kimaki 1.3.0 → 1.4.0

package/src/tunnel.ts

@@ -5,16 +5,22 @@
 
 import crypto from 'node:crypto'
 import { execFile, spawn, type ChildProcess } from 'node:child_process'
+import http from 'node:http'
 import net from 'node:net'
 import { setTimeout as sleep } from 'node:timers/promises'
 import { promisify, stripVTControlCharacters } from 'node:util'
-import { create as createOpenTunnel, type OpenTunnelConnection } from '@opentunnel/client'
+import {
+  create as createOpenTunnel,
+  isValidRouteName,
+  OpenTunnelClientError,
+  publicUrl,
+  type OpenTunnelClientEvent,
+  type OpenTunnelConnection,
+} from '@opentunnel/client'
 
 const execFileAsync = promisify(execFile)
 
-const ROUTE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/
 const PORT_WAIT_MS = 30_000
-const ATTACH_TIMEOUT_MS = 60_000
 const CHILD_KILL_GRACE_MS = 5_000
 
 // Only lines with host:port, so "Port 5173 is in use" does not match.
@@ -31,12 +37,28 @@ export function detectPortFromText(text: string): number | null {
   return null
 }
 
+// Traforo accepted any tunnel ID, so map it to a DNS label instead of failing: `My_App` becomes `my-app`.
+function toRouteLabel(raw: string): string {
+  const label = raw.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 63).replace(/-+$/, '')
+  return isValidRouteName(label) ? label : ''
+}
+
 // Explicit name, then the tuistory session ID (stable URL across restarts of one session), then random.
 export function routeName({ name, tuistorySessionId }: { name?: string; tuistorySessionId?: string }): string | Error {
-  if (name) return ROUTE_NAME.test(name) ? name : new Error(`Invalid tunnel ID ${JSON.stringify(name)}: use lowercase letters, digits and dashes`)
-  const fromSession = tuistorySessionId?.toLowerCase()
-  if (fromSession && ROUTE_NAME.test(fromSession)) return fromSession
-  return crypto.randomBytes(8).toString('hex')
+  if (name) return toRouteLabel(name) || new Error(`Invalid tunnel ID ${JSON.stringify(name)}: use letters, digits and dashes`)
+  return toRouteLabel(tuistorySessionId ?? '') || crypto.randomBytes(8).toString('hex')
+}
+
+// Parses `netstat -ano` output on Windows: `TCP  0.0.0.0:5173  0.0.0.0:0  LISTENING  1234`.
+export function parseNetstatListeningPids({ stdout, port }: { stdout: string; port: number }): number[] {
+  const pids = new Set<number>()
+  for (const line of stdout.split('\n')) {
+    const [protocol, local, , state, pid] = line.trim().split(/\s+/)
+    if (protocol !== 'TCP' || state !== 'LISTENING' || !local?.endsWith(`:${port}`)) continue
+    const parsed = Number(pid)
+    if (Number.isInteger(parsed) && parsed > 0) pids.add(parsed)
+  }
+  return [...pids]
 }
 
 function isPortInUse({ port, host }: { port: number; host: string }): Promise<boolean> {
@@ -55,6 +77,10 @@ async function waitForPort({ port, host, signal }: { port: number; host: string;
 }
 
 async function listeningPids(port: number): Promise<number[]> {
+  if (process.platform === 'win32') {
+    const { stdout } = await execFileAsync('netstat', ['-ano'], { timeout: 5_000 }).catch(() => ({ stdout: '' }))
+    return parseNetstatListeningPids({ stdout, port })
+  }
   const { stdout } = await execFileAsync('lsof', ['-ti', `tcp:${port}`, '-sTCP:LISTEN'], { timeout: 5_000 }).catch(() => ({ stdout: '' }))
   return stdout.split('\n').map(Number).filter((pid) => Number.isInteger(pid) && pid > 0)
 }
@@ -107,6 +133,69 @@ function killChild(child: ChildProcess | undefined, signal: NodeJS.Signals = 'SI
 
 const log = (line: string) => process.stderr.write(`${line}\n`)
 
