palmier 0.2.1 → 0.2.2

package/README.md

@@ -1,6 +1,6 @@
 # Palmier
 
-A Node.js CLI that runs on your machine as a persistent daemon. It manages tasks, communicates with the Palmier platform via NATS and/or direct HTTP, and executes CLI tools autonomously.
+A Node.js CLI that runs on your machine as a persistent daemon. It manages tasks, communicates with the Palmier app via NATS and/or direct HTTP, and executes tasks on schedule or demand using CLI tools.
 
 ## Connection Modes
 

package/dist/commands/pair.js

@@ -1,4 +1,3 @@
-import * as os from "os";
 import * as http from "node:http";
 import { StringCodec } from "nats";
 import { loadConfig } from "../config.js";
@@ -12,30 +11,53 @@ function generateCode() {
     crypto.getRandomValues(bytes);
     return Array.from(bytes, (b) => CODE_CHARS[b % CODE_CHARS.length]).join("");
 }
-function detectLanIp() {
-    const interfaces = os.networkInterfaces();
-    for (const name of Object.keys(interfaces)) {
-        for (const iface of interfaces[name] ?? []) {
-            if (iface.family === "IPv4" && !iface.internal) {
-                return iface.address;
-            }
-        }
-    }
-    return "127.0.0.1";
-}
 function buildPairResponse(config, label) {
     const session = addSession(label);
     const response = {
         hostId: config.hostId,
         sessionToken: session.token,
     };
-    if (config.mode === "lan" || config.mode === "auto") {
-        const ip = detectLanIp();
-        response.directUrl = `http://${ip}:${config.directPort ?? 7400}`;
-        response.directToken = config.directToken;
-    }
     return response;
 }
+/**
+ * POST to the running serve process and long-poll until paired or expired.
+ * Returns true if paired, false if expired/failed.
+ */
+function lanPairRegister(port, code) {
+    const body = JSON.stringify({ code, expiryMs: EXPIRY_MS });
+    return new Promise((resolve) => {
+        const req = http.request({
+            hostname: "127.0.0.1",
+            port,
+            path: "/internal/pair-register",
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            timeout: EXPIRY_MS + 5000, // slightly longer than expiry
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                try {
+                    const result = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+                    resolve(result.paired);
+                }
+                catch {
+                    resolve(false);
+                }
+            });
+        });
+        req.on("error", (err) => {
+            console.error(`Failed to reach palmier serve on port ${port}: ${err.message}`);
+            console.error("Make sure `palmier serve` is running first.");
+            resolve(false);
+        });
+        req.on("timeout", () => {
+            req.destroy();
+            resolve(false);
+        });
+        req.end(body);
+    });
+}
 /**
  * Generate an OTP code and wait for a PWA client to pair.
  * Listens on NATS (nats/auto modes) and/or HTTP (lan/auto modes).
@@ -50,6 +72,13 @@ export async function pairCommand() {
         console.log("Paired successfully!");
     }
     const cleanups = [];
+    // Display pairing info
+    console.log("");
+    console.log("Enter this code in your Palmier app:");
+    console.log("");
+    console.log(`  ${code}`);
+    console.log("");
+    console.log("Code expires in 5 minutes.");
     // NATS pairing (nats or auto mode)
     if (mode === "nats" || mode === "auto") {
         const nc = await connectNats(config);
@@ -80,70 +109,15 @@ export async function pairCommand() {
             }
         })();
     }
-    // HTTP pairing (lan or auto mode)
+    // LAN pairing — long-poll the running serve process
     if (mode === "lan" || mode === "auto") {
         const port = config.directPort ?? 7400;
-        const server = http.createServer(async (req, res) => {
-            res.setHeader("Access-Control-Allow-Origin", "*");
-            res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-            res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-            if (req.method === "OPTIONS") {
-                res.writeHead(204);
-                res.end();
-                return;
-            }
-            if (req.method === "POST" && req.url === "/pair") {
-                const chunks = [];
-                req.on("data", (chunk) => chunks.push(chunk));
-                req.on("end", () => {
-                    try {
-                        const body = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
-                        if (body.code !== code) {
-                            res.writeHead(401, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: "Invalid code" }));
-                            return;
-                        }
-                        if (paired) {
-                            res.writeHead(410, { "Content-Type": "application/json" });
-                            res.end(JSON.stringify({ error: "Code already used" }));
-                            return;
-                        }
-                        const response = buildPairResponse(config, body.label);
-                        res.writeHead(200, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify(response));
-                        onPaired();
-                    }
-                    catch {
-                        res.writeHead(400, { "Content-Type": "application/json" });
-                        res.end(JSON.stringify({ error: "Invalid JSON" }));
-                    }
-                });
-                return;
-            }
-            res.writeHead(404, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Not found" }));
-        });
-        await new Promise((resolve, reject) => {
-            server.listen(port + 1, () => resolve());
-            server.on("error", reject);
-        });
-        cleanups.push(() => {
-            server.close();
-        });
-    }
-    // Display pairing info
-    console.log("");
-    console.log("Enter this code in your Palmier app:");
-    console.log("");
-    console.log(`  ${code}`);
-    console.log("");
-    if (mode === "lan" || mode === "auto") {
-        const ip = detectLanIp();
-        const port = config.directPort ?? 7400;
-        console.log(`  Address: ${ip}:${port + 1}`);
-        console.log("");
+        (async () => {
+            const result = await lanPairRegister(port, code);
+            if (result)
+                onPaired();
+        })();
     }
-    console.log("Code expires in 5 minutes.");
     // Wait for pairing or timeout
     const start = Date.now();
     await new Promise((resolve) => {

