nolo-cli 0.1.26 → 0.1.29

package/server/handlers/machines/machineAuth.ts

@@ -0,0 +1,149 @@
+import { randomBytes, createHash } from "node:crypto";
+
+export const MACHINE_TOKEN_PREFIX = "sk_machine_";
+
+type MachineTokenDb = {
+  get(key: string): Promise<any>;
+  put(key: string, value: any): Promise<unknown>;
+};
+
+export type MachineTokenRecord = {
+  userId: string;
+  name: string | null;
+  createdAt: number;
+  lastUsedAt?: number;
+  machineId?: string;
+  boundAt?: number;
+  revokedAt?: number;
+  revokedMachineId?: string;
+};
+
+export type MachineAuthResult = { userId: string; machineToken: true; tokenHash: string } | null | Response;
+
+const tokenKey = (tokenHash: string) => `machine-token:${tokenHash}`;
+const machineTokenBindingKey = (userId: string, machineId: string) =>
+  `machine-token-binding:${userId}:${machineId}`;
+
+async function importServerDb() {
+  const load = new Function("specifier", "return import(specifier)") as (
+    specifier: string
+  ) => Promise<{ default: MachineTokenDb }>;
+  return load("database/server/db");
+}
+
+function authErrorResponse(message: string, code: string, status: number) {
+  return new Response(JSON.stringify({ error: message, code }), {
+    status,
+    headers: { "Content-Type": "application/json; charset=utf-8" },
+  });
+}
+
+export function extractBearerToken(req: Request) {
+  const header = req.headers.get("authorization") ?? req.headers.get("Authorization") ?? "";
+  const match = header.match(/^Bearer\s+(.+)$/i);
+  return match?.[1]?.trim() || "";
+}
+
+export function isMachineToken(token: string) {
+  return token.startsWith(MACHINE_TOKEN_PREFIX);
+}
+
+export function hashMachineToken(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export async function issueMachineToken(args: {
+  userId: string;
+  name?: string | null;
+  now?: number;
+  db?: MachineTokenDb;
+  random?: (size: number) => Buffer;
+}) {
+  const db = args.db ?? (await importServerDb()).default;
+  const random = args.random ?? randomBytes;
+  const apiKey = `${MACHINE_TOKEN_PREFIX}${random(24).toString("hex")}`;
+  const record: MachineTokenRecord = {
+    userId: args.userId,
+    name: args.name?.trim() || null,
+    createdAt: args.now ?? Date.now(),
+  };
+  await db.put(tokenKey(hashMachineToken(apiKey)), record);
+  return { apiKey, record };
+}
+
+export async function authenticateMachineToken(
+  req: Request,
+  deps: { db?: MachineTokenDb; now?: number } = {}
+): Promise<MachineAuthResult> {
+  const token = extractBearerToken(req);
+  if (!isMachineToken(token)) return null;
+
+  const db = deps.db ?? (await importServerDb()).default;
+  const hash = hashMachineToken(token);
+  const record = (await db.get(tokenKey(hash)).catch(() => null)) as MachineTokenRecord | null;
+  if (!record?.userId) {
+    return authErrorResponse("Invalid machine token.", "AUTH_MACHINE_TOKEN_INVALID", 401);
+  }
+  if (record.revokedAt) {
+    return authErrorResponse("Machine token has been revoked.", "AUTH_MACHINE_TOKEN_REVOKED", 401);
+  }
+
+  await db.put(tokenKey(hash), {
+    ...record,
+    lastUsedAt: deps.now ?? Date.now(),
+  }).catch(() => {});
+
+  return { userId: record.userId, machineToken: true, tokenHash: hash };
+}
+
+export async function bindMachineTokenToMachine(args: {
+  userId: string;
+  tokenHash: string;
+  machineId: string;
+  now?: number;
+  db?: MachineTokenDb;
+}) {
+  const db = args.db ?? (await importServerDb()).default;
+  const now = args.now ?? Date.now();
+  const key = tokenKey(args.tokenHash);
+  const record = (await db.get(key).catch(() => null)) as MachineTokenRecord | null;
+  if (!record?.userId || record.userId !== args.userId || record.revokedAt) return false;
+
+  await db.put(machineTokenBindingKey(args.userId, args.machineId), {
+    tokenHash: args.tokenHash,
+    boundAt: now,
+  });
+  await db.put(key, {
+    ...record,
+    machineId: args.machineId,
+    boundAt: now,
+  });
+  return true;
+}
+
+export async function revokeMachineTokenForMachine(args: {
+  userId: string;
+  machineId: string;
+  now?: number;
+  db?: MachineTokenDb;
+}) {
