@zhanguym/chatroom 1.0.0

package/dist/plugins/cloud/state-store.js

@@ -0,0 +1,79 @@
+import { generateKeyPairSync, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { CLOUD_DESIRED_SERVICES_SCHEMA, CLOUD_ENTITLEMENT_SCHEMA, CLOUD_HTTP_URL_SCHEMA, CLOUD_LEASE_SCHEMA, } from "./types.js";
+const stateSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    installationId: z.string().uuid(),
+    devicePublicKey: z.string().min(20),
+    devicePrivateKey: z.string().min(20),
+    customerId: z.string().min(1).nullable(),
+    publicPrefix: z.string().min(1).nullable(),
+    desiredServices: CLOUD_DESIRED_SERVICES_SCHEMA,
+    entitlements: z.array(CLOUD_ENTITLEMENT_SCHEMA),
+    managementSession: z
+        .object({
+        purchaseToken: z.string().min(24),
+        managementUrl: CLOUD_HTTP_URL_SCHEMA,
+        expiresAt: z.string().datetime(),
+    })
+        .strict()
+        .nullable(),
+    lease: CLOUD_LEASE_SCHEMA.nullable(),
+})
+    .strict();
+export class CloudStateStore {
+    filePath;
+    constructor(dataDir) {
+        this.filePath = path.join(dataDir, "cloud.json");
+    }
+    async loadOrCreate() {
+        try {
+            return stateSchema.parse(JSON.parse(await readFile(this.filePath, "utf8")));
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const state = createInitialState();
+        await this.save(state);
+        return state;
+    }
+    async save(state) {
+        const validated = stateSchema.parse(state);
+        await mkdir(path.dirname(this.filePath), { recursive: true, mode: 0o700 });
+        const temporary = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporary, `${JSON.stringify(validated, null, 2)}\n`, {
+                mode: 0o600,
+            });
+            await chmod(temporary, 0o600).catch(() => undefined);
+            await rename(temporary, this.filePath);
+            await chmod(this.filePath, 0o600).catch(() => undefined);
+        }
+        finally {
+            await rm(temporary, { force: true }).catch(() => undefined);
+        }
+    }
+}
+function createInitialState() {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    return {
+        schemaVersion: 1,
+        installationId: randomUUID(),
+        devicePublicKey: publicKey
+            .export({ format: "der", type: "spki" })
+            .toString("base64url"),
+        devicePrivateKey: privateKey
+            .export({ format: "der", type: "pkcs8" })
+            .toString("base64url"),
+        customerId: null,
+        publicPrefix: null,
+        desiredServices: { remote_mcp: true, remote_web: true },
+        entitlements: [],
+        managementSession: null,
+        lease: null,
+    };
+}

package/dist/plugins/cloud/tunnel-client.d.ts

@@ -0,0 +1,84 @@
+import { z } from "zod";
+import { type CloudLeaseState } from "./types.js";
+interface TunnelTimings {
+    readyTimeoutMs: number;
+    heartbeatIntervalMs: number;
+}
+declare const controlMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"challenge">;
+    nonce: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"ready">;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"open">;
+    streamId: z.ZodNumber;
+    service: z.ZodEnum<{
+        mcp: "mcp";
+        web: "web";
+    }>;
+    method: z.ZodString;
+    path: z.ZodString;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"end">;
+    streamId: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"abort">;
+    streamId: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"pause">;
+    streamId: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"resume">;
+    streamId: z.ZodNumber;
+}, z.core.$strict>], "type">;
+type ControlMessage = z.infer<typeof controlMessageSchema>;
+export declare function parseTunnelControlMessage(input: string): ControlMessage;
+export declare class CloudTunnelClient {
+    private lease;
+    private readonly identity;
