@tsconfigdotjson/vibe-os 0.0.0-stage → 0.2.0-rc.1

package/scripts/compile.ts

@@ -0,0 +1,62 @@
+#!/usr/bin/env bun
+// Compiles vibe-os into standalone executables.
+//
+// The output needs no Bun, no Node and no npm on the target machine — the whole
+// web app, including the ~20MB ssh.wasm and its precompressed variants, is
+// embedded. That makes the VPS install "download one file and run it".
+
+import { mkdir, stat } from "node:fs/promises";
+import path from "node:path";
+
+const ROOT = path.resolve(import.meta.dir, "..");
+const OUT = path.join(ROOT, "dist", "bin");
+const ENTRY = path.join(ROOT, "server", "main.ts");
+
+const TARGETS = [
+  { target: "bun-linux-x64", name: "vibe-os-linux-x64" },
+  { target: "bun-linux-arm64", name: "vibe-os-linux-arm64" },
+  { target: "bun-darwin-arm64", name: "vibe-os-darwin-arm64" },
+];
+
+const only = process.argv.slice(2).filter((a) => !a.startsWith("-"));
+const selected =
+  only.length > 0
+    ? TARGETS.filter((t) => only.some((o) => t.target.includes(o)))
+    : TARGETS;
+
+if (selected.length === 0) {
+  console.error(
+    `no target matched. known: ${TARGETS.map((t) => t.target).join(", ")}`,
+  );
+  process.exit(1);
+}
+
+await mkdir(OUT, { recursive: true });
+
+for (const { target, name } of selected) {
+  const outfile = path.join(OUT, name);
+  console.log(`vibe-os: compiling ${target}…`);
+  const proc = Bun.spawn(
+    [
+      "bun",
+      "build",
+      "--compile",
+      `--target=${target}`,
+      // Stack traces would point at bundled output anyway, and the server code
+      // is a rounding error next to the embedded wasm.
+      "--minify",
+      "--sourcemap=none",
+      ENTRY,
+      "--outfile",
+      outfile,
+    ],
+    { cwd: ROOT, stdout: "inherit", stderr: "inherit" },
+  );
+  const code = await proc.exited;
+  if (code !== 0) {
+    console.error(`vibe-os: compiling ${target} failed`);
+    process.exit(code);
+  }
+  const size = (await stat(outfile)).size;
+  console.log(`vibe-os: ${name} — ${(size / 1024 / 1024).toFixed(1)} MB`);
+}

package/scripts/compress.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+
+// Precompresses large static assets after `vite build`.
+//
+// ssh.wasm is ~20MB and every first-time visitor pays for it. Compressing at
+// build time (rather than per-request) lets the server hand out a ~5MB body
+// with zero CPU cost at serve time.
+
+import { readFile, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { brotliCompress, constants, gzip } from "node:zlib";
+import { walk } from "./lib/walk.ts";
+
+const br = promisify(brotliCompress);
+const gz = promisify(gzip);
+
+const WEB = path.resolve(
+  fileURLToPath(new URL("../dist/web", import.meta.url)),
+);
+const COMPRESSIBLE = /\.(wasm|js|css|html|json|svg)$/;
+const MIN_SIZE = 4096;
+
+const t0 = Date.now();
+let count = 0;
+let saved = 0;
+
+for await (const file of walk(WEB)) {
+  if (!COMPRESSIBLE.test(file) || /\.(br|gz)$/.test(file)) continue;
+  const size = (await stat(file)).size;
+  if (size < MIN_SIZE) continue;
+
+  const raw = await readFile(file);
+  // Quality 5 rather than the default 11: on a 20MB wasm the top setting costs
+  // minutes of build time for a few percent of size.
