replicas-cli 0.3.284 → 0.3.285

package/dist/index.cjs

@@ -17208,7 +17208,7 @@ var init_workspace_identity = __esm({
 });
 
 // ../shared/src/routes/environment.ts
-var ENVIRONMENT_MCP_TRANSPORTS, stringMap, createEnvironmentMcpRequestSchema, updateEnvironmentMcpRequestSchema, screenPasswordSchema, createEnvironmentDeviceRequestSchema, updateEnvironmentDeviceRequestSchema, provisionedDeviceSchema;
+var ENVIRONMENT_MCP_TRANSPORTS, stringMap, createEnvironmentMcpRequestSchema, updateEnvironmentMcpRequestSchema, screenPasswordSchema, hostSchema, createEnvironmentDeviceRequestSchema, updateEnvironmentDeviceRequestSchema, deviceConnectionResponseSchema, deviceHostKeysRequestSchema, DEVICE_CONNECT_COMMAND, provisionedDeviceSchema;
 var init_environment = __esm({
   "../shared/src/routes/environment.ts"() {
     "use strict";
@@ -17227,19 +17227,30 @@ var init_environment = __esm({
     });
     updateEnvironmentMcpRequestSchema = createEnvironmentMcpRequestSchema.partial();
     screenPasswordSchema = external_exports.string().min(1, "Enter the screen password").max(256).describe('Screen Sharing password, for `replicas computer screen`. On a Mac, the "VNC viewers may control screen with password" password. Never returned.');
+    hostSchema = external_exports.string().max(253).regex(/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?|[0-9A-Fa-f:]+)$/, "Enter a hostname or IP address");
     createEnvironmentDeviceRequestSchema = external_exports.object({
       name: external_exports.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/, "Use lowercase letters, numbers and dashes").describe("SSH alias in workspaces, e.g. `mac-mini` for `ssh mac-mini`."),
-      host: external_exports.string().max(253).regex(/^(?:[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?|[0-9A-Fa-f:]+)$/, "Enter a hostname or IP address").describe("Hostname or IP, such as a Tailscale MagicDNS name (`mac-mini`) or a public address."),
-      port: external_exports.number().int().min(1).max(65535).optional().describe("SSH port. Defaults to 22."),
+      host: hostSchema.optional().describe("Hostname or IP, such as a Tailscale MagicDNS name (`mac-mini`) or a public address. Leave it out when the device connects to Replicas itself with `replicas device connect`."),
+      port: external_exports.number().int().min(1).max(65535).optional().describe("SSH port on the device. Defaults to 22."),
       username: external_exports.string().regex(/^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$/, "Enter the account name on the device").describe("Account the agent signs in as."),
       screen_password: screenPasswordSchema.optional()
     });
     updateEnvironmentDeviceRequestSchema = createEnvironmentDeviceRequestSchema.partial().extend({
+      host: external_exports.union([hostSchema, external_exports.literal("")]).optional().describe("New hostname or IP, or an empty string for a device that connects to Replicas itself."),
       screen_password: external_exports.union([screenPasswordSchema, external_exports.literal("")]).optional().describe("New Screen Sharing password, or an empty string to remove it.")
     });
+    deviceConnectionResponseSchema = external_exports.object({
+      name: external_exports.string(),
+      port: external_exports.number(),
+      workspace_ids: external_exports.array(external_exports.string())
+    });
+    deviceHostKeysRequestSchema = external_exports.object({
+      host_keys: external_exports.array(external_exports.string().max(2048).regex(/^[a-z0-9@.-]+ [A-Za-z0-9+/]+={0,3}$/, "Each host key must be `<type> <base64>`")).min(1).max(8).transform((keys) => [...new Set(keys)].sort())
+    });
+    DEVICE_CONNECT_COMMAND = "npx -y replicas-cli device connect";
     provisionedDeviceSchema = external_exports.object({
       name: external_exports.string(),
-      host: external_exports.string(),
+      host: external_exports.string().nullable(),
       port: external_exports.number(),
       username: external_exports.string(),
       private_key: external_exports.string(),
@@ -31704,7 +31715,7 @@ var CLI_VERSION;
 var init_cli_version = __esm({
   "../shared/src/cli-version.ts"() {
     "use strict";
-    CLI_VERSION = "0.3.284";
+    CLI_VERSION = "0.3.285";
   }
 });
 
@@ -42288,6 +42299,29 @@ var init_variable_requests = __esm({
   }
 });
 
