ugly-app 0.1.519 → 0.1.521

package/src/cli/devTunnel.ts

@@ -1,589 +0,0 @@
-/**
- * devTunnel.ts
- *
- * Combined dev tunnel client: multiplexes infrastructure TCP ports (Postgres,
- * NATS, S3, Qdrant) over binary frames AND handles proxy tunnel HTTP/WS relay
- * for public dev URLs — all on a single WebSocket to /dev-tunnel.
- *
- * Binary frames = infra tunnel (5-byte header + TCP payload)
- * Text frames = proxy tunnel (JSON messages for HTTP/WS relay)
- */
-
-import net from 'net';
-import WebSocket from 'ws';
-import { getUglyBotWsUrl } from '../shared/uglyBotUrl.js';
-import type { SidecarPorts } from './sidecarHealth.js';
-import {
-  SERVICE,
-  SERVICE_NAME,
-  FLAGS,
-  type ServiceId,
-  encodeFrame,
-  decodeFrame,
-} from './sidecarProtocol.js';
-
-export interface StartDevTunnelOpts {
-  projectId: string;
-  token: string;
-  /** Defaults to UGLY_BOT_WS_URL */
-  serverUrl?: string;
-  /** When set, enables proxy tunnel relay to this local port */
-  vitePort?: number;
-  /**
-   * Optional studio session id (`ws_x:sess_y`). When set, the server
-   * scopes the proxy subdomain to this session so two concurrent dev
-   * servers on the same project don't collide on the same registration.
-   */
-  sessionId?: string;
-}
-
-export interface DevTunnelResult extends SidecarPorts {
-  /** Public subdomain if proxy tunnel registered (e.g. 'proxy-user-myapp') */
-  subdomain?: string;
-}
-
-const BACKPRESSURE_THRESHOLD = 1024 * 1024; // 1 MB
-// Only NATS needs a tunnel proxy — PG/R2/Qdrant go through the centralized data proxy
-const SERVICE_LIST: ServiceId[] = [
-  SERVICE.NATS,
-];
-
-// Headers to strip from localhost responses (avoid double-decompression)
-const STRIP_RESPONSE_HEADERS = new Set([
-  'content-encoding',
-  'content-length',
-  'transfer-encoding',
-]);
-
-interface DevTunnelState {
-  ws: WebSocket | null;
-  servers: Map<ServiceId, net.Server>;
-  streams: Map<number, net.Socket>;
-  nextStreamId: number;
-  reconnectTimer: ReturnType<typeof setTimeout> | null;
-  reconnectDelay: number;
-  connected: boolean;
-  stopped: boolean;
-  subdomain: string | null;
-  localWsSockets: Map<string, WebSocket>;
-}
-
-let state: DevTunnelState | null = null;
-
-/**
- * Start the dev tunnel: opens WSS connection and binds ephemeral TCP ports.
- * If vitePort is provided, also registers a proxy tunnel for public URL access.
