@tsconfigdotjson/vibe-os 0.0.0-stage → 0.1.0

package/server/config.ts

@@ -0,0 +1,362 @@
+import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs, promisify } from "node:util";
+
+const run = promisify(execFile);
+
+export interface Config {
+  /** Port for plain HTTP. Also serves ACME challenges when a domain is set. */
+  port: number;
+  host: string;
+  /** When set, provisions a Let's Encrypt certificate and serves HTTPS too. */
+  domain?: string;
+  tlsPort: number;
+  acmeEmail?: string;
+  acmeStaging: boolean;
+
+  /**
+   * The colour an installed PWA paints its window chrome with.
+   *
+   * Configurable because it is the fastest way to tell two installed instances
+   * apart. A laptop, a staging box and the real one all look identical in a
+   * dock otherwise, and installing the wrong one is the kind of mistake you
+   * only notice after typing into it.
+   */
+  themeColor: string;
+
+  /** Where the WebSocket bridge points. Defaults to this machine's sshd. */
+  sshHost: string;
+  sshPort: number;
+  /**
+   * `host` or `host:port` to print in the ssh commands offered for popping a
+   * terminal out to a real one.
+   *
+   * Unset is the common case and the good default: the host the browser used to
+   * reach the desktop is almost always the host sshd answers on, and unlike
+   * `sshHost` (`127.0.0.1`, where the bridge dials) it is something a person on
+   * another machine can actually type. Set this when the two really do differ —
+   * a reverse proxy in front of the web port, or sshd on a non-standard port.
+   */
+  sshAdvertise?: string;
+  /** Unix user the browser logs in as, and the certificate principal. */
+  user: string;
+
+  stateDir: string;
+  webRoot: string;
+  /** Absolute path to the built web assets, or null if not built. */
+  workspace: string;
+
+  /** null disables the gate entirely (with a loud warning at startup). */
+  token: string | null;
+  /**
+   * Names, beyond the ones the server works out for itself, that a request may
+   * use to reach it when there is no token. See `hostAllowed` in auth.ts.
+   */
+  allowedHosts: string[];
+  certTtlSeconds: number;
+  /**
+   * Keep each window in a dtach session so it survives a reload. Auto-detected
+   * from whether dtach is installed, unless forced.
+   */
+  sessions: boolean;
+}
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+/** server/config.ts -> dist/web */
+const DEFAULT_WEB_ROOT = path.resolve(HERE, "..", "dist", "web");
+
+export const OPTION_SPEC = {
+  port: { type: "string" as const },
+  host: { type: "string" as const },
+  domain: { type: "string" as const },
+  "tls-port": { type: "string" as const },
+  email: { type: "string" as const },
+  "acme-staging": { type: "boolean" as const },
+  "ssh-host": { type: "string" as const },
+  "ssh-port": { type: "string" as const },
+  "ssh-advertise": { type: "string" as const },
+  user: { type: "string" as const },
+  "state-dir": { type: "string" as const },
+  "web-root": { type: "string" as const },
+  workspace: { type: "string" as const },
+  token: { type: "string" as const },
+  "no-token": { type: "boolean" as const },
+  "allowed-host": { type: "string" as const, multiple: true },
+  "cert-ttl": { type: "string" as const },
+  "theme-color": { type: "string" as const },
+  sessions: { type: "boolean" as const },
+  "no-sessions": { type: "boolean" as const },
+  // doctor only, same reasoning as the install-browser block below: parseArgs
+  // is strict, so a flag it has never heard of is an error.
+  reap: { type: "boolean" as const },
+  // install-browser only. Kept here because parseArgs is strict, and a flag it
+  // has never heard of is an error rather than something a subcommand can read.
+  geometry: { type: "string" as const },
+  display: { type: "string" as const },
+  "vnc-port": { type: "string" as const },
+  "cdp-port": { type: "string" as const },
+  "restart-at": { type: "string" as const },
+  "no-restart": { type: "boolean" as const },
+  "vnc-password": { type: "string" as const },
+  "no-vnc-password": { type: "boolean" as const },
+  help: { type: "boolean" as const, short: "h" },
+  version: { type: "boolean" as const, short: "v" },
+};
+
+export type RawOptions = Partial<
+  Record<Exclude<keyof typeof OPTION_SPEC, "allowed-host">, string | boolean>
+> & { "allowed-host"?: string[] };
+
+/**
+ * Flags that mean "generate one" when given no value.
