nexus-agentd 0.1.0 → 0.1.6

package/dist/artifact-store.js

@@ -0,0 +1,340 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { createWriteStream } from 'node:fs';
+import { chmod, mkdir, open, readdir, rename, rm, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+export class ArtifactStoreError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export class GatewayArtifactStore {
+    directory;
+    ttlMs;
+    maxBytes;
+    maxStorageBytes;
+    maxFiles;
+    maxConcurrentPublishes;
+    byCacheKey = new Map();
+    cleanupTimer;
+    capacityQueue = Promise.resolve();
+    activePublishes = 0;
+    reservedBytes = 0;
+    reservedFiles = 0;
+    constructor(directory, ttlMs, maxBytes, maxStorageBytes = Math.max(maxBytes, 4 * 1024 * 1024 * 1024), maxFiles = 4096, maxConcurrentPublishes = 4) {
+        this.directory = directory;
+        this.ttlMs = ttlMs;
+        this.maxBytes = maxBytes;
+        this.maxStorageBytes = maxStorageBytes;
+        this.maxFiles = maxFiles;
+        this.maxConcurrentPublishes = maxConcurrentPublishes;
+    }
+    startCleanup(intervalMs = Math.min(this.ttlMs, 60 * 60 * 1000)) {
+        if (this.cleanupTimer)
+            return;
+        void this.cleanup().catch((error) => {
+            console.error(`[nexus-agentd] initial artifact cleanup failed: ${errorMessage(error)}`);
+        });
+        this.cleanupTimer = setInterval(() => {
+            void this.cleanup().catch((error) => {
+                console.error(`[nexus-agentd] artifact cleanup failed: ${errorMessage(error)}`);
+            });
+        }, Math.max(60_000, intervalMs));
+        this.cleanupTimer.unref?.();
+    }
+    stopCleanup() {
+        if (this.cleanupTimer)
+            clearInterval(this.cleanupTimer);
+        this.cleanupTimer = undefined;
+    }
+    async publishFile(filePath, preferredName, mediaType) {
+        const handle = await open(filePath, 'r');
+        try {
+            return await this.publishHandle(handle, preferredName || path.basename(filePath), mediaType);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async publishHandle(handle, preferredName, mediaType) {
+        const details = await handle.stat();
+        if (!details.isFile())
+            throw new ArtifactStoreError(400, 'Only regular files can be published');
+        if (details.size > this.maxBytes)
+            throw new ArtifactStoreError(413, 'File exceeds the publish size limit');
+        return this.publishStream(handle.createReadStream({ autoClose: false }), preferredName, mediaType, details.size);
+    }
+    async publishBytes(bytes, preferredName, mediaType, cacheKey) {
+        if (bytes.byteLength > this.maxBytes) {
+            throw new ArtifactStoreError(413, 'File exceeds the publish size limit');
+        }
+        const { Readable } = await import('node:stream');
+        return this.publishStream(Readable.from([bytes]), preferredName, mediaType, bytes.byteLength, cacheKey);
+    }
+    async publishStream(input, preferredName, mediaType, declaredSize, cacheKey) {
+        if (declaredSize !== undefined && declaredSize > this.maxBytes) {
+            throw new ArtifactStoreError(413, 'File exceeds the publish size limit');
+        }
+        await this.ensureDirectory();
+        const releaseCapacity = await this.reserveCapacity(declaredSize ?? this.maxBytes);
+        const name = safeFilename(preferredName);
+        const temporary = path.join(this.directory, `.upload-${randomUUID()}`);
+        const hash = createHash('sha256');
+        let size = 0;
+        const meter = new Transform({
+            transform: (chunk, _encoding, callback) => {
+                size += chunk.length;
+                if (size > this.maxBytes) {
+                    callback(new ArtifactStoreError(413, 'File exceeds the publish size limit'));
+                    return;
+                }
+                hash.update(chunk);
+                callback(null, chunk);
+            }
+        });
+        try {
+            await pipeline(input, meter, createWriteStream(temporary, { flags: 'wx', mode: 0o600 }));
+            const sha256 = hash.digest('hex');
+            const cacheId = cacheKey ? `${cacheKey}\0${sha256}` : undefined;
+            const existing = cacheId ? this.byCacheKey.get(cacheId) : undefined;
+            if (existing && (await this.isAvailable(existing))) {
+                await rm(temporary, { force: true });
+                return publicView(existing);
+            }
+            const id = randomBytes(32).toString('hex');
+            const expiresAt = Date.now() + this.ttlMs;
+            const filePath = path.join(this.directory, storedFilename(id, expiresAt, name));
+            await rename(temporary, filePath);
+            const stored = {
+                id,
+                name,
+                url: artifactUrl(id, expiresAt, name),
+                size,
+                mediaType: mediaType || mediaTypeForName(name),
+                sha256,
+                expiresAt,
+                filePath
+            };
+            if (cacheId)
+                this.byCacheKey.set(cacheId, stored);
+            return publicView(stored);
+        }
+        catch (error) {
+            await rm(temporary, { force: true }).catch(() => undefined);
+            throw error;
+        }
+        finally {
+            releaseCapacity();
+        }
+    }
+    async open(id, expiresInput, requestedName) {
+        if (!/^[a-f0-9]{64}$/.test(id))
+            throw new ArtifactStoreError(404, 'Artifact not found');
+        const expiresAt = Number(expiresInput);
+        if (!Number.isSafeInteger(expiresAt) || expiresAt <= Date.now()) {
+            throw new ArtifactStoreError(404, 'Artifact not found');
+        }
+        const name = safeFilename(requestedName);
+        if (name !== requestedName)
+            throw new ArtifactStoreError(404, 'Artifact not found');
+        const filePath = path.join(this.directory, storedFilename(id, expiresAt, name));
+        let handle;
+        try {
+            handle = await open(filePath, 'r');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                throw new ArtifactStoreError(404, 'Artifact not found');
+            }
+            throw error;
+        }
