loophole-im 0.1.0

package/bin/loophole-im.js

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { homedir, platform, arch } from "node:os";
+import { fileURLToPath } from "node:url";
+
+const REPO = process.env.LOOPHOLE_REPO ?? "Sir-Goose/loophole";
+const VERSION = await getVersion();
+
+const TARGETS = {
+  "darwin-arm64": "loophole-darwin-arm64",
+  "darwin-x64": "loophole-darwin-x64",
+  "linux-arm64": "loophole-linux-arm64",
+  "linux-x64": "loophole-linux-x64",
+  "windows-x64.exe": "loophole-windows-x64.exe",
+};
+
+function getSuffix() {
+  const os = platform();
+  const a = arch();
+  let key;
+  if (os === "darwin") key = `darwin-${a === "arm64" ? "arm64" : "x64"}`;
+  else if (os === "linux") key = `linux-${a === "arm64" ? "arm64" : "x64"}`;
+  else if (os === "win32" && a === "x64") key = "windows-x64.exe";
+  else {
+    console.error(`unsupported platform ${os}/${a} — see https://github.com/${REPO}/releases`);
+    process.exit(1);
+  }
+  if (!(key in TARGETS)) {
+    console.error(`unsupported target ${key}`);
+    process.exit(1);
+  }
+  return key;
+}
+
+async function getVersion() {
+  try {
+    const pkgPath = join(fileURLToPath(new URL(".", import.meta.url)), "..", "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return process.env.LOOPHOLE_VERSION ?? "0.0.0";
+  }
+}
+
+function binName(suffix) {
+  return TARGETS[suffix];
+}
+
+function localBinPaths(suffix) {
+  const name = binName(suffix);
+  const home = homedir();
+  return [
+    // bundled next to shim (if published with binaries)
+    join(fileURLToPath(new URL(".", import.meta.url)), name),
+    // dist from bun build --compile (local dev)
+    join(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..", "dist", name),
+    // cached in ~/.loophole/bin (where install.sh and cloudflared live)
+    join(home, ".loophole", "bin", name),
+    // also check without exe on windows fallback
+    join(home, ".loophole", "bin", name.replace(/\.exe$/, "")),
+  ];
+}
+
+function findLocalBin(suffix) {
+  for (const p of localBinPaths(suffix)) {
+    if (existsSync(p)) return p;
+  }
+  // also check PATH
+  const pathEnv = process.env.PATH ?? "";
+  for (const dir of pathEnv.split(":")) {
+    const cand = join(dir, "loophole");
+    if (existsSync(cand)) return cand;
+    const cand2 = join(dir, binName(suffix));
+    if (existsSync(cand2)) return cand2;
+  }
+  return null;
+}
+
+async function downloadBinary(suffix) {
+  const name = binName(suffix);
+  const version = VERSION;
+  const isPrivate = true; // repo is private until flipped public
+  const ghToken = process.env.GH_TOKEN;
+  const cacheDir = join(homedir(), ".loophole", "bin");
+  mkdirSync(cacheDir, { recursive: true });
+  const dest = join(cacheDir, name);
+  const shaDest = join(cacheDir, "SHA256SUMS");
+
+  // Use GitHub API if GH_TOKEN set (required for private repo), else try public download
+  const apiBase = "https://api.github.com";
+  const headers = { "Accept": "application/vnd.github+json" };
+  if (ghToken) headers["Authorization"] = `Bearer ${ghToken}`;
+
+  console.error(`downloading loophole ${version} (${suffix}) …`);
+
+  let binaryUrl;
+  let shaUrl;
+  if (ghToken) {
+    // api mode — fetch release json to get asset ids
+    const ref = version && version !== "0.0.0" ? `tags/v${version}` : "latest";
+    const releaseUrl = `${apiBase}/repos/${REPO}/releases/${ref}`;
+    const res = await fetch(releaseUrl, { headers });
+    if (!res.ok) {
+      console.error(`could not fetch release ${ref}: ${res.status} ${await res.text()}`);
+      process.exit(1);
+    }
+    const rel = await res.json();
+    const findAsset = (n) => rel.assets?.find((a) => a.name === n);
+    const asset = findAsset(name);
+    const shaAsset = findAsset("SHA256SUMS");
+    if (!asset || !shaAsset) {
+      console.error(`asset ${name} or SHA256SUMS not found in release ${rel.tag_name}`);
+      process.exit(1);
+    }
+    binaryUrl = asset.url;
+    shaUrl = shaAsset.url;
+    // GitHub API requires Accept: application/octet-stream for binary
+    await downloadFile(binaryUrl, dest, { ...headers, Accept: "application/octet-stream" });
+    await downloadFile(shaUrl, shaDest, headers);
+  } else {
+    // public mode — direct download (will 404 while repo private)
+    const base = version && version !== "0.0.0" && version !== "0.0.0-dev"
+      ? `https://github.com/${REPO}/releases/download/v${version}`
+      : `https://github.com/${REPO}/releases/latest/download`;
+    binaryUrl = `${base}/${name}`;
+    shaUrl = `${base}/SHA256SUMS`;
+    try {
+      await downloadFile(binaryUrl, dest, {});
+      await downloadFile(shaUrl, shaDest, {});
+    } catch (e) {
+      console.error(`could not download ${name} — repo is private, set GH_TOKEN to download`);
+      console.error(`  export GH_TOKEN=ghp_...`);
+      console.error(`  npx loophole-im link   # then tunnel`);
+      process.exit(1);
+    }
+  }
+
+  // verify checksum
+  try {
+    const shas = readFileSync(shaDest, "utf8");
+    const wanted = shas.split("\n").find((l) => l.includes(name));
+    if (!wanted) throw new Error(`no checksum for ${name}`);
+    const expected = wanted.split(/\s+/)[0];
+    const data = readFileSync(dest);
+    const actual = createHash("sha256").update(data).digest("hex");
+    if (actual !== expected) {
+      console.error(`checksum mismatch for ${name}: expected ${expected}, got ${actual}`);
+      process.exit(1);
+    }
+  } catch (e) {
+    console.error(`checksum verification failed: ${e.message}`);
+    process.exit(1);
+  }
+
+  chmodSync(dest, 0o755);
+  return dest;
+}
+
+async function downloadFile(url, dest, headers) {
+  const res = await fetch(url, { headers, redirect: "follow" });
+  if (!res.ok) throw new Error(`fetch ${url}: ${res.status} ${res.statusText}`);
+  const buf = Buffer.from(await res.arrayBuffer());
+  writeFileSync(dest, buf, { mode: 0o755 });
+  if (!existsSync(dest)) throw new Error(`failed to write ${dest}`);
+}
+
+async function main() {
+  const suffix = getSuffix();
+  let bin = findLocalBin(suffix);
+
+  // handle npx loophole-im with no args → default to tunnel (like npx t3)
+  let args = process.argv.slice(2);
+  if (args.length === 0) args = ["tunnel"];
+
+  if (!bin) {
+    // try to download
+    bin = await downloadBinary(suffix);
+  }
+
+  // spawn the real binary
+  const child = spawn(bin, args, { stdio: "inherit" });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (err) => {
+    console.error(`failed to spawn ${bin}: ${err.message}`);
+    process.exit(1);
+  });
+}
+
+await main();

