devchain-cli 0.23.3 → 0.24.0

package/dist/drizzle/meta/_journal.json

@@ -603,6 +603,62 @@
       "when": 1789655972024,
       "tag": "0085_clumsy_zodiak",
       "breakpoints": true
+    },
+    {
+      "idx": 86,
+      "version": "6",
+      "when": 1790026461091,
+      "tag": "0086_retire_worktrees",
+      "breakpoints": true
+    },
+    {
+      "idx": 87,
+      "version": "6",
+      "when": 1790066099486,
+      "tag": "0087_add_remotes_and_bindings",
+      "breakpoints": true
+    },
+    {
+      "idx": 88,
+      "version": "6",
+      "when": 1790098348936,
+      "tag": "0088_add_project_frozen_at",
+      "breakpoints": true
+    },
+    {
+      "idx": 89,
+      "version": "6",
+      "when": 1790101426955,
+      "tag": "0089_add_remote_operations",
+      "breakpoints": true
+    },
+    {
+      "idx": 90,
+      "version": "6",
+      "when": 1790103983260,
+      "tag": "0090_add_binding_sync_error",
+      "breakpoints": true
+    },
+    {
+      "idx": 91,
+      "version": "6",
+      "when": 1790214958057,
+      "tag": "0091_add_provider_auth_entries",
+      "breakpoints": true
+    },
+    {
+      "idx": 92,
+      "version": "6",
+      "when": 1790285023420,
+      "tag": "0092_amazing_synch",
+      "breakpoints": true
+    },
+    {
+      "idx": 93,
+      "version": "6",
+      "when": 1790806241239,
+      "tag": "0093_remote_tls_certificate",
+      "breakpoints": true
     }
   ]
 }

package/dist/host-cli-pins.json

@@ -0,0 +1,7 @@
+{
+  "claude": { "package": "@anthropic-ai/claude-code", "version": "2.1.281" },
+  "codex": { "package": "@openai/codex", "version": "0.156.1" },
+  "copilot": { "package": "@github/copilot", "version": "1.0.88" },
+  "opencode": { "package": "opencode-ai", "version": "1.18.32" },
+  "agy": { "installer": "https://antigravity.google/cli/install.sh" }
+}

package/dist/host-install/60-devchain-inotify.conf

@@ -0,0 +1,2 @@
+# DevChain watches project trees and Syncthing watches synced folders.
+fs.inotify.max_user_watches = 524288

package/dist/host-install/devchain-bootstrap.service

@@ -0,0 +1,25 @@
+# Serves an unclaimed DevChain host VM over HTTPS: GET /api/runtime and POST /api/host/claim.
+# Once claim.json exists, devchain-host.service owns the port instead.
+[Unit]
+Description=DevChain host bootstrap (unclaimed VM)
+After=network-online.target
+Wants=network-online.target
+ConditionPathExists=!/etc/devchain-host/claim.json
+
+[Service]
+Type=simple
+Environment=DEVCHAIN_BOOTSTRAP_PORT=3000
+# Creates /etc/devchain-host/tls/ on first start; `systemctl start` waits for it.
+ExecStartPre=/usr/local/bin/devchain-bootstrap --ensure-certificate
+ExecStart=/usr/local/bin/devchain-bootstrap
+Restart=on-failure
+RestartSec=5
+# A claim answers only after DevChain is up on the port, which systemd waits
+# for while it stops this unit for devchain-host.service. `mixed` sends
+# SIGTERM to the main process only: the systemctl call that started
+# devchain-host.service is still running in this unit then.
+TimeoutStopSec=240
+KillMode=mixed
+
+[Install]
+WantedBy=multi-user.target

package/dist/host-install/devchain-no-session-bus.pref

@@ -0,0 +1,6 @@
+# The image stays headless: with a user-session D-Bus or a keyring, Antigravity
+# (agy) keeps its login in the Secret Service instead of the file the DevChain
+# vault writes and watches. Priority -1 keeps apt from ever installing these.
+Package: dbus-user-session dbus-x11 gnome-keyring
+Pin: release *
+Pin-Priority: -1

package/dist/host-install/pins.json

@@ -0,0 +1,31 @@
+{
+  "nodeVersion": "24.21.0",
+  "syncthingVersion": "2.1.5",
+  "npmRegistry": "https://registry.npmjs.org/",
+  "bootstrap": {
+    "package": "devchain-host-bootstrap",
+    "version": "0.1.0",
+    "sha256": "724d4664ff9bc77d5d6be21de949022cb8e3a01cbb8ad525fef971136db65f96"
+  },
+  "aptPackages": [
+    "qemu-guest-agent",
+    "tmux",
+    "git",
+    "curl",
+    "ca-certificates",
+    "xz-utils",
+    "build-essential",
+    "python3",
+    "jq",
+    "ripgrep",
+    "python-is-python3",
+    "python3-pip",
+    "python3-venv",
+    "file",
+    "sqlite3",
+    "bsdextrautils",
+    "rsync",
+    "unzip",
+    "openssl"
+  ]
+}

