@whyvix/remote 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "private": false,
   "type": "module",
   "files": [

package/packages/agent/src/agent.js

@@ -5,14 +5,16 @@ import { envelope, parseMessage, TYPES } from "../../protocol/src/index.js";
 import { createSecurity } from "./security.js";
 import { ProcessManager } from "./process-manager.js";
 import { RemoteExecutionManager } from "./remote-execution-manager.js";
+import { DeploymentManager } from "./deployment-manager.js";
 import { createToolExecutor } from "./tools.js";
 
-export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUID(),deviceName=os.hostname(),token="",workspaces=[process.cwd()],remoteTargets=[],reconnectMs=1000,reconnect=true,audit=()=>{},log=console.log,errorLog=console.error,onRegistered=()=>{}}={}) {
+export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUID(),deviceName=os.hostname(),token="",workspaces=[process.cwd()],remoteTargets=[],deploymentProfiles=[],agentVersion="unknown",capabilities=[],reconnectMs=1000,reconnect=true,audit=()=>{},log=console.log,errorLog=console.error,onRegistered=()=>{}}={}) {
   let ws=null,reconnectTimer=null,stopped=false,generation=0;
   const security=createSecurity({token,workspaces,audit});
   const processManager=new ProcessManager({audit});
   const remoteExecutionManager=new RemoteExecutionManager({targets:remoteTargets,audit});
-  const executeTool=createToolExecutor({security,processManager,remoteExecutionManager});
+  const deploymentManager=new DeploymentManager({profiles:deploymentProfiles,security,audit});
+  const executeTool=createToolExecutor({security,processManager,remoteExecutionManager,deploymentManager});
   function scheduleReconnect(reason){
     if(stopped||!reconnect||reconnectTimer)return;
     log("[agent:reconnect-scheduled]",reason,reconnectMs);
@@ -24,8 +26,8 @@ export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUI
     const current=++generation;
     const socket=new WebSocket(gatewayUrl); ws=socket;
     log("[agent:connecting]",gatewayUrl,"generation="+current);
-    socket.on("open",()=>{if(ws!==socket)return;log("[agent:connected]",gatewayUrl);socket.send(JSON.stringify(envelope(TYPES.REGISTER,{auth:{token},device:{id:deviceId,name:deviceName,platform:process.platform,agentVersion:"0.3.0"}})));});
-    socket.on("message",async(raw)=>{if(ws!==socket)return;try{const m=parseMessage(raw);if(m.type===TYPES.REGISTERED){log("[agent:registered]",m.deviceId);onRegistered({deviceId:m.deviceId,authorizedAccount:m.authorizedAccount||""});return;}if(m.type!==TYPES.REQUEST)return;log("[tool:request]",m.tool);try{const result=await executeTool(m.tool,m.arguments);if(m.tool==="device.ping")Object.assign(result,{deviceId,deviceName});log("[tool:success]",m.tool);if(socket.readyState===WebSocket.OPEN)socket.send(JSON.stringify(envelope(TYPES.RESPONSE,{requestId:m.requestId,result})));}catch(error){errorLog("[tool:rejected]",m.tool,error.code||"TOOL_ERROR",error.message);if(socket.readyState===WebSocket.OPEN)socket.send(JSON.stringify(envelope(TYPES.ERROR,{requestId:m.requestId,error:{code:error.code||"TOOL_ERROR",message:error.message}})));}}catch(error){errorLog("[agent:protocol-error]",error.message);}});
+    socket.on("open",()=>{if(ws!==socket)return;log("[agent:connected]",gatewayUrl);socket.send(JSON.stringify(envelope(TYPES.REGISTER,{auth:{token},device:{id:deviceId,name:deviceName,platform:process.platform,agentVersion,capabilities:[...new Set(capabilities.map(String))].sort()}})));});
+    socket.on("message",async(raw)=>{if(ws!==socket)return;try{const m=parseMessage(raw);if(m.type===TYPES.REGISTERED){log("[agent:registered]",m.deviceId);onRegistered({deviceId:m.deviceId,authorizedAccount:m.authorizedAccount||""});return;}if(m.type!==TYPES.REQUEST)return;log("[tool:request]",m.tool,{path:m.arguments?.path,cwd:m.arguments?.cwd});try{const result=await executeTool(m.tool,m.arguments);if(m.tool==="device.ping")Object.assign(result,{deviceId,deviceName});log("[tool:success]",m.tool);if(socket.readyState===WebSocket.OPEN)socket.send(JSON.stringify(envelope(TYPES.RESPONSE,{requestId:m.requestId,result})));}catch(error){errorLog("[tool:rejected]",m.tool,error.code||"TOOL_ERROR",error.message);if(socket.readyState===WebSocket.OPEN)socket.send(JSON.stringify(envelope(TYPES.ERROR,{requestId:m.requestId,error:{code:error.code||"TOOL_ERROR",message:error.message}})));}}catch(error){errorLog("[agent:protocol-error]",error.message);}});
     socket.on("close",(code)=>{log("[agent:disconnected]","generation="+current,"code="+code);if(ws===socket)ws=null;if(code===1008){errorLog("[agent:authorization-required] device credential rejected");return;}if(code===4001){errorLog("[agent:replaced] newer WHYVIX Remote connection is active");return;}scheduleReconnect("close");});
     socket.on("error",(e)=>{errorLog("[agent:socket-error]",e.message);scheduleReconnect("error");});
   }

