skydive-cli 0.5.0-beta.31 → 0.5.0-beta.32

package/dist/js/{forward-DL6DYqyc.mjs → forward-zwB55Bls.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { t as fetchForwardTarget } from "./api-DG5W6iwx.mjs";
+import { r as warnOnRebindProtection } from "./tls-cert-CV-pwxVN.mjs";
+import { l as startTlsForward, t as fetchForwardTarget } from "./api-DQCaztBg.mjs";
 import net from "node:net";
 import { WebSocket, createWebSocketStream } from "ws";
 
@@ -103,7 +104,7 @@ const MAX_POOL_SIZE = 16;
 * sandbox recycle just costs the next connection a cold-start wait rather
 * than invalidating the forward.
 */
-async function startForward({ auth, agentId, localPort, targetPort, log }) {
+async function startForward({ auth, agentId, localPort, targetPort, tlsCertSource, log }) {
 	let target = await fetchForwardTarget(auth, agentId);
 	let mintedAt = Date.now();
 	async function freshTarget() {
@@ -174,11 +175,31 @@ async function startForward({ auth, agentId, localPort, targetPort, log }) {
 		});
 	});
 	const addr = server.address();
+	const boundPort = addr && typeof addr === "object" ? addr.port : localPort;
+	let tls = null;
+	if (tlsCertSource) try {
+		const cert = await tlsCertSource();
+		if (cert) {
+			if (cert.hostname !== "localhost") await warnOnRebindProtection(cert.hostname, log);
+			tls = await startTlsForward({
+				cert,
+				localPort: boundPort,
+				targetPort,
+				acquireTunnel: async () => pool.take() ?? dialTunnel(),
+				log
+			});
+		}
+	} catch (err) {
+		log(`forward: TLS origin unavailable (${err instanceof Error ? err.message : String(err)}); continuing with http only`);
+	}
 	return {
-		port: addr && typeof addr === "object" ? addr.port : localPort,
+		port: boundPort,
+		tls,
 		close: () => new Promise((resolve) => {
 			pool.close();
-			server.close(() => resolve());
+			(tls ? tls.close() : Promise.resolve()).then(() => {
+				server.close(() => resolve());
+			});
 		})
 	};
 }

package/dist/js/localhost-cert-Bn-UBUmj.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { r as __toESM } from "./chunk-BbwQpWto.mjs";
+import os from "node:os";
+import path from "node:path";
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+
+//#region ../portal-daemon/src/localhost-cert.ts
+/**
+* Durable home for the one piece of state devcert doesn't keep for us: the
+* user's decision to skip automatic cert setup. The daemon's own state dir is
+* tmpdir-based (wiped on reboot), and re-raising a system trust prompt on
+* every `portal forward` after a decline is exactly the nagging that trains
+* people to fear the feature.
+*/
+function declineMarkerPath() {
+	return path.join(os.homedir(), ".config", "skydive-portal", "tls-declined");
+}
+async function hasDeclined() {
+	try {
+		await readFile(declineMarkerPath());
+		return true;
+	} catch (_error) {
+		return false;
+	}
+}
+async function recordDecline(reason) {
+	const marker = declineMarkerPath();
+	try {
+		await mkdir(path.dirname(marker), { recursive: true });
+		await writeFile(marker, `Automatic localhost TLS setup failed or was declined:\n${reason}\n\nDelete this file to let it try again.\n`);
+	} catch (_error) {}
+}
+/**
+* Fully automatic localhost cert: devcert generates a per-machine local CA on
+* first use, installs it into the system/browser trust stores (one OS-native
+* consent prompt, the mkcert pattern), signs a `localhost` leaf, and reuses
+* both silently on every later run. The private key never leaves the machine
+* and the CA is unique to it, so trusting it vouches only for this user's own
+* loopback.
+*
+* Every failure — the user declining the trust prompt included — degrades to
+* the plain-http origin (the product default) with one log line, and writes a
+* marker so subsequent runs don't nag. `resetLocalhostCertDecline` (or
+* deleting the marker file) re-arms it.
+*/
+function localhostCertSource(log) {
+	return async () => {
+		if (await hasDeclined()) return null;
+		try {
+			const { certificateFor } = await import("./dist-CRtjM7ba.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
+			const { key, cert } = await certificateFor("localhost", { skipHostsFile: true });
+			return {
+				key: key.toString(),
+				cert: cert.toString(),
+				hostname: "localhost"
+			};
+		} catch (error) {
+			const reason = error instanceof Error ? error.message : String(error);
+			await recordDecline(reason);
+			log(`portal: automatic localhost TLS setup didn't complete (${reason}). Continuing with http only; delete ~/.config/skydive-portal/tls-declined to try again.`);
+			return null;
+		}
+	};
+}
+
+//#endregion
+export { localhostCertSource };

