@whyvix/remote 0.3.6 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "private": false,
   "type": "module",
   "files": [

package/packages/agent/src/agent.js

@@ -9,12 +9,12 @@ import { DeploymentManager } from "./deployment-manager.js";
 import { GuiManager } from "./gui-manager.js";
 import { createToolExecutor } from "./tools.js";
 
-export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUID(),deviceName=os.hostname(),token="",workspaces=[process.cwd()],remoteTargets=[],deploymentProfiles=[],guiBackend=null,agentVersion="unknown",capabilities=[],reconnectMs=1000,reconnect=true,heartbeatMs=30000,audit=()=>{},log=console.log,errorLog=console.error,onRegistered=()=>{}}={}) {
+export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUID(),deviceName=os.hostname(),token="",workspaces=[process.cwd()],remoteTargets=[],deploymentProfiles=[],deploymentTransferArtifact=null,guiBackend=null,agentVersion="unknown",capabilities=[],reconnectMs=1000,reconnect=true,heartbeatMs=30000,audit=()=>{},log=console.log,errorLog=console.error,onRegistered=()=>{}}={}) {
   let ws=null,reconnectTimer=null,stopped=false,generation=0;
   const security=createSecurity({token,workspaces,audit});
   const processManager=new ProcessManager({audit});
   const remoteExecutionManager=new RemoteExecutionManager({targets:remoteTargets,audit});
-  const deploymentManager=new DeploymentManager({profiles:deploymentProfiles,security,audit});
+  const deploymentManager=new DeploymentManager({profiles:deploymentProfiles,security,audit,transferArtifact:deploymentTransferArtifact});
   const guiManager=new GuiManager({backend:guiBackend,audit});
   const advertisedCapabilities=[...new Set([...capabilities,...(guiManager.capabilities().available?["gui.observe"]:[])])].sort();
   const executeTool=createToolExecutor({security,processManager,remoteExecutionManager,deploymentManager,guiManager});

package/packages/agent/src/deployment-manager.js

@@ -13,7 +13,7 @@ function fail(code,message){throw Object.assign(new Error(message),{code});}
 async function sha256(file){const hash=crypto.createHash("sha256");const data=await fs.readFile(file);hash.update(data);return hash.digest("hex");}
 
 export class DeploymentManager{
- constructor({profiles=[],security,audit=()=>{},execFileFn=execFileAsync}={}){
+ constructor({profiles=[],security,audit=()=>{},execFileFn=execFileAsync,transferArtifact=null}={}){
   if(!security?.resolveAllowed)fail("DEPLOY_PROFILE_DENIED","Deployment security authority is required");
   this.profiles=new Map();
   for(const profile of profiles){
@@ -21,7 +21,7 @@ export class DeploymentManager{
    if(this.profiles.has(profile.alias))fail("DEPLOY_PROFILE_DENIED","Duplicate deployment profile");
    this.profiles.set(profile.alias,profile);
   }
-  this.security=security;this.audit=audit;this.execFileFn=execFileFn;
+  this.security=security;this.audit=audit;this.execFileFn=execFileFn;this.transferArtifact=transferArtifact;
  }
  listProfiles(){return [...this.profiles.values()].map(({alias,label="",remoteAlias})=>({alias,label,remoteAlias}));}
  #profile(alias){const value=String(alias||"");if(!PROFILE_RE.test(value)||!this.profiles.has(value))fail("DEPLOY_PROFILE_DENIED","Deployment profile is not registered");return this.profiles.get(value);}
@@ -57,9 +57,10 @@ export class DeploymentManager{
   if(!stat.isFile())fail("DEPLOY_TRANSFER_FAILED","Deployment artifact must be a regular file");
   const actualSha256=await sha256(localArtifact);
   if(actualSha256!==artifactSha256)fail("DEPLOY_CHECKSUM_MISMATCH","Local deployment artifact checksum changed");
+  if(typeof this.transferArtifact!=="function")fail("DEPLOY_TRANSFER_FAILED","Bounded deployment transfer authority is not configured");
   try{
-   await this.execFileFn("scp",["--",localArtifact,`${operation.remoteAlias}:${operation.artifactPath}`],{windowsHide:true,maxBuffer:1024*1024});
-  }catch{fail("DEPLOY_TRANSFER_FAILED","Deployment artifact transfer failed");}
+   await this.transferArtifact({remoteAlias:operation.remoteAlias,localArtifact,artifactPath:operation.artifactPath,commit,releaseId:operation.releaseId,artifactSha256});
+  }catch(error){if(error?.code==="DEPLOY_TRANSFER_FAILED")throw error;fail("DEPLOY_TRANSFER_FAILED","Deployment artifact transfer failed");}
   this.audit({event:"deploy.stage",profile:profile.alias,commit,artifactSha256});
   return{profile:profile.alias,remoteAlias:operation.remoteAlias,commit,releaseId:operation.releaseId,artifactPath:operation.artifactPath,artifactSha256};
  }