+// ../shared/src/websocket-liveness.ts
+function trackWebSocketLiveness(socket) {
+  let answered = true;
+  for (const event of ["pong", "message"]) socket.on(event, () => {
+    answered = true;
+  });
+  return () => {
+    if (socket.isPaused) {
+      answered = true;
+      return true;
+    }
+    if (!answered) return false;
+    answered = false;
+    socket.ping();
+    return true;
+  };
+}
+var init_websocket_liveness = __esm({
+  "../shared/src/websocket-liveness.ts"() {
+    "use strict";
+  }
+});
+
 // ../shared/src/index.ts
 var init_src = __esm({
   "../shared/src/index.ts"() {
@@ -42465,6 +42499,7 @@ var init_src = __esm({
     init_environment_setups();
     init_variable_requests();
     init_api_casing();
+    init_websocket_liveness();
   }
 });
 
@@ -45428,16 +45463,24 @@ async function envDevicesListCommand(env) {
     `/v1/environments/${await resolveEnvironmentId(env)}/devices`
   );
   output(response, ({ environment_devices }) => {
-    for (const device of environment_devices) console.log(`${device.id}	${device.name}	${device.username}@${device.host}:${device.port}`);
+    for (const device of environment_devices) {
+      console.log(`${device.id}	${device.name}	${device.host === null ? `${device.username}, connects from the device` : `${device.username}@${device.host}:${device.port}`}`);
+    }
   });
 }
 async function envDevicesAddCommand(env, name, options) {
   const id = await resolveEnvironmentId(env);
   const body = { name, host: options.host, username: options.user, port: options.port, screen_password: options.screenPassword };
   const response = await orgAuthenticatedFetch(`/v1/environments/${id}/devices`, { method: "POST", body });
-  output(response, ({ environment_device }) => {
+  const connect2 = options.host === void 0 ? await orgAuthenticatedFetch(`/v1/environments/${id}/devices/${response.environment_device.id}/connect-token`) : void 0;
+  output({ ...response, connect_token: connect2?.token }, ({ environment_device, connect_token }) => {
     console.log(import_chalk20.default.green(`Added device ${name}. Allow its key by running this on the device as ${options.user}:`));
     console.log(`mkdir -p ~/.ssh && echo '${environment_device.public_key}' >> ~/.ssh/authorized_keys`);
+    if (connect_token) {
+      console.log(import_chalk20.default.green("Then keep this running on it, so workspaces can reach it, and paste this token when it asks:"));
+      console.log(DEVICE_CONNECT_COMMAND);
+      console.log(connect_token);
+    }
   });
 }
 async function envDevicesRemoveCommand(env, nameOrId) {
@@ -45448,6 +45491,18 @@ async function envDevicesRemoveCommand(env, nameOrId) {
   await orgAuthenticatedFetch(`/v1/environments/${id}/devices/${device.id}`, { method: "DELETE" });
   outputSuccess(`Removed device ${device.name}`);
 }
+async function envDevicesResetCommand(env, nameOrId) {
+  const id = await resolveEnvironmentId(env);
+  const { environment_devices } = await orgAuthenticatedFetch(`/v1/environments/${id}/devices`);
+  const device = resolveByNameOrId(nameOrId, environment_devices);
+  if (!device) throw new Error(`Device not found: ${nameOrId}`);
+  const response = await orgAuthenticatedFetch(`/v1/environments/${id}/devices/${device.id}/connect-token`, { method: "POST" });
+  output(response, ({ token }) => {
+    console.log(import_chalk20.default.green(`Reset ${device.name}'s connection. Its old token no longer works; run this on it again and paste the new token when it asks:`));
+    console.log(DEVICE_CONNECT_COMMAND);
+    console.log(token);
+  });
+}
 function envWarmPoolCommand(enabled) {
   return async (env) => {
     const id = await resolveEnvironmentId(env);
@@ -48592,6 +48647,116 @@ trim "$1"`;
   }
 });
 
