aimux-cli 0.1.16 → 0.1.18

package/dist/daemon.js

@@ -1,19 +1,92 @@
 import { createServer } from "node:http";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve as pathResolve } from "node:path";
 import { spawn } from "node:child_process";
 import { writeJsonAtomic } from "./atomic-write.js";
-import { getDaemonInfoPath, getDaemonStatePath, getProjectIdFor } from "./paths.js";
+import { getDaemonInfoPath, getDaemonStatePath, getDaemonStdioLogPath, getProjectIdFor, getProjectServiceStdioLogPathFor, } from "./paths.js";
 import { listDesktopProjects } from "./project-scanner.js";
 import { loadMetadataEndpoint } from "./metadata-store.js";
 import { requestJson } from "./http-client.js";
-const DAEMON_PORT = 43190;
-const DAEMON_HOST = "127.0.0.1";
+import { getLoggingConfig, log } from "./debug.js";
+import { RelayClient } from "./relay-client.js";
+import { loadCredentials, setRemoteEnabled } from "./credentials.js";
+import { assertRemoteAccessAllowed, parseRemoteActor } from "./remote-access.js";
+const DEFAULT_DAEMON_PORT = 43190;
+const DEFAULT_DAEMON_HOST = "127.0.0.1";
 const DAEMON_STARTUP_TIMEOUT_MS = 10_000;
 const PROJECT_SERVICE_STARTUP_GRACE_MS = 15_000;
+const PROJECT_SERVICE_TERM_GRACE_MS = 2_000;
+const PROJECT_SERVICE_KILL_GRACE_MS = 3_000;
+const PROJECT_SERVICE_EXIT_POLL_MS = 50;
+const PROXY_TIMEOUT_MS = 10_000;
+// `::1` is intentionally excluded — building http://::1:port is invalid (IPv6
+// needs brackets) and metadata services bind to 127.0.0.1 anyway.
+const PROXY_ALLOWED_HOSTS = new Set(["127.0.0.1", "localhost"]);
+const CORS_ALLOWED_ORIGINS = new Set([
+    "http://localhost:8081",
+    "http://127.0.0.1:8081",
+    "http://localhost:8091",
+    "http://127.0.0.1:8091",
+    "http://localhost:43192",
+    "http://127.0.0.1:43192",
+]);
+export function getDaemonHost() {
+    const host = process.env.AIMUX_DAEMON_HOST?.trim();
+    const resolved = host || DEFAULT_DAEMON_HOST;
+    if (resolved !== "127.0.0.1" && resolved !== "localhost") {
+        throw new Error(`AIMUX_DAEMON_HOST must be loopback (127.0.0.1 or localhost), got ${resolved}`);
+    }
+    return resolved;
+}
+export function getDaemonPort() {
+    const raw = process.env.AIMUX_DAEMON_PORT?.trim();
+    if (!raw)
+        return DEFAULT_DAEMON_PORT;
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error(`AIMUX_DAEMON_PORT must be an integer between 1 and 65535, got ${raw}`);
+    }
+    return port;
+}
+function getDaemonBaseUrl(port = getDaemonPort()) {
+    return `http://${getDaemonHost()}:${port}`;
+}
 function ensureParent(path) {
     mkdirSync(dirname(path), { recursive: true });
 }
+function loggingChildEnv() {
+    const logging = getLoggingConfig();
+    if (!logging.enabled)
+        return process.env;
+    return {
+        ...process.env,
+        AIMUX_LOG: "1",
+        AIMUX_LOG_LEVEL: logging.level,
+        AIMUX_LOG_CATEGORIES: logging.categories.join(","),
+    };
+}
+function loggingChildStdio(path) {
+    const logging = getLoggingConfig();
+    if (!logging.enabled)
+        return { stdio: "ignore", close: () => { } };
+    try {
+        ensureParent(path);
+        const stdout = openSync(path, "a");
+        const stderr = openSync(path, "a");
+        let closed = false;
+        const close = () => {
+            if (closed)
+                return;
+            closed = true;
+            closeSync(stdout);
+            closeSync(stderr);
+        };
+        return { stdio: ["ignore", stdout, stderr], close };
+    }
+    catch {
+        return { stdio: "ignore", close: () => { } };
+    }
+}
 function saveJson(path, value) {
     try {
         writeJsonAtomic(path, value);
@@ -64,6 +137,32 @@ function send(res, status, body) {
     res.setHeader("connection", "close");
     res.end(payload);
 }
+function setCorsHeaders(req, res) {
+    const origin = req.headers.origin;
+    if (origin && !isAllowedCorsOrigin(origin))
+        return false;
+    if (origin) {
+        res.setHeader("Access-Control-Allow-Origin", origin);
+        res.setHeader("Vary", "Origin");
+    }
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    return true;
+}
+function isAllowedCorsOrigin(origin) {
+    if (CORS_ALLOWED_ORIGINS.has(origin))
