new Set(
+    [
+      ...execFileSync(
+        "security",
+        ["find-identity", "-v", "-p", "codesigning"],
+        {
+          encoding: "utf8",
+        },
+      ).matchAll(/\) ([0-9A-F]{40}) "Apple Development: /g),
+    ].map((match) => match[1]),
+  );
+  const certificates = execFileSync(
+    "security",
+    ["find-certificate", "-a", "-Z", "-p", "-c", "Apple Development"],
+    { encoding: "utf8" },
+  ).matchAll(
+    /SHA-1 hash: ([0-9A-F]{40})[\s\S]*?(-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----)/g,
+  );
+  const teams = new Map();
+  for (const [, hash, pem] of certificates) {
+    if (!valid.has(hash)) {
+      continue;
+    }
+    const subject = new X509Certificate(pem).subject;
+    const id = /^OU=(.+)$/m.exec(subject)?.[1];
+    if (id !== undefined && teamPattern.test(id)) {
+      teams.set(id, /^O=(.+)$/m.exec(subject)?.[1].replaceAll("\\", ""));
+    }
+  }
+  return [...teams].map(([id, name]) => ({ id, name }));
+}
+
+const teamList = (teams) =>
+  teams
+    .map((team) => `  ${team.id}${team.name ? `  ${team.name}` : ""}`)
+    .join("\n");
+
+function locate(options, device, fresh = false) {
+  const found = apps(device.udid)
+    .map((app) => ({
+      ...app,
+      team: sideloadedPattern.exec(app.bundleIdentifier)?.[1],
+    }))
+    .filter((app) => app.team !== undefined);
+  if (options.team !== undefined) {
+    if (!teamPattern.test(options.team)) {
+      throw new UsageError(
+        `invalid argument ${JSON.stringify(options.team)} for --team: it is the 10-character team ID shown in ${accountsHint}`,
+      );
+    }
+    return {
+      team: options.team,
+      current: found.find((app) => app.team === options.team),
+    };
+  }
+  if (found.length > 1) {
+    throw new Error(
+      `Swipt is sideloaded on ${device.name} by more than one team; choose one with --team ID:\n${teamList(found.map((app) => ({ id: app.team })))}`,
+    );
+  }
+  if (found.length === 0 && fresh) {
+    const teams = xcodeTeams();
+    if (teams.length !== 1) {
+      throw new Error(
+        teams.length === 0
+          ? `Xcode has no development certificate; sign in at ${accountsHint}, or choose a team with --team ID`
+          : `choose a team with --team ID:\n${teamList(teams)}`,
+      );
+    }
+    return { team: teams[0].id, current: undefined };
+  }
+  return { team: found[0]?.team, current: found[0] };
+}
+
+const buildText = (app) => `Swipt ${app.version} (${app.bundleVersion})`;
+
+async function deploy(context, onlyNewer) {
+  const device = coreDevice(context.options.device, { required: true });
+  const { team, current } = locate(context.options, device, !onlyNewer);
+  if (current === undefined && onlyNewer) {
+    throw new Error(
+      `Swipt is not sideloaded on ${device.name}${team === undefined ? "" : ` by team ${team}`}; install it with "swipt sideload install"`,
+    );
+  }
+  const passcode =
+    current === undefined ? passcodeOf(context.options) : undefined;
+  const release = await findRelease(context.options.nightly, context.signal);
+  if (current !== undefined) {
+    const installed = Number(current.bundleVersion);
+    if (installed === release.build) {
+      console.log(
+        `${buildText(current)} on ${device.name} is already ${release.tag}`,
+      );
+      return;
+    }
+    if (onlyNewer && installed > release.build) {
+      console.log(
+        `${buildText(current)} on ${device.name} is newer than ${release.tag} (${release.build})`,
+      );
+      return;
+    }
+  }
+  const id = `${bundleId}.${team}`;
+  const work = fs.mkdtempSync(path.join(os.tmpdir(), "swipt-sideload-"));
+  try {
+    console.error(