+    private readonly local;
+    private readonly callbacks;
+    private socket;
+    private reconnectTimer;
+    private readyTimer;
+    private heartbeatTimer;
+    private awaitingPong;
+    private stopped;
+    private attempts;
+    private closeWhenIdle;
+    private acceptingServices;
+    private readonly streams;
+    private readonly timings;
+    constructor(lease: CloudLeaseState, identity: {
+        devicePrivateKey: string;
+    }, local: {
+        host: string;
+        port: number;
+    }, callbacks: {
+        onConnected(): void;
+        onDisconnected(): void;
+        onLeaseRejected(): void;
+        onError(error: Error): void;
+    }, timings?: Partial<TunnelTimings>);
+    start(): void;
+    stop(): void;
+    drainAndStop(): void;
+    updateLease(lease: CloudLeaseState): void;
+    private connect;
+    private handleControl;
+    private openStream;
+    private finishStream;
+    private pauseForBackpressure;
+    private destroyAllStreams;
+    private handleBinary;
+    private send;
+    private sendBinary;
+    private startReadyTimeout;
+    private clearReadyTimeout;
+    private startHeartbeat;
+    private clearSocketTimers;
+    private failSocket;
+    private scheduleReconnect;
+}
+export {};

package/dist/plugins/cloud/tunnel-client.js

@@ -0,0 +1,427 @@
+import { createPrivateKey, sign } from "node:crypto";
+import http from "node:http";
+import WebSocket from "ws";
+import { z } from "zod";
+import { cloudServiceForPublicService, } from "./types.js";
+const PROTOCOL = "chatroom-tunnel-v1";
+const HIGH_WATER = 8 * 1024 * 1024;
+const LOW_WATER = 2 * 1024 * 1024;
+const READY_TIMEOUT_MS = 10_000;
+const HEARTBEAT_INTERVAL_MS = 20_000;
+const streamIdSchema = z.number().int().min(0).max(0xffff_ffff);
+const controlMessageSchema = z.discriminatedUnion("type", [
+    z
+        .object({
+        type: z.literal("challenge"),
+        nonce: z.string().min(1),
+    })
+        .strict(),
+    z.object({ type: z.literal("ready") }).strict(),
+    z
+        .object({
+        type: z.literal("open"),
+        streamId: streamIdSchema,
+        service: z.enum(["mcp", "web"]),
+        method: z.string().min(1),
+        path: z.string().startsWith("/"),
+        headers: z.record(z.string(), z.string()),
+    })
+        .strict(),
+    z.object({ type: z.literal("end"), streamId: streamIdSchema }).strict(),
+    z.object({ type: z.literal("abort"), streamId: streamIdSchema }).strict(),
+    z.object({ type: z.literal("pause"), streamId: streamIdSchema }).strict(),
+    z.object({ type: z.literal("resume"), streamId: streamIdSchema }).strict(),
+]);
+export function parseTunnelControlMessage(input) {
+    return controlMessageSchema.parse(JSON.parse(input));
+}
+export class CloudTunnelClient {
+    lease;
+    identity;
+    local;
+    callbacks;
+    socket = null;
+    reconnectTimer = null;
+    readyTimer = null;
+    heartbeatTimer = null;
+    awaitingPong = false;
+    stopped = true;
+    attempts = 0;
+    closeWhenIdle = null;
+    acceptingServices;
+    streams = new Map();
+    timings;
+    constructor(lease, identity, local, callbacks, timings = {}) {
+        this.lease = lease;
+        this.identity = identity;
+        this.local = local;
+        this.callbacks = callbacks;
+        this.acceptingServices = new Set(lease.services);
+        this.timings = {
+            readyTimeoutMs: timings.readyTimeoutMs ?? READY_TIMEOUT_MS,
+            heartbeatIntervalMs: timings.heartbeatIntervalMs ?? HEARTBEAT_INTERVAL_MS,
+        };
+    }
+    start() {
+        if (!this.stopped)
+            return;
+        this.stopped = false;
+        this.closeWhenIdle = null;
+        this.acceptingServices = new Set(this.lease.services);
+        this.connect();
+    }
+    stop() {
+        this.stopped = true;
+        this.closeWhenIdle = null;
+        this.acceptingServices.clear();