package/dist/lib/exclusive-run.js

@@ -0,0 +1,308 @@
+const fs = require("node:fs");
+const { spawn } = require("node:child_process");
+const { randomBytes } = require("node:crypto");
+const { homedir, constants } = require("node:os");
+const { join, resolve } = require("node:path");
+
+const QUEUE_NAME = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+
+function isPid(value) {
+  return Number.isInteger(value) && value > 0;
+}
+
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error.code === "ESRCH") return false;
+    if (error.code === "EPERM") return true;
+    throw error;
+  }
+}
+
+function readOwner(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT" || error instanceof SyntaxError) return null;
+    throw error;
+  }
+}
+
+function isStale(owner) {
+  // An unpublished pgid cannot prove that a crashed owner never spawned a child.
+  return (
+    owner &&
+    isPid(owner.pid) &&
+    isPid(owner.pgid) &&
+    !isAlive(owner.pid) &&
+    !isAlive(-owner.pgid)
+  );
+}
+
+function removeReclaim(dir, file) {
+  fs.rmSync(file, { force: true });
+  try {
+    fs.rmdirSync(dir);
+  } catch (error) {
+    if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(error.code)) throw error;
+  }
+}
+
+function reclaim(dir, previousOwner) {
+  const guard = `${dir}.reclaim`;
+  const token = randomBytes(16).toString("hex");
+  const guardFile = join(guard, `owner-${token}.json`);
+  try {
+    fs.mkdirSync(guard, { mode: 0o700 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    try {
+      const files = fs.readdirSync(guard);
+      if (files.length === 1 && /^owner-[a-f0-9]+\.json$/.test(files[0])) {
+        const file = join(guard, files[0]);
+        const owner = readOwner(file);
+        if (
+          owner &&
+          isPid(owner.pid) &&
+          Date.now() - Date.parse(owner.startedAt) > 60000 &&
+          !isAlive(owner.pid)
+        ) {
+          // Token-specific unlink + nonrecursive rmdir cannot erase a new guard's owner.
+          removeReclaim(guard, file);
+        }
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    return false;
+  }
+
+  try {
+    const identity = fs.statSync(guard);
+    fs.writeFileSync(
+      guardFile,
+      JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }),
+      { flag: "wx", mode: 0o600 },
+    );
+    const current = fs.statSync(guard);
+    if (identity.ino !== current.ino || identity.dev !== current.dev)
+      return false;
+    const owner = readOwner(join(dir, "owner.json"));
+    if (owner && owner.token === previousOwner.token && isStale(owner)) {
+      fs.rmSync(dir, { recursive: true, force: true });
+      return true;
+    }
+    return false;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  } finally {
+    removeReclaim(guard, guardFile);
+  }
+}
+
+function signalState() {
+  const state = { signal: null, pgid: null, wake: null };
+  const handlers = SIGNALS.map((signal) => {
+    const handler = () => {
+      state.signal = state.signal || signal;
+      if (state.pgid) {
+        try {
+          process.kill(-state.pgid, signal);
+        } catch (error) {
+          if (error.code !== "ESRCH") throw error;
+        }
+      }
+      if (state.wake) state.wake();
+    };
+    process.on(signal, handler);
+    return [signal, handler];
+  });
+  state.dispose = () =>
+    handlers.forEach(([signal, handler]) =>
+      process.removeListener(signal, handler),
+    );
+  return state;
+}
+
+function pause(ms, state) {
+  return new Promise((done) => {
+    const finish = () => {
+      clearTimeout(timer);
+      state.wake = null;
+      done();
+    };
+    const timer = setTimeout(finish, ms);
+    state.wake = finish;
+  });
+}
+
+function signalCode(signal) {
+  return 128 + constants.signals[signal];
+}
+
+function formatWait(ms) {
+  const seconds = Math.round(ms / 1000);
+  if (seconds < 60) return `${seconds}s`;
+  return `${Math.floor(seconds / 60)}m ${seconds % 60}s`;
+}
+
+async function spawnAndForward(
+  { command, args, env, pollMs, name },
+  state,
+  onSpawn,
+) {
+  if (state.signal) return signalCode(state.signal);
+  const child = spawn(command, args, { env, stdio: "inherit", detached: true });
+  state.pgid = child.pid || null;
+  const result = new Promise((done) => {
+    child.once("error", (error) => {
+      process.stderr.write(
+        `${name ? `Queue "${name}"` : "Command"} cannot start "${command}": ${error.message}\n`,
