kova-node-cli 0.1.0

package/dist/lib/config.js

@@ -0,0 +1,107 @@
+import convict from 'convict';
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+// config with sensible defaults
+const schema = {
+    node: {
+        id: {
+            doc: 'unique node identifier',
+            format: String,
+            default: '',
+            env: 'KOVA_NODE_ID'
+        },
+        name: {
+            doc: 'friendly name for this node',
+            format: String,
+            default: 'kova-node',
+            env: 'KOVA_NODE_NAME'
+        }
+    },
+    network: {
+        port: {
+            doc: 'p2p port to listen on',
+            format: 'port',
+            default: 4001,
+            env: 'KOVA_P2P_PORT'
+        },
+        bootstrapNodes: {
+            doc: 'initial nodes to connect to',
+            format: Array,
+            default: [],
+            env: 'KOVA_BOOTSTRAP_NODES'
+        }
+    },
+    orchestratorUrl: {
+        doc: 'orchestrator API URL for registration',
+        format: String,
+        default: 'https://orchestrator.kovanetwork.com',
+        env: 'KOVA_ORCHESTRATOR_URL'
+    },
+    resources: {
+        maxCpu: {
+            doc: 'max cpu cores to offer',
+            format: Number,
+            default: 0, // 0 = auto detect
+            env: 'KOVA_MAX_CPU'
+        },
+        maxMemory: {
+            doc: 'max memory in gb to offer',
+            format: Number,
+            default: 0, // 0 = auto detect
+            env: 'KOVA_MAX_MEMORY'
+        },
+        maxDisk: {
+            doc: 'max disk space in gb to offer',
+            format: Number,
+            default: 100,
+            env: 'KOVA_MAX_DISK'
+        }
+    },
+    earnings: {
+        wallet: {
+            doc: 'wallet address for payments',
+            format: String,
+            default: '',
+            env: 'KOVA_WALLET_ADDRESS'
+        }
+    }
+};
+export class NodeConfig {
+    static instance;
+    static async load(configPath) {
+        this.instance = convict(schema);
+        // try to load config from file
+        const paths = [
+            configPath,
+            join(process.cwd(), 'kova.config.json'),
+            join(homedir(), '.kova', 'config.json')
+        ].filter(p => p);
+        for (const path of paths) {
+            if (path && existsSync(path)) {
+                try {
+                    const configFile = readFileSync(path, 'utf8');
+                    this.instance.load(JSON.parse(configFile));
+                    break;
+                }
+                catch (err) {
+                    // whatever just use defaults
+                }
+            }
+        }
+        // validate it
+        this.instance.validate({ allowed: 'strict' });
+        return this.instance.getProperties();
+    }
+    static get(path) {
+        if (!this.instance) {
+            throw new Error('config not loaded yet');
+        }
+        if (path) {
+            // @ts-ignore - convict types are too complex
+            const result = this.instance.get(path);
+            return result;
+        }
+        return this.instance.getProperties();
+    }
+}

package/dist/lib/docker.js

@@ -0,0 +1,415 @@
+import Docker from 'dockerode';
+import { logger } from './logger.js';
+export class DockerManager {
+    docker;
+    persistentVolumes = new Map(); // deploymentId -> volumeNames
+    constructor() {
+        // use socket if on linux, named pipe on windows
+        this.docker = new Docker({
+            socketPath: process.platform === 'win32'
+                ? '//./pipe/docker_engine'
+                : '/var/run/docker.sock'
+        });
+    }
+    async checkDocker() {
+        try {
+            await this.docker.ping();
+            const info = await this.docker.info();
+            logger.debug({
+                containers: info.Containers,
+                images: info.Images,
+                version: info.ServerVersion
+            }, 'docker is running');
+            return true;
+        }
+        catch (err) {
+            logger.error({ err }, 'docker not available');
+            return false;
+        }
+    }
+    async pullImage(image) {
+        // check if we already have it
+        try {
+            await this.docker.getImage(image).inspect();
+            logger.debug({ image }, 'image already exists');
+            return;
+        }
+        catch (err) {
+            // need to pull
+        }
+        logger.info({ image }, 'pulling docker image');
+        const stream = await this.docker.pull(image);
+        // wait for pull to complete
+        return new Promise((resolve, reject) => {
+            this.docker.modem.followProgress(stream, (err, output) => {
+                if (err) {
+                    logger.error({ err, image }, 'failed to pull image');
+                    reject(err);
+                }