- */
-export async function startDevTunnel(opts: StartDevTunnelOpts): Promise<DevTunnelResult> {
-  if (state && !state.stopped) {
-    throw new Error('Dev tunnel already running');
-  }
-
-  state = {
-    ws: null,
-    servers: new Map(),
-    streams: new Map(),
-    nextStreamId: 1,
-    reconnectTimer: null,
-    reconnectDelay: 1000,
-    connected: false,
-    stopped: false,
-    subdomain: null,
-    localWsSockets: new Map(),
-  };
-
-  // Create TCP servers for each service on port 0 (ephemeral)
-  const portResults = new Map<ServiceId, number>();
-
-  for (const serviceId of SERVICE_LIST) {
-    const server = net.createServer((socket) => {
-      handleTcpConnection(serviceId, socket);
-    });
-
-    await new Promise<void>((resolve, reject) => {
-      server.listen(0, '127.0.0.1', () => resolve());
-      server.on('error', reject);
-    });
-
-    const addr = server.address() as net.AddressInfo;
-    portResults.set(serviceId, addr.port);
-    state.servers.set(serviceId, server);
-  }
-
-  // Connect WebSocket
-  await connectWs(opts);
-
-  const ports: DevTunnelResult = {
-    postgres: 0, // No longer proxied — uses data proxy
-    nats: portResults.get(SERVICE.NATS)!,
-    s3: 0, // No longer proxied — uses data proxy
-    qdrantHttp: 0, // No longer proxied — uses data proxy
-    qdrantGrpc: 0, // No longer proxied — uses data proxy
-    subdomain: state.subdomain ?? undefined,
-  };
-
-  console.log('[ugly-app] Dev tunnel listening:');
-  for (const [serviceId, port] of portResults) {
-    console.log(`  ${SERVICE_NAME[serviceId]}: localhost:${port}`);
-  }
-
-  if (ports.subdomain) {
-    console.log(`\x1b[36m  ➜  Tunnel:  https://${ports.subdomain}.ugly.bot\x1b[0m`);
-  }
-
-  return ports;
-}
-
-function connectWs(opts: StartDevTunnelOpts): Promise<void> {
-  if (!state || state.stopped) return Promise.resolve();
-
-  const serverUrl = opts.serverUrl ?? getUglyBotWsUrl();
-
-  return new Promise<void>((resolve, reject) => {
-    let resolved = false;
-
-    try {
-      const ws = new WebSocket(`${serverUrl}/dev-tunnel`, {
-        headers: {
-          'Authorization': `Bearer ${opts.token}`,
-          'X-Project-Id': opts.projectId,
-        },
-      });
-
-      ws.binaryType = 'nodebuffer';
-
-      ws.on('open', () => {
-        if (!state) return;
-        state.ws = ws;
-        // Don't reset reconnectDelay here — reset on 'ready' only,
-        // so rapid disconnect/reconnect cycles see growing delays.
-      });
-
-      ws.on('message', (data: Buffer | string, isBinary: boolean) => {
-        if (!state) return;
-
-        if (!isBinary) {
-          // Text frame — JSON control/proxy messages
-          try {
-            const msg = JSON.parse(typeof data === 'string' ? data : data.toString('utf8')) as Record<string, unknown>;
-            handleTextMessage(msg, opts, ws, () => {
-              if (!resolved) {
-                resolved = true;
-                resolve();
-              }
-            });
-          } catch {
-            // Not valid JSON — ignore
-          }
-          return;
-        }
-
-        // Binary frame — infra tunnel
-        try {
-          const { streamId, flags, payload } = decodeFrame(Buffer.from(data as Buffer));
-
-          if (flags & FLAGS.RST) {
-            const socket = state.streams.get(streamId);
-            if (socket) {
-              state.streams.delete(streamId);
-              socket.destroy();
-            }
-            return;
-          }
-
-          if (payload.length > 0) {
-            const socket = state.streams.get(streamId);
-            if (socket && !socket.destroyed) {
-              socket.write(payload);
-            }
-          }
-
-          if (flags & FLAGS.FIN) {
-            const socket = state.streams.get(streamId);
-            if (socket) {
-              state.streams.delete(streamId);
-              socket.end();
-            }
-            return;
-          }
-        } catch {
-          // Ignore malformed frames
-        }
-      });
-
-      ws.on('close', (code: number, reason: Buffer) => {
-        if (!state || state.stopped) return;
-        state.connected = false;
-        state.ws = null;
-
-        // RST all active streams
-        for (const [id, socket] of state.streams) {
-          socket.destroy();
-          state.streams.delete(id);
-        }
-
-        // Close all local WS relays
-        for (const localWs of state.localWsSockets.values()) {
-          localWs.close(1001);
-        }
-        state.localWsSockets.clear();
-
-        if (!resolved) {
-          resolved = true;
-          cleanupServers();
-          const reasonStr = reason?.toString() || '';
-          if (code === 4001) {
-            reject(new Error(`[ugly-app] Authentication failed (4001). Run: npx ugly-app login${process.env['UGLY_BOT_LOCAL'] === '1' ? ' --local' : ''}`));
-          } else if (code === 4500) {
-            reject(new Error(`[ugly-app] Failed to provision resources (4500): ${reasonStr}`));
-          } else {
-            reject(new Error(`[ugly-app] Cannot reach ugly.bot (close code ${code}): ${reasonStr}`));
-          }
-          return;
-        }
-
-        // 4004 = "Replaced by new tunnel" — our own reconnect created a new connection,
-        // so the server killed this old one. Don't reconnect again (the new one IS our reconnect).
