bdy 1.25.18-stage → 1.25.19-beta

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.25.18-stage",
+  "version": "1.25.19-beta",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",
@@ -61,6 +61,7 @@
     "@xhmikosr/decompress": "11.1.4",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
+    "asn1js": "3.0.10",
     "basic-auth": "2.0.1",
     "chalk": "5.6.2",
     "commander": "15.0.0",
@@ -78,7 +79,6 @@
     "mime-db": "1.54.0",
     "mime-types": "3.0.2",
     "netmask": "2.1.1",
-    "node-forge": "1.4.0",
     "open": "11.0.0",
     "path-is-inside": "1.0.2",
     "picomatch": "4.0.4",
@@ -113,7 +113,6 @@
     "@types/mime-types": "3.0.1",
     "@types/netmask": "2.0.6",
     "@types/node": "24.13.3",
-    "@types/node-forge": "1.3.14",
     "@types/path-is-inside": "1.0.3",
     "@types/picomatch": "4.0.3",
     "@types/punycode": "2.1.4",

package/distTs/src/command/sandbox/create.js

@@ -9,6 +9,7 @@ const texts_1 = require("../../texts");
 const output_1 = __importDefault(require("../../output"));
 const input_1 = __importDefault(require("../../input"));
 const distro_1 = require("../../types/distro");
+const name_1 = require("./name");
 const VALID_RESOURCES = [
     '1x2',
     '2x4',
@@ -86,16 +87,25 @@ commandSandboxCreate.action(async (options) => {
         result = await client.createSandboxByYaml(workspace, scope === distro_1.SCOPE.PROJECT ? project : null, body, environmentId);
     }
     else {
-        const timestamp = Date.now().toString(36);
-        const baseName = humanId({ separator: '-', capitalize: false });
-        const defaultIdentifier = `${baseName}-${timestamp}`;
+        const fetch = options.fetch
+            ? input_1.default.sandboxFetch(options.fetch)
+            : undefined;
+        const randomName = () => humanId({ separator: '-', capitalize: false });
+        const name = options.name ||
+            options.identifier ||
+            (0, name_1.sandboxNameFromFetch)(fetch, scope === distro_1.SCOPE.PROJECT ? project : null) ||
+            randomName();
+        // keeps repeated creates from the same name or repo unique, the random
+        // part covers parallel creates within the same millisecond
+        const suffix = Date.now().toString(36) + Math.random().toString(36).substring(2, 5);
         const body = {
-            name: options.name || options.identifier || baseName,
-            identifier: options.identifier || defaultIdentifier,
+            name,
+            identifier: options.identifier ||
+                `${(0, name_1.sandboxSlug)(name) || randomName()}-${suffix}`,
         };
         body.variables = input_1.default.runVariables(options);
-        if (options.fetch) {
-            body.fetch = input_1.default.sandboxFetch(options.fetch);
+        if (fetch) {
+            body.fetch = fetch;
         }
         if (environmentId) {
             body.environment = {

package/distTs/src/command/sandbox/name.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sandboxNameFromFetch = exports.sandboxSlug = void 0;
+const sandbox_1 = require("../../types/sandbox");
+// the API limit on identifier length is not documented, keep the derived part
+// short so the timestamp suffix always fits
+const MAX_SLUG = 40;
+// identifier-safe form of a sandbox name (it must start and end with a letter
+// or digit); empty when nothing usable is left
+const sandboxSlug = (name) => name
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, '-')
+    .replace(/^[-_]+/, '')
+    .substring(0, MAX_SLUG)
+    .replace(/[-_]+$/, '');
+exports.sandboxSlug = sandboxSlug;
+// a full commit sha is unreadable in a name, shorten it like git does
+const shortRef = (ref) => ref && /^[0-9a-f]{40}$/i.test(ref) ? ref.substring(0, 7) : ref;
+const repoName = (url) => {
+    const last = url.replace(/\/+$/, '').split(/[/:]/).pop() || '';
+    return last.replace(/\.git$/, '');
+};
+// Derives a readable sandbox name from the first --fetch entry, so a sandbox
+// created for a repo or branch is recognisable on the list without -n.
+// `project` is the project the sandbox is created in - pass null outside the
+// project scope, a linked project there has nothing to do with the sandbox.
+const sandboxNameFromFetch = (fetch, project) => {
+    const f = fetch?.[0];
+    if (!f)
+        return null;
+    let parts = [];
+    if (f.type === sandbox_1.SANDBOX_FETCH.PUBLIC_REPO && f.repository) {
+        parts = [repoName(f.repository), shortRef(f.ref)];
+    }
+    else if (f.type === sandbox_1.SANDBOX_FETCH.PROJECT_REPO && project) {
+        parts = [project, shortRef(f.ref)];
+    }
+    else if (f.type === sandbox_1.SANDBOX_FETCH.ARTIFACT && f.artifact) {
+        // artifact is given as name@version or name:version
+        parts = f.artifact.split(/[@:]/);
+    }
+    const name = parts.filter(Boolean).join(' ');
+    if (!(0, exports.sandboxSlug)(name))
+        return null;
+    return name;
+};
+exports.sandboxNameFromFetch = sandboxNameFromFetch;

