@weaveprotocol/cli 0.1.1 → 0.1.2

package/README.md

@@ -30,7 +30,7 @@ To have `weave` everywhere:
 npm install -g @weaveprotocol/cli            # or run it without installing: npx @weaveprotocol/cli <command>
 ```
 
-From this repo: `cd cli && npm install && npm run bundle && npm link`, or a
+From this repo: `npm install` at the repo root (the CLI is a workspace), then `cd cli && npm run bundle && npm link`, or a
 binary with no Node at all: `bun build.ts --native`.
 
 ```bash

package/dist/weave.mjs

@@ -10687,6 +10687,201 @@ async function unlock(home, account, secret) {
 // src/serve.ts
 import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
+
+// ../server/relay.mjs
+import { createHmac } from "node:crypto";
+var MAX_MESSAGE_BYTES = 64 * 1024;
+var MAX_CONNECTIONS = 5e3;
+var MAX_CONNECTIONS_PER_IP = 32;
+var MAX_ROOMS = 1e4;
+var MAX_ROOMS_PER_SOCKET = 256;
+var MAX_PEERS_PER_ROOM = 64;
+var MAX_ROOM_LENGTH = 128;
+var MAX_DID_LENGTH = 256;
+var RATE_PER_SECOND = 50;
+var RATE_BURST = 100;
+var HEARTBEAT_MS = 15e3;
+var MAX_BUFFERED_BYTES = 1024 * 1024;
+var ROUTED = /* @__PURE__ */ new Set(["offer", "answer", "candidate"]);
+var DID_PATTERN = /^did:key:z[1-9A-HJ-NP-Za-km-z]+$/;
+var CLOSE_DID_TAKEN = 4009;
+function turnFromEnv(env) {
+  const secret = env.TURN_SECRET ?? "";
+  const urls = (env.TURN_URLS ?? "").split(",").map((url) => url.trim()).filter(Boolean);
+  if (!secret || urls.length === 0) return void 0;
+  return { secret, urls, ttlSeconds: Number(env.TURN_TTL_SECONDS ?? 4 * 3600) };
+}
+function createRelay(options = {}) {
+  const { turn } = options;
+  const log = options.log ?? (() => {
+  });
+  const rooms = /* @__PURE__ */ new Map();
+  const clients = /* @__PURE__ */ new Set();
+  const perIp = /* @__PURE__ */ new Map();
+  function canEnter(room) {
+    if (typeof room !== "string" || room.length === 0 || room.length > MAX_ROOM_LENGTH) return false;
+    const peers = rooms.get(room);
+    return peers ? peers.size < MAX_PEERS_PER_ROOM : rooms.size < MAX_ROOMS;
+  }
+  function accept(ws, legacyRoom, ip) {
+    const client = { ws, legacyRoom, ip, did: null, rooms: /* @__PURE__ */ new Set(), alive: true, tokens: RATE_BURST, refilled: Date.now() };
+    clients.add(client);
+    perIp.set(ip, (perIp.get(ip) ?? 0) + 1);
+    ws.on("pong", () => client.alive = true);
+    ws.on("message", (data, isBinary) => {
+      if (!withinBudget(client)) {
+        ws.terminate();
+        return;
+      }
+      if (!isBinary) handleMessage(client, data.toString("utf8"));
+    });
+    let dropped = false;
+    const drop = () => {
+      if (dropped) return;
+      dropped = true;
+      clients.delete(client);
+      const left = (perIp.get(ip) ?? 1) - 1;
+      if (left > 0) perIp.set(ip, left);
+      else perIp.delete(ip);
+      for (const room of [...client.rooms]) leave(client, room);
+    };
+    ws.on("close", drop);
+    ws.on("error", () => ws.terminate());
+  }
+  function handleMessage(client, raw) {
+    let message;
+    try {
+      message = JSON.parse(raw);
+    } catch {
+      return;
+    }
+    if (!message || typeof message.type !== "string") return;
+    const room = message.room ?? client.legacyRoom;
+    if (message.type === "join") {
+      if (client.did ? message.from !== client.did : !isDid(message.from)) return;
+      if (client.rooms.has(room) || client.rooms.size >= MAX_ROOMS_PER_SOCKET || !canEnter(room)) return;
+      if (findPeer(room, message.from)) {
+        client.ws.close(CLOSE_DID_TAKEN, "DID already in room");
+        return;
+      }
+      const first = !client.did;
+      client.did = message.from;
+      client.rooms.add(room);
+      if (!rooms.has(room)) rooms.set(room, /* @__PURE__ */ new Set());
+      rooms.get(room).add(client);
+      announce(client, room, "join");
+      if (first) offerTurn(client);
+      log(`peer joined room ${short(room)} (${rooms.get(room).size} present)`);
+      return;
+    }
+    if (message.type === "ice") {
+      if (client.did) offerTurn(client);
+      return;
+    }
+    if (message.type === "leave") {
+      if (client.rooms.has(room)) leave(client, room);
+      return;
+    }
+    if (!client.did || !ROUTED.has(message.type) || typeof message.to !== "string") return;
+    for (const shared of client.rooms) {
+      const target = findPeer(shared, message.to);
+      if (target && target !== client) {
