handmux 0.23.0 → 0.25.0

package/src/cli/probe.js

@@ -1,16 +0,0 @@
-// Read-only reachability check: after the tunnel reports live, GET the public URL from THIS machine to
-// confirm the whole chain (edge/reverse-proxy → tunnel → server) actually answers. Touches no remote
-// config — it just fills the "tunnel connected but page won't load" blind spot.
-export async function probe(url, { fetchImpl = globalThis.fetch, timeoutMs = 6000 } = {}) {
-  if (!url) return false;
-  const ac = new AbortController();
-  const t = setTimeout(() => ac.abort(), timeoutMs);
-  try {
-    await fetchImpl(url, { method: 'GET', redirect: 'manual', signal: ac.signal });
-    return true;            // any HTTP response (even 401/404) means the chain is reachable
-  } catch {
-    return false;
-  } finally {
-    clearTimeout(t);
-  }
-}

package/src/cli/pushCmd.js

@@ -1,60 +0,0 @@
-// `handmux push <title> <body> [--session X]... [--device K]... [--tag T] [--url U]` — fire one
-// notification to the phone through the already-running server (loopback + the server's own token).
-// Scope is mutually exclusive: --device (by key) or --session, else all. Pure parse + injectable
-// runner so it unit-tests without spawning or real fetch.
-import { readState } from './state.js';
-import { sanitizeNotificationUrl } from '../urlPolicy.js';
-
-const collect = (acc, v) => acc.concat(String(v).split(',').map((s) => s.trim()).filter(Boolean));
-
-// argv is process.argv.slice(2), i.e. ['push', title, body, ...flags]. The shared parseArgs() drops bare
-// words after the command, so title/body are taken positionally; --session/--device may repeat.
-export function parsePushArgs(argv) {
-  const rest = argv.slice(1);
-  const positional = [];
-  let sessions = [], devices = [], tag, url;
-  for (let i = 0; i < rest.length; i++) {
-    const a = rest[i];
-    if (a === '--session') { sessions = collect(sessions, rest[++i]); }
-    else if (a === '--device') { devices = collect(devices, rest[++i]); }
-    else if (a === '--tag') { tag = rest[++i]; }
-    else if (a === '--url') { url = rest[++i]; }
-    else if (!a.startsWith('--')) positional.push(a);
-  }
-  const [title, body] = positional;
-  if (!title || !body) return { error: 'usage: handmux push <title> <body> [--session X]... [--device K]... [--tag T] [--url U]' };
-  if (sessions.length && devices.length) return { error: 'use --session or --device, not both' };
-  const safeUrl = url == null ? null : sanitizeNotificationUrl(url);
-  if (url != null && !safeUrl) return { error: '--url must be an http(s) URL or a relative path' };
-  const out = { title, body };
-  if (sessions.length) out.sessions = sessions;
-  if (devices.length) out.devices = devices;
-  if (tag) out.tag = tag;
-  if (safeUrl) out.url = safeUrl;
-  return out;
-}
-
-export async function runPush({ argv, home, fetchImpl = globalThis.fetch, log = console.log, err = console.error }) {
-  const parsed = parsePushArgs(argv);
-  if (parsed.error) { err(parsed.error); return 1; }
-  const st = readState(home);
-  if (!st || !st.localUrl || !st.token) { err('handmux is not running — run `handmux start` first.'); return 1; }
-  try {
-    const res = await fetchImpl(`${st.localUrl}/api/push/send-local`, {
-      method: 'POST',
-      headers: { Authorization: `Bearer ${st.token}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify(parsed),
-    });
-    if (!res.ok) { err(`push failed: ${res.status}`); return 1; }
-    const out = await res.json();
-    if (out.configured === false) { err('push is not configured (no VAPID keys) — run `handmux setup`.'); return 1; }
-    const sent = Number.isFinite(out.sent) ? out.sent : 0;
-    const failed = Number.isFinite(out.failed) ? out.failed : 0;
-    const gone = Number.isFinite(out.gone) ? out.gone : 0;
-    const counts = `sent: ${sent}, failed: ${failed}, gone: ${gone}`;
-    if (sent === 0) { err(`no notification delivered (${counts})`); return 1; }
-    if (failed > 0) { err(`push partially failed (${counts})`); return 1; }
-    log(`pushed (${counts})`);
-    return 0;
-  } catch (e) { err(`push failed: ${e.message}`); return 1; }
-}

package/src/cli/service.js

@@ -1,126 +0,0 @@
-// Boot/login autostart. The OS keeps the handmux SUPERVISOR (`__supervise`) alive; the supervisor
-// keeps server + tunnel alive — same model as a foreground run, just parented by launchd/systemd.
