@tikoci/quickchr 0.2.0

package/src/lib/rest.ts

@@ -0,0 +1,244 @@
+/**
+ * Centralized HTTP client for all RouterOS CHR REST API calls.
+ *
+ * Uses node:http with agent:false to bypass Bun's connection pool.
+ * Bun pools TCP connections by host:port; when a CHR is stopped and a new
+ * one starts on the same port, the pool returns stale responses. This is
+ * the root cause of "REST flakiness" we chased across 7 sessions.
+ *
+ * Uses setTimeout + done flag instead of req.setTimeout + req.destroy
+ * because Bun's node:http req.destroy() does not reliably emit the
+ * "error" event, which would leave the Promise pending forever.
+ *
+ * External URLs (mikrotik.com, upgrade server) use fetch() — no pool
+ * issue there. This module is ONLY for CHR REST calls (127.0.0.1).
+ */
+
+import { request as nodeRequest } from "node:http";
+
+export interface RestResponse {
+	status: number;
+	body: string;
+}
+
+/**
+ * HTTP GET to a CHR REST endpoint.
+ *
+ * @param url        Full URL, e.g. "http://127.0.0.1:9100/rest/system/resource"
+ * @param auth       HTTP Authorization header value (e.g. "Basic YWRtaW46")
+ * @param timeoutMs  Per-request timeout in milliseconds (default 10s)
+ */
+export function restGet(
+	url: string,
+	auth: string,
+	timeoutMs = 10_000,
+): Promise<RestResponse> {
+	return new Promise((resolve, reject) => {
+		const parsed = new URL(url);
+		let done = false;
+
+		const timer = setTimeout(() => {
+			if (!done) { done = true; req.destroy(); reject(new Error(`restGet timeout after ${timeoutMs}ms: ${url}`)); }
+		}, timeoutMs);
+
+		const req = nodeRequest(
+			{
+				hostname: parsed.hostname,
+				port: parsed.port,
+				path: parsed.pathname + parsed.search,
+				method: "GET",
+				headers: { Authorization: auth, Connection: "close" },
+				agent: false,
+			},
+			(res) => {
+				let body = "";
+				res.on("data", (chunk: Buffer) => { body += chunk.toString(); });
+				res.on("end", () => {
+					if (!done) { done = true; clearTimeout(timer); resolve({ status: res.statusCode ?? 0, body }); }
+				});
+				res.on("error", (e) => {
+					if (!done) { done = true; clearTimeout(timer); reject(e); }
+				});
+			},
+		);
+		req.on("error", (e) => {
+			if (!done) { done = true; clearTimeout(timer); reject(e); }
+		});
+		req.end();
+	});
+}
+
+/**
+ * HTTP POST to a CHR REST endpoint with a JSON body.
+ *
+ * @param url        Full URL, e.g. "http://127.0.0.1:9100/rest/system/reboot"
+ * @param auth       HTTP Authorization header value
+ * @param jsonBody   Object to serialize as JSON request body
+ * @param timeoutMs  Per-request timeout in milliseconds (default 10s)
+ */
+export function restPost(
+	url: string,
+	auth: string,
+	jsonBody: Record<string, unknown>,
+	timeoutMs = 10_000,
+): Promise<RestResponse> {
+	return new Promise((resolve, reject) => {
+		const parsed = new URL(url);
+		const bodyBuf = Buffer.from(JSON.stringify(jsonBody), "utf-8");
+		let done = false;
+
+		const timer = setTimeout(() => {
+			if (!done) { done = true; req.destroy(); reject(new Error(`restPost timeout after ${timeoutMs}ms: ${url}`)); }
+		}, timeoutMs);
+
+		const req = nodeRequest(
+			{
+				hostname: parsed.hostname,
+				port: parsed.port,
+				path: parsed.pathname + parsed.search,
+				method: "POST",
+				headers: {
+					Authorization: auth,
+					"Content-Type": "application/json",
+					"Content-Length": bodyBuf.length,
+					Connection: "close",
+				},
+				agent: false,
+			},
+			(res) => {
+				let body = "";
+				res.on("data", (chunk: Buffer) => { body += chunk.toString(); });
+				res.on("end", () => {
+					if (!done) { done = true; clearTimeout(timer); resolve({ status: res.statusCode ?? 0, body }); }
+				});
+				res.on("error", (e) => {
+					if (!done) { done = true; clearTimeout(timer); reject(e); }
+				});
+			},
+		);
+		req.on("error", (e) => {
+			if (!done) { done = true; clearTimeout(timer); reject(e); }
+		});
+		req.write(bodyBuf);
+		req.end();
+	});
+}
+
+/**
+ * HTTP PATCH to a CHR REST endpoint with a JSON body.