+  const db = args.db ?? (await importServerDb()).default;
+  const binding = await db
+    .get(machineTokenBindingKey(args.userId, args.machineId))
+    .catch(() => null) as { tokenHash?: string } | null;
+  const tokenHash = typeof binding?.tokenHash === "string" ? binding.tokenHash : "";
+  if (!tokenHash) return { revoked: false, tokenHash: "" };
+
+  const key = tokenKey(tokenHash);
+  const record = (await db.get(key).catch(() => null)) as MachineTokenRecord | null;
+  if (!record?.userId || record.userId !== args.userId) {
+    return { revoked: false, tokenHash };
+  }
+
+  await db.put(key, {
+    ...record,
+    revokedAt: args.now ?? Date.now(),
+    revokedMachineId: args.machineId,
+  });
+  return { revoked: true, tokenHash };
+}

package/server/handlers/machines/machineBinding.ts

@@ -0,0 +1,59 @@
+import type { MachineSummary } from "./machineRegistry";
+
+export type RuntimeBinding = {
+  machineId?: string | null;
+  requiredCapabilities?: string[] | null;
+};
+
+export type RuntimeBindingResult =
+  | { ok: true; machine: MachineSummary }
+  | { ok: false; reason: "bound_machine_unavailable" | "bound_machine_missing_capability"; message: string };
+
+function normalizeString(value: unknown) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function normalizeRequiredCapabilities(binding?: RuntimeBinding | null) {
+  const requiredCapabilities = Array.isArray(binding?.requiredCapabilities)
+    ? binding.requiredCapabilities
+        .map((item) => normalizeString(item))
+        .filter(Boolean)
+    : [];
+  return [...new Set(requiredCapabilities)];
+}
+
+export function resolveRuntimeBinding(args: {
+  binding?: RuntimeBinding | null;
+  requiredCapabilities?: string[];
+  machines: MachineSummary[];
+}): RuntimeBindingResult {
+  const machineId = normalizeString(args.binding?.machineId);
+  const machine = args.machines.find(
+    (candidate) => candidate.machineId === machineId && candidate.status === "online"
+  );
+
+  if (!machine) {
+    return {
+      ok: false,
+      reason: "bound_machine_unavailable",
+      message: `Bound runtime machine is not online: ${machineId || "unknown"}.`,
+    };
+  }
+
+  const requiredCapabilities = [
+    ...normalizeRequiredCapabilities(args.binding),
+    ...(args.requiredCapabilities ?? []),
+  ];
+  const missingCapability = [...new Set(requiredCapabilities)].find(
+    (capability) => !machine.capabilities.includes(capability)
+  );
+  if (missingCapability) {
+    return {
+      ok: false,
+      reason: "bound_machine_missing_capability",
+      message: `Bound runtime machine ${machine.machineId} is missing capability: ${missingCapability}.`,
+    };
+  }
+
+  return { ok: true, machine };
+}

package/server/handlers/machines/machineHandlers.ts

@@ -0,0 +1,279 @@
+import { normalizeMachineHeartbeat } from "../../../connector-experimental/protocol";
+import {
+  authenticateMachineToken,
+  bindMachineTokenToMachine,
+  issueMachineToken,
+  revokeMachineTokenForMachine,
+} from "./machineAuth";
+import {
+  type MachineRegistry,
+  machineRegistry,
+  serializeMachineSummary,
+} from "./machineRegistry";
+import { getMachineInstallAsset } from "./machineInstallAssets";
+import { connectorConnectionRegistry } from "../connector/connectorConnectionRegistry";
+
+const JSON_HEADERS: Record<string, string> = {
+  "Content-Type": "application/json; charset=utf-8",
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+};
+
+type AuthResult = { userId: string; machineToken?: true; tokenHash?: string } | Response;
+
+type MachineHandlerDeps = {
+  registry?: MachineRegistry;
+  connectorRegistry?: Pick<typeof connectorConnectionRegistry, "hasConnection" | "sendAgentRun" | "unregister">;
+  authenticate?: (req: Request) => Promise<AuthResult>;
+  authenticateMachine?: typeof authenticateMachineToken;
+  issueToken?: typeof issueMachineToken;
+  bindMachineToken?: typeof bindMachineTokenToMachine;
+  revokeMachineToken?: typeof revokeMachineTokenForMachine;
+};
+
+type SmokeCliProvider = "codex" | "copilot" | "claude" | "agy" | "gemini";
+
+const SMOKE_CAPABILITY_BY_PROVIDER: Record<SmokeCliProvider, string> = {
