alink-cli 0.8.6 → 0.8.8

package/dist/bin.mjs

@@ -51996,12 +51996,20 @@ const makeWsRpcLayer = (currentSession) => WsRpcGroup.toLayer(gen(function* () {
 		return startup.enqueueCommand(dispatchEffect).pipe(mapError((cause) => toDispatchCommandError(cause, "Failed to dispatch orchestration command")));
 	};
 	const loadServerConfig = gen(function* () {
+		console.error("[DEBUG-provider-checking-20260820] getConfig start");
 		const keybindingsConfig = yield* keybindings.loadConfigState;
+		console.error("[DEBUG-provider-checking-20260820] getConfig keybindings");
 		const providers = yield* providerRegistry.getProviders;
+		console.error("[DEBUG-provider-checking-20260820] getConfig providers");
 		const settings = redactServerSettingsForClient(yield* serverSettings.getSettings);
+		console.error("[DEBUG-provider-checking-20260820] getConfig settings");
+		const environment = yield* serverEnvironment.getDescriptor;
+		console.error("[DEBUG-provider-checking-20260820] getConfig environment");
+		const auth = yield* serverAuth.getDescriptor();
+		console.error("[DEBUG-provider-checking-20260820] getConfig auth");
 		return {
-			environment: yield* serverEnvironment.getDescriptor,
-			auth: yield* serverAuth.getDescriptor(),
+			environment,
+			auth,
 			cwd: config.cwd,
 			keybindingsConfigPath: config.keybindingsConfigPath,
 			keybindings: keybindingsConfig.keybindings,
@@ -52350,6 +52358,37 @@ function isEnvelope(value) {
 //#endregion
 //#region src/tunnel/bridge.ts
 const TUNNEL_SCOPES = [AuthOrchestrationReadScope, AuthOrchestrationOperateScope];
+function machineIdFromToken(token) {
+	const parts = token.split(".");
+	if (parts.length !== 3 || parts[0] !== "al1" || !parts[1]) return null;
+	try {
+		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+		return typeof payload.mid === "string" && payload.mid.length > 0 ? payload.mid : null;
+	} catch {
+		return null;
+	}
+}
+function hubHttpUrl(hub) {
+	const url = new URL(hub);
+	url.protocol = url.protocol === "wss:" ? "https:" : "http:";
+	url.pathname = "";
+	url.search = "";
+	url.hash = "";
+	return url.toString().replace(/\/$/, "");
+}
+const uploadHubEnckey = (config) => gen(function* () {
+	const machineId = machineIdFromToken(config.machineToken);
+	if (!machineId) return yield* fail(/* @__PURE__ */ new Error("machine id is missing from the machine token"));
+	const httpClient = yield* HttpClient;
+	const request = yield* post$1(`${hubHttpUrl(config.hubUrl)}/api/machines/${encodeURIComponent(machineId)}/enckey`).pipe(setHeaders({
+		authorization: `Bearer ${config.machineToken}`,
+		"content-type": "application/json",
+		"x-requested-with": "agentlink"
+	}), bodyJson({ enckey: config.enckey }));
+	yield* filterStatusOk(yield* httpClient.execute(request));
+	return machineId;
+});
+const hubFrameDecoder = new TextDecoder();
 const ResponseDefectEncoded = (cause) => ({
 	_tag: "Defect",
 	defect: cause instanceof Error ? {
@@ -52386,17 +52425,30 @@ const makeTunnelSocketProtocol = gen(function* () {
 		};
 		clients.set(id, { write });
 		clientIds.add(id);
+		console.error("[DEBUG-provider-checking-20260820] rpc socket ready", { clientId: id });
 		yield* socket.runRaw((data) => {
 			try {
+				console.error("[DEBUG-provider-checking-20260820] rpc input", { byteLength: typeof data === "string" ? data.length : data.byteLength });
 				const decoded = parser.decode(data);
+				console.error("[DEBUG-provider-checking-20260820] rpc decoded", {
+					count: decoded.length,
+					messages: decoded.map((item) => typeof item === "object" && item !== null ? {
+						tag: "tag" in item ? String(item.tag) : void 0,
+						id: "id" in item ? String(item.id) : void 0
+					} : { type: typeof item })
+				});
 				if (decoded.length === 0) return void_$1;
 				let i = 0;
 				return whileLoop({
 					while: () => i < decoded.length,