+// src/commands/device.ts
+async function refuse(response) {
+  const body = await response.json().catch(() => null);
+  throw new Error(body && typeof body === "object" && "error" in body ? String(body.error) : `Replicas refused this device (${response.status})`);
+}
+async function scanHostKeys(port) {
+  const { stdout } = await (0, import_node_util.promisify)(import_node_child_process4.execFile)("ssh-keyscan", ["-T", "5", "-p", String(port), "127.0.0.1"]).catch(() => ({ stdout: "" }));
+  return stdout.split("\n").filter((line) => line && !line.startsWith("#")).map((line) => line.split(" ").slice(1, 3).join(" "));
+}
+async function deviceConnectCommand() {
+  const token = process.env.REPLICAS_DEVICE_TOKEN ?? (isInteractive() ? (await ask({ type: "password", name: "token", message: "Device token, from the device in the environment's Devices settings" })).token : void 0);
+  if (!token) throw new Error("Paste the device token when asked, or set REPLICAS_DEVICE_TOKEN to it. It's on the device in the environment's Devices settings.");
+  const headers = { Authorization: `Bearer ${token}` };
+  let pinned = false;
+  const waiting = /* @__PURE__ */ new Map();
+  let port = 22;
+  let summary = "";
+  const wait = (workspaceId, failures = 0) => {
+    if (!waiting.has(workspaceId)) return;
+    const startedAt = Date.now();
+    let opened = false;
+    const socket = new import_ws.default(`${MONOLITH_URL.replace(/^http/, "ws")}/v1/devices/workspaces/${workspaceId}/ws`, { headers, handshakeTimeout: HEARTBEAT_MS });
+    waiting.set(workspaceId, socket);
+    const alive = trackWebSocketLiveness(socket);
+    let heartbeat;
+    socket.once("open", () => {
+      heartbeat = setInterval(() => {
+        if (!alive()) socket.terminate();
+      }, HEARTBEAT_MS);
+    });
+    socket.once("message", (data, isBinary) => {
+      if (isBinary || data.toString() !== "open") return socket.close();
+      opened = true;
+      wait(workspaceId);
+      const sshd = (0, import_node_net.connect)(port, "127.0.0.1");
+      const stream = (0, import_ws.createWebSocketStream)(socket);
+      const close = () => {
+        sshd.destroy();
+        stream.destroy();
+      };
+      sshd.once("error", (error51) => {
+        console.log(import_chalk32.default.yellow(`A workspace couldn't reach SSH on port ${port} here (${error51.message}). ${REMOTE_LOGIN_HINT}`));
+      });
+      sshd.on("error", close).on("close", close);
+      stream.on("error", close).on("close", close);
+      sshd.pipe(stream).pipe(sshd);
+    });
+    socket.on("error", () => void 0);
+    socket.once("close", () => {
+      clearInterval(heartbeat);
+      if (opened) return;
+      const failed = Date.now() - startedAt < POLL_INTERVAL_MS;
+      const delay = failed ? Math.min(5e3 * 2 ** failures, MAX_RETRY_DELAY_MS) : 0;
+      setTimeout(() => {
+        if (waiting.get(workspaceId) === socket) wait(workspaceId, failed ? failures + 1 : 0);
+      }, delay).unref();
+    });
+  };
+  for (; ; ) {
+    const response = await fetch(`${MONOLITH_URL}/v1/devices/workspaces`, { headers }).catch(() => null);
+    if (response && [401, 403, 409].includes(response.status)) await refuse(response);
+    const device = response?.ok ? deviceConnectionResponseSchema.parse(await response.json()) : void 0;
+    let problem = device ? void 0 : `Can't reach Replicas (${response?.status ?? "network error"}), retrying...`;
+    if (device && !pinned) {
+      const body = { host_keys: await scanHostKeys(device.port) };
+      const pin = body.host_keys.length === 0 ? void 0 : await fetch(`${MONOLITH_URL}/v1/devices/host-keys`, { method: "PUT", headers: { ...headers, "Content-Type": "application/json" }, body: JSON.stringify(body) }).catch(() => null);
+      if (pin && [400, 401, 403, 409].includes(pin.status)) await refuse(pin);
+      pinned = pin?.ok === true;
+      if (pin === void 0) problem = `Can't reach SSH on port ${device.port} here, retrying... ${REMOTE_LOGIN_HINT}`;
+      else if (!pinned) problem = `Can't reach Replicas (${pin?.status ?? "network error"}), retrying...`;
+    }
+    if (device && pinned) {
+      port = device.port;
+      for (const [workspaceId, socket] of waiting) {
+        if (device.workspace_ids.includes(workspaceId)) continue;
+        waiting.delete(workspaceId);
+        socket?.close();
+      }
+      for (const workspaceId of device.workspace_ids) {
+        if (waiting.has(workspaceId)) continue;
+        waiting.set(workspaceId, void 0);
+        wait(workspaceId);
+      }
+    }
+    const next = problem ?? `\u2713 ${device?.name}: ready for ${waiting.size} ${waiting.size === 1 ? "workspace" : "workspaces"}, forwarding to SSH on port ${port}`;
+    if (next !== summary) console.log(problem ? import_chalk32.default.yellow(next) : import_chalk32.default.green(next));
+    summary = next;
+    await (0, import_promises2.setTimeout)(POLL_INTERVAL_MS);
+  }
+}
+var import_chalk32, import_node_child_process4, import_node_net, import_promises2, import_node_util, import_ws, POLL_INTERVAL_MS, HEARTBEAT_MS, MAX_RETRY_DELAY_MS, REMOTE_LOGIN_HINT;
+var init_device = __esm({
+  "src/commands/device.ts"() {
+    "use strict";
+    import_chalk32 = __toESM(require("chalk"));
+    import_node_child_process4 = require("child_process");
+    import_node_net = require("net");
+    import_promises2 = require("timers/promises");
+    import_node_util = require("util");
+    import_ws = __toESM(require("ws"));
+    init_src();
+    init_monolith_url();
+    init_output();
+    POLL_INTERVAL_MS = 1e4;
+    HEARTBEAT_MS = 3e4;
+    MAX_RETRY_DELAY_MS = 5 * 6e4;
+    REMOTE_LOGIN_HINT = "On a Mac, turn on Remote Login in System Settings \u2192 General \u2192 Sharing.";
+  }
+});
+
 // src/index.ts
 var src_exports = {};
 function parseBooleanOption(value) {
@@ -48663,6 +48828,7 @@ var init_src2 = __esm({
     init_slack4();
     init_service();
     init_environment3();
+    init_device();
     init_config();
     init_organization2();
     init_output();
@@ -48680,6 +48846,7 @@ var init_src2 = __esm({
       "codex-auth",
       "muse-auth",
       "config",
+      "device",
       "init",
       "login",
       "logout",
@@ -48858,12 +49025,14 @@ var init_src2 = __esm({
     envMcps.command("remove <env> <name-or-id>").description("Remove an MCP server").action(run(envMcpsRemoveCommand));
     envDevices = environment.command("devices", { hidden: true }).description("Computers the agent reaches over SSH, like a Mac mini or your own laptop");
     envDevices.command("list <env>").description("List devices").action(run(envDevicesListCommand));
-    envDevices.command("add <env> <name>").description("Add a device and print the command that allows its key on the device").requiredOption("--host <host>", "Hostname or IP, such as its Tailscale name").requiredOption("--user <user>", "Account the agent signs in as").option("--port <port>", "SSH port (default 22)", (value) => {
+    envDevices.command("add <env> <name>").description("Add a device and print the command that allows its key on the device").option("--host <host>", "Hostname or IP, such as its Tailscale name. Leave it out to connect from the device instead").requiredOption("--user <user>", "Account the agent signs in as").option("--port <port>", "SSH port (default 22)", (value) => {
       const port = Number(value);
       if (!Number.isInteger(port)) throw new import_commander.InvalidArgumentError("must be a whole number");
       return port;
     }).option("--screen-password <password>", "Screen Sharing password, so the agent can see and control the screen").action(run(envDevicesAddCommand));
     envDevices.command("remove <env> <name-or-id>").description("Remove a device and delete its key").action(run(envDevicesRemoveCommand));
+    envDevices.command("reset <env> <name-or-id>").description("Replace the connect token of a device that connects from itself and forget its SSH identity, for a leaked token or a reinstalled device").action(run(envDevicesResetCommand));
+    program.command("device", { hidden: true }).description("Run on one of your computers so Replicas workspaces can reach it").command("connect").description("Keep this computer reachable from the workspaces that have it, without opening ports or a tailnet. Asks for the token from the device's settings, or reads REPLICAS_DEVICE_TOKEN").action(run(deviceConnectCommand));
     envWarmPool = environment.command("warm-pool").description("Keep pre-warmed workspaces ready for an environment");
     envWarmPool.command("enable <env>").description("Enable the warm pool").action(run(envWarmPoolCommand(true)));
     envWarmPool.command("disable <env>").description("Disable the warm pool").action(run(envWarmPoolCommand(false)));
@@ -48975,12 +49144,12 @@ ${VISUAL_PAGE_RULES}`).action(run(visualizeCommand));
 });
 