+      `downloading Swipt ${release.version} (${release.build}) from ${release.tag}`,
+    );
+    const ipa = path.join(work, "Swipt.ipa");
+    await download(release.ipa, ipa, context.signal);
+    const app = unpack(ipa, work);
+    console.error(`signing ${id} with team ${team} through Xcode`);
+    resign(app, id, provision(work, id, team, device));
+    console.error(`installing on ${device.name}`);
+    devicectl(["device", "install", "app", "--device", device.udid, app]);
+    if (current === undefined) {
+      console.error(`pairing with ${device.name}`);
+      pair(device, id, work);
+      if (passcode !== undefined) {
+        setUpAutoUnlock(device, id, work, passcode);
+      }
+    }
+  } finally {
+    fs.rmSync(work, { recursive: true, force: true });
+  }
+  const result = locate({ team }, device).current;
+  if (result === undefined || Number(result.bundleVersion) !== release.build) {
+    throw new Error(
+      `${device.name} ${result === undefined ? `does not list ${id}` : `has ${buildText(result)}`} after the install`,
+    );
+  }
+  console.log(
+    `${buildText(result)} is ${current === undefined ? "installed" : "updated"} on ${device.name}`,
+  );
+  try {
+    devicectl([
+      "device",
+      "process",
+      "launch",
+      "--terminate-existing",
+      "--device",
+      device.udid,
+      id,
+    ]);
+  } catch (error) {
+    if (/trusted by the user/.test(error.message)) {
+      console.log(
+        `it opens once the team's developer app is trusted in Settings › General › VPN & Device Management on ${device.name}`,
+      );
+    } else if (/BSErrorCodeDescription = Locked/.test(error.message)) {
+      console.log(`it opens once ${device.name} is unlocked`);
+    } else {
+      throw error;
+    }
+  }
+}
+
+export const install = (context) => deploy(context, false);
+
+export const update = (context) => deploy(context, true);
+
+const serverHint =
+  "swipt-server is missing; install @swipt/cli with its optional dependencies";
+
+function serverPath() {
+  let packaged;
+  try {
+    packaged = path.join(
+      path.dirname(
+        createRequire(import.meta.url).resolve(
+          `@swipt/server-${process.platform}-${process.arch}/package.json`,
+        ),
+      ),
+      "swipt-server",
+    );
+  } catch {
+    return "swipt-server";
+  }
+  return fs.existsSync(packaged) ? packaged : "swipt-server";
+}
+
+const schema = [
+  "CREATE TABLE grdb_migrations (identifier TEXT NOT NULL PRIMARY KEY)",
+  'CREATE TABLE "preferences" ("name" TEXT PRIMARY KEY NOT NULL, "data" BLOB NOT NULL)',
+  'CREATE TABLE "swiplets" ("id" TEXT PRIMARY KEY NOT NULL, "position" INTEGER NOT NULL, "etag" TEXT NOT NULL)',
+  'CREATE TABLE "repositories" ("url" TEXT PRIMARY KEY NOT NULL, "position" INTEGER NOT NULL, "name" TEXT NOT NULL, "localizedNames" TEXT, "iconColor" TEXT, "iconSymbol" TEXT, "image" BLOB, "etag" TEXT NOT NULL)',
+  'CREATE TABLE "repositorySwiplets" ("repository" TEXT NOT NULL REFERENCES "repositories"("url") ON DELETE CASCADE, "position" INTEGER NOT NULL, "id" TEXT NOT NULL, "name" TEXT NOT NULL, "localizedNames" TEXT NOT NULL, "description" TEXT NOT NULL, "version" TEXT NOT NULL, "versionCode" INTEGER NOT NULL, "iconColor" TEXT, "iconSymbol" TEXT, "url" TEXT NOT NULL, "sha256" TEXT NOT NULL, PRIMARY KEY ("repository", "id"))',
+  "INSERT INTO grdb_migrations VALUES ('0.1.0')",
+];
+
+function setUpAutoUnlock(device, id, work, passcode) {
+  const database = path.join(work, "Swipt.sqlite");
+  const preferences = {
+    serverAutoUnlocks: true,
+    serverAutoUnlockPasscodeType: passcodeTypes.indexOf(passcode.type),
+    serverAutoUnlockPasscode: passcode.passcode,
+    autoUnlockSetUp: true,
