bdy 1.23.6-dev → 1.23.7-dev

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.23.6-dev",
+  "version": "1.23.7-dev",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",
@@ -10,7 +10,7 @@
   },
   "scripts": {
     "lint": "eslint \"*/**\"",
-    "lint:types": "tsc --skipLibCheck --noEmit --project tsconfig.json",
+    "lint:types": "tsc --skipLibCheck --noEmit --project tsconfig.json && tsc --skipLibCheck --project test/tsconfig.json && tsc --skipLibCheck --project e2e/tsconfig.json",
     "watch": "tsc --watch --project tsconfig.json & tsc --watch --project src/visualTest/utils/tsconfig.json",
     "buildTs": "(tsc --project tsconfig.json & tsc --project src/visualTest/utils/tsconfig.json & wait) && cp package.json distTs/package.json && curl -fsSL https://raw.githubusercontent.com/buddy/cli/main/README.md -o README.md",
     "e2e": "npm run buildTs && vitest run --config e2e/vitest.config.ts",
@@ -38,6 +38,13 @@
   "engines": {
     "node": ">=24.14"
   },
+  "bundleDependencies": [
+    "ssh2",
+    "asn1",
+    "safer-buffer",
+    "bcrypt-pbkdf",
+    "tweetnacl"
+  ],
   "dependencies": {
     "@buddy-works/ci-info": "1.1.7",
     "@fastify/accept-negotiator": "2.0.1",
@@ -100,6 +107,7 @@
     "@types/mime-db": "1.43.6",
     "@types/mime-types": "3.0.1",
     "@types/netmask": "2.0.6",
+    "@types/node": "24.13.3",
     "@types/node-forge": "1.3.14",
     "@types/path-is-inside": "1.0.3",
     "@types/picomatch": "4.0.3",