+        let details;
+        try {
+            details = await handle.stat();
+        }
+        catch (error) {
+            await handle.close();
+            throw error;
+        }
+        if (!details.isFile()) {
+            await handle.close();
+            throw new ArtifactStoreError(404, 'Artifact not found');
+        }
+        return {
+            id,
+            name,
+            url: artifactUrl(id, expiresAt, name),
+            size: details.size,
+            mediaType: mediaTypeForName(name),
+            sha256: '',
+            expiresAt,
+            filePath,
+            handle
+        };
+    }
+    async cleanup() {
+        await this.ensureDirectory();
+        const now = Date.now();
+        const names = await readdir(this.directory);
+        await Promise.all(names.map(async (name) => {
+            const filePath = path.join(this.directory, name);
+            try {
+                const parsed = parseStoredFilename(name);
+                if (parsed?.expiresAt !== undefined && parsed.expiresAt <= now) {
+                    await rm(filePath, { force: true });
+                    return;
+                }
+                if (name.startsWith('.upload-')) {
+                    const details = await stat(filePath);
+                    if (details.mtimeMs + Math.max(this.ttlMs, 60 * 60 * 1000) <= now) {
+                        await rm(filePath, { force: true });
+                    }
+                }
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }));
+        for (const [cacheId, artifact] of this.byCacheKey) {
+            if (artifact.expiresAt <= now)
+                this.byCacheKey.delete(cacheId);
+        }
+    }
+    async ensureDirectory() {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        if (process.platform !== 'win32')
+            await chmod(this.directory, 0o700);
+    }
+    async isAvailable(artifact) {
+        if (artifact.expiresAt <= Date.now())
+            return false;
+        try {
+            const details = await stat(artifact.filePath);
+            return details.isFile();
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+    }
+    async reserveCapacity(expectedBytes) {
+        let unlock;
+        const previous = this.capacityQueue;
+        this.capacityQueue = new Promise((resolve) => {
+            unlock = resolve;
+        });
+        await previous;
+        try {
+            if (this.activePublishes >= this.maxConcurrentPublishes) {
+                throw new ArtifactStoreError(429, 'Artifact publish concurrency limit reached');
+            }
+            const usage = await this.storageUsage();
+            if (usage.bytes + this.reservedBytes + expectedBytes > this.maxStorageBytes) {
+                throw new ArtifactStoreError(507, 'Artifact storage capacity reached');
+            }
+            if (usage.files + this.reservedFiles + 1 > this.maxFiles) {
+                throw new ArtifactStoreError(507, 'Artifact file count limit reached');
+            }
+            this.activePublishes += 1;
+            this.reservedBytes += expectedBytes;
+            this.reservedFiles += 1;
+        }
+        finally {
+            unlock();
+        }
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.activePublishes = Math.max(0, this.activePublishes - 1);
+            this.reservedBytes = Math.max(0, this.reservedBytes - expectedBytes);
+            this.reservedFiles = Math.max(0, this.reservedFiles - 1);
+        };
+    }
+    async storageUsage() {
+        await this.ensureDirectory();
+        const now = Date.now();
+        let bytes = 0;
+        let files = 0;
+        for (const name of await readdir(this.directory)) {
+            const parsed = parseStoredFilename(name);
+            if (parsed?.expiresAt !== undefined && parsed.expiresAt <= now) {
+                await rm(path.join(this.directory, name), { force: true });
+                continue;
+            }
+            try {
+                const details = await stat(path.join(this.directory, name));
+                if (!details.isFile())
+                    continue;
+                bytes += details.size;
+                files += 1;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        return { bytes, files };
+    }
+}
+export function contentDisposition(name) {
+    const ascii = name.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
+    return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+export function mediaTypeForName(name) {
+    const types = {
+        '.avif': 'image/avif',
+        '.csv': 'text/csv; charset=utf-8',
+        '.gif': 'image/gif',
+        '.html': 'text/html; charset=utf-8',
+        '.jpeg': 'image/jpeg',
+        '.jpg': 'image/jpeg',
+        '.json': 'application/json; charset=utf-8',
+        '.md': 'text/markdown; charset=utf-8',
+        '.mp3': 'audio/mpeg',
+        '.mp4': 'video/mp4',
+        '.ogg': 'audio/ogg',
+        '.pdf': 'application/pdf',
+        '.png': 'image/png',
+        '.svg': 'image/svg+xml',
+        '.txt': 'text/plain; charset=utf-8',
+        '.wav': 'audio/wav',
+        '.webm': 'video/webm',
+        '.webp': 'image/webp',
+        '.zip': 'application/zip'
+    };
+    return types[path.extname(name).toLowerCase()] || 'application/octet-stream';
+}
+function artifactUrl(id, expiresAt, name) {
+    return `/v1/artifacts/${id}/${expiresAt}/${encodeURIComponent(name)}`;
+}
+function storedFilename(id, expiresAt, name) {
+    return `${id}-${expiresAt}-${name}`;
+}
+function parseStoredFilename(value) {
+    const match = /^([a-f0-9]{64})-(\d+)-(.+)$/.exec(value);
+    if (!match)
+        return undefined;
+    const expiresAt = Number(match[2]);
+    if (!Number.isSafeInteger(expiresAt))
+        return undefined;
+    return { id: match[1], expiresAt, name: match[3] };
+}
+function safeFilename(value) {
+    const basename = path.basename(String(value || 'artifact').replace(/\\/g, '/'));
+    const safe = basename.replace(/[<>:"/\\|?*\u0000-\u001f]/g, '_').trim().slice(0, 180);
+    return safe || 'artifact';
+}
+function publicView(value) {
+    const { filePath: _filePath, handle: _handle, ...result } = value;
+    return result;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/auth.d.ts

