byollm 0.1.0-alpha.97 → 0.1.0-alpha.99

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.97`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.99`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npx byollm@latest`, or `npm install byollm@latest`.
 >

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   main
-} from "./chunk-R3WK5X6Q.js";
+} from "./chunk-LPCHIPVJ.js";
 
 // src/bin.ts
 process.exitCode = await main(process.argv.slice(2));

package/dist/{chunk-R3WK5X6Q.js → chunk-LPCHIPVJ.js}

@@ -4781,8 +4781,10 @@ import {
   ConsoleFrame,
   CONSOLE_FRAME_VERSION,
   CONSOLE_MAX_DATA_BYTES,
+  consoleDataBytes,
   consoleEnvelope,
   consoleOrder,
+  encodeConsoleData,
   keyId,
   open as open2,
   seal,
@@ -4790,6 +4792,9 @@ import {
 } from "@byollm/protocol";
 function consoleSession(deps) {
   const inbound = consoleOrder("browser");
+  const log = deps.log ?? (() => void 0);
+  let fromBrowser = 0;
+  let toBrowser = 0;
   const boxKeyId = keyId(deps.keys.identityPublic);
   const browserKeyId = keyId(deps.browser.identity);
   let outSeq = 0;
@@ -4813,6 +4818,11 @@ function consoleSession(deps) {
   const finish = async (reason) => {
     if (ended !== void 0) return;
     ended = reason;
+    log("console session ending", {
+      reason,
+      framesFromBrowser: fromBrowser,
+      framesToBrowser: toBrowser
+    });
     deps.shell.kill();
     try {
       outSeq += 1;
@@ -4836,12 +4846,20 @@ function consoleSession(deps) {
     for (let at = 0; at < chunk.length; at += CONSOLE_MAX_DATA_BYTES) {
       const slice = chunk.subarray(at, at + CONSOLE_MAX_DATA_BYTES);
       outSeq += 1;
+      toBrowser += 1;
       void sealTo({
         v: CONSOLE_FRAME_VERSION,
         kind: "stdout",
         seq: outSeq,
-        data: slice.toString("base64")
-      }).catch(() => void finish("the console channel closed"));
+        data: encodeConsoleData(slice)
+      }).catch((cause) => {
+        log("could not send output to the browser", {
+          reason: cause instanceof Error ? cause.message : String(cause),
+          fromBrowser,
+          toBrowser
+        });
+        return finish("the console channel closed");
+      });
     }
   });
   deps.shell.onExit((reason) => void finish(reason));
@@ -4902,10 +4920,12 @@ function consoleSession(deps) {
         }
         case "stdin":
           if (!started) return;
-          deps.shell.write(Buffer.from(frame.data, "base64"));
+          fromBrowser += 1;
+          deps.shell.write(Buffer.from(consoleDataBytes(frame.data)));
           return;
         case "resize":
           if (!started) return;
+          fromBrowser += 1;
           deps.shell.resize(frame.cols, frame.rows);
           return;
         case "stdout":
@@ -4985,9 +5005,13 @@ async function openPtyShell(options) {
 }
 
 // src/console-agent-main.ts
-import { SealedEnvelope as SealedEnvelopeSchema } from "@byollm/protocol";
-var connectWebSocket = (url) => new Promise((resolve, reject) => {
-  const socket = new WebSocket(url);
+import {
+  SealedEnvelope as SealedEnvelopeSchema,
+  signRequest as signRequest2
+} from "@byollm/protocol";
+var CONSOLE_BOX_ENDPOINT = "/console/box";
+var connectWebSocket = (url, headers) => new Promise((resolve, reject) => {
+  const socket = new WebSocket(url, { headers });
   socket.addEventListener("open", () => {
     resolve({
       send: (text) => {
@@ -5019,7 +5043,17 @@ async function runConsoleAgent(options) {
     cwd: options.cwd,
     env: options.env
   });
-  const socket = await (options.connect ?? connectWebSocket)(options.url);
+  const signed = signRequest2(options.keys, {
+    endpoint: CONSOLE_BOX_ENDPOINT,
+    runnerId: options.runnerId,
+    issuedAt: (options.now ?? Date.now)(),
+    body: options.sessionId
+  });
+  const socket = await (options.connect ?? connectWebSocket)(options.url, {
+    "x-byollm-runner": signed.runnerId,
+    "x-byollm-issued-at": String(signed.issuedAt),
+    "x-byollm-signature": signed.signature
+  });
   const session = consoleSession({
     sessionId: options.sessionId,
     deadlineAt: options.deadlineAt,
@@ -5031,6 +5065,7 @@ async function runConsoleAgent(options) {
       return Promise.resolve();
     },
     record: options.record,
+    log: options.log,
     now: options.now ?? (() => Date.now())
   });
   return new Promise((resolve) => {
@@ -5099,10 +5134,10 @@ var ConsoleAgentSpec = z5.object({
 }).strict();
 
