mindwire 0.1.2 → 0.1.3

package/dist/client.d.ts

@@ -102,7 +102,7 @@ export declare class Mindwire {
      * call before the target has connected (nothing to reap yet).
      */
     close(): Promise<void>;
-    /** `GET /healthz` — public liveness check. Resolves with the daemon's health payload when it is up. */
+    /** `GET /healthz` — authenticated liveness check. Resolves with the daemon's health payload when it is up. */
     health(): Promise<Health>;
     /**
      * `GET /stats` — the daemon **process's** resource snapshot (heap in use, memory reserved from the

package/dist/index.cjs

@@ -469,7 +469,7 @@ var Run = class _Run {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.1.2" ;
+var SDK_VERSION = "0.1.3" ;
 
 // src/daemon-binary.ts
 function supported(platform, arch) {
@@ -580,17 +580,19 @@ async function spawnDaemon(opts) {
   const { spawn } = await import('child_process');
   const net = await import('net');
   const proc = serverRuntime().process;
+  const { randomBytes } = await import('crypto');
   const resolved = await resolveBinary(opts.bin);
   const bin = resolved.bin;
   const port = await freePort(net);
   const baseUrl = `http://127.0.0.1:${port}`;
+  const token = randomBytes(32).toString("hex");
   const child = spawn(bin, [], {
     env: {
       ...proc.env,
       ADDR: `127.0.0.1:${port}`,
       AGENT_CWD: opts.cwd ?? proc.cwd(),
       STATE_PATH: opts.statePath ?? ".mindwire-state.json",
-      DAEMON_TOKEN: ""
+      DAEMON_TOKEN: token
     },
     stdio: "ignore"
   });
@@ -609,8 +611,8 @@ async function spawnDaemon(opts) {
     stop();
     proc.exit?.(130);
   });
-  await waitHealthy(baseUrl, () => spawnError, resolved);
-  return { baseUrl, stop };
+  await waitHealthy(baseUrl, token, () => spawnError, resolved);
+  return { baseUrl, token, stop };
 }
 async function resolveBinary(explicit) {
   const fs = await import('fs');
@@ -662,7 +664,7 @@ function freePort(net) {
     });
   });
 }
-async function waitHealthy(baseUrl, getError, resolved, timeoutMs = 15e3) {
+async function waitHealthy(baseUrl, token, getError, resolved, timeoutMs = 15e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     const err = getError();
@@ -670,7 +672,7 @@ async function waitHealthy(baseUrl, getError, resolved, timeoutMs = 15e3) {
       throw new MindwireError(daemonStartError(resolved, err), { cause: err });
     }
     try {
-      const res = await fetch(`${baseUrl}/healthz`);
+      const res = await fetch(`${baseUrl}/healthz`, { headers: { Authorization: `Bearer ${token}` } });
       if (res.ok) return;
     } catch {
     }
@@ -805,7 +807,7 @@ var Mindwire = class _Mindwire {
     if (h) await h.stop();
   }
   // ---- health & catalog ----------------------------------------------------
-  /** `GET /healthz` — public liveness check. Resolves with the daemon's health payload when it is up. */
+  /** `GET /healthz` — authenticated liveness check. Resolves with the daemon's health payload when it is up. */
   health() {
     return this.http.request("GET", "/healthz");
   }
@@ -1307,11 +1309,12 @@ var STATE = `${DAEMON_DIR}/agent-state.json`;
 var LOG = `${DAEMON_DIR}/daemon.log`;
 async function ensureDaemon(host, cfg) {
   const emit2 = makeEmit(cfg);
+  const token = cfg.token ?? (await import('crypto')).randomBytes(32).toString("hex");
   try {
     await waitHostReady(host);
     emit2({ phase: "connect", message: "runtime ready" });
     const desired = cfg.desiredVersion ?? SDK_VERSION;
-    const health = await probeHealth(host, cfg.port);
+    const health = await probeHealth(host, cfg.port, token);
     if (health.reachable) {
       emit2({
         phase: "probe",
@@ -1319,31 +1322,32 @@ async function ensureDaemon(host, cfg) {
         version: health.version
       });
       const upToDate = health.version !== void 0 && health.version === desired;
-      if (upToDate || !cfg.autoUpdate) {
+      if (!cfg.forceDeploy && (upToDate || !cfg.autoUpdate)) {
         emit2({
           phase: "skip",