+      );
+      done(1);
+    });
+    child.once("exit", (code, signal) =>
+      done(signal ? signalCode(signal) : code),
+    );
+  });
+  let publishError;
+  try {
+    if (state.pgid && onSpawn) onSpawn(state.pgid);
+  } catch (error) {
+    publishError = error;
+    process.kill(-state.pgid, "SIGTERM");
+  }
+  const code = await result;
+  // The launcher may exit before its descendants; group liveness owns the lock.
+  while (state.pgid && isAlive(-state.pgid)) await pause(pollMs, state);
+  state.pgid = null;
+  if (publishError) throw publishError;
+  return state.signal ? signalCode(state.signal) : code;
+}
+
+async function runCommand({
+  command,
+  args = [],
+  env = process.env,
+  pollMs = 2000,
+}) {
+  const state = signalState();
+  try {
+    return await spawnAndForward({ command, args, env, pollMs }, state);
+  } finally {
+    state.dispose();
+  }
+}
+
+async function runExclusive({
+  name,
+  command,
+  args = [],
+  env = process.env,
+  lockRoot,
+  pollMs = 2000,
+}) {
+  if (!QUEUE_NAME.test(name))
+    throw new Error(`Queue name must match ${QUEUE_NAME.source}.`);
+  if (!Number.isFinite(pollMs) || pollMs <= 0)
+    throw new Error("Queue pollMs must be positive.");
+  const root = resolve(
+    lockRoot || env.DEVCHAIN_QUEUE_DIR || join(homedir(), ".devchain", "locks"),
+  );
+  const dir = join(root, name);
+  const file = join(dir, "owner.json");
+  const markers = (env.DEVCHAIN_QUEUE_HELD || "").split(",").filter(Boolean);
+  const inherited = markers.some((entry) => entry.startsWith(`${name}@`))
+    ? readOwner(file)
+    : null;
+  if (
+    inherited &&
+    markers.includes(`${name}@${inherited.token}`) &&
+    isPid(inherited.pid) &&
+    isAlive(inherited.pid)
+  ) {
+    return runCommand({ command, args, env, pollMs });
+  }
+
+  const state = signalState();
+  const owner = {
+    pid: process.pid,
+    pgid: null,
+    token: randomBytes(16).toString("hex"),
+    name,
+    command: [command, ...args]
+      .map((arg) => (/\s/.test(arg) ? JSON.stringify(arg) : arg))
+      .join(" "),
+    cwd: process.cwd(),
+    startedAt: null,
+  };
+  let acquired = false;
+  let waitStart = null;
+  let lastNotice = null;
+  try {
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    while (!state.signal) {
+      try {
+        fs.mkdirSync(dir, { mode: 0o700 });
+        acquired = true;
+        owner.startedAt = new Date().toISOString();
+        fs.writeFileSync(file, JSON.stringify(owner), { mode: 0o600 });
+        break;
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+      }
+      const holder = readOwner(file);
+      if (isStale(holder) && reclaim(dir, holder)) continue;
+      const now = Date.now();
+      waitStart ??= now;
+      if (lastNotice === null || now - lastNotice >= 60000) {
+        const waited =
+          now > waitStart ? ` Waited ${formatWait(now - waitStart)}.` : "";
+        process.stderr.write(
+          `Queue "${name}" waiting for pid ${holder?.pid ?? "unknown"}: ${holder?.command ?? "unknown command"} (started ${holder?.startedAt ?? "unknown"}).${waited}\n`,
+        );
+        lastNotice = now;
+      }
+      await pause(pollMs, state);
+    }
+    if (state.signal) return signalCode(state.signal);
+    const waited = waitStart === null ? null : Date.now() - waitStart;
+    const childEnv = {
+      ...env,
+      DEVCHAIN_QUEUE_DIR: root,
+      DEVCHAIN_QUEUE_HELD: [
+        ...markers.filter((entry) => !entry.startsWith(`${name}@`)),
+        `${name}@${owner.token}`,
+      ].join(","),
+    };
+    const code = await spawnAndForward(
+      { name, command, args, env: childEnv, pollMs },
+      state,
+      (pgid) => {
+        owner.pgid = pgid;
+        const tempFile = join(dir, `owner-${owner.token}.tmp`);
+        fs.writeFileSync(tempFile, JSON.stringify(owner), { mode: 0o600 });
+        fs.renameSync(tempFile, file);
+      },
+    );
+    // The last line reaches a caller that only reads the tail of its log.
+    if (waited !== null)
+      process.stderr.write(
+        `Queue "${name}" waited ${formatWait(waited)} before this run.\n`,
+      );
+    return code;
+  } finally {
+    if (acquired) {
+      const current = readOwner(file);
+      if (!current || current.token === owner.token)
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    state.dispose();
+  }
+}
+
+module.exports = { QUEUE_NAME, runExclusive, runCommand };

