@zswarm/core 0.2.0 → 0.2.2

package/README.md

@@ -10,7 +10,7 @@ the CLI flags, and the CLI help, so they cannot drift.
 npm install @zswarm/core
 ```
 
-From a checkout of this repo:
+From a checkout of this repo (build first with `pnpm build`):
 
 ```bash
 npm install ./packages/core
@@ -36,11 +36,11 @@ SSH LocalForward and calls `probeServe` before ops (including before reuse);
 pass a `serveTunnels` manager if the caller (MCP) should reuse it. Omitting
 the SSH port leaves `Port` to OpenSSH instead of forcing 22. `tcp://` also
 names a private Tailscale Serve frontend over a loopback backend; see
-[Tailscale crew](../../docs/tailscale.md).
+[Tailscale crew](https://github.com/brandonkramer/zswarm/blob/master/docs/tailscale.md).
 
-Spawn lifecycle, body files, guarded keys, status tabs and routing context: [crew operations](../../docs/crew-operations.md).
+Spawn lifecycle, body files, guarded keys, status tabs and routing context: [crew operations](https://github.com/brandonkramer/zswarm/blob/master/docs/crew-operations.md).
 
-Ops, env, and the event bus: the [zswarm README](../../README.md).
+Ops, env, and the event bus: the [zswarm README](https://github.com/brandonkramer/zswarm#readme).
 
 ## License
 

package/dist/host/cli.js

@@ -183,7 +183,7 @@ const COMMANDS = {
             "zswarm host install --ssh DEST [--sudo] [--prefix /usr/local/lib/zswarm] [--bin-dir /usr/local/bin]",
             "                    [--node V] [--zellij V] [--zswarm V]   Node.js, zswarm and Zellij on a Linux/macOS host",
             "zswarm host install --script [same options]   print the script (run it as: sh -s -- <args printed on stderr>)",
-            "zswarm host doctor [--ssh DEST] [--serve TARGET] [--session S]   tools, disk, services, serve, session, panes",
+            "zswarm host doctor (--ssh DEST | --serve TARGET) [--session S]   tools, disk, services, serve, session, panes",
         ].join("\n"),
         run: host,
     },

package/dist/host/relay.js

@@ -293,6 +293,7 @@ export function launchRelay(dir, env = process.env) {
             "submit", "-l", label, "-o", log, "-e", log, "--",
             "/usr/bin/env", `PATH=${env.PATH ?? "/usr/bin:/bin"}`, `HOME=${env.HOME ?? ""}`,
             ...(env.ZSWARM_STATE_DIR ? [`ZSWARM_STATE_DIR=${env.ZSWARM_STATE_DIR}`] : []),
+            ...(env.ZSWARM_RELAY_DELAYS ? [`ZSWARM_RELAY_DELAYS=${env.ZSWARM_RELAY_DELAYS}`] : []),
             `ZSWARM_RELAY_LABEL=${label}`, ...argv,
         ], { encoding: "utf8" });
         if (res.status !== 0)
@@ -304,6 +305,7 @@ export function launchRelay(dir, env = process.env) {
         const res = spawnSync("systemd-run", ["--user", "--collect", "--quiet", `--unit=${unit}`,
             `--setenv=PATH=${env.PATH ?? "/usr/bin:/bin"}`,
             ...(env.ZSWARM_STATE_DIR ? [`--setenv=ZSWARM_STATE_DIR=${env.ZSWARM_STATE_DIR}`] : []),
+            ...(env.ZSWARM_RELAY_DELAYS ? [`--setenv=ZSWARM_RELAY_DELAYS=${env.ZSWARM_RELAY_DELAYS}`] : []),
             ...argv], { encoding: "utf8" });
         if (res.status === 0)
             return `systemd unit ${unit}`;

package/dist/host/services.d.ts

@@ -66,14 +66,15 @@ export declare const defaultRunner: Runner;
 /** The account services are installed for: the current user, or `runAs` when root. */
 export declare function serviceAccount(runAs?: string, run?: Runner): ServiceAccount;
 /**
- * Run fs work in another account's home as that account. Root installing
- * with --run-as drops its effective uid and gid for the duration, so the
+ * The argv prefix that runs a command as the account: `runuser` on Linux,
+ * `sudo -u` on macOS. Root writes into the account's home through it, so the
  * kernel refuses what the account itself could not do (a symlink it planted
- * towards a root-owned file, say) and new files are the account's own. The
- * work must be synchronous: the effective ids are process-wide.
+ * towards a root-owned file, say) and new files are the account's own. (Not
+ * seteuid in this process: Node disables it on Linux while io_uring may be
+ * enabled, CVE-2024-22017.)
  */
-export declare function asAccount<T>(account: ServiceAccount, fn: () => T): T;
-/** Write a file in the account's home as the account (see asAccount). */
+export declare function accountArgv(account: ServiceAccount): string[];
+/** Write a file in the account's home as the account (see accountArgv). */
 export declare function writeAccountFile(account: ServiceAccount, path: string, text: string | Buffer, mode: number): void;
 export declare function systemdUnitName(name: string, kind: ServiceKind): string;
 export declare function systemdUnits(spec: ServiceSpec): Array<{