+ *
+ * `--vnc-password` joins `--token` here for a reason beyond symmetry: a password
+ * typed on a command line lands in shell history and in `ps`, so the bare form
+ * that generates and prints one is the form worth reaching for.
+ */
+const OPTIONAL_VALUE_FLAGS = ["--token", "--vnc-password"];
+
+/**
+ * Makes a bare `--token` mean "generate one".
+ *
+ * That is what the help text has always promised — `--token [value]` — and what
+ * the VPS instructions tell people to type, but `parseArgs` has no notion of an
+ * optional value: a string option with nothing after it is an error, and the
+ * error talks about ambiguity rather than saying what to do. Rewriting it to
+ * `--token=` here is the whole fix, and it is done before parsing so everything
+ * downstream still sees one shape.
+ */
+function allowBareToken(argv: string[]): string[] {
+  return argv.map((arg, i) => {
+    if (!OPTIONAL_VALUE_FLAGS.includes(arg)) return arg;
+    const next = argv[i + 1];
+    return next === undefined || next.startsWith("-") ? `${arg}=` : arg;
+  });
+}
+
+export function parseCliArgs(argv: string[]): {
+  values: RawOptions;
+  positionals: string[];
+} {
+  const { values, positionals } = parseArgs({
+    args: allowBareToken(argv),
+    options: OPTION_SPEC,
+    allowPositionals: true,
+    strict: true,
+  });
+  return { values: values as RawOptions, positionals };
+}
+
+async function hasDtach(): Promise<boolean> {
+  try {
+    // dtach exits non-zero with no mode, so its usage text is the liveness
+    // check; `--help` is not a flag it accepts either.
+    await run("dtach", ["--help"], { timeout: 5_000 });
+    return true;
+  } catch (err) {
+    return (
+      (err as { stdout?: string })?.stdout?.includes("dtach - version") === true
+    );
+  }
+}
+
+/**
+ * A CSS hex colour, which is all the manifest and the meta tag accept.
+ *
+ * Validated rather than passed through: it lands in a JSON document and in an
+ * HTML attribute, and "whatever the operator typed" is not something either
+ * should be asked to carry.
+ */
+/**
+ * A neutral slate, deliberately not the cyan accent.
+ *
+ * The accent already means "this is the thing you are pointing at" inside the
+ * app; reusing it for the window chrome would make the chrome look active.
+ */
+const DEFAULT_THEME = "#1c2128";
+
+function hexColour(value: unknown, label: string): string {
+  const colour = String(value).trim();
+  if (!/^#[0-9a-fA-F]{6}$/.test(colour))
+    throw new Error(`invalid --${label}: ${colour} is not a #rrggbb colour`);
+  return colour.toLowerCase();
+}
+
+/**
+ * A Unix username, as `ssh-keygen -n` will read it.
+ *
+ * That flag takes a comma-separated *list*, so `--user vibe,root` would quietly
+ * mint certificates valid for root as well. Operator-supplied rather than
+ * attacker-supplied, so this is a footgun rather than a hole — but the check is
+ * one line, and the same value is interpolated into doctor's `-C user=…` spec,
+ * where a comma corrupts the connection string too.
+ */
+function userName(value: unknown, label: string): string {
+  const name = String(value);
+  if (!/^[a-z_][a-z0-9_-]*\$?$/.test(name))
+    throw new Error(`invalid --${label}: ${name}`);
+  return name;
+}
+
+function num(value: unknown, fallback: number, label: string): number {
+  if (value === undefined || value === "") return fallback;
+  const n = Number(value);
+  // `Number("")` is 0, which used to pass this guard and make Bun bind a random
+  // ephemeral port — while the banner printed that port as the URL. Fractions
+  // and out-of-range values were accepted just as quietly.