+        send(target, JSON.stringify({ type: message.type, from: client.did, to: message.to, payload: message.payload }));
+        return;
+      }
+    }
+  }
+  function offerTurn(client) {
+    if (!turn) return;
+    const expires = Math.floor(Date.now() / 1e3) + turn.ttlSeconds;
+    const username = String(expires);
+    const credential = createHmac("sha1", turn.secret).update(username).digest("base64");
+    send(client, JSON.stringify({ type: "ice", payload: { servers: [{ urls: turn.urls, username, credential }], expiresAt: expires * 1e3 } }));
+  }
+  function leave(client, room) {
+    client.rooms.delete(room);
+    const peers = rooms.get(room);
+    peers?.delete(client);
+    if (peers?.size === 0) rooms.delete(room);
+    announce(client, room, "leave");
+    log(`peer left room ${short(room)}`);
+  }
+  function announce(sender, room, type) {
+    const payload = JSON.stringify({ type, from: sender.did, room });
+    for (const peer of rooms.get(room) ?? []) {
+      if (peer !== sender) send(peer, payload);
+    }
+  }
+  function send(peer, text) {
+    if (peer.ws.readyState !== peer.ws.OPEN) return;
+    if (peer.ws.bufferedAmount > MAX_BUFFERED_BYTES) {
+      peer.ws.terminate();
+      return;
+    }
+    peer.ws.send(text);
+  }
+  function findPeer(room, did) {
+    for (const peer of rooms.get(room) ?? []) {
+      if (peer.did === did) return peer;
+    }
+    return null;
+  }
+  function withinBudget(client) {
+    const now = Date.now();
+    client.tokens = Math.min(RATE_BURST, client.tokens + (now - client.refilled) / 1e3 * RATE_PER_SECOND);
+    client.refilled = now;
+    if (client.tokens < 1) return false;
+    client.tokens -= 1;
+    return true;
+  }
+  const heartbeat = setInterval(() => {
+    for (const client of clients) {
+      if (!client.alive) {
+        client.ws.terminate();
+        continue;
+      }
+      client.alive = false;
+      client.ws.ping();
+    }
+  }, HEARTBEAT_MS);
+  heartbeat.unref();
+  return {
+    /**
+     * Takes an HTTP upgrade request. Everything that can be refused is refused
+     * here, before a socket is opened.
+     *
+     * @param {import('ws').WebSocketServer} wss A `ws` server made with `noServer: true` and `maxPayload: MAX_MESSAGE_BYTES`
+     */
+    upgrade(wss, req, socket, head) {
+      socket.on("error", () => socket.destroy());
+      const legacyRoom = new URL(req.url ?? "/", "http://relay").searchParams.get("room");
+      const ip = clientIp(req);
+      const refusal2 = legacyRoom !== null && !canEnter(legacyRoom) ? [503, "Room full"] : clients.size >= MAX_CONNECTIONS ? [503, "Relay full"] : (perIp.get(ip) ?? 0) >= MAX_CONNECTIONS_PER_IP ? [429, "Too many connections"] : null;
+      if (refusal2) {
+        socket.end(`HTTP/1.1 ${refusal2[0]} ${refusal2[1]}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+        return;
+      }
+      wss.handleUpgrade(req, socket, head, (ws) => accept(ws, legacyRoom, ip));
+    },
+    /** Drops every socket and stops the heartbeat */
+    close() {
+      clearInterval(heartbeat);
+      for (const client of clients) client.ws.terminate();
+    }
+  };
+}
+var isDid = (value) => typeof value === "string" && value.length <= MAX_DID_LENGTH && DID_PATTERN.test(value);
+function clientIp(req) {
+  const forwarded = process.env.FLY_APP_NAME ? req.headers["fly-client-ip"] : void 0;
+  return typeof forwarded === "string" && forwarded || req.socket.remoteAddress || "unknown";
+}
+var short = (room) => room.length > 12 ? `${room.slice(0, 12)}\u2026` : room;
+
+// src/serve.ts
 function createSpacePeers() {
   const sockets = /* @__PURE__ */ new Map();
   const listeners = {};
@@ -10751,84 +10946,21 @@ function createInboundPeers() {
     count: () => spaces.size
   };
 }
-var RELAY_MAX_ROOM_LENGTH = 128;
-var RELAY_MAX_PEERS_PER_ROOM = 64;
-var RELAY_MESSAGES_PER_SECOND = 50;
-var RELAY_BURST = 100;
-var DID_PATTERN = /^did:key:z[1-9A-HJ-NP-Za-km-z]{1,250}$/;
-function createRelay() {
-  const rooms = /* @__PURE__ */ new Map();
-  const broadcast = (sender, payload) => {
-    for (const peer of rooms.get(sender.room) ?? []) {
-      if (peer !== sender && peer.did && peer.socket.readyState === peer.socket.OPEN) peer.socket.send(payload);
-    }
-  };
-  return {
-    rooms,
-    accept(socket, room) {
-      if (room.length > RELAY_MAX_ROOM_LENGTH || (rooms.get(room)?.size ?? 0) >= RELAY_MAX_PEERS_PER_ROOM) {
-        socket.close(1008, "room refused");
-        return;
-      }