package/dist/js/{print-DACzRUwQ.mjs → print-B9djx8GU.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-C_TnQSPg.mjs";
-import "./rest-CgfbKXst.mjs";
-import "./billing-blocked-2wju4gC_.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-Clgq46GU.mjs";
+import "./rest-C6E4mS2A.mjs";
+import "./billing-blocked-D3l5kJlX.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{print-C_TnQSPg.mjs → print-Clgq46GU.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-CgfbKXst.mjs";
-import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-2wju4gC_.mjs";
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-C6E4mS2A.mjs";
+import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-D3l5kJlX.mjs";
 import path from "node:path";
 import Conf from "conf";
 import { err, ok } from "neverthrow";

package/dist/js/{print-share-BH9gvCls.mjs → print-share-BBy3OTno.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as printError } from "./output-DYzzdXYV.mjs";
+import { n as printError } from "./output-wY0VQDea.mjs";
 
 //#region src/chat/print-share.ts
 /**
@@ -14,7 +14,8 @@ import { n as printError } from "./output-DYzzdXYV.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-hH2PJL8y.mjs");
+	const { PortalClient } = await import("./client-yz3zrpAS.mjs");
+	const { defaultTlsCertSource } = await import("./tls-cert-CLgSQALB.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {
 		signalConnected = resolve;
@@ -26,6 +27,9 @@ async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
 			deviceToken: null
 		}),
 		resolveCwd: () => process.cwd(),
+		tlsCertSource: defaultTlsCertSource(process.env, (msg) => {
+			console.error(msg);
+		}),
 		persistedMachineName: null,
 		onMachineName: () => {},
 		onState: (state) => {

package/dist/js/{profiler-BVbYs_Yg.mjs → profiler-CJMnC90G.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as getConfigPath } from "./print-C_TnQSPg.mjs";
+import { C as getConfigPath } from "./print-Clgq46GU.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";
@@ -8,7 +8,7 @@ import fs from "node:fs";
 
 //#region package.json
 var name = "skydive-cli";
-var version$1 = "0.5.0-beta.31";
+var version$1 = "0.5.0-beta.32";
 
 //#endregion
 //#region src/auth/organization.ts

package/dist/js/{raw-pty-DY4KelZW.mjs → raw-pty-B9Bue8gg.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
+import { t as SandboxStream } from "./client-BTQ1fwzM.mjs";
 
 //#region src/chat/sandbox/raw-pty.ts
 /**

package/dist/js/raw-pty-g3kATVQe.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import "./client-BTQ1fwzM.mjs";
+import { t as runRawPtyPassthrough } from "./raw-pty-B9Bue8gg.mjs";
+
+export { runRawPtyPassthrough };

package/dist/js/{rest-CgfbKXst.mjs → rest-C6E4mS2A.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as billingBlockedOutcomeSchema } from "./billing-blocked-2wju4gC_.mjs";
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { a as billingBlockedOutcomeSchema } from "./billing-blocked-D3l5kJlX.mjs";
 import { z } from "zod";
 import { createParser } from "eventsource-parser";
 

package/dist/js/rest-CaWUSrnH.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-C6E4mS2A.mjs";
+import "./billing-blocked-D3l5kJlX.mjs";
+
+export { createRestClient };

package/dist/js/tls-cert-CLgSQALB.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { n as envTlsCertSource, r as warnOnRebindProtection, t as defaultTlsCertSource } from "./tls-cert-CV-pwxVN.mjs";
+
+export { defaultTlsCertSource };

