overmux 0.0.3 → 0.0.5

package/dist/internal/server/coordinator/server-child.js

@@ -4,13 +4,13 @@ import { createServer, isIP } from "node:net";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { createJiti } from "jiti";
 import { ZodError, z } from "zod";
-import { homedir, tmpdir } from "node:os";
+import { homedir, hostname } from "node:os";
 import { once } from "node:events";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { generateCookie } from "hono/cookie";
 import { bodyLimit } from "hono/body-limit";
 import { parse } from "hono/utils/cookie";
-import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { appendFileSync, constants, mkdirSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { Hono } from "hono";
 import { serveStatic } from "@hono/node-server/serve-static";
@@ -35,6 +35,7 @@ const durationToMilliseconds$1 = (duration) => {
 	return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
 };
 const aiContextSnippets = ["package-source", "tech-stack-recommendations"];
+const instanceIdSchema$1 = z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?![\s\S])/, "Expected a lowercase instance ID with only ASCII letters, digits, internal dots and hyphens");
 const zodTypeSchema = z.custom((value) => value instanceof z.ZodType, "Expected a Zod schema");
 const functionSchema = z.custom((value) => typeof value === "function", "Expected a function");
 const contractRuntimeSchema = z.object({
@@ -83,12 +84,11 @@ const loopbackPeerSchema = z.string().refine((value) => isIP(value) !== 0 && (va
 const authConfigRuntimeSchema = z.object({
 	mode: z.literal("cli-login"),
 	origins: z.array(exactOriginSchema).min(1).refine((origins) => new Set(origins).size === origins.length, "Expected unique origins").optional(),
-	sessionLifetime: z.union([z.literal("never"), authDurationSchema]).default("never"),
+	sessionLifetime: z.union([z.literal("forever"), authDurationSchema]).default("forever"),
 	trustedProxyPeer: loopbackPeerSchema.optional()
 }).strict();
 const serverConfigRuntimeSchema = z.object({
 	host: z.string().min(1).optional(),
-	logFile: z.string().min(1).optional(),
 	port: z.number().int().min(1).max(65535).optional(),
 	productionWebAssetsDir: z.string().min(1).optional(),
 	watch: z.boolean().optional()
@@ -102,6 +102,7 @@ const configDefinitionRuntimeSchema = serverConfigRuntimeSchema.extend({
 	aiContextSnippets: z.array(z.enum(aiContextSnippets)).optional(),
 	auth: authConfigRuntimeSchema,
 	debug: z.boolean().optional(),
+	instanceId: z.union([instanceIdSchema$1, z.custom((value) => typeof value === "function", "Expected an instance ID or a function of the bound port")]).optional(),
 	server: serverDefinitionRuntimeSchema,
 	vite: z.string().min(1).optional()
 });
@@ -400,7 +401,7 @@ const createAuthService = ({ config, environment = process.env, homeDirectory =
 	const createSession = ({ kind, lifetimeMs, origin }) => {
 		const token = randomToken();
 		const createdAt = new Date(now()).toISOString();
-		const configuredLifetime = config.sessionLifetime && config.sessionLifetime !== "never" ? durationMilliseconds(config.sessionLifetime) : void 0;
+		const configuredLifetime = config.sessionLifetime && config.sessionLifetime !== "forever" ? durationMilliseconds(config.sessionLifetime) : void 0;
 		const expiresIn = lifetimeMs ?? configuredLifetime;
 		return {
 			stored: {
@@ -844,9 +845,41 @@ const createHttpAuthenticationHandlers = ({ auth, authAssetsDirectory }) => {
 	};
 };
 //#endregion
+//#region ../shared/dist/index.js
+const overmuxSettingsPath = "/_overmux/settings";
+const overmuxLogoutPath = "/_overmux/logout";
+const safeRelativeNotificationLink = (link) => {