package/bin/loophole.js

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { homedir, platform, arch } from "node:os";
+import { fileURLToPath } from "node:url";
+
+const REPO = process.env.LOOPHOLE_REPO ?? "Sir-Goose/loophole";
+const VERSION = await getVersion();
+
+const TARGETS = {
+  "darwin-arm64": "loophole-darwin-arm64",
+  "darwin-x64": "loophole-darwin-x64",
+  "linux-arm64": "loophole-linux-arm64",
+  "linux-x64": "loophole-linux-x64",
+  "windows-x64.exe": "loophole-windows-x64.exe",
+};
+
+function getSuffix() {
+  const os = platform();
+  const a = arch();
+  let key;
+  if (os === "darwin") key = `darwin-${a === "arm64" ? "arm64" : "x64"}`;
+  else if (os === "linux") key = `linux-${a === "arm64" ? "arm64" : "x64"}`;
+  else if (os === "win32" && a === "x64") key = "windows-x64.exe";
+  else {
+    console.error(`unsupported platform ${os}/${a} — see https://github.com/${REPO}/releases`);
+    process.exit(1);
+  }
+  if (!(key in TARGETS)) {
+    console.error(`unsupported target ${key}`);
+    process.exit(1);
+  }
+  return key;
+}
+
+async function getVersion() {
+  try {
+    const pkgPath = join(fileURLToPath(new URL(".", import.meta.url)), "..", "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return process.env.LOOPHOLE_VERSION ?? "0.0.0";
+  }
+}
+
+function binName(suffix) {
+  return TARGETS[suffix];
+}
+
+function localBinPaths(suffix) {
+  const name = binName(suffix);
+  const home = homedir();
+  return [
+    // bundled next to shim (if published with binaries)
+    join(fileURLToPath(new URL(".", import.meta.url)), name),
+    // dist from bun build --compile (local dev)
+    join(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..", "dist", name),
+    // cached in ~/.loophole/bin (where install.sh and cloudflared live)
+    join(home, ".loophole", "bin", name),
+    // also check without exe on windows fallback
+    join(home, ".loophole", "bin", name.replace(/\.exe$/, "")),
+  ];
+}
+
+function findLocalBin(suffix) {
+  for (const p of localBinPaths(suffix)) {
+    if (existsSync(p)) return p;
+  }
+  // also check PATH
+  const pathEnv = process.env.PATH ?? "";
+  for (const dir of pathEnv.split(":")) {
+    const cand = join(dir, "loophole");
+    if (existsSync(cand)) return cand;
+    const cand2 = join(dir, binName(suffix));
+    if (existsSync(cand2)) return cand2;
+  }
+  return null;
+}
+
+async function downloadBinary(suffix) {
+  const name = binName(suffix);
+  const version = VERSION;
+  const isPrivate = true; // repo is private until flipped public
+  const ghToken = process.env.GH_TOKEN;
+  const cacheDir = join(homedir(), ".loophole", "bin");
+  mkdirSync(cacheDir, { recursive: true });
+  const dest = join(cacheDir, name);
+  const shaDest = join(cacheDir, "SHA256SUMS");
+
+  // Use GitHub API if GH_TOKEN set (required for private repo), else try public download
+  const apiBase = "https://api.github.com";
+  const headers = { "Accept": "application/vnd.github+json" };
+  if (ghToken) headers["Authorization"] = `Bearer ${ghToken}`;
+
+  console.error(`downloading loophole ${version} (${suffix}) …`);
+
+  let binaryUrl;
+  let shaUrl;
+  if (ghToken) {
+    // api mode — fetch release json to get asset ids
+    const ref = version && version !== "0.0.0" ? `tags/v${version}` : "latest";
+    const releaseUrl = `${apiBase}/repos/${REPO}/releases/${ref}`;
+    const res = await fetch(releaseUrl, { headers });
+    if (!res.ok) {
+      console.error(`could not fetch release ${ref}: ${res.status} ${await res.text()}`);
+      process.exit(1);
+    }
+    const rel = await res.json();
