replica-bridge 0.3.3 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replica-bridge",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Lets the ChatReplica iPhone app use Codex on this computer through a relay, end-to-end encrypted.",
   "type": "module",
   "bin": {

package/src/bridge/install.js

@@ -22,6 +22,8 @@ export const PACKAGE_VERSION         = JSON.parse(fs.readFileSync(path.resolve(i
                     
                               
               
+                                                                 
+                
  
 
                               
@@ -62,6 +64,7 @@ export function servicePlan(spec             )              {
   <array>
 ${spec.program.map((a) => `    <string>${xml(a)}</string>`).join("\n")}
   </array>
+  <key>WorkingDirectory</key><string>${xml(spec.home)}</string>
   <key>EnvironmentVariables</key>
   <dict>
 ${env}
@@ -110,6 +113,10 @@ WantedBy=default.target
           { command: "systemctl", args: ["--user", "daemon-reload"] },
           { command: "systemctl", args: ["--user", "enable", unit] },
           { command: "systemctl", args: ["--user", "restart", unit] },
+          // A user service starts with the user's session; lingering starts it at boot, before anyone logs in, so a
+          // computer that restarts unattended (a server, a Mac mini in a cupboard) comes back. Allowed for oneself
+          // on most distributions; where it is not, main.ts says how.
+          ...(spec.user ? [{ command: "loginctl", args: ["enable-linger", spec.user], optional: true }] : []),
         ],
         uninstall: [
           { command: "systemctl", args: ["--user", "disable", "--now", unit], optional: true },
@@ -157,19 +164,60 @@ function serviceEnv()                         {
   for (const [key, value] of Object.entries(process.env)) {
     if (value !== undefined && (key === "PATH" || key === "Path" || /^(CODEX_|REPLICA_|RELAY_ENV$)/.test(key)) && key !== "REPLICA_BRIDGE_LOG") env[key] = value;
   }
+  for (const key of ["PATH", "Path"]) if (env[key]) env[key] = servicePATH(env[key]);
   env.REPLICA_BRIDGE_SERVICE = "1";
   return env;
 }
 
+/**
+ * PATH without what npx put in front of it: its temporary package's .bin (npm may clear that cache), the
+ * node_modules/.bin of the folder npx ran in and of every folder above it, and npm's node-gyp shim.
+ */
+export function servicePATH(value        , delimiter = path.delimiter)         {
+  return value.split(delimiter).filter((dir) => dir && !/[\\/]_npx[\\/]|[\\/]node_modules[\\/]\.bin$|node-gyp-bin$/.test(dir)).join(delimiter);
+}
+
+/**
+ * The node the service runs. process.execPath has its links resolved: with Homebrew it is
+ * /opt/homebrew/Cellar/node/<version>/bin/node, which `brew upgrade node` deletes, so at the next login (after a
+ * restart) launchd had nothing to run and the bridge never came back. A `node` on PATH that is the same program under
+ * a path without the version (/opt/homebrew/bin/node, which brew points at the new version) is used instead.
+ */
+export function stableNodePath(execPath        , pathValue        , delimiter = path.delimiter, realpath = (p        ) => fs.realpathSync(p))         {
+  let real        ;
+  try { real = realpath(execPath); } catch { return execPath; }
+  const name = path.basename(execPath);
+  for (const dir of servicePATH(pathValue, delimiter).split(delimiter)) {
+    if (!dir) continue;
+    const candidate = path.join(dir, name);
+    if (candidate === execPath) return execPath; // already the path PATH finds, as with nvm or the official installer
+    try { if (realpath(candidate) === real) return candidate; } catch { /* not there */ }
+  }
+  return execPath;
+}
+
 /**
  * The script the service runs. From npx (inside node_modules) a copy of this version is installed under
  * ~/.config/replica-bridge/app, since npm may clear its npx cache; from a working copy, the working copy itself.
  */
-function installedScript(say                        )         {
-  const current = process.argv[1] ? fs.realpathSync(process.argv[1]) : "";
-  if (!current.split(path.sep).includes("node_modules")) return current;
+export function installedScript(say                        , current = process.argv[1] ? fs.realpathSync(process.argv[1]) : "")         {
+  const parts = current.split(path.sep);
+  const at = parts.lastIndexOf("node_modules");
+  if (at < 0) return current;
   const app = path.join(bridgeHome(), "app");
-  const spec = process.env.REPLICA_BRIDGE_PACKAGE ?? `replica-bridge@${PACKAGE_VERSION}`;
+  if (!process.env.REPLICA_BRIDGE_PACKAGE) {
+    // Copy what npx already installed (this package and its dependencies) rather than asking npm again: npx may have
+    // used a registry the second npm would not (`npx --registry`, or a company feed without this package).
+    const from = parts.slice(0, at + 1).join(path.sep);
+    say(`Copying replica-bridge ${PACKAGE_VERSION} to ${app}…`);
+    const next = `${app}.${process.pid}.part`;
+    fs.rmSync(next, { recursive: true, force: true });
+    fs.cpSync(from, path.join(next, "node_modules"), { recursive: true, dereference: true });
+    fs.rmSync(app, { recursive: true, force: true });
+    fs.renameSync(next, app);
+    return path.join(app, "node_modules", ...parts.slice(at + 1));
+  }
+  const spec = process.env.REPLICA_BRIDGE_PACKAGE;
   say(`Installing ${spec} in ${app}…`);
   fs.mkdirSync(app, { recursive: true });
   // npx's own npm_* settings (a temporary prefix, for one) must not leak into this install.
@@ -193,14 +241,15 @@ export function readServiceInfo()                     {
 }
 