+  if (!Number.isInteger(n) || n < 0)
+    throw new Error(`invalid --${label}: ${String(value)}`);
+  return n;
+}
+
+/** Ports specifically: the same rules, plus the range one can actually bind. */
+function port_(value: unknown, fallback: number, label: string): number {
+  const n = num(value, fallback, label);
+  if (n < 1 || n > 65535)
+    throw new Error(`invalid --${label}: ${String(value)} is not a port`);
+  return n;
+}
+
+/**
+ * A boolean from a flag or an environment variable.
+ *
+ * `Boolean(x)` is wrong for the environment half: every non-empty string is
+ * true, so `VIBE_OS_ACME_STAGING=0` and `=false` both turned staging *on* —
+ * which quietly points certificate issuance at Let's Encrypt's staging CA and
+ * produces a certificate no browser trusts.
+ */
+function flag(value: unknown): boolean {
+  if (typeof value === "boolean") return value;
+  if (value === undefined || value === null) return false;
+  const v = String(value).trim().toLowerCase();
+  return !(v === "" || v === "0" || v === "false" || v === "no" || v === "off");
+}
+
+interface PersistedConfig {
+  token?: string | null;
+  [key: string]: unknown;
+}
+
+export async function loadPersisted(
+  stateDir: string,
+): Promise<PersistedConfig> {
+  try {
+    return JSON.parse(
+      await readFile(path.join(stateDir, "config.json"), "utf8"),
+    ) as PersistedConfig;
+  } catch {
+    return {};
+  }
+}
+
+export async function savePersisted(
+  stateDir: string,
+  patch: PersistedConfig,
+): Promise<void> {
+  await mkdir(stateDir, { recursive: true, mode: 0o700 });
+  const current = await loadPersisted(stateDir);
+  await writeFile(
+    path.join(stateDir, "config.json"),
+    `${JSON.stringify({ ...current, ...patch }, null, 2)}\n`,
+    {
+      mode: 0o600,
+    },
+  );
+}
+
+export async function resolveConfig(values: RawOptions): Promise<Config> {
+  const stateDir = String(
+    values["state-dir"] ??
+      process.env.VIBE_OS_STATE_DIR ??
+      path.join(os.homedir(), ".vibe-os"),
+  );
+  const persisted = await loadPersisted(stateDir);
+
+  // A token unless told otherwise: --no-token, or VIBE_OS_NO_TOKEN for the
+  // container. Given none, the one from the last run, or a new one.
+  let token: string | null;
+  if (flag(values["no-token"] ?? process.env.VIBE_OS_NO_TOKEN)) {
+    token = null;
+  } else if (typeof values.token === "string" && values.token.length > 0) {
+    token = values.token;
+  } else if (process.env.VIBE_OS_TOKEN) {
+    token = process.env.VIBE_OS_TOKEN;
+  } else {
+    token = persisted.token ?? randomBytes(24).toString("base64url");
+  }
+
+  const allowedHosts = [
+    ...(values["allowed-host"] ?? []),
+    ...(process.env.VIBE_OS_ALLOWED_HOSTS?.split(",") ?? []),
+  ]
+    .map((h) => h.trim().toLowerCase())
+    .filter(Boolean);
+
+  const sessions = values["no-sessions"]
+    ? false
+    : values.sessions
+      ? true
+      : await hasDtach();
+
+  return {
+    port: port_(values.port ?? process.env.VIBE_OS_PORT, 80, "port"),
+    host: String(values.host ?? process.env.VIBE_OS_HOST ?? "0.0.0.0"),
+    domain:
+      (values.domain as string) ?? process.env.VIBE_OS_DOMAIN ?? undefined,
+    tlsPort: port_(
+      values["tls-port"] ?? process.env.VIBE_OS_TLS_PORT,
+      443,
+      "tls-port",
+    ),
+    acmeEmail:
+      (values.email as string) ?? process.env.VIBE_OS_ACME_EMAIL ?? undefined,
+    acmeStaging: flag(
+      values["acme-staging"] ?? process.env.VIBE_OS_ACME_STAGING,
+    ),
+    themeColor: hexColour(
+      values["theme-color"] ?? process.env.VIBE_OS_THEME_COLOR ?? DEFAULT_THEME,
+      "theme-color",
+    ),
+    sshHost: String(
+      values["ssh-host"] ?? process.env.VIBE_OS_SSH_HOST ?? "127.0.0.1",
+    ),
+    sshPort: port_(
+      values["ssh-port"] ?? process.env.VIBE_OS_SSH_PORT,
+      22,
+      "ssh-port",
+    ),
+    sshAdvertise:
+      (values["ssh-advertise"] as string) ??