package/dist/transports/http-transport.js

@@ -1,5 +1,18 @@
 import * as http from "node:http";
-import { validateSession, hasSessions } from "../session-store.js";
+import * as os from "os";
+import { validateSession, hasSessions, addSession } from "../session-store.js";
+const pendingPairs = new Map();
+function detectLanIp() {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+        for (const iface of interfaces[name] ?? []) {
+            if (iface.family === "IPv4" && !iface.internal) {
+                return iface.address;
+            }
+        }
+    }
+    return "127.0.0.1";
+}
 /**
  * Start the HTTP transport: Express-like server with RPC, SSE, and health endpoints.
  */
@@ -78,6 +91,79 @@ export async function startHttpTransport(config, handleRpc) {
             }
             return;
         }
+        // Internal pair-register endpoint — localhost only, long-poll
+        // The pair CLI posts here and blocks until paired or expired.
+        if (req.method === "POST" && pathname === "/internal/pair-register") {
+            if (!isLocalhost(req)) {
+                sendJson(res, 403, { error: "localhost only" });
+                return;
+            }
+            try {
+                const body = await readBody(req);
+                const { code, expiryMs } = JSON.parse(body);
+                if (!code) {
+                    sendJson(res, 400, { error: "Missing code" });
+                    return;
+                }
+                if (pendingPairs.has(code)) {
+                    sendJson(res, 409, { error: "Code already registered" });
+                    return;
+                }
+                const result = await new Promise((resolve) => {
+                    const timer = setTimeout(() => {
+                        pendingPairs.delete(code);
+                        resolve({ paired: false });
+                    }, expiryMs ?? 5 * 60 * 1000);
+                    pendingPairs.set(code, { resolve, timer });
+                    // Clean up if the CLI disconnects early
+                    req.on("close", () => {
+                        if (pendingPairs.has(code)) {
+                            clearTimeout(timer);
+                            pendingPairs.delete(code);
+                        }
+                    });
+                });
+                sendJson(res, 200, result);
+            }
+            catch {
+                sendJson(res, 400, { error: "Invalid JSON" });
+            }
+            return;
+        }
+        // Public pair endpoint — no auth required, PWA posts OTP code here
+        if (req.method === "POST" && pathname === "/pair") {
+            try {
+                const body = await readBody(req);
+                const { code, label } = JSON.parse(body);
+                if (!code) {
+                    sendJson(res, 400, { error: "Missing code" });
+                    return;
+                }
+                const pending = pendingPairs.get(code);
+                if (!pending) {
+                    sendJson(res, 401, { error: "Invalid code" });
+                    return;
+                }
+                // Create session and build response
+                const session = addSession(label);
+                const ip = detectLanIp();
+                const response = {
+                    hostId: config.hostId,
+                    sessionToken: session.token,
+                    directUrl: `http://${ip}:${port}`,
+                    directToken: config.directToken,
+                };
+                // Resolve the long-poll and clean up
+                clearTimeout(pending.timer);
+                pendingPairs.delete(code);
+                pending.resolve({ paired: true });
+                sendJson(res, 200, response);
+            }
+            catch {
+                sendJson(res, 400, { error: "Invalid JSON" });
+            }
+            return;
+        }
         // All other endpoints require auth
         if (!checkAuth(req)) {
             sendJson(res, 401, { error: "Unauthorized" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palmier",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Palmier host CLI - provisions, executes tasks, and serves NATS RPC",
   "license": "ISC",
   "author": "Hongxu Cai",

package/src/commands/pair.ts

@@ -1,4 +1,3 @@
-import * as os from "os";
 import * as http from "node:http";
 import { StringCodec } from "nats";
 import { loadConfig } from "../config.js";
@@ -16,18 +15,6 @@ function generateCode(): string {
   return Array.from(bytes, (b) => CODE_CHARS[b % CODE_CHARS.length]).join("");
 }
 