package/packages/agent/src/deployment-manager.js

@@ -3,6 +3,7 @@ import fs from "node:fs/promises";
 import crypto from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { buildDeploymentOperation } from "./deployment-protocol.js";
 
 const execFileAsync=promisify(execFile);
 const PROFILE_RE=/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
@@ -48,4 +49,18 @@ export class DeploymentManager{
   this.audit({event:"deploy.prepare_local",profile:profile.alias,commit,dependencyChanged});
   return{profile:profile.alias,remoteAlias:profile.remoteAlias,commit,shortSha,artifact,artifactSha256,dependencyChanged};
  }
+ async stageArtifact({profile:profileAlias,commit,artifact,artifactSha256}){
+  const profile=this.#profile(profileAlias);
+  const operation=buildDeploymentOperation(profile,{operation:"stage",commit,artifactSha256});
+  const localArtifact=this.security.resolveAllowed(artifact);
+  const stat=await fs.stat(localArtifact);
+  if(!stat.isFile())fail("DEPLOY_TRANSFER_FAILED","Deployment artifact must be a regular file");
+  const actualSha256=await sha256(localArtifact);
+  if(actualSha256!==artifactSha256)fail("DEPLOY_CHECKSUM_MISMATCH","Local deployment artifact checksum changed");
+  try{
+   await this.execFileFn("scp",["--",localArtifact,`${operation.remoteAlias}:${operation.artifactPath}`],{windowsHide:true,maxBuffer:1024*1024});
+  }catch{fail("DEPLOY_TRANSFER_FAILED","Deployment artifact transfer failed");}
+  this.audit({event:"deploy.stage",profile:profile.alias,commit,artifactSha256});
+  return{profile:profile.alias,remoteAlias:operation.remoteAlias,commit,releaseId:operation.releaseId,artifactPath:operation.artifactPath,artifactSha256};
+ }
 }

package/packages/agent/src/deployment-profile-loader.js

@@ -0,0 +1,22 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+
+function fail(code,message){throw Object.assign(new Error(message),{code});}
+
+export async function loadDeploymentProfiles(filePath){
+  const requested=String(filePath||"").trim();
+  if(!requested)return[];
+  const resolved=path.resolve(requested);
+  let parsed;
+  try{parsed=JSON.parse(await fs.readFile(resolved,"utf8"));}catch(error){
+    if(error instanceof SyntaxError)fail("DEPLOY_PROFILE_DENIED","Deployment profile file is not valid JSON");
+    fail("DEPLOY_PROFILE_DENIED","Deployment profile file cannot be read");
+  }
+  if(!Array.isArray(parsed))fail("DEPLOY_PROFILE_DENIED","Deployment profile file must contain an array");
+  return parsed.map((profile)=>{
+    if(!profile||typeof profile!=="object"||Array.isArray(profile))fail("DEPLOY_PROFILE_DENIED","Invalid deployment profile");
+    const allowed=new Set(["alias","label","remoteAlias","repository","remoteReleaseRoot","remoteStagingRoot","serviceName"]);
+    for(const key of Object.keys(profile))if(!allowed.has(key))fail("DEPLOY_PROFILE_DENIED","Unsupported deployment profile field");
+    return{alias:profile.alias,label:profile.label||"",remoteAlias:profile.remoteAlias,repository:profile.repository,...(profile.remoteReleaseRoot!==undefined?{remoteReleaseRoot:profile.remoteReleaseRoot}:{}),...(profile.remoteStagingRoot!==undefined?{remoteStagingRoot:profile.remoteStagingRoot}:{}),...(profile.serviceName!==undefined?{serviceName:profile.serviceName}:{})};
+  });
+}

