auvrynt 1.0.2 → 1.0.5

package/dist/tunnels/ngrok-tunnel.js

@@ -0,0 +1,220 @@
+import { closeSync, existsSync, openSync } from "node:fs";
+import { mkdtemp, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { execFileSync, spawn } from "node:child_process";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { isProcessRunning } from "../background-lifecycle.js";
+import { findCommand, isGeneratedNgrokUrl, normalizeNgrokUrl } from "./tunnel-utils.js";
+const MAX_STARTUP_OUTPUT_BYTES = 1024 * 1024;
+const MAX_NGROK_DOWNLOAD_BYTES = 64 * 1024 * 1024;
+const NGROK_DOWNLOAD_ORIGIN = "https://bin.equinox.io";
+export function ngrokWindowsDownloadUrl(architecture = process.arch) {
+    const artifact = architecture === "arm64"
+        ? "ngrok-v3-stable-windows-arm64.zip"
+        : architecture === "ia32"
+            ? "ngrok-v3-stable-windows-386.zip"
+            : "ngrok-v3-stable-windows-amd64.zip";
+    return `${NGROK_DOWNLOAD_ORIGIN}/c/bNyj1mQVY4c/${artifact}`;
+}
+export function buildNgrokArgs(port, url) {
+    const args = ["http", String(port), "--log=stdout", "--log-format=json"];
+    const normalizedUrl = normalizeNgrokUrl(url);
+    if (normalizedUrl)
+        args.push("--url", normalizedUrl);
+    return args;
+}
+export function extractNgrokPublicUrl(output, expectedUrl) {
+    const expected = normalizeNgrokUrl(expectedUrl);
+    const candidates = output.match(/https:\/\/[^\s"'\\]+/g) ?? [];
+    for (const raw of candidates) {
+        const cleaned = raw.replace(/[),.;]+$/, "");
+        try {
+            const normalized = normalizeNgrokUrl(cleaned);
+            if (!normalized)
+                continue;
+            if (expected ? normalized === expected : isGeneratedNgrokUrl(normalized))
+                return normalized;
+        }
+        catch {
+            // Startup logs can include unrelated URLs; only valid endpoint origins count.
+        }
+    }
+    return undefined;
+}
+async function resolveNgrokExecutable() {
+    const found = findCommand("ngrok");
+    if (found)
+        return found;
+    if (process.platform === "win32") {
+        const storeExecutable = findWindowsStoreNgrok();
+        if (storeExecutable)
+            return storeExecutable;
+        const managedExecutable = join(homedir(), ".auvrynt", "bin", "ngrok.exe");
+        if (existsSync(managedExecutable) && verifyWindowsExecutable(managedExecutable)) {
+            return managedExecutable;
+        }
+        return installWindowsNgrok();
+    }
+    throw new Error("ngrok is required for AUVRYNT_TUNNEL_PROVIDER=ngrok. Install it from https://ngrok.com/download, ensure `ngrok` is on PATH, "
+        + "and either run `ngrok config add-authtoken <token>` or set AUVRYNT_NGROK_AUTHTOKEN.");
+}
+function findWindowsStoreNgrok() {
+    try {
+        const installLocation = execFileSync("powershell.exe", [
+            "-NoProfile",
+            "-NonInteractive",
+            "-Command",
+            "Get-AppxPackage -Name 'ngrok.ngrok' | Select-Object -First 1 -ExpandProperty InstallLocation",
+        ], { encoding: "utf8", windowsHide: true }).trim();
+        if (!installLocation)
+            return undefined;
+        const executable = join(installLocation, "ngrok.exe");
+        return existsSync(executable) ? executable : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function installWindowsNgrok() {
+    const targetDir = join(homedir(), ".auvrynt", "bin");
+    const executable = join(targetDir, "ngrok.exe");
+    const downloadUrl = ngrokWindowsDownloadUrl();
+    const tempRoot = await mkdtemp(join(tmpdir(), "auvrynt-ngrok-"));
+    const archive = join(tempRoot, "ngrok.zip");
+    const extractedDir = join(tempRoot, "extracted");
+    try {
+        console.log("ngrok is not installed; downloading and verifying the official Windows build...");
+        const response = await fetch(downloadUrl, { signal: AbortSignal.timeout(120_000) });
+        if (!response.ok)
+            throw new Error(`Could not download ngrok (HTTP ${response.status}).`);
+        const length = Number(response.headers.get("content-length"));
+        if (Number.isFinite(length) && (length <= 0 || length > MAX_NGROK_DOWNLOAD_BYTES)) {