-					body: () => writeRequest(id, decoded[i++]),
+					body: () => {
+						console.error("[DEBUG-provider-checking-20260820] rpc dispatch", { clientId: id });
+						return writeRequest(id, decoded[i++]);
+					},
 					step: () => void 0
 				});
 			} catch (cause) {
+				console.error("[DEBUG-provider-checking-20260820] rpc decode error", { message: cause instanceof Error ? cause.message : String(cause) });
 				if (isTagged(cause, "MaxBufferSizeExceeded")) return orDie(writeRaw(new CloseEvent(1009, String(cause))));
 				const defect = parser.encode(ResponseDefectEncoded(cause));
 				return defect === void 0 ? void_$1 : orDie(writeRaw(defect));
@@ -52433,6 +52485,12 @@ const splitHubFrame = (text) => {
 		rest: text.slice(spaceAt + 1)
 	};
 };
+function isHttpTunnelRequestFrame(value) {
+	return typeof value === "object" && value !== null && value._tag === "HttpRequest" && typeof value.id === "string" && typeof value.method === "string" && typeof value.path === "string" && Array.isArray(value.headers) && (value.body === null || typeof value.body === "string");
+}
+function encodeHttpTunnelResponseFrame(frame) {
+	return JSON.stringify(frame);
+}
 const makeTunnelSocket = (input) => {
 	const runRaw = (handler, options) => scopedWith((scope) => gen(function* () {
 		const fiberSet = yield* make$62().pipe(provide$2(scope));
@@ -52449,18 +52507,33 @@ const makeTunnelSocket = (input) => {
 	return make$63({
 		runRaw,
 		writer: sync(() => (chunk) => sync(() => {
-			if (typeof chunk === "string") input.sendEncrypted(JSON.stringify(utf8ToEnvelope(input.enckey, chunk)));
+			if (typeof chunk === "string") {
+				console.error("[DEBUG-provider-checking-20260820] rpc outbound", { byteLength: chunk.length });
+				input.sendEncrypted(JSON.stringify(utf8ToEnvelope(input.enckey, chunk)));
+			}
 		}))
 	});
 };
 const runHubTunnel = (config) => gen(function* () {
 	const serverAuth = yield* EnvironmentAuth;
 	const sessionsStore = yield* SessionStore;
+	const serverConfig = yield* ServerConfig;
+	const httpClient = yield* HttpClient;
 	yield* retry(gen(function* () {
 		yield* logInfo("hub tunnel: connection effect entered");
 		const url = `${config.hubUrl.replace(/\/+$/, "")}/daemon-tunnel?token=${encodeURIComponent(config.machineToken)}&v=1`;
 		yield* logInfo("hub tunnel: connecting", { hubUrl: config.hubUrl });
 		const socket = yield* makeWebSocket(url).pipe(provide$1(layerWebSocketConstructor));
+		const upload = gen(function* () {
+			const machineId = machineIdFromToken(config.machineToken);
+			if (!machineId) {
+				yield* logWarning$1("[daemon] enckey upload skipped: machine id missing from token");
+				return;
+			}
+			yield* logInfo(`[daemon] uploading enckey for machine ${machineId}...`);
+			yield* uploadHubEnckey(config);
+			yield* logInfo("[daemon] enckey uploaded to hub for cross-device recovery");
+		}).pipe(provideService(HttpClient, httpClient), catch_((error) => logError(`[daemon] enckey upload failed: ${String(error)}`)), asVoid);
 		yield* addFinalizer((exit) => logInfo("hub tunnel: connection scope closing", { exit: String(exit) }));
 		const tunnels = /* @__PURE__ */ new Map();
 		const dropTunnel = (tunnelId) => {
@@ -52478,7 +52551,7 @@ const runHubTunnel = (config) => gen(function* () {
 			const writeRaw = yield* socket.writer;
 			yield* forever(take$1(outbox).pipe(flatMap$1(writeRaw)));
 		}));
-		const attachTunnel = (tunnelId, live) => gen(function* () {
+		const attachRpcTunnel = (tunnelId, live) => gen(function* () {
 			yield* addFinalizer(() => sync(() => {
 				if (tunnels.get(tunnelId) !== live) return;
 				tunnels.delete(tunnelId);
@@ -52504,25 +52577,141 @@ const runHubTunnel = (config) => gen(function* () {
 				}
 			});
 			const { protocol, onSocket } = yield* makeTunnelSocketProtocol.pipe(provide$1(layerJson));
