skydive-cli 0.5.0-beta.31 → 0.5.0-beta.33

package/README.md

@@ -483,6 +483,25 @@ The remaining keys (`apiKey`, `apiUrl`, `sessionToken`, `appUrl`, `themeDark`,
 `themeLight`, …) are credentials or flow-managed state — leave them to the
 CLI.
 
+## Diagnostic logs
+
+The CLI records local diagnostics by default. It keeps the latest 20 sessions
+beside the CLI config. Nothing uploads automatically.
+
+```sh
+skydive logs                    # list recent sessions
+skydive logs path               # print the latest session directory
+skydive logs export             # archive the latest session for sharing
+skydive logs export <session>   # archive one session from `logs list`
+```
+
+Automatic logs include request timing, TUI state changes, render performance,
+and process metadata. Command values and URL query values are removed.
+
+Set `SKYDIVE_PROFILE=<path>` to write a full profile to a chosen directory.
+Full profiles also include CPU data. Set `SKYDIVE_PROFILE=0` to disable all
+session diagnostics.
+
 ## Environment variables
 
 | Variable                | Effect                                           |
@@ -493,6 +512,7 @@ CLI.
 | `SKYDIVE_APP_URL`       | Chat app/session origin (overrides stored value) |
 | `SKYDIVE_THEME`         | Chat colorscheme id (flag `--theme` overrides)   |
 | `SKYDIVE_CONFIG_NAME`   | On-disk config profile name (default `skydive`)  |
+| `SKYDIVE_PROFILE`       | Full profile path; `0` disables diagnostics      |
 