+ *
+ * @param url        Full URL, e.g. "http://127.0.0.1:9100/rest/user/*1"
+ * @param auth       HTTP Authorization header value
+ * @param jsonBody   Object to serialize as JSON request body
+ * @param timeoutMs  Per-request timeout in milliseconds (default 10s)
+ */
+export function restPatch(
+	url: string,
+	auth: string,
+	jsonBody: Record<string, unknown>,
+	timeoutMs = 10_000,
+): Promise<RestResponse> {
+	return new Promise((resolve, reject) => {
+		const parsed = new URL(url);
+		const bodyBuf = Buffer.from(JSON.stringify(jsonBody), "utf-8");
+		let done = false;
+
+		const timer = setTimeout(() => {
+			if (!done) { done = true; req.destroy(); reject(new Error(`restPatch timeout after ${timeoutMs}ms: ${url}`)); }
+		}, timeoutMs);
+
+		const req = nodeRequest(
+			{
+				hostname: parsed.hostname,
+				port: parsed.port,
+				path: parsed.pathname + parsed.search,
+				method: "PATCH",
+				headers: {
+					Authorization: auth,
+					"Content-Type": "application/json",
+					"Content-Length": bodyBuf.length,
+					Connection: "close",
+				},
+				agent: false,
+			},
+			(res) => {
+				let body = "";
+				res.on("data", (chunk: Buffer) => { body += chunk.toString(); });
+				res.on("end", () => {
+					if (!done) { done = true; clearTimeout(timer); resolve({ status: res.statusCode ?? 0, body }); }
+				});
+				res.on("error", (e) => {
+					if (!done) { done = true; clearTimeout(timer); reject(e); }
+				});
+			},
+		);
+		req.on("error", (e) => {
+			if (!done) { done = true; clearTimeout(timer); reject(e); }
+		});
+		req.write(bodyBuf);
+		req.end();
+	});
+}
+
+/**
+ * Generic HTTP request to a CHR REST endpoint.
+ * Used for arbitrary methods (PUT, DELETE) or when method is dynamic.
+ *
+ * @param url        Full URL
+ * @param method     HTTP method
+ * @param auth       HTTP Authorization header value
+ * @param jsonBody   Optional JSON body (for POST/PUT/PATCH)
+ * @param timeoutMs  Per-request timeout in milliseconds (default 10s)
+ */
+export function restRequest(
+	url: string,
+	method: string,
+	auth: string,
+	jsonBody?: Record<string, unknown> | string | null,
+	timeoutMs = 10_000,
+): Promise<RestResponse> {
+	return new Promise((resolve, reject) => {
+		const parsed = new URL(url);
+		const bodyStr = jsonBody != null
+			? (typeof jsonBody === "string" ? jsonBody : JSON.stringify(jsonBody))
+			: null;
+		const bodyBuf = bodyStr != null ? Buffer.from(bodyStr, "utf-8") : null;
+		let done = false;
+
+		const timer = setTimeout(() => {
+			if (!done) { done = true; req.destroy(); reject(new Error(`restRequest timeout after ${timeoutMs}ms: ${method} ${url}`)); }
+		}, timeoutMs);
+
+		const headers: Record<string, string | number> = { Authorization: auth, Connection: "close" };
+		if (bodyBuf) {
+			headers["Content-Type"] = "application/json";
+			headers["Content-Length"] = bodyBuf.length;
+		}
+
+		const req = nodeRequest(
+			{
+				hostname: parsed.hostname,
+				port: parsed.port,
+				path: parsed.pathname + parsed.search,
+				method,
+				headers,
+				agent: false,
+			},
+			(res) => {
+				let body = "";
+				res.on("data", (chunk: Buffer) => { body += chunk.toString(); });
+				res.on("end", () => {
+					if (!done) { done = true; clearTimeout(timer); resolve({ status: res.statusCode ?? 0, body }); }
+				});
+				res.on("error", (e) => {
+					if (!done) { done = true; clearTimeout(timer); reject(e); }
+				});
+			},
+		);
+		req.on("error", (e) => {
+			if (!done) { done = true; clearTimeout(timer); reject(e); }
+		});
+		if (bodyBuf) req.write(bodyBuf);
+		req.end();
+	});
+}

package/src/lib/secrets.ts

@@ -0,0 +1,133 @@
+/**
+ * Cross-platform secret storage wrapper.