@@ -0,0 +1,13 @@
+export declare function hashAdminPassword(input: string): Promise<string>;
+export declare function verifyAdminPassword(input: string, encoded?: string): Promise<boolean>;
+export declare function validateAdminPassword(input: string): string;
+export declare class AdminSessionStore {
+    private readonly ttlMs;
+    private readonly sessions;
+    constructor(ttlMs: number);
+    create(): string;
+    has(id: string): boolean;
+    delete(id: string): void;
+    clear(): void;
+    private cleanup;
+}

package/dist/auth.js

@@ -0,0 +1,77 @@
+import { randomBytes, scrypt as scryptCallback, timingSafeEqual } from 'node:crypto';
+import { promisify } from 'node:util';
+const scrypt = promisify(scryptCallback);
+const KEY_LENGTH = 64;
+const PASSWORD_MIN_LENGTH = 12;
+export async function hashAdminPassword(input) {
+    const password = validateAdminPassword(input);
+    const salt = randomBytes(16);
+    const derived = (await scrypt(password, salt, KEY_LENGTH));
+    return `scrypt$${salt.toString('base64url')}$${derived.toString('base64url')}`;
+}
+export async function verifyAdminPassword(input, encoded) {
+    if (!encoded)
+        return false;
+    const [algorithm, saltValue, hashValue, extra] = encoded.split('$');
+    if (algorithm !== 'scrypt' || !saltValue || !hashValue || extra !== undefined) {
+        return false;
+    }
+    try {
+        const expected = Buffer.from(hashValue, 'base64url');
+        if (expected.length !== KEY_LENGTH)
+            return false;
+        const actual = (await scrypt(input, Buffer.from(saltValue, 'base64url'), expected.length));
+        return timingSafeEqual(actual, expected);
+    }
+    catch {
+        return false;
+    }
+}
+export function validateAdminPassword(input) {
+    const value = typeof input === 'string' ? input : '';
+    if (value.length < PASSWORD_MIN_LENGTH) {
+        throw new Error(`Console Password must contain at least ${PASSWORD_MIN_LENGTH} characters`);
+    }
+    if (Buffer.byteLength(value, 'utf8') > 1024) {
+        throw new Error('Console Password must not exceed 1024 bytes');
+    }
+    if (/\u0000/.test(value))
+        throw new Error('Console Password must not contain NUL bytes');
+    return value;
+}
+export class AdminSessionStore {
+    ttlMs;
+    sessions = new Map();
+    constructor(ttlMs) {
+        this.ttlMs = ttlMs;
+    }
+    create() {
+        this.cleanup();
+        const id = randomBytes(32).toString('base64url');
+        this.sessions.set(id, Date.now() + this.ttlMs);
+        return id;
+    }
+    has(id) {
+        const expiresAt = this.sessions.get(id);
+        if (!expiresAt)
+            return false;
+        if (expiresAt <= Date.now()) {
+            this.sessions.delete(id);
+            return false;
+        }
+        return true;
+    }
+    delete(id) {
+        this.sessions.delete(id);
+    }
+    clear() {
+        this.sessions.clear();
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [id, expiresAt] of this.sessions) {
+            if (expiresAt <= now)
+                this.sessions.delete(id);
+        }
+    }
+}