+function logTunnelEvent(event: OpenTunnelClientEvent) {
+  if (event.type === 'disconnected') log(`Tunnel disconnected: ${event.reason}`)
+  if (event.type === 'connected') log('Tunnel connected')
+}
+
+function forwardedHeaders({ headers, target }: { headers: http.IncomingHttpHeaders; target: string }): http.OutgoingHttpHeaders {
+  return {
+    ...headers,
+    host: target,
+    'x-forwarded-host': headers['x-forwarded-host'] ?? headers.host,
+    'x-forwarded-proto': headers['x-forwarded-proto'] ?? 'https',
+  }
+}
+
+function rawResponseHead(response: http.IncomingMessage): string {
+  let head = `HTTP/1.1 ${response.statusCode} ${response.statusMessage}\r\n`
+  for (let i = 0; i < response.rawHeaders.length; i += 2) head += `${response.rawHeaders[i]}: ${response.rawHeaders[i + 1]}\r\n`
+  return `${head}\r\n`
+}
+
+// opentunnel forwards the raw bytes, so the app would see the public Host header. Vite and other dev
+// servers reject unknown hosts (DNS rebinding protection) with 403. This loopback proxy sends
+// Host: localhost:<port> and keeps the public host in X-Forwarded-Host, like traforo did.
+export function startHostProxy({ host, port }: { host: string; port: number }): Promise<http.Server | Error> {
+  const target = `${host}:${port}`
+  const server = http.createServer((req, res) => {
+    const upstream = http.request({ host, port, method: req.method, path: req.url, headers: forwardedHeaders({ headers: req.headers, target }) }, (response) => {
+      res.writeHead(response.statusCode ?? 502, response.statusMessage, response.rawHeaders)
+      response.pipe(res)
+    })
+    upstream.on('error', () => {
+      if (!res.headersSent) res.writeHead(502)
+      res.end()
+    })
+    req.pipe(upstream)
+  })
+
+  // WebSocket upgrades (Vite HMR): replay the handshake upstream, then pipe both sockets.
+  server.on('upgrade', (req, socket, head) => {
+    const upstream = http.request({ host, port, method: req.method, path: req.url, headers: forwardedHeaders({ headers: req.headers, target }) })
+    upstream.on('upgrade', (response, upstreamSocket, upstreamHead) => {
+      socket.write(rawResponseHead(response))
+      if (upstreamHead.length > 0) socket.write(upstreamHead)
+      if (head.length > 0) upstreamSocket.write(head)
+      upstreamSocket.on('error', () => socket.destroy())
+      socket.on('error', () => upstreamSocket.destroy())
+      upstreamSocket.pipe(socket).pipe(upstreamSocket)
+    })
+    upstream.on('response', (response) => {
+      socket.write(rawResponseHead(response))
+      response.pipe(socket)
+    })
+    upstream.on('error', () => socket.destroy())
+    socket.on('error', () => upstream.destroy())
+    upstream.end()
+  })
+
+  return new Promise((resolve) => {
+    server.once('error', (cause) => resolve(new Error('Could not start the tunnel proxy', { cause })))
+    server.listen(0, '127.0.0.1', () => resolve(server))
+  })
+}
+
 export async function runTunnel(options: {
   port?: number
   command?: string[]
@@ -127,11 +216,18 @@ export async function runTunnel(options: {
   }
 
   const client = createOpenTunnel()
-  const existing = await client.tunnel.get().catch(() => undefined)
-  if (!existing) log('Creating the opentunnel.xyz tunnel of this machine (waits for a certificate, up to a minute)...')
-  const identity = await client.tunnel.ensure().catch((cause: unknown) => new Error('Could not create the opentunnel tunnel', { cause }))
+  let waitLogged = false
+  const identity = await client.tunnel
+    .ensure({
+      onProgress: (stage) => {
+        if (waitLogged || stage === 'checking-certificate' || stage === 'ready') return
+        waitLogged = true
+        log('Getting a certificate for the opentunnel.xyz tunnel of this machine (up to a minute)...')
+      },
+    })
+    .catch((cause) => new Error('Could not create the opentunnel tunnel', { cause }))
   if (identity instanceof Error) return identity
-  const url = `https://${route}.${identity.hostname}`
+  const url = publicUrl(route, identity.hostname)
 
   let child: ChildProcess | undefined
   let connection: OpenTunnelConnection | undefined
@@ -186,24 +282,27 @@ export async function runTunnel(options: {
   if (!port) return fail(new Error('Could not find the local port. Pass --port'))
   const ready = await waitForPort({ port, host, signal: portSignal })
   if (ready instanceof Error) return fail(ready)
+  const proxy = await startHostProxy({ host, port })
+  if (proxy instanceof Error) return fail(proxy)
+  const proxyAddress = proxy.address()
+  if (!proxyAddress || typeof proxyAddress === 'string') return fail(new Error('Tunnel proxy has no TCP address'))
 
