getbotons 0.0.0-stage → 0.1.0

package/payload/npm-shrinkwrap.json

@@ -0,0 +1,51 @@
+{
+  "name": "getbotons",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "getbotons",
+      "version": "0.1.0",
+      "license": "MIT",
+      "dependencies": {
+        "croner": "^11.0.0",
+        "playwright-core": "^1.65.0"
+      },
+      "engines": {
+        "node": ">=24"
+      }
+    },
+    "node_modules/croner": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/croner/-/croner-11.0.0.tgz",
+      "integrity": "sha512-T17ADjdttrVToyzLpLq9Xb9xzcMwpQ/M3Qs9szhh0MVNTbv6NWQ9OFYa2qlzPYXFMn+uoDlnW1IpIv6cAvFtyA==",
+      "funding": [
+        {
+          "type": "other",
+          "url": "https://paypal.me/hexagonpp"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/hexagon"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.65.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.65.0.tgz",
+      "integrity": "sha512-vNSKgH6YqtN7cdT/L334zo0a+YwkrpicyrHJlWWPIm/Q+Nn2SWInil01oT0mbu96U4GgoRtCYQD9CzJQgju+lA==",
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    }
+  }
+}

package/payload/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "getbotons",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=24"
+  },
+  "dependencies": {
+    "croner": "^11.0.0",
+    "playwright-core": "^1.65.0"
+  }
+}

package/payload/scripts/backup.ts

@@ -0,0 +1,47 @@
+// `npm run backup` (and the nightly botons-backup.timer); BOTONS_BACKUP_RSYNC_TO also copies the new backup there.
+import '../server/src/env-init.ts';
+import { spawnSync } from 'node:child_process';
+import { type BackupResult, backup } from '../server/src/backup.ts';
+import { botonsHome } from '../server/src/config.ts';
+
+let home: string;
+try {
+  home = botonsHome();
+} catch (err) {
+  console.error((err as Error).message);
+  process.exit(1);
+}
+let result: BackupResult;
+try {
+  result = backup({ home });
+} catch (err) {
+  console.error(`Backup of ${home} failed: ${(err as Error).message}`);
+  process.exit(1);
+}
+
+const { manifest } = result;
+const counts = Object.entries(manifest.counts)
+  .map(([table, n]) => `${n} ${table}`)
+  .join(', ');
+console.log(`Backed up ${home} to ${result.dir}`);
+console.log(`  schema v${manifest.schemaVersion}: ${counts}${manifest.workspaces ? '; workspaces.tar.gz' : ''}`);
+if (manifest.tarWarning) console.warn(`  tar warnings (these files are not in the backup):\n${manifest.tarWarning.replace(/^/gm, '    ')}`);
+if (result.removed.length) console.log(`  removed old backups: ${result.removed.join(', ')}`);
+// Fail the run (and the unit) only after the database backup is in place and copied.
+let failed = false;
+if (manifest.workspacesError) {
+  console.error(`The workspaces were NOT backed up; the database was. Older backups were kept. ${manifest.workspacesError}`);
+  failed = true;
+}
+
+const target = process.env.BOTONS_BACKUP_RSYNC_TO;
+if (target) {
+  const rsync = spawnSync('rsync', ['-a', result.dir, `${target.replace(/\/+$/, '')}/`], { stdio: 'inherit' });
+  if (rsync.status !== 0) {
+    console.error(`Copying the backup to ${target} failed (${rsync.error?.message ?? `rsync exit ${rsync.status}`}). The local backup is kept.`);
+    failed = true;
+  } else {
+    console.log(`  copied to ${target}`);
+  }
+}
+if (failed) process.exit(1);