+	let decoded;
+	try {
+		decoded = decodeURIComponent(link);
+	} catch {
+		return false;
+	}
+	return !decoded.startsWith("//") && !decoded.includes("\\") && ![...decoded].some((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint < 32 || codePoint === 127;
+	});
+};
+const notificationLinkSchema = z.union([z.string().max(4096).startsWith("/").refine(safeRelativeNotificationLink), z.string().max(4096).url().refine((link) => {
+	if (!URL.canParse(link)) return false;
+	const url = new URL(link);
+	return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password;
+})]);
+const notificationSchema = z.object({
+	body: z.string().max(4096).optional(),
+	open: z.object({ link: notificationLinkSchema }).strict().optional(),
+	title: z.string().min(1).max(4096)
+}).strict();
+const instanceIdSchema = z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?![\s\S])/, "Expected a lowercase instance ID with only ASCII letters, digits, internal dots and hyphens");
+const createInstanceIdentity = (instanceId) => ({
+	instanceId: instanceIdSchema.parse(instanceId),
+	deepLinkPrefix: `overmux://${instanceId}`
+});
+//#endregion
 //#region src/internal/server/auth/instance-control.ts
 const maxControlMessageBytes = 16384;
 const controlRequestSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("get-instance") }).strict(),
 	z.object({ type: z.literal("ping") }).strict(),
 	z.object({ type: z.literal("create-login") }).strict(),
 	z.object({ type: z.literal("issue-bearer") }).strict(),
@@ -872,6 +905,9 @@ const sessionSchema = z.object({
 	revokedAt: z.string().optional()
 }).strict();
 z.object({
+	instanceId: instanceIdSchema,
+	ok: z.literal(true)
+}).strict(), z.object({
 	login: loginGrantSchema,
 	ok: z.literal(true)
 }).strict(), z.object({
@@ -902,12 +938,26 @@ z.object({
 	port: z.number().int().min(1).max(65535),
 	url: z.string().url()
 });
+const currentUid = () => {
+	if (!process.getuid) throw new Error("Overmux instance control requires a Unix user ID");
+	return process.getuid();
+};
 const runtimeDirectory = () => {
-	const paths = getOvermuxPaths();
-	const preferred = paths.runtimeDir ?? join(paths.stateDir, "runtime");
+	const fallback = `/tmp/overmux-${currentUid()}`;
+	const preferred = getOvermuxPaths().runtimeDir;
+	if (!preferred) return fallback;
 	if (Buffer.byteLength(preferred) <= 80) return preferred;
-	const suffix = createHash("sha256").update(preferred).digest("hex").slice(0, 12);
-	return join(tmpdir(), `overmux-${process.getuid?.() ?? "user"}-${suffix}`);
+	return `${fallback}-${createHash("sha256").update(preferred).digest("hex").slice(0, 12)}`;
+};
+const secureRuntimeDirectory = async (directory) => {
+	const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+	try {
+		const metadata = await handle.stat();
+		if (!metadata.isDirectory() || metadata.uid !== currentUid()) throw new Error(`Unsafe Overmux runtime directory: ${directory}`);
+		await handle.chmod(448);
+	} finally {
+		await handle.close();
+	}
 };
 const readNewlineFrame = ({ maximumBytes, socket, timeout }) => new Promise((resolve, reject) => {
 	let buffer = Buffer.alloc(0);
@@ -950,7 +1000,11 @@ const readNewlineFrame = ({ maximumBytes, socket, timeout }) => new Promise((res
 const writeResponse = (socket, response) => {
 	socket.end(`${JSON.stringify(response)}\n`);
 };
-const handleRequest = async (auth, request) => {
+const handleRequest = async ({ auth, instanceId, request }) => {
+	if (request.type === "get-instance") return {
+		instanceId,
+		ok: true
+	};
 	if (request.type === "ping") return { ok: true };
 	if (request.type === "create-login") return {
 		login: await auth.createLoginGrant(),