+        return true;
+    try {
+        const parsed = new URL(origin);
+        return parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
+    }
+    catch {
+        return false;
+    }
+}
+function rejectCors(res) {
+    send(res, 403, { ok: false, error: "origin not allowed" });
+}
 export function loadDaemonInfo() {
     const info = loadJson(getDaemonInfoPath(), null);
     if (!info)
@@ -75,6 +174,11 @@ export async function stopDaemon(signal = "SIGTERM") {
     if (!info)
         return null;
     const state = loadDaemonState();
+    log.info("stopping daemon", "daemon", {
+        pid: info.pid,
+        signal,
+        projectCount: Object.keys(state.projects).length,
+    });
     for (const entry of Object.values(state.projects)) {
         try {
             process.kill(entry.pid, signal);
@@ -123,7 +227,7 @@ export async function requestDaemonJson(path, init) {
     if (!info) {
         throw new Error("aimux daemon is not running");
     }
-    const { status, json } = await requestJson(`http://${DAEMON_HOST}:${info.port}${path}`, {
+    const { status, json } = await requestJson(`${getDaemonBaseUrl(info.port)}${path}`, {
         method: init?.method,
         headers: init?.headers,
         body: init?.body,
@@ -140,29 +244,49 @@ export async function ensureDaemonRunning() {
             await requestDaemonJson("/health");
             return existing;
         }
-        catch {
+        catch (error) {
+            log.warn("stored daemon info failed health check", "daemon", {
+                pid: existing.pid,
+                error: error instanceof Error ? error.message : String(error),
+            });
             clearFile(getDaemonInfoPath());
         }
     }
     try {
-        const { status, json } = await requestJson(`http://${DAEMON_HOST}:${DAEMON_PORT}/health`);
+        const { status, json } = await requestJson(`${getDaemonBaseUrl()}/health`);
         if (status >= 200 && status < 300 && json?.ok !== false && typeof json?.pid === "number") {
             const adopted = {
                 pid: json.pid,
-                port: typeof json?.port === "number" ? json.port : DAEMON_PORT,
+                port: typeof json?.port === "number" ? json.port : getDaemonPort(),
                 startedAt: loadDaemonInfo()?.startedAt ?? new Date().toISOString(),
                 updatedAt: new Date().toISOString(),
             };
             saveJson(getDaemonInfoPath(), adopted);
+            log.info("adopted existing daemon on default port", "daemon", { ...adopted });
             return adopted;
         }
     }
-    catch { }
-    const child = spawn(process.execPath, [process.argv[1], "daemon", "run"], {
-        detached: true,
-        stdio: "ignore",
-    });
+    catch (error) {
+        log.debug("default daemon health probe failed", "daemon", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    const stdio = loggingChildStdio(getDaemonStdioLogPath());
+    let child;
+    try {
+        child = spawn(process.execPath, [process.argv[1], "daemon", "run"], {
+            detached: true,
+            env: loggingChildEnv(),
+            stdio: stdio.stdio,
+        });
+    }
+    catch (error) {
+        stdio.close();
+        throw error;
+    }
+    child.once("exit", stdio.close);
     child.unref();
+    log.info("spawned daemon", "daemon", { pid: child.pid });
     const deadline = Date.now() + DAEMON_STARTUP_TIMEOUT_MS;
     while (Date.now() < deadline) {
         const info = loadDaemonInfo();
@@ -203,14 +327,16 @@ export async function projectServiceStatus(projectRoot) {
 }
 export class AimuxDaemon {
     server = null;
+    relayClient = null;
     children = new Map();
+    projectEnsurePromises = new Map();
     state = loadDaemonState();
     async start() {
         if (this.server)
             return;
         saveJson(getDaemonInfoPath(), {
             pid: process.pid,
-            port: DAEMON_PORT,
+            port: getDaemonPort(),
             startedAt: new Date().toISOString(),
             updatedAt: new Date().toISOString(),
         });
@@ -222,16 +348,57 @@ export class AimuxDaemon {
                 });
             });
         });
+        const host = getDaemonHost();