-			yield* make$13(WsRpcGroup, { disableTracing: true }).pipe(provideService(Protocol, protocol), provide$1(makeWsRpcLayer({
+			console.error("[DEBUG-provider-checking-20260820] rpc server starting");
+			yield* forkScoped(make$13(WsRpcGroup, { disableTracing: true }).pipe(provideService(Protocol, protocol), provide$1(makeWsRpcLayer({
 				sessionId: issued.sessionId,
 				subject: "hub-tunnel",
 				method: "bearer-access-token",
 				scopes: [...TUNNEL_SCOPES]
-			}).pipe(provide(layer$8))), forkScoped);
+			}).pipe(provideMerge(layerJson), provide(layer$8))), tapCause((cause) => logError("hub tunnel: RPC server failed", { cause: String(cause) }))));
+			console.error("[DEBUG-provider-checking-20260820] rpc server started");
 			yield* forkScoped(onSocket(socketAdapter));
 			if (!writeHub(JSON.stringify({
 				type: "tunnel_open",
 				tunnelId
 			}))) dropTunnel(tunnelId);
-			yield* logInfo("hub tunnel: attached", { tunnelId });
+			yield* logInfo("hub tunnel: attached", {
+				tunnelId,
+				purpose: live.purpose
+			});
 			yield* _await(live.closed);
 		}).pipe(catch_((error) => logWarning$1("hub tunnel: attach failed", {
 			tunnelId,
 			error
 		})));
-		yield* socket.runRaw((data) => {
-			if (typeof data !== "string") return;
+		const attachHttpTunnel = (tunnelId, live) => gen(function* () {
+			yield* addFinalizer(() => sync(() => {
+				if (tunnels.get(tunnelId) !== live) return;
+				tunnels.delete(tunnelId);
+				writeHub(JSON.stringify({
+					type: "tunnel_close",
+					tunnelId,
+					code: 1011,
+					reason: "daemon http tunnel ended"
+				}));
+			}));
+			const issued = yield* serverAuth.issueSession({
+				subject: "hub-tunnel-http",
+				label: "AgentLink hub tunnel HTTP proxy",
+				scopes: [...TUNNEL_SCOPES]
+			});
+			yield* addFinalizer(() => sessionsStore.markDisconnected(issued.sessionId).pipe(andThen(serverAuth.revokeSession(issued.sessionId)), ignore$1));
+			yield* sessionsStore.markConnected(issued.sessionId);
+			const localBaseUrl = `http://127.0.0.1:${serverConfig.port}`;
+			const sendEncrypted = (frame) => {
+				try {
+					const envelope = utf8ToEnvelope(config.enckey, encodeHttpTunnelResponseFrame(frame));
+					if (!writeHub(`${tunnelId} ${JSON.stringify(envelope)}`)) dropTunnel(tunnelId);
+				} catch {
+					dropTunnel(tunnelId);
+				}
+			};
+			live.onDecryptedFrame = (frame) => {
+				let requestFrame;
+				try {
+					const parsed = JSON.parse(frame);
+					if (!isHttpTunnelRequestFrame(parsed)) {
+						sendEncrypted({
+							_tag: "HttpResponse",
+							id: typeof parsed?.id === "string" ? parsed.id : "unknown",
+							status: 400,
+							statusText: "Bad Request",
+							headers: [["content-type", "text/plain"]],
+							body: Buffer.from("Invalid HTTP tunnel request frame").toString("base64")
+						});
+						return;
+					}
+					requestFrame = parsed;
+				} catch {
+					sendEncrypted({
+						_tag: "HttpResponse",
+						id: "unknown",
+						status: 400,
+						statusText: "Bad Request",
+						headers: [["content-type", "text/plain"]],
+						body: Buffer.from("Malformed HTTP tunnel request frame").toString("base64")
+					});
+					return;
+				}
+				runFork(gen(function* () {
+					const targetUrl = `${localBaseUrl}${requestFrame.path}`;
+					const headers = { authorization: `Bearer ${issued.token}` };
+					for (const [key, value] of requestFrame.headers) {
+						const lower = key.toLowerCase();
+						if (lower === "authorization" || lower === "cookie") continue;
+						headers[lower] = value;
+					}
+					let request = make$61(requestFrame.method)(targetUrl).pipe(setHeaders(headers));
+					if (requestFrame.body !== null) request = setBody(uint8Array(Buffer.from(requestFrame.body, "base64")))(request);
+					const response = yield* httpClient.execute(request);
+					const responseBody = yield* response.arrayBuffer;