+ *
+ * Uses Bun.secrets when available (macOS Keychain, Linux libsecret, Windows
+ * Credential Manager).  Falls back to a config file with 0o600 permissions
+ * when Bun.secrets is unavailable (Node.js, older Bun, headless Linux without
+ * a secret-service daemon).
+ *
+ * Callers should never touch Bun.secrets directly — this module handles the
+ * runtime detection and fallback.
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+
+function configDir(): string {
+	return join(process.env.HOME ?? process.env.USERPROFILE ?? homedir(), ".config", "quickchr");
+}
+
+/** True when the Bun.secrets API is available at runtime. */
+function hasBunSecrets(): boolean {
+	try {
+		return typeof Bun !== "undefined" && Bun.secrets != null;
+	} catch {
+		return false;
+	}
+}
+
+// --- Config-file fallback helpers ---
+
+function configPath(service: string): string {
+	// One JSON file per service, keyed by name
+	const safeName = service.replace(/[^a-zA-Z0-9._-]/g, "_");
+	return join(configDir(), `${safeName}.json`);
+}
+
+function readConfigStore(service: string): Record<string, string> {
+	const path = configPath(service);
+	if (!existsSync(path)) return {};
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {};
+	}
+}
+
+function writeConfigStore(service: string, store: Record<string, string>): void {
+	const path = configPath(service);
+	const dir = dirname(path);
+	if (!existsSync(dir)) {
+		mkdirSync(dir, { recursive: true });
+	}
+	writeFileSync(path, JSON.stringify(store, null, 2), "utf8");
+	chmodSync(path, 0o600);
+}
+
+// --- Public API ---
+
+/** Retrieve a secret from the config file only (no OS keychain).