-// The intended config is baked into the service file as a base64 payload (self-contained: no reliance
-// on config.json). Text generators are pure (unit-tested); the launchctl/systemctl calls inject `exec`.
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { pocketHome, logPath } from './state.js';
-
-export const LABEL = 'com.handmux.agent';
-export const UNIT = 'handmux.service';
-
-export function plistPath(home) { return path.join(home, 'Library', 'LaunchAgents', `${LABEL}.plist`); }
-export function unitPath(home) { return path.join(home, '.config', 'systemd', 'user', UNIT); }
-
-export function isServiceInstalled(home, platform = process.platform) {
-  if (platform === 'darwin') return fs.existsSync(plistPath(home));
-  if (platform === 'linux') return fs.existsSync(unitPath(home));
-  return false;
-}
-
-const xmlEscape = (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-
-// launchd LaunchAgent. args = full argv for the process (node, script, __supervise, --payload, b64).
-export function plistFor({ args, log, label = LABEL }) {
-  const items = args.map((a) => `    <string>${xmlEscape(a)}</string>`).join('\n');
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key><string>${label}</string>
-  <key>ProgramArguments</key>
-  <array>
-${items}
-  </array>
-  <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
-  <key>StandardOutPath</key><string>${xmlEscape(log)}</string>
-  <key>StandardErrorPath</key><string>${xmlEscape(log)}</string>
-</dict>
-</plist>
-`;
-}
-
-// systemd --user unit. ExecStart needs a single command line; args are space-joined (our args have no
-// spaces except an absolute path with none in practice — quote the script path defensively).
-export function unitFor({ args }) {
-  const cmd = args.map((a) => (/\s/.test(a) ? JSON.stringify(a) : a)).join(' ');
-  return `[Unit]
-Description=handmux — drive your tmux from your phone
-After=network-online.target
-
-[Service]
-ExecStart=${cmd}
-Restart=always
-RestartSec=2
-
-[Install]
-WantedBy=default.target
-`;
-}
-
-export function installService(args, { home, platform = process.platform, exec = spawnSync, log = console } = {}) {
-  if (platform === 'darwin') {
-    const p = plistPath(home);
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, plistFor({ args, log: logPath(home) }));
-    exec('launchctl', ['unload', p], { stdio: 'ignore' }); // best-effort: clear any prior load
-    const r = exec('launchctl', ['load', '-w', p], { encoding: 'utf8' });
-    if (r.status !== 0) throw new Error(`launchctl load failed: ${r.stderr || r.status}`);
-    log.log?.(`installed launchd agent: ${p}`);
-    return p;
-  }
-  if (platform === 'linux') {
-    const p = unitPath(home);
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, unitFor({ args }));
-    exec('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' });
-    const enabled = exec('systemctl', ['--user', 'enable', UNIT], { encoding: 'utf8' });
-    if (enabled.status !== 0) throw new Error(`systemctl enable failed: ${enabled.stderr || enabled.status}`);
-    // `enable --now` does not restart an already-active unit. Always restart after rewriting ExecStart so
-    // an npm/brew upgrade (new CLI/Node path) and a changed baked config take effect immediately.