+  const [brotli, gzipped] = await Promise.all([
+    br(raw, {
+      params: {
+        [constants.BROTLI_PARAM_QUALITY]: 5,
+        [constants.BROTLI_PARAM_SIZE_HINT]: size,
+      },
+    }),
+    gz(raw, { level: 6 }),
+  ]);
+  await writeFile(`${file}.br`, brotli);
+  await writeFile(`${file}.gz`, gzipped);
+  count += 1;
+  saved += size - brotli.length;
+}
+
+console.log(
+  `vibe-os: precompressed ${count} asset(s), saving ${(saved / 1024 / 1024).toFixed(1)} MB on the wire (${((Date.now() - t0) / 1000).toFixed(1)}s)`,
+);

package/scripts/fetch-wasm.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+
+// Fetches ssh.wasm + wasm_exec.js from an upstream c2FmZQ/sshterm release into
+// public/.
+//
+// The two files are a matched pair: wasm_exec.js is the host half of the Go
+// WASM ABI and is version-locked to the compiler that produced the .wasm, so
+// they always come from the same release tarball. Building from source instead
+// would require a Go toolchain on the target machine, which a VPS running
+// the npm package will not have.
+//
+// Flags:
+//   --if-missing   no-op when public/ssh.wasm already exists
+//   --soft-fail    warn and exit 0 on failure (used from postinstall, where a
+//                  hard failure would break `npm install` on an offline box;
+//                  the server retries this at startup)
+
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import {
+  mkdir,
+  mkdtemp,
+  readdir,
+  readFile,
+  rename,
+  rm,
+  stat,
+} from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { pipeline } from "node:stream/promises";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(fileURLToPath(new URL("..", import.meta.url)));
+const PUBLIC = path.join(ROOT, "public");
+const REPO = "c2FmZQ/sshterm";
+
+/**
+ * The release this project is built and tested against, with the checksum of
+ * its docroot tarball.
+ *
+ * Pinned rather than tracking `latest` because this file becomes the SSH client
+ * that generates and holds every user's private key in the browser, and it is
+ * fetched automatically by `postinstall`. Tracking `latest` meant whatever
+ * upstream tagged most recently became that code, unverified — so an install
+ * today and an install tomorrow could differ with nothing recording it.
+ *
+ * To move it: set SSHTERM_VERSION to the new tag, run this script, and copy the
+ * sha256 it prints into `sha256` below.
+ */
+const PINNED = {
+  tag: "v0.8.3",
+  sha256: "77af7cb2582ff43588d866277019351695c23880133929136532340937dba87c",
+};
+
+const args = new Set(process.argv.slice(2));
+const ifMissing = args.has("--if-missing");
+const softFail = args.has("--soft-fail");
+
+// Local rather than shared with server/fsx.ts: this asks a different question
+// (non-empty, because a half-written 0-byte ssh.wasm must not count as present)
+// and this script has to keep running under plain node, with no .ts imports.
+async function exists(p) {
+  try {
+    const s = await stat(p);
+    return s.size > 0;
+  } catch {
+    return false;
+  }
+}
+
+async function resolveAsset() {
+  const override = process.env.SSHTERM_VERSION;
+  const tag = override ?? PINNED.tag;
+  const url = `https://api.github.com/repos/${REPO}/releases/tags/${tag}`;
+  const res = await fetch(url, {
+    headers: {
+      accept: "application/vnd.github+json",
+      "user-agent": "vibe-os-installer",
+      ...(process.env.GITHUB_TOKEN
+        ? { authorization: `Bearer ${process.env.GITHUB_TOKEN}` }
+        : {}),
+    },
+  });
+  if (!res.ok)
+    throw new Error(`GitHub API ${res.status} ${res.statusText} for ${url}`);
+  const release = await res.json();
+  const asset = release.assets?.find((a) =>
+    /^sshterm-docroot-.*\.tar\.gz$/.test(a.name),
+  );
+  if (!asset) {
+    throw new Error(
+      `release ${release.tag_name} has no sshterm-docroot tarball`,
+    );
+  }
+  return {
+    tag: release.tag_name,
+    name: asset.name,
+    url: asset.browser_download_url,
+    // Only the pinned tag has a checksum recorded here; an override is by
+    // definition something this file has never seen.