package/dist/js/tls-cert-CV-pwxVN.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import dns from "node:dns";
+
+//#region ../portal-daemon/src/tls-cert.ts
+/**
+* File-backed cert source, configured by environment:
+* SKYDIVE_PORTAL_TLS_KEY / SKYDIVE_PORTAL_TLS_CERT (PEM file paths) and
+* SKYDIVE_PORTAL_TLS_HOST (the name the cert covers). All three or nothing —
+* a partial configuration is reported once and treated as absent, so a typo
+* degrades to today's behavior instead of a crash loop.
+*/
+function envTlsCertSource(env, log) {
+	return async () => {
+		const keyPath = env.SKYDIVE_PORTAL_TLS_KEY;
+		const certPath = env.SKYDIVE_PORTAL_TLS_CERT;
+		const hostname = env.SKYDIVE_PORTAL_TLS_HOST;
+		if (!keyPath && !certPath && !hostname) return null;
+		if (!keyPath || !certPath || !hostname) {
+			log("forward: SKYDIVE_PORTAL_TLS_KEY, SKYDIVE_PORTAL_TLS_CERT and SKYDIVE_PORTAL_TLS_HOST must all be set to enable the TLS origin; continuing with http only");
+			return null;
+		}
+		try {
+			const [key, cert] = await Promise.all([readFile(keyPath, "utf8"), readFile(certPath, "utf8")]);
+			return {
+				key,
+				cert,
+				hostname
+			};
+		} catch (err) {
+			log(`forward: could not read TLS key/cert (${err instanceof Error ? err.message : String(err)}); continuing with http only`);
+			return null;
+		}
+	};
+}
+/**
+* The default cert source for both tunnel surfaces: an explicit env/file
+* configuration wins (BYO cert — also the escape hatch for machines where the
+* trust prompt is unwanted, e.g. CI), otherwise the fully automatic
+* devcert-backed localhost source.
+*/
+function defaultTlsCertSource(env, log) {
+	const fromEnv = envTlsCertSource(env, log);
+	return async () => {
+		if (env.SKYDIVE_PORTAL_TLS_KEY || env.SKYDIVE_PORTAL_TLS_CERT || env.SKYDIVE_PORTAL_TLS_HOST) return fromEnv();
+		const { localhostCertSource } = await import("./localhost-cert-Bn-UBUmj.mjs");
+		return localhostCertSource(log)();
+	};
+}
+/**
+* Detect resolver-level DNS rebind protection: some routers/resolvers refuse
+* public names that answer with loopback addresses (Plex documents this exact
+* failure for *.plex.direct). The https origin simply won't resolve for such
+* users — warn with the cause, and leave the http origin (unaffected) as the
+* fallback. Never fatal: the browser may use a different resolver than the
+* OS, so we start the listener regardless.
+*/
+async function warnOnRebindProtection(hostname, log) {
+	try {
+		if (!(await dns.promises.lookup(hostname, { all: true })).some((a) => a.address === "127.0.0.1" || a.address === "::1")) log(`forward: ${hostname} did not resolve to 127.0.0.1 — a resolver on this network may block public names pointing at loopback (DNS rebind protection). The https origin may not work here; http://localhost is unaffected.`);
+	} catch (error) {
+		log(`forward: ${hostname} did not resolve (${error instanceof Error ? error.message : String(error)}) — a resolver on this network may block public names pointing at loopback (DNS rebind protection). The https origin may not work here; http://localhost is unaffected.`);
+	}
+}
+
+//#endregion
+export { envTlsCertSource as n, warnOnRebindProtection as r, defaultTlsCertSource as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.5.0-beta.31",
+  "version": "0.5.0-beta.32",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",

