skydive-cli 0.5.0-beta.9 → 0.5.0

package/dist/js/forward-C-f04uyE.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+import { r as warnOnRebindProtection } from "./tls-cert-Rua2oV7n.mjs";
+import { l as startTlsForward, t as fetchForwardTarget } from "./api-BFQ4PQDA.mjs";
+import net from "node:net";
+import { WebSocket, createWebSocketStream } from "ws";
+
+//#region src/chat/portal/tunnel-pool.ts
+const MAX_AGE_MS = 4e4;
+const SWEEP_INTERVAL_MS = 1e4;
+const REFILL_BACKOFF_MS = 15e3;
+/**
+* Pre-warmed tunnel pool for the forward portal's accept path.
+*
+* Dialing a tunnel costs a full edge round-trip (~300ms measured). The pool
+* pays that in the background so accept can adopt a warm tunnel and move the
+* first byte immediately. Target starts at `initialSize` and grows by one on
+* each miss, never above `maxSize` — a miss still cold-dials (today's path);
+* growth only helps the next wave. No decay: a runaway client can hold
+* `maxSize` idle edge sockets until `forward` exits.
+*
+* `dial` must resolve with a stream that is already paused, so any bytes a
+* server-first protocol sends before adoption buffer instead of dropping.
+*/
+function createTunnelPool({ initialSize, maxSize, dial, log }) {
+	let entries = [];
+	let dialsInFlight = 0;
+	let backoffUntil = 0;
+	let closed = false;
+	let targetSize = initialSize;
+	function refill() {
+		if (closed) return;
+		if (Date.now() < backoffUntil) return;
+		while (entries.length + dialsInFlight < targetSize) {
+			dialsInFlight += 1;
+			dial().then((tunnel) => {
+				dialsInFlight -= 1;
+				if (closed) {
+					tunnel.close();
+					return;
+				}
+				const entry = {
+					tunnel,
+					dialedAt: Date.now(),
+					dead: false
+				};
+				tunnel.stream.once("close", () => {
+					entry.dead = true;
+				});
+				tunnel.stream.once("error", () => {
+					entry.dead = true;
+				});
+				entries.push(entry);
+			}).catch((err) => {
+				dialsInFlight -= 1;
+				backoffUntil = Date.now() + REFILL_BACKOFF_MS;
+				log(`forward: pool dial failed (backing off): ${err instanceof Error ? err.message : String(err)}`);
+			});
+		}
+	}
+	function sweep() {
+		const now = Date.now();
+		const keep = [];
+		for (const entry of entries) if (entry.dead || now - entry.dialedAt > MAX_AGE_MS) entry.tunnel.close();
+		else keep.push(entry);
+		entries = keep;
+		refill();
+	}
+	const sweeper = setInterval(sweep, SWEEP_INTERVAL_MS);
+	sweeper.unref();
+	refill();
+	return {
+		take: () => {
+			while (entries.length > 0) {
+				const entry = entries.pop();
+				if (!entry) break;
+				if (entry.dead || entry.tunnel.stream.destroyed) continue;
+				refill();
+				return entry.tunnel;
+			}
+			if (targetSize < maxSize) targetSize += 1;
+			refill();
+			return null;
+		},
+		close: () => {
+			closed = true;
+			clearInterval(sweeper);
+			for (const entry of entries) entry.tunnel.close();
+			entries = [];
+		}
+	};
+}
+
+//#endregion
+//#region src/chat/portal/forward.ts
+const TARGET_REFRESH_SAFETY_MS = 12e4;
+const INITIAL_POOL_SIZE = 8;
+const MAX_POOL_SIZE = 16;
+/**
+* The reverse portal's client half: listen on the local machine's loopback and
+* pipe each TCP connection to the agent sandbox's daemon (`/portal/tcp`),
+* which pipes to the sandbox's own loopback. The daemon is reached through the
+* agent-webserver edge Worker (sandboxes have public ingress disabled; the
+* Worker owns boot-resolution and injects the sandbox edge-auth token), so a
+* sandbox recycle just costs the next connection a cold-start wait rather
+* than invalidating the forward.
+*/
+async function startForward({ auth, agentId, localPort, targetPort, tlsCertSource, log }) {
+	let target = await fetchForwardTarget(auth, agentId);
+	let mintedAt = Date.now();
+	async function freshTarget() {
+		const ttlMs = target.expiresInSeconds * 1e3;
+		if (Date.now() - mintedAt > ttlMs - TARGET_REFRESH_SAFETY_MS) {
+			target = await fetchForwardTarget(auth, agentId);
+			mintedAt = Date.now();
+		}
+		return target;
+	}
+	/**
+	* Dial one tunnel through the edge to the daemon's /portal/tcp. Resolves
+	* once the upgrade completes, with the duplex PAUSED — the pool holds it
+	* warm without dropping any early bytes, and adoption resumes it by piping.
+	*/
+	async function dialTunnel() {
+		const resolved = await freshTarget();
+		const ws = new WebSocket(`${resolved.daemonOrigin.replace(/^http/, "ws")}/portal/tcp?port=${targetPort}`, { headers: { authorization: `Bearer ${resolved.token}` } });
+		return new Promise((resolve, reject) => {
+			ws.once("error", reject);
+			ws.once("open", () => {
+				ws.removeListener("error", reject);
+				const stream = createWebSocketStream(ws);
+				stream.pause();
+				resolve({
+					stream,
+					close: () => stream.destroy()
+				});
+			});
+		});
+	}
+	const pool = createTunnelPool({
+		initialSize: INITIAL_POOL_SIZE,
+		maxSize: MAX_POOL_SIZE,
+		dial: dialTunnel,
+		log
+	});
+	const server = net.createServer((sock) => {
+		sock.pause();
+		const warm = pool.take();
+		if (warm) {
+			warm.stream.on("error", () => sock.destroy());
+			sock.on("error", () => warm.stream.destroy());
+			sock.pipe(warm.stream).pipe(sock);
+			sock.resume();
+			return;
+		}
+		(async () => {
+			let tunnel;
+			try {
+				tunnel = await dialTunnel();
+			} catch (err) {
+				log(`forward: tunnel connect failed: ${err instanceof Error ? err.message : String(err)}`);
+				sock.destroy();
+				return;
+			}
+			tunnel.stream.on("error", () => sock.destroy());
+			sock.on("error", () => tunnel.stream.destroy());
+			sock.pipe(tunnel.stream).pipe(sock);
+			sock.resume();
+		})();
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(localPort, "127.0.0.1", () => {
+			server.removeListener("error", reject);
+			resolve();
+		});
+	});
+	const addr = server.address();
+	const boundPort = addr && typeof addr === "object" ? addr.port : localPort;
+	let tls = null;
+	if (tlsCertSource) try {
+		const cert = await tlsCertSource();
+		if (cert) {
+			if (cert.hostname !== "localhost") await warnOnRebindProtection(cert.hostname, log);
+			tls = await startTlsForward({
+				cert,
+				localPort: boundPort,
+				targetPort,
+				acquireTunnel: async () => pool.take() ?? dialTunnel(),
+				log
+			});
+		}
+	} catch (err) {
+		log(`forward: TLS origin unavailable (${err instanceof Error ? err.message : String(err)}); continuing with http only`);
+	}
+	return {
+		port: boundPort,
+		tls,
+		close: () => new Promise((resolve) => {
+			pool.close();
+			(tls ? tls.close() : Promise.resolve()).then(() => {
+				server.close(() => resolve());
+			});
+		})
+	};
+}
+
+//#endregion
+export { startForward };