package/distTs/src/texts.js

@@ -883,7 +883,7 @@ Authenticates with the SSH key you added to your Buddy account - the session alw
 Arguments for ssh itself, or a command to run instead of a shell, go after --`;
 // Sandbox options
 exports.OPTION_SANDBOX_IDENTIFIER = 'Sandbox identifier';
-exports.OPTION_SANDBOX_NAME = 'Sandbox display name';
+exports.OPTION_SANDBOX_NAME = 'Sandbox display name. Defaults to the first --fetch source (repository, project and branch, or artifact) when not set';
 exports.OPTION_SANDBOX_NOTE = 'Sandbox note';
 exports.OPTION_SANDBOX_AGENT_NOTE = 'Sandbox note for AI agents; stored as agent_note and meant to be read before acting on the resource';
 exports.OPTION_SANDBOX_OS = `Operating system image (ubuntu:24.04 (default), ubuntu:22.04)`;
@@ -1749,6 +1749,10 @@ exports.EXAMPLE_SANDBOX_CREATE = [
         description: 'create sandbox and fetch artifact',
         command: 'bdy sb create --fetch "path=/home/buddy/repo,artifact=name@version"',
     },
+    {
+        description: 'create sandbox named after the fetched repository and branch ("Hello-World master")',
+        command: 'bdy sb create --fetch "url=https://github.com/octocat/Hello-World.git,ref=master"',
+    },
     {
         description: 'create sandbox, fetch project repo branch and build',
         command: 'bdy sb create --fetch "path=/home/buddy/repo,ref=branch,build=npm install && npm run build"',