           message: upToDate ? `daemon already at v${desired}` : "keeping the running daemon",
           version: health.version
         });
-        return;
+        return token;
       }
     } else {
       emit2({ phase: "probe", message: "no daemon reachable; deploying" });
     }
-    await deploy(host, cfg, emit2);
+    await deploy(host, cfg, emit2, token);
+    return token;
   } catch (err) {
     emit2({ phase: "error", message: "ensure failed", error: err instanceof Error ? err.message : String(err) });
     throw err;
   }
 }
-async function deploy(host, cfg, emit2) {
+async function deploy(host, cfg, emit2, token) {
   const arch = await probeArch(host);
   const desired = cfg.desiredVersion ?? SDK_VERSION;
   let acquire = "";
   if (cfg.daemonBin) {
     const binPath = await resolveLinuxDaemon(cfg.daemonBin, arch);
     const bytes = await readBytes(binPath);
-    emit2({ phase: "upload", message: `uploading daemon (${arch}, ${bytes.length} bytes)`, arch, bytes: bytes.length });
+    emit2({ phase: "upload", message: `uploading daemon (${arch}, ${formatMiB(bytes.length)})`, arch, bytes: bytes.length });
     await host.putFile(BIN_NEW, bytes, { mode: "0755" });
   } else {
     if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(desired)) {
@@ -1386,9 +1390,9 @@ async function deploy(host, cfg, emit2) {
     `mv -f ${BIN_NEW} ${BIN}`,
     `chmod +x ${BIN}`,
     // Detach so the daemon survives this exec's shell exiting. ADDR=":<port>" binds 0.0.0.0.
-    `setsid nohup env ADDR=":${cfg.port}" AGENT_TYPE="${cfg.agent}" AGENT_CWD="${cfg.agentCwd}" STATE_PATH="${STATE}" DAEMON_TOKEN="" ${BIN} > ${LOG} 2>&1 < /dev/null &`,
+    `setsid nohup env ADDR=":${cfg.port}" AGENT_TYPE="${cfg.agent}" AGENT_CWD="${cfg.agentCwd}" STATE_PATH="${STATE}" DAEMON_TOKEN=${shellQuote(token)} ${BIN} > ${LOG} 2>&1 < /dev/null &`,
     // Health-poll from inside the VM (loopback) and emit a marker — exit codes are unreliable here.
-    `for i in $(seq 1 60); do curl -fsS --max-time 2 http://127.0.0.1:${cfg.port}/healthz >/dev/null 2>&1 && { echo MINDWIRE_READY; exit 0; }; sleep 0.25; done`,
+    `for i in $(seq 1 60); do curl -fsS --max-time 2 -H ${shellQuote(`Authorization: Bearer ${token}`)} http://127.0.0.1:${cfg.port}/healthz >/dev/null 2>&1 && { echo MINDWIRE_READY; exit 0; }; sleep 0.25; done`,
     "echo MINDWIRE_FAIL",
     `tail -n 40 ${LOG} 2>/dev/null || true`
   ].join("\n");
@@ -1402,8 +1406,8 @@ async function deploy(host, cfg, emit2) {
   }
   emit2({ phase: "ready", message: "daemon deployed and healthy" });
 }
-async function probeHealth(host, port) {
-  const script = `out=$(curl -fsS --max-time 3 http://127.0.0.1:${port}/healthz 2>/dev/null) && printf '<<MW_H>>%s<<MW_H>>' "$out" || printf '<<MW_H>><<MW_H>>'`;
+async function probeHealth(host, port, token) {
+  const script = `out=$(curl -fsS --max-time 3 -H ${shellQuote(`Authorization: Bearer ${token}`)} http://127.0.0.1:${port}/healthz 2>/dev/null) && printf '<<MW_H>>%s<<MW_H>>' "$out" || printf '<<MW_H>><<MW_H>>'`;
   const res = await host.exec(["bash", "-lc", script], { timeoutSeconds: 15 });
   const body = ((res.stdout ?? "").match(/<<MW_H>>([\s\S]*?)<<MW_H>>/)?.[1] ?? "").trim();
   if (!body) return { reachable: false };
@@ -1439,10 +1443,11 @@ async function waitHostReady(host, timeoutMs = 6e4) {
 async function resolveLinuxDaemon(explicit, arch) {
   const fs = await import('fs');
   if (explicit) {
-    if (!fs.existsSync(explicit)) {
-      throw new MindwireError(`mindwire: sandbox daemonBin not found at ${explicit}`);
+    const resolved = explicit.replaceAll("{arch}", arch);
+    if (!fs.existsSync(resolved)) {
+      throw new MindwireError(`mindwire: sandbox daemonBin not found at ${resolved}`);
     }
-    return explicit;
+    return resolved;
   }
   return ensureDaemonBinary({ platform: "linux", arch: arch === "arm64" ? "arm64" : "x64" });
 }
@@ -1456,6 +1461,9 @@ function sleep(ms) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
+function formatMiB(bytes) {
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
 