-      const client = { socket, room, did: null };
-      if (!rooms.has(room)) rooms.set(room, /* @__PURE__ */ new Set());
-      rooms.get(room).add(client);
-      let tokens = RELAY_BURST;
-      let refilled = Date.now();
-      socket.on("message", (data, isBinary) => {
-        const now = Date.now();
-        tokens = Math.min(RELAY_BURST, tokens + (now - refilled) / 1e3 * RELAY_MESSAGES_PER_SECOND);
-        refilled = now;
-        if ((tokens -= 1) < 0) {
-          socket.close(1008, "too many messages");
-          return;
-        }
-        if (isBinary) return;
-        let message;
-        try {
-          message = JSON.parse(String(data));
-        } catch {
-          return;
-        }
-        if (typeof message?.type !== "string") return;
-        if (message.type === "join") {
-          if (client.did || typeof message.from !== "string" || !DID_PATTERN.test(message.from)) return;
-          if ([...rooms.get(room)].some((peer) => peer.did === message.from)) {
-            socket.close(4009, "that DID is already in this room");
-            return;
-          }
-          client.did = message.from;
-          broadcast(client, JSON.stringify({ type: "join", from: client.did }));
-          return;
-        }
-        if (!client.did || !["offer", "answer", "candidate"].includes(message.type) || typeof message.to !== "string") return;
-        const target = [...rooms.get(room) ?? []].find((peer) => peer.did === message.to);
-        const forwarded = { type: message.type, from: client.did, to: message.to, payload: message.payload };
-        if (target && target.socket.readyState === target.socket.OPEN) target.socket.send(JSON.stringify(forwarded));
-      });
-      socket.on("close", () => {
-        const peers = rooms.get(room);
-        if (!peers?.delete(client)) return;
-        if (peers.size === 0) rooms.delete(room);
-        if (client.did) broadcast(client, JSON.stringify({ type: "leave", from: client.did }));
-      });
-    }
-  };
-}
+var DID_PATTERN2 = /^did:key:z[1-9A-HJ-NP-Za-km-z]{1,250}$/;
 function parseHello(data, isBinary) {
   if (isBinary) return null;
   try {
     const hello = JSON.parse(String(data));
-    return hello.type === "hello" && typeof hello.did === "string" && DID_PATTERN.test(hello.did) && typeof hello.nonce === "string" ? { did: hello.did, nonce: hello.nonce, proof: { sig: hello.sig, read: hello.read } } : null;
+    return hello.type === "hello" && typeof hello.did === "string" && DID_PATTERN2.test(hello.did) && typeof hello.nonce === "string" ? { did: hello.did, nonce: hello.nonce, proof: { sig: hello.sig, read: hello.read } } : null;
   } catch {
     return null;
   }
 }
 async function serve(options) {
   const { node, inbound } = options;
-  const relay = createRelay();
+  const relay = createRelay({ turn: turnFromEnv(process.env) });
   const sockets = new WebSocketServer({ noServer: true, maxPayload: 16 * 1024 * 1024 });
-  const relaySockets = new WebSocketServer({ noServer: true, maxPayload: 64 * 1024 });
+  const relaySockets = new WebSocketServer({ noServer: true, maxPayload: MAX_MESSAGE_BYTES, perMessageDeflate: false, clientTracking: false });
   const http = createServer((req, res) => {
     if (req.url === "/health") {
       res.writeHead(200, { "content-type": "application/json" });
@@ -10876,7 +11008,7 @@ async function serve(options) {
     if (url.pathname === "/peer") {
       sockets.handleUpgrade(req, socket, head, (ws) => void onPeer(ws, url).catch(() => ws.close(1011, "internal error")));
     } else {
-      relaySockets.handleUpgrade(req, socket, head, (ws) => relay.accept(ws, url.searchParams.get("room") ?? "default"));
+      relay.upgrade(relaySockets, req, socket, head);
     }
   });
   await new Promise((resolve, reject) => {
@@ -10888,7 +11020,8 @@ async function serve(options) {
   return {
     port,
     async close() {
-      for (const client of [...sockets.clients, ...relaySockets.clients]) client.terminate();
+      for (const client of sockets.clients) client.terminate();
+      relay.close();
       sockets.close();
       relaySockets.close();
       await new Promise((resolve) => http.close(() => resolve()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weaveprotocol/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The Weave protocol from a terminal: manage spaces, run an always-on node, serve MCP to agents",
   "type": "module",
   "bin": {