package/dist/host/services.js

@@ -38,33 +38,38 @@ export function serviceAccount(runAs, run = defaultRunner) {
         throw new ZellijError("usage", `cannot find the home of ${target}`);
     return { platform, user: target, uid: id("-u"), gid: id("-g"), home, foreign: true };
 }
+/** Root installing for another account (`--run-as`). */
+function installingFor(account) {
+    return account.foreign && typeof process.geteuid === "function" && process.geteuid() === 0;
+}
 /**
- * Run fs work in another account's home as that account. Root installing
- * with --run-as drops its effective uid and gid for the duration, so the
+ * The argv prefix that runs a command as the account: `runuser` on Linux,
+ * `sudo -u` on macOS. Root writes into the account's home through it, so the
  * kernel refuses what the account itself could not do (a symlink it planted
- * towards a root-owned file, say) and new files are the account's own. The
- * work must be synchronous: the effective ids are process-wide.
+ * towards a root-owned file, say) and new files are the account's own. (Not
+ * seteuid in this process: Node disables it on Linux while io_uring may be
+ * enabled, CVE-2024-22017.)
  */
-export function asAccount(account, fn) {
-    const root = account.foreign && typeof process.geteuid === "function" && process.geteuid() === 0;
-    if (!root)
-        return fn();
-    process.setegid(account.gid);
-    process.seteuid(account.uid);
-    try {
-        return fn();
-    }
-    finally {
-        process.seteuid(0);
-        process.setegid(0);
+export function accountArgv(account) {
+    return account.platform === "linux"
+        ? ["runuser", "-u", account.user, "--"]
+        : ["sudo", "-n", "-u", account.user, "-H", "--"];
+}
+function runAsAccount(account, argv, input) {
+    const [cmd, ...rest] = [...accountArgv(account), ...argv];
+    const res = spawnSync(cmd, rest, { input, encoding: "utf8" });
+    if (res.status !== 0) {
+        throw new ZellijError("failed", `${argv[0]} as ${account.user} failed: ${(res.stderr || res.error?.message || "").trim().slice(0, 300)}`);
     }
 }
-/** Write a file in the account's home as the account (see asAccount). */
+/** Write a file in the account's home as the account (see accountArgv). */
 export function writeAccountFile(account, path, text, mode) {
-    asAccount(account, () => {
+    if (!installingFor(account)) {
         writeFileSync(path, text, { mode });
         chmodSync(path, mode);
-    });
+        return;
+    }
+    runAsAccount(account, ["sh", "-c", 'umask 077 && cat > "$1" && chmod "$2" "$1"', "sh", path, mode.toString(8)], text);
 }
 function realFs(account) {
     return {
@@ -319,7 +324,10 @@ export function ensureAccountDir(account, dir, mode = 0o700) {
     for (let d = dir; d && d !== "/" && !existsSync(d); d = d.slice(0, d.lastIndexOf("/")) || "/")
         missing.unshift(d);
     for (const d of missing) {
-        asAccount(account, () => mkdirSync(d, { mode }));
+        if (installingFor(account))
+            runAsAccount(account, ["mkdir", "-m", mode.toString(8), d]);
+        else
+            mkdirSync(d, { mode });
     }
 }
 /** Write a mode-600 file for the account, creating its directory (700) as needed. */

package/dist/index.d.ts

@@ -32,7 +32,7 @@ export { cliUsage, mcpInputSchema, parseCliArgv, MCP_TOOL_DESCRIPTION, OP_NAMES,
 export { HOST_COMMANDS, hostUsage, parseHostArgs, runHostCommand } from "./host/cli.js";
 export { findPython, runSlot, slotScriptPath } from "./host/slot.js";
 export { installServeService, serveServiceName, serveServiceSpec, serveTokenFromEnv, serveTokenPath, uninstallServeService, SERVE_AWAIT_SESSION_ENV, SERVE_TOKEN_FILE_ENV, type ServeServiceInput, } from "./host/serve-service.js";
-export { asAccount, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, type Runner, type ServiceAccount, type ServiceHost, type ServiceKind, type ServiceSpec, type ServiceState, } from "./host/services.js";
+export { accountArgv, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, type Runner, type ServiceAccount, type ServiceHost, type ServiceKind, type ServiceSpec, type ServiceState, } from "./host/services.js";
 export { crewCheck, crewDir, crewDown, crewServiceSpecs, crewStart, crewStatus, crewUp, firstLayoutPane, parseEnvFile, CREW_UNIT_ENV, CREW_WATCH_SEC, type CrewDeps, type CrewUpInput, } from "./host/crew.js";
 export { deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, type RelayConfig, type RelayDeps, type RelayStartInput, type RelayStatus, } from "./host/relay.js";
 export { hostChecks, hostDoctor, hostInstall, hostInstallArgs, hostScriptPath, parseHostReport, type HostCheck, type HostDoctorInput, type HostInstallInput, type SshRunner, } from "./host/host.js";

package/dist/index.js

@@ -30,7 +30,7 @@ export { cliUsage, mcpInputSchema, parseCliArgv, MCP_TOOL_DESCRIPTION, OP_NAMES,
 export { HOST_COMMANDS, hostUsage, parseHostArgs, runHostCommand } from "./host/cli.js";
 export { findPython, runSlot, slotScriptPath } from "./host/slot.js";
 export { installServeService, serveServiceName, serveServiceSpec, serveTokenFromEnv, serveTokenPath, uninstallServeService, SERVE_AWAIT_SESSION_ENV, SERVE_TOKEN_FILE_ENV, } from "./host/serve-service.js";
-export { asAccount, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, } from "./host/services.js";
+export { accountArgv, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, } from "./host/services.js";
 export { crewCheck, crewDir, crewDown, crewServiceSpecs, crewStart, crewStatus, crewUp, firstLayoutPane, parseEnvFile, CREW_UNIT_ENV, CREW_WATCH_SEC, } from "./host/crew.js";
 export { deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, } from "./host/relay.js";
 export { hostChecks, hostDoctor, hostInstall, hostInstallArgs, hostScriptPath, parseHostReport, } from "./host/host.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zswarm/core",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "type": "module",
   "description": "zSwarm Zellij client and shared ops dispatch",
   "exports": {