cofluxd 2.4.0 → 2.6.0

package/README.md

@@ -45,10 +45,10 @@ Requires Node.js 20 or later.
 
 ```sh
 npm install -g cofluxd
-cofluxd up
+cofluxd up --key <join key>
 ```
 
-Follow the authorization link to connect the host to your account. Use `cofluxd status`, `cofluxd doctor`, or `cofluxd logs -f` to inspect it.
+Get the command, join key included, from **Add device → Headless** in the Coflux desktop app. The key is single use and valid for one hour; the host joins your account as soon as the command runs. Without `--key`, `cofluxd up` prints an authorization link instead: open it in a browser signed in to your account. Use `cofluxd status`, `cofluxd doctor`, or `cofluxd logs -f` to inspect it.
 
 ## Operate your workspaces
 

package/account-client.mjs

@@ -1,7 +1,12 @@
 // 账号客户端与桌面共用中心操作层；本文件不依赖 MCP 或 Node 常驻进程。
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
 import fs from "node:fs";
+import http from "node:http";
 import net from "node:net";
+import { hostname } from "node:os";
 import { join } from "node:path";
+import readline from "node:readline";
 
 /* --------------------------------- 实体标识 -------------------------------- */
 // `coflux:<kind>:<hex>`：设备 / 项目 / 工作区 / 终端 ID 的可粘贴短形式，hex 是 ID 的前几位
@@ -73,6 +78,118 @@ function broker(home, body, timeout) {
     socket.on("end", () => { try { resolve(unwrap(JSON.parse(text))); } catch (error) { reject(error); } });
   });
 }
+/* ------------------------------ browser login ------------------------------ */
+// `coflux login` with no credential flags (plan 20260923-oauth-login-redesign): RFC 8252 loopback
+// redirect with PKCE (S256), or a paste code when the browser cannot reach back (SSH, or forced with
+// COFLUX_LOGIN_PASTE=1). Same requests, same copy as the Rust CLI (crates/cli/src/browser_login.rs).
+
+const LOGIN_FAILURES = { not_allowed: "该邮箱未开通 Coflux", not_verified: "该账号的邮箱未经验证，无法登录", cancelled: "已取消登录" };
+
+function prefersPaste() {
+  return ["COFLUX_LOGIN_PASTE", "SSH_CONNECTION", "SSH_TTY", "SSH_CLIENT"].some((name) => !!process.env[name]);
+}
+
+function openBrowser(url) {
+  try {
+    const child = spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore", detached: true });
+    child.on("error", () => undefined);
+    child.unref();
+  } catch {
+    /* printing the URL is enough */
+  }
+}
+
+function escapeHtml(value) {
+  return String(value).replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch]);
+}
+
+function callbackPage(title, body) {
+  return `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><title>${escapeHtml(title)} · Coflux</title><style>:root{color-scheme:light dark}body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;font:15px/1.5 -apple-system,BlinkMacSystemFont,sans-serif}main{text-align:center;padding:24px}h1{font-size:18px}</style></head><body><main><h1>${escapeHtml(title)}</h1><p>${escapeHtml(body)}</p></main></body></html>`;
+}
+
+function listenLoopback() {
+  return new Promise((resolve) => {
+    const server = http.createServer();
+    server.once("error", () => resolve(null));
+    server.listen(0, "127.0.0.1", () => resolve(server));
+  });
+}
+
+function askLine(prompt) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr, terminal: !!process.stdin.isTTY });
+    rl.question(prompt, (answer) => { rl.close(); resolve(answer.trim()); });
+  });
+}
+
+async function browserLogin(server) {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier, "ascii").digest("base64url");
+  const state = randomBytes(24).toString("base64url");
+  const listener = prefersPaste() ? null : await listenLoopback();
+  const port = listener ? listener.address().port : undefined;
+  let registered;
+  try {
+    registered = await request(server, "/api/client/login/request", null, {
+      protocolVersion: 1, clientKind: "cli", host: (hostname() || "unknown-host").slice(0, 253),
+      redirect: listener ? "loopback" : "paste", ...(listener ? { port } : {}),
+      codeChallenge: challenge, codeChallengeMethod: "S256", state,
+    }, 30000);
+  } catch (error) {
+    listener?.close();
+    throw error;
+  }
+  const page = new URL(registered.url);
+  // Only ever open a page on the server we are logging into.