+  };
+  const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+  execFileSync("sqlite3", [database], {
+    input: [
+      ...schema,
+      ...Object.entries(preferences).map(
+        ([name, value]) =>
+          `INSERT INTO preferences VALUES (${quote(name)}, CAST(${quote(JSON.stringify(value))} AS BLOB))`,
+      ),
+    ]
+      .map((statement) => `${statement};\n`)
+      .join(""),
+  });
+  devicectl([
+    "device",
+    "copy",
+    "to",
+    "--device",
+    device.udid,
+    "--source",
+    database,
+    "--destination",
+    "Library/Application Support/Swipt.sqlite",
+    "--domain-type",
+    "appDataContainer",
+    "--domain-identifier",
+    id,
+  ]);
+}
+
+function pair(device, id, work) {
+  const record = path.join(work, "PairingRecord.plist");
+  const result = spawnSync(
+    serverPath(),
+    ["pair", "-d", device.udid, "-o", record],
+    { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] },
+  );
+  if (result.error?.code === "ENOENT") {
+    console.error(`${serverHint}; Swipt pairs in Settings instead`);
+    return;
+  }
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    console.error(
+      `pairing failed, so Swipt pairs in Settings instead: ${result.stderr.trim()}`,
+    );
+    return;
+  }
+  devicectl([
+    "device",
+    "copy",
+    "to",
+    "--device",
+    device.udid,
+    "--source",
+    record,
+    "--destination",
+    "Library/Application Support/PairingRecord.plist",
+    "--domain-type",
+    "appDataContainer",
+    "--domain-identifier",
+    id,
+  ]);
+}
+
+function serve(udid, passcode, signal) {
+  const server = spawn(
+    serverPath(),
+    [
+      "-d",
+      udid,
+      ...(passcode
+        ? ["--passcode", passcode.passcode, "--passcode-type", passcode.type]
+        : []),
+    ],
+    {
+      stdio: ["ignore", "pipe", "pipe"],
+      signal,
+    },
+  );
+  let logs = "";
+  server.stderr.on("data", (chunk) => {
+    logs += chunk;
+  });
+  const exited = new Promise((resolve) => server.once("close", resolve));
+  const url = new Promise((resolve, reject) => {
+    server.once("error", (error) =>
+      reject(error.code === "ENOENT" ? new Error(serverHint) : error),
+    );
+    exited.then((code) =>
+      reject(
+        new Error(
+          `swipt-server exited with ${code ?? "a signal"}${logs.trim() === "" ? "" : `: ${logs.trim()}`}`,
+        ),
+      ),
+    );
+    readline.createInterface({ input: server.stdout }).on("line", (line) => {
+      const found = /^Swipt API: (\S+)/.exec(line);
+      if (found) {
+        const parsed = new URL(found[1]);
+        parsed.hostname = "127.0.0.1";
+        resolve(parsed.origin);
+      }
+    });
+  });
+  return {
+    url,
+    stop() {
+      server.kill("SIGTERM");
+      return exited;
+    },
+  };
+}
+
+export async function start(context) {
+  const passcode = passcodeOf(context.options);
+  const device = coreDevice(context.options.device, { required: true });
+  const { team, current } = locate(context.options, device);
+  if (current === undefined) {
+    throw new Error(
+      `Swipt is not sideloaded on ${device.name}${team === undefined ? "" : ` by team ${team}`}`,
+    );
+  }
+  const server = serve(device.udid, passcode, context.signal);
+  try {
+    const client = open({ url: await server.url, token: "" });
+    let failure;
+    for await (const response of client.repl.execute(
+      {
+        code: fs.readFileSync(
+          new URL("sideload/trust.js", import.meta.url),
+          "utf8",
+        ),
+        args: [current.bundleIdentifier],
+        program: true,
+      },
+      { signal: context.signal },
+    )) {
