nolo-cli 0.1.30 → 0.1.32

package/server/handlers/machines/machineAuth.ts

@@ -1,149 +0,0 @@
-import { randomBytes, createHash } from "node:crypto";
-
-export const MACHINE_TOKEN_PREFIX = "sk_machine_";
-
-type MachineTokenDb = {
-  get(key: string): Promise<any>;
-  put(key: string, value: any): Promise<unknown>;
-};
-
-export type MachineTokenRecord = {
-  userId: string;
-  name: string | null;
-  createdAt: number;
-  lastUsedAt?: number;
-  machineId?: string;
-  boundAt?: number;
-  revokedAt?: number;
-  revokedMachineId?: string;
-};
-
-export type MachineAuthResult = { userId: string; machineToken: true; tokenHash: string } | null | Response;
-
-const tokenKey = (tokenHash: string) => `machine-token:${tokenHash}`;
-const machineTokenBindingKey = (userId: string, machineId: string) =>
-  `machine-token-binding:${userId}:${machineId}`;
-
-async function importServerDb() {
-  const load = new Function("specifier", "return import(specifier)") as (
-    specifier: string
-  ) => Promise<{ default: MachineTokenDb }>;
-  return load("database/server/db");
-}
-
-function authErrorResponse(message: string, code: string, status: number) {
-  return new Response(JSON.stringify({ error: message, code }), {
-    status,
-    headers: { "Content-Type": "application/json; charset=utf-8" },
-  });
-}
-
-export function extractBearerToken(req: Request) {
-  const header = req.headers.get("authorization") ?? req.headers.get("Authorization") ?? "";
-  const match = header.match(/^Bearer\s+(.+)$/i);
-  return match?.[1]?.trim() || "";
-}
-
-export function isMachineToken(token: string) {
-  return token.startsWith(MACHINE_TOKEN_PREFIX);
-}
-
-export function hashMachineToken(token: string) {
-  return createHash("sha256").update(token).digest("hex");
-}
-
-export async function issueMachineToken(args: {
-  userId: string;
-  name?: string | null;
-  now?: number;
-  db?: MachineTokenDb;
-  random?: (size: number) => Buffer;
-}) {
-  const db = args.db ?? (await importServerDb()).default;
-  const random = args.random ?? randomBytes;
-  const apiKey = `${MACHINE_TOKEN_PREFIX}${random(24).toString("hex")}`;
-  const record: MachineTokenRecord = {
-    userId: args.userId,
-    name: args.name?.trim() || null,
-    createdAt: args.now ?? Date.now(),
-  };
-  await db.put(tokenKey(hashMachineToken(apiKey)), record);
-  return { apiKey, record };
-}
-
-export async function authenticateMachineToken(
-  req: Request,
-  deps: { db?: MachineTokenDb; now?: number } = {}
-): Promise<MachineAuthResult> {
-  const token = extractBearerToken(req);
-  if (!isMachineToken(token)) return null;
-
-  const db = deps.db ?? (await importServerDb()).default;
-  const hash = hashMachineToken(token);
-  const record = (await db.get(tokenKey(hash)).catch(() => null)) as MachineTokenRecord | null;
-  if (!record?.userId) {
-    return authErrorResponse("Invalid machine token.", "AUTH_MACHINE_TOKEN_INVALID", 401);
-  }
-  if (record.revokedAt) {
-    return authErrorResponse("Machine token has been revoked.", "AUTH_MACHINE_TOKEN_REVOKED", 401);
-  }
-
-  await db.put(tokenKey(hash), {
-    ...record,
-    lastUsedAt: deps.now ?? Date.now(),
-  }).catch(() => {});
-
-  return { userId: record.userId, machineToken: true, tokenHash: hash };
-}
-
-export async function bindMachineTokenToMachine(args: {
-  userId: string;
-  tokenHash: string;
-  machineId: string;
-  now?: number;
-  db?: MachineTokenDb;
-}) {
-  const db = args.db ?? (await importServerDb()).default;
-  const now = args.now ?? Date.now();
-  const key = tokenKey(args.tokenHash);
-  const record = (await db.get(key).catch(() => null)) as MachineTokenRecord | null;
-  if (!record?.userId || record.userId !== args.userId || record.revokedAt) return false;
-
-  await db.put(machineTokenBindingKey(args.userId, args.machineId), {
-    tokenHash: args.tokenHash,
-    boundAt: now,
-  });
-  await db.put(key, {
-    ...record,
-    machineId: args.machineId,
-    boundAt: now,
-  });
-  return true;
-}
-
-export async function revokeMachineTokenForMachine(args: {
-  userId: string;
-  machineId: string;
-  now?: number;
-  db?: MachineTokenDb;
-}) {
-  const db = args.db ?? (await importServerDb()).default;