-    const restarted = exec('systemctl', ['--user', 'restart', UNIT], { encoding: 'utf8' });
-    if (restarted.status !== 0) throw new Error(`systemctl restart failed: ${restarted.stderr || restarted.status}`);
-    log.log?.(`installed systemd --user unit: ${p}`);
-    log.log?.('(for autostart before login: loginctl enable-linger "$USER")');
-    return p;
-  }
-  throw new Error(`autostart not supported on ${platform} yet`);
-}
-
-// Stop the currently-loaded service without removing/disable-ing its login registration. This is what the
-// ordinary `handmux stop` command needs: stay stopped for this login session, then start normally again at
-// the next login/boot. In particular, do NOT SIGTERM the supervisor directly while KeepAlive/Restart=always
-// is active — the service manager would immediately resurrect it and race a second manual supervisor.
-export function stopService({ home, platform = process.platform, exec = spawnSync } = {}) {
-  if (platform === 'darwin') {
-    const r = exec('launchctl', ['unload', plistPath(home)], { encoding: 'utf8' });
-    // unload returns non-zero when it was already unloaded; `stop` stays idempotent.
-    return r.status === 0;
-  }
-  if (platform === 'linux') {
-    const r = exec('systemctl', ['--user', 'stop', UNIT], { encoding: 'utf8' });
-    if (r.status !== 0) throw new Error(`systemctl stop failed: ${r.stderr || r.status}`);
-    return true;
-  }
-  throw new Error(`autostart not supported on ${platform} yet`);
-}
-
-export function uninstallService({ home, platform = process.platform, exec = spawnSync, log = console } = {}) {
-  if (platform === 'darwin') {
-    const p = plistPath(home);
-    exec('launchctl', ['unload', '-w', p], { stdio: 'ignore' });
-    try { fs.unlinkSync(p); } catch { /* already gone */ }
-    log.log?.(`removed launchd agent: ${p}`);
-    return;
-  }
-  if (platform === 'linux') {
-    exec('systemctl', ['--user', 'disable', '--now', UNIT], { stdio: 'ignore' });
-    try { fs.unlinkSync(unitPath(home)); } catch { /* already gone */ }
-    exec('systemctl', ['--user', 'daemon-reload'], { stdio: 'ignore' });
-    log.log?.(`removed systemd --user unit: ${unitPath(home)}`);
-    return;
-  }
-  throw new Error(`autostart not supported on ${platform} yet`);
-}

package/src/cli/setupModel.js

@@ -1,154 +0,0 @@
-// Pure model for `handmux setup`: the answer↔config mappers, the wizard-owned key sets, the connection
-// summary, the cloudflared provisioning text helpers, and the clack validators. Extracted from the
-// interactive shell (setupWizard.js) so the tested, side-effect-free logic stands on its own. Depends only
-// on i18n (t/getLocale) for user-facing strings — otherwise deterministic given its inputs.
-import { t, getLocale } from './i18n/index.js';
-
-// ~/.cloudflared/config.yml for a named tunnel: route the hostname to the local handmux port.
-export function cfConfigYaml({ tunnelName, credentialsFile, hostname, port }) {
-  return [
-    `tunnel: ${tunnelName}`,
-    `credentials-file: ${credentialsFile}`,
-    'ingress:',
-    `  - hostname: ${hostname}`,
-    `    service: http://localhost:${port}`,
-    '  - service: http_status:404',
-    '',
-  ].join('\n');
-}
-
-// Extract the tunnel UUID + credentials path from `cloudflared tunnel create <name>` stdout.