+      switch (response.part.case) {
+        case "console": {
+          const output = response.part.value;
+          (output.level === LogLevel.ERROR || output.level === LogLevel.WARN
+            ? console.error
+            : console.log)(output.text);
+          break;
+        }
+        case "error":
+          failure = response.part.value;
+          break;
+      }
+    }
+    if (failure) {
+      throw printScriptError(failure);
+    }
+  } finally {
+    await server.stop();
+  }
+}
+
+export function uninstall(context) {
+  const device = coreDevice(context.options.device, { required: true });
+  const { team, current } = locate(context.options, device);
+  if (current === undefined) {
+    throw new Error(
+      `Swipt is not sideloaded on ${device.name}${team === undefined ? "" : ` by team ${team}`}`,
+    );
+  }
+  devicectl([
+    "device",
+    "uninstall",
+    "app",
+    "--device",
+    device.udid,
+    current.bundleIdentifier,
+  ]);
+  console.log(`removed ${buildText(current)} from ${device.name}`);
+}

package/swipt.mjs

@@ -7,6 +7,7 @@ import * as connection from "./connection.mjs";
 import * as device from "./device.mjs";
 import { FalseResult } from "./output.mjs";
 import { buildProject, createCommand, sourceCommand } from "./project.mjs";
+import * as sideload from "./sideload.mjs";
 
 const globalOptions = {
   help: { type: "boolean", short: "h", help: "help" },
@@ -17,10 +18,37 @@ const deviceOption = {
     type: "string",
     short: "d",
     value: "NAME|URL",
-    help: "the device to use (SWIPT_DEVICE)",
+    help: "the device to use",
   },
 };
 
+const sideloadOptions = {
+  device: {
+    type: "string",
+    short: "d",
+    value: "NAME|UDID",
+    help: "device paired with this Mac",
+  },
+  team: {
+    type: "string",
+    value: "ID",
+    help: "team ID, required if more than one",
+  },
+};
+
+const passcodeOptions = (help) => ({
+  passcode: { type: "string", value: "CODE", help },
+  "passcode-type": {
+    type: "string",
+    value: "TYPE",
+    help: "pin (4 or 6 digits, default), numeric or alphanumeric",
+  },
+});
+
+const nightlyOption = {
+  nightly: { type: "boolean", help: "use nightly build" },
+};
+
 const durationUnits = {
   ns: 1e-6,
   us: 1e-3,
@@ -195,6 +223,13 @@ const commands = [
         args: [1, 1],
         run: connection.remove,
       },
+      {
+        name: "stop",
+        short: "Stop the Swipt server",
+        args: [0, 0],
+        options: deviceOption,
+        run: device.stop,
+      },
       {
         name: "logs",
         short: "Print the logs",
@@ -347,6 +382,43 @@ const commands = [
       dataCommands("", device.replData),
     ],
   },
+  {
+    name: "sideload",
+    short: "Sideload Swipt, signed by Xcode",
+    options: sideloadOptions,
+    commands: [
+      {
+        name: "install",
+        short: "Install latest release",
+        args: [0, 0],
+        options: {
+          ...passcodeOptions("set up auto-unlock with this passcode"),
+          ...nightlyOption,
+        },
+        run: sideload.install,
+      },
+      {
+        name: "update",
+        short: "Update to latest release",
+        args: [0, 0],
+        options: nightlyOption,
+        run: sideload.update,
+      },
+      {
+        name: "start",
+        short: "Trust developer if needed and open Swipt",
+        args: [0, 0],
+        options: passcodeOptions("unlock device with this passcode"),
+        run: sideload.start,
+      },
+      {
+        name: "uninstall",
+        short: "Remove Swipt",
+        args: [0, 0],
+        run: sideload.uninstall,
+      },
+    ],
+  },
   {
     name: "version",
     short: "Print the version",