package/dist/cli.js

@@ -1,13 +1,30 @@
 #!/usr/bin/env node
 import path from 'node:path';
+import { networkInterfaces } from 'node:os';
+import { ensureAgentdConfig } from './config.js';
 import { startAgentd } from './index.js';
-const configPath = resolveConfigPath(process.argv.slice(2));
+const args = process.argv.slice(2);
+const configPath = resolveConfigPath(args);
+const bootstrap = await ensureAgentdConfig(configPath, {
+    host: option(args, '--host'),
+    port: numberOption(args, '--port'),
+    workspace: option(args, '--workspace')
+});
 const runtime = await startAgentd(configPath);
 const address = runtime.server.address();
 const label = typeof address === 'object' && address
     ? `${address.address}:${address.port}`
     : String(address);
 console.log(`nexus-agentd listening on ${label}`);
+for (const url of displayUrls(address))
+    console.log(`WebUI: ${url}`);
+if (bootstrap.created) {
+    console.log(`Created config: ${configPath}`);
+    console.log('Setup required: open the WebUI and create the Console Password.');
+    if (runtime.config.listen.host !== '127.0.0.1' && runtime.config.listen.host !== '::1') {
+        console.warn('WARNING: first-run setup is reachable over the network; initialize it immediately on a trusted network.');
+    }
+}
 let closing = false;
 const close = async () => {
     if (closing)
@@ -22,3 +39,43 @@ function resolveConfigPath(args) {
     const value = index >= 0 ? args[index + 1] : process.env.NEXUS_AGENTD_CONFIG;
     return path.resolve(value || 'nexus-agentd.json');
 }
+function option(args, name) {
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function numberOption(args, name) {
+    const value = option(args, name);
+    if (value === undefined)
+        return undefined;
+    const number = Number(value);
+    if (!Number.isInteger(number))
+        throw new Error(`${name} must be an integer`);
+    return number;
+}
+function displayHost(address) {
+    if (!address || typeof address === 'string')
+        return '127.0.0.1';
+    if (address.address === '0.0.0.0' || address.address === '::') {
+        return '127.0.0.1';
+    }
+    return address.family === 'IPv6' ? `[${address.address}]` : address.address;
+}
+function displayPort(address) {
+    return address && typeof address === 'object' ? address.port : runtime.config.listen.port;
+}
+function displayUrls(address) {
+    const port = displayPort(address);
+    if (address &&
+        typeof address === 'object' &&
+        (address.address === '0.0.0.0' || address.address === '::')) {
+        const hosts = new Set(['127.0.0.1']);
+        for (const entries of Object.values(networkInterfaces())) {
+            for (const entry of entries || []) {
+                if (entry.family === 'IPv4' && !entry.internal)
+                    hosts.add(entry.address);
+            }
+        }
+        return Array.from(hosts).map((host) => `http://${host}:${port}/ui/`);
+    }
+    return [`http://${displayHost(address)}:${port}/ui/`];
+}

package/dist/config.d.ts

@@ -1,3 +1,13 @@
 import { type AgentdConfig } from './types.js';
+export interface AgentdBootstrapOptions {
+    host?: string;
+    port?: number;
+    workspace?: string;
+}
+export declare function ensureAgentdConfig(filePath: string, options?: AgentdBootstrapOptions): Promise<{
+    created: false;
+} | {
+    created: true;
+}>;
 export declare function loadAgentdConfig(filePath: string): Promise<AgentdConfig>;
 export declare function resolveSecret(value: string): string;