+            throw new Error("ngrok download size is invalid or exceeds the 64 MB safety limit.");
+        }
+        const bytes = Buffer.from(await response.arrayBuffer());
+        if (bytes.byteLength < 4 || bytes.byteLength > MAX_NGROK_DOWNLOAD_BYTES || bytes.subarray(0, 2).toString("ascii") !== "PK") {
+            throw new Error("ngrok download is not a valid ZIP archive.");
+        }
+        await writeFile(archive, bytes, { mode: 0o600 });
+        await mkdir(extractedDir, { recursive: true });
+        extractNgrokArchive(archive, extractedDir);
+        const extractedExecutable = join(extractedDir, "ngrok.exe");
+        if (!existsSync(extractedExecutable) || !verifyWindowsExecutable(extractedExecutable)) {
+            throw new Error("ngrok signature verification failed; the download was not installed.");
+        }
+        runWindowsDefenderScan(extractedExecutable);
+        await mkdir(targetDir, { recursive: true });
+        await rm(executable, { force: true });
+        await rename(extractedExecutable, executable);
+        execFileSync(executable, ["version"], { stdio: "ignore", windowsHide: true });
+        return executable;
+    }
+    finally {
+        await rm(tempRoot, { recursive: true, force: true });
+    }
+}
+function extractNgrokArchive(archive, destination) {
+    const entries = execFileSync("tar.exe", ["-tf", archive], { encoding: "utf8", windowsHide: true });
+    const normalized = entries.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean);
+    if (!normalized.includes("ngrok.exe") || normalized.some((entry) => entry.includes("..") || entry.startsWith("/") || entry.startsWith("\\"))) {
+        throw new Error("ngrok archive contains an unexpected file layout.");
+    }
+    execFileSync("tar.exe", ["-xf", archive, "-C", destination], { windowsHide: true });
+}
+function verifyWindowsExecutable(executable) {
+    try {
+        const quotedPath = executable.replaceAll("'", "''");
+        const status = execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `(Get-AuthenticodeSignature -LiteralPath '${quotedPath}').Status`], { encoding: "utf8", windowsHide: true }).trim();
+        return status === "Valid";
+    }
+    catch {
+        return false;
+    }
+}
+function runWindowsDefenderScan(executable) {
+    const quotedPath = executable.replaceAll("'", "''");
+    try {
+        const available = execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", "[bool](Get-Command Start-MpScan -ErrorAction SilentlyContinue)"], { encoding: "utf8", windowsHide: true }).trim();
+        if (available.toLowerCase() === "true") {
+            execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Start-MpScan -ScanType CustomScan -ScanPath '${quotedPath}' -ErrorAction Stop`], { windowsHide: true });
+        }
+    }
+    catch (error) {
+        throw new Error(`Microsoft Defender scan failed; ngrok was not installed. ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+async function waitForNgrokUrl(child, readOutput, spawnError, expectedUrl, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const error = spawnError();
+        if (error)
+            throw new Error(`ngrok tunnel failed to start: ${error.message}`);
+        if (!child.pid || !isProcessRunning(child.pid))
+            throw new Error("ngrok tunnel exited before connecting.");
+        const output = await readOutput();
+        if (Buffer.byteLength(output, "utf8") > MAX_STARTUP_OUTPUT_BYTES) {
+            throw new Error("ngrok startup output exceeded 1 MB before providing a public URL.");
+        }
+        const url = extractNgrokPublicUrl(output, expectedUrl);
+        if (url)
+            return url;
+        await new Promise((resolveDelay) => setTimeout(resolveDelay, 100));
+    }
+    throw new Error(`ngrok tunnel did not provide a public URL within ${Math.round(timeoutMs / 1000)} seconds.`);
+}
+export async function startNgrokTunnel(port, options = {}) {
+    const executable = options.executable ?? await resolveNgrokExecutable();
+    const expectedUrl = normalizeNgrokUrl(options.url);
+    const spawnEnv = { ...process.env, ...(options.authtoken ? { NGROK_AUTHTOKEN: options.authtoken } : {}) };