package/packages/agent/src/deployment-transfer-runner.js

@@ -0,0 +1,26 @@
+import { spawn } from "node:child_process";
+
+const ALIAS_RE=/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function fail(code,message){throw Object.assign(new Error(message),{code});}
+function validRemotePath(value){
+ return typeof value==="string"&&value.startsWith("/")&&!value.includes("\0")&&!value.split("/").includes("..");
+}
+
+export async function transferDeploymentArtifact({remoteAlias,localArtifact,artifactPath,spawnFn=spawn,timeoutMs=120000}={}){
+ if(!ALIAS_RE.test(String(remoteAlias||"")))fail("DEPLOY_TRANSFER_FAILED","Invalid deployment remote alias");
+ if(typeof localArtifact!=="string"||!localArtifact)fail("DEPLOY_TRANSFER_FAILED","Invalid local deployment artifact");
+ if(!validRemotePath(artifactPath))fail("DEPLOY_TRANSFER_FAILED","Invalid deployment staging path");
+ const timeout=Math.max(1,Math.min(Number(timeoutMs)||120000,300000));
+ return await new Promise((resolve,reject)=>{
+  const child=spawnFn("scp",["--",localArtifact,`${remoteAlias}:${artifactPath}`],{windowsHide:true,shell:false});
+  let settled=false;
+  const finish=(error)=>{
+   if(settled)return;settled=true;clearTimeout(timer);
+   if(error)reject(error);else resolve({remoteAlias,artifactPath});
+  };
+  child.on("error",()=>finish(Object.assign(new Error("Deployment artifact transfer failed"),{code:"DEPLOY_TRANSFER_FAILED"})));
+  child.on("close",(code)=>code===0?finish():finish(Object.assign(new Error("Deployment artifact transfer failed"),{code:"DEPLOY_TRANSFER_FAILED"})));
+  const timer=setTimeout(()=>{if(!settled){child.kill();finish(Object.assign(new Error("Deployment artifact transfer timed out"),{code:"DEPLOY_TRANSFER_FAILED"}));}},timeout);
+  timer.unref?.();
+ });
+}

package/packages/agent/src/remote-execution-manager.js

@@ -2,8 +2,6 @@ import { spawn } from "node:child_process";
 import { buildDeployHelperArgs } from "./deployment-protocol.js";
 