+        if (this.reconnectTimer)
+            clearTimeout(this.reconnectTimer);
+        this.reconnectTimer = null;
+        this.clearSocketTimers();
+        this.socket?.close();
+        this.socket = null;
+        this.destroyAllStreams();
+    }
+    drainAndStop() {
+        this.stopped = true;
+        this.acceptingServices.clear();
+        if (this.reconnectTimer)
+            clearTimeout(this.reconnectTimer);
+        this.reconnectTimer = null;
+        this.clearSocketTimers();
+        if (this.streams.size === 0) {
+            this.closeWhenIdle = null;
+            this.socket?.close();
+            return;
+        }
+        this.closeWhenIdle = "stop";
+    }
+    updateLease(lease) {
+        const tunnelChanged = lease.tunnelUrl !== this.lease.tunnelUrl;
+        const removesService = this.lease.services.some((service) => !lease.services.includes(service));
+        this.lease = lease;
+        this.acceptingServices = new Set(lease.services);
+        if (this.stopped)
+            return;
+        if (!tunnelChanged) {
+            if (this.socket?.readyState === WebSocket.OPEN)
+                this.send({ type: "update-lease", lease: lease.token });
+            return;
+        }
+        if (!removesService || this.streams.size === 0) {
+            this.socket?.close();
+            return;
+        }
+        this.closeWhenIdle = "reconnect";
+    }
+    connect() {
+        if (this.stopped || this.socket)
+            return;
+        const socket = new WebSocket(this.lease.tunnelUrl, PROTOCOL);
+        this.socket = socket;
+        socket.binaryType = "nodebuffer";
+        this.startReadyTimeout(socket);
+        socket.on("message", (data, isBinary) => {
+            try {
+                if (isBinary)
+                    this.handleBinary(Buffer.from(data));
+                else
+                    this.handleControl(parseTunnelControlMessage(data.toString()));
+            }
+            catch (error) {
+                this.callbacks.onError(error instanceof Error ? error : new Error(String(error)));
+                socket.close();
+            }
+        });
+        socket.on("pong", () => {
+            if (this.socket === socket)
+                this.awaitingPong = false;
+        });
+        socket.on("close", (code) => {
+            if (this.socket === socket) {
+                this.clearSocketTimers();
+                this.socket = null;
+            }
+            this.closeWhenIdle = null;
+            this.destroyAllStreams();
+            this.callbacks.onDisconnected();
+            if (this.stopped)
+                return;
+            if (code === 4003) {
+                this.stopped = true;
+                this.callbacks.onLeaseRejected();
+                return;
+            }
+            this.scheduleReconnect();
+        });
+        socket.on("error", (error) => this.failSocket(socket, error));
+    }
+    handleControl(message) {
+        if (message.type === "challenge") {
+            this.send({
+                type: "authenticate",
+                lease: this.lease.token,
+                signature: signChallenge(message.nonce, this.lease.token, this.identity.devicePrivateKey),
+            });
+            return;
+        }
+        if (message.type === "ready") {
+            this.attempts = 0;
+            this.clearReadyTimeout();
+            if (this.socket)
+                this.startHeartbeat(this.socket);
+            this.callbacks.onConnected();
+            return;
+        }
+        if (message.type === "open") {
+            this.openStream(message);
+            return;
+        }
+        const stream = this.streams.get(message.streamId);
+        if (!stream)
+            return;
+        if (message.type === "end")
+            stream.request.end();
+        else if (message.type === "abort") {
+            stream.request.destroy();
+            stream.response?.destroy();