+ *  Use for credentials that don't need OS-level security (e.g., per-instance CHR passwords). */
+export function secretGetSync(service: string, name: string): string | null {
+	return readConfigStore(service)[name] ?? null;
+}
+
+/** Store a secret in the config file only (no OS keychain). */
+export function secretSetSync(service: string, name: string, value: string): void {
+	const store = readConfigStore(service);
+	store[name] = value;
+	writeConfigStore(service, store);
+}
+
+/** Delete a secret from the config file only (no OS keychain).  Returns true if deleted. */
+export function secretDeleteSync(service: string, name: string): boolean {
+	const store = readConfigStore(service);
+	if (!(name in store)) return false;
+	delete store[name];
+	writeConfigStore(service, store);
+	return true;
+}
+
+/** Retrieve a secret.  Returns null when not found. */
+export async function secretGet(service: string, name: string): Promise<string | null> {
+	if (hasBunSecrets()) {
+		try {
+			return await Bun.secrets.get({ service, name });
+		} catch {
+			// Bun.secrets threw (e.g. no keyring daemon on Linux) — fall through
+		}
+	}
+	return readConfigStore(service)[name] ?? null;
+}
+
+/** Store or update a secret. */
+export async function secretSet(service: string, name: string, value: string): Promise<void> {
+	if (hasBunSecrets()) {
+		try {
+			await Bun.secrets.set({ service, name, value });
+			return;
+		} catch {
+			// fall through to config file
+		}
+	}
+	const store = readConfigStore(service);
+	store[name] = value;
+	writeConfigStore(service, store);
+}
+
+/** Delete a secret.  Returns true if something was deleted. */
+export async function secretDelete(service: string, name: string): Promise<boolean> {
+	let deleted = false;
+	if (hasBunSecrets()) {
+		try {
+			deleted = await Bun.secrets.delete({ service, name });
+		} catch {
+			// ignore
+		}
+	}
+	// Always clean up config file entry too
+	const store = readConfigStore(service);
+	if (name in store) {
+		delete store[name];
+		writeConfigStore(service, store);
+		deleted = true;
+	}
+	return deleted;
+}
+
+/** Human-readable label for where secrets are stored. */
+export function secretStorageLabel(): string {
+	if (hasBunSecrets()) return "OS credential store (via Bun.secrets)";
+	return `config file (${configDir()})`;
+}

package/src/lib/socket-registry.ts

@@ -0,0 +1,140 @@
+/**
+ * Named socket registry — persistent named L2 links between CHR instances.
+ * Socket entries are stored as JSON files in ~/.local/share/quickchr/networks/.
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync, rmSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { QuickCHRError } from "./types.ts";
+import { getDataDir } from "./state.ts";
+
+export interface SocketEntry {
+	name: string;
+	mode: "mcast" | "listen-connect";
+	mcastGroup?: string;
+	port: number;
+	createdAt: string;
+	members: string[];
+}
+
+const DEFAULT_START_PORT = 4000;
+const DEFAULT_MCAST_GROUP = "230.0.0.1";
+
+// In-memory write-through cache — works around Bun Windows FS caching bugs
+// where writeFileSync followed by immediate readdirSync/readFileSync returns stale data.
+// Uses a Map for well-defined semantics on every Bun platform; the previous plain-
+// object + `in`-operator approach silently failed on windows-latest under Bun (CI #1).
+const _cache: Map<string, SocketEntry> = new Map();
+
+/** Reset in-memory socket cache. Exported for test cleanup only. */
+export function _resetSocketCache(): void {
+	_cache.clear();
+}
+
+export function getSocketRegistryDir(): string {
+	const dir = join(getDataDir(), "networks");
+	mkdirSync(dir, { recursive: true });
+	return dir;
+}
+
+function socketPath(name: string): string {
+	return join(getSocketRegistryDir(), `${name}.json`);
+}
+
+function saveEntry(entry: SocketEntry): void {
+	writeFileSync(socketPath(entry.name), JSON.stringify(entry, null, "\t") + "\n");
+	_cache.set(entry.name, entry);
+}
+
+function allocatePort(existing: SocketEntry[]): number {