 // src/bin.ts
-var import_node_child_process4 = require("child_process");
-var import_chalk32 = __toESM(require("chalk"));
+var import_node_child_process5 = require("child_process");
+var import_chalk33 = __toESM(require("chalk"));
 init_config();
 if (process.argv[2] === "computer" && isAgentMode()) {
-  const result = (0, import_node_child_process4.spawnSync)("replicas-computer", process.argv.slice(3), { stdio: "inherit" });
-  if (result.error) console.error(import_chalk32.default.red(`
+  const result = (0, import_node_child_process5.spawnSync)("replicas-computer", process.argv.slice(3), { stdio: "inherit" });
+  if (result.error) console.error(import_chalk33.default.red(`
 \u2717 replicas-computer is unavailable in this workspace image
 `));
   process.exitCode = result.error ? 1 : result.status ?? 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.3.284",
+  "version": "0.3.285",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.cjs",
   "bin": {
@@ -47,11 +47,13 @@
     "dotenv": "^17.2.3",
     "open": "^8.4.2",
     "prompts": "^2.4.2",
-    "tslib": "^2.6.2"
+    "tslib": "^2.6.2",
+    "ws": "8.21.0"
   },
   "devDependencies": {
     "@replicas/shared": "*",
     "@types/node": "^20.11.0",
+    "@types/ws": "8.18.1",
     "tsup": "^8.5.0",
     "typescript": "^5.3.3"
   }