+            this.finishStream(message.streamId);
+        }
+        else if (message.type === "pause")
+            stream.response?.pause();
+        else if (message.type === "resume")
+            stream.response?.resume();
+    }
+    openStream(message) {
+        if (this.streams.has(message.streamId))
+            throw new Error(`Duplicate tunnel stream id: ${message.streamId}`);
+        const service = cloudServiceForPublicService(message.service);
+        if (!this.acceptingServices.has(service) ||
+            !allowedPath(message.service, message.path)) {
+            this.send({
+                type: "response",
+                streamId: message.streamId,
+                status: 404,
+                headers: { "content-type": "text/plain" },
+            });
+            this.send({ type: "response-end", streamId: message.streamId });
+            return;
+        }
+        const headers = sanitizeHeaders(message.headers);
+        headers.host = publicHost(this.lease, message.service);
+        const request = http.request({
+            host: this.local.host,
+            port: this.local.port,
+            method: message.method,
+            path: message.path,
+            headers,
+        }, (response) => {
+            const stream = this.streams.get(message.streamId);
+            if (stream)
+                stream.response = response;
+            this.send({
+                type: "response",
+                streamId: message.streamId,
+                status: response.statusCode ?? 502,
+                headers: responseHeaders(response.headers),
+            });
+            response.on("data", (chunk) => {
+                if (!this.sendBinary(message.streamId, Buffer.from(chunk)))
+                    this.pauseForBackpressure(message.streamId, response);
+            });
+            response.on("end", () => {
+                this.send({ type: "response-end", streamId: message.streamId });
+                this.finishStream(message.streamId);
+            });
+            response.on("error", () => {
+                this.send({ type: "abort", streamId: message.streamId });
+                this.finishStream(message.streamId);
+            });
+        });
+        request.on("drain", () => this.send({ type: "resume", streamId: message.streamId }));
+        request.on("error", () => {
+            this.send({
+                type: "response",
+                streamId: message.streamId,
+                status: 502,
+                headers: {},
+            });
+            this.send({ type: "response-end", streamId: message.streamId });
+            this.finishStream(message.streamId);
+        });
+        this.streams.set(message.streamId, {
+            request,
+            response: null,
+            backpressureTimer: null,
+        });
+    }
+    finishStream(streamId) {
+        const stream = this.streams.get(streamId);
+        if (stream?.backpressureTimer)
+            clearInterval(stream.backpressureTimer);
+        this.streams.delete(streamId);
+        if (this.streams.size !== 0 || !this.closeWhenIdle)
+            return;
+        const action = this.closeWhenIdle;
+        this.closeWhenIdle = null;
+        if (action === "stop") {
+            this.socket?.close();
+            return;
+        }
+        this.socket?.close();
+    }
+    pauseForBackpressure(streamId, response) {
+        response.pause();
+        const stream = this.streams.get(streamId);
+        if (!stream || stream.backpressureTimer)
+            return;
+        stream.backpressureTimer = setInterval(() => {
+            if (!this.socket || this.socket.readyState !== WebSocket.OPEN) {
+                if (stream.backpressureTimer)
+                    clearInterval(stream.backpressureTimer);
+                stream.backpressureTimer = null;
+                return;
+            }