package/dist/js/api-DG5W6iwx.mjs

@@ -1,131 +0,0 @@
-#!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { z } from "zod";
-
-//#region ../portal-daemon/src/api.ts
-/**
-* The portal's session-authed REST surface, shared by `PortalClient` (the
-* TUI/`portal open` connection) and the `skydive portal` management
-* commands, so the endpoint contracts and response schemas live in exactly
-* one place.
-*/
-const deviceSchema = z.object({
-	id: z.string(),
-	machineName: z.string(),
-	friendlyName: z.string(),
-	connected: z.boolean(),
-	lastSeen: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
-});
-const devicesResponseSchema = z.object({
-	devices: z.array(deviceSchema),
-	agents: z.array(z.object({
-		id: z.string(),
-		name: z.string()
-	}))
-});
-const deviceTokenSchema = z.object({ token: z.string().min(1) });
-async function portalFetch(auth, path, init) {
-	const res = await fetch(`${auth.appUrl}${path}`, {
-		method: init.method,
-		headers: {
-			authorization: `Bearer ${auth.sessionToken}`,
-			accept: "application/json",
-			...init.body ? { "content-type": "application/json" } : {}
-		},
-		...init.body ? { body: init.body } : {}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new HttpError(res.status, body);
-	}
-	return res.json();
-}
-async function fetchPortalDevices(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
-	return devicesResponseSchema.parse(json);
-}
-const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
-/**
-* Register this machine's device row without connecting. Connecting registers
-* as a side effect; this covers granting an agent on a machine that has never
-* shared yet (the grant references the device row).
-*/
-async function registerPortalDevice(auth, { machineName, friendlyName }) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", {
-		method: "POST",
-		body: JSON.stringify({
-			machineName,
-			friendlyName
-		})
-	});
-	return registerResponseSchema.parse(json).device;
-}
-/** Short-lived token the machine presents when dialing the portal WebSocket. */
-async function mintPortalDeviceToken(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
-	return deviceTokenSchema.parse(json).token;
-}
-const forwardTargetSchema = z.object({
-	daemonOrigin: z.string().min(1),
-	token: z.string().min(1),
-	expiresInSeconds: z.number()
-});
-/**
-* Everything `portal forward` needs to dial an agent's sandbox daemon through
-* the agent-webserver edge Worker: the daemon's stable public origin and a
-* daemon auth token (canUse-gated server-side).
-*/
-async function fetchForwardTarget(auth, agentId) {
-	const json = await portalFetch(auth, "/api/v1/portal/forward-target", {
-		method: "POST",
-		body: JSON.stringify({ agentId })
-	});
-	return forwardTargetSchema.parse(json);
-}
-async function grantPortalAccess(auth, { deviceId, agentId, conversationId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
-		method: "POST",
-		body: JSON.stringify({
-			agentId,
-			conversationId
-		})
-	});
-}
-async function revokePortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
-}
-/**
-* The device row for a given machine identity. Matching is by `machineName`
-* equality — the stable handle the machine registers under, not the display
-* label.
-*/
-function findThisDevice(devices, machineName) {
-	return devices.find((device) => device.machineName === machineName) ?? null;
-}
-/**
-* One-time grant migration onto the merged device. Earlier CLI builds
-* registered a separate `<machineName>-cli` device, so a user's existing
-* approvals hang off that row; the merged device would start with zero grants
-* and every already-authorized agent would ask again. Copy any grant the
-* merged device is missing (the grant endpoint upserts, so re-runs are
-* no-ops). The legacy row is left in place — an old CLI build may still
-* connect under it. Returns how many grants were copied.
-*/
-async function unifyLegacyCliGrants(auth, machineName) {
-	const { devices } = await fetchPortalDevices(auth);
-	const merged = findThisDevice(devices, machineName);
-	const legacy = findThisDevice(devices, `${machineName}-cli`);
-	if (!merged || !legacy) return 0;
-	const have = new Set(merged.grantedAgentIds);
-	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
-	for (const agentId of missing) await grantPortalAccess(auth, {
-		deviceId: merged.id,
-		agentId,
-		conversationId: null
-	});
-	return missing.length;
-}
-
-//#endregion
-export { mintPortalDeviceToken as a, unifyLegacyCliGrants as c, grantPortalAccess as i, fetchPortalDevices as n, registerPortalDevice as o, findThisDevice as r, revokePortalAccess as s, fetchForwardTarget as t };

package/dist/js/client-hH2PJL8y.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import { t as PortalClient } from "./client-DbqRBquD.mjs";
-import "./api-DG5W6iwx.mjs";
-
-export { PortalClient };

package/dist/js/daemon-SPQgtsbW.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import "./client-DbqRBquD.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-BTyg329O.mjs";
-import "./api-DG5W6iwx.mjs";
-
-export { runPortalDaemon };

package/dist/js/daemon-client-C7emKKlj.mjs

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import "./client-DbqRBquD.mjs";
-import "./daemon-BTyg329O.mjs";
-import "./api-DG5W6iwx.mjs";
-import { t as PortalDaemonClient } from "./daemon-client--A_yMKq6.mjs";
-
-export { PortalDaemonClient };

package/dist/js/raw-pty-DmdUf4_w.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import "./client-c4c5MmgN.mjs";
-import { t as runRawPtyPassthrough } from "./raw-pty-DY4KelZW.mjs";
-
-export { runRawPtyPassthrough };

package/dist/js/rest-VV5nc-Mn.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-CgfbKXst.mjs";
-import "./billing-blocked-2wju4gC_.mjs";
-
-export { createRestClient };