package/packages/agent/src/process-manager.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import path from "node:path";
 
 const DEFAULT_EXECUTABLES = Object.freeze({
   node: process.execPath,
@@ -35,8 +36,8 @@ function resolveExecutable(registry, requested) {
 }
 
 export class ProcessManager {
-  constructor({ audit=()=>{}, spawnFn=spawn, allowedExecutables=DEFAULT_EXECUTABLES, maxOutputBytes=262144, maxRetainedJobs=100, maxRunningJobs=16, jobRetentionMs=300000, now=()=>Date.now() }={}) {
-    this.audit=audit; this.spawnFn=spawnFn; this.executableRegistry=normalizeRegistry(allowedExecutables);
+  constructor({ audit=()=>{}, spawnFn=spawn, allowedExecutables=DEFAULT_EXECUTABLES, platform=process.platform, nodeExecPath=process.execPath, maxOutputBytes=262144, maxRetainedJobs=100, maxRunningJobs=16, jobRetentionMs=300000, now=()=>Date.now() }={}) {
+    this.audit=audit; this.spawnFn=spawnFn; this.executableRegistry=normalizeRegistry(allowedExecutables); this.platform=platform; this.nodeExecPath=nodeExecPath;
     this.maxOutputBytes=Math.max(1024,Math.min(Number(maxOutputBytes)||262144,1048576));
     this.maxRetainedJobs=Math.max(1,Math.min(Number(maxRetainedJobs)||100,1000));
     this.maxRunningJobs=Math.max(1,Math.min(Number(maxRunningJobs)||16,128));
@@ -59,9 +60,14 @@ export class ProcessManager {
       if(args.some(x=>/^--(?:yes|package|call|shell|install)/i.test(x))) fail("LOCAL_EXEC_NOT_ALLOWED","npx install or shell options are not allowed");
       args=["--no-install",...args];
     }
+    let spawnCommand=executable.command;
+    if(this.platform==="win32"&&(executable.name==="npm"||executable.name==="npx")) {
+      const cli=path.join(path.dirname(this.nodeExecPath),"node_modules","npm","bin",executable.name==="npm"?"npm-cli.js":"npx-cli.js");
+      spawnCommand=this.nodeExecPath; args=[cli,...args];
+    }
     if([...this.processes.values()].filter(x=>x.running).length>=this.maxRunningJobs)fail("LOCAL_JOB_LIMIT","Local running job limit reached");
     const id=String(this.nextId++);let child;
-    try{child=this.spawnFn(executable.command,args,{cwd,windowsHide:true,shell:false});}catch{fail("LOCAL_EXEC_FAILED","Local process failed to start");}
+    try{child=this.spawnFn(spawnCommand,args,{cwd,windowsHide:true,shell:false});}catch{fail("LOCAL_EXEC_FAILED","Local process failed to start");}
     const state={id,ownerId:ownerId==null?null:String(ownerId),command:executable.name,cwd,stdout:"",stderr:"",truncated:false,exitCode:null,errorCode:null,timedOut:false,running:true,completedAt:null,child};
     this.processes.set(id,state);this.audit({event:"process.start",id,command:executable.name,cwd});
     child.stdout?.on("data",x=>appendBounded(state,"stdout",x,this.maxOutputBytes));child.stderr?.on("data",x=>appendBounded(state,"stderr",x,this.maxOutputBytes));

package/packages/agent/src/tools.js

@@ -5,7 +5,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync=promisify(execFile);
 
