@zswarm/core 0.2.0 → 0.2.1

package/dist/host/services.d.ts

@@ -66,14 +66,15 @@ export declare const defaultRunner: Runner;
 /** The account services are installed for: the current user, or `runAs` when root. */
 export declare function serviceAccount(runAs?: string, run?: Runner): ServiceAccount;
 /**
- * Run fs work in another account's home as that account. Root installing
- * with --run-as drops its effective uid and gid for the duration, so the
+ * The argv prefix that runs a command as the account: `runuser` on Linux,
+ * `sudo -u` on macOS. Root writes into the account's home through it, so the
  * kernel refuses what the account itself could not do (a symlink it planted
- * towards a root-owned file, say) and new files are the account's own. The
- * work must be synchronous: the effective ids are process-wide.
+ * towards a root-owned file, say) and new files are the account's own. (Not
+ * seteuid in this process: Node disables it on Linux while io_uring may be
+ * enabled, CVE-2024-22017.)
  */
-export declare function asAccount<T>(account: ServiceAccount, fn: () => T): T;
-/** Write a file in the account's home as the account (see asAccount). */
+export declare function accountArgv(account: ServiceAccount): string[];
+/** Write a file in the account's home as the account (see accountArgv). */
 export declare function writeAccountFile(account: ServiceAccount, path: string, text: string | Buffer, mode: number): void;
 export declare function systemdUnitName(name: string, kind: ServiceKind): string;
 export declare function systemdUnits(spec: ServiceSpec): Array<{

package/dist/host/services.js

@@ -38,33 +38,38 @@ export function serviceAccount(runAs, run = defaultRunner) {
         throw new ZellijError("usage", `cannot find the home of ${target}`);
     return { platform, user: target, uid: id("-u"), gid: id("-g"), home, foreign: true };
 }
+/** Root installing for another account (`--run-as`). */
+function installingFor(account) {
+    return account.foreign && typeof process.geteuid === "function" && process.geteuid() === 0;
+}
 /**
- * Run fs work in another account's home as that account. Root installing
- * with --run-as drops its effective uid and gid for the duration, so the
+ * The argv prefix that runs a command as the account: `runuser` on Linux,
+ * `sudo -u` on macOS. Root writes into the account's home through it, so the
  * kernel refuses what the account itself could not do (a symlink it planted
- * towards a root-owned file, say) and new files are the account's own. The
- * work must be synchronous: the effective ids are process-wide.
+ * towards a root-owned file, say) and new files are the account's own. (Not
+ * seteuid in this process: Node disables it on Linux while io_uring may be
+ * enabled, CVE-2024-22017.)
  */
-export function asAccount(account, fn) {
-    const root = account.foreign && typeof process.geteuid === "function" && process.geteuid() === 0;
-    if (!root)
-        return fn();
-    process.setegid(account.gid);
-    process.seteuid(account.uid);
-    try {
-        return fn();
-    }
-    finally {
-        process.seteuid(0);
-        process.setegid(0);
+export function accountArgv(account) {
+    return account.platform === "linux"
+        ? ["runuser", "-u", account.user, "--"]
+        : ["sudo", "-n", "-u", account.user, "-H", "--"];
+}
+function runAsAccount(account, argv, input) {
+    const [cmd, ...rest] = [...accountArgv(account), ...argv];
+    const res = spawnSync(cmd, rest, { input, encoding: "utf8" });
+    if (res.status !== 0) {
+        throw new ZellijError("failed", `${argv[0]} as ${account.user} failed: ${(res.stderr || res.error?.message || "").trim().slice(0, 300)}`);
     }
 }
-/** Write a file in the account's home as the account (see asAccount). */
+/** Write a file in the account's home as the account (see accountArgv). */
 export function writeAccountFile(account, path, text, mode) {
-    asAccount(account, () => {
+    if (!installingFor(account)) {
         writeFileSync(path, text, { mode });
         chmodSync(path, mode);
-    });
+        return;
+    }
+    runAsAccount(account, ["sh", "-c", 'umask 077 && cat > "$1" && chmod "$2" "$1"', "sh", path, mode.toString(8)], text);
 }
 function realFs(account) {
     return {
@@ -319,7 +324,10 @@ export function ensureAccountDir(account, dir, mode = 0o700) {
     for (let d = dir; d && d !== "/" && !existsSync(d); d = d.slice(0, d.lastIndexOf("/")) || "/")
         missing.unshift(d);
     for (const d of missing) {
-        asAccount(account, () => mkdirSync(d, { mode }));
+        if (installingFor(account))
+            runAsAccount(account, ["mkdir", "-m", mode.toString(8), d]);
+        else
+            mkdirSync(d, { mode });
     }
 }
 /** Write a mode-600 file for the account, creating its directory (700) as needed. */