+                else {
+                    logger.info({ image }, 'image pulled successfully');
+                    resolve(output);
+                }
+            });
+        });
+    }
+    async createContainer(spec) {
+        // Create isolated network for this container (prevents inter-container communication)
+        const networkName = `kova-net-${spec.jobId}`;
+        let network;
+        try {
+            network = await this.docker.createNetwork({
+                Name: networkName,
+                Driver: 'bridge',
+                Internal: false, // needs internet access
+                EnableIPv6: false,
+                Labels: {
+                    'kova.job.id': spec.jobId,
+                    'kova.isolated': 'true'
+                }
+            });
+            logger.debug({ networkName }, 'created isolated network for job');
+        }
+        catch (err) {
+            logger.error({ err, jobId: spec.jobId }, 'failed to create isolated network');
+        }
+        // check if there's a startup script in env vars
+        let containerCmd = spec.cmd;
+        let envVars = spec.env || [];
+        // handle both array and object formats for env
+        if (typeof spec.env === 'object' && !Array.isArray(spec.env)) {
+            // convert object to array of "KEY=VALUE" strings
+            envVars = Object.entries(spec.env).map(([k, v]) => `${k}=${v}`);
+            // check for startup script
+            if (spec.env.KOVA_STARTUP_SCRIPT) {
+                const script = Buffer.from(spec.env.KOVA_STARTUP_SCRIPT, 'base64').toString('utf-8');
+                containerCmd = ['/bin/sh', '-c', script];
+            }
+        }
+        else if (Array.isArray(spec.env)) {
+            const startupScript = spec.env.find((e) => e.startsWith('KOVA_STARTUP_SCRIPT='));
+            if (startupScript) {
+                const scriptB64 = startupScript.split('=')[1];
+                const script = Buffer.from(scriptB64, 'base64').toString('utf-8');
+                containerCmd = ['/bin/sh', '-c', script];
+            }
+        }
+        // handle volumes - persistent vs ephemeral
+        const binds = [];
+        const volumeNames = [];
+        if (spec.volumes && Array.isArray(spec.volumes)) {
+            for (const vol of spec.volumes) {
+                if (vol.persistent) {
+                    // create or reuse persistent docker volume
+                    const volumeName = `kova-pv-${spec.jobId}-${vol.name}`;
+                    try {
+                        // check if volume exists
+                        await this.docker.getVolume(volumeName).inspect();
+                        logger.debug({ volumeName }, 'reusing existing persistent volume');
+                    }
+                    catch (err) {
+                        // create new volume
+                        await this.docker.createVolume({
+                            Name: volumeName,
+                            Labels: {
+                                'kova.job.id': spec.jobId,
+                                'kova.volume.name': vol.name,
+                                'kova.persistent': 'true'
+                            }
+                        });
+                        logger.info({ volumeName, mountPath: vol.mountPath }, 'created persistent volume');
+                    }
+                    binds.push(`${volumeName}:${vol.mountPath}:rw`);
+                    volumeNames.push(volumeName);
+                }
+                else {
+                    // ephemeral volume - use tmpfs or empty volume
+                    const volumeName = `kova-vol-${spec.jobId}-${vol.name}`;
+                    await this.docker.createVolume({
+                        Name: volumeName,
+                        Labels: {
+                            'kova.job.id': spec.jobId,
+                            'kova.volume.name': vol.name,
+                            'kova.persistent': 'false'
+                        }
+                    });
+                    binds.push(`${volumeName}:${vol.mountPath}:rw`);
+                    volumeNames.push(volumeName);
+                }
+            }
+        }
+        // track persistent volumes for this deployment
+        if (volumeNames.length > 0) {
+            this.persistentVolumes.set(spec.jobId, volumeNames);
+        }
+        // determine tmpfs mounts - only use for /app if no custom volumes mounted there
+        const tmpfsMounts = {};
+        const hasAppMount = spec.volumes?.some((v) => v.mountPath === '/app');
+        if (!hasAppMount) {
+            tmpfsMounts['/app'] = 'rw,size=100m,mode=1777';
+        }
+        // build host config with optional gpu support
+        const hostConfig = {
+            Memory: spec.memory * 1024 * 1024, // mb to bytes
+            NanoCpus: spec.cpus * 1000000000, // cpu cores to nanocpus