 // src/console-listen.ts
-import { signRequest as signRequest2 } from "@byollm/protocol";
+import { signRequest as signRequest3 } from "@byollm/protocol";
 var CONSOLE_DEVICE_ENDPOINT = "/console/device";
 var deviceHeaders = (keys, runnerId, now) => {
-  const signed = signRequest2(keys, {
+  const signed = signRequest3(keys, {
     endpoint: CONSOLE_DEVICE_ENDPOINT,
     runnerId,
     issuedAt: now,
@@ -8883,15 +8918,28 @@ async function commandConsoleAgent(paths, args, io) {
     const url = `${paired.origin.replace(/^http/, "ws")}${CONSOLE_DEVICE_ENDPOINT}`;
     io.out(`listening for consoles on ${paired.origin}
 `);
+    const consoleLog = (message, fields) => {
+      io.out(`${JSON.stringify({ console: message, ...fields })}
+`);
+    };
     consoleListener({
       url,
       runnerId: paired.runnerId,
       keys,
       run: (announcement) => runConsoleAgent({
-        url: `${paired.origin.replace(/^http/, "ws")}/console/box?session=${announcement.sessionId}`,
+        /* The endpoint from one definition, shared with the signer that
+           has to name it identically — a URL built here and a signature
+           built there, disagreeing by a character, is a 401 nobody can
+           read. */
+        url: `${paired.origin.replace(/^http/, "ws")}${CONSOLE_BOX_ENDPOINT}?session=${announcement.sessionId}`,
         sessionId: announcement.sessionId,
         deadlineAt: announcement.deadlineAt,
         keys,
+        /* The data door is authenticated too, and signs over the SESSION —
+           a signature captured from one cannot be replayed to join
+           another. Without this the dial is refused 401 before the
+           handshake, which is what attempt six hit. */
+        runnerId: paired.runnerId,
         browser: announcement.browser,
         command: process.env["BYOLLM_CONSOLE_SHELL"] ?? "/bin/sh",
         args: [],
@@ -8901,12 +8949,12 @@ async function commandConsoleAgent(paths, args, io) {
           io.out(`${JSON.stringify({ consoleSession: entry })}
 `);
           return Promise.resolve();
-        }
+        },
+        /* The agent's own half of the picture, on the same stream as the
+           listener's — one place to read when a console goes quiet. */
+        log: consoleLog
       }).then(() => void 0),
-      log: (message, fields) => {
-        io.out(`${JSON.stringify({ console: message, ...fields ?? {} })}
-`);
-      }
+      log: consoleLog
     });
     await new Promise(() => void 0);
     return 0;
@@ -8923,12 +8971,22 @@ async function commandConsoleAgent(paths, args, io) {
     io.err("That session description is not one this agent understands.\n");
     return 2;
   }
+  const agentPairings = new Pairings(paths.pairings);
+  await agentPairings.load();
+  const agentPaired = agentPairings.list()[0];
+  if (agentPaired === void 0) {
+    io.err(
+      "byollm console-agent cannot join a console: this device is not paired.\nThe hub will not accept an unsigned connection. Pair it first with `byollm connect`.\n"
+    );
+    return 1;
+  }
   try {
     const why = await runConsoleAgent({
       url: session.data.url,
       sessionId: session.data.sessionId,
       deadlineAt: session.data.deadlineAt,
       keys,
+      runnerId: agentPaired.runnerId,
       browser: session.data.browser,
       command: session.data.shell.command,
       args: session.data.shell.args,
@@ -10503,7 +10561,7 @@ async function exists(path) {
 }
 
 // src/index.ts
-var DAEMON_VERSION = "0.1.0-alpha.97";
+var DAEMON_VERSION = "0.1.0-alpha.99";
 function daemonVersion() {
   return {
     daemon: DAEMON_VERSION,
@@ -10562,4 +10620,4 @@ export {
   runCli,
   main
 };
-//# sourceMappingURL=chunk-R3WK5X6Q.js.map
+//# sourceMappingURL=chunk-LPCHIPVJ.js.map