 // src/target/container.ts
 async function provisionContainer(host, cfg, onLog) {
@@ -1469,7 +1477,7 @@ async function provisionContainer(host, cfg, onLog) {
   };
   await ensureDockerReady(host, cfg.install ?? "never", emit2);
   const { containerId, hostPort, created } = await runContainer(host, cfg, emit2);
-  await ensureDaemon(new ContainerHost(host, containerId), {
+  const token = await ensureDaemon(new ContainerHost(host, containerId), {
     port: cfg.daemonPort,
     agent: cfg.agent,
     agentCwd: cfg.agentCwd,
@@ -1488,7 +1496,7 @@ async function provisionContainer(host, cfg, onLog) {
     } catch {
     }
   };
-  return { containerId, hostPort, stop };
+  return { containerId, hostPort, token, stop };
 }
 var ContainerHost = class {
   constructor(base, containerId) {
@@ -1724,7 +1732,7 @@ async function connectSsh(opts, spec) {
   });
 }
 async function provisionSsh(client, makeTunnel, cfg) {
-  await ensureDaemon(new SshHost(client), {
+  const token = await ensureDaemon(new SshHost(client), {
     port: cfg.daemonPort,
     agent: cfg.agent,
     agentCwd: cfg.agentCwd,
@@ -1747,7 +1755,7 @@ async function provisionSsh(client, makeTunnel, cfg) {
       }
     }
   };
-  return { id: cfg.id, baseUrl: tunnel.baseUrl, stop };
+  return { id: cfg.id, baseUrl: tunnel.baseUrl, token, stop };
 }
 async function provisionSshContainer(client, makeTunnel, cfg) {
   const container = await provisionContainer(
@@ -1784,7 +1792,7 @@ async function provisionSshContainer(client, makeTunnel, cfg) {
       }
     }
   };
-  return { id: cfg.id, baseUrl: tunnel.baseUrl, stop };
+  return { id: cfg.id, baseUrl: tunnel.baseUrl, token: container.token, stop };
 }
 async function openConnection(mod, opts) {
   const auth = await buildAuth(opts);
@@ -1996,7 +2004,7 @@ async function provisionDocker(docker2, config = {}, onLog) {
       `mindwire: the Docker container does not publish a host port for ${port}/tcp. ` + (created ? "This is unexpected for a container mindwire created." : "Attach to a container started with that port published (e.g. `-p 0:" + port + "`).")
     );
   }
-  await ensureDaemon(new DockerHost(container), {
+  const token = await ensureDaemon(new DockerHost(container), {
     port,
     agent,
     agentCwd,
@@ -2015,7 +2023,7 @@ async function provisionDocker(docker2, config = {}, onLog) {
     } catch {
     }
   };
-  return { id: container.id, baseUrl: `http://127.0.0.1:${hostPort}`, stop };
+  return { id: container.id, baseUrl: `http://127.0.0.1:${hostPort}`, token, stop };
 }
 async function ensureImage(docker2, image, policy, onLog) {
   const emit2 = (message, error) => {
@@ -2152,26 +2160,31 @@ async function provisionOblien(client, config = {}, onLog) {
     const ws = await client.workspaces.create(params);
     workspaceId = ws.id;
   }
+  await config.onWorkspace?.(workspaceId);
   const handle = client.workspace(workspaceId);
   await handle.start().catch(() => {
   });
   let rt = await handle.runtime();
-  await ensureDaemon(new OblienHost(rt), {
+  const token = await ensureDaemon(new OblienHost(rt), {
     port,
     agent,
     agentCwd,
     daemonBin: config.daemonBin,
     autoUpdate: config.autoUpdate,
+    forceDeploy: config.forceDeploy,
     target: "oblien",
     onLog
   });
   const fetchImpl = async (url, init) => {
     const { pathname, search } = new URL(url);
     const path = pathname + search;
-    let res = await rt.proxy(port).fetch(path, init);
+    const headers = new Headers(init?.headers);
+    headers.set("X-Mindwire-Token", token);
+    headers.delete("Authorization");
+    let res = await rt.proxy(port).fetch(path, { ...init, headers });
     if (res.status === 401) {
       rt = await handle.runtime({ force: true });
-      res = await rt.proxy(port).fetch(path, init);
+      res = await rt.proxy(port).fetch(path, { ...init, headers });
     }
     return res;
   };
@@ -2182,7 +2195,7 @@ async function provisionOblien(client, config = {}, onLog) {
     } catch {
     }
   };
-  return { id: workspaceId, workspaceId, baseUrl: SENTINEL_BASE, fetch: fetchImpl, stop };
+  return { id: workspaceId, workspaceId, baseUrl: SENTINEL_BASE, token, fetch: fetchImpl, stop };
 }
 async function importOblien() {
   const spec = "oblien";