+    const args = [...(options.executableArgsPrefix ?? []), ...buildNgrokArgs(port, expectedUrl)];
+    const timeoutMs = options.timeoutMs ?? (options.detached ? 90_000 : 30_000);
+    if (options.detached && options.logPath) {
+        await writeFile(options.logPath, "", { mode: 0o600 });
+        const logHandle = openSync(options.logPath, "a");
+        const child = spawn(executable, args, {
+            stdio: ["ignore", logHandle, logHandle],
+            windowsHide: true,
+            detached: true,
+            env: spawnEnv,
+        });
+        closeSync(logHandle);
+        let spawnError;
+        child.once("error", (error) => { spawnError = error; });
+        try {
+            const url = await waitForNgrokUrl(child, () => readFile(options.logPath, "utf8").catch(() => ""), () => spawnError, expectedUrl, timeoutMs);
+            child.unref();
+            return { process: child, url };
+        }
+        catch (error) {
+            child.kill();
+            throw error;
+        }
+    }
+    const child = spawn(executable, args, {
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        detached: options.detached,
+        env: spawnEnv,
+    });
+    let spawnError;
+    let output = "";
+    child.once("error", (error) => { spawnError = error; });
+    const append = (chunk) => {
+        if (Buffer.byteLength(output, "utf8") <= MAX_STARTUP_OUTPUT_BYTES)
+            output += chunk.toString();
+    };
+    child.stdout?.on("data", append);
+    child.stderr?.on("data", append);
+    try {
+        const url = await waitForNgrokUrl(child, async () => output, () => spawnError, expectedUrl, timeoutMs);
+        return { process: child, url };
+    }
+    catch (error) {
+        child.kill();
+        throw error;
+    }
+    finally {
+        child.stdout?.off("data", append);
+        child.stderr?.off("data", append);
+    }
+}

package/dist/tunnels/tunnel-manager.js

@@ -0,0 +1,186 @@
+import { execFileSync } from "node:child_process";
+import { unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { atomicWriteJson, getProcessIdentity, isProcessRunning, processIdentityMatches, readJsonFile, } from "../background-lifecycle.js";
+import { startCloudflareTunnel } from "./cloudflare-tunnel.js";
+import { startNgrokTunnel } from "./ngrok-tunnel.js";
+import { tunnelExecutableNamePattern, tunnelProviderLabel, tunnelUrlMatchesProvider, } from "./tunnel-utils.js";
+export { tunnelExecutableNamePattern, tunnelProviderLabel, tunnelUrlMatchesProvider } from "./tunnel-utils.js";
+export function managedTunnelPath(stateDir) {
+    return join(stateDir, "tunnel.json");
+}
+export async function startTunnel(provider, port, options = {}) {
+    if (provider === "custom" && !options.cloudflareTunnelToken) {
+        throw new Error("Custom external URLs are managed outside Auvrynt. Configure a Cloudflare tunnel token to manage it with Auvrynt.");
+    }
+    if (provider === "ngrok") {
+        return startNgrokTunnel(port, {
+            detached: options.detached,
+            logPath: options.logPath,
+            authtoken: options.ngrokAuthtoken,
+            url: options.ngrokUrl,
+        });
+    }
+    return startCloudflareTunnel(port, {
+        detached: options.detached,
+        logPath: options.logPath,
+        cloudflareTunnelToken: options.cloudflareTunnelToken,
+        publicUrl: options.publicUrl,
+    });
+}
+export async function readManagedTunnel(options) {
+    const tunnelPath = managedTunnelPath(options.stateDir);
+    const record = await readJsonFile(tunnelPath);
+    if (!record || !Number.isInteger(record.pid) || record.pid < 1)
+        return undefined;
+    const recordProvider = record.provider ?? "cloudflare";
+    const matchesConfiguration = record.port === options.port
+        && recordProvider === options.provider
+        && tunnelUrlMatchesProvider(record.url, options.provider, options.ngrokUrl);
+    if (!matchesConfiguration)
+        return undefined;
+    if (processIdentityMatches(record.pid, record))
+        return record;
+    if (!record.processPath || !record.processStartedAt) {
+        const identity = getProcessIdentity(record.pid);