package/distTs/src/agent/linux.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const system_1 = __importDefault(require("./system"));
+const node_fs_1 = require("node:fs");
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const logger_1 = __importDefault(require("../logger"));
@@ -39,12 +40,15 @@ class AgentLinux extends system_1.default {
     getSystemConfigPath() {
         return path_1.default.join(this.getSystemConfigDir(), 'agent.json');
     }
-    getSystemStandalonePath() {
-        return path_1.default.join(this.getSystemConfigDir(), 'pid.lock');
-    }
     getServicePath() {
         return '/etc/systemd/system/bdy.service';
     }
+    // The token goes on the command line, so /proc/<pid>/cmdline shows it to every local account.
+    // That is a known trade and `Environment=` is not the way out of it: systemd.exec(5) says
+    // environment variables are unsuitable for secrets because it re-exports them over D-Bus, so
+    // `systemctl show bdy` would hand the token to the same unprivileged users - and file modes
+    // cannot stop that. Closing this means the agent reading the token from a file only it can
+    // read, which is a change of where the token lives, not of this template.
     getServiceConfig(id, host, token, port, user, debug) {
         const cli = this.getSystemBinaryPath();
         return `[Unit]
@@ -62,6 +66,24 @@ RestartSec=3
 [Install]
 WantedBy=multi-user.target`;
     }
+    readServiceUser() {
+        let cfg;
+        try {
+            cfg = (0, node_fs_1.readFileSync)(this.getServicePath(), 'utf-8');
+        }
+        catch {
+            // No unit to read, so there is nothing to say about the user it names
+            return null;
+        }
+        // This cli always writes the key, with `root` when no user was given. Not finding it means
+        // the unit has been through something else - systemd allows spaces around the `=` that this
+        // does not - and guessing root there would take the directory off whoever it does name.
+        const m = cfg.match(/^User=(.*)$/m);
+        if (!m)
+            return null;
+        const user = m[1].trim();
+        return user === 'root' ? '' : user;
+    }
     async install(id, host, token, port, start, user, pass, debug) {
         try {
             // ensure service clear
@@ -71,6 +93,10 @@ WantedBy=multi-user.target`;
             // do nothing
         }
         try {
+            // Resolved before the download rather than after it: a `--user` this machine does not have
+            // is a failed install either way, and finding out here costs no binary
+            if (user)
+                await this.resolveUserIds(user);
             logger_1.default.info(texts_1.LOG_AGENT_SYSTEM_DIR);
             await this.ensureSystemConfigDir();
             logger_1.default.info(texts_1.LOG_AGENT_DOWNLOADING_ARCHIVE);
@@ -80,6 +106,11 @@ WantedBy=multi-user.target`;
             await this.fixBinaryRights();
             logger_1.default.info(texts_1.LOG_AGENT_SYSTEM_SERVICE_CONFIG);
             await this.saveFile(this.getServicePath(), this.getServiceConfig(id, host, token, port, user, debug));
+            // Everything above was written by this root process, so the service user does not own
+            // any of it yet and could not write its host key or its log. Ownership first, mode
+            // second - see chownSystemDir for why that order is the one that fails safely.
+            await this.chownSystemDir(user);
+            this.applySystemModes();
             logger_1.default.info(texts_1.LOG_AGENT_ENABLING_SYSTEM);
             if (start)
                 await this.start();
@@ -93,6 +124,10 @@ WantedBy=multi-user.target`;
     async changeUser(user) {
         try {
             const json = this.loadSystemConfig();
+            // Resolved before the service is touched: a name this machine does not have would
+            // otherwise leave it stopped, with a config naming a user that does not exist
+            if (user)
+                await this.resolveUserIds(user);
             logger_1.default.info(texts_1.LOG_AGENT_STOPPING_SYSTEM);
             try {
                 await this.stop();
@@ -101,6 +136,10 @@ WantedBy=multi-user.target`;
                 // do nothing
             }
             await this.saveFile(this.getServicePath(), this.getServiceConfig(json.id, json.host, json.token, json.port, user, json.debug));
+            // The directory follows the service to its new user, and back to root when the user is
+            // cleared - this is what makes changing the user later work without 0777 everywhere
+            await this.chownSystemDir(user);
+            this.applySystemModes();
             logger_1.default.info(texts_1.LOG_AGENT_STARTING_SYSTEM);
             await this.start();
         }
@@ -125,6 +164,17 @@ WantedBy=multi-user.target`;
             logger_1.default.info(texts_1.LOG_AGENT_EXTRACTING_ARCHIVE);
             await this.extractBinaryArchive();
             await this.fixBinaryRights();
+            // The service user is not passed in here, so it comes off the service config. Both steps
+            // are skipped when that cannot be read: tighter modes without the matching ownership are
+            // exactly what would lock a service user out of their own directory.
+            const svcUser = this.readServiceUser();
+            if (svcUser === null) {
+                logger_1.default.error((0, texts_1.LOG_AGENT_RIGHTS_SKIPPED)(this.getServicePath()));
+            }
+            else {
+                await this.chownSystemDir(svcUser);
+                this.applySystemModes();
+            }
             logger_1.default.info(texts_1.LOG_AGENT_STARTING_SYSTEM);
             await this.start();
         }

package/distTs/src/agent/manager.js

@@ -570,17 +570,14 @@ class AgentManagerClass {
             // do nothing
         }
         try {
+            // The host key went with clearSystemFiles above. Asking for it here by way of
+            // getNewAgentConfigDir would resolve against a config that is already gone, and land on
+            // the other install's.
             this.system.clearAgentFiles();
         }
         catch {
             // do nothing
         }
-        try {
-            this.system.clearNewAgentFiles();
-        }
-        catch {
-            // do nothing
-        }
         output_1.default.exitError(txt);
     }
     agentDisable() {