+    sha256: override ? null : PINNED.sha256,
+  };
+}
+
+async function sha256Of(file) {
+  return createHash("sha256")
+    .update(await readFile(file))
+    .digest("hex");
+}
+
+function untar(tarball, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("tar", ["-xzf", tarball, "-C", cwd], {
+      stdio: ["ignore", "ignore", "pipe"],
+    });
+    let stderr = "";
+    child.stderr.on("data", (d) => (stderr += d));
+    child.on("error", reject);
+    child.on("close", (code) =>
+      code === 0
+        ? resolve()
+        : reject(new Error(`tar exited ${code}: ${stderr.trim()}`)),
+    );
+  });
+}
+
+// The tarball's internal layout is not part of any stability guarantee, so find
+// the two files wherever they landed rather than assuming a path.
+async function findFile(dir, name) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      const hit = await findFile(full, name);
+      if (hit) return hit;
+    } else if (entry.isFile() && entry.name === name) {
+      // isFile() excludes symlinks, which a tarball can carry and which would
+      // otherwise let an entry point anywhere on the filesystem.
+      return full;
+    }
+  }
+  return null;
+}
+
+async function main() {
+  await mkdir(PUBLIC, { recursive: true });
+
+  // Either location counts as "already have it": a git checkout keeps the pair
+  // in public/, while the published tarball ships it already copied into
+  // dist/web and does not include public/ at all. Checking only public/ would
+  // re-download 19MB on every `npm install` of the published package.
+  if (ifMissing) {
+    for (const dir of [PUBLIC, path.join(ROOT, "dist", "web")]) {
+      if (
+        (await exists(path.join(dir, "ssh.wasm"))) &&
+        (await exists(path.join(dir, "wasm_exec.js")))
+      )
+        return;
+    }
+  }
+
+  const asset = await resolveAsset();
+  console.log(`vibe-os: fetching ssh.wasm from ${REPO} ${asset.tag}`);
+
+  // mkdtemp, not a name we compose ourselves: it creates the directory
+  // atomically with an unpredictable suffix, so nothing in a world-writable
+  // /tmp can pre-create the path (or a symlink at it) and have the extracted
+  // contents land somewhere of its choosing. Same reasoning as server/ssh-ca.ts.
+  const tmp = await mkdtemp(path.join(os.tmpdir(), "vibe-os-wasm-"));
+  try {
+    const tarball = path.join(tmp, asset.name);
+    const res = await fetch(asset.url, {
+      headers: { "user-agent": "vibe-os-installer" },
+      redirect: "follow",
+    });
+    if (!res.ok || !res.body)
+      throw new Error(`download ${asset.url}: HTTP ${res.status}`);
+    await pipeline(res.body, createWriteStream(tarball));
+
+    const digest = await sha256Of(tarball);
+    if (asset.sha256 && digest !== asset.sha256) {
+      throw new Error(
+        `checksum mismatch for ${asset.name}\n` +
+          `  expected ${asset.sha256}\n` +
+          `  received ${digest}\n` +
+          "Refusing to install: this file becomes the SSH client that handles " +
+          "your private keys.",
+      );
+    }
+    if (!asset.sha256) {
+      console.warn(
+        `vibe-os: SSHTERM_VERSION=${asset.tag} is not the pinned release — ` +
+          "skipping checksum verification.",
+      );
+      console.warn(`vibe-os: sha256 of ${asset.name} is ${digest}`);
+    }
+
+    await untar(tarball, tmp);
+
+    // Resolve both halves before moving either. They are a matched pair, and a
+    // failure between two moves would leave a new ssh.wasm beside the previous
+    // wasm_exec.js — which --if-missing then treats as "already have it", so the
+    // mismatch would be permanent and would surface only as an opaque failure
+    // in the browser.
+    const staged = [];
+    for (const name of ["ssh.wasm", "wasm_exec.js"]) {
+      const found = await findFile(tmp, name);
+      if (!found) throw new Error(`${asset.name} does not contain ${name}`);
+      staged.push([name, found]);
+    }
+
+    for (const [name, found] of staged) {
+      await rename(found, path.join(PUBLIC, name)).catch(async (err) => {
+        // rename fails across devices; fall back to a copy.