+        if (identity && tunnelExecutableNamePattern(options.provider).test(identity.processPath)) {
+            const migrated = { ...record, ...identity, provider: options.provider };
+            await atomicWriteJson(tunnelPath, migrated);
+            return migrated;
+        }
+    }
+    await unlink(tunnelPath).catch(() => undefined);
+    return undefined;
+}
+export async function ensureManagedTunnel(options) {
+    if (options.provider === "custom" && !options.cloudflareTunnelToken) {
+        throw new Error("A Cloudflare tunnel token is required to manage a custom domain from Auvrynt.");
+    }
+    const existing = await readManagedTunnel(options);
+    if (existing) {
+        cleanupOrphanedTunnelProcesses(options, existing.pid);
+        return { record: existing, created: false };
+    }
+    await stopManagedTunnel(options);
+    const logFileName = options.provider === "ngrok" ? "ngrok.log" : "cloudflared.log";
+    const tunnel = await startTunnel(options.provider, options.port, {
+        detached: true,
+        logPath: join(options.stateDir, logFileName),
+        ngrokAuthtoken: options.ngrokAuthtoken,
+        ngrokUrl: options.ngrokUrl,
+        cloudflareTunnelToken: options.cloudflareTunnelToken,
+        publicUrl: options.publicUrl,
+    });
+    if (!tunnel.process.pid)
+        throw new Error(`${tunnelProviderLabel(options.provider)} tunnel started without a process ID.`);
+    const identity = getProcessIdentity(tunnel.process.pid);
+    if (!identity) {
+        tunnel.process.kill();
+        throw new Error(`Could not verify the ${tunnelProviderLabel(options.provider)} tunnel process.`);
+    }
+    const record = {
+        pid: tunnel.process.pid,
+        url: tunnel.url,
+        port: options.port,
+        provider: options.provider,
+        ...identity,
+    };
+    await atomicWriteJson(managedTunnelPath(options.stateDir), record);
+    return { record, created: true };
+}
+export async function stopManagedTunnel(options) {
+    const tunnelPath = managedTunnelPath(options.stateDir);
+    const tunnel = await readJsonFile(tunnelPath);
+    let stopped = false;
+    if (tunnel && Number.isInteger(tunnel.pid) && tunnel.pid > 0) {
+        const provider = tunnel.provider ?? "cloudflare";
+        if (processIdentityMatches(tunnel.pid, tunnel)) {
+            stopTunnelProcess(tunnel.pid, provider);
+            stopped = true;
+        }
+    }
+    await unlink(tunnelPath).catch(() => undefined);
+    return cleanupOrphanedTunnelProcesses(options) > 0 || stopped;
+}
+export function tunnelCommandMatches(provider, port, commandLine) {
+    const escapedPort = String(port).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (provider === "custom")
+        return false;
+    if (provider === "ngrok") {
+        return new RegExp(`ngrok(?:\\.exe)?["']?\\s+http\\s+${escapedPort}(?:\\s|$)`, "i").test(commandLine);
+    }
+    return /cloudflared(?:\.exe)?["']?\s+tunnel(?:\s|$)/i.test(commandLine)
+        && new RegExp(`--url(?:=|\\s+)https?://(?:127\\.0\\.0\\.1|localhost):${escapedPort}(?:\\s|$)`, "i").test(commandLine);
+}
+function cleanupOrphanedTunnelProcesses(options, keepPid) {
+    let stopped = 0;
+    for (const candidate of listTunnelProcessCandidates(options.provider)) {
+        if (candidate.pid === keepPid || !tunnelCommandMatches(options.provider, options.port, candidate.commandLine)) {
+            continue;
+        }
+        const identity = getProcessIdentity(candidate.pid);
+        if (!identity || !tunnelExecutableNamePattern(options.provider).test(identity.processPath))
+            continue;
+        stopTunnelProcess(candidate.pid, options.provider);
+        stopped++;
+    }
+    return stopped;
+}
+function listTunnelProcessCandidates(provider) {
+    if (provider === "custom")
+        return [];
+    try {
+        if (process.platform === "win32") {
+            const executable = provider === "ngrok" ? "ngrok.exe" : "cloudflared.exe";
+            const script = [
+                `$items = @(Get-CimInstance Win32_Process -Filter \"Name = '${executable}'\" -ErrorAction Stop`,