package/distTs/src/tunnel/server/cert.js

@@ -1,54 +1,145 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_forge_1 = __importDefault(require("node-forge"));
-const toPositiveHex = (hexString) => {
-    let hexAsInt = parseInt(hexString[0], 16);
-    if (hexAsInt < 8) {
-        return hexString;
-    }
-    hexAsInt -= 8;
-    return hexAsInt.toString() + hexString.substring(1);
+const crypto_1 = __importDefault(require("crypto"));
+const asn1js = __importStar(require("asn1js"));
+const OID_SHA256_RSA = '1.2.840.113549.1.1.11';
+const OID_COMMON_NAME = '2.5.4.3';
+const OID_BASIC_CONSTRAINTS = '2.5.29.19';
+const OID_KEY_USAGE = '2.5.29.15';
+const COMMON_NAME = 'buddy.tunnel';
+const VALIDITY_MS = 622080000000;
+const algorithm = () => new asn1js.Sequence({
+    value: [
+        new asn1js.ObjectIdentifier({ value: OID_SHA256_RSA }),
+        new asn1js.Null(),
+    ],
+});
+const name = () => new asn1js.Sequence({
+    value: [
+        new asn1js.Set({
+            value: [
+                new asn1js.Sequence({
+                    value: [
+                        new asn1js.ObjectIdentifier({ value: OID_COMMON_NAME }),
+                        new asn1js.Utf8String({ value: COMMON_NAME }),
+                    ],
+                }),
+            ],
+        }),
+    ],
+});
+// UTCTime only reaches 2049, RFC 5280 switches to GeneralizedTime from 2050
+const time = (date) => date.getUTCFullYear() < 2050
+    ? new asn1js.UTCTime({ valueDate: date })
+    : new asn1js.GeneralizedTime({ valueDate: date });
+const extension = (oid, value) => new asn1js.Sequence({
+    value: [
+        new asn1js.ObjectIdentifier({ value: oid }),
+        new asn1js.OctetString({ valueHex: value.toBER() }),
+    ],
+});
+const toPem = (label, der) => {
+    const lines = Buffer.from(der).toString('base64').match(/.{1,64}/g) || [];
+    return `-----BEGIN ${label}-----\r\n${lines.join('\r\n')}\r\n-----END ${label}-----\r\n`;
 };
+// Self-signed certificate for the local TLS server when the user does not
+// provide one. Keys and the signature come from node crypto, asn1js only
+// encodes the certificate structure.
 class ServerCert {
     key;
     cert;
     constructor() {
-        const keyPair = node_forge_1.default.pki.rsa.generateKeyPair(2048);
-        const cert = node_forge_1.default.pki.createCertificate();
-        cert.serialNumber = toPositiveHex(node_forge_1.default.util.bytesToHex(node_forge_1.default.random.getBytesSync(9)));
-        cert.validity.notBefore = new Date();
-        const notAfter = new Date();
-        notAfter.setTime(notAfter.getTime() + 622080000000);
-        cert.validity.notAfter = notAfter;
-        const attrs = [
-            {
-                name: 'commonName',
-                value: 'buddy.tunnel',
-            },
-        ];
-        cert.setSubject(attrs);
-        cert.setIssuer(attrs);
-        cert.publicKey = keyPair.publicKey;
-        cert.setExtensions([
-            {
-                name: 'basicConstraints',
-                cA: true,
-            },
-            {
-                name: 'keyUsage',
-                keyCertSign: true,
-                digitalSignature: true,
-                nonRepudiation: true,
-                keyEncipherment: true,
-                dataEncipherment: true,
-            },
-        ]);
-        cert.sign(keyPair.privateKey, node_forge_1.default.md.sha256.create());
-        this.key = node_forge_1.default.pki.privateKeyToPem(keyPair.privateKey);
-        this.cert = node_forge_1.default.pki.certificateToPem(cert);
+        const { publicKey, privateKey } = crypto_1.default.generateKeyPairSync('rsa', {
+            modulusLength: 2048,
+        });
+        // positive and without a leading zero byte, so the DER integer is minimal
+        const serial = crypto_1.default.randomBytes(9);
+        serial[0] = (serial[0] & 0x7f) | 0x40;
+        // whole seconds: asn1js writes milliseconds into GeneralizedTime and RFC
+        // 5280 forbids fractions, VALIDITY_MS keeps notAfter on a whole second too
+        const notBefore = new Date(Math.floor(Date.now() / 1000) * 1000);
+        const notAfter = new Date(notBefore.getTime() + VALIDITY_MS);
+        const spki = asn1js.fromBER(publicKey.export({ type: 'spki', format: 'der' }));
+        const tbs = new asn1js.Sequence({
+            value: [
+                // v3
+                new asn1js.Constructed({
+                    idBlock: { tagClass: 3, tagNumber: 0 },
+                    value: [new asn1js.Integer({ value: 2 })],
+                }),
+                new asn1js.Integer({ valueHex: serial }),
+                algorithm(),
+                name(),
+                new asn1js.Sequence({ value: [time(notBefore), time(notAfter)] }),
+                name(),
+                spki.result,
+                new asn1js.Constructed({
+                    idBlock: { tagClass: 3, tagNumber: 3 },
+                    value: [
+                        new asn1js.Sequence({
+                            value: [
+                                extension(OID_BASIC_CONSTRAINTS, new asn1js.Sequence({
+                                    value: [new asn1js.Boolean({ value: true })],
+                                })),
+                                // digitalSignature, nonRepudiation, keyEncipherment,
+                                // dataEncipherment and keyCertSign - bits 0-3 and 5
+                                extension(OID_KEY_USAGE, new asn1js.BitString({
+                                    valueHex: new Uint8Array([0xf4]),
+                                    unusedBits: 2,
+                                })),
+                            ],
+                        }),
+                    ],
+                }),
+            ],
+        });
+        const tbsDer = Buffer.from(tbs.toBER());
+        const signature = crypto_1.default.sign('sha256', tbsDer, privateKey);
+        const cert = new asn1js.Sequence({
+            value: [
+                asn1js.fromBER(tbsDer).result,
+                algorithm(),
+                new asn1js.BitString({ valueHex: signature }),
+            ],
+        });
+        this.key = privateKey.export({ type: 'pkcs1', format: 'pem' }).toString();
+        this.cert = toPem('CERTIFICATE', cert.toBER());
     }
 }
 exports.default = ServerCert;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.25.18-stage",
+  "version": "1.25.19-beta",
   "type": "commonjs",
   "license": "MIT",
   "homepage": "https://buddy.works/docs/cli",
@@ -61,6 +61,7 @@
     "@xhmikosr/decompress": "11.1.4",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
+    "asn1js": "3.0.10",
     "basic-auth": "2.0.1",
     "chalk": "5.6.2",
     "commander": "15.0.0",
@@ -78,7 +79,6 @@
     "mime-db": "1.54.0",
     "mime-types": "3.0.2",
     "netmask": "2.1.1",
-    "node-forge": "1.4.0",
     "open": "11.0.0",
     "path-is-inside": "1.0.2",
     "picomatch": "4.0.4",
@@ -113,7 +113,6 @@
     "@types/mime-types": "3.0.1",
     "@types/netmask": "2.0.6",
     "@types/node": "24.13.3",
-    "@types/node-forge": "1.3.14",
     "@types/path-is-inside": "1.0.3",
     "@types/picomatch": "4.0.3",
     "@types/punycode": "2.1.4",