+            ReadonlyRootfs: false, // allow writing for interactive use
+            // mount tmpfs for /app only if no custom volumes there
+            Tmpfs: Object.keys(tmpfsMounts).length > 0 ? tmpfsMounts : undefined,
+            // mount persistent and ephemeral volumes
+            Binds: binds.length > 0 ? binds : undefined,
+            CapDrop: ['ALL'],
+            CapAdd: [], // NO capabilities
+            SecurityOpt: ['no-new-privileges'],
+            // disk quota if supported
+            StorageOpt: spec.disk ? { size: `${spec.disk}G` } : undefined,
+            // NETWORK ISOLATION: Each container gets its own network
+            NetworkMode: network ? networkName : 'none',
+            // auto remove after exit
+            AutoRemove: false,
+            // Prevent container from accessing host services
+            ExtraHosts: [],
+            Dns: ['8.8.8.8', '1.1.1.1']
+        };
+        // add gpu support if requested
+        if (spec.gpu && spec.gpu > 0) {
+            hostConfig.DeviceRequests = [{
+                    Driver: '',
+                    Count: spec.gpu,
+                    DeviceIDs: [],
+                    Capabilities: [['gpu']],
+                    Options: {}
+                }];
+            logger.info({ jobId: spec.jobId, gpuCount: spec.gpu }, 'enabling gpu access for container');
+        }
+        const container = await this.docker.createContainer({
+            Image: spec.image || 'alpine:latest',
+            name: `kova-${spec.jobId}`,
+            // execute startup script or default command
+            Cmd: containerCmd || ['/bin/sh', '-c', 'echo "no command provided" && sleep 60'],
+            Tty: false,
+            OpenStdin: false,
+            HostConfig: hostConfig,
+            Env: envVars,
+            WorkingDir: '/app',
+            // labels for tracking
+            Labels: {
+                'kova.job.id': spec.jobId,
+                'kova.job.user': spec.userId || 'unknown',
+                'kova.version': '0.0.1',
+                'kova.has.persistent.volumes': volumeNames.some(v => v.includes('-pv-')) ? 'true' : 'false',
+                'kova.gpu.count': spec.gpu ? String(spec.gpu) : '0'
+            }
+        });
+        await container.start();
+        return container;
+    }
+    async getContainerStats(containerId) {
+        const container = this.docker.getContainer(containerId);
+        // check if container exists first
+        try {
+            await container.inspect();
+        }
+        catch (err) {
+            throw new Error('container not found or removed');
+        }
+        const stream = await container.stats({ stream: false });
+        // calc actual usage with safe access
+        const memUsage = stream.memory_stats?.usage ? stream.memory_stats.usage / (1024 * 1024) : 0; // mb
+        let cpuPercent = 0;
+        if (stream.cpu_stats?.cpu_usage && stream.precpu_stats?.cpu_usage) {
+            const cpuDelta = stream.cpu_stats.cpu_usage.total_usage -
+                stream.precpu_stats.cpu_usage.total_usage;
+            const systemDelta = stream.cpu_stats.system_cpu_usage -
+                stream.precpu_stats.system_cpu_usage;
+            if (systemDelta > 0) {
+                cpuPercent = (cpuDelta / systemDelta) *
+                    (stream.cpu_stats.online_cpus || 1) * 100;
+            }
+        }
+        return {
+            memory: Math.round(memUsage),
+            cpu: Math.round(cpuPercent * 100) / 100,
+            network: {
+                rx: stream.networks?.eth0?.rx_bytes || 0,
+                tx: stream.networks?.eth0?.tx_bytes || 0
+            }
+        };
+    }
+    async cleanupContainer(containerId, deleteVolumes = false) {
+        try {
+            const container = this.docker.getContainer(containerId);
+            // get container info to find its network
+            const info = await container.inspect();
+            const jobId = info.Config.Labels?.['kova.job.id'];
+            const hasPersistentVolumes = info.Config.Labels?.['kova.has.persistent.volumes'] === 'true';
+            // check if its still running
+            if (info.State.Running) {
+                await container.stop({ t: 10 }); // 10 sec grace
+            }
+            await container.remove();
+            logger.debug({ containerId }, 'container cleaned up');
+            // Clean up isolated network
+            if (jobId) {
+                const networkName = `kova-net-${jobId}`;
+                try {
+                    const network = this.docker.getNetwork(networkName);
+                    await network.remove();
+                    logger.debug({ networkName }, 'isolated network cleaned up');
+                }
+                catch (err) {
+                    // network might not exist or already removed
+                    if (err.statusCode !== 404) {