-  const binding = await db
-    .get(machineTokenBindingKey(args.userId, args.machineId))
-    .catch(() => null) as { tokenHash?: string } | null;
-  const tokenHash = typeof binding?.tokenHash === "string" ? binding.tokenHash : "";
-  if (!tokenHash) return { revoked: false, tokenHash: "" };
-
-  const key = tokenKey(tokenHash);
-  const record = (await db.get(key).catch(() => null)) as MachineTokenRecord | null;
-  if (!record?.userId || record.userId !== args.userId) {
-    return { revoked: false, tokenHash };
-  }
-
-  await db.put(key, {
-    ...record,
-    revokedAt: args.now ?? Date.now(),
-    revokedMachineId: args.machineId,
-  });
-  return { revoked: true, tokenHash };
-}

package/server/handlers/machines/machineBinding.ts

@@ -1,59 +0,0 @@
-import type { MachineSummary } from "./machineRegistry";
-
-export type RuntimeBinding = {
-  machineId?: string | null;
-  requiredCapabilities?: string[] | null;
-};
-
-export type RuntimeBindingResult =
-  | { ok: true; machine: MachineSummary }
-  | { ok: false; reason: "bound_machine_unavailable" | "bound_machine_missing_capability"; message: string };
-
-function normalizeString(value: unknown) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function normalizeRequiredCapabilities(binding?: RuntimeBinding | null) {
-  const requiredCapabilities = Array.isArray(binding?.requiredCapabilities)
-    ? binding.requiredCapabilities
-        .map((item) => normalizeString(item))
-        .filter(Boolean)
-    : [];
-  return [...new Set(requiredCapabilities)];
-}
-
-export function resolveRuntimeBinding(args: {
-  binding?: RuntimeBinding | null;
-  requiredCapabilities?: string[];
-  machines: MachineSummary[];
-}): RuntimeBindingResult {
-  const machineId = normalizeString(args.binding?.machineId);
-  const machine = args.machines.find(
-    (candidate) => candidate.machineId === machineId && candidate.status === "online"
-  );
-
-  if (!machine) {
-    return {
-      ok: false,
-      reason: "bound_machine_unavailable",
-      message: `Bound runtime machine is not online: ${machineId || "unknown"}.`,
-    };
-  }
-
-  const requiredCapabilities = [
-    ...normalizeRequiredCapabilities(args.binding),
-    ...(args.requiredCapabilities ?? []),
-  ];
-  const missingCapability = [...new Set(requiredCapabilities)].find(
-    (capability) => !machine.capabilities.includes(capability)
-  );
-  if (missingCapability) {
-    return {
-      ok: false,
-      reason: "bound_machine_missing_capability",
-      message: `Bound runtime machine ${machine.machineId} is missing capability: ${missingCapability}.`,
-    };
-  }
-
-  return { ok: true, machine };
-}

package/server/handlers/machines/machineHandlers.ts

@@ -1,279 +0,0 @@
-import { normalizeMachineHeartbeat } from "../../../connector-experimental/protocol";
-import {
-  authenticateMachineToken,
-  bindMachineTokenToMachine,
-  issueMachineToken,
-  revokeMachineTokenForMachine,
-} from "./machineAuth";
-import {
-  type MachineRegistry,
-  machineRegistry,
-  serializeMachineSummary,
-} from "./machineRegistry";
-import { getMachineInstallAsset } from "./machineInstallAssets";
-import { connectorConnectionRegistry } from "../connector/connectorConnectionRegistry";
-
-const JSON_HEADERS: Record<string, string> = {
-  "Content-Type": "application/json; charset=utf-8",
-  "Access-Control-Allow-Origin": "*",
-  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-  "Access-Control-Allow-Headers": "Content-Type, Authorization",
-};
-
-type AuthResult = { userId: string; machineToken?: true; tokenHash?: string } | Response;
-
-type MachineHandlerDeps = {
-  registry?: MachineRegistry;
-  connectorRegistry?: Pick<typeof connectorConnectionRegistry, "hasConnection" | "sendAgentRun" | "unregister">;
-  authenticate?: (req: Request) => Promise<AuthResult>;
-  authenticateMachine?: typeof authenticateMachineToken;
-  issueToken?: typeof issueMachineToken;
-  bindMachineToken?: typeof bindMachineTokenToMachine;
-  revokeMachineToken?: typeof revokeMachineTokenForMachine;
-};
-
-type SmokeCliProvider = "codex" | "copilot" | "claude" | "agy" | "gemini";
-