-  // connect retries route_conflict forever, so a route held by another process would hang here.
-  const connecting = client.tunnel.connect({ routes: { [route]: `${host}:${port}` } })
-  const timeout = sleep(ATTACH_TIMEOUT_MS, null, { ref: false })
-  const attached = await Promise.race([connecting, timeout]).catch((cause: unknown) => new Error('Could not connect the tunnel', { cause }))
+  const attached = await client.tunnel
+    .connect({ routes: { [route]: `127.0.0.1:${proxyAddress.port}` }, onRouteConflict: 'fail', onEvent: logTunnelEvent })
+    .catch((cause) => {
+      if (cause instanceof OpenTunnelClientError && cause.code === 'route_conflict') {
+        return new Error(`Tunnel ID ${route} is already used by another process. Pass a different -t`, { cause })
+      }
+      return new Error('Could not connect the tunnel', { cause })
+    })
   if (attached instanceof Error) return fail(attached)
-  if (!attached) return fail(new Error(`Tunnel did not attach in ${ATTACH_TIMEOUT_MS / 1000}s. Another process may use the tunnel ID ${route}`))
   connection = attached
 
-  process.stdout.write(`\nLocal:  http://${host}:${port}\nTunnel: ${url}\n\n`)
-
-  void (async () => {
-    for await (const event of attached.events) {
-      if (event.type === 'disconnected') log(`Tunnel disconnected: ${event.reason}`)
-      if (event.type === 'connected') log('Tunnel connected')
-    }
-  })()
+  process.stdout.write(
+    `\nLocal:  http://${host}:${port}\nTunnel: ${url}\n` +
+      `Agents: validate with the Local URL (playwriter, curl), it is much faster. The Tunnel URL is for the user.\n\n`,
+  )
 
-  const closed = await attached.closed.then(() => undefined, (cause: unknown) => new Error('Tunnel stopped', { cause }))
+  const closed = await attached.closed.then(() => undefined, (cause) => new Error('Tunnel stopped', { cause }))
   return fail(closed ?? new Error('Tunnel stopped'))
 }

package/src/message-tool.e2e.test.ts

@@ -1,45 +0,0 @@
-// `kimaki --message-tool`: the plugin gives root sessions a send_message tool
-// and the thread shows only its text. The model's plain text stays hidden.
-
-import fs from 'node:fs'
-import { afterAll, beforeAll, expect, test } from 'vitest'
-
-import type { BotHandle } from './main.ts'
-import { scriptedTurn, seedProjectChannel, startOpencodeTestServer, startTestBot, startTwin, tempDataDir, TEST_USER_ID, waitForFooter, warmUp, type OpencodeTestServer, type TestTwin } from './test/harness.ts'
-
-const dataDir = tempDataDir()
-let server: OpencodeTestServer
-let twin: TestTwin
-let bot: BotHandle
-
-beforeAll(async () => {
-  const matchers = scriptedTurn({
-    marker: 'message-tool-marker',
-    steps: [{ id: 'message-call', tool: 'send_message', input: { text: 'Hello from **send_message**' } }],
-    finalText: 'hidden scratchpad text',
-  })
-  ;[server, twin] = await Promise.all([startOpencodeTestServer({ matchers }), startTwin()])
-  await seedProjectChannel({ dataDir, channelId: twin.channelId, guildId: twin.discord.guildId, directory: server.projectDirectory })
-  bot = await startTestBot({ dataDir, twin, server, messageTool: true })
-  await warmUp({ server })
-}, 60_000)
-
-afterAll(async () => {
-  await bot?.stop()
-  await Promise.all([server?.stop(), twin?.stop()])
-  fs.rmSync(dataDir, { recursive: true, force: true })
-})
-
-test('send_message text shows in Discord, plain text of the same turn does not', async () => {
-  await twin.discord.channel(twin.channelId).user(TEST_USER_ID).sendMessage({ content: 'message-tool-marker' })
-  const thread = await twin.discord.channel(twin.channelId).waitForThread({ timeout: 8_000 })
-  await waitForFooter({ discord: twin.discord, threadId: thread.id })
-  expect(await twin.discord.thread(thread.id).text()).toMatchInlineSnapshot(`
-    "--- from: user (tommy)
-    message-tool-marker
-    --- from: assistant (TestBot)
-    -# *using deterministic-provider/deterministic-v2 ⋅ build*
-    Hello from **send_message**
-    -# *project ⋅ main ⋅ Ns ⋅ N% ⋅ deterministic-v2*"
-  `)
-})