package/distTs/src/agent/osx.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const texts_1 = require("../texts");
 const logger_1 = __importDefault(require("../logger"));
+const node_fs_1 = require("node:fs");
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const system_1 = __importDefault(require("./system"));
@@ -32,12 +33,14 @@ class AgentOsx extends system_1.default {
     getSystemConfigPath() {
         return path_1.default.join(this.getSystemConfigDir(), 'agent.json');
     }
-    getSystemStandalonePath() {
-        return path_1.default.join(this.getSystemConfigDir(), 'pid.lock');
-    }
     getServicePath() {
         return '/Library/LaunchDaemons/bdy.plist';
     }
+    // The token goes into ProgramArguments, so `ps` shows it to every local account. That is a
+    // known trade, and moving it to EnvironmentVariables is not the way out: it would still sit in
+    // this plist, and the same move on systemd leaks the token through `systemctl show` whatever
+    // the file mode is - see the note in AgentLinux.getServiceConfig. Closing this means the agent
+    // reading the token from a file only it can read, which is a change of where the token lives.
     getServiceConfig(id, host, token, port, user, debug) {
         const cli = this.getSystemBinaryPath();
         let cfg = `<?xml version='1.0' encoding='UTF-8'?>
@@ -79,6 +82,23 @@ class AgentOsx extends system_1.default {
 </plist>`;
         return cfg;
     }
+    readServiceUser() {
+        let cfg;
+        try {
+            cfg = (0, node_fs_1.readFileSync)(this.getServicePath(), 'utf-8');
+        }
+        catch {
+            // No plist to read, so there is nothing to say about the user it names
+            return null;
+        }
+        // Only the xml plist this cli writes can be read this way. A binary one, or anything else
+        // that has been through another tool, is a file whose UserName we cannot see - and a
+        // missing UserName is only 'root' when we know we are looking at the whole thing.
+        if (!cfg.includes('<key>Label</key>'))
+            return null;
+        const m = cfg.match(/<key>UserName<\/key>\s*<string>([^<]+)<\/string>/);
+        return m ? m[1].trim() : '';
+    }
     async install(id, host, token, port, start, user, pass, debug) {
         try {
             // ensure service clear
@@ -88,6 +108,10 @@ class AgentOsx extends system_1.default {
             // do nothing
         }
         try {
+            // Resolved before the download rather than after it: a `--user` this machine does not have
+            // is a failed install either way, and finding out here costs no binary
+            if (user)
+                await this.resolveUserIds(user);
             logger_1.default.info(texts_1.LOG_AGENT_SYSTEM_DIR);
             await this.ensureSystemConfigDir();
             logger_1.default.info(texts_1.LOG_AGENT_DOWNLOADING_ARCHIVE);
@@ -97,6 +121,11 @@ class AgentOsx extends system_1.default {
             await this.fixBinaryRights();
             logger_1.default.info(texts_1.LOG_AGENT_SYSTEM_SERVICE_CONFIG);
             await this.saveFile(this.getServicePath(), this.getServiceConfig(id, host, token, port, user, debug));
+            // Everything above was written by this root process, so the service user does not own
+            // any of it yet and could not write its host key or its log. Ownership first, mode
+            // second - see chownSystemDir for why that order is the one that fails safely.
+            await this.chownSystemDir(user);
+            this.applySystemModes();
             logger_1.default.info(texts_1.LOG_AGENT_ENABLING_SYSTEM);
             if (start)
                 await this.start();
@@ -110,6 +139,10 @@ class AgentOsx extends system_1.default {
     async changeUser(user) {
         try {
             const json = this.loadSystemConfig();
+            // Resolved before the service is touched: a name this machine does not have would
+            // otherwise leave it stopped, with a config naming a user that does not exist
+            if (user)
+                await this.resolveUserIds(user);
             logger_1.default.info(texts_1.LOG_AGENT_STOPPING_SYSTEM);
             try {
                 await this.stop();
@@ -118,6 +151,10 @@ class AgentOsx extends system_1.default {
                 // do nothing
             }
             await this.saveFile(this.getServicePath(), this.getServiceConfig(json.id, json.host, json.token, json.port, user, json.debug));
+            // The directory follows the service to its new user, and back to root when the user is
+            // cleared - this is what makes changing the user later work without 0777 everywhere
+            await this.chownSystemDir(user);
+            this.applySystemModes();
             logger_1.default.info(texts_1.LOG_AGENT_STARTING_SYSTEM);
             await this.start();
         }
@@ -142,6 +179,17 @@ class AgentOsx extends system_1.default {
             logger_1.default.info(texts_1.LOG_AGENT_EXTRACTING_ARCHIVE);
             await this.extractBinaryArchive();
             await this.fixBinaryRights();
+            // The service user is not passed in here, so it comes off the service config. Both steps
+            // are skipped when that cannot be read: tighter modes without the matching ownership are
+            // exactly what would lock a service user out of their own directory.
+            const svcUser = this.readServiceUser();
+            if (svcUser === null) {
+                logger_1.default.error((0, texts_1.LOG_AGENT_RIGHTS_SKIPPED)(this.getServicePath()));
+            }
+            else {
+                await this.chownSystemDir(svcUser);
+                this.applySystemModes();
+            }
             logger_1.default.info(texts_1.LOG_AGENT_STARTING_SYSTEM);
             await this.start();
             logger_1.default.info(texts_1.LOG_AGENT_ENABLED);