 const ALIAS_RE=/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-const DEFAULT_EXECUTABLES=new Set(["uname","systemctl","journalctl","cat","ls","sha256sum","node","npm"]);
-
 function fail(code,message){throw Object.assign(new Error(message),{code});}
 function classifySshFailure(state,code){
  if(state.timedOut)return "REMOTE_TIMEOUT";
@@ -13,6 +11,11 @@ function classifySshFailure(state,code){
  if(text.includes("permission denied")||text.includes("authentication failed")||text.includes("no supported authentication methods available"))return "REMOTE_AUTH_FAILED";
  return state.errorCode||"REMOTE_EXEC_FAILED";
 }
+function quoteRemoteArg(value){
+ const text=String(value);
+ return "'" + text.replaceAll("'", "'\"'\"'") + "'";
+}
+function serializeRemoteCommand(argv){return argv.map(quoteRemoteArg).join(" ");}
 function appendBounded(state,key,chunk,maxBytes){
  const current=Buffer.from(state[key],"utf8"),incoming=Buffer.from(chunk);
  const room=Math.max(0,maxBytes-current.length);
@@ -20,8 +23,8 @@ function appendBounded(state,key,chunk,maxBytes){
  if(room>0)state[key]=Buffer.concat([current,incoming.subarray(0,room)]).toString("utf8");
 }
 export class RemoteExecutionManager {
- constructor({targets=[],allowedExecutables=DEFAULT_EXECUTABLES,audit=()=>{},spawnFn=spawn,maxOutputBytes=262144,maxRetainedJobs=100,maxRunningJobs=16,jobRetentionMs=300000,now=()=>Date.now()}={}){
-  this.targets=new Map(targets.map(x=>[x.alias,x]));this.allowedExecutables=new Set(allowedExecutables);this.audit=audit;this.spawnFn=spawnFn;this.maxOutputBytes=maxOutputBytes;
+ constructor({targets=[],allowedExecutables=null,audit=()=>{},spawnFn=spawn,maxOutputBytes=262144,maxRetainedJobs=100,maxRunningJobs=16,jobRetentionMs=300000,now=()=>Date.now()}={}){
+  this.targets=new Map(targets.map(x=>[x.alias,x]));this.allowedExecutables=allowedExecutables?new Set(allowedExecutables):null;this.audit=audit;this.spawnFn=spawnFn;this.maxOutputBytes=maxOutputBytes;
   this.maxRetainedJobs=Math.max(1,Math.min(Number(maxRetainedJobs)||100,1000));
   this.maxRunningJobs=Math.max(1,Math.min(Number(maxRunningJobs)||16,128));
   this.jobRetentionMs=Math.max(1000,Math.min(Number(jobRetentionMs)||300000,86400000));
@@ -39,7 +42,7 @@ export class RemoteExecutionManager {
  }
  listTargets(){return [...this.targets.values()].map(({alias,label=""})=>({alias,label}));}
  #target(alias){const value=String(alias||"");if(!ALIAS_RE.test(value)||!this.targets.has(value))fail("REMOTE_TARGET_DENIED","Remote target is not registered");return this.targets.get(value);}
- #argv(executable,args=[]){if(!this.allowedExecutables.has(executable))fail("REMOTE_COMMAND_DENIED","Remote executable denied");if(!Array.isArray(args)||args.length>64)fail("INVALID_ARGUMENT","Invalid remote arguments");for(const arg of args){if(typeof arg!=="string"||Buffer.byteLength(arg,"utf8")>4096||arg.includes("\0"))fail("INVALID_ARGUMENT","Invalid remote argument");}return [executable,...args];}