+      process.env.VIBE_OS_SSH_ADVERTISE ??
+      undefined,
+    user: userName(
+      values.user ?? process.env.VIBE_OS_USER ?? os.userInfo().username,
+      "user",
+    ),
+    stateDir,
+    webRoot: path.resolve(
+      String(
+        values["web-root"] ?? process.env.VIBE_OS_WEB_ROOT ?? DEFAULT_WEB_ROOT,
+      ),
+    ),
+    workspace: path.resolve(
+      String(
+        values.workspace ??
+          process.env.VIBE_OS_WORKSPACE ??
+          path.join(os.homedir(), "workspace"),
+      ),
+    ),
+    token,
+    allowedHosts,
+    certTtlSeconds: num(
+      values["cert-ttl"] ?? process.env.VIBE_OS_CERT_TTL,
+      12 * 60 * 60,
+      "cert-ttl",
+    ),
+    sessions,
+  };
+}

package/server/db.ts

@@ -0,0 +1,262 @@
+// Persistence for projects, workspaces and window layout.
+//
+// SQLite via bun:sqlite, which is built into the runtime — no service to run
+// and one file in the state directory. The schema is applied as idempotent DDL
+// at startup rather than through drizzle-kit migration files, because a
+// `bun build --compile` binary has no directory to read .sql from. Verified to
+// behave identically under `bun run` and compiled.
+
+import { Database } from "bun:sqlite";
+import path from "node:path";
+import { getTableColumns } from "drizzle-orm";
+import { type BunSQLiteDatabase, drizzle } from "drizzle-orm/bun-sqlite";
+import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { log } from "./log.ts";
+
+/** A git repository checked out on this machine. */
+export const projects = sqliteTable("projects", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  path: text("path").notNull().unique(),
+  /** Branch the repo's main checkout is on, refreshed on scan. */
+  branch: text("branch"),
+  /** origin remote, when it has one — usually the GitHub URL. */
+  remote: text("remote"),
+  createdAt: integer("created_at").notNull(),
+});
+
+/** A git worktree of a project — what the UI calls a workspace. */
+export const workspaces = sqliteTable(
+  "workspaces",
+  {
+    id: text("id").primaryKey(),
+    projectId: text("project_id").notNull(),
+    /** Three words, kebab-case. Doubles as the branch and the dtach prefix. */
+    name: text("name").notNull(),
+    branch: text("branch").notNull(),
+    path: text("path").notNull(),
+    createdAt: integer("created_at").notNull(),
+    lastOpenedAt: integer("last_opened_at").notNull(),
+  },
+  (t) => [index("workspaces_project_idx").on(t.projectId)],
+);
+
+/**
+ * A role you can open a terminal as — "QA Engineer", "Backend Manager".
+ *
+ * Scoped to a project rather than a workspace: the prompts and flags belong to
+ * the codebase, and workspaces are throwaway worktrees of it.