@@ -973,14 +1027,18 @@ const handleRequest = async (auth, request) => {
 		ok: true
 	};
 };
-const handleConnection = async ({ auth, socket }) => {
+const handleConnection = async ({ auth, instanceId, socket }) => {
 	try {
 		const frame = await readNewlineFrame({
 			maximumBytes: maxControlMessageBytes,
 			socket
 		});
 		const request = controlRequestSchema.parse(JSON.parse(frame.toString()));
-		writeResponse(socket, await handleRequest(auth, request));
+		writeResponse(socket, await handleRequest({
+			auth,
+			instanceId,
+			request
+		}));
 	} catch (cause) {
 		writeResponse(socket, {
 			error: cause instanceof Error ? cause.message : "Invalid control request",
@@ -988,13 +1046,13 @@ const handleConnection = async ({ auth, socket }) => {
 		});
 	}
 };
-const startInstanceControl = async ({ auth, apiUrl, port, url }) => {
+const startInstanceControl = async ({ auth, apiUrl, instanceId, port, url }) => {
 	const directory = runtimeDirectory();
 	await mkdir(directory, {
 		mode: 448,
 		recursive: true
 	});
-	await chmod(directory, 448);
+	await secureRuntimeDirectory(directory);
 	const id = randomBytes(8).toString("hex");
 	const socketPath = join(directory, `${id}.sock`);
 	const registrationPath = join(directory, `${id}.json`);
@@ -1004,6 +1062,7 @@ const startInstanceControl = async ({ auth, apiUrl, port, url }) => {
 		socket.once("close", () => sockets.delete(socket));
 		handleConnection({
 			auth,
+			instanceId,
 			socket
 		});
 	});
@@ -1054,30 +1113,6 @@ const backgroundNotificationSubscriptionSchema = z.object({
 }).strict();
 z.object({ publicKey: deliveryKeySchema }).strict();
 const backgroundNotificationDisableRequestSchema = z.object({ endpoint: backgroundNotificationSubscriptionSchema.shape.endpoint }).strict();
-const overmuxSettingsPath = "/_overmux/settings";
-const overmuxLogoutPath = "/_overmux/logout";
-const safeRelativeNotificationLink = (link) => {
-	let decoded;
-	try {
-		decoded = decodeURIComponent(link);
-	} catch {
-		return false;
-	}
-	return !decoded.startsWith("//") && !decoded.includes("\\") && ![...decoded].some((character) => {
-		const codePoint = character.codePointAt(0) ?? 0;
-		return codePoint < 32 || codePoint === 127;
-	});
-};
-const notificationLinkSchema = z.union([z.string().max(4096).startsWith("/").refine(safeRelativeNotificationLink), z.string().max(4096).url().refine((link) => {
-	if (!URL.canParse(link)) return false;
-	const url = new URL(link);
-	return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password;
-})]);
-const notificationSchema = z.object({
-	body: z.string().max(4096).optional(),
-	open: z.object({ link: notificationLinkSchema }).strict().optional(),
-	title: z.string().min(1).max(4096)
-}).strict();
 const webSocketCloseCode = {
 	authenticationRevoked: 4001,
 	authenticationUnavailable: 4002
@@ -1085,7 +1120,7 @@ const webSocketCloseCode = {
 z.object({
 	debug: z.boolean(),
 	operations: z.array(z.string().min(1)),
-	protocolVersion: z.literal(9),
+	protocolVersion: z.literal(10),
 	resources: z.array(z.string().min(1)),
 	streams: z.array(z.string().min(1))
 });
@@ -1191,7 +1226,12 @@ const protocolErrorMessageSchema = z.object({
 	subscriptionId: operationIdSchema.optional(),
 	type: z.literal("error")
 });
+const serverInfoMessageSchema = z.object({
+	type: z.literal("server-info"),
+	instanceId: instanceIdSchema
+}).strict();
 const serverProtocolMessageSchema = z.discriminatedUnion("type", [
+	serverInfoMessageSchema,
 	resourceResultMessageSchema,
 	resourceInvalidatedMessageSchema,
 	streamOpenedMessageSchema,
@@ -1308,7 +1348,7 @@ const lifecycleEvents = /* @__PURE__ */ new Set([
 	"websocket-connect",
 	"websocket-open"