+                        logger.debug({ err, networkName }, 'network cleanup failed');
+                    }
+                }
+                // cleanup volumes - only delete persistent volumes if explicitly requested
+                const volumeNames = this.persistentVolumes.get(jobId) || [];
+                for (const volumeName of volumeNames) {
+                    const isPersistent = volumeName.includes('-pv-');
+                    if (!isPersistent || deleteVolumes) {
+                        try {
+                            const volume = this.docker.getVolume(volumeName);
+                            await volume.remove();
+                            logger.debug({ volumeName, isPersistent }, 'volume cleaned up');
+                        }
+                        catch (err) {
+                            if (err.statusCode !== 404) {
+                                logger.debug({ err, volumeName }, 'volume cleanup failed');
+                            }
+                        }
+                    }
+                    else {
+                        logger.debug({ volumeName }, 'keeping persistent volume for reuse');
+                    }
+                }
+                this.persistentVolumes.delete(jobId);
+            }
+        }
+        catch (err) {
+            // probably already gone
+            if (err.statusCode !== 404) {
+                logger.debug({ err, containerId }, 'cleanup failed');
+            }
+        }
+    }
+    // delete all volumes for a deployment (called when deployment is closed)
+    async deleteDeploymentVolumes(jobId) {
+        const volumes = await this.docker.listVolumes({
+            filters: {
+                label: [`kova.job.id=${jobId}`]
+            }
+        });
+        for (const vol of volumes.Volumes || []) {
+            try {
+                const volume = this.docker.getVolume(vol.Name);
+                await volume.remove();
+                logger.info({ volumeName: vol.Name }, 'deleted deployment volume');
+            }
+            catch (err) {
+                if (err.statusCode !== 404) {
+                    logger.warn({ err, volumeName: vol.Name }, 'failed to delete volume');
+                }
+            }
+        }
+        this.persistentVolumes.delete(jobId);
+    }
+    // list persistent volumes for a deployment
+    async listDeploymentVolumes(jobId) {
+        const volumes = await this.docker.listVolumes({
+            filters: {
+                label: [`kova.job.id=${jobId}`]
+            }
+        });
+        return (volumes.Volumes || []).map(vol => ({
+            name: vol.Labels?.['kova.volume.name'] || vol.Name,
+            size: 0, // docker doesn't track volume size easily
+            persistent: vol.Labels?.['kova.persistent'] === 'true'
+        }));
+    }
+    async listKovaContainers() {
+        const containers = await this.docker.listContainers({
+            all: true,
+            filters: {
+                label: ['kova.job.id']
+            }
+        });
+        return containers.map(c => ({
+            id: c.Id,
+            jobId: c.Labels['kova.job.id'],
+            state: c.State,
+            status: c.Status,
+            created: new Date(c.Created * 1000)
+        }));
+    }
+    async execCommand(containerId, command) {
+        const container = this.docker.getContainer(containerId);
+        const exec = await container.exec({
+            Cmd: ['/bin/sh', '-c', command],
+            AttachStdout: true,
+            AttachStderr: true
+        });
+        return new Promise((resolve, reject) => {
+            exec.start({ hijack: true, stdin: false }, (err, stream) => {
+                if (err) {
+                    reject(err);
+                    return;
+                }
+                let stdout = '';
+                let stderr = '';
+                const { Transform } = require('stream');
+                const demuxStream = new Transform({
+                    transform(chunk, encoding, callback) {
+                        // docker multiplexes stdout/stderr
+                        // first byte: 1=stdout, 2=stderr
+                        const type = chunk[0];
+                        const data = chunk.slice(8).toString();
+                        if (type === 1) {
+                            stdout += data;
+                        }
+                        else if (type === 2) {
+                            stderr += data;
+                        }
+                        callback();
+                    }
+                });
+                stream.pipe(demuxStream);
+                stream.on('end', async () => {
+                    const result = await exec.inspect();
+                    resolve({
+                        stdout: stdout.trim(),
+                        stderr: stderr.trim(),