+  codex: "codex-cli",
+  copilot: "copilot-cli",
+  claude: "claude-code",
+  agy: "agy-cli",
+  gemini: "gemini-cli",
+};
+
+function normalizeSmokeProvider(value: unknown): SmokeCliProvider | null {
+  if (
+    value === "codex" ||
+    value === "copilot" ||
+    value === "claude" ||
+    value === "agy" ||
+    value === "gemini"
+  ) {
+    return value;
+  }
+  return null;
+}
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+
+function text(body: string, contentType: string) {
+  return new Response(body, {
+    headers: {
+      "Content-Type": contentType,
+      "Cache-Control": "no-store",
+      "Access-Control-Allow-Origin": "*",
+    },
+  });
+}
+
+async function defaultAuthenticate(req: Request): Promise<AuthResult> {
+  const load = new Function("specifier", "return import(specifier)") as (
+    specifier: string
+  ) => Promise<any>;
+  const { authenticateRequest } = await load("auth/utils");
+  const result = await authenticateRequest(req);
+  if (result instanceof Response) return result;
+  return { userId: result.userId };
+}
+
+export function createMachineHandlers(deps: MachineHandlerDeps = {}) {
+  const registry = deps.registry ?? machineRegistry;
+  const connectorRegistry = deps.connectorRegistry ?? connectorConnectionRegistry;
+  const authenticate = deps.authenticate ?? defaultAuthenticate;
+  const authenticateMachine = deps.authenticateMachine ?? authenticateMachineToken;
+  const issueToken = deps.issueToken ?? issueMachineToken;
+  const bindMachineToken = deps.bindMachineToken ?? bindMachineTokenToMachine;
+  const revokeMachineToken = deps.revokeMachineToken ?? revokeMachineTokenForMachine;
+
+  async function authenticateUserOrMachine(req: Request): Promise<AuthResult> {
+    const machineAuth = await authenticateMachine(req);
+    if (machineAuth instanceof Response) return machineAuth;
+    if (machineAuth) return machineAuth;
+    return authenticate(req);
+  }
+
+  return {
+    handleMachineInstallAsset(req: Request) {
+      const asset = getMachineInstallAsset(new URL(req.url).pathname);
+      if (!asset) return json({ error: "Unknown machine install asset" }, 404);
+      return text(asset.body, asset.contentType);
+    },
+
+    async handleMachineHeartbeat(req: Request) {
+      const auth = await authenticateUserOrMachine(req);
+      if (auth instanceof Response) return auth;
+
+      let body: unknown;
+      try {
+        body = await req.json();
+      } catch {
+        return json({ error: "Invalid JSON body" }, 400);
+      }
+
+      try {
+        const heartbeat = normalizeMachineHeartbeat(
+          body && typeof body === "object" ? body : {}
+        );
+        const record = registry.recordHeartbeat(auth.userId, heartbeat);
+        if (auth.machineToken && auth.tokenHash) {
+          await bindMachineToken({
+            userId: auth.userId,
+            tokenHash: auth.tokenHash,
+            machineId: heartbeat.machineId,
+          });
+        }
+        return json({ ok: true, machine: serializeMachineSummary(record) });
+      } catch (error) {
+        return json(
+          { error: error instanceof Error ? error.message : String(error) },
+          400
+        );
+      }
+    },
+
+    async handleMachineList(req: Request) {
+      const auth = await authenticate(req);
+      if (auth instanceof Response) return auth;
+      return json({
+        machines: registry.listMachines(auth.userId).map((record) => {
+          const summary = serializeMachineSummary(record);
+          return {
+            ...summary,
+            connectorStatus: connectorRegistry.hasConnection(auth.userId, summary.machineId)
+              ? "connected"
+              : "disconnected",
+          };
+        }),
+      });
+    },
+
+    async handleMachineTokenCreate(req: Request) {
+      const auth = await authenticate(req);
+      if (auth instanceof Response) return auth;
+
+      let body: any = {};
+      try {
+        body = req.body ? await req.json() : {};
+      } catch {
+        return json({ error: "Invalid JSON body" }, 400);
+      }
+
+      const { apiKey, record } = await issueToken({