-        if (code === 4004) {
-          console.log('[ugly-app] Old tunnel closed (replaced by new connection)');
-          return;
-        }
-
-        console.warn('[ugly-app] Tunnel disconnected, reconnecting...');
-        scheduleReconnect(opts);
-      });
-
-      ws.on('error', () => {
-        // error is always followed by close — handled there
-      });
-    } catch (err) {
-      if (!resolved) {
-        resolved = true;
-        cleanupServers();
-        reject(err instanceof Error ? err : new Error(String(err)));
-      }
-    }
-  });
-}
-
-function handleTextMessage(
-  msg: Record<string, unknown>,
-  opts: StartDevTunnelOpts,
-  ws: WebSocket,
-  onReady: () => void,
-): void {
-  if (!state) return;
-
-  switch (msg.type) {
-    case 'ready':
-      state.connected = true;
-      state.reconnectDelay = 1000; // Reset backoff only after successful ready handshake
-      // Register proxy tunnel if vitePort is set
-      if (opts.vitePort) {
-        ws.send(
-          JSON.stringify({
-            type: 'register',
-            projectId: opts.projectId,
-            sessionId: opts.sessionId,
-          }),
-        );
-      }
-      onReady();
-      break;
-
-    case 'provisioning':
-      console.log('[ugly-app] Cloud DB being provisioned — first-time setup...');
-      break;
-
-    case 'registered':
-      state.subdomain = msg.subdomain as string;
-      console.log(`\x1b[36m  ➜  Tunnel:  https://${state.subdomain}.ugly.bot\x1b[0m`);
-      break;
-
-    case 'http-request':
-      handleHttpRequest(msg as { id: string; method: string; url: string; headers: Record<string, string>; body?: string }, opts, ws);
-      break;
-
-    case 'ws-open':
-      handleWsOpen(msg as { id: string; url: string; headers: Record<string, string> }, opts, ws);
-      break;
-
-    case 'ws-frame':
-      handleWsFrame(msg as { id: string; data: string; binary: boolean });
-      break;
-
-    case 'ws-close':
-      handleWsClose(msg as { id: string; code?: number });
-      break;
-
-    case 'tunnel:ping':
-      // Respond to server heartbeat
-      ws.send(JSON.stringify({ type: 'tunnel:pong' }));
-      break;
-  }
-}
-
-// ── Proxy tunnel: HTTP relay ────────────────────────────────────────────────
-
-function handleHttpRequest(
-  msg: { id: string; method: string; url: string; headers: Record<string, string>; body?: string },
-  opts: StartDevTunnelOpts,
-  ws: WebSocket,
-): void {
-  const port = opts.vitePort ?? 5173;
-  const url = `http://localhost:${port}${msg.url}`;
-
-  const headers = { ...msg.headers };
-  delete headers['host'];
-  delete headers['accept-encoding'];
-
-  const fetchOptions: RequestInit = {
-    method: msg.method,
-    headers,
-    body: msg.body ? Buffer.from(msg.body, 'base64') : undefined,
-  };
-
-  fetch(url, fetchOptions)
-    .then(async (res) => {
-      const responseHeaders: Record<string, string> = {};
-      res.headers.forEach((value, key) => {
-        if (!STRIP_RESPONSE_HEADERS.has(key)) {
-          responseHeaders[key] = value;
-        }
-      });
-
-      const bodyBuffer = await res.arrayBuffer();
-      const body =
-        bodyBuffer.byteLength > 0
-          ? Buffer.from(bodyBuffer).toString('base64')
-          : undefined;
-
-      ws.send(
-        JSON.stringify({
-          type: 'http-response',
-          id: msg.id,
