querysub 0.655.0 → 0.657.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.655.0",
+  "version": "0.657.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -79,8 +79,8 @@
     "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
     "pako": "^2.1.0",
     "peggy": "^5.0.6",
-    "sliftutils": "^1.7.127",
-    "socket-function": "^1.2.34",
+    "sliftutils": "^1.7.130",
+    "socket-function": "^1.2.35",
     "terser": "^5.31.0",
     "typenode": "^6.6.1",
     "typesafecss": "^0.32.0",

package/src/-g-core-values/NodeCapabilities.ts

@@ -14,7 +14,7 @@ import { formatTime } from "socket-function/src/formatting/format";
 import type { DebugFunctionShardInfo } from "../3-path-functions/PathFunctionRunner";
 import type { AuthoritySpec } from "../0-path-value-core/PathRouter";
 import { requiresNetworkTrustHook } from "../-d-trust/NetworkTrust2";
-import { isNoNetwork } from "../config";
+import { isNoNetwork, isPublic } from "../config";
 import { getDomain } from "../config";
 import { getDebuggerUrl } from "../diagnostics/listenOnDebugger";
 import { hackDevtoolsWebsocketForward } from "./oneTimeForward";
@@ -176,10 +176,12 @@ class NodeCapabilitiesControllerBase {
     }
 
     public async getInspectURL() {
+        assertAssistedDebugConnectionAllowed();
         return await getDebuggerUrl();
     }
 
     public async exposeExternalDebugPortOnce(forExternalIP: string) {
+        assertAssistedDebugConnectionAllowed();
         // https://notdevtools.com/devtools/inspector.html?experiments=true&v8only=true&ws=127.0.0.1:62448/22895aed-f8da-4dfb-8d50-e432a9c2d827
         let debugURL = await this.getInspectURL();
 
@@ -203,6 +205,13 @@ class NodeCapabilitiesControllerBase {
 }
 let lastExposed: (() => void) | undefined;
 
+/** The assisted debug connection (opening the inspector, forwarding the port externally, TLS proxying) only exists because public servers can't be reached directly - on a non-public server the debugger can be attached directly, and the forwarding machinery would only add attack surface. */
+export function assertAssistedDebugConnectionAllowed() {
+    if (!isPublic()) {
+        throw new Error(`Non-public server, connect directly. Don't use this assisted connection code.`);
+    }
+}
+
 
 let getFunctionRunnerShards = () => [] as DebugFunctionShardInfo[];
 export function set_debug_getFunctionRunnerShards(fnc: () => DebugFunctionShardInfo[]) {

package/src/deployManager/setupMachineMain.ts

@@ -4,6 +4,7 @@ import { Querysub } from "../4-querysub/Querysub";
 import { runPromise } from "../functional/runCommand";
 import fs from "fs";
 import os from "os";
+import path from "path";
 import readline from "readline";
 import open from "open";
 import { fsExistsAsync } from "../fs";
@@ -113,6 +114,12 @@ async function writeRemoteFile(sshRemote: string, remotePath: string, content: s
     await runPromise(`ssh ${sshRemote} "echo ${encoded} | base64 -d | ${write}"`);
 }
 
+/** Reads one value off the remote: the last line of the command's output, since banners and connection chatter come before it. */
+async function sshValue(sshRemote: string, command: string, config?: { nothrow?: boolean }): Promise<string> {
+    let output = await runPromise(`ssh ${sshRemote} "${command}"`, { nothrow: config?.nothrow });
+    return (output.trim().split("\n").at(-1) || "").trim();
+}
+
 function getGitHubKeyCachePath(repoUrl: string): string {
     let repoOwner = "";
     let repoName = "";
@@ -490,7 +497,7 @@ async function main() {
             }
 
             // Get the public key from remote machine
-            const sshPublicKey = await runPromise(`ssh ${sshRemote} "cat ~/.ssh/id_rsa.pub"`);
+            const sshPublicKey = await sshValue(sshRemote, "cat ~/.ssh/id_rsa.pub");
             const keyTitle = `Machine Setup - ${sshRemote} - ${new Date().toISOString()}`;
 
             // Add the deploy key to GitHub repository
@@ -512,8 +519,8 @@ async function main() {
     console.log("✅ Dependencies installed");
 