+ */
+export const profiles = sqliteTable(
+  "profiles",
+  {
+    id: text("id").primaryKey(),
+    projectId: text("project_id").notNull(),
+    name: text("name").notNull(),
+    /** Palette token, not a hex value — the CSS owns what the colours are. */
+    color: text("color").notNull(),
+    /** 'claude' | 'shell' | 'custom' */
+    harness: text("harness").notNull(),
+    /** Executable for the custom harness; unused by the other two. */
+    command: text("command"),
+    /** JSON array of argv tokens, so each can be quoted on its own. */
+    args: text("args").notNull().default("[]"),
+    prompt: text("prompt").notNull().default(""),
+    /** Order in the rail. */
+    position: integer("position").notNull(),
+    createdAt: integer("created_at").notNull(),
+  },
+  (t) => [index("profiles_project_idx").on(t.projectId)],
+);
+
+/** One terminal window, with its place on the grid. */
+export const windows = sqliteTable(
+  "windows",
+  {
+    id: text("id").primaryKey(),
+    workspaceId: text("workspace_id").notNull(),
+    /** Per-workspace counter; forms the session name with the workspace. */
+    idx: integer("idx").notNull(),
+    col: integer("col").notNull(),
+    row: integer("row").notNull(),
+    colSpan: integer("col_span").notNull(),
+    rowSpan: integer("row_span").notNull(),
+    z: integer("z").notNull(),
+    minimized: integer("minimized").notNull().default(0),
+    /** The profile this window was opened as, or null for a plain terminal. */
+    profileId: text("profile_id"),
+    /** The prompt band has been handed off and should stay closed. */
+    promptDone: integer("prompt_done").notNull().default(0),
+    /**
+     * 'ssh' while this window's terminal belongs to an ssh client instead of
+     * the desktop, or null. A browser pop-out is not recorded here: those two
+     * documents share an origin and settle it over a BroadcastChannel, and a
+     * flag that outlived a closed pop-up would strand the window.
+     */
+    handoff: text("handoff"),
+    /** When the handoff was made, so one that never got used can be reaped. */
+    handoffAt: integer("handoff_at"),
+    /** Set once a terminal has actually attached to this window's session. */
+    handoffSeen: integer("handoff_seen").notNull().default(0),
+    createdAt: integer("created_at").notNull(),
+  },
+  (t) => [index("windows_workspace_idx").on(t.workspaceId)],
+);
+
+const DDL = [
+  `CREATE TABLE IF NOT EXISTS projects (
+     id TEXT PRIMARY KEY,
+     name TEXT NOT NULL,
+     path TEXT NOT NULL UNIQUE,
+     branch TEXT,
+     remote TEXT,
+     created_at INTEGER NOT NULL
+   )`,
+  `CREATE TABLE IF NOT EXISTS workspaces (
+     id TEXT PRIMARY KEY,
+     project_id TEXT NOT NULL,
+     name TEXT NOT NULL,
+     branch TEXT NOT NULL,
+     path TEXT NOT NULL,
+     created_at INTEGER NOT NULL,
+     last_opened_at INTEGER NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS workspaces_project_idx ON workspaces (project_id)`,
+  `CREATE TABLE IF NOT EXISTS profiles (
+     id TEXT PRIMARY KEY,
+     project_id TEXT NOT NULL,
+     name TEXT NOT NULL,
+     color TEXT NOT NULL,
+     harness TEXT NOT NULL,
+     command TEXT,
+     args TEXT NOT NULL DEFAULT '[]',
+     prompt TEXT NOT NULL DEFAULT '',
+     position INTEGER NOT NULL,
+     created_at INTEGER NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS profiles_project_idx ON profiles (project_id)`,
+  `CREATE TABLE IF NOT EXISTS windows (
+     id TEXT PRIMARY KEY,
+     workspace_id TEXT NOT NULL,
+     idx INTEGER NOT NULL,
+     col INTEGER NOT NULL,
+     row INTEGER NOT NULL,
+     col_span INTEGER NOT NULL,
+     row_span INTEGER NOT NULL,
+     z INTEGER NOT NULL,
+     minimized INTEGER NOT NULL DEFAULT 0,
+     profile_id TEXT,
+     prompt_done INTEGER NOT NULL DEFAULT 0,
+     handoff TEXT,
+     handoff_at INTEGER,
+     handoff_seen INTEGER NOT NULL DEFAULT 0,
+     created_at INTEGER NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS windows_workspace_idx ON windows (workspace_id)`,
+];
+
+/**
+ * Columns added to a table that already existed.
+ *
+ * The DDL above is all CREATE TABLE IF NOT EXISTS, which does nothing at all to
+ * a database from an earlier version — so a new column has to arrive this way
+ * or it only ever appears for people starting from scratch. ADD COLUMN is the
+ * one schema change SQLite does cheaply and in place.