package/payload/scripts/botons-backup.service

@@ -0,0 +1,15 @@
+# Installed by `npm run backup:install`, which fills in the Node binary and
+# checkout paths. Started daily by @TIMER@.
+[Unit]
+Description=Botons backup (database snapshot and workspaces)
+
+[Service]
+Type=oneshot
+# Optional. Set BOTONS_HOME here if the server uses a non-default one, and
+# BOTONS_BACKUP_RSYNC_TO to copy each backup to another machine. It may be
+# missing.
+EnvironmentFile=-%h/.config/botons/env
+UMask=0077
+Nice=10
+IOSchedulingClass=idle
+ExecStart="@NODE@" "@REPO@/scripts/backup.ts"

package/payload/scripts/botons-backup.timer

@@ -0,0 +1,11 @@
+# Installed by `npm run backup:install`. Runs @SERVICE@ daily.
+[Unit]
+Description=Nightly Botons backup
+
+[Timer]
+OnCalendar=*-*-* 03:30:00
+# If the machine was off or asleep at 03:30, back up as soon as it is back.
+Persistent=true
+
+[Install]
+WantedBy=timers.target

package/payload/scripts/botons.service

@@ -0,0 +1,36 @@
+# Installed by `npm run service:install`, which fills in the Node binary, the
+# app folder and the environment file. See "Run it as a service" in the README.
+[Unit]
+Description=@DESCRIPTION@
+# Restart after a crash, but give up (and leave it failed) if it keeps failing:
+# more than 10 starts in 5 minutes.
+StartLimitIntervalSec=300
+StartLimitBurst=10
+
+[Service]
+Type=exec
+WorkingDirectory=@APP@
+# PATH (node, claude, codex and the tools Botons use), BOTONS_CLAUDE_BIN,
+# BOTONS_CODEX_BIN and any other BOTONS_* settings. The backup unit reads the
+# same file.
+EnvironmentFile=@ENV_FILE@
+# Node runs the TypeScript directly: no npm, no build step at start.
+ExecStart="@NODE@" "@APP@/server/src/index.ts"
+Restart=on-failure
+RestartSec=5
+# 78 (EX_CONFIG): a bad setting, or a database this code cannot open.
+# Restarting cannot fix either, so systemd leaves the unit failed instead.
+RestartPreventExitStatus=78
+# Stopping (and restarting) sends SIGTERM to the server alone. It takes no new
+# work, gives running turns up to BOTONS_DRAIN_MS (default 2m) to finish, then
+# stops its agent processes itself; work that was cut off or still queued runs
+# after the next start. Whatever is still in the unit's cgroup after the server
+# exits, or after TimeoutStopSec (set above the drain budget), gets SIGKILL.
+KillMode=mixed
+TimeoutStopSec=@STOP_TIMEOUT@
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=@NAME@
+
+[Install]
+WantedBy=default.target