+        if (err.code !== "EXDEV") throw err;
+        const { copyFile } = await import("node:fs/promises");
+        await copyFile(found, path.join(PUBLIC, name));
+      });
+    }
+
+    const size = (await stat(path.join(PUBLIC, "ssh.wasm"))).size;
+    console.log(
+      `vibe-os: ssh.wasm ready (${(size / 1024 / 1024).toFixed(1)} MB)`,
+    );
+  } finally {
+    await rm(tmp, { recursive: true, force: true });
+  }
+}
+
+main().catch((err) => {
+  if (softFail) {
+    console.warn(`vibe-os: could not fetch ssh.wasm (${err.message}).`);
+    console.warn(
+      "vibe-os: it will be fetched on first start, or run `vibe-os fetch-wasm`.",
+    );
+    process.exit(0);
+  }
+  console.error(`vibe-os: ${err.message}`);
+  process.exit(1);
+});

package/scripts/gen-assets.ts

@@ -0,0 +1,76 @@
+#!/usr/bin/env bun
+
+// Generates server/assets.generated.ts, the manifest that lets
+// `bun build --compile` embed the whole web app inside the binary.
+//
+// Bun only embeds files it can see as static imports, so the manifest has to be
+// written out rather than discovered at runtime. Filenames are content-hashed
+// by Vite and change every build, which is exactly why this is generated.
+
+import { createHash } from "node:crypto";
+import { stat } from "node:fs/promises";
+import path from "node:path";
+import { walk } from "./lib/walk.ts";
+
+const ROOT = path.resolve(import.meta.dir, "..");
+const WEB = path.join(ROOT, "dist", "web");
+const OUT = path.join(ROOT, "server", "assets.generated.ts");
+
+// A fresh clone has no dist/web yet, but static.ts imports this manifest
+// unconditionally — so emit an empty one rather than failing. postinstall runs
+// this, which is what lets `bun run dev:server` and `tsc` work before the first
+// build. The empty manifest also makes the server read assets off disk, which
+// is what you want in development.
+const files: string[] = [];
+try {
+  for await (const file of walk(WEB)) files.push(file);
+} catch (err) {
+  // Only "the directory is not there yet" is the ordinary case. Anything else —
+  // an unreadable subdirectory, EMFILE partway through — leaves `files` half
+  // populated, and reporting that as "empty" would embed a subset of the web
+  // app into the binary and serve 404s for the rest.
+  if ((err as NodeJS.ErrnoException)?.code !== "ENOENT") throw err;
+  if (files.length > 0) {
+    throw new Error(
+      `vibe-os: asset walk failed after ${files.length} file(s); refusing to write a partial manifest`,
+    );
+  }
+  console.log("vibe-os: no dist/web yet — writing an empty asset manifest");
+}
+files.sort();
+
+// Embedded files have no usable mtime, so the ETag needs another source of
+// change. Hash the manifest (names + sizes) into a per-build id.
+const hash = createHash("sha256");
+for (const file of files) hash.update(`${file}:${(await stat(file)).size}`);
+const buildId = hash.digest("hex").slice(0, 12);
+
+const imports: string[] = [];
+const entries: string[] = [];
+
+files.forEach((file, i) => {
+  const urlPath = `/${path.relative(WEB, file).split(path.sep).join("/")}`;
+  const specifier = `../dist/web${urlPath}`;
+  imports.push(
+    `import a${i} from ${JSON.stringify(specifier)} with { type: 'file' };`,
+  );
+  entries.push(`  ${JSON.stringify(urlPath)}: a${i},`);
+});
+
+const source = `// @ts-nocheck — generated; \`with { type: 'file' }\` imports are not modelled by tsc.
+// Generated by scripts/gen-assets.ts — do not edit.
+//
+// Maps URL paths to files embedded in the compiled binary. Under \`bun run\`
+// these resolve to real paths on disk, so the same code serves both modes.