-export function createToolExecutor({ security, processManager, remoteExecutionManager }) {
+export function createToolExecutor({ security, processManager, remoteExecutionManager, deploymentManager }) {
   return async function executeTool(tool,args={}) {
     security.audit({event:"tool.request",tool});
     if(tool==="device.ping") return {pong:true,timestamp:new Date().toISOString()};
@@ -70,19 +70,20 @@ export function createToolExecutor({ security, processManager, remoteExecutionMa
       await fs.writeFile(target,updated,{encoding:"utf8",flag:"w"});
       return{path:target,bytes,replacements:1};
     }
+    if(tool==="deploy.prepare_local"){if(!deploymentManager)throw Object.assign(new Error("Deployment is not configured"),{code:"DEPLOY_PROFILE_DENIED"});return deploymentManager.prepareLocal({profile:args.profile,commit:args.commit,baseCommit:args.baseCommit??null});}
     if(tool==="remote.targets"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return{targets:remoteExecutionManager.listTargets()};}
     if(tool==="remote.start"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return remoteExecutionManager.start(args);}
     if(tool==="remote.deploy_status"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return remoteExecutionManager.startDeployHelper({alias:args.alias,input:{operation:"status",commit:args.commit},timeoutMs:args.timeoutMs,ownerId:args.ownerId});}
     if(tool==="remote.output"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.output(args);}
     if(tool==="remote.stop"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.stop(args);}
-    if(tool==="process.start"){const cwd=security.resolveAllowed(args.cwd);return processManager.start({...args,cwd});}
+    if(tool==="process.start"){const cwd=security.resolveFilesystemPath(args.cwd);return processManager.start({...args,cwd});}
     if(tool==="process.output")return processManager.output(args);
     if(tool==="process.stop")return processManager.stop(args);
-    if(tool==="git.status"||tool==="git.diff"||tool==="git.log"){const cwd=security.resolveAllowed(args.cwd);const gitArgs=tool==="git.status"?["status","--porcelain=v1","--branch"]:tool==="git.diff"?["diff","--",...(args.paths||[])]:["log","--oneline","-n",String(Math.min(Number(args.limit||10),50))];const {stdout,stderr}=await execFileAsync("git",gitArgs,{cwd,windowsHide:true,maxBuffer:1024*1024});return{stdout,stderr};}
-    if(tool==="git.stage_paths"||tool==="git.commit"){
-      const cwd=security.resolveAllowed(args.cwd);
+    if(tool==="git.status"||tool==="git.diff"||tool==="git.log"){const cwd=security.resolveFilesystemPath(args.cwd);const gitArgs=tool==="git.status"?["status","--porcelain=v1","--branch"]:tool==="git.diff"?["diff","--",...(args.paths||[])]:["log","--oneline","-n",String(Math.min(Number(args.limit||10),50))];const {stdout,stderr}=await execFileAsync("git",gitArgs,{cwd,windowsHide:true,maxBuffer:1024*1024});return{stdout,stderr};}
+    if(tool==="git.stage_paths"||tool==="git.commit"||tool==="git.push"){
+      const cwd=security.resolveFilesystemPath(args.cwd);
       const {stdout:rootRaw}=await execFileAsync("git",["rev-parse","--show-toplevel"],{cwd,windowsHide:true,maxBuffer:1024*1024});
-      const repoRoot=security.resolveAllowed(rootRaw.trim());
+      const repoRoot=security.resolveFilesystemPath(rootRaw.trim());
       if(tool==="git.stage_paths"){
         const {stdout:alreadyStaged}=await execFileAsync("git",["diff","--cached","--name-only"],{cwd:repoRoot,windowsHide:true,maxBuffer:1024*1024});
         if(alreadyStaged.trim())throw Object.assign(new Error("Repository already has staged changes"),{code:"INDEX_NOT_EMPTY"});
@@ -90,7 +91,7 @@ export function createToolExecutor({ security, processManager, remoteExecutionMa
         if(paths.length<1||paths.length>64)throw Object.assign(new Error("paths must contain 1 to 64 explicit paths"),{code:"INVALID_ARGUMENT"});
         const relativePaths=paths.map((item)=>{
           if(!item||item==="."||item==="*"||item.startsWith("-"))throw Object.assign(new Error("Only explicit repository paths may be staged"),{code:"INVALID_ARGUMENT"});
-          const absolute=security.resolveAllowed(path.resolve(repoRoot,item));
+          const absolute=security.resolveFilesystemPath(path.resolve(repoRoot,item));
           const relative=path.relative(repoRoot,absolute);
           if(!relative||relative.startsWith(".."+path.sep)||path.isAbsolute(relative))throw Object.assign(new Error("Path outside repository"),{code:"PATH_DENIED"});
           return relative.split(path.sep).join("/");
@@ -99,6 +100,11 @@ export function createToolExecutor({ security, processManager, remoteExecutionMa
         const {stdout}=await execFileAsync("git",["diff","--cached","--name-only","--",...relativePaths],{cwd:repoRoot,windowsHide:true,maxBuffer:1024*1024});
         return{staged:stdout.split(/\r?\n/).filter(Boolean)};
       }
+      if(tool==="git.push"){
+        const {stdout,stderr}=await execFileAsync("git",["push"],{cwd:repoRoot,windowsHide:true,maxBuffer:1024*1024});
+        const {stdout:sha}=await execFileAsync("git",["rev-parse","HEAD"],{cwd:repoRoot,windowsHide:true,maxBuffer:1024*1024});
+        return{sha:sha.trim(),stdout,stderr};
+      }
       const message=String(args.message||"");
       if(!message.trim()||message.length>500||/[\r\n]/.test(message))throw Object.assign(new Error("Commit message must be 1 to 500 characters on one line"),{code:"INVALID_ARGUMENT"});
       const {stdout:before}=await execFileAsync("git",["diff","--cached","--name-only"],{cwd:repoRoot,windowsHide:true,maxBuffer:1024*1024});

