@swipt/cli 0.1.0-nightly.45 → 0.1.0-nightly.46

package/connection.mjs

@@ -155,7 +155,7 @@ const requiresToken = (found) =>
   `${found.name} requires a token: swipt device add ${withToken(found.url)}`;
 
 export async function attach(context) {
-  const given = context.options.device ?? process.env.SWIPT_DEVICE;
+  const given = context.options.device;
   const stored = load();
   let device;
   if (given && /[:/]/.test(given)) {
@@ -197,7 +197,7 @@ export async function attach(context) {
     }
     if (names.length > 1) {
       throw new Error(
-        `there is more than one device: ${names.join(", ")}; choose one with -d or SWIPT_DEVICE`,
+        `there is more than one device: ${names.join(", ")}; choose one with -d`,
       );
     }
     device = parseURL(stored[names[0]]);

package/coredevice.mjs

@@ -34,7 +34,7 @@ export function devicectl(args, { parse = false } = {}) {
   return parsed;
 }
 
-export function coreDevice(given) {
+export function coreDevice(given, { required = false } = {}) {
   const devices = devicectl(["list", "devices"], { parse: true })
     .result.devices.filter(
       (device) =>
@@ -51,13 +51,19 @@ export function coreDevice(given) {
           sameName(device.udid, given) ||
           sameName(label(device.name), label(given)),
       )
-    : devices;
+    : required
+      ? []
+      : devices;
   if (matches.length !== 1) {
-    const found = matches.length === 0 ? "no" : "more than one";
+    const reason = !given
+      ? "choose a device with -d NAME|UDID"
+      : matches.length === 0
+        ? `no iOS device is named ${given}`
+        : `more than one iOS device is named ${given}; choose one by UDID`;
     throw new Error(
-      given
-        ? `${found} iOS device is named ${given}`
-        : `${found} iOS device is paired; choose one with -d NAME|UDID`,
+      devices.length === 0
+        ? `${reason}; no iOS device is paired with this Mac`
+        : `${reason}; paired iOS devices:\n${devices.map((device) => `  ${device.name}  ${device.udid}`).join("\n")}`,
     );
   }
   return matches[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swipt/cli",
-  "version": "0.1.0-nightly.45",
+  "version": "0.1.0-nightly.46",
   "license": "GPL-3.0-or-later",
   "repository": {
     "type": "git",
@@ -32,11 +32,11 @@
     "react-native-worklets": "0.13.0"
   },
   "peerDependencies": {
-    "@swipt/api": "0.1.0-nightly.45"
+    "@swipt/api": "0.1.0-nightly.46"
   },
   "optionalDependencies": {
-    "@swipt/server-darwin-arm64": "0.1.0-nightly.45",
-    "@swipt/server-darwin-x64": "0.1.0-nightly.45"
+    "@swipt/server-darwin-arm64": "0.1.0-nightly.46",
+    "@swipt/server-darwin-x64": "0.1.0-nightly.46"
   },
   "devDependencies": {
     "@bufbuild/protoc-gen-es": "^2.16.0"

package/sideload.mjs

@@ -1,5 +1,5 @@
 import { execFileSync, spawn, spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
+import { X509Certificate, createHash } from "node:crypto";
 import fs from "node:fs";
 import { createRequire } from "node:module";
 import os from "node:os";
@@ -31,7 +31,7 @@ function passcodeOf(options) {
       `invalid argument ${JSON.stringify(type)} for --passcode-type: it is ${passcodeTypes.join(", ")}`,
     );
   }
-  const passcode = options.passcode ?? process.env.SWIPT_PASSCODE;
+  const passcode = options.passcode;
   if (!passcode) {
     return undefined;
   }
@@ -51,7 +51,7 @@ function passcodeOf(options) {
 }
 
 function headers(accept) {
-  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const token = process.env.GITHUB_TOKEN;
   return {
     Accept: accept,
     "X-GitHub-Api-Version": "2022-11-28",
@@ -72,7 +72,7 @@ async function github(url, accept, signal) {
   if (!response.ok) {
     let message = `GitHub answered ${response.status} for ${url}`;
     if ([401, 403, 404, 429].includes(response.status)) {
-      message += `; ${process.env.GITHUB_TOKEN || process.env.GH_TOKEN ? "GITHUB_TOKEN" : "set GITHUB_TOKEN to a token that"} must read the repository and stay under the rate limit`;
+      message += `; ${process.env.GITHUB_TOKEN ? "GITHUB_TOKEN" : "set GITHUB_TOKEN to a token that"} must read the repository and stay under the rate limit`;
     }
     throw new Error(message);
   }
@@ -317,7 +317,45 @@ function resign(app, id, signing) {
   ]);
 }
 