+
+${imports.join("\n")}
+
+export const BUILD_ID = ${JSON.stringify(buildId)};
+
+export const EMBEDDED: Record<string, string> = {
+${entries.join("\n")}
+};
+`;
+
+await Bun.write(OUT, source);
+console.log(`vibe-os: embedded manifest lists ${files.length} asset(s)`);

package/scripts/lib/walk.ts

@@ -0,0 +1,18 @@
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+
+/**
+ * Every file under `dir`, depth-first.
+ *
+ * Both build scripts walk `dist/web` in the same `bun run build` pipeline, and
+ * had a byte-identical copy of this each. Symlinks come back as files rather
+ * than being followed, which is what you want for a build output tree — the
+ * caller stats them anyway.
+ */
+export async function* walk(dir: string): AsyncGenerator<string> {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) yield* walk(full);
+    else yield full;
+  }
+}

package/scripts/notices.ts

@@ -0,0 +1,189 @@
+#!/usr/bin/env bun
+
+// Generates THIRD_PARTY_NOTICES.md: the license of everything the binary and
+// the web app carry that this repository did not write.
+//
+// Two sources. npm packages are read out of node_modules, walking runtime
+// dependencies from the packages that actually ship: `dependencies`, which the
+// compiled server embeds, and the browser packages Vite bundles. ssh.wasm is
+// compiled Go, so it carries Go's standard library and the modules sshterm
+// links; their texts are fetched from GitHub at the versions in sshterm's
+// go.mod for the release `scripts/fetch-wasm.mjs` pins.
+//
+// Rerun after changing dependencies or moving the sshterm pin:
+//   bun run notices
+
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+const ROOT = path.resolve(import.meta.dir, "..");
+const OUT = path.join(ROOT, "THIRD_PARTY_NOTICES.md");
+
+/** devDependencies that end up in the browser bundle, not just the toolchain. */
+const BUNDLED = [
+  "react",
+  "react-dom",
+  "swr",
+  "@xterm/xterm",
+  "@xterm/addon-fit",
+  "@xterm/addon-unicode11",
+  "@xterm/addon-web-links",
+];
+
+/**
+ * What ssh.wasm links, from sshterm v0.8.3's go/go.mod, keeping the modules
+ * whose package paths appear in the compiled binary. Move these with the pin.
+ */
+const GO_MODULES: { name: string; repo: string; ref: string }[] = [
+  {
+    name: "Go (standard library, wasm_exec.js)",
+    repo: "golang/go",
+    ref: "go1.26.0",
+  },
+  { name: "sshterm", repo: "c2FmZQ/sshterm", ref: "v0.8.3" },
+  { name: "golang.org/x/crypto", repo: "golang/crypto", ref: "v0.49.0" },
+  {
+    name: "github.com/fxamacker/cbor/v2",
+    repo: "fxamacker/cbor",
+    ref: "v2.9.1",
+  },
+  { name: "github.com/x448/float16", repo: "x448/float16", ref: "v0.8.4" },
+  { name: "github.com/urfave/cli/v2", repo: "urfave/cli", ref: "v2.27.7" },
+  {
+    name: "github.com/russross/blackfriday/v2",
+    repo: "russross/blackfriday",
+    ref: "v2.1.0",
+  },
+  {
+    name: "github.com/cpuguy83/go-md2man/v2",
+    repo: "cpuguy83/go-md2man",
+    ref: "v2.0.7",
+  },
+  {
+    name: "github.com/xrash/smetrics",
+    repo: "xrash/smetrics",
+    ref: "55b8f293f342",
+  },
+  { name: "github.com/pkg/sftp", repo: "pkg/sftp", ref: "v1.13.10" },
+  { name: "github.com/kr/fs", repo: "kr/fs", ref: "v0.1.0" },
+];
+
+const LICENSE_FILE = /^(licen[sc]e|copying|notice)(\.(md|txt))?$/i;
+const LICENSE_NAMES = ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING"];
+
+type Entry = { name: string; version: string; license: string; text: string };
+
+function readPackage(name: string): Record<string, unknown> | null {
+  const file = path.join(ROOT, "node_modules", name, "package.json");
+  return existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null;
+}