-function detectLanIp(): string {
-  const interfaces = os.networkInterfaces();
-  for (const name of Object.keys(interfaces)) {
-    for (const iface of interfaces[name] ?? []) {
-      if (iface.family === "IPv4" && !iface.internal) {
-        return iface.address;
-      }
-    }
-  }
-  return "127.0.0.1";
-}
-
 function buildPairResponse(config: HostConfig, label?: string) {
   const session = addSession(label);
   const response: Record<string, unknown> = {
@@ -35,15 +22,57 @@ function buildPairResponse(config: HostConfig, label?: string) {
     sessionToken: session.token,
   };
 
-  if (config.mode === "lan" || config.mode === "auto") {
-    const ip = detectLanIp();
-    response.directUrl = `http://${ip}:${config.directPort ?? 7400}`;
-    response.directToken = config.directToken;
-  }
-
   return response;
 }
 
+/**
+ * POST to the running serve process and long-poll until paired or expired.
+ * Returns true if paired, false if expired/failed.
+ */
+function lanPairRegister(port: number, code: string): Promise<boolean> {
+  const body = JSON.stringify({ code, expiryMs: EXPIRY_MS });
+
+  return new Promise((resolve) => {
+    const req = http.request(
+      {
+        hostname: "127.0.0.1",
+        port,
+        path: "/internal/pair-register",
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        timeout: EXPIRY_MS + 5000, // slightly longer than expiry
+      },
+      (res) => {
+        const chunks: Buffer[] = [];
+        res.on("data", (chunk: Buffer) => chunks.push(chunk));
+        res.on("end", () => {
+          try {
+            const result = JSON.parse(Buffer.concat(chunks).toString("utf-8")) as {
+              paired: boolean;
+            };
+            resolve(result.paired);
+          } catch {
+            resolve(false);
+          }
+        });
+      },
+    );
+
+    req.on("error", (err) => {
+      console.error(`Failed to reach palmier serve on port ${port}: ${err.message}`);
+      console.error("Make sure `palmier serve` is running first.");
+      resolve(false);
+    });
+
+    req.on("timeout", () => {
+      req.destroy();
+      resolve(false);
+    });
+
+    req.end(body);
+  });
+}
+
 /**
  * Generate an OTP code and wait for a PWA client to pair.
  * Listens on NATS (nats/auto modes) and/or HTTP (lan/auto modes).
@@ -62,6 +91,14 @@ export async function pairCommand(): Promise<void> {
 
   const cleanups: Array<() => void | Promise<void>> = [];
 
+  // Display pairing info
+  console.log("");
+  console.log("Enter this code in your Palmier app:");
+  console.log("");
+  console.log(`  ${code}`);
+  console.log("");
+  console.log("Code expires in 5 minutes.");
+
   // NATS pairing (nats or auto mode)
   if (mode === "nats" || mode === "auto") {
     const nc = await connectNats(config);
@@ -94,84 +131,15 @@ export async function pairCommand(): Promise<void> {
     })();
   }
 
-  // HTTP pairing (lan or auto mode)
+  // LAN pairing — long-poll the running serve process
   if (mode === "lan" || mode === "auto") {
     const port = config.directPort ?? 7400;
-    const server = http.createServer(async (req, res) => {
-      res.setHeader("Access-Control-Allow-Origin", "*");
-      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-      res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-
-      if (req.method === "OPTIONS") {
-        res.writeHead(204);
-        res.end();
-        return;
-      }
-
-      if (req.method === "POST" && req.url === "/pair") {
-        const chunks: Buffer[] = [];
-        req.on("data", (chunk: Buffer) => chunks.push(chunk));
-        req.on("end", () => {
-          try {
-            const body = JSON.parse(Buffer.concat(chunks).toString("utf-8")) as {
-              code: string;
-              label?: string;
-            };
-
-            if (body.code !== code) {
-              res.writeHead(401, { "Content-Type": "application/json" });
-              res.end(JSON.stringify({ error: "Invalid code" }));
-              return;
-            }
-
-            if (paired) {
-              res.writeHead(410, { "Content-Type": "application/json" });
-              res.end(JSON.stringify({ error: "Code already used" }));
-              return;
-            }
-
-            const response = buildPairResponse(config, body.label);
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify(response));
-            onPaired();
-          } catch {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ error: "Invalid JSON" }));
-          }
-        });
-        return;
-      }
-
-      res.writeHead(404, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "Not found" }));
-    });
-
-    await new Promise<void>((resolve, reject) => {
-      server.listen(port + 1, () => resolve());
-      server.on("error", reject);
-    });
-
-    cleanups.push(() => {
-      server.close();
-    });
-  }
-
-  // Display pairing info
-  console.log("");
-  console.log("Enter this code in your Palmier app:");
-  console.log("");
-  console.log(`  ${code}`);
-  console.log("");
-
-  if (mode === "lan" || mode === "auto") {
-    const ip = detectLanIp();
-    const port = config.directPort ?? 7400;
-    console.log(`  Address: ${ip}:${port + 1}`);
-    console.log("");
+    (async () => {
+      const result = await lanPairRegister(port, code);
+      if (result) onPaired();
+    })();
   }
 