+                        exitCode: result.ExitCode || 0
+                    });
+                });
+                stream.on('error', reject);
+            });
+        });
+    }
+    async getContainerLogs(containerId, tail = 100) {
+        const container = this.docker.getContainer(containerId);
+        const logs = await container.logs({
+            stdout: true,
+            stderr: true,
+            tail,
+            timestamps: true
+        });
+        return logs.toString();
+    }
+    async streamContainerLogs(containerId, onData) {
+        const container = this.docker.getContainer(containerId);
+        const stream = await container.logs({
+            stdout: true,
+            stderr: true,
+            follow: true,
+            timestamps: true
+        });
+        stream.on('data', (chunk) => {
+            onData(chunk.toString());
+        });
+        return () => {
+            if (stream && typeof stream.destroy === 'function') {
+                stream.destroy();
+            }
+        };
+    }
+}

package/dist/lib/logger.js

@@ -0,0 +1,12 @@
+import pino from 'pino';
+// just a logger nothing fancy
+export const logger = pino({
+    level: process.env.LOG_LEVEL || 'info',
+    transport: process.env.NODE_ENV !== 'production' ? {
+        target: 'pino-pretty',
+        options: {
+            colorize: true,
+            ignore: 'pid,hostname'
+        }
+    } : undefined
+});

package/dist/lib/message-signer.js

@@ -0,0 +1,93 @@
+import crypto from 'crypto';
+import { logger } from './logger.js';
+export class MessageSigner {
+    privateKey;
+    publicKey;
+    publicKeyPem;
+    usedNonces = new Set();
+    nonceCleanupInterval;
+    constructor(keyPair) {
+        if (keyPair) {
+            this.privateKey = crypto.createPrivateKey(keyPair.privateKey);
+            this.publicKey = crypto.createPublicKey(keyPair.publicKey);
+            this.publicKeyPem = keyPair.publicKey;
+        }
+        else {
+            const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519');
+            this.privateKey = privateKey;
+            this.publicKey = publicKey;
+            this.publicKeyPem = this.publicKey.export({ type: 'spki', format: 'pem' }).toString();
+        }
+        // cleanup old nonces every 5 min to prevent replay attacks
+        this.nonceCleanupInterval = setInterval(() => {
+            this.usedNonces.clear();
+        }, 5 * 60 * 1000);
+    }
+    sign(payload) {
+        const timestamp = Date.now();
+        const nonce = crypto.randomBytes(16).toString('hex');
+        const message = {
+            payload,
+            timestamp,
+            nonce
+        };
+        const messageString = JSON.stringify(message);
+        const signature = crypto.sign(null, Buffer.from(messageString), this.privateKey);
+        return {
+            payload,
+            signature: signature.toString('base64'),
+            publicKey: this.publicKeyPem,
+            timestamp,
+            nonce
+        };
+    }
+    verify(signedMessage, maxAge = 60000) {
+        try {
+            // reject old or future messages
+            const age = Date.now() - signedMessage.timestamp;
+            if (age > maxAge || age < 0) {
+                logger.warn({ age, maxAge }, 'message timestamp out of range');
+                return false;
+            }
+            // prevent replay attacks
+            if (this.usedNonces.has(signedMessage.nonce)) {
+                logger.warn({ nonce: signedMessage.nonce }, 'nonce already used');
+                return false;
+            }
+            const message = {
+                payload: signedMessage.payload,
+                timestamp: signedMessage.timestamp,
+                nonce: signedMessage.nonce
+            };
+            const messageString = JSON.stringify(message);
+            const signature = Buffer.from(signedMessage.signature, 'base64');
+            const publicKey = crypto.createPublicKey(signedMessage.publicKey);
+            const isValid = crypto.verify(null, Buffer.from(messageString), publicKey, signature);
+            if (isValid) {
+                this.usedNonces.add(signedMessage.nonce);
+            }
+            return isValid;
+        }
+        catch (err) {
+            logger.error({ err }, 'failed to verify signature');
+            return false;
+        }
+    }
+    getPublicKey() {
+        return this.publicKeyPem;
+    }
+    getPrivateKey() {
+        return this.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+    }
+    getFingerprint() {
+        const hash = crypto.createHash('sha256');
+        hash.update(this.publicKeyPem);
+        return hash.digest('hex').substring(0, 16);
+    }
+    destroy() {
+        if (this.nonceCleanupInterval) {
+            clearInterval(this.nonceCleanupInterval);
+        }
+        this.usedNonces.clear();
+    }
+}