+ #argv(executable,args=[]){if(typeof executable!=="string"||!executable||Buffer.byteLength(executable,"utf8")>1024||executable.includes("\0"))fail("INVALID_ARGUMENT","Invalid remote executable");if(this.allowedExecutables&&!this.allowedExecutables.has(executable))fail("REMOTE_COMMAND_DENIED","Remote executable denied");if(!Array.isArray(args)||args.length>64)fail("INVALID_ARGUMENT","Invalid remote arguments");for(const arg of args){if(typeof arg!=="string"||Buffer.byteLength(arg,"utf8")>4096||arg.includes("\0"))fail("INVALID_ARGUMENT","Invalid remote argument");}return [executable,...args];}
  start({alias,executable,args=[],timeoutMs=30000,ownerId}){
   return this.#start({alias,executable,args,timeoutMs,ownerId,allowDeployHelper:false});
  }
@@ -54,7 +57,7 @@ export class RemoteExecutionManager {
   for(const state of this.jobs.values())if(state.running)runningJobs++;
   if(runningJobs>=this.maxRunningJobs)fail("REMOTE_JOB_LIMIT","Remote running job limit reached");
   const target=this.#target(alias),remoteArgv=allowDeployHelper?["whyvix-deploy",...args]:this.#argv(executable,args),timeout=Math.max(1,Math.min(Number(timeoutMs)||30000,300000)),id=String(this.nextId++);
-  const sshArgs=["--",target.alias,...remoteArgv],child=this.spawnFn("ssh",sshArgs,{windowsHide:true,shell:false});
+  const sshArgs=["--",target.alias,serializeRemoteCommand(remoteArgv)],child=this.spawnFn("ssh",sshArgs,{windowsHide:true,shell:false});
   const state={id,ownerId:String(ownerId),alias:target.alias,executable,stdout:"",stderr:"",truncated:false,running:true,exitCode:null,child};this.jobs.set(id,state);this.audit({event:"remote.start",id,alias:state.alias,executable});
   child.stdout?.on("data",x=>appendBounded(state,"stdout",x,this.maxOutputBytes));child.stderr?.on("data",x=>appendBounded(state,"stderr",x,this.maxOutputBytes));
   const finish=()=>{if(state.timer){clearTimeout(state.timer);state.timer=null;}};
@@ -64,5 +67,6 @@ export class RemoteExecutionManager {
   return{id,pid:child.pid,alias:state.alias};
  }
  output({id,ownerId}){this.#cleanup();const s=this.jobs.get(String(id));if(!s||!ownerId||s.ownerId!==String(ownerId))fail("REMOTE_JOB_NOT_FOUND","Remote job not found");return{id:s.id,alias:s.alias,stdout:s.stdout,stderr:s.stderr,running:s.running,exitCode:s.exitCode,errorCode:s.errorCode||null,truncated:s.truncated,timedOut:Boolean(s.timedOut)};}
+ input({id,ownerId,data,end=false}){this.#cleanup();const s=this.jobs.get(String(id));if(!s||!ownerId||s.ownerId!==String(ownerId))fail("REMOTE_JOB_NOT_FOUND","Remote job not found");if(!s.running||!s.child.stdin)fail("REMOTE_INPUT_CLOSED","Remote job input is not available");if(typeof data!=="string"||Buffer.byteLength(data,"utf8")>65536||data.includes("\0"))fail("INVALID_ARGUMENT","Invalid remote input");s.child.stdin.write(data);if(end)s.child.stdin.end();this.audit({event:"remote.input",id:s.id,alias:s.alias,bytes:Buffer.byteLength(data,"utf8"),end:Boolean(end)});return{id:s.id,written:Buffer.byteLength(data,"utf8"),ended:Boolean(end)};}
  stop({id,ownerId}){this.#cleanup();const s=this.jobs.get(String(id));if(!s||!ownerId||s.ownerId!==String(ownerId))fail("REMOTE_JOB_NOT_FOUND","Remote job not found");if(s.running)s.child.kill();return{id:s.id,stopping:s.running};}
 }