+    const findAsset = (n) => rel.assets?.find((a) => a.name === n);
+    const asset = findAsset(name);
+    const shaAsset = findAsset("SHA256SUMS");
+    if (!asset || !shaAsset) {
+      console.error(`asset ${name} or SHA256SUMS not found in release ${rel.tag_name}`);
+      process.exit(1);
+    }
+    binaryUrl = asset.url;
+    shaUrl = shaAsset.url;
+    // GitHub API requires Accept: application/octet-stream for binary
+    await downloadFile(binaryUrl, dest, { ...headers, Accept: "application/octet-stream" });
+    await downloadFile(shaUrl, shaDest, headers);
+  } else {
+    // public mode — direct download (will 404 while repo private)
+    const base = version && version !== "0.0.0" && version !== "0.0.0-dev"
+      ? `https://github.com/${REPO}/releases/download/v${version}`
+      : `https://github.com/${REPO}/releases/latest/download`;
+    binaryUrl = `${base}/${name}`;
+    shaUrl = `${base}/SHA256SUMS`;
+    try {
+      await downloadFile(binaryUrl, dest, {});
+      await downloadFile(shaUrl, shaDest, {});
+    } catch (e) {
+      console.error(`could not download ${name} — repo is private, set GH_TOKEN to download`);
+      console.error(`  export GH_TOKEN=ghp_...`);
+      console.error(`  npx loophole-im link   # then tunnel`);
+      process.exit(1);
+    }
+  }
+
+  // verify checksum
+  try {
+    const shas = readFileSync(shaDest, "utf8");
+    const wanted = shas.split("\n").find((l) => l.includes(name));
+    if (!wanted) throw new Error(`no checksum for ${name}`);
+    const expected = wanted.split(/\s+/)[0];
+    const data = readFileSync(dest);
+    const actual = createHash("sha256").update(data).digest("hex");
+    if (actual !== expected) {
+      console.error(`checksum mismatch for ${name}: expected ${expected}, got ${actual}`);
+      process.exit(1);
+    }
+  } catch (e) {
+    console.error(`checksum verification failed: ${e.message}`);
+    process.exit(1);
+  }
+
+  chmodSync(dest, 0o755);
+  return dest;
+}
+
+async function downloadFile(url, dest, headers) {
+  const res = await fetch(url, { headers, redirect: "follow" });
+  if (!res.ok) throw new Error(`fetch ${url}: ${res.status} ${res.statusText}`);
+  const buf = Buffer.from(await res.arrayBuffer());
+  writeFileSync(dest, buf, { mode: 0o755 });
+  if (!existsSync(dest)) throw new Error(`failed to write ${dest}`);
+}
+
+async function main() {
+  const suffix = getSuffix();
+  let bin = findLocalBin(suffix);
+
+  // handle npx loophole-im with no args → default to tunnel (like npx t3)
+  let args = process.argv.slice(2);
+  if (args.length === 0) args = ["tunnel"];
+
+  if (!bin) {
+    // try to download
+    bin = await downloadBinary(suffix);
+  }
+
+  // spawn the real binary
+  const child = spawn(bin, args, { stdio: "inherit" });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (err) => {
+    console.error(`failed to spawn ${bin}: ${err.message}`);
+    process.exit(1);
+  });
+}
+
+await main();

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "loophole-im",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Tunnel local web apps so they're reachable from any signed-in instance — private Cloudflare Tunnels",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Sir-Goose/loophole"
+  },
+  "bin": {
+    "loophole-im": "bin/loophole-im.js",
+    "loophole": "bin/loophole.js"
+  },
+  "files": [
+    "bin"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "dev": "bun run src/index.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@loophole/contracts": "workspace:*",
+    "@types/bun": "latest",
+    "jose": "^5.9.6",
+    "typescript": "^5.7.2",
+    "zod": "^3.24.1"
+  }
+}