+	if (existing.length === 0) return DEFAULT_START_PORT;
+	const maxPort = Math.max(...existing.map((e) => e.port));
+	return maxPort + 1;
+}
+
+export function createNamedSocket(
+	name: string,
+	opts?: { mode?: "mcast" | "listen-connect"; port?: number; mcastGroup?: string },
+): SocketEntry {
+	if (_cache.has(name) || existsSync(socketPath(name))) {
+		throw new QuickCHRError("STATE_ERROR", `Named socket "${name}" already exists`);
+	}
+
+	const mode = opts?.mode ?? "mcast";
+	const port = opts?.port ?? allocatePort(listNamedSockets());
+	const mcastGroup = mode === "mcast" ? (opts?.mcastGroup ?? DEFAULT_MCAST_GROUP) : undefined;
+
+	const entry: SocketEntry = {
+		name,
+		mode,
+		port,
+		mcastGroup,
+		createdAt: new Date().toISOString(),
+		members: [],
+	};
+
+	saveEntry(entry);
+	return entry;
+}
+
+export function getNamedSocket(name: string): SocketEntry | undefined {
+	const cached = _cache.get(name);
+	if (cached) return cached;
+	try {
+		const entry = JSON.parse(readFileSync(socketPath(name), "utf-8")) as SocketEntry;
+		_cache.set(name, entry);
+		return entry;
+	} catch {
+		return undefined;
+	}
+}
+
+export function listNamedSockets(): SocketEntry[] {
+	const dir = getSocketRegistryDir();
+	const merged = new Map(_cache);
+	try {
+		for (const file of readdirSync(dir)) {
+			if (!file.endsWith(".json")) continue;
+			const name = file.replace(/\.json$/, "");
+			if (!merged.has(name)) {
+				try {
+					const entry = JSON.parse(readFileSync(join(dir, file), "utf-8")) as SocketEntry;
+					merged.set(name, entry);
+					_cache.set(name, entry);
+				} catch {}
+			}
+		}
+	} catch {}
+	return Array.from(merged.values());
+}
+
+export function removeNamedSocket(name: string): boolean {
+	const wasCached = _cache.has(name);
+	_cache.delete(name);
+	const path = socketPath(name);
+	if (!existsSync(path)) return wasCached;
+	rmSync(path);
+	return true;
+}
+
+export function addSocketMember(name: string, machineName: string): void {
+	const entry = getNamedSocket(name);
+	if (!entry) {
+		throw new QuickCHRError("STATE_ERROR", `Named socket "${name}" not found`);
+	}
+	if (!entry.members.includes(machineName)) {
+		entry.members.push(machineName);
+		saveEntry(entry);
+	}
+}
+
+export function removeSocketMember(name: string, machineName: string): void {
+	const entry = getNamedSocket(name);
+	if (!entry) return;
+	entry.members = entry.members.filter((m) => m !== machineName);
+	if (entry.members.length === 0) {
+		removeNamedSocket(name);
+	} else {
+		saveEntry(entry);
+	}
+}

package/src/lib/state.ts

@@ -0,0 +1,173 @@
+/**
+ * Machine state persistence — JSON files in ~/.local/share/quickchr/machines/.
+ */
+
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, rmSync, statSync } from "node:fs";
+import { join, } from "node:path";
+import type { MachineState, } from "./types.ts";
+import { QuickCHRError } from "./types.ts";
+import { networkModeToConfigs } from "./network.ts";
+
+/** Get the quickchr data directory root. Override with QUICKCHR_DATA_DIR env var. */
+export function getDataDir(): string {
+	if (process.env.QUICKCHR_DATA_DIR) return process.env.QUICKCHR_DATA_DIR;
+	if (process.platform === "win32") {
+		const appData = process.env.LOCALAPPDATA || join(process.env.USERPROFILE || "", "AppData", "Local");
+		return join(appData, "quickchr");
+	}
+	const home = process.env.HOME || process.env.USERPROFILE || "";
+	return join(home, ".local", "share", "quickchr");
+}
+
+/** Get the machines directory. */
+export function getMachinesDir(): string {
+	return join(getDataDir(), "machines");
+}
+
+/** Get the cache directory. */
+export function getCacheDir(): string {
+	return join(getDataDir(), "cache");
+}
+
+/** Get a specific machine's directory. */
+export function getMachineDir(name: string): string {
+	return join(getMachinesDir(), name);
+}
+
+/** Get the path to a machine's state file. */
+function machineJsonPath(name: string): string {
+	return join(getMachineDir(name), "machine.json");
+}
+