+        const port = getDaemonPort();
         await new Promise((resolve, reject) => {
             this.server.once("error", reject);
-            this.server.listen(DAEMON_PORT, DAEMON_HOST, () => {
+            this.server.listen(port, host, () => {
                 this.server?.off("error", reject);
                 resolve();
             });
         });
         this.refreshState();
+        log.info("daemon started", "daemon", { pid: process.pid, host, port });
+        this.connectRelayIfConfigured();
+    }
+    // Resolve relay config from stored credentials (`aimux login`), with env-var
+    // overrides for advanced/CI use. Connects only when remote access is enabled.
+    connectRelayIfConfigured(options = {}) {
+        const status = this.relayClient?.getStatus().status;
+        if (!options.force && this.relayClient && status !== "auth_failed" && status !== "disconnected")
+            return;
+        if (this.relayClient) {
+            this.relayClient.disconnect();
+            this.relayClient = null;
+        }
+        const creds = loadCredentials();
+        const relayUrl = process.env.AIMUX_RELAY_URL ?? creds?.relayUrl;
+        const relayToken = process.env.AIMUX_RELAY_TOKEN ?? creds?.token;
+        const hasEnvOverride = Boolean(process.env.AIMUX_RELAY_URL || process.env.AIMUX_RELAY_TOKEN);
+        const enabled = hasEnvOverride ? Boolean(relayUrl && relayToken) : Boolean(creds?.remoteEnabled);
+        if (relayUrl && relayToken && enabled) {
+            this.relayClient = new RelayClient(relayUrl, relayToken, this);
+            this.relayClient.connect();
+        }
+    }
+    getRelayStatus() {
+        return this.relayClient?.getStatus() ?? { status: "off" };
+    }
+    enableRelay() {
+        setRemoteEnabled(true);
+        this.connectRelayIfConfigured({ force: true });
+        return this.getRelayStatus();
+    }
+    disableRelay() {
+        setRemoteEnabled(false);
+        this.relayClient?.disconnect();
+        this.relayClient = null;
+        return { status: "off" };
     }
     stop() {
+        log.info("daemon stopping child services", "daemon", { projectCount: Object.keys(this.state.projects).length });
+        this.relayClient?.disconnect();
+        this.relayClient = null;
         for (const entry of Object.values(this.state.projects)) {
             try {
                 process.kill(entry.pid, "SIGTERM");
@@ -267,16 +434,25 @@ export class AimuxDaemon {
         saveJson(getDaemonStatePath(), this.state);
         saveJson(getDaemonInfoPath(), {
             pid: process.pid,
-            port: DAEMON_PORT,
+            port: getDaemonPort(),
             startedAt: loadDaemonInfo()?.startedAt ?? new Date().toISOString(),
             updatedAt: new Date().toISOString(),
         });
     }
     spawnProjectService(projectRoot, projectId) {
-        const child = spawn(process.execPath, [process.argv[1], "__project-service-internal"], {
-            cwd: projectRoot,
-            stdio: "ignore",
-        });
+        const stdio = loggingChildStdio(getProjectServiceStdioLogPathFor(projectRoot));
+        let child;
+        try {
+            child = spawn(process.execPath, [process.argv[1], "__project-service-internal"], {
+                cwd: projectRoot,
+                env: loggingChildEnv(),
+                stdio: stdio.stdio,
+            });
+        }
+        catch (error) {
+            stdio.close();
+            throw error;
+        }
         this.children.set(projectId, child);
         const now = new Date().toISOString();
         const state = {
@@ -287,8 +463,23 @@ export class AimuxDaemon {
             updatedAt: now,
         };
         this.state.projects[projectId] = state;
-        child.on("exit", () => {
-            this.children.delete(projectId);
+        log.info("spawned project service", "daemon", {
+            projectId,
+            projectRoot,
+            pid: state.pid,
+        });
+        child.on("exit", (code, signal) => {
+            stdio.close();
+            log.warn("project service exited", "daemon", {
+                projectId,
+                projectRoot,
+                pid: state.pid,
+                code,
+                signal,
+            });
