skydive-cli 0.5.0-beta.31 → 0.5.0-beta.32

package/dist/js/{client-DbqRBquD.mjs → client-d6K9qm6B.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, n as fetchPortalDevices, r as findThisDevice } from "./api-DG5W6iwx.mjs";
+import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, l as startTlsForward, n as fetchPortalDevices, r as findThisDevice } from "./api-DQCaztBg.mjs";
 import os from "node:os";
 import { z } from "zod";
 import * as childProcess from "node:child_process";
@@ -237,10 +237,36 @@ function decodeFrame(frame) {
 */
 var ReverseListener = class {
 	server = null;
+	tls = null;
 	conns = /* @__PURE__ */ new Set();
 	constructor(opts) {
 		this.opts = opts;
 	}
+	/**
+	* One tunnel to the sandbox target — the same per-connection edge dial the
+	* plain accept path inlines, shaped for the TLS listener's acquireTunnel
+	* seam. Resolves once the upgrade completes, with the duplex PAUSED so no
+	* early bytes drop before adoption.
+	*/
+	dialTunnel() {
+		const { dialOrigin, targetPort, token } = this.opts.target();
+		const ws = new WebSocket(`${dialOrigin.replace(/^http/, "ws")}/portal/tcp?port=${targetPort}`, { headers: { authorization: `Bearer ${token}` } });
+		return new Promise((resolve, reject) => {
+			ws.once("error", reject);
+			ws.once("unexpected-response", (_req, res) => {
+				res.destroy();
+				reject(/* @__PURE__ */ new Error(`tunnel rejected (HTTP ${res.statusCode ?? "?"})`));
+			});
+			ws.once("open", () => {
+				const stream = createWebSocketStream(ws);
+				stream.pause();
+				resolve({
+					stream,
+					close: () => stream.destroy()
+				});
+			});
+		});
+	}
 	start() {
 		const server = net.createServer((sock) => {
 			this.conns.add(sock);
@@ -266,12 +292,52 @@ var ReverseListener = class {
 			});
 		});
 		server.once("error", (err) => this.opts.onListening(err));
-		server.listen(this.opts.listenPort, "127.0.0.1", () => this.opts.onListening(null));
+		server.listen(this.opts.listenPort, "127.0.0.1", () => {
+			this.opts.onListening(null);
+			this.startTls();
+		});
 		this.server = server;
 	}
+	/**
+	* The additive TLS+h2 twin (fire-and-forget from start): browsers negotiate
+	* h2 there, lifting the 6-connection cap that serializes module-heavy dev
+	* servers. Every failure logs once and leaves the plain listener — the
+	* product's default behavior — untouched. The ack (`reverse_listening`)
+	* deliberately stays keyed to the plain bind: TLS is an enhancement, never
+	* a condition of "the tunnel is up".
+	*/
+	startTls() {
+		const source = this.opts.tlsCertSource;
+		if (!source) return;
+		(async () => {
+			try {
+				const cert = await source();
+				if (!cert || this.server === null) return;
+				this.tls = await startTlsForward({
+					cert,
+					localPort: this.opts.listenPort,
+					targetPort: this.opts.target().targetPort,
+					acquireTunnel: () => this.dialTunnel(),
+					log: this.opts.log
+				});
+				if (this.server === null) {
+					const straggler = this.tls;
+					this.tls = null;
+					await straggler.close();
+					return;
+				}
+				this.opts.log(`expose: TLS origin up: https://${this.tls.hostname}:${this.tls.port} (HTTP/2)`);
+			} catch (error) {
+				this.opts.log(`expose: TLS origin unavailable (${error instanceof Error ? error.message : String(error)}); http listener unaffected`);
+			}
+		})();
+	}
 	stop() {
 		this.server?.close();
 		this.server = null;
+		const tls = this.tls;
+		this.tls = null;
+		if (tls) tls.close();
 		for (const sock of this.conns) sock.destroy();
 		this.conns.clear();
 	}
@@ -365,6 +431,7 @@ var JobManager = class {
 			listener: new ReverseListener({
 				listenPort,
 				target: () => rev.target,
+				tlsCertSource: this.opts.tlsCertSource,
 				log: (msg) => {
 					if (rev.settled) return;
 					this.opts.send(encodeData(id, STREAM.stderr, rev.seq, Buffer.from(msg)));
@@ -619,6 +686,7 @@ var PortalClient = class {
 			this.ws = ws;
 			const jobs = new JobManager({
 				resolveCwd: this.opts.resolveCwd,
+				tlsCertSource: this.opts.tlsCertSource,
 				send: (frame) => {
 					if (ws.readyState === WebSocket.OPEN) ws.send(frame);
 				}

package/dist/js/client-yz3zrpAS.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { t as PortalClient } from "./client-d6K9qm6B.mjs";
+import "./api-DQCaztBg.mjs";
+
+export { PortalClient };

package/dist/js/daemon-Btd2436i.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import "./client-d6K9qm6B.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-CxFxH36O.mjs";
+import "./tls-cert-CV-pwxVN.mjs";
+import "./api-DQCaztBg.mjs";
+
+export { runPortalDaemon };

package/dist/js/{daemon-BTyg329O.mjs → daemon-CxFxH36O.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { n as isRecord, t as PortalClient } from "./client-DbqRBquD.mjs";
+import { n as isRecord, t as PortalClient } from "./client-d6K9qm6B.mjs";
+import { t as defaultTlsCertSource } from "./tls-cert-CV-pwxVN.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -20,7 +21,7 @@ import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1786761220";
+	return "1786765910";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -500,6 +501,7 @@ var PortalDaemon = class {
 				deviceToken: this.deviceToken
 			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
+			tlsCertSource: defaultTlsCertSource(process.env, (msg) => this.logInfo(msg)),
 			persistedMachineName: this.persistedMachineName,
 			onMachineName: (name, source) => this.onMachineName(name, source),
 			onState: (state) => {

package/dist/js/daemon-client-1Qfc_Y3J.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-d6K9qm6B.mjs";
+import "./daemon-CxFxH36O.mjs";
+import "./tls-cert-CV-pwxVN.mjs";
+import "./api-DQCaztBg.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-Br1NlkRp.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-client--A_yMKq6.mjs → daemon-client-Br1NlkRp.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-BTyg329O.mjs";
+import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-CxFxH36O.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";