+ */
+// Every value here is a compile-time literal, which is what makes the string
+// concatenation in `ensureColumn` safe — SQLite cannot parameterise identifiers
+// or DDL, so there is no bound-parameter form of ALTER TABLE. Nothing from a
+// request may ever reach this list.
+const ADDED_COLUMNS: [table: string, column: string, decl: string][] = [
+  ["windows", "profile_id", "TEXT"],
+  ["windows", "prompt_done", "INTEGER NOT NULL DEFAULT 0"],
+  ["windows", "handoff", "TEXT"],
+  ["windows", "handoff_at", "INTEGER"],
+  ["windows", "handoff_seen", "INTEGER NOT NULL DEFAULT 0"],
+];
+
+function ensureColumn(
+  sqlite: Database,
+  table: string,
+  column: string,
+  decl: string,
+): void {
+  const existing = sqlite.query(`PRAGMA table_info(${table})`).all() as {
+    name: string;
+  }[];
+  if (existing.some((c) => c.name === column)) return;
+  sqlite.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${decl}`);
+  log.info(`migrated ${table}: added ${column}`);
+}
+
+export type Db = BunSQLiteDatabase<{
+  projects: typeof projects;
+  workspaces: typeof workspaces;
+  profiles: typeof profiles;
+  windows: typeof windows;
+}>;
+
+export function openDb(stateDir: string): Db {
+  const file = path.join(stateDir, "vibe-os.db");
+  const sqlite = new Database(file, { create: true });
+
+  // WAL keeps reads from blocking the writes the UI makes on every drag.
+  sqlite.run("PRAGMA journal_mode = WAL");
+  // On for anything added later. No table declares a REFERENCES clause today,
+  // so this currently enforces nothing: the cascades are done by hand, in
+  // projects.ts and profiles.ts. Do not read it as a guarantee.
+  sqlite.run("PRAGMA foreign_keys = ON");
+  for (const statement of DDL) sqlite.run(statement);
+  for (const [table, column, decl] of ADDED_COLUMNS)
+    ensureColumn(sqlite, table, column, decl);
+
+  assertSchemaMatches(sqlite);
+
+  log.debug(`opened database at ${file}`);
+  return drizzle(sqlite, {
+    schema: { projects, workspaces, profiles, windows },
+  });
+}
+
+/**
+ * Fails loudly if the live tables do not have every column the code reads.
+ *
+ * Each migrated column is declared three times — in the drizzle schema, in the
+ * CREATE TABLE DDL, and in ADDED_COLUMNS — and nothing forces those to agree. A
+ * column added to the DDL and forgotten in ADDED_COLUMNS works perfectly on a
+ * fresh install and breaks only on upgrade, which is the failure the comment on
+ * ADDED_COLUMNS exists to prevent and could not actually catch. Checking what
+ * the code expects against what the file has turns that into a startup error
+ * with the column name in it.
+ */
+function assertSchemaMatches(sqlite: Database): void {
+  const tables = { projects, workspaces, profiles, windows };
+  const missing: string[] = [];
+  for (const [name, table] of Object.entries(tables)) {
+    const live = new Set(
+      (
+        sqlite.query(`PRAGMA table_info(${name})`).all() as { name: string }[]
+      ).map((c) => c.name),
+    );
+    for (const column of Object.values(getTableColumns(table))) {
+      if (!live.has(column.name)) missing.push(`${name}.${column.name}`);
+    }
+  }
+  if (missing.length > 0) {
+    throw new Error(
+      `database is missing column(s) the code expects: ${missing.join(", ")}. ` +
+        "A column was added to the schema without a matching ADDED_COLUMNS entry.",
+    );
+  }
+}
+
+export const newId = () => crypto.randomUUID();
+
+/**
+ * What a valid id looks like coming back over HTTP.
+ *
+ * Lives here beside `newId` because it has to accept what that produces. It was
+ * declared once in `api.ts` as `ID` and again in `attach.ts` as `WINDOW_ID`,
+ * byte-identical, and both validate the same values.
+ */
+export const ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;