+            if (this.socket.bufferedAmount <= LOW_WATER) {
+                if (stream.backpressureTimer)
+                    clearInterval(stream.backpressureTimer);
+                stream.backpressureTimer = null;
+                response.resume();
+            }
+        }, 10);
+        stream.backpressureTimer.unref();
+    }
+    destroyAllStreams() {
+        for (const stream of this.streams.values()) {
+            if (stream.backpressureTimer)
+                clearInterval(stream.backpressureTimer);
+            stream.request.destroy();
+            stream.response?.destroy();
+        }
+        this.streams.clear();
+    }
+    handleBinary(frame) {
+        if (frame.length < 4)
+            throw new Error("Invalid tunnel data frame");
+        const streamId = frame.readUInt32BE(0);
+        const stream = this.streams.get(streamId);
+        if (!stream)
+            return;
+        if (!stream.request.write(frame.subarray(4)))
+            this.send({ type: "pause", streamId });
+    }
+    send(message) {
+        if (this.socket?.readyState === WebSocket.OPEN)
+            this.socket.send(JSON.stringify(message));
+    }
+    sendBinary(streamId, chunk) {
+        const socket = this.socket;
+        if (!socket || socket.readyState !== WebSocket.OPEN)
+            return false;
+        const frame = Buffer.allocUnsafe(4 + chunk.length);
+        frame.writeUInt32BE(streamId, 0);
+        chunk.copy(frame, 4);
+        socket.send(frame, { binary: true });
+        return socket.bufferedAmount < HIGH_WATER;
+    }
+    startReadyTimeout(socket) {
+        this.clearReadyTimeout();
+        this.readyTimer = setTimeout(() => {
+            this.readyTimer = null;
+            this.failSocket(socket, new Error("Tunnel connection timed out"));
+        }, this.timings.readyTimeoutMs);
+        this.readyTimer.unref();
+    }
+    clearReadyTimeout() {
+        if (this.readyTimer)
+            clearTimeout(this.readyTimer);
+        this.readyTimer = null;
+    }
+    startHeartbeat(socket) {
+        if (this.heartbeatTimer)
+            clearInterval(this.heartbeatTimer);
+        this.awaitingPong = false;
+        this.heartbeatTimer = setInterval(() => {
+            if (this.socket !== socket || socket.readyState !== WebSocket.OPEN)
+                return;
+            if (this.awaitingPong) {
+                this.failSocket(socket, new Error("Tunnel heartbeat timed out"));
+                return;
+            }
+            this.awaitingPong = true;
+            socket.ping();
+        }, this.timings.heartbeatIntervalMs);
+        this.heartbeatTimer.unref();
+    }
+    clearSocketTimers() {
+        this.clearReadyTimeout();
+        if (this.heartbeatTimer)
+            clearInterval(this.heartbeatTimer);
+        this.heartbeatTimer = null;
+        this.awaitingPong = false;
+    }
+    failSocket(socket, error) {
+        if (this.socket !== socket)
+            return;
+        this.callbacks.onError(error);
+        this.clearSocketTimers();
+        this.socket = null;
+        socket.terminate();
+    }
+    scheduleReconnect() {
+        if (this.reconnectTimer || this.stopped)
+            return;
+        const delay = Math.min(30_000, 500 * 2 ** Math.min(this.attempts++, 6)) *
+            (0.8 + Math.random() * 0.4);
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            this.connect();
+        }, delay);
+        this.reconnectTimer.unref();
+    }
+}
+function signChallenge(nonce, lease, privateKey) {
+    const key = createPrivateKey({
+        key: Buffer.from(privateKey, "base64url"),
+        format: "der",
+        type: "pkcs8",
+    });
+    return sign(null, Buffer.from(`chatroom-tunnel-v1\n${nonce}\n${lease}`), key).toString("base64url");
+}
+function publicHost(lease, service) {
+    const baseUrl = service === "mcp" ? lease.mcpBaseUrl : lease.webBaseUrl;
+    if (!baseUrl)