 ]);
-const getDefaultServerLogFile = ({ homeDir, xdgStateHome } = {}) => join(getOvermuxPaths({
+const getServerLogFile = ({ homeDir, xdgStateHome } = {}) => join(getOvermuxPaths({
 	homeDir,
 	xdgStateHome
 }).stateDir, "overmux.log");
@@ -1324,8 +1364,7 @@ const safeJson = (value) => {
 		});
 	}
 };
-const createServerLogger = ({ enabled, logFile = getDefaultServerLogFile() }) => {
-	let activeLogFile = logFile;
+const createServerLogger = ({ enabled, logFile }) => {
 	let debugEnabled = enabled;
 	return {
 		get enabled() {
@@ -1340,15 +1379,12 @@ const createServerLogger = ({ enabled, logFile = getDefaultServerLogFile() }) =>
 				source: entry.source ?? "server",
 				...entry
 			});
-			mkdirSync(dirname(activeLogFile), { recursive: true });
-			appendFileSync(activeLogFile, `${record}\n`, "utf8");
+			mkdirSync(dirname(logFile), { recursive: true });
+			appendFileSync(logFile, `${record}\n`, "utf8");
 			process.stderr.write(`[overmux:debug] ${record}\n`);
 		},
 		setEnabled: (nextEnabled) => {
 			debugEnabled = nextEnabled;
-		},
-		setLogFile: (nextLogFile) => {
-			activeLogFile = nextLogFile;
 		}
 	};
 };
@@ -2334,6 +2370,10 @@ const createWebSocketServer = ({ auth, developmentWebTarget, runtime, server, se
 				sessionSockets,
 				socket: webSocket
 			});
+			webSocket.send(encodeProtocolFrame({
+				type: "server-info",
+				instanceId: runtime.instance.getInstanceId()
+			}));
 			webSocketServer.emit("connection", webSocket, request);
 			attachWebSocketConnection({
 				runtime,
@@ -2607,6 +2647,31 @@ const createNotificationService = ({ backgroundNotifications, logger }) => {
 	};
 };
 //#endregion
+//#region src/internal/server/runtime/runtime-instance.ts
+const defaultInstanceId = ({ port }) => `${hostname()}-${port}`;
+const createRuntimeInstance = (configured) => {
+	let identity;
+	const get = () => {
+		if (!identity) throw new Error("Overmux instance identity is not ready");
+		return identity;
+	};
+	return {
+		context: {
+			getInstanceId: () => get().instanceId,
+			getDeepLinkPrefix: () => get().deepLinkPrefix
+		},
+		establish: (port) => {
+			if (identity) throw new Error("Overmux instance identity is already established");
+			try {
+				identity = createInstanceIdentity(typeof configured === "function" ? configured({ port }) : configured);
+			} catch (cause) {
+				throw new Error("Invalid Overmux instance ID; configure instanceId with a canonical lowercase ID", { cause });
+			}
+			return identity;
+		}
+	};
+};
+//#endregion
 //#region src/internal/server/runtime/runtime-lifecycle.ts
 const asError = (cause) => cause instanceof Error ? cause : new Error(String(cause));
 const disposeAll = async (disposers) => {
@@ -2728,14 +2793,10 @@ const getInvalidatedResourceIds = (graph, resourceId) => {
 };
 //#endregion
 //#region src/internal/server/runtime/runtime-resources.ts
-const createRuntimeResources = ({ definitions, lifecycle }) => {
+const createRuntimeResources = ({ definitions, instance, lifecycle }) => {
 	const graph = createResourceDependencyGraph(definitions);
 	const invalidationListeners = /* @__PURE__ */ new Set();
-	const contracts = /* @__PURE__ */ new Map();
 	const resources = /* @__PURE__ */ new Map();
-	Object.entries(definitions).forEach(([id, definition]) => {
-		contracts.set(definition.contract, [...contracts.get(definition.contract) ?? [], id]);
-	});
 	const invalidateResource = (id, input, allInputs = false) => {
 		if (lifecycle.signal.aborted) return;
 		const ids = getInvalidatedResourceIds(graph, id);
@@ -2743,16 +2804,14 @@ const createRuntimeResources = ({ definitions, lifecycle }) => {