-export function parseTunnelCreate(out) {
-  const s = String(out || '');
-  const id = (s.match(/Created tunnel \S+ with id ([0-9a-fA-F-]+)/) || [])[1] || null;
-  const credentialsFile = (s.match(/credentials written to (\S+\.json)/i) || [])[1]?.replace(/\.$/, '') || null;
-  return { id, credentialsFile };
-}
-
-// Find an existing named tunnel's UUID in `cloudflared tunnel list --output json`. A named tunnel is a
-// PERSISTENT object in the Cloudflare account, so a second `setup` would hit `cloudflared tunnel create`'s
-// "tunnel with name X already exists" error — which used to force a rename and pile up junk tunnels in the
-// account. Looking it up first lets provisioning REUSE it idempotently. Tolerates non-JSON / errors → null.
-export function findTunnelId(listJsonOut, name) {
-  let arr;
-  try { arr = JSON.parse(String(listJsonOut || '')); } catch { return null; }
-  if (!Array.isArray(arr)) return null;
-  const hit = arr.find((tn) => tn && tn.name === name);
-  return hit?.id || null;
-}
-
-// The config keys the wizard owns: everything it can set. mergeConfig wipes these from the existing config
-// before re-applying the answers, so switching a tunnel (or clearing an optional field) cleanly drops the
-// old value instead of leaving a stale field behind. Anything NOT here (staticDir, uploadExts…) is
-// preserved untouched. `token` IS owned so the Token row can pin one AND clear it back to auto — but it
-// round-trips through answersFromConfig, so a re-run that never touches the row still writes it back.
-const WIZARD_KEYS = [
-  'lang', 'name', 'port', 'tunnel', 'token', 'previewDomain',
-  'sshHost', 'remotePort', 'sshJump', 'cfHostname', 'cfTunnelName', 'publicUrl',
-  'authtoken', 'cpolarRegion',
-  'vapid', 'xfyun',
-];
-
-// The tunnel-specific keys, cleared whenever the tunnel changes so a switch never carries a stale field.
-export const TUNNEL_KEYS = ['sshHost', 'remotePort', 'sshJump', 'cfHostname', 'cfTunnelName', 'publicUrl', 'authtoken', 'cpolarRegion'];
-
-// Wizard answers → the config fragment the user actually set (omit empty optional fields).
-export function configFromAnswers(a) {
-  const cfg = { tunnel: a.tunnel, port: a.port };
-  if (a.lang) cfg.lang = a.lang;
-  if (a.name) cfg.name = a.name;
-  if (a.token) cfg.token = a.token;   // blank = don't pin one → the server mints a fresh token each start
-  if (a.previewDomain) cfg.previewDomain = a.previewDomain;
-  if (a.tunnel === 'ssh') {
-    cfg.sshHost = a.sshHost;
-    cfg.remotePort = a.remotePort;
-    if (a.publicUrl) cfg.publicUrl = a.publicUrl;
-    if (a.sshJump) cfg.sshJump = a.sshJump;
-  }
-  if (a.tunnel === 'cloudflare-named') {
-    cfg.cfHostname = a.cfHostname;
-    cfg.cfTunnelName = a.cfTunnelName;
-  }
-  if (a.tunnel === 'natapp' || a.tunnel === 'cpolar') {
-    if (a.authtoken) cfg.authtoken = a.authtoken;
-    if (a.publicUrl) cfg.publicUrl = a.publicUrl;      // fixed/reserved domain (blank = temporary random)
-    if (a.cpolarRegion) cfg.cpolarRegion = a.cpolarRegion;
-  }
-  if (a.vapid) cfg.vapid = a.vapid;
-  if (a.xfyun) cfg.xfyun = a.xfyun;
-  return cfg;
-}
-
-// Fold this run's answers into an existing config: preserve every non-wizard field, replace the wizard's
-// own fields wholesale. This is why re-running `setup` to switch tunnels (or edit the name) never drops
-// your token / push keys / static dir, yet also never leaves the previous tunnel's stale keys around.