+                "| ForEach-Object { [pscustomobject]@{ pid = $_.ProcessId; commandLine = [string]$_.CommandLine } })",
+                "$items | ConvertTo-Json -Compress",
+            ].join(" ; ").replace(/ ; \|/g, " |");
+            const raw = execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+                windowsHide: true,
+            }).trim();
+            if (!raw)
+                return [];
+            const parsed = JSON.parse(raw);
+            const values = Array.isArray(parsed) ? parsed : [parsed];
+            return values.flatMap((value) => {
+                if (!value || typeof value !== "object")
+                    return [];
+                const item = value;
+                return Number.isInteger(item.pid) && typeof item.commandLine === "string"
+                    ? [{ pid: item.pid, commandLine: item.commandLine }]
+                    : [];
+            });
+        }
+        const raw = execFileSync("ps", ["-eo", "pid=,args="], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true,
+        });
+        return raw.split(/\r?\n/).flatMap((line) => {
+            const match = line.trim().match(/^(\d+)\s+(.+)$/);
+            return match ? [{ pid: Number(match[1]), commandLine: match[2] }] : [];
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function stopTunnelProcess(pid, provider) {
+    try {
+        if (process.platform === "win32") {
+            execFileSync("taskkill.exe", ["/PID", String(pid), "/F"], { stdio: "ignore", windowsHide: true });
+        }
+        else {
+            process.kill(pid, "SIGTERM");
+        }
+    }
+    catch {
+        if (isProcessRunning(pid)) {
+            throw new Error(`Could not stop ${tunnelProviderLabel(provider)} tunnel process ${pid}.`);
+        }
+    }
+}

package/dist/tunnels/tunnel-types.js

@@ -0,0 +1 @@
+export {};

package/dist/tunnels/tunnel-utils.js

@@ -0,0 +1,62 @@
+import { execFileSync } from "node:child_process";
+const GENERATED_NGROK_HOST = /(^|\.)ngrok(?:-free)?\.(?:app|dev|io)$/i;
+export function findCommand(command) {
+    try {
+        return execFileSync(process.platform === "win32" ? "where.exe" : "which", [command], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"], windowsHide: true }).split(/\r?\n/)[0]?.trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function tunnelProviderLabel(provider) {
+    if (provider === "ngrok")
+        return "ngrok";
+    if (provider === "custom")
+        return "Custom external URL";
+    return "Cloudflare";
+}
+export function normalizeNgrokUrl(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = new URL(trimmed.includes("://") ? trimmed : `https://${trimmed}`);
+    if (parsed.protocol !== "https:")
+        throw new Error("ngrok URL must use HTTPS.");
+    if (parsed.username || parsed.password)
+        throw new Error("ngrok URL must not contain credentials.");
+    if (parsed.port)
+        throw new Error("ngrok URL must not contain a custom port.");
+    if ((parsed.pathname && parsed.pathname !== "/") || parsed.search || parsed.hash) {
+        throw new Error("ngrok URL must be an origin without a path, query, or fragment.");
+    }
+    return parsed.origin;
+}
+export function isGeneratedNgrokUrl(value) {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "https:" && !parsed.username && !parsed.password
+            && !parsed.port && (parsed.pathname === "/" || parsed.pathname === "")
+            && !parsed.search && !parsed.hash && GENERATED_NGROK_HOST.test(parsed.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function tunnelUrlMatchesProvider(url, provider, expectedNgrokUrl) {
+    if (provider === "ngrok") {
+        const expected = normalizeNgrokUrl(expectedNgrokUrl);
+        if (expected)
+            return url === expected;
+        return isGeneratedNgrokUrl(url);
+    }
+    if (provider === "custom")
+        return /^https:\/\//i.test(url);
+    return /^https:\/\/[a-zA-Z0-9-]+\.trycloudflare\.com$/.test(url);
+}
+export function tunnelExecutableNamePattern(provider) {
+    if (provider === "ngrok")
+        return /(^|[\\/])ngrok(?:\.exe)?$/i;
+    if (provider === "custom")
+        return /$a/;
+    return /(^|[\\/])cloudflared(?:\.exe)?$/i;
+}