package/packages/agent/src/tools.js

@@ -9,6 +9,10 @@ const execFileAsync=promisify(execFile);
 
 export function createToolExecutor({ security, processManager, remoteExecutionManager, deploymentManager, guiManager }) {
   const binaryTransferManager=new BinaryTransferManager({security,audit:(entry)=>security.audit(entry)});
+  const pendingDeployments=new Map();
+  const pendingDeploymentTtlMs=10*60*1000;
+  function deploymentOwner(args){return String(args.ownerId||"");}
+  function prunePendingDeployments(){const now=Date.now();for(const [id,state] of pendingDeployments)if(now-state.createdAt>pendingDeploymentTtlMs)pendingDeployments.delete(id);}
   return async function executeTool(tool,args={}) {
     security.audit({event:"tool.request",tool});
     if(tool==="device.ping") return {pong:true,timestamp:new Date().toISOString()};
@@ -88,10 +92,32 @@ export function createToolExecutor({ security, processManager, remoteExecutionMa
       return{path:target,bytes,replacements:1};
     }
     if(tool==="deploy.prepare_local"){if(!deploymentManager)throw Object.assign(new Error("Deployment is not configured"),{code:"DEPLOY_PROFILE_DENIED"});return deploymentManager.prepareLocal({profile:args.profile,commit:args.commit,baseCommit:args.baseCommit??null});}
+    if(tool==="deploy.prepare_release"){
+      if(!deploymentManager)throw Object.assign(new Error("Deployment is not configured"),{code:"DEPLOY_PROFILE_DENIED"});
+      if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});
+      const local=await deploymentManager.prepareLocal({profile:args.profile,commit:args.commit,baseCommit:args.baseCommit??null});
+      const staged=await deploymentManager.stageArtifact({profile:args.profile,commit:local.commit,artifact:local.artifact,artifactSha256:local.artifactSha256});
+      const ownerId=deploymentOwner(args);if(!ownerId)throw Object.assign(new Error("Deployment owner is required"),{code:"DEPLOY_OWNER_REQUIRED"});
+      const verify=remoteExecutionManager.startDeployHelper({alias:staged.remoteAlias,input:{operation:"verify",commit:local.commit,artifactSha256:local.artifactSha256},timeoutMs:args.timeoutMs,ownerId});
+      prunePendingDeployments();pendingDeployments.set(verify.id,{ownerId,remoteAlias:staged.remoteAlias,commit:local.commit,artifactSha256:local.artifactSha256,createdAt:Date.now()});
+      return{profile:local.profile,commit:local.commit,shortSha:local.shortSha,artifactSha256:local.artifactSha256,dependencyChanged:local.dependencyChanged,artifactPath:staged.artifactPath,verifyJobId:verify.id};
+    }
+    if(tool==="deploy.continue_prepare"){
+      if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});
+      prunePendingDeployments();const state=pendingDeployments.get(args.verifyJobId);const ownerId=deploymentOwner(args);
+      if(!state||!ownerId||state.ownerId!==ownerId)throw Object.assign(new Error("Deployment prepare state is unavailable"),{code:"DEPLOY_NOT_PREPARED"});
+      const verified=remoteExecutionManager.output({id:args.verifyJobId,ownerId});
+      if(verified.running)throw Object.assign(new Error("Deployment verification is still running"),{code:"DEPLOY_VERIFY_PENDING"});
+      if(verified.exitCode!==0||verified.errorCode){pendingDeployments.delete(args.verifyJobId);throw Object.assign(new Error("Deployment verification failed"),{code:"DEPLOY_VERIFY_FAILED"});}
+      pendingDeployments.delete(args.verifyJobId);
+      const prepared=remoteExecutionManager.startDeployHelper({alias:state.remoteAlias,input:{operation:"prepare",commit:state.commit,artifactSha256:state.artifactSha256},timeoutMs:args.timeoutMs,ownerId});
+      return{prepareJobId:prepared.id,remoteAlias:prepared.alias};
+    }
     if(tool==="remote.targets"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return{targets:remoteExecutionManager.listTargets()};}
     if(tool==="remote.start"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return remoteExecutionManager.start(args);}
     if(tool==="remote.deploy_status"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_TARGET_DENIED"});return remoteExecutionManager.startDeployHelper({alias:args.alias,input:{operation:"status",commit:args.commit},timeoutMs:args.timeoutMs,ownerId:args.ownerId});}
     if(tool==="remote.output"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.output(args);}
+    if(tool==="remote.input"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.input(args);}
     if(tool==="remote.stop"){if(!remoteExecutionManager)throw Object.assign(new Error("Remote execution is not configured"),{code:"REMOTE_JOB_NOT_FOUND"});return remoteExecutionManager.stop(args);}
     if(tool==="process.discover")return processManager.discover(args);
     if(tool==="process.start"){const cwd=security.resolveFilesystemPath(args.cwd);return processManager.start({...args,cwd});}

package/packages/cli/index.js

@@ -6,6 +6,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createAgent } from "../agent/src/agent.js";
 import { loadDeploymentProfiles } from "../agent/src/deployment-profile-loader.js";
+import { transferDeploymentArtifact } from "../agent/src/deployment-transfer-runner.js";
 import { loadGuiBackend } from "../agent/src/gui-backend-loader.js";
 import { runWindowsGuiHelper } from "../agent/src/windows-gui-helper-runner.js";
 import { openBrowser } from "./browser.js";
@@ -68,6 +69,7 @@ const agent=createAgent({
   workspaces,
   remoteTargets,
   deploymentProfiles,
+  deploymentTransferArtifact:transferDeploymentArtifact,
   guiBackend,
   agentVersion:String(packageMeta.version||"unknown"),
   capabilities,