+  if (page.origin !== server) { listener?.close(); throw new Error("服务器返回的登录地址不在该服务器上"); }
+  const exchange = (code) => request(server, "/api/client/login/exchange", null, { protocolVersion: 1, code, codeVerifier: verifier }, 30000);
+  process.stderr.write(`在浏览器中打开以下地址完成登录（Ctrl-C 取消）：\n  ${page.href}\n`);
+  if (!listener) {
+    process.stderr.write("登录后页面会显示一次性登录码。\n");
+    const code = await askLine("粘贴登录码：");
+    if (!code) throw new Error("没有输入登录码");
+    return exchange(code);
+  }
+  openBrowser(page.href);
+  const waitMs = typeof registered.expiresAt === "number" && registered.expiresAt > Date.now() ? registered.expiresAt - Date.now() : 600000;
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => finish(new Error("登录超时，请重新运行 coflux login")), waitMs);
+    let done = false;
+    function finish(error, value) {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      listener.close();
+      setTimeout(() => listener.closeAllConnections?.(), 1000).unref();
+      if (error) reject(error); else resolve(value);
+    }
+    listener.on("request", (req, res) => {
+      const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+      const answer = (status, title, body) => { res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }); res.end(callbackPage(title, body)); };
+      if (req.method !== "GET" || url.pathname !== "/callback" || url.searchParams.get("state") !== state) { answer(404, "页面不存在", "这个地址只用于 Coflux 登录回调。"); return; }
+      const failed = url.searchParams.get("error");
+      if (failed) {
+        const message = LOGIN_FAILURES[failed] ?? "登录未完成，请重试";
+        answer(200, "登录未完成", `${message}。可以关闭此页面，回到终端。`);
+        finish(new Error(message));
+        return;
+      }
+      exchange(url.searchParams.get("code") ?? "").then(
+        (value) => { answer(200, "已登录", "已登录，可以回到终端。"); finish(null, value); },
+        (error) => { answer(200, "登录未完成", "登录未完成，请回到终端查看原因。"); finish(error); },
+      );
+    });
+  });
+}
+
+function saveSession(home, sessionPath, record) {
+  fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+  fs.chmodSync(home, 0o700);
+  const temp = `${sessionPath}.${process.pid}.tmp`;
+  try { fs.writeFileSync(temp, JSON.stringify(record), { mode: 0o600, flag: "wx" }); fs.renameSync(temp, sessionPath); }
+  finally { fs.rmSync(temp, { force: true }); }
+}
+
 /** 写到底再继续：`device exec` 之后要用远端退出码退出，而 process.exit 会截断写向管道的输出。 */
 function writeAll(stream, text) {
   if (!text) return Promise.resolve();
@@ -108,16 +225,20 @@ export async function runAccountCommand(positionals, flags, home) {
   const print = (value) => console.log(JSON.stringify(value));
   if (command === "login") {
     const server = origin(flags.server || "https://api.coflux.dev");
+    // No credential flags: sign in through the browser (loopback + PKCE, or a paste code over SSH).
+    if (!flags.username && !flags["password-stdin"]) {
+      const value = await browserLogin(server);
+      if (!value?.token) throw new Error("服务器没有返回会话");
+      saveSession(home, sessionPath, { server, token: value.token, accountId: value.accountId });
+      console.log(`已登录为 ${value.login || "当前账号"}`);
+      return;
+    }
     const username = required("username");
     if (!flags["password-stdin"]) throw new Error("用 --password-stdin 从标准输入读取密码；密码不进入命令参数或配置文件");
     let password = "";
     for await (const chunk of process.stdin) { password += chunk; if (Buffer.byteLength(password) > 4096) throw new Error("密码过长"); if (password.includes("\n")) break; }
     const value = await request(server, "/api/client/login", null, { protocolVersion: 1, username, password: password.split("\n", 1)[0].replace(/\r$/, "") }, 30000);
-    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
-    fs.chmodSync(home, 0o700);
-    const temp = `${sessionPath}.${process.pid}.tmp`;
-    try { fs.writeFileSync(temp, JSON.stringify({ server, token: value.token, accountId: value.accountId }), { mode: 0o600, flag: "wx" }); fs.renameSync(temp, sessionPath); }
-    finally { fs.rmSync(temp, { force: true }); }
+    saveSession(home, sessionPath, { server, token: value.token, accountId: value.accountId });
     print({ accountId: value.accountId, server });
     return;
   }