-export function mergeConfig(existing = {}, answers) {
-  const out = { ...existing };
-  for (const k of WIZARD_KEYS) delete out[k];
-  return { ...out, ...configFromAnswers(answers) };
-}
-
-// Seed the working answers from an existing config so the hub shows current values and each edit starts
-// from what's already there. A brand-new config yields safe defaults (none/LAN, port 19999).
-export function answersFromConfig(cfg = {}) {
-  const a = {
-    lang: cfg.lang || getLocale(),
-    name: cfg.name || '',
-    token: cfg.token || '',   // '' = not pinned (auto each start); seeded so an untouched re-run rewrites it
-    previewDomain: cfg.previewDomain || '',
-    tunnel: cfg.tunnel || 'none',
-    port: Number(cfg.port) || 19999,
-  };
-  for (const k of [...TUNNEL_KEYS, 'vapid', 'xfyun']) if (cfg[k] != null) a[k] = cfg[k];
-  return a;
-}
-
-// The dim one-line summary shown next to the Connection row (and reused nowhere else). Pure.
-export function summarizeConnection(a) {
-  const bare = (u) => String(u || '').replace(/^https?:\/\//, '');
-  switch (a.tunnel) {
-    case 'cloudflare': return `cloudflare · ${t('setup.sumTemp')}`;
-    case 'cloudflare-named': return `cloudflare-named · ${a.cfHostname || '?'}`;
-    case 'ssh': return `ssh · ${a.sshHost || '?'}`;
-    case 'natapp':
-    case 'cpolar': return `${a.tunnel} · ${a.publicUrl ? `${t('setup.sumFixed')} ${bare(a.publicUrl)}` : t('setup.sumTemp')}`;
-    default: return `${t('setup.tunnelNone')} · ${t('setup.sumNoRelay')}`;
-  }
-}
-
-// ---- validators (clack: return a string to reject + show inline, undefined to accept). Pure. ----
-export function validatePort(v) {
-  const n = Number(v);
-  if (!Number.isInteger(n) || n < 1 || n > 65535) return t('setup.valPort');
-  return undefined;
-}
-export const validateNonEmpty = (label) => (v) => (String(v || '').trim() ? undefined : t('setup.valRequired', { label }));
-export function validateHost(v) {
-  const s = String(v || '').trim().replace(/^https?:\/\//, '').replace(/\/.*$/, '');
-  return /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(s) ? undefined : t('setup.valHost');
-}
-// The built-in browser maps proxy origins below this domain. Blank deliberately leaves proxy mode disabled;
-// a URL, wildcard, or port would produce an invalid host when Handmux adds its own stable subdomain.
-export function validatePreviewDomain(v) {
-  const s = String(v || '').trim();
-  if (!s) return undefined;
-  return /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(s) ? undefined : t('setup.valPreviewDomain');
-}
-// VAPID subject: Apple (APNs) rejects a fake/.local domain with BadJwtToken, so require a real-looking
-// mailto:you@host.tld or an https:// URL and reject the known-bad .local. Keeps push from silently
-// failing on iOS. (Can't fully validate "real" client-side — this just catches the obvious footguns.)
-export function validateContact(v) {
-  const s = String(v || '').trim();
-  const wellFormed = /^mailto:[^@\s]+@[a-z0-9-]+(\.[a-z0-9-]+)+$/i.test(s)
-    || /^https:\/\/[a-z0-9-]+(\.[a-z0-9-]+)+/i.test(s);
-  if (!wellFormed || /\.local(?:[:/]|$)/i.test(s)) return t('setup.valContact');
-  return undefined;
-}
-// Access token: it rides in the phone's URL as ?token=…, so require something and reject whitespace (a space
-// would break the link). Length/charset are otherwise up to the user — a pinned token is used verbatim.
-export function validateToken(v) {
-  const s = String(v || '').trim();
-  if (!s) return t('setup.valToken');
-  if (/\s/.test(s)) return t('setup.valTokenSpace');
-  return undefined;
-}