+            if (this.children.get(projectId) === child) {
+                this.children.delete(projectId);
+            }
             const current = this.state.projects[projectId];
             if (current?.pid === state.pid) {
                 delete this.state.projects[projectId];
@@ -301,6 +492,18 @@ export class AimuxDaemon {
     async ensureProject(projectRoot) {
         const resolvedRoot = pathResolve(projectRoot);
         const projectId = getProjectIdFor(resolvedRoot);
+        const existingEnsure = this.projectEnsurePromises.get(projectId);
+        if (existingEnsure)
+            return existingEnsure;
+        const ensure = this.ensureProjectUnlocked(resolvedRoot, projectId).finally(() => {
+            if (this.projectEnsurePromises.get(projectId) === ensure) {
+                this.projectEnsurePromises.delete(projectId);
+            }
+        });
+        this.projectEnsurePromises.set(projectId, ensure);
+        return ensure;
+    }
+    async ensureProjectUnlocked(resolvedRoot, projectId) {
         const existing = this.state.projects[projectId];
         if (existing && isPidAlive(existing.pid)) {
             const startedAtMs = Date.parse(existing.startedAt);
@@ -319,13 +522,12 @@ export class AimuxDaemon {
                 if (withinStartupGrace) {
                     return refreshExisting();
                 }
-                try {
-                    process.kill(existing.pid, "SIGTERM");
-                }
-                catch { }
-                delete this.state.projects[projectId];
-                this.refreshState();
-                return this.spawnProjectService(resolvedRoot, projectId);
+                log.warn("project service missing metadata endpoint after startup grace", "daemon", {
+                    projectId,
+                    projectRoot: resolvedRoot,
+                    pid: existing.pid,
+                });
+                return this.replaceProjectServiceAfterExit(resolvedRoot, projectId, existing, refreshExisting);
             }
             try {
                 const { status, json } = await requestJson(`http://${endpoint.host}:${endpoint.port}/health`, {
@@ -335,22 +537,95 @@ export class AimuxDaemon {
                     throw new Error(json?.error || `health request failed: ${status}`);
                 }
             }
-            catch {
+            catch (error) {
                 if (withinStartupGrace) {
                     return refreshExisting();
                 }
-                try {
-                    process.kill(existing.pid, "SIGTERM");
-                }
-                catch { }
-                delete this.state.projects[projectId];
-                this.refreshState();
-                return this.spawnProjectService(resolvedRoot, projectId);
+                log.warn("project service health check failed", "daemon", {
+                    projectId,
+                    projectRoot: resolvedRoot,
+                    pid: existing.pid,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return this.replaceProjectServiceAfterExit(resolvedRoot, projectId, existing, refreshExisting);
             }
             return refreshExisting();
         }
         return this.spawnProjectService(resolvedRoot, projectId);
     }
+    async replaceProjectServiceAfterExit(resolvedRoot, projectId, existing, refreshExisting) {
+        const stopped = await this.terminateProjectService(projectId, existing);
+        if (!stopped) {
+            log.warn("project service did not exit before replacement deadline", "daemon", {
+                projectId,
+                projectRoot: resolvedRoot,
+                pid: existing.pid,
+            });
+            return refreshExisting();
+        }
+        const current = this.state.projects[projectId];
+        if (current?.pid === existing.pid) {
+            delete this.state.projects[projectId];
+        }
+        const child = this.children.get(projectId);
+        if (child?.pid === existing.pid) {
+            this.children.delete(projectId);
+        }
+        this.refreshState();
+        return this.spawnProjectService(resolvedRoot, projectId);
+    }
+    async terminateProjectService(projectId, existing) {