 function spec(program          )              {
-  return { platform: process.platform, label: serviceLabel(), home: os.homedir(), bridgeHome: bridgeHome(), program, env: serviceEnv(), uid: os.userInfo().uid };
+  const { uid, username } = os.userInfo();
+  return { platform: process.platform, label: serviceLabel(), home: os.homedir(), bridgeHome: bridgeHome(), program, env: serviceEnv(), uid, user: username };
 }
 
 /** Installs (or replaces) the background service and starts it. `startArgs` are the options `start` keeps. */
 export function installService(startArgs          , say                        )              {
   servicePlan(spec([])); // fails early on a platform without a service manager
   stopRunning();
-  const program = [process.execPath, installedScript(say), "start", ...startArgs];
+  const program = [stableNodePath(process.execPath, process.env.PATH ?? process.env.Path ?? ""), installedScript(say), "start", ...startArgs];
   const plan = servicePlan(spec(program));
   fs.mkdirSync(bridgeHome(), { recursive: true, mode: 0o700 });
   for (const file of plan.files) {
@@ -236,10 +285,23 @@ export function clearPid() {
   try { if (fs.readFileSync(pidPath(), "utf8").trim() === String(process.pid)) fs.rmSync(pidPath()); } catch { /* gone */ }
 }
 
+/**
+ * Whether a pid file was written before this boot. A computer that loses power or is shut down hard leaves it behind,
+ * and after the restart its pid can belong to any other process: `start` took that for a running bridge, exited 1,
+ * and the service manager retried every ten seconds for as long as that process lived. Five seconds of slack, since
+ * the boot time is worked out from the uptime.
+ */
+export function writtenBeforeBoot(mtimeMs        , now = Date.now(), uptimeSeconds = os.uptime())          {
+  return mtimeMs < now - uptimeSeconds * 1000 - 5000;
+}
+
 /** The background bridge's pid while it runs. */
 export function runningPid()                {
   let pid        ;
-  try { pid = Number(fs.readFileSync(pidPath(), "utf8").trim()); } catch { return null; }
+  try {
+    pid = Number(fs.readFileSync(pidPath(), "utf8").trim());
+    if (writtenBeforeBoot(fs.statSync(pidPath()).mtimeMs)) return null;
+  } catch { return null; }
   if (!pid || pid === process.pid) return null;
   try { process.kill(pid, 0); return pid; } catch (error) { return (error                         ).code === "EPERM" ? pid : null; }
 }

package/src/bridge/main.js

@@ -12,6 +12,7 @@
 //   devices
 //   revoke <deviceId>
 import fs from "node:fs";
+import os from "node:os";
 import readline from "node:readline/promises";
 import { parseArgs, format } from "node:util";
 import { relayRequest } from "../http.js";
@@ -109,7 +110,11 @@ function install()       {
   const plan = installService(startArgs(), console.log);
   console.log(`Running in the background: ${plan.where}. It starts at login and comes back if it stops, so this terminal can be closed.`);
   console.log(`Log: ${logPath()}. Remove it with "npx replica-bridge uninstall".`);
-  if (process.platform === "linux") console.log(`To keep it running while you are logged out: loginctl enable-linger ${process.env.USER ?? "$USER"}`);
+  // The install asked for lingering (the service starts at boot, not at login); some systems only let root grant it.
+  const user = os.userInfo().username;
+  if (process.platform === "linux" && !fs.existsSync(`/var/lib/systemd/linger/${user}`)) {
+    console.log(`To start it when the computer boots, before anyone logs in: sudo loginctl enable-linger ${user}`);
+  }
 }
 
 async function pairOrExplain() {

package/src/bridge/service.js

@@ -10,7 +10,7 @@ import { Duplex } from "node:stream";
 import { WebSocket } from "ws";
                                   