-          status: res.status,
-          headers: responseHeaders,
-          body,
-        }),
-      );
-    })
-    .catch(() => {
-      ws.send(
-        JSON.stringify({
-          type: 'http-response',
-          id: msg.id,
-          status: 502,
-          headers: {},
-          body: Buffer.from('Local server error').toString('base64'),
-        }),
-      );
-    });
-}
-
-// ── Proxy tunnel: WebSocket relay ───────────────────────────────────────────
-
-function handleWsOpen(
-  msg: { id: string; url: string; headers: Record<string, string> },
-  opts: StartDevTunnelOpts,
-  ws: WebSocket,
-): void {
-  if (!state) return;
-
-  const port = opts.vitePort ?? 5173;
-  const url = `ws://localhost:${port}${msg.url}`;
-
-  const wsHeaders = { ...msg.headers };
-  delete wsHeaders['host'];
-  delete wsHeaders['upgrade'];
-  delete wsHeaders['connection'];
-  delete wsHeaders['sec-websocket-key'];
-  delete wsHeaders['sec-websocket-version'];
-  delete wsHeaders['sec-websocket-extensions'];
-  const protocols = msg.headers['sec-websocket-protocol']
-    ?.split(',')
-    .map((p) => p.trim())
-    .filter(Boolean);
-  const localWs = new WebSocket(url, protocols, { headers: wsHeaders });
-
-  localWs.on('open', () => {
-    if (!state) return;
-    state.localWsSockets.set(msg.id, localWs);
-    ws.send(JSON.stringify({ type: 'ws-open-ok', id: msg.id }));
-  });
-
-  localWs.on('error', () => {
-    ws.send(
-      JSON.stringify({ type: 'ws-open-error', id: msg.id, status: 502 }),
-    );
-  });
-
-  localWs.on('message', (data, isBinary) => {
-    const encoded = isBinary
-      ? (data as Buffer).toString('base64')
-      : data.toString();
-    ws.send(
-      JSON.stringify({
-        type: 'ws-frame',
-        id: msg.id,
-        data: encoded,
-        binary: isBinary,
-      }),
-    );
-  });
-
-  localWs.on('close', (code) => {
-    state?.localWsSockets.delete(msg.id);
-    ws.send(JSON.stringify({ type: 'ws-close', id: msg.id, code }));
-  });
-}
-
-function handleWsFrame(msg: { id: string; data: string; binary: boolean }): void {
-  if (!state) return;
-  const localWs = state.localWsSockets.get(msg.id);
-  if (localWs?.readyState !== WebSocket.OPEN) return;
-
-  if (msg.binary) {
-    localWs.send(Buffer.from(msg.data, 'base64'));
-  } else {
-    localWs.send(msg.data);
-  }
-}
-
-function handleWsClose(msg: { id: string; code?: number }): void {
-  if (!state) return;
-  const localWs = state.localWsSockets.get(msg.id);
-  if (localWs) {
-    state.localWsSockets.delete(msg.id);
-    localWs.close(msg.code ?? 1000);
-  }
-}
-
-// ── Infra tunnel: TCP multiplexing ──────────────────────────────────────────
-
-function cleanupServers(): void {
-  if (!state) return;
-  for (const server of state.servers.values()) {
-    server.close();
-  }
-  state.servers.clear();
-  for (const socket of state.streams.values()) {
-    socket.destroy();
-  }
-  state.streams.clear();
-  for (const localWs of state.localWsSockets.values()) {
-    localWs.close(1001);
-  }
-  state.localWsSockets.clear();
-  state = null;
-}
-
-function scheduleReconnect(opts: StartDevTunnelOpts): void {
-  if (!state || state.stopped || state.reconnectTimer) return;
-
-  state.reconnectTimer = setTimeout(() => {
-    if (!state || state.stopped) return;
-    state.reconnectTimer = null;