 			if (ids.has(entry.resourceId) && (allInputs || isDeepStrictEqual(entry.input, input))) entry.listener();
 		});
 	};
-	const invalidate = (contract, input) => {
-		const ids = contracts.get(contract) ?? Object.entries(definitions).filter(([, definition]) => definition.contract.input === contract.input && definition.contract.output === contract.output).map(([id]) => id);
-		if (!ids.length) throw new Error("Cannot invalidate a resource outside this runtime");
-		ids.forEach((id) => {
-			const definition = definitions[id];
-			const parsedInput = input === void 0 ? void 0 : definition.contract.input.parse(input);
-			invalidateResource(id, parsedInput, input === void 0);
-		});
+	const invalidate = (resourceId, input) => {
+		if (!resources.has(resourceId)) throw new Error(`Unknown resource ID: ${resourceId}`);
+		const definition = definitions[resourceId];
+		const parsedInput = input === void 0 ? void 0 : definition.contract.input.parse(input);
+		invalidateResource(resourceId, parsedInput, input === void 0);
 	};
 	const context = (signal) => ({
+		instance,
 		invalidate,
 		signal: lifecycle.requestSignal(signal)
 	});
@@ -2885,11 +2944,13 @@ const createRuntimeStreams = ({ context, definitions, lifecycle }) => {
 };
 //#endregion
 //#region src/internal/server/runtime/create-runtime.ts
-const createRuntime = async ({ config, debug = false, notifications = { send: async () => void 0 }, signal }) => {
+const createRuntime = async ({ config, debug = true, notifications = { send: async () => void 0 }, signal }) => {
 	const lifecycle = createRuntimeLifecycle(signal);
+	const instance = createRuntimeInstance(config.instanceId ?? defaultInstanceId);
 	try {
 		const resources = createRuntimeResources({
 			definitions: config.server.resources ?? {},
+			instance: instance.context,
 			lifecycle
 		});
 		const context = resources.context;
@@ -2905,14 +2966,17 @@ const createRuntime = async ({ config, debug = false, notifications = { send: as
 		});
 		lifecycle.signal.throwIfAborted();
 		lifecycle.completePreparation();
+		const manifest = {
+			debug,
+			operations: [...operations.names],
+			protocolVersion: 10,
+			resources: [...resources.names],
+			streams: [...streams.names]
+		};
 		return {
-			manifest: {
-				debug,
-				operations: [...operations.names],
-				protocolVersion: 9,
-				resources: [...resources.names],
-				streams: [...streams.names]
-			},
+			instance: instance.context,
+			establishInstance: instance.establish,
+			manifest,
 			dispose: lifecycle.dispose,
 			getOperation: operations.get,
 			getResource: resources.get,
@@ -2925,16 +2989,18 @@ const createRuntime = async ({ config, debug = false, notifications = { send: as
 };
 //#endregion
 //#region src/internal/server/server-startup-options.ts
+const serverStartupOverridesRuntimeSchema = serverConfigRuntimeSchema.omit({ port: true }).extend({
+	debug: z.boolean().optional(),
+	port: z.number().int().min(0).max(65535).optional()
+});
 const resolveServerStartupOptions = ({ config, configPath, overrides = {} }) => {
-	const validatedOverrides = serverConfigRuntimeSchema.omit({ port: true }).extend({ port: z.number().int().min(0).max(65535).optional() }).parse(overrides);
-	const configuredLogFile = config.logFile ? resolve(dirname(configPath), config.logFile) : void 0;
-	const logFile = validatedOverrides.logFile ? resolve(validatedOverrides.logFile) : configuredLogFile;
+	const validatedOverrides = serverStartupOverridesRuntimeSchema.parse(overrides);
 	const configuredWebAssetsDir = config.productionWebAssetsDir ? resolve(dirname(configPath), config.productionWebAssetsDir) : void 0;