 import {
-  CloseCode, FrameCipher, MAX_FRAME_BYTES, StreamBuffer, b64url, fromB64url, generateKeyPair, hostSessionKeys,
+  CloseCode, FrameCipher, MAX_FRAME_BYTES, RELAY_REPLY_LIMIT, StreamBuffer, b64url, fromB64url, generateKeyPair, hostSessionKeys,
 } from "../protocol.js";
                                                                             
 import { relaySocketURL } from "../http.js";
@@ -233,7 +233,11 @@ export class BridgeService {
     const stream         = { id: crypto.randomBytes(12).toString("base64url"), deviceId, appServer, out: new StreamBuffer(), in: new StreamBuffer(), conn: null, expiry: null, ackTimer: null, relayed: Promise.resolve() };
     this.streams.set(stream.id, stream);
     appServer.on("message", (data         ) => {
-      const annotated = annotateWriterError(data.toString(), this.options.findWriter);
+      const text = data.toString();
+      const fitted = fitLine(text);
+      if (fitted === null) return this.log(`stream ${stream.id}: dropped a ${text.length}-byte app-server notification too large for the relay`);
+      if (fitted !== text) this.log(`stream ${stream.id}: answered a ${text.length}-byte app-server reply too large for the relay with an error`);
+      const annotated = annotateWriterError(fitted, this.options.findWriter);
       stream.relayed = stream.relayed.then(async () => {
         const line = await annotated;
         if (!this.streams.has(stream.id)) return;
@@ -290,7 +294,9 @@ export class BridgeService {
       const pipe = Duplex.from({ readable: child.stdout , writable: child.stdin  })                                    ;
       // The HTTP client that carries the WebSocket handshake tunes its socket; a pipe has nothing to tune.
       for (const name of ["setNoDelay", "setKeepAlive", "setTimeout", "ref", "unref"]) pipe[name] = () => pipe;
-      const ws = new WebSocket("ws://localhost/", { createConnection: () => pipe         , perMessageDeflate: false, maxPayload: MAX_FRAME_BYTES });
+      // Read app-server messages well past what one relay frame holds, so fitLine answers a big reply with an error
+      // rather than the oversized message closing the app-server connection.
+      const ws = new WebSocket("ws://localhost/", { createConnection: () => pipe         , perMessageDeflate: false, maxPayload: APP_SERVER_MAX_MESSAGE_BYTES });
       const fail = (why        ) => { ws.removeAllListeners("open"); killCommand(child); reject(new Error(why)); };
       child.once("error", (error) => fail(`could not run codex: ${error.message}`));
       child.once("exit", (code) => { if (ws.readyState !== WebSocket.OPEN) fail(`codex app-server proxy exited (${code})${stderr ? `: ${stderr.trim()}` : ""}`); });
@@ -339,3 +345,20 @@ export class BridgeService {
     throw new Error(`codex app-server did not come up: ${last?.message}`);
   }
 }
+
+/** Largest app-server message the bridge reads before refusing it. */
+const APP_SERVER_MAX_MESSAGE_BYTES = 256 * 1024 * 1024;
+
+/**
+ * An app-server line as it can cross the relay: unchanged when it fits RELAY_REPLY_LIMIT, a JSON-RPC error with the
+ * same id when it is a reply that does not (`error.data.replicaTooLarge: {bytes, limit}`, PROTOCOL.md), and null for a
+ * notification that does not, which has no one to answer.
+ */
+export function fitLine(line        )                {
+  const bytes = Buffer.byteLength(line, "utf8");
+  if (bytes <= RELAY_REPLY_LIMIT) return line;
+  let id         ;
+  try { id = (JSON.parse(line)                    ).id; } catch { return null; }
+  if (id === undefined || id === null) return null;
+  return JSON.stringify({ id, error: { code: -32010, message: `the reply is ${bytes} bytes, more than the relay carries (${RELAY_REPLY_LIMIT})`, data: { replicaTooLarge: { bytes, limit: RELAY_REPLY_LIMIT } } } });
+}

package/src/protocol.js

@@ -9,6 +9,12 @@ export const LINK_SCHEME = "chatreplica:";
 export const CODE_ALPHABET = "23456789ABCDEFGHJKMNPQRSTVWXYZ";
 export const CODE_LENGTH = 8;
 export const MAX_FRAME_BYTES = 16 * 1024 * 1024;
+/**
+ * The longest app-server line the bridge forwards. A line travels as {t,seq,line} JSON, sealed (+16 bytes) and
+ * base64url encoded (x4/3) inside a frame envelope, so 11 MiB stays under MAX_FRAME_BYTES; longer replies (fs/readFile
+ * of a big file) come back as a JSON-RPC error instead of a frame the relay would refuse by closing the connection.
+ */
+export const RELAY_REPLY_LIMIT = 11 * 1024 * 1024;
 
 export const b64url = (data            )         => Buffer.from(data).toString("base64url");
 export const fromB64url = (text        )         => Buffer.from(text, "base64url");