package/dist/index.d.ts

@@ -32,7 +32,7 @@ export { cliUsage, mcpInputSchema, parseCliArgv, MCP_TOOL_DESCRIPTION, OP_NAMES,
 export { HOST_COMMANDS, hostUsage, parseHostArgs, runHostCommand } from "./host/cli.js";
 export { findPython, runSlot, slotScriptPath } from "./host/slot.js";
 export { installServeService, serveServiceName, serveServiceSpec, serveTokenFromEnv, serveTokenPath, uninstallServeService, SERVE_AWAIT_SESSION_ENV, SERVE_TOKEN_FILE_ENV, type ServeServiceInput, } from "./host/serve-service.js";
-export { asAccount, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, type Runner, type ServiceAccount, type ServiceHost, type ServiceKind, type ServiceSpec, type ServiceState, } from "./host/services.js";
+export { accountArgv, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, type Runner, type ServiceAccount, type ServiceHost, type ServiceKind, type ServiceSpec, type ServiceState, } from "./host/services.js";
 export { crewCheck, crewDir, crewDown, crewServiceSpecs, crewStart, crewStatus, crewUp, firstLayoutPane, parseEnvFile, CREW_UNIT_ENV, CREW_WATCH_SEC, type CrewDeps, type CrewUpInput, } from "./host/crew.js";
 export { deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, type RelayConfig, type RelayDeps, type RelayStartInput, type RelayStatus, } from "./host/relay.js";
 export { hostChecks, hostDoctor, hostInstall, hostInstallArgs, hostScriptPath, parseHostReport, type HostCheck, type HostDoctorInput, type HostInstallInput, type SshRunner, } from "./host/host.js";

package/dist/index.js

@@ -30,7 +30,7 @@ export { cliUsage, mcpInputSchema, parseCliArgv, MCP_TOOL_DESCRIPTION, OP_NAMES,
 export { HOST_COMMANDS, hostUsage, parseHostArgs, runHostCommand } from "./host/cli.js";
 export { findPython, runSlot, slotScriptPath } from "./host/slot.js";
 export { installServeService, serveServiceName, serveServiceSpec, serveTokenFromEnv, serveTokenPath, uninstallServeService, SERVE_AWAIT_SESSION_ENV, SERVE_TOKEN_FILE_ENV, } from "./host/serve-service.js";
-export { asAccount, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, } from "./host/services.js";
+export { accountArgv, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, } from "./host/services.js";
 export { crewCheck, crewDir, crewDown, crewServiceSpecs, crewStart, crewStatus, crewUp, firstLayoutPane, parseEnvFile, CREW_UNIT_ENV, CREW_WATCH_SEC, } from "./host/crew.js";
 export { deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, } from "./host/relay.js";
 export { hostChecks, hostDoctor, hostInstall, hostInstallArgs, hostScriptPath, parseHostReport, } from "./host/host.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zswarm/core",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "type": "module",
   "description": "zSwarm Zellij client and shared ops dispatch",
   "exports": {