package/cofluxd.mjs

@@ -38,6 +38,10 @@ const SETTINGS = join(HOME, "settings.json"); // 用户配置（serverUrl/device
 const LOG_FILE = join(HOME, "daemon.log");
 const CRED = join(HOME, "credentials.json");
 const PENDING_AUTH = join(HOME, "pending-auth.json"); // worker 落盘的待授权链接（daemon.authorizePending）
+// One-time join key (plan 20260924-device-join-keys): `up --key` writes it, the worker presents it once
+// and deletes it on the server's answer, recording what happened in the outcome file (0600 each).
+const JOIN_KEY = join(HOME, "join-key.json");
+const JOIN_OUTCOME = join(HOME, "join-outcome.json");
 const CONN_STATE = join(HOME, "conn-state.json"); // worker 落盘的连接态快照（plan 033，见 crates/worker/src/conn_state.rs）
 const LOCAL_GATEWAY_STORE = join(HOME, "local-gateway.json"); // gateway key/origin/grant；doctor 只读结构与数量，绝不打印秘密
 const FDA_STATUS = join(HOME, "fda-status"); // supervisor 启动时探测落盘（仅 macOS，见 crates/supervisor/src/fda.rs）
@@ -69,6 +73,17 @@ function readPendingAuth() {
   try { return JSON.parse(fs.readFileSync(PENDING_AUTH, "utf8")); } catch { return null; }
 }
 
+function readJoinOutcome() {
+  try { return JSON.parse(fs.readFileSync(JOIN_OUTCOME, "utf8")); } catch { return null; }
+}
+
+function readCredentialsSummary() {
+  try {
+    const c = JSON.parse(fs.readFileSync(CRED, "utf8"));
+    return { serverUrl: typeof c.serverUrl === "string" ? c.serverUrl : "", daemonId: typeof c.daemonId === "string" ? c.daemonId : "" };
+  } catch { return { serverUrl: "", daemonId: "" }; }
+}
+
 function readConnState() {
   try { return JSON.parse(fs.readFileSync(CONN_STATE, "utf8")); } catch { return null; }
 }
@@ -449,6 +464,55 @@ async function applyAndStart({ serverUrl, deviceName, shell, version, binDir, no
   }
 }
 
+/**
+ * `cofluxd up --key` (plan 20260924-device-join-keys): join the account with a one-time key minted in
+ * Coflux's 添加设备 dialog. Never prints a link and never enters the 11-minute link wait.
+ *
+ * Order matters: stop the service before the key file exists, so a worker still running from the link
+ * era can never pick it up in a renewal and then be killed mid-answer; starting the stopped unit again
+ * (`enable --now` on Linux, unload/load on macOS) is the restart that makes the new worker read it.
+ * The CLI still never speaks the protocol: it learns the result only from `credentials.json` and the
+ * outcome file the worker writes.
+ */
+async function joinWithKey({ serverUrl, deviceName, shell, version, binDir, key }) {
+  await ensureBinaries({ version, binDir, skipIfPresent: true });
+  applyConfig({ serverUrl, deviceName, shell });
+  if (serverUrl !== DEFAULT_SERVER) console.log(`⚠ 使用非默认服务器: ${serverUrl}`);
+  stopService();
+  // The worker clears pending-auth.json only at connection end, not on SIGTERM: a stale one would
+  // read as "daemon too old for keys" below.
+  for (const file of [JOIN_OUTCOME, PENDING_AUTH]) { try { fs.rmSync(file, { force: true }); } catch { /* */ } }
+  fs.writeFileSync(JOIN_KEY, JSON.stringify({ key }) + "\n", { mode: 0o600 });
+  fs.chmodSync(JOIN_KEY, 0o600);
+  installService(true);
+  console.log(`✓ daemon 已启动 → ${serverUrl}`);
+  console.log("\n  正在用接入密钥接入账号 …\n");
+  const maxWaitMs = 2 * 60 * 1000;
+  const start = Date.now();
+  while (Date.now() - start < maxWaitMs) {
+    const outcome = readJoinOutcome();
+    if (fs.existsSync(CRED) || outcome?.status === "joined") {
+      console.log("✓ 已接入\n");
+      cmdStatus();
+      return;
+    }
+    if (outcome?.status === "rejected") {
+      die(`接入失败：${outcome.reason || "密钥无效、已过期或已被使用"}\n  在 Coflux 的添加设备里换一个密钥，再重新运行这条命令。`);
+    }
+    if (outcome?.status === "unsupported") {
+      die("服务器还不支持接入密钥（需要更新服务器）。");
+    }
+    if (fs.existsSync(JOIN_KEY) && fs.existsSync(PENDING_AUTH)) {
+      // The daemon enrolled without reading the key: its binary predates join keys (up keeps existing
+      // binaries). Drop the key so a later worker never presents it behind the user's back.
+      try { fs.rmSync(JOIN_KEY, { force: true }); } catch { /* */ }
+      die("已安装的 daemon 版本过旧，不认识接入密钥：先运行 `cofluxd update`，再在 Coflux 的添加设备里换一个密钥重新运行这条命令。");
+    }
+    await sleep(500);
+  }
+  die("等待接入超时：daemon 仍在后台尝试连接服务器。用 `cofluxd status` 查看状态，`cofluxd logs` 查看原因。");
+}
+
 // 轮询 ~/.coflux/pending-auth.json（授权链接）与 credentials.json（登记成功）给出全程反馈。
 // CLI 保持零协议：只读文件，不连 WS；daemon 断线重连会自动重发 enrollRequest、换发新链接。
 async function waitForAuthorization() {
@@ -479,6 +543,24 @@ async function waitForAuthorization() {
 