-const SMOKE_CAPABILITY_BY_PROVIDER: Record<SmokeCliProvider, string> = {
-  codex: "codex-cli",
-  copilot: "copilot-cli",
-  claude: "claude-code",
-  agy: "agy-cli",
-  gemini: "gemini-cli",
-};
-
-function normalizeSmokeProvider(value: unknown): SmokeCliProvider | null {
-  if (
-    value === "codex" ||
-    value === "copilot" ||
-    value === "claude" ||
-    value === "agy" ||
-    value === "gemini"
-  ) {
-    return value;
-  }
-  return null;
-}
-
-const json = (body: unknown, status = 200) =>
-  new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
-
-function text(body: string, contentType: string) {
-  return new Response(body, {
-    headers: {
-      "Content-Type": contentType,
-      "Cache-Control": "no-store",
-      "Access-Control-Allow-Origin": "*",
-    },
-  });
-}
-
-async function defaultAuthenticate(req: Request): Promise<AuthResult> {
-  const load = new Function("specifier", "return import(specifier)") as (
-    specifier: string
-  ) => Promise<any>;
-  const { authenticateRequest } = await load("auth/utils");
-  const result = await authenticateRequest(req);
-  if (result instanceof Response) return result;
-  return { userId: result.userId };
-}
-
-export function createMachineHandlers(deps: MachineHandlerDeps = {}) {
-  const registry = deps.registry ?? machineRegistry;
-  const connectorRegistry = deps.connectorRegistry ?? connectorConnectionRegistry;
-  const authenticate = deps.authenticate ?? defaultAuthenticate;
-  const authenticateMachine = deps.authenticateMachine ?? authenticateMachineToken;
-  const issueToken = deps.issueToken ?? issueMachineToken;
-  const bindMachineToken = deps.bindMachineToken ?? bindMachineTokenToMachine;
-  const revokeMachineToken = deps.revokeMachineToken ?? revokeMachineTokenForMachine;
-
-  async function authenticateUserOrMachine(req: Request): Promise<AuthResult> {
-    const machineAuth = await authenticateMachine(req);
-    if (machineAuth instanceof Response) return machineAuth;
-    if (machineAuth) return machineAuth;
-    return authenticate(req);
-  }
-
-  return {
-    handleMachineInstallAsset(req: Request) {
-      const asset = getMachineInstallAsset(new URL(req.url).pathname);
-      if (!asset) return json({ error: "Unknown machine install asset" }, 404);
-      return text(asset.body, asset.contentType);
-    },
-
-    async handleMachineHeartbeat(req: Request) {
-      const auth = await authenticateUserOrMachine(req);
-      if (auth instanceof Response) return auth;
-
-      let body: unknown;
-      try {
-        body = await req.json();
-      } catch {
-        return json({ error: "Invalid JSON body" }, 400);
-      }
-
-      try {
-        const heartbeat = normalizeMachineHeartbeat(
-          body && typeof body === "object" ? body : {}
-        );
-        const record = registry.recordHeartbeat(auth.userId, heartbeat);
-        if (auth.machineToken && auth.tokenHash) {
-          await bindMachineToken({
-            userId: auth.userId,
-            tokenHash: auth.tokenHash,
-            machineId: heartbeat.machineId,
-          });
-        }
-        return json({ ok: true, machine: serializeMachineSummary(record) });
-      } catch (error) {
-        return json(
-          { error: error instanceof Error ? error.message : String(error) },
-          400
-        );
-      }
-    },
-
-    async handleMachineList(req: Request) {
-      const auth = await authenticate(req);
-      if (auth instanceof Response) return auth;
-      return json({
-        machines: registry.listMachines(auth.userId).map((record) => {
-          const summary = serializeMachineSummary(record);
-          return {
-            ...summary,
-            connectorStatus: connectorRegistry.hasConnection(auth.userId, summary.machineId)
-              ? "connected"
-              : "disconnected",
-          };
-        }),
-      });
-    },
-
-    async handleMachineTokenCreate(req: Request) {
-      const auth = await authenticate(req);
-      if (auth instanceof Response) return auth;
-
-      let body: any = {};
-      try {
-        body = req.body ? await req.json() : {};
-      } catch {
-        return json({ error: "Invalid JSON body" }, 400);