-    state.reconnectDelay = Math.min(state.reconnectDelay * 2, 30_000);
-    connectWs(opts).then(() => {
-      console.log('[ugly-app] Tunnel reconnected');
-    }).catch(() => {
-      scheduleReconnect(opts);
-    });
-  }, state.reconnectDelay);
-}
-
-function handleTcpConnection(serviceId: ServiceId, socket: net.Socket): void {
-  if (!state) { socket.destroy(); return; }
-
-  if (!state.connected || !state.ws) {
-    console.warn(`[ugly-app] Tunnel reconnecting — rejecting ${SERVICE_NAME[serviceId]} connection`);
-    socket.destroy();
-    return;
-  }
-
-  const streamId = state.nextStreamId++;
-  if (state.nextStreamId > 0xFFFFFFFF) {
-    state.nextStreamId = 1;
-  }
-
-  state.streams.set(streamId, socket);
-  const serviceFlags = serviceId << 2;
-
-  // Send empty data frame to signal "stream opened"
-  if (state.ws?.readyState === WebSocket.OPEN) {
-    state.ws.send(encodeFrame(streamId, serviceFlags, Buffer.alloc(0)));
-  }
-
-  socket.on('data', (chunk: Buffer) => {
-    if (state?.ws?.readyState !== WebSocket.OPEN) return;
-
-    const frame = encodeFrame(streamId, serviceFlags, chunk);
-    state.ws.send(frame);
-
-    if (state.ws.bufferedAmount > BACKPRESSURE_THRESHOLD) {
-      socket.pause();
-      const checkDrain = () => {
-        if (!state?.ws) return;
-        if (state.ws.bufferedAmount <= BACKPRESSURE_THRESHOLD) {
-          socket.resume();
-        } else {
-          setTimeout(checkDrain, 50);
-        }
-      };
-      setTimeout(checkDrain, 50);
-    }
-  });
-
-  socket.on('end', () => {
-    if (!state) return;
-    state.streams.delete(streamId);
-    if (state.ws?.readyState === WebSocket.OPEN) {
-      state.ws.send(encodeFrame(streamId, serviceFlags | FLAGS.FIN, Buffer.alloc(0)));
-    }
-  });
-
-  socket.on('error', () => {
-    if (!state) return;
-    state.streams.delete(streamId);
-    if (state.ws?.readyState === WebSocket.OPEN) {
-      state.ws.send(encodeFrame(streamId, serviceFlags | FLAGS.RST, Buffer.alloc(0)));
-    }
-  });
-
-  socket.on('close', () => {
-    state?.streams.delete(streamId);
-  });
-}
-
-/** Stop the dev tunnel: close WS, all TCP servers and sockets. */
-export function stopDevTunnel(): void {
-  if (!state) return;
-  state.stopped = true;
-
-  if (state.reconnectTimer) {
-    clearTimeout(state.reconnectTimer);
-    state.reconnectTimer = null;
-  }
-
-  if (state.ws && state.ws.readyState <= WebSocket.OPEN) {
-    state.ws.close(1000, 'Dev tunnel stopped');
-  }
-
-  for (const socket of state.streams.values()) {
-    socket.destroy();
-  }
-  state.streams.clear();
-
-  for (const server of state.servers.values()) {
-    server.close();
-  }
-  state.servers.clear();
-
-  for (const localWs of state.localWsSockets.values()) {
-    localWs.close(1000);
-  }
-  state.localWsSockets.clear();
-
-  state = null;
-}

package/src/cli/ensureInfra.ts

@@ -1,90 +0,0 @@
-import { getLocalPort } from '../shared/Defaults.js';
-import { getUglyBotUrl } from '../shared/uglyBotUrl.js';
-import { readAuthToken, readLocalToken } from './authStore.js';
-import { readUglyAppConfig } from './uglyappConfig.js';
-
-function isLocal(): boolean {
-  return process.env['UGLY_BOT_LOCAL'] === '1';
-}
-
-/**
- * Ensure infrastructure env vars (DATABASE_URL, NATS_URL, etc.) are set.
- *
- * Starts the sidecar tunnel if env vars are not already present.