 async function cmdUp(v) {
   const s = readSettings();
+  if (v.key !== undefined) {
+    const key = v.key.trim();
+    if (!/^cf_join_[A-Za-z0-9_-]+$/.test(key)) die("--key 不是接入密钥：请完整复制 Coflux 添加设备里的命令（密钥以 cf_join_ 开头）");
+    if (v["no-start"]) die("--key 不能与 --no-start 同用：密钥只在启动时使用一次");
+    if (fs.existsSync(CRED)) {
+      // Already registered: a key would never be presented, so change nothing at all.
+      const c = readCredentialsSummary();
+      console.log(`✓ 此设备已接入 ${c.serverUrl || s.serverUrl || "(未知服务器)"}${c.daemonId ? `（设备 ${c.daemonId}）` : ""}，忽略 --key，未做任何改动。`);
+      return;
+    }
+    await joinWithKey({
+      serverUrl: v.server || s.serverUrl || DEFAULT_SERVER,
+      deviceName: v.name || s.deviceName || hostname(),
+      shell: v.shell || s.shell,
+      version: v.version, binDir: v["bin-dir"], key,
+    });
+    return;
+  }
   await applyAndStart({
     serverUrl: v.server || s.serverUrl || DEFAULT_SERVER,
     deviceName: v.name || s.deviceName || hostname(),
@@ -844,6 +926,7 @@ const HELP = `cofluxd —— coflux daemon 管理
 
   cofluxd                 首次=up（打印浏览器授权链接），已配置=status
   cofluxd up [flags]      幂等：首次装+起，已装则按当前 settings.json 重装服务并重启
+  cofluxd up --key <密钥>  用 Coflux 添加设备里生成的一次性密钥直接接入账号（不打印授权链接；已接入则不做改动）
   cofluxd status          服务器/登记（含"等待授权"）/服务/连接状态
   cofluxd doctor          中心网络 + gateway bind/grant/loopback + daemon 状态分层自检
   cofluxd update          下载新二进制（不重启；supervisor 有变化时提示用 restart 应用）
@@ -853,14 +936,14 @@ const HELP = `cofluxd —— coflux daemon 管理
   cofluxd down            停止
   cofluxd uninstall [--purge]   卸载（--purge 连二进制/配置/凭证一并删）
 
-up flags: --server <ws://.../daemon>  --name <名>  --shell <路径>
+up flags: --server <ws://.../daemon>  --name <名>  --shell <路径>  --key <cf_join_…>(一次性接入密钥，1 小时内有效)
 通用: --version <vX|latest>(不传时 up 沿用已有二进制，update 默认 latest)  --bin-dir <dir>(用本地 cargo 产物)  --no-start
 配置都在 ~/.coflux/settings.json（serverUrl/deviceName/shell），daemon 直接读；改后重跑 cofluxd up 生效。`;
 
 const { values, positionals } = parseArgs({
   allowPositionals: true,
   options: {
-    server: { type: "string" }, name: { type: "string" }, shell: { type: "string" },
+    server: { type: "string" }, name: { type: "string" }, shell: { type: "string" }, key: { type: "string" },
     version: { type: "string" }, "bin-dir": { type: "string" },
     "no-start": { type: "boolean", default: false }, purge: { type: "boolean", default: false },
     follow: { type: "boolean", short: "f", default: false }, help: { type: "boolean", short: "h", default: false },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cofluxd",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "Coflux 无界面宿主（cofluxd）与统一操作工具（coflux）",
   "type": "module",
   "bin": {