-function locate(options, device) {
+function xcodeTeams() {
+  const valid = new Set(
+    [
+      ...execFileSync(
+        "security",
+        ["find-identity", "-v", "-p", "codesigning"],
+        {
+          encoding: "utf8",
+        },
+      ).matchAll(/\) ([0-9A-F]{40}) "Apple Development: /g),
+    ].map((match) => match[1]),
+  );
+  const certificates = execFileSync(
+    "security",
+    ["find-certificate", "-a", "-Z", "-p", "-c", "Apple Development"],
+    { encoding: "utf8" },
+  ).matchAll(
+    /SHA-1 hash: ([0-9A-F]{40})[\s\S]*?(-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----)/g,
+  );
+  const teams = new Map();
+  for (const [, hash, pem] of certificates) {
+    if (!valid.has(hash)) {
+      continue;
+    }
+    const subject = new X509Certificate(pem).subject;
+    const id = /^OU=(.+)$/m.exec(subject)?.[1];
+    if (id !== undefined && teamPattern.test(id)) {
+      teams.set(id, /^O=(.+)$/m.exec(subject)?.[1].replaceAll("\\", ""));
+    }
+  }
+  return [...teams].map(([id, name]) => ({ id, name }));
+}
+
+const teamList = (teams) =>
+  teams
+    .map((team) => `  ${team.id}${team.name ? `  ${team.name}` : ""}`)
+    .join("\n");
+
+function locate(options, device, fresh = false) {
   const found = apps(device.udid)
     .map((app) => ({
       ...app,
@@ -337,25 +375,35 @@ function locate(options, device) {
   }
   if (found.length > 1) {
     throw new Error(
-      `Swipt is sideloaded on ${device.name} by more than one team (${found.map((app) => app.team).join(", ")}); choose one with --team`,
+      `Swipt is sideloaded on ${device.name} by more than one team; choose one with --team ID:\n${teamList(found.map((app) => ({ id: app.team })))}`,
     );
   }
+  if (found.length === 0 && fresh) {
+    const teams = xcodeTeams();
+    if (teams.length !== 1) {
+      throw new Error(
+        teams.length === 0
+          ? `Xcode has no development certificate; sign in at ${accountsHint}, or choose a team with --team ID`
+          : `choose a team with --team ID:\n${teamList(teams)}`,
+      );
+    }
+    return { team: teams[0].id, current: undefined };
+  }
   return { team: found[0]?.team, current: found[0] };
 }
 
 const buildText = (app) => `Swipt ${app.version} (${app.bundleVersion})`;
 
 async function deploy(context, onlyNewer) {
-  const passcode = passcodeOf(context.options);
-  const device = coreDevice(context.options.device ?? process.env.SWIPT_DEVICE);
-  const { team, current } = locate(context.options, device);
-  if (team === undefined) {
+  const device = coreDevice(context.options.device, { required: true });
+  const { team, current } = locate(context.options, device, !onlyNewer);
+  if (current === undefined && onlyNewer) {
     throw new Error(
-      onlyNewer
-        ? `Swipt is not sideloaded on ${device.name}; install it with "swipt sideload install"`
-        : `Swipt is not sideloaded on ${device.name} yet; choose the team with --team ID, as shown in ${accountsHint}`,
+      `Swipt is not sideloaded on ${device.name}${team === undefined ? "" : ` by team ${team}`}; install it with "swipt sideload install"`,
     );
   }
+  const passcode =
+    current === undefined ? passcodeOf(context.options) : undefined;
   const release = await findRelease(context.options.nightly, context.signal);
   if (current !== undefined) {
     const installed = Number(current.bundleVersion);
@@ -432,12 +480,9 @@ export const install = (context) => deploy(context, false);
 export const update = (context) => deploy(context, true);
 
 const serverHint =
-  "swipt-server is missing; install @swipt/cli with its optional dependencies, or name it with SWIPT_SERVER_PATH";
+  "swipt-server is missing; install @swipt/cli with its optional dependencies";
 