+        throw new Error("Tunnel lease is missing " + service + " public base URL");
+    return new URL(baseUrl).host;
+}
+function allowedPath(service, value) {
+    const pathname = new URL(value, "http://localhost").pathname;
+    if (service === "mcp")
+        return (pathname === "/mcp" ||
+            pathname.startsWith("/.well-known/oauth-") ||
+            pathname.startsWith("/oauth/"));
+    return (pathname !== "/mcp" &&
+        !pathname.startsWith("/oauth/") &&
+        !pathname.startsWith("/.well-known/oauth-"));
+}
+function sanitizeHeaders(headers) {
+    const blocked = new Set([
+        "connection",
+        "host",
+        "proxy-connection",
+        "keep-alive",
+        "transfer-encoding",
+        "upgrade",
+    ]);
+    return Object.fromEntries(Object.entries(headers).filter(([key]) => !blocked.has(key.toLowerCase())));
+}
+function responseHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (value === undefined ||
+            ["connection", "keep-alive", "transfer-encoding", "upgrade"].includes(key.toLowerCase()))
+            continue;
+        result[key] = Array.isArray(value) ? value.join(", ") : value;
+    }
+    return result;
+}

package/dist/plugins/cloud/types.d.ts

@@ -0,0 +1,72 @@
+import { z } from "zod";
+export declare const CLOUD_SERVICES: readonly ["remote_mcp", "remote_web"];
+export declare const CLOUD_HTTP_URL_SCHEMA: z.ZodString;
+export declare const CLOUD_WEBSOCKET_URL_SCHEMA: z.ZodString;
+export declare const CLOUD_SERVICE_SCHEMA: z.ZodEnum<{
+    remote_mcp: "remote_mcp";
+    remote_web: "remote_web";
+}>;
+export type CloudServiceId = (typeof CLOUD_SERVICES)[number];
+declare const PUBLIC_SERVICE_TO_CLOUD_SERVICE: {
+    readonly mcp: "remote_mcp";
+    readonly web: "remote_web";
+};
+export type PublicService = keyof typeof PUBLIC_SERVICE_TO_CLOUD_SERVICE;
+export declare const CLOUD_DESIRED_SERVICES_SCHEMA: z.ZodObject<{
+    remote_mcp: z.ZodBoolean;
+    remote_web: z.ZodBoolean;
+}, z.core.$strict>;
+export declare function cloudServiceForPublicService(service: PublicService): CloudServiceId;
+export declare const CLOUD_ENTITLEMENT_SCHEMA: z.ZodObject<{
+    service: z.ZodEnum<{
+        remote_mcp: "remote_mcp";
+        remote_web: "remote_web";
+    }>;
+    status: z.ZodLiteral<"active">;
+    sourceProvider: z.ZodString;
+    sourceId: z.ZodString;
+    validUntil: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type CloudEntitlement = z.infer<typeof CLOUD_ENTITLEMENT_SCHEMA>;
+export declare const CLOUD_LEASE_SCHEMA: z.ZodObject<{
+    token: z.ZodString;
+    expiresAt: z.ZodString;
+    tunnelUrl: z.ZodString;
+    mcpBaseUrl: z.ZodNullable<z.ZodString>;
+    webBaseUrl: z.ZodNullable<z.ZodString>;
+    services: z.ZodArray<z.ZodEnum<{
+        remote_mcp: "remote_mcp";
+        remote_web: "remote_web";
+    }>>;
+}, z.core.$strict>;
+export type CloudLeaseState = z.infer<typeof CLOUD_LEASE_SCHEMA>;
+interface ManagementSessionState {
+    purchaseToken: string;
+    managementUrl: string;
+    expiresAt: string;
+}
+export interface CloudPersistedState {
+    schemaVersion: 1;
+    installationId: string;
+    devicePublicKey: string;
+    devicePrivateKey: string;
+    customerId: string | null;
+    publicPrefix: string | null;
+    desiredServices: Record<CloudServiceId, boolean>;
+    entitlements: CloudEntitlement[];
+    managementSession: ManagementSessionState | null;
+    lease: CloudLeaseState | null;
+}
+export interface CloudStatus {
+    installationId: string | null;
+    customerId: string | null;
+    publicPrefix: string | null;
+    desiredServices: Record<CloudServiceId, boolean>;
+    entitlements: CloudEntitlement[];
+    managementSessionActive: boolean;
+    connection: "inactive" | "connecting" | "connected" | "disconnected" | "error";
+    mcpUrl: string | null;
+    webUrl: string | null;
+    lastError: string | null;
+}
+export {};