 ## Testing the TUI
 

package/dist/js/api-DQCaztBg.mjs

@@ -0,0 +1,315 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { z } from "zod";
+import http from "node:http";
+import http2 from "node:http2";
+
+//#region ../portal-daemon/src/tls-forward.ts
+const TLS_PORT_OFFSET = 1e4;
+const STRIP_HEADERS = new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"http2-settings"
+]);
+/**
+* The opt-in TLS+h2 origin for a forwarded/exposed port (ANY-6872, additive
+* next to the plain listener — never a replacement). Browsers only negotiate
+* h2 over TLS, and h2's stream multiplexing is what lifts the
+* 6-connections-per-origin cap that makes unbundled dev servers crawl through
+* the tunnel; each h2 stream is converted here to an h1 request over a tunnel
+* from `acquireTunnel`. Used by BOTH tunnel surfaces: the CLI's
+* `skydive portal forward` and the desktop daemon's `platform portal expose`.
+*
+* The dev server keeps seeing `Host: localhost:<port>` — the browser's
+* authority is a public name it would reject (Vite 403s unknown hosts), and
+* "looks exactly like localhost" is the product contract. The original
+* authority travels in x-forwarded-host / x-forwarded-proto for apps that
+* want it.
+*/
+async function startTlsForward({ cert, localPort, targetPort, acquireTunnel, log }) {
+	const connectionShims = {
+		setNoDelay: () => {},
+		setKeepAlive: () => {},
+		setTimeout: () => {},
+		ref: () => {},
+		unref: () => {}
+	};
+	/**
+	* node's http client drives the tunnel: the agent's keep-alive free list
+	* gives request→request socket reuse on top of the pool's pre-paid dials,
+	* and a tunnel the daemon/dev-server side reaps while idle is evicted from
+	* the free list by its 'close' — the next request just adopts a fresh one.
+	* maxSockets mirrors the pool cap: every socket here holds an edge WS open,
+	* and ANY-6873 is the honest fix for wanting more concurrency than that.
+	*
+	* The base signature allows synchronous implementations to return the
+	* socket; this one is asynchronous, so it always uses the callback and
+	* returns undefined (the documented async contract). The agent core always
+	* passes the callback — the error branch below guards the contract anyway
+	* rather than assuming it.
+	*/
+	class TunnelAgent extends http.Agent {
+		createConnection(_options, callback) {
+			if (!callback) throw new Error("TunnelAgent.createConnection requires the async callback");
+			(async () => {
+				let tunnel;
+				try {
+					tunnel = await acquireTunnel();
+				} catch (error) {
+					callback(error instanceof Error ? error : new Error(String(error)));
+					return;
+				}
+				Object.assign(tunnel.stream, connectionShims);
+				tunnel.stream.resume();
+				callback(null, tunnel.stream);
+			})();
+		}
+	}
+	const agent = new TunnelAgent({
+		keepAlive: true,
+		maxSockets: 16
+	});
+	const server = http2.createSecureServer({
+		key: cert.key,
+		cert: cert.cert,
+		allowHTTP1: true
+	});
+	const liveSessions = /* @__PURE__ */ new Set();
+	server.on("session", (session) => {
+		liveSessions.add(session);
+		session.once("close", () => liveSessions.delete(session));
+	});
+	server.on("secureConnection", (socket) => {
+		liveSessions.add(socket);
+		socket.once("close", () => liveSessions.delete(socket));
+	});
+	server.on("request", (req, res) => {
+		const headers = {};
+		for (const [name, value] of Object.entries(req.headers)) {
+			if (name.startsWith(":") || STRIP_HEADERS.has(name)) continue;
+			if (value !== void 0) headers[name] = value;
+		}
+		headers.host = `localhost:${targetPort}`;
+		headers["x-forwarded-proto"] = "https";
+		headers["x-forwarded-host"] = cert.hostname;
+		const upstream = http.request({
+			host: "localhost",
+			port: targetPort,
+			method: req.method,
+			path: req.url,
+			headers,
+			agent
+		}, (upstreamRes) => {
+			const resHeaders = {};
+			for (const [name, value] of Object.entries(upstreamRes.headers)) {
+				if (STRIP_HEADERS.has(name)) continue;
+				if (value !== void 0) resHeaders[name] = value;
+			}
+			res.writeHead(upstreamRes.statusCode ?? 502, resHeaders);
+			upstreamRes.pipe(res);
+			upstreamRes.on("error", () => res.destroy());
+		});
+		upstream.on("error", (err) => {
+			log(`forward(tls): upstream request failed: ${err.message}`);
+			if (!res.headersSent) {
+				res.writeHead(502, { "content-type": "text/plain" });
+				res.end("portal forward: tunnel request failed");
+			} else res.destroy();
+		});
+		req.pipe(upstream);
+		req.on("error", () => upstream.destroy());
+	});
+	server.on("upgrade", (req, socket, head) => {
+		socket.pause();
+		(async () => {
+			let tunnel;
+			try {
+				tunnel = await acquireTunnel();
+			} catch (err) {
+				log(`forward(tls): upgrade tunnel failed: ${err instanceof Error ? err.message : String(err)}`);
+				socket.destroy();
+				return;
+			}
+			const lines = [`${req.method} ${req.url} HTTP/1.1`];
+			for (let i = 0; i < req.rawHeaders.length; i += 2) {
+				const name = req.rawHeaders[i];
+				const value = name?.toLowerCase() === "host" ? `localhost:${targetPort}` : req.rawHeaders[i + 1];
+				lines.push(`${name}: ${value}`);
+			}
+			tunnel.stream.write(lines.join("\r\n") + "\r\n\r\n");
+			if (head.length > 0) tunnel.stream.write(head);
+			tunnel.stream.on("error", () => socket.destroy());
+			tunnel.stream.on("close", () => socket.destroy());
+			socket.on("error", () => tunnel.stream.destroy());
+			socket.on("close", () => tunnel.stream.destroy());
+			socket.pipe(tunnel.stream).pipe(socket);
+			socket.resume();
+		})();
+	});
+	server.on("tlsClientError", (err, tlsSocket) => {
+		tlsSocket.destroy();
+		log(`forward(tls): handshake failed: ${err.message}`);
+	});
+	const preferredPort = localPort + TLS_PORT_OFFSET <= 65535 ? localPort + TLS_PORT_OFFSET : 0;
+	return {
+		port: await new Promise((resolve, reject) => {
+			const onError = (err) => {