 function serverPath() {
-  if (process.env.SWIPT_SERVER_PATH) {
-    return process.env.SWIPT_SERVER_PATH;
-  }
   let packaged;
   try {
     packaged = path.join(
@@ -540,12 +585,14 @@ function pair(device, id, work) {
 function serve(udid, passcode, signal) {
   const server = spawn(
     serverPath(),
-    ["-d", udid, ...(passcode ? ["--passcode-type", passcode.type] : [])],
+    [
+      "-d",
+      udid,
+      ...(passcode
+        ? ["--passcode", passcode.passcode, "--passcode-type", passcode.type]
+        : []),
+    ],
     {
-      env: {
-        ...process.env,
-        ...(passcode ? { SWIPT_PASSCODE: passcode.passcode } : {}),
-      },
       stdio: ["ignore", "pipe", "pipe"],
       signal,
     },
@@ -586,7 +633,7 @@ function serve(udid, passcode, signal) {
 
 export async function start(context) {
   const passcode = passcodeOf(context.options);
-  const device = coreDevice(context.options.device ?? process.env.SWIPT_DEVICE);
+  const device = coreDevice(context.options.device, { required: true });
   const { team, current } = locate(context.options, device);
   if (current === undefined) {
     throw new Error(
@@ -630,7 +677,7 @@ export async function start(context) {
 }
 
 export function uninstall(context) {
-  const device = coreDevice(context.options.device ?? process.env.SWIPT_DEVICE);
+  const device = coreDevice(context.options.device, { required: true });
   const { team, current } = locate(context.options, device);
   if (current === undefined) {
     throw new Error(

package/swipt.mjs

@@ -18,7 +18,7 @@ const deviceOption = {
     type: "string",
     short: "d",
     value: "NAME|URL",
-    help: "the device to use (SWIPT_DEVICE)",
+    help: "the device to use",
   },
 };
 
@@ -27,33 +27,26 @@ const sideloadOptions = {
     type: "string",
     short: "d",
     value: "NAME|UDID",
-    help: "the paired iOS device (SWIPT_DEVICE)",
+    help: "device paired with this Mac",
   },
   team: {
     type: "string",
     value: "ID",
-    help: "the team ID (default: the team of the installed Swipt)",
+    help: "team ID, required if more than one",
   },
 };
 
-const passcodeOptions = {
-  passcode: {
-    type: "string",
-    value: "CODE",
-    help: "the device passcode, for unlocking it (SWIPT_PASSCODE)",
-  },
+const passcodeOptions = (help) => ({
+  passcode: { type: "string", value: "CODE", help },
   "passcode-type": {
     type: "string",
     value: "TYPE",
-    help: "pin for 4 or 6 digits, numeric or alphanumeric for a custom code (default pin)",
+    help: "pin (4 or 6 digits, default), numeric or alphanumeric",
   },
-};
+});
 
 const nightlyOption = {
-  nightly: {
-    type: "boolean",
-    help: "the nightly build",
-  },
+  nightly: { type: "boolean", help: "use nightly build" },
 };
 
 const durationUnits = {
@@ -391,33 +384,36 @@ const commands = [
   },
   {
     name: "sideload",
-    short: "Install the Swipt app on a paired device",
+    short: "Sideload Swipt, signed by Xcode",
     options: sideloadOptions,
     commands: [
       {
         name: "install",
-        short: "Install the latest release",
+        short: "Install latest release",
         args: [0, 0],
-        options: { ...passcodeOptions, ...nightlyOption },
+        options: {
+          ...passcodeOptions("set up auto-unlock with this passcode"),
+          ...nightlyOption,
+        },
         run: sideload.install,
       },
       {
         name: "update",
-        short: "Install the latest release if it is newer",
+        short: "Update to latest release",
         args: [0, 0],
-        options: { ...passcodeOptions, ...nightlyOption },
+        options: nightlyOption,
         run: sideload.update,
       },
       {
         name: "start",
-        short: "Open the app, trusting its developer if needed",
+        short: "Trust developer if needed and open Swipt",
         args: [0, 0],
-        options: passcodeOptions,
+        options: passcodeOptions("unlock device with this passcode"),
         run: sideload.start,
       },
       {
         name: "uninstall",
-        short: "Remove the app",
+        short: "Remove Swipt",
         args: [0, 0],
         run: sideload.uninstall,
       },