@vantaloom/runtime-darwin-arm64 0.12.49 → 0.12.50

package/cli/src/lib/auth.mjs

@@ -0,0 +1,155 @@
+import {
+  existsSync,
+  readFileSync,
+} from "node:fs"
+import os from "node:os"
+import path from "node:path"
+import readline from "node:readline"
+import { DEFAULT_HUB_URL } from "./constants.mjs"
+import {
+  readJSONIfExists,
+  safeDirectory,
+  defaultPrefix,
+} from "./platform.mjs"
+
+export function localApiBase(prefix) {
+  let port
+  try {
+    port = readFileSync(path.join(prefix, "runtime", "api.port"), "utf8").trim()
+  } catch {}
+  if (!port) {
+    const cfg = readJSONIfExists(path.join(prefix, "config", "local.json"))
+    port = cfg.apiPort ? String(cfg.apiPort) : "8780"
+  }
+  return `http://127.0.0.1:${port}`
+}
+
+export function localMachineInfo() {
+  const platMap = { win32: "windows", darwin: "darwin", linux: "linux" }
+  const archMap = { x64: "amd64", arm64: "arm64" }
+  return {
+    name: `${platMap[process.platform] ?? process.platform}-${os.hostname() || "unknown"}`,
+    platform: platMap[process.platform] ?? process.platform,
+    arch: archMap[process.arch] ?? process.arch,
+    localIp: "127.0.0.1",
+  }
+}
+
+export async function hubFetch(url, { method = "GET", body, token } = {}) {
+  const headers = { "Content-Type": "application/json" }
+  if (token) headers.Authorization = `Bearer ${token}`
+  const res = await fetch(url, {
+    method,
+    headers,
+    body: body ? JSON.stringify(body) : undefined,
+  })
+  const data = await res.json().catch(() => ({}))
+  if (!res.ok) {
+    throw new Error(data.error || `${url}: HTTP ${res.status}`)
+  }
+  return data
+}
+
+export function promptVisible(query) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+    rl.question(query, (answer) => {
+      rl.close()
+      resolve(answer.trim())
+    })
+  })
+}
+
+export function promptHidden(query) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: true,
+    })
+    process.stdout.write(query)
+    // Suppress echo so the password isn't shown as it's typed.
+    rl._writeToOutput = () => {}
+    rl.question("", (answer) => {
+      rl.close()
+      process.stdout.write("\n")
+      resolve(answer)
+    })
+  })
+}
+
+export async function runLogin(options) {
+  const prefix = safeDirectory(options.prefix ?? defaultPrefix())
+  const existing = readJSONIfExists(path.join(prefix, "config", "local.json"))
+  const hubUrl = (options.hub ?? existing.hubUrl ?? DEFAULT_HUB_URL).replace(/\/+$/, "")
+  const localApi = localApiBase(prefix)
+
+  // The local runtime must be running: we need its stable hardware id (so the
+  // Hub dedups re-registrations) and it's what actually connects to the Hub.
+  let hardwareId = null
+  try {
+    const res = await fetch(`${localApi}/v1/hub/status`)
+    if (res.ok) hardwareId = (await res.json()).hardwareId ?? null
+  } catch {}
+  if (!hardwareId) {
+    throw new Error(
+      `local runtime not reachable at ${localApi}. Start it first with "vantaloom start", then retry "vantaloom login".`
+    )
+  }
+
+  const email = options.email ?? (await promptVisible("Hub email: "))
+  const password = options.password ?? (await promptHidden("Hub password: "))
+  if (!email || !password) {
+    throw new Error("email and password are required")
+  }
+
+  console.log(`logging in to ${hubUrl} ...`)
+  const login = await hubFetch(`${hubUrl}/api/auth/login`, {
+    method: "POST",
+    body: { email, password },
+  })
+  const userToken = login.token
+  if (!userToken) throw new Error("login failed: no token returned")
+
+  const { deviceToken } = await hubFetch(`${hubUrl}/api/machines/token`, {
+    method: "POST",
+    token: userToken,
+  })
+  const info = localMachineInfo()
+  const connect = await hubFetch(`${hubUrl}/api/connect`, {
+    method: "POST",
+    body: { deviceToken, hardwareId, ...info },
+  })
+  const machineId = connect.machine?.id
+  if (!machineId) throw new Error("machine registration failed: no machine id")
+
+  // Hand the credentials to the running runtime; it persists them to local.json
+  // and brings up the Hub WebSocket + heartbeat + mesh.
+  const res = await fetch(`${localApi}/v1/hub/connect`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ hubUrl, hubToken: userToken, machineId }),
+  })
+  if (!res.ok) {
+    throw new Error(`runtime failed to connect to Hub: HTTP ${res.status}`)
+  }
+
+  console.log(`\n✓ logged in as ${login.user?.email ?? email}`)
+  console.log(`✓ machine registered: ${info.name} (${machineId})`)
+  console.log(`✓ runtime connected to Hub at ${hubUrl}`)
+  console.log(`\nThis machine is now in your workgroup. It will reconnect automatically on restart.`)
+}
+
+export async function runLogout(options) {
+  const prefix = safeDirectory(options.prefix ?? defaultPrefix())
+  const localApi = localApiBase(prefix)
+  try {
+    const res = await fetch(`${localApi}/v1/hub/disconnect`, { method: "POST" })
+    if (!res.ok) throw new Error(`HTTP ${res.status}`)
+    console.log("✓ disconnected from Hub (runtime keeps running locally).")
+  } catch (error) {
+    throw new Error(
+      `could not reach local runtime at ${localApi}: ${error.message}`
+    )
+  }
+}

package/cli/src/lib/constants.mjs

@@ -0,0 +1,34 @@
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+
+export const cliRoot = path.resolve(fileURLToPath(import.meta.url), "..", "..", "..")
+export const repoCandidate = path.resolve(cliRoot, "..", "..")
+export const installedConfigPath = path.join(cliRoot, "config.json")
+export const defaultReleaseTag = "runtime-latest"
+export const defaultRepo = "Timefiles404/Vantaloom-next"
+export const defaultNpmRegistry = "https://registry.npmjs.org"
+export const fallbackNpmRegistries = [
+  "https://registry.npmmirror.com",
+]
+
+// The mesh binaries the privileged service holds open while running. On Windows
+// a file copy can't overwrite them in place, so the lock-safe `apply` path swaps
+// them after stopping the service.
+export const WINDOWS_MESH_BINARIES = ["easytier-core.exe", "easytier-cli.exe", "wintun.dll", "Packet.dll", "WinDivert64.sys", "vantaloom-mesh.exe"]
+
+export const LOCK_ERROR_CODES = new Set(["EPERM", "EBUSY", "EACCES", "ETXTBSY"])
+
+// ── Hub login (headless / no-web) ──
+export const DEFAULT_HUB_URL = "http://vanta.timefiles.online"
+
+// ── Runtime login-autostart (no elevation) ──
+// Start the local runtime (api/agent/web/tray) at login/boot using only
+// per-user mechanisms — no UAC/sudo. This is separate from the privileged mesh
+// service: the mesh sidecar autostarts via the OS service manager; this brings
+// up the unprivileged runtime that joins the mesh and serves the local API.
+export const AUTOSTART_LABEL = "online.timefiles.vantaloom.runtime"
+// PowerShell HKCU: drive path. Set-ItemProperty handles values with spaces and
+// embedded quotes cleanly (reg.exe's /d escaping is brittle), and the Run key is
+// not blocked by Controlled Folder Access the way the Startup folder is.
+export const WINDOWS_RUN_KEY = "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
+export const WINDOWS_RUN_VALUE = "Vantaloom"