package/payload/scripts/check-browser.ts

@@ -0,0 +1,90 @@
+// `npm run check:browser` (in Docker: `botons check-browser`): starts the managed browser the way a Boton's turn
+// does (server/src/browser.ts, openGuarded) on a temp profile, against a page this script serves on loopback, and
+// checks that it reads the page, takes a screenshot, and that nothing else gets out: a request to another loopback
+// port, a POST and a WebSocket to the allowed one. Touches no install: no data folder, no server, no network beyond
+// 127.0.0.1. Exit 0 when the browser works with every guard, 1 when it doesn't (and why).
+import { mkdtempSync, rmSync } from 'node:fs';
+import { createServer, type Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { findBrowser, loadPlaywright, openGuarded } from '../server/src/browser.ts';
+import { loadConfig } from '../server/src/config.ts';
+
+function listen(handler: (method: string, url: string) => { status?: number; body: string }): Promise<{ server: Server; port: number; hits: string[] }> {
+  const hits: string[] = [];
+  const server = createServer((req, res) => {
+    hits.push(`${req.method} ${req.url}`);
+    const out = handler(req.method ?? '', req.url ?? '');
+    res.writeHead(out.status ?? 200, { 'content-type': 'text/html; charset=utf-8' });
+    res.end(out.body);
+  });
+  server.on('upgrade', (req, socket) => {
+    hits.push(`UPGRADE ${req.url}`);
+    socket.destroy();
+  });
+  return new Promise((r) => server.listen(0, '127.0.0.1', () => r({ server, port: (server.address() as AddressInfo).port, hits })));
+}
+
+async function main(): Promise<string[]> {
+  const cfg = loadConfig(process.env, () => ({ ip: null, dnsName: null }), { create: false });
+  const problems: string[] = [];
+  const other = await listen(() => ({ body: 'other' }));
+  const site = await listen((method, url) =>
+    url.startsWith('/page')
+      ? {
+          body: `<!doctype html><title>Botons browser check</title><p id="t">botons-browser-ok</p><script>
+            fetch('http://127.0.0.1:${other.port}/fetch').catch(() => {});
+            fetch('/post', { method: 'POST', body: 'x' }).catch(() => {});
+            try { new WebSocket('ws://127.0.0.1:' + location.port + '/ws'); } catch (e) {}
+          </script>`,
+        }
+      : { status: method === 'GET' ? 404 : 405, body: '' },
+  );
+  const profile = mkdtempSync(join(tmpdir(), 'botons-check-browser-'));
+  // Only what the server's own availability check finds (BOTONS_BROWSER_PATH, Playwright's, the system's).
+  const found = await findBrowser(cfg.browser.path);
+  try {
+    if (!found.available || !found.executable) return [found.why ?? 'no browser'];
+    const blocked: string[] = [];
+    const { context, page } = await openGuarded((await loadPlaywright())!, join(profile, 'profile'), {
+      executable: found.executable,
+      sandbox: cfg.browser.sandbox,
+      headless: true,
+      policy: () => ({ enabled: true, sites: [`127.0.0.1:${site.port}`] }),
+      note: (url, why) => blocked.push(`${url}: ${why}`),
+    });
+    try {
+      await page.goto(`http://127.0.0.1:${site.port}/page`, { waitUntil: 'load', timeout: 30_000 });
+      await page.waitForTimeout(1500);
+      const text = await page.locator('#t').innerText({ timeout: 10_000 });
+      if (text !== 'botons-browser-ok') problems.push(`the page read as ${JSON.stringify(text)}`);
+      const png = await page.screenshot({ type: 'png' });
+      if (png.subarray(1, 4).toString() !== 'PNG') problems.push('the screenshot is not a PNG');
+      const reached = site.hits.filter((h) => h !== 'GET /page' && !h.startsWith('GET /favicon'));
+      if (reached.length) problems.push(`the allowed site got more than reads of the page: ${reached.join(', ')}`);
+      if (other.hits.length) problems.push(`another loopback port was reached: ${other.hits.join(', ')}`);
+      if (blocked.length < 3) problems.push(`expected the fetch, the POST and the WebSocket to be blocked; blocked: ${blocked.join('; ') || 'nothing'}`);
+    } finally {
+      await context.close();
+    }
+    return problems;
+  } catch (err) {
+    // Playwright's message ends with Chromium's own log, where the reason (a sandbox that can't start, say) is.
+    const lines = (err as Error).message.split('\n').map((l) => l.trim()).filter(Boolean);
+    const why = lines.filter((l) => /sandbox|namespace|fatal|error/i.test(l)).slice(0, 5);
+    return [`the browser did not start or failed: ${lines[0]?.slice(0, 300)}`, ...why.map((l) => l.slice(0, 300))];
+  } finally {
+    other.server.close();
+    site.server.close();
+    rmSync(profile, { recursive: true, force: true });
+  }
+}
+
+const problems = await main();
+const sandbox = loadConfig(process.env, () => ({ ip: null, dnsName: null }), { create: false }).browser.sandbox ? 'with its sandbox' : 'without its sandbox (BOTONS_BROWSER_SANDBOX=0)';
+if (problems.length) {
+  console.error(`The managed browser does not work here (${sandbox}):\n${problems.map((p) => `- ${p}`).join('\n')}`);
+  process.exit(1);
+}
+console.log(`The managed browser works here (${sandbox}): it read a page and took a screenshot, and nothing else got out.`);