-      }
-
-      const { apiKey, record } = await issueToken({
-        userId: auth.userId,
-        name: typeof body?.name === "string" ? body.name : null,
-      });
-      return json({
-        ok: true,
-        apiKey,
-        token: {
-          name: record.name,
-          createdAt: record.createdAt,
-        },
-      });
-    },
-
-    async handleMachineDisconnect(req: Request) {
-      const auth = await authenticate(req);
-      if (auth instanceof Response) return auth;
-
-      const url = new URL(req.url);
-      const machineId = decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "").trim();
-      if (!machineId || machineId === "machines") return json({ error: "machineId is required" }, 400);
-
-      const removed = registry.removeMachine(auth.userId, machineId);
-      
-      if (removed) {
-        connectorRegistry.unregister?.(auth.userId, machineId);
-        const revoked = await revokeMachineToken({
-          userId: auth.userId,
-          machineId,
-        });
-        return json({
-          ok: true,
-          machineId,
-          removed,
-          tokenRevoked: revoked.revoked,
-        });
-      }
-
-      return json({
-        ok: true,
-        machineId,
-        removed: false,
-        tokenRevoked: false,
-      });
-    },
-
-    async handleMachineSmokeRun(req: Request) {
-      const auth = await authenticateUserOrMachine(req);
-      if (auth instanceof Response) return auth;
-
-      let body: any = {};
-      try {
-        body = req.body ? await req.json() : {};
-      } catch {
-        return json({ error: "Invalid JSON body" }, 400);
-      }
-
-      const machineId = typeof body?.machineId === "string" ? body.machineId.trim() : "";
-      const cliProvider = normalizeSmokeProvider(body?.cliProvider);
-      if (!machineId) return json({ error: "machineId is required" }, 400);
-      if (!cliProvider) return json({ error: "Unsupported CLI provider" }, 400);
-
-      const machine = registry
-        .listMachines(auth.userId)
-        .find((record) => record.machineId === machineId);
-      if (!machine) return json({ error: "Machine not found" }, 404);
-      if (machine.status !== "online") return json({ error: "Machine is offline" }, 409);
-      if (!connectorRegistry.hasConnection(auth.userId, machineId)) {
-        return json({ error: "Machine connector is not connected" }, 409);
-      }
-
-      const requiredCapability = SMOKE_CAPABILITY_BY_PROVIDER[cliProvider];
-      if (!machine.capabilities.includes(requiredCapability)) {
-        return json({ error: `Machine is missing capability: ${requiredCapability}` }, 409);
-      }
-
-      try {
-        const result = await connectorRegistry.sendAgentRun(auth.userId, machineId, {
-          agentKey: `machine-smoke-${cliProvider}`,
-          userInput: "Reply exactly: NOLO_MACHINE_SMOKE_OK",
-          agentConfig: {
-            apiSource: "cli",
-            cliProvider,
-            prompt: "You are a connectivity smoke test. Ignore all other context and reply exactly with the requested marker.",
-          },
-          runtimeContext: {
-            source: "settings.machines.smoke",
-            machineId,
-          },
-        });
-        return json({
-          ok: true,
-          machineId,
-          cliProvider,
-          content: result.content,
-          model: result.model ?? cliProvider,
-          diagnostics: result.diagnostics ?? null,
-        });
-      } catch (error) {
-        return json(
-          { error: error instanceof Error ? error.message : String(error) },
-          502
-        );
-      }
-    },
-
-  };
-}
-
-const defaultHandlers = createMachineHandlers();
-
-export const handleMachineInstallAsset = defaultHandlers.handleMachineInstallAsset;
-export const handleMachineHeartbeat = defaultHandlers.handleMachineHeartbeat;
-export const handleMachineList = defaultHandlers.handleMachineList;
-export const handleMachineDisconnect = defaultHandlers.handleMachineDisconnect;
-export const handleMachineTokenCreate = defaultHandlers.handleMachineTokenCreate;
-export const handleMachineSmokeRun = defaultHandlers.handleMachineSmokeRun;