+        const child = this.children.get(projectId);
+        log.info("terminating project service", "daemon", {
+            projectId,
+            projectRoot: existing.projectRoot,
+            pid: existing.pid,
+        });
+        try {
+            process.kill(existing.pid, "SIGTERM");
+        }
+        catch {
+            return true;
+        }
+        if (await this.waitForProjectServiceExit(existing.pid, child, PROJECT_SERVICE_TERM_GRACE_MS)) {
+            return true;
+        }
+        try {
+            process.kill(existing.pid, "SIGKILL");
+        }
+        catch {
+            return true;
+        }
+        return this.waitForProjectServiceExit(existing.pid, child, PROJECT_SERVICE_KILL_GRACE_MS);
+    }
+    async waitForProjectServiceExit(pid, child, timeoutMs) {
+        if (!isPidAlive(pid))
+            return true;
+        return new Promise((resolve) => {
+            let settled = false;
+            const cleanups = [];
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                for (const cleanup of cleanups)
+                    cleanup();
+                resolve(value);
+            };
+            const onExit = () => finish(true);
+            if (child) {
+                child.once("exit", onExit);
+                cleanups.push(() => child.off("exit", onExit));
+            }
+            const interval = setInterval(() => {
+                if (!isPidAlive(pid))
+                    finish(true);
+            }, PROJECT_SERVICE_EXIT_POLL_MS);
+            cleanups.push(() => clearInterval(interval));
+            const timeout = setTimeout(() => finish(!isPidAlive(pid)), timeoutMs);
+            cleanups.push(() => clearTimeout(timeout));
+        });
+    }
     stopProject(projectRoot) {
         const projectId = getProjectIdFor(pathResolve(projectRoot));
         const existing = this.state.projects[projectId];
@@ -361,18 +636,34 @@ export class AimuxDaemon {
         }
         catch { }
         delete this.state.projects[projectId];
-        this.children.delete(projectId);
+        if (this.children.get(projectId)?.pid === existing.pid) {
+            this.children.delete(projectId);
+        }
         this.refreshState();
         return existing;
     }
-    async handle(req, res) {
+    async routeRequest(method, path, body, headers) {
         this.refreshState();
-        const url = new URL(req.url ?? "/", `http://${DAEMON_HOST}:${DAEMON_PORT}`);
-        if (req.method === "GET" && url.pathname === "/health") {
-            send(res, 200, { ok: true, pid: process.pid, port: DAEMON_PORT });
-            return;
+        const routeUrl = new URL(path, getDaemonBaseUrl());
+        const pathname = routeUrl.pathname;
+        const actor = parseRemoteActor(headers);
+        const access = assertRemoteAccessAllowed(actor, method, pathname, routeUrl.searchParams);
+        if (!access.ok) {
+            return { status: access.status ?? 403, body: { ok: false, error: access.error ?? "remote access denied" } };
+        }
+        if (method === "GET" && pathname === "/health") {
+            return { status: 200, body: { ok: true, pid: process.pid, port: getDaemonPort() } };
+        }
+        if (method === "GET" && pathname === "/relay/status") {
+            return { status: 200, body: { ok: true, relay: this.getRelayStatus() } };
+        }
+        if (method === "POST" && pathname === "/relay/enable") {
+            return { status: 200, body: { ok: true, relay: this.enableRelay() } };
         }
-        if (req.method === "GET" && url.pathname === "/projects") {
+        if (method === "POST" && pathname === "/relay/disable") {
+            return { status: 200, body: { ok: true, relay: this.disableRelay() } };
+        }
+        if (method === "GET" && pathname === "/projects") {
             const liveById = this.state.projects;
             const projects = listDesktopProjects().map((project) => ({
                 ...project,
@@ -380,36 +671,70 @@ export class AimuxDaemon {
                 serviceAlive: Boolean(liveById[project.id]),
                 serviceEndpoint: project.path ? loadMetadataEndpoint(project.path) : null,
             }));
-            send(res, 200, { ok: true, projects });