+				if (err.code === "EADDRINUSE" && preferredPort !== 0) {
+					server.listen(0, "127.0.0.1");
+					return;
+				}
+				server.removeListener("error", onError);
+				reject(err);
+			};
+			server.on("error", onError);
+			server.on("listening", () => {
+				server.removeListener("error", onError);
+				const addr = server.address();
+				resolve(addr && typeof addr === "object" ? addr.port : preferredPort);
+			});
+			server.listen(preferredPort, "127.0.0.1");
+		}),
+		hostname: cert.hostname,
+		close: () => new Promise((resolve) => {
+			agent.destroy();
+			server.close(() => resolve());
+			for (const live of liveSessions) live.destroy();
+		})
+	};
+}
+
+//#endregion
+//#region ../portal-daemon/src/api.ts
+/**
+* The portal's session-authed REST surface, shared by `PortalClient` (the
+* TUI/`portal open` connection) and the `skydive portal` management
+* commands, so the endpoint contracts and response schemas live in exactly
+* one place.
+*/
+const deviceSchema = z.object({
+	id: z.string(),
+	machineName: z.string(),
+	friendlyName: z.string(),
+	connected: z.boolean(),
+	lastSeen: z.string().nullable(),
+	grantedAgentIds: z.array(z.string())
+});
+const devicesResponseSchema = z.object({
+	devices: z.array(deviceSchema),
+	agents: z.array(z.object({
+		id: z.string(),
+		name: z.string()
+	}))
+});
+const deviceTokenSchema = z.object({ token: z.string().min(1) });
+async function portalFetch(auth, path, init) {
+	const res = await fetch(`${auth.appUrl}${path}`, {
+		method: init.method,
+		headers: {
+			authorization: `Bearer ${auth.sessionToken}`,
+			accept: "application/json",
+			...init.body ? { "content-type": "application/json" } : {}
+		},
+		...init.body ? { body: init.body } : {}
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new HttpError(res.status, body);
+	}
+	return res.json();
+}
+async function fetchPortalDevices(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
+	return devicesResponseSchema.parse(json);
+}
+const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
+/**
+* Register this machine's device row without connecting. Connecting registers
+* as a side effect; this covers granting an agent on a machine that has never
+* shared yet (the grant references the device row).
+*/
+async function registerPortalDevice(auth, { machineName, friendlyName }) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", {
+		method: "POST",
+		body: JSON.stringify({
+			machineName,
+			friendlyName
+		})
+	});
+	return registerResponseSchema.parse(json).device;
+}
+/** Short-lived token the machine presents when dialing the portal WebSocket. */
+async function mintPortalDeviceToken(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
+	return deviceTokenSchema.parse(json).token;
+}
+const forwardTargetSchema = z.object({
+	daemonOrigin: z.string().min(1),
+	token: z.string().min(1),
+	expiresInSeconds: z.number()
+});
+/**
+* Everything `portal forward` needs to dial an agent's sandbox daemon through
+* the agent-webserver edge Worker: the daemon's stable public origin and a
+* daemon auth token (canUse-gated server-side).
+*/
+async function fetchForwardTarget(auth, agentId) {
+	const json = await portalFetch(auth, "/api/v1/portal/forward-target", {
+		method: "POST",
+		body: JSON.stringify({ agentId })
+	});
+	return forwardTargetSchema.parse(json);
+}
+async function grantPortalAccess(auth, { deviceId, agentId, conversationId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
+		method: "POST",
+		body: JSON.stringify({
+			agentId,
+			conversationId
+		})
+	});
+}
+async function revokePortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
+}
+/**
+* The device row for a given machine identity. Matching is by `machineName`
+* equality — the stable handle the machine registers under, not the display
+* label.
+*/
+function findThisDevice(devices, machineName) {
+	return devices.find((device) => device.machineName === machineName) ?? null;
+}
+/**
+* One-time grant migration onto the merged device. Earlier CLI builds
+* registered a separate `<machineName>-cli` device, so a user's existing
+* approvals hang off that row; the merged device would start with zero grants
+* and every already-authorized agent would ask again. Copy any grant the
+* merged device is missing (the grant endpoint upserts, so re-runs are
+* no-ops). The legacy row is left in place — an old CLI build may still
+* connect under it. Returns how many grants were copied.
+*/
+async function unifyLegacyCliGrants(auth, machineName) {
+	const { devices } = await fetchPortalDevices(auth);
+	const merged = findThisDevice(devices, machineName);
+	const legacy = findThisDevice(devices, `${machineName}-cli`);
+	if (!merged || !legacy) return 0;
+	const have = new Set(merged.grantedAgentIds);
+	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
+	for (const agentId of missing) await grantPortalAccess(auth, {
+		deviceId: merged.id,
+		agentId,
+		conversationId: null
+	});
+	return missing.length;
+}
+
+//#endregion
+export { mintPortalDeviceToken as a, unifyLegacyCliGrants as c, grantPortalAccess as i, startTlsForward as l, fetchPortalDevices as n, registerPortalDevice as o, findThisDevice as r, revokePortalAccess as s, fetchForwardTarget as t };

package/dist/js/{billing-blocked-Dgu5-oDy.mjs → billing-blocked-SE6tySLd.mjs}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import { a as billingBlockedOutcomeSchema, i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError, r as billingBlockedJsonResult, t as BILLING_BLOCKED_EXIT_CODE } from "./billing-blocked-2wju4gC_.mjs";
+import { a as billingBlockedOutcomeSchema, i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError, r as billingBlockedJsonResult, t as BILLING_BLOCKED_EXIT_CODE } from "./billing-blocked-D3l5kJlX.mjs";
 
 export { BILLING_BLOCKED_EXIT_CODE, BillingBlockedError, billingBlockedJsonResult };