     // 6. Install the daemon that keeps the machine process running
-    let remoteUser = (await runPromise(`ssh ${sshRemote} "whoami"`)).trim();
-    let remoteHome = (await runPromise(`ssh ${sshRemote} "echo $HOME"`)).trim();
+    let remoteUser = await sshValue(sshRemote, "whoami");
+    let remoteHome = await sshValue(sshRemote, "echo $HOME");
     console.log(`Installing the ${SERVICE_UNIT_NAME} daemon (user ${remoteUser}, home ${remoteHome})...`);
     await writeRemoteFile(sshRemote, `~/${DAEMON_SCRIPT_NAME}`, getDaemonScript(remoteHome), false);
     await runPromise(`ssh ${sshRemote} "chmod +x ~/${DAEMON_SCRIPT_NAME}"`);
@@ -559,7 +566,7 @@ sudo systemctl start ${SERVICE_UNIT_NAME}
     let screenDeadline = Date.now() + SCREEN_VERIFY_TIMEOUT;
     let screenUp = false;
     while (Date.now() < screenDeadline) {
-        let panePid = (await runPromise(`ssh ${sshRemote} "tmux list-panes -t ${SERVICE_NAME} -F '#{pane_pid}' 2>/dev/null || true"`, { nothrow: true })).trim();
+        let panePid = await sshValue(sshRemote, `tmux list-panes -t ${SERVICE_NAME} -F '#{pane_pid}' 2>/dev/null || true`, { nothrow: true });
         if (panePid) {
             screenUp = true;
             break;
@@ -575,8 +582,37 @@ sudo systemctl start ${SERVICE_UNIT_NAME}
     console.log(`   Screen:  ssh ${sshRemote} -t "tmux attach -t ${SERVICE_NAME}"`);
     console.log(`   Status:  ssh ${sshRemote} "systemctl status ${SERVICE_UNIT_NAME}"`);
 
+    await runMachineDeployHook(sshRemote);
+
     console.log("\n🎉 Machine setup complete!");
 }
 
+async function runMachineDeployHook(sshRemote: string) {
+    let hookPathBase = path.resolve("./machineDeploy");
+    let hookExists = false;
+    for (let extension of [".ts", ".tsx", ".js"]) {
+        if (await fsExistsAsync(hookPathBase + extension)) {
+            hookExists = true;
+            break;
+        }
+    }
+    if (!hookExists) {
+        console.log(`No machineDeploy file at ${hookPathBase}, skipping the application deploy hook`);
+        return;
+    }
+    console.log(`Running the machineDeploy hook at ${hookPathBase}`);
+    try {
+        let hookModule = await import(hookPathBase) as { machineDeploy?: (config: { sshRemote: string }) => Promise<void> };
+        if (!hookModule.machineDeploy) {
+            throw new Error(`Expected ${hookPathBase} to export machineDeploy, exports are: ${Object.keys(hookModule).join(", ") || "(none)"}`);
+        }
+        await hookModule.machineDeploy({ sshRemote });
+        console.log("✅ machineDeploy hook finished");
+    } catch (e) {
+        console.error((e as Error).stack || String(e));
+        console.error(`⚠️  The machineDeploy hook failed (see the error above). This is fine if the synchronization database hasn't been set up yet, or isn't running.`);
+    }
+}
+
 
 main().catch(console.error).finally(() => process.exit(0));

package/src/diagnostics/MachineThreadInfo.tsx

@@ -10,7 +10,7 @@ import { assertIsNetworkTrusted } from "../-d-trust/NetworkTrust2";
 import { runPromise } from "../functional/runCommand";
 import { errorToUndefinedSilent } from "../errors";
 import { decodeNodeId } from "sliftutils/misc/https/certs";
-import { getDomain } from "../config";
+import { getDomain, isPublic } from "../config";
 import { keyBy, keyByArray, timeInSecond, timeoutToUndefined, timeoutToUndefinedSilent } from "socket-function/src/misc";
 import dns from "dns";
 import { isDefined } from "../misc";
@@ -239,7 +239,8 @@ class MachineThreadInfoBase {
             hostname: hostname?.trim() || "",
             entrypoint: process.argv[1] || "",
             aliveTime: aliveTime,
-            inspectURL: await getDebuggerUrl(),
+            // Only public servers hand out an inspect URL - getDebuggerUrl opens the inspector port as a side effect, and on a non-public server the debugger should be attached directly instead
+            inspectURL: isPublic() && await getDebuggerUrl() || "",
         };
     }
 

package/src/diagnostics/NodeViewer.tsx

@@ -5,7 +5,7 @@ import { getAllNodeIds, getBrowserUrlNode, syncNodesNow } from "../../src/-f-nod
 import { errorToUndefined, errorToUndefinedSilent, logErrors, timeoutToError } from "../../src/errors";
 import { QuerysubController } from "../../src/4-querysub/QuerysubController";
 import { Querysub } from "../../src/4-querysub/Querysub";
-import { NodeCapabilitiesController, getControllerNodeIdList } from "../../src/-g-core-values/NodeCapabilities";
+import { NodeCapabilitiesController, assertAssistedDebugConnectionAllowed, getControllerNodeIdList } from "../../src/-g-core-values/NodeCapabilities";
 import { lazy } from "socket-function/src/caching";
 import { atomicObjectWrite } from "../../src/2-proxy/PathValueProxyWatcher";
 import { Button } from "../../src/library-components/Button";
@@ -355,6 +355,7 @@ class NodeViewerControllerBase {
     }
 
     public async getExternalInspectURL(nodeId: string) {
+        assertAssistedDebugConnectionAllowed();
         // TODO: Replace this with a an HTTPS => HTTP proxy, adding a secret time based key
         //  - Needs to run in another process
         //  - Key will use machine hash(secret key + time mod interval). Will last for 2X interval, so at
@@ -482,6 +483,7 @@ class NodeViewerControllerBase {
     }
 
     public async getInspectURL(nodeId: string) {
+        assertAssistedDebugConnectionAllowed();
         return await NodeCapabilitiesController.nodes[nodeId].getInspectURL();
     }