-            return;
+            return { status: 200, body: { ok: true, projects } };
         }
-        if (req.method === "GET" && url.pathname.startsWith("/projects/")) {
-            const projectId = decodeURIComponent(url.pathname.slice("/projects/".length));
+        if (method === "GET" && pathname.startsWith("/projects/")) {
+            const projectId = decodeURIComponent(pathname.slice("/projects/".length));
             const project = this.state.projects[projectId] ?? null;
-            send(res, 200, { ok: true, project });
-            return;
+            return { status: 200, body: { ok: true, project } };
         }
-        if (req.method === "POST" && url.pathname === "/projects/ensure") {
-            const body = (await readJson(req));
-            if (!body.projectRoot) {
-                send(res, 400, { ok: false, error: "projectRoot is required" });
-                return;
+        if (method === "POST" && pathname === "/projects/ensure") {
+            const b = body;
+            if (!b?.projectRoot) {
+                return { status: 400, body: { ok: false, error: "projectRoot is required" } };
             }
-            const project = await this.ensureProject(body.projectRoot);
-            send(res, 200, { ok: true, project });
-            return;
+            const project = await this.ensureProject(b.projectRoot);
+            return { status: 200, body: { ok: true, project } };
         }
-        if (req.method === "POST" && url.pathname === "/projects/stop") {
-            const body = (await readJson(req));
-            if (!body.projectRoot) {
-                send(res, 400, { ok: false, error: "projectRoot is required" });
-                return;
+        if (method === "POST" && pathname === "/projects/stop") {
+            const b = body;
+            if (!b?.projectRoot) {
+                return { status: 400, body: { ok: false, error: "projectRoot is required" } };
+            }
+            const project = this.stopProject(b.projectRoot);
+            return { status: 200, body: { ok: true, project } };
+        }
+        const proxyMatch = pathname.match(/^\/proxy\/([^/]+)\/(\d+)(\/.*)/);
+        if (proxyMatch) {
+            const [, host, portStr, subPath] = proxyMatch;
+            if (!PROXY_ALLOWED_HOSTS.has(host)) {
+                return { status: 403, body: { ok: false, error: "proxy host not allowed" } };
+            }
+            try {
+                const { status, json } = await requestJson(`http://${host}:${portStr}${subPath}${routeUrl.search}`, {
+                    method,
+                    headers,
+                    body: body !== undefined ? body : undefined,
+                    timeoutMs: PROXY_TIMEOUT_MS,
+                });
+                return { status, body: json };
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Proxy error";
+                const status = /timed? out|timeout/i.test(message) ? 504 : 502;
+                return { status, body: { ok: false, error: message } };
             }
-            const project = this.stopProject(body.projectRoot);
-            send(res, 200, { ok: true, project });
+        }
+        return { status: 404, body: { ok: false, error: "not found" } };
+    }
+    async handle(req, res) {
+        // No auth on the HTTP server: the daemon binds to 127.0.0.1, and remote
+        // app requests come in over the relay (which performs Clerk/HS256 verify
+        // before forwarding) and call routeRequest() directly in-process. Local
+        // CLI is trusted with the daemon's user.
+        if (!setCorsHeaders(req, res)) {
+            rejectCors(res);
+            return;
+        }
+        if (req.method === "OPTIONS") {
+            res.statusCode = 204;
+            res.end();
             return;
         }
-        send(res, 404, { ok: false, error: "not found" });
+        const url = new URL(req.url ?? "/", getDaemonBaseUrl());
+        const body = req.method === "POST" ? await readJson(req) : undefined;
+        const result = await this.routeRequest(req.method ?? "GET", `${url.pathname}${url.search}`, body);
+        send(res, result.status, result.body);
     }
 }
 //# sourceMappingURL=daemon.js.map