 	const productionWebAssetsDir = validatedOverrides.productionWebAssetsDir ? resolve(validatedOverrides.productionWebAssetsDir) : configuredWebAssetsDir;
 	return {
+		debug: validatedOverrides.debug ?? config.debug ?? true,
 		host: validatedOverrides.host ?? config.host ?? "localhost",
-		...logFile === void 0 ? {} : { logFile },
-		port: validatedOverrides.port ?? config.port ?? 4200,
+		port: validatedOverrides.port ?? config.port ?? 4242,
 		...productionWebAssetsDir === void 0 ? {} : { productionWebAssetsDir },
 		watch: validatedOverrides.watch ?? config.watch ?? true
 	};
@@ -3076,12 +3142,20 @@ const startApplicationTransport = async ({ auth, authOrigins, authService, backg
 		serverLogger: logger,
 		webAssetsDir: developmentWebTarget ? void 0 : startup.productionWebAssetsDir
 	});
+	let ready = false;
 	const server = serve({
-		fetch: app.fetch,
+		fetch: (request, env) => ready ? app.fetch(request, env) : new Response("Starting", { status: 503 }),
 		hostname: startup.host,
 		port: startup.port
 	});
 	resources.add(() => closeNodeServer(server, runtime.dispose));
+	const address = await getServerAddress(server);
+	runtime.establishInstance(address.port);
+	const urlHost = startup.host.includes(":") ? `[${startup.host}]` : startup.host;
+	const localUrl = `http://${urlHost}:${address.port}`;
+	const controlApiHost = startup.host === "0.0.0.0" ? "127.0.0.1" : startup.host === "::" ? "[::1]" : urlHost;
+	const origins = authOrigins.establish(localUrl);
+	authService.setOrigins(origins);
 	const webSockets = createWebSocketServer({
 		auth,
 		developmentWebTarget,
@@ -3092,15 +3166,11 @@ const startApplicationTransport = async ({ auth, authOrigins, authService, backg
 	resources.add(webSockets.close);
 	announceRestarting = webSockets.announceRestarting;
 	notifications.attachLiveDelivery(webSockets.broadcastNotification);
-	const address = await getServerAddress(server);
-	const urlHost = startup.host.includes(":") ? `[${startup.host}]` : startup.host;
-	const localUrl = `http://${urlHost}:${address.port}`;
-	const controlApiHost = startup.host === "0.0.0.0" ? "127.0.0.1" : startup.host === "::" ? "[::1]" : urlHost;
-	const origins = authOrigins.establish(localUrl);
-	authService.setOrigins(origins);
+	ready = true;
 	const instanceControl = await startInstanceControl({
 		auth: authService,
 		apiUrl: `http://${controlApiHost}:${address.port}`,
+		instanceId: runtime.instance.getInstanceId(),
 		port: address.port,
 		url: origins[0]
 	});
@@ -3127,8 +3197,8 @@ const failApplicationServerStartup = async (cause, resources) => {
 };
 const startApplicationServer = async ({ onRestartRequested, options }) => {
 	const logger = createServerLogger({
-		enabled: options.debug ?? false,
-		logFile: options.logFile ? resolve(options.logFile) : void 0
+		enabled: options.debug ?? true,
+		logFile: getServerLogFile()
 	});
 	const resources = createResources();
 	resources.add(registerProcessErrorLogging(logger));
@@ -3142,8 +3212,7 @@ const startApplicationServer = async ({ onRestartRequested, options }) => {
 			configPath,
 			options
 		});
-		logger.setEnabled(Boolean(options.debug || config.debug));
-		if (startup.logFile) logger.setLogFile(startup.logFile);
+		logger.setEnabled(startup.debug);
 		const { auth, authOrigins, authService, backgroundNotifications, notifications, runtime } = await createApplicationServices({
 			config,
 			logger,
@@ -3187,7 +3256,6 @@ const childOptionsSchema = z.object({
 	debug: z.boolean().optional(),
 	developmentWebTarget: z.url().optional(),
 	host: z.string().optional(),
-	logFile: z.string().optional(),
 	port: z.number().int().min(0).max(65535).optional(),
 	productionWebAssetsDir: z.string().optional(),
 	watch: z.boolean().optional()