package/dist/lib/host-api-key.js

@@ -0,0 +1,143 @@
+const fs = require("node:fs");
+const { join } = require("node:path");
+const { randomBytes, createHash } = require("node:crypto");
+
+const CLAIM_FILE = "claim.json";
+const KEY_DIR_NAME = ".devchain";
+const KEY_FILE_NAME = "host-api-key";
+const KEY_PREFIX = "dck_";
+
+// The home path comes from the claim record, never from the runner's own ~,
+// because this command is also valid as root or another account.
+function readClaimRecord(env) {
+  const etcDir = env.DEVCHAIN_HOST_ETC_DIR || "/etc/devchain-host";
+  const claimFile = join(etcDir, CLAIM_FILE);
+  if (!fs.existsSync(claimFile)) return null;
+  const claim = JSON.parse(fs.readFileSync(claimFile, "utf8"));
+  if (!claim || typeof claim !== "object") {
+    throw new Error(`${claimFile} is not a valid claim record.`);
+  }
+  const { userName, homePath } = claim;
+  if (typeof userName !== "string" || userName.length === 0) {
+    throw new Error(`${claimFile} has no userName.`);
+  }
+  if (typeof homePath !== "string" || homePath.length === 0) {
+    throw new Error(`${claimFile} has no homePath.`);
+  }
+  return { userName, homePath };
+}
+
+function lookupUnixAccount(userName) {
+  const passwd = fs.readFileSync("/etc/passwd", "utf8");
+  for (const line of passwd.split("\n")) {
+    const fields = line.split(":");
+    if (fields[0] === userName) {
+      return { uid: Number(fields[2]), gid: Number(fields[3]) };
+    }
+  }
+  return null;
+}
+
+function generateHostApiKey() {
+  return KEY_PREFIX + randomBytes(32).toString("base64url");
+}
+
+function hashHostApiKey(key) {
+  return createHash("sha256").update(key).digest("hex");
+}
+
+// lstat instead of existsSync so a dangling symlink is still refused.
+function isSymbolicLink(filePath) {
+  let stats;
+  try {
+    stats = fs.lstatSync(filePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+  return stats.isSymbolicLink();
+}
+
+function runHostApiKeyReset({
+  env = process.env,
+  getuid = process.getuid,
+  lookupAccount = lookupUnixAccount,
+  chownSync = fs.chownSync,
+  log = console.log,
+  error = console.error,
+} = {}) {
+  let claim;
+  try {
+    claim = readClaimRecord(env);
+  } catch (err) {
+    error(`Cannot read the claim record: ${err.message}`);
+    return 1;
+  }
+  if (!claim) {
+    error("This machine is not a claimed DevChain VM.");
+    return 1;
+  }
+  const { userName, homePath } = claim;
+
+  const account = lookupAccount(userName);
+  if (!account) {
+    error(`Cannot find the claimed user account "${userName}".`);
+    return 1;
+  }
+
+  if (typeof getuid !== "function") {
+    error("This command requires a Unix-like system.");
+    return 1;
+  }
+  const uid = getuid();
+  if (uid !== account.uid && uid !== 0) {
+    error(`This command must run as ${userName} (the claimed user) or as root.`);
+    return 1;
+  }
+
+  const keyDir = join(homePath, KEY_DIR_NAME);
+  const keyFile = join(keyDir, KEY_FILE_NAME);
+  try {
+    if (isSymbolicLink(keyFile)) {
+      error(`Refusing to write ${keyFile}: it is a symbolic link.`);
+      return 1;
+    }
+    let createdKeyDir = false;
+    if (!fs.existsSync(keyDir)) {
+      fs.mkdirSync(keyDir, { recursive: true, mode: 0o700 });
+      createdKeyDir = true;
+    }
+    if (uid === 0 && createdKeyDir) {
+      // A root-owned 0700 directory would keep the claimed user's server
+      // from reading the key file that lives inside it.
+      chownSync(keyDir, account.uid, account.gid);
+    }
+    const key = generateHostApiKey();
+    const tmpFile = join(
+      keyDir,
+      `.${KEY_FILE_NAME}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`,
+    );
+    fs.writeFileSync(tmpFile, `${hashHostApiKey(key)}\n`, { mode: 0o600 });
+    try {
+      // Chown before the rename so the key never sits at the final path
+      // owned by root.
+      if (uid === 0) chownSync(tmpFile, account.uid, account.gid);
+      fs.renameSync(tmpFile, keyFile);
+    } catch (err) {
+      try {
+        fs.unlinkSync(tmpFile);
+      } catch (_) {
+        // best-effort cleanup of the abandoned temp file
+      }
+      throw err;
+    }
+    log(key);
+    log("Paste this key on home: Remote VMs → <VM> → Enter API key.");
+    return 0;
+  } catch (err) {
+    error(`Failed to write the host API key: ${err.message}`);
+    return 1;
+  }
+}
+
+module.exports = { runHostApiKeyReset };