package/packages/cli/index.js

@@ -2,16 +2,22 @@
 import os from "node:os";
 import crypto from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { createAgent } from "../agent/src/agent.js";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createAgent } from "../agent/src/agent.js";
+import { loadDeploymentProfiles } from "../agent/src/deployment-profile-loader.js";
 import { openBrowser } from "./browser.js";
 
+const packageRoot=join(dirname(fileURLToPath(import.meta.url)),"..","..");
+const packageMeta=JSON.parse(await readFile(join(packageRoot,"package.json"),"utf8"));
 const command=process.argv[2]||"remote";
 if(command!=="remote"){console.error("Usage: whyvix-remote remote");process.exit(2);}
 const gatewayUrl=process.env.WHYVIX_GATEWAY_URL||"wss://remote.whyvix.com";
 const authUrl=(process.env.WHYVIX_AUTH_URL||"https://auth.whyvix.com").replace(/\/$/,"");
 const workspaces=(process.env.WHYVIX_WORKSPACES||process.cwd()).split(";").filter(Boolean);
-const remoteTargets=(process.env.WHYVIX_REMOTE_TARGETS||"").split(";").map(alias=>alias.trim()).filter(Boolean).map(alias=>({alias}));
+const remoteTargets=(process.env.WHYVIX_REMOTE_TARGETS||"").split(";").map(alias=>alias.trim()).filter(Boolean).map(alias=>({alias}));
+const deploymentProfiles=await loadDeploymentProfiles(process.env.WHYVIX_DEPLOY_PROFILES_FILE||"");
+const capabilities=["filesystem.crud","process.bounded","git.read","git.mutate",...(remoteTargets.length?["remote.bounded"]:[]),...(deploymentProfiles.length?["deployment.profiled"]:[])];
 const deviceId=process.env.WHYVIX_DEVICE_ID||crypto.createHash("sha256").update(os.hostname()+"|"+os.userInfo().username).digest("hex").slice(0,24);
 const credentialDir=join(os.homedir(),".whyvix-remote");
 const credentialPath=join(credentialDir,"device.json");
@@ -56,10 +62,21 @@ const agent=createAgent({
   token:credential,
   workspaces,
   remoteTargets,
-  audit:()=>{},
-  log:(event,tool)=>{
-    if(event==="[tool:request]") console.log("←",tool);
-    else if(event==="[tool:success]") console.log("✓",tool);
+  deploymentProfiles,
+  agentVersion:String(packageMeta.version||"unknown"),
+  capabilities,
+  audit:(event)=>{
+    if(event?.event==="process.start") console.log("RUN",event.command,event.cwd);
+    else if(event?.event==="process.exit") console.log("EXIT",event.code,event.errorCode||"OK");
+    else if(event?.event==="process.error") console.error("PROCESS ERROR",event.code);
+    else if(event?.event==="remote.start") console.log("REMOTE",event.alias,event.executable);
+    else if(event?.event==="remote.exit") console.log("REMOTE EXIT",event.code,event.errorCode||"OK");
+    else if(event?.event==="deploy.prepare_local"||event?.event==="deploy.stage") console.log("DEPLOY",event.event,event.profile,event.commit);
+  },
+  log:(event,tool,meta)=>{
+    const quiet=tool==="process.output"||tool==="remote.output";
+    if(event==="[tool:request]"&&!quiet) console.log("←",tool,meta?.path||meta?.cwd||"");
+    else if(event==="[tool:success]"&&!quiet) console.log("✓",tool);
   },
   errorLog:(event,tool,code,message)=>{
     if(event==="[tool:rejected]") console.error("✗",tool,"·",code,"·",message);