- * The tunnel connects to ugly.bot (cloud or local depending on UGLY_BOT_LOCAL).
- * If not logged in or token expired, auto-triggers the login flow.
- */
-export async function ensureInfra(): Promise<void> {
-  const config = readUglyAppConfig(process.cwd());
-
-  // Inject basic config-derived env vars
-  if (config) {
-    if (!process.env['NATS_PREFIX']) process.env['NATS_PREFIX'] = config.projectId;
-    if (!process.env['STORAGE_KEY_PREFIX']) process.env['STORAGE_KEY_PREFIX'] = config.projectId;
-    // Use the right project token for the current mode
-    // Prefer ~/.ugly-bot/ auth store, fall back to .uglyapp for legacy
-    const projectToken = isLocal()
-      ? (readLocalToken(config.projectId) ?? config.localToken)
-      : (readAuthToken(config.projectId) ?? config.uglyBotToken);
-    if (projectToken && !process.env['UGLY_BOT_TOKEN']) {
-      process.env['UGLY_BOT_TOKEN'] = projectToken;
-    }
-  }
-
-  // If a Postgres URL is already set (e.g. by a parent process, a deploy
-  // script, or an E2E test), skip the tunnel-bootstrap path. `DATABASE_URL`
-  // is the canonical name `Pg.ts:getPool()` reads; `POSTGRES_URL` is the
-  // legacy name kept for older deploys until they migrate.
-  if (process.env['DATABASE_URL'] || process.env['POSTGRES_URL']) return;
-
-  if (!config) {
-    throw new Error('[ugly-app] No .uglyapp config found. Run: npx ugly-app init');
-  }
-
-  // Ensure we have valid user auth — auto-trigger login if needed
-  const { ensureUglyBotAuth } = await import('./uglyBotLogin.js');
-  const auth = await ensureUglyBotAuth(getUglyBotUrl());
-
-  // Ensure we have a valid project token for this mode
-  const storedToken = isLocal()
-    ? (readLocalToken(config.projectId) ?? config.localToken)
-    : (readAuthToken(config.projectId) ?? config.uglyBotToken);
-  if (!storedToken) {
-    console.log(`[ugly-app] No project token for ${isLocal() ? 'local' : 'cloud'} — registering...`);
-    const path = await import('path');
-    const { runUglyBotSetup } = await import('./uglyBotSetup.js');
-    await runUglyBotSetup(config.projectId, path.join(process.cwd(), '.uglyapp'));
-    // Re-read token from auth store (runUglyBotSetup now writes there)
-    const newToken = isLocal()
-      ? readLocalToken(config.projectId)
-      : readAuthToken(config.projectId);
-    if (newToken) {
-      process.env['UGLY_BOT_TOKEN'] = newToken;
-    }
-  }
-
-  const { startDevTunnel } = await import('./devTunnel.js');
-
-  // Studio sessions set this so each session's proxy subdomain is unique;
-  // unset (regular `npm run dev`) keeps the legacy `proxy-{username}-{projectId}` URL.
-  const sessionId = process.env['UGLY_STUDIO_SESSION_ID'];
-
-  const vitePort = getLocalPort();
-  try {
-    const ports = await startDevTunnel({ projectId: config.projectId, token: auth.token, vitePort, sessionId });
-    process.env['NATS_URL'] = `nats://localhost:${ports.nats}`;
-  } catch (err) {
-    const msg = (err as Error).message;
-    if (msg.includes('4001')) {
-      // Auth failed — force re-login and retry
-      console.log('[ugly-app] Auth expired, re-authenticating...');
-      const { runUglyBotLogin } = await import('./uglyBotLogin.js');
-      const freshAuth = await runUglyBotLogin(getUglyBotUrl());
-      const ports = await startDevTunnel({ projectId: config.projectId, token: freshAuth.token, vitePort, sessionId });
-      process.env['NATS_URL'] = `nats://localhost:${ports.nats}`;
-      process.env['MINIO_ENDPOINT'] = `http://localhost:${ports.s3}`;
-    } else {
-      throw err;
-    }
-  }
-}