+/** Ensure a directory exists. */
+export function ensureDir(dir: string): void {
+	mkdirSync(dir, { recursive: true });
+}
+
+/** Save machine state to disk. */
+export function saveMachine(state: MachineState): void {
+	ensureDir(state.machineDir);
+	writeFileSync(machineJsonPath(state.name), JSON.stringify(state, null, "\t") + "\n");
+}
+
+/** Load machine state from disk. Returns undefined if not found. */
+export function loadMachine(name: string): MachineState | undefined {
+	const path = machineJsonPath(name);
+	if (!existsSync(path)) return undefined;
+	const data = readFileSync(path, "utf-8");
+	const state = JSON.parse(data) as MachineState;
+	// Migrate legacy `network` field → `networks` array
+	if (!state.networks && (state as unknown as Record<string, unknown>).network) {
+		const legacy = (state as unknown as Record<string, unknown>).network as MachineState["networks"][0]["specifier"] | "user" | "vmnet-shared" | { type: "vmnet-bridge"; iface: string };
+		state.networks = networkModeToConfigs(legacy as Parameters<typeof networkModeToConfigs>[0]);
+	} else if (!state.networks) {
+		state.networks = [{ specifier: "user", id: "net0" }];
+	}
+	return state;
+}
+
+/** Load all machine states. */
+export function loadAllMachines(): MachineState[] {
+	const dir = getMachinesDir();
+	if (!existsSync(dir)) return [];
+
+	const entries = readdirSync(dir, { withFileTypes: true });
+	const machines: MachineState[] = [];
+
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		const state = loadMachine(entry.name);
+		if (state) machines.push(state);
+	}
+
+	return machines;
+}
+
+/** Get all existing machine names. */
+export function listMachineNames(): string[] {
+	const dir = getMachinesDir();
+	if (!existsSync(dir)) return [];
+	return readdirSync(dir, { withFileTypes: true })
+		.filter((e) => e.isDirectory())
+		.map((e) => e.name);
+}
+
+/** Get all port bases currently in use by existing machines. */
+export function getUsedPortBases(): number[] {
+	return loadAllMachines().map((m) => m.portBase);
+}
+
+/** Delete a machine and all its files. */
+export function removeMachine(name: string): void {
+	const dir = getMachineDir(name);
+	if (!existsSync(dir)) {
+		throw new QuickCHRError("MACHINE_NOT_FOUND", `Machine "${name}" not found`);
+	}
+	rmSync(dir, { recursive: true, force: true });
+}
+
+/** Update the status of a machine. */
+export function updateMachineStatus(
+	name: string,
+	status: MachineState["status"],
+	pid?: number,
+): void {
+	const state = loadMachine(name);
+	if (!state) {
+		throw new QuickCHRError("MACHINE_NOT_FOUND", `Machine "${name}" not found`);
+	}
+	state.status = status;
+	state.pid = pid;
+	if (status === "running") {
+		state.lastStartedAt = new Date().toISOString();
+	}
+	saveMachine(state);
+}
+
+/** Check if a machine is actually still running (verify PID). */
+export function isMachineRunning(state: MachineState): boolean {
+	if (state.status !== "running" || !state.pid) return false;
+	try {
+		process.kill(state.pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+/** Refresh status for all machines (check PIDs). */
+export function refreshAllStatuses(): MachineState[] {
+	const machines = loadAllMachines();
+	for (const m of machines) {
+		if (m.status === "running" && !isMachineRunning(m)) {
+			m.status = "stopped";
+			m.pid = undefined;
+			saveMachine(m);
+		}
+	}
+	return machines;
+}
+
+/** Prune old cached images older than the given number of days. */
+export function pruneCache(maxAgeDays: number = 30): number {
+	const cacheDir = getCacheDir();
+	if (!existsSync(cacheDir)) return 0;
+
+	const now = Date.now();
+	const maxAgeMs = maxAgeDays * 24 * 60 * 60 * 1000;
+	let removed = 0;
+
+	const entries = readdirSync(cacheDir);
+	for (const entry of entries) {
+		const fullPath = join(cacheDir, entry);
+		try {
+			const stat = statSync(fullPath);
+			if (now - stat.mtimeMs > maxAgeMs) {
+				rmSync(fullPath);
+				removed++;
+			}
+		} catch { /* skip */ }
+	}
+
+	return removed;
+}