+					const responseHeaders = [];
+					for (const [key, value] of Object.entries(response.headers)) if (typeof value === "string") responseHeaders.push([key, value]);
+					return {
+						_tag: "HttpResponse",
+						id: requestFrame.id,
+						status: response.status,
+						statusText: "",
+						headers: responseHeaders,
+						body: Buffer.from(responseBody).toString("base64")
+					};
+				}).pipe(match$2({
+					onFailure: (cause) => ({
+						_tag: "HttpResponse",
+						id: requestFrame.id,
+						status: 502,
+						statusText: "Bad Gateway",
+						headers: [["content-type", "text/plain"]],
+						body: Buffer.from(cause instanceof Error ? cause.message : String(cause)).toString("base64")
+					}),
+					onSuccess: (response) => response
+				}), tap((frame) => sync(() => sendEncrypted(frame)))));
+			};
+			if (!writeHub(JSON.stringify({
+				type: "tunnel_open",
+				tunnelId
+			}))) dropTunnel(tunnelId);
+			yield* logInfo("hub tunnel: attached", {
+				tunnelId,
+				purpose: live.purpose
+			});
+			yield* _await(live.closed);
+		}).pipe(provideService(HttpClient, httpClient), catch_((error) => logWarning$1("hub tunnel: attach failed", {
+			tunnelId,
+			error
+		})));
+		let debugProviderCheckingFrameCount = 0;
+		yield* socket.runRaw((rawData) => {
+			if (debugProviderCheckingFrameCount < 20) {
+				debugProviderCheckingFrameCount += 1;
+				console.error("[DEBUG-provider-checking-20260820] hub frame", {
+					count: debugProviderCheckingFrameCount,
+					type: typeof rawData,
+					byteLength: typeof rawData === "string" ? rawData.length : rawData instanceof Uint8Array ? rawData.byteLength : -1
+				});
+			}
+			const data = typeof rawData === "string" ? rawData : rawData instanceof Uint8Array ? hubFrameDecoder.decode(rawData) : null;
+			if (data === null) return;
 			if (data.startsWith("{")) {
 				let control;
 				try {
@@ -52534,13 +52723,17 @@ const runHubTunnel = (config) => gen(function* () {
 					const tunnelId = control.tunnelId;
 					if (tunnels.has(tunnelId)) return;
 					return gen(function* () {
+						const closed = yield* make$70();
+						const purpose = control.purpose === "http" ? "http" : "rpc";
 						const live = {
-							closed: yield* make$70(),
+							closed,
 							pendingFrames: [],
+							purpose,
 							onDecryptedFrame: null
 						};
 						tunnels.set(tunnelId, live);
-						yield* forkScoped(scoped(attachTunnel(tunnelId, live)));
+						if (purpose === "http") runFork(scoped(attachHttpTunnel(tunnelId, live)));
+						else runFork(scoped(attachRpcTunnel(tunnelId, live)));
 					});
 				}
 				if (control.type === "tunnel_close" && typeof control.tunnelId === "string") dropTunnel(control.tunnelId);
@@ -52563,12 +52756,17 @@ const runHubTunnel = (config) => gen(function* () {
 				} catch {
 					return dropTunnel(framed.tunnelId);
 				}
+				console.error("[DEBUG-provider-checking-20260820] frame decrypted", {
+					tunnelId: framed.tunnelId,
+					byteLength: frame.length,
+					delivery: live.onDecryptedFrame ? "deliver" : "pending"
+				});
 				if (live.onDecryptedFrame) live.onDecryptedFrame(frame);
 				else if (live.pendingFrames.length < 16) live.pendingFrames.push(frame);
 				else dropTunnel(framed.tunnelId);
 				return;
 			}
-		}, { onOpen: logInfo("hub tunnel: connected to hub") }).pipe(tapDefect((cause) => logWarning$1("hub tunnel: hub socket defect", { cause: String(cause) })));
+		}, { onOpen: logInfo("hub tunnel: connected to hub").pipe(tap(() => sync(() => void runFork(upload)))) }).pipe(tapDefect((cause) => logWarning$1("hub tunnel: hub socket defect", { cause: String(cause) })));
 		yield* logWarning$1("hub tunnel: hub connection closed");
 	}).pipe(scoped, tapError((error) => logWarning$1("hub tunnel: connection error", { error }))), {
 		schedule: spaced("2 seconds"),