-  console.log("Code expires in 5 minutes.");
-
   // Wait for pairing or timeout
   const start = Date.now();
   await new Promise<void>((resolve) => {

package/src/transports/http-transport.ts

@@ -1,9 +1,29 @@
 import * as http from "node:http";
-import { validateSession, hasSessions } from "../session-store.js";
+import * as os from "os";
+import { validateSession, hasSessions, addSession } from "../session-store.js";
 import type { HostConfig, RpcMessage } from "../types.js";
 
 type SseClient = http.ServerResponse;
 
+interface PendingPair {
+  resolve: (result: { paired: boolean }) => void;
+  timer: ReturnType<typeof setTimeout>;
+}
+
+const pendingPairs = new Map<string, PendingPair>();
+
+function detectLanIp(): string {
+  const interfaces = os.networkInterfaces();
+  for (const name of Object.keys(interfaces)) {
+    for (const iface of interfaces[name] ?? []) {
+      if (iface.family === "IPv4" && !iface.internal) {
+        return iface.address;
+      }
+    }
+  }
+  return "127.0.0.1";
+}
+
 /**
  * Start the HTTP transport: Express-like server with RPC, SSE, and health endpoints.
  */
@@ -92,6 +112,96 @@ export async function startHttpTransport(
       return;
     }
 
+    // Internal pair-register endpoint — localhost only, long-poll
+    // The pair CLI posts here and blocks until paired or expired.
+    if (req.method === "POST" && pathname === "/internal/pair-register") {
+      if (!isLocalhost(req)) {
+        sendJson(res, 403, { error: "localhost only" });
+        return;
+      }
+      try {
+        const body = await readBody(req);
+        const { code, expiryMs } = JSON.parse(body) as {
+          code: string;
+          expiryMs: number;
+        };
+
+        if (!code) {
+          sendJson(res, 400, { error: "Missing code" });
+          return;
+        }
+
+        if (pendingPairs.has(code)) {
+          sendJson(res, 409, { error: "Code already registered" });
+          return;
+        }
+
+        const result = await new Promise<{ paired: boolean }>((resolve) => {
+          const timer = setTimeout(() => {
+            pendingPairs.delete(code);
+            resolve({ paired: false });
+          }, expiryMs ?? 5 * 60 * 1000);
+
+          pendingPairs.set(code, { resolve, timer });
+
+          // Clean up if the CLI disconnects early
+          req.on("close", () => {
+            if (pendingPairs.has(code)) {
+              clearTimeout(timer);
+              pendingPairs.delete(code);
+            }
+          });
+        });
+
+        sendJson(res, 200, result);
+      } catch {
+        sendJson(res, 400, { error: "Invalid JSON" });
+      }
+      return;
+    }
+
+    // Public pair endpoint — no auth required, PWA posts OTP code here
+    if (req.method === "POST" && pathname === "/pair") {
+      try {
+        const body = await readBody(req);
+        const { code, label } = JSON.parse(body) as {
+          code: string;
+          label?: string;
+        };
+
+        if (!code) {
+          sendJson(res, 400, { error: "Missing code" });
+          return;
+        }
+
+        const pending = pendingPairs.get(code);
+        if (!pending) {
+          sendJson(res, 401, { error: "Invalid code" });
+          return;
+        }
+
+        // Create session and build response
+        const session = addSession(label);
+        const ip = detectLanIp();
+        const response: Record<string, unknown> = {
+          hostId: config.hostId,
+          sessionToken: session.token,
+          directUrl: `http://${ip}:${port}`,
+          directToken: config.directToken,
+        };
+
+        // Resolve the long-poll and clean up
+        clearTimeout(pending.timer);
+        pendingPairs.delete(code);
+        pending.resolve({ paired: true });
+
+        sendJson(res, 200, response);
+      } catch {
+        sendJson(res, 400, { error: "Invalid JSON" });
+      }
+      return;
+    }
+
     // All other endpoints require auth
     if (!checkAuth(req)) {
       sendJson(res, 401, { error: "Unauthorized" });