+
+function repoOf(pkg: Record<string, unknown>): string | null {
+  const repo = pkg.repository;
+  const url = typeof repo === "string" ? repo : (repo as { url?: string })?.url;
+  const match = url && /github\.com[/:]([^/]+\/[^/.#]+)/.exec(url);
+  return match ? match[1] : null;
+}
+
+async function fetchLicense(repo: string, ref: string): Promise<string | null> {
+  for (const name of LICENSE_NAMES) {
+    const res = await fetch(
+      `https://raw.githubusercontent.com/${repo}/${ref}/${name}`,
+    );
+    if (res.ok) return (await res.text()).trim();
+  }
+  return null;
+}
+
+/** A README's "License" section, through to the end of the file. */
+function readmeLicense(dir: string): string | null {
+  const file = path.join(dir, "README.md");
+  if (!existsSync(file)) return null;
+  const match = /^(?:#+ *License\s*$|License\n-+$)([\s\S]+)/im.exec(
+    readFileSync(file, "utf8"),
+  );
+  return match ? match[1].trim() : null;
+}
+
+async function npmEntries(): Promise<Entry[]> {
+  const root = JSON.parse(
+    readFileSync(path.join(ROOT, "package.json"), "utf8"),
+  );
+  const roots = [
+    ...Object.keys((root.dependencies as Record<string, string>) ?? {}),
+    ...BUNDLED,
+  ];
+  const seen = new Map<string, Entry>();
+  const queue = [...roots];
+  while (queue.length > 0) {
+    const name = queue.shift() as string;
+    if (seen.has(name)) continue;
+    const pkg = readPackage(name);
+    if (!pkg) throw new Error(`${name} is not installed; run bun install`);
+    const dir = path.join(ROOT, "node_modules", name);
+    const file = readdirSync(dir).find((f) => LICENSE_FILE.test(f));
+    // A few packages publish without their license file. Older ones keep the
+    // text as the README's last section; otherwise the repository has it, at
+    // HEAD rather than the version, which is the best a tarball that omitted
+    // it allows.
+    const repo = repoOf(pkg);
+    const text = file
+      ? readFileSync(path.join(dir, file), "utf8").trim()
+      : (readmeLicense(dir) ??
+        (repo ? await fetchLicense(repo, "HEAD") : null));
+    if (!text) throw new Error(`no license text found for ${name}`);
+    seen.set(name, {
+      name,
+      version: String(pkg.version),
+      license: String(pkg.license ?? "see text"),
+      text,
+    });
+    queue.push(...Object.keys((pkg.dependencies as object) ?? {}));
+  }
+  return [...seen.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+async function goEntries(): Promise<Entry[]> {
+  return Promise.all(
+    GO_MODULES.map(async ({ name, repo, ref }) => {
+      const text = await fetchLicense(repo, ref);
+      if (!text) throw new Error(`no license text found for ${repo}@${ref}`);
+      return { name, version: ref, license: "see text", text };
+    }),
+  );
+}
+
+const section = (entries: Entry[]) =>
+  entries
+    .map(
+      (e) =>
+        `### ${e.name} ${e.version}\n\nLicense: ${e.license}\n\n\`\`\`\n${e.text}\n\`\`\`\n`,
+    )
+    .join("\n");
+
+const [npm, go] = await Promise.all([npmEntries(), goEntries()]);
+
+writeFileSync(
+  OUT,
+  `# Third-party notices
+
+vibe-os is MIT licensed (see LICENSE). The binary and the web app also carry
+the software below, under its own terms. This file is generated by
+\`bun run notices\`.
+
+Where a package offers a choice of licenses, vibe-os uses it under the first
+one that is not copyleft: node-forge under BSD-3-Clause.
+
+## ssh.wasm and wasm_exec.js
+
+From [c2FmZQ/sshterm](https://github.com/c2FmZQ/sshterm), compiled Go.
+
+${section(go)}
+## npm packages
+
+${section(npm)}`,
+);
+
+console.log(
+  `vibe-os: wrote ${path.relative(ROOT, OUT)} (${go.length} Go, ${npm.length} npm)`,
+);