+        userId: auth.userId,
+        name: typeof body?.name === "string" ? body.name : null,
+      });
+      return json({
+        ok: true,
+        apiKey,
+        token: {
+          name: record.name,
+          createdAt: record.createdAt,
+        },
+      });
+    },
+
+    async handleMachineDisconnect(req: Request) {
+      const auth = await authenticate(req);
+      if (auth instanceof Response) return auth;
+
+      const url = new URL(req.url);
+      const machineId = decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "").trim();
+      if (!machineId || machineId === "machines") return json({ error: "machineId is required" }, 400);
+
+      const removed = registry.removeMachine(auth.userId, machineId);
+      
+      if (removed) {
+        connectorRegistry.unregister?.(auth.userId, machineId);
+        const revoked = await revokeMachineToken({
+          userId: auth.userId,
+          machineId,
+        });
+        return json({
+          ok: true,
+          machineId,
+          removed,
+          tokenRevoked: revoked.revoked,
+        });
+      }
+
+      return json({
+        ok: true,
+        machineId,
+        removed: false,
+        tokenRevoked: false,
+      });
+    },
+
+    async handleMachineSmokeRun(req: Request) {
+      const auth = await authenticateUserOrMachine(req);
+      if (auth instanceof Response) return auth;
+
+      let body: any = {};
+      try {
+        body = req.body ? await req.json() : {};
+      } catch {
+        return json({ error: "Invalid JSON body" }, 400);
+      }
+
+      const machineId = typeof body?.machineId === "string" ? body.machineId.trim() : "";
+      const cliProvider = normalizeSmokeProvider(body?.cliProvider);
+      if (!machineId) return json({ error: "machineId is required" }, 400);
+      if (!cliProvider) return json({ error: "Unsupported CLI provider" }, 400);
+
+      const machine = registry
+        .listMachines(auth.userId)
+        .find((record) => record.machineId === machineId);
+      if (!machine) return json({ error: "Machine not found" }, 404);
+      if (machine.status !== "online") return json({ error: "Machine is offline" }, 409);
+      if (!connectorRegistry.hasConnection(auth.userId, machineId)) {
+        return json({ error: "Machine connector is not connected" }, 409);
+      }
+
+      const requiredCapability = SMOKE_CAPABILITY_BY_PROVIDER[cliProvider];
+      if (!machine.capabilities.includes(requiredCapability)) {
+        return json({ error: `Machine is missing capability: ${requiredCapability}` }, 409);
+      }
+
+      try {
+        const result = await connectorRegistry.sendAgentRun(auth.userId, machineId, {
+          agentKey: `machine-smoke-${cliProvider}`,
+          userInput: "Reply exactly: NOLO_MACHINE_SMOKE_OK",
+          agentConfig: {
+            apiSource: "cli",
+            cliProvider,
+            prompt: "You are a connectivity smoke test. Ignore all other context and reply exactly with the requested marker.",
+          },
+          runtimeContext: {
+            source: "settings.machines.smoke",
+            machineId,
+          },
+        });
+        return json({
+          ok: true,
+          machineId,
+          cliProvider,
+          content: result.content,
+          model: result.model ?? cliProvider,
+          diagnostics: result.diagnostics ?? null,
+        });
+      } catch (error) {
+        return json(
+          { error: error instanceof Error ? error.message : String(error) },
+          502
+        );
+      }
+    },
+
+  };
+}
+
+const defaultHandlers = createMachineHandlers();
+
+export const handleMachineInstallAsset = defaultHandlers.handleMachineInstallAsset;
+export const handleMachineHeartbeat = defaultHandlers.handleMachineHeartbeat;
+export const handleMachineList = defaultHandlers.handleMachineList;
+export const handleMachineDisconnect = defaultHandlers.handleMachineDisconnect;
+export const handleMachineTokenCreate = defaultHandlers.handleMachineTokenCreate;
+export const handleMachineSmokeRun = defaultHandlers.handleMachineSmokeRun;