usagemax 0.3.3 → 0.3.7

package/src/service.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { access, mkdir, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import { access, chmod, copyFile, mkdir, readFile, readdir, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { promisify } from "node:util";
@@ -27,13 +27,73 @@ export function assertDurablePath(path) {
   }
 }
 
+export function brandedRuntimePath(directory, platform = process.platform) {
+  if (platform !== "darwin" && platform !== "win32") return null;
+  return platform === "win32"
+    ? join(directory, "runtime", "UsageMax.exe")
+    : join(directory, "runtime", "bin", "UsageMax");
+}
+
+/**
+ * Give scheduled jobs a stable product-facing image name on platforms where
+ * the JavaScript runtime otherwise appears as `node` in process browsers.
+ * The copied runtime is intentionally private to this installation and is
+ * refreshed on every service install, so upgrading Node or UsageMax never
+ * leaves the scheduler pointing at an ephemeral cache path.
+ */
+export async function ensureBrandedRuntime(directory, executable, platform = process.platform) {
+  const target = brandedRuntimePath(directory, platform);
+  if (!target) return executable;
+  const source = await realpath(executable);
+  const runtimeBinDirectory = dirname(target);
+  if (source === target) return target;
+  await mkdir(runtimeBinDirectory, { recursive: true, mode: 0o700 });
+  const temporary = join(runtimeBinDirectory, `.${platform === "win32" ? "UsageMax.exe" : "UsageMax"}.${randomUUID()}.tmp`);
+  try {
+    await copyFile(source, temporary);
+    if (platform !== "win32") await chmod(temporary, 0o700);
+    await rename(temporary, target);
+    if (platform === "darwin") {
+      // Homebrew Node uses @rpath/libnode.<n>.dylib next to its bin folder;
+      // the official Node distribution is self-contained. Copy only adjacent
+      // dylibs when they exist, keeping both layouts runnable.
+      const sourceLibraryDirectory = resolve(dirname(source), "../lib");
+      const runtimeLibraryDirectory = resolve(runtimeBinDirectory, "../lib");
+      const sourceLibraries = await readdir(sourceLibraryDirectory, { withFileTypes: true }).catch((error) => {
+        if (error?.code === "ENOENT") return [];
+        throw error;
+      });
+      const libraries = sourceLibraries.filter((entry) => entry.isFile() && entry.name.endsWith(".dylib"));
+      if (libraries.length) await mkdir(runtimeLibraryDirectory, { recursive: true, mode: 0o700 });
+      for (const library of libraries) {
+        const libraryTemporary = join(runtimeLibraryDirectory, `.${library.name}.${randomUUID()}.tmp`);
+        try {
+          await copyFile(join(sourceLibraryDirectory, library.name), libraryTemporary);
+          await chmod(libraryTemporary, 0o700);
+          await rename(libraryTemporary, join(runtimeLibraryDirectory, library.name));
+        } finally {
+          await unlink(libraryTemporary).catch(() => undefined);
+        }
+      }
+    }
+  } finally {
+    await unlink(temporary).catch(() => undefined);
+  }
+  return target;
+}
+
 export function servicePlan({ directory, executable, cli, minutes = 15, platform = process.platform, home = homedir(), uid = process.getuid?.(), configHome = join(home, ".config"), now = Date.now() }) {
   minutes = intervalMinutes(minutes);
   for (const path of [directory, executable, cli, home, configHome]) if (/[\x00-\x1f]/.test(path)) throw new Error("Scheduler paths cannot contain control characters.");
   const id = createHash("sha256").update(directory).digest("hex").slice(0, 12);
-  const name = `com.usagemax.sync.${id}`;
+  const name = `com.UsageMax.sync.${id}`;
   const args = [cli, "service", "run", "--config-dir", directory];
-  const command = [executable, ...args];
+  // Linux can execute the published shebang entry point directly. macOS and
+  // Windows launch the staged UsageMax runtime so process browsers do not show
+  // the generic JavaScript runtime image name.
+  const command = platform === "win32" || platform === "darwin"
+    ? [executable, ...args]
+    : [cli, "service", "run", "--config-dir", directory];
   if (platform === "darwin") {
     const file = join(home, "Library", "LaunchAgents", `${name}.plist`);
     const domain = `gui/${uid}`;
@@ -88,7 +148,8 @@ export async function manageService(action, { directory, cli, minutes, env = pro
   const settingsPath = join(directory, "service.json");
   const settings = await readJson(settingsPath);
   const configHome = settings?.configHome || env.XDG_CONFIG_HOME || join(home, ".config");
-  const plan = servicePlan({ directory, cli, executable: process.execPath, minutes: minutes ?? settings?.minutes ?? 15, configHome, home, platform });
+  const executable = brandedRuntimePath(directory, platform) || process.execPath;
+  const plan = servicePlan({ directory, cli, executable, minutes: minutes ?? settings?.minutes ?? 15, configHome, home, platform });
   if (action === "status") {
     let registered = false;
     try { await executeCommand(plan.probe); registered = true; } catch { /* Not installed, inactive, or unavailable. */ }
@@ -105,8 +166,9 @@ export async function manageService(action, { directory, cli, minutes, env = pro
   }
   if (action !== "install") throw new Error("Use service install [--every 15], status, run, or uninstall.");
   assertDurablePath(await realpath(cli));
-  assertDurablePath(await realpath(process.execPath));
+  if (platform === "darwin" || platform === "win32") assertDurablePath(await realpath(process.execPath));
   await access(join(directory, "config.json"));
+  if (platform === "darwin" || platform === "win32") await ensureBrandedRuntime(directory, process.execPath, platform);
   // Check the user manager before writing anything. WSL without systemd fails clearly.
   if (plan.backend === "systemd") await executeCommand(["systemctl", ["--user", "show-environment"]]);
   if (settings) {

package/src/transport.js

@@ -7,6 +7,82 @@ export function retryAfterMs(value, now = Date.now()) {
   return Number.isFinite(date) ? Math.max(0, date - now) : 0;
 }
 
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+
+const collectorStates = new Set(["active", "revoked", "workspace_disabled", "membership_inactive", "device_mismatch", "scope_missing"]);
+const deviceBindings = new Set(["unbound", "bound", "matched", "mismatch"]);
+const collectorTokenPattern = /umx_[a-f0-9]{64}/gi;
+
+function safeText(value, secret) {
+  let text = value;
+  if (secret) text = text.split(secret).join("[redacted]");
+  return text.replace(collectorTokenPattern, "[redacted]").slice(0, 160);
+}
+
+// Only copy the documented diagnostic projection. This keeps a compromised or
+// misconfigured endpoint from echoing a collector secret through the CLI.
+export function collectorStatusView(httpStatus, value, secret) {
+  const body = record(value);
+  const view = { tokenFormat: "valid", httpStatus };
+  if (!body) {
+    return {
+      ...view,
+      status: httpStatus === 401 ? "rejected" : "unavailable",
+      reason: httpStatus === 401
+        ? "UsageMax did not accept this collector token. It may be unknown, revoked, disabled, or from another deployment."
+        : "UsageMax returned no machine-readable collector status.",
+    };
+  }
+
+  if (typeof body.status === "string" && collectorStates.has(body.status)) view.status = body.status;
+  if (body.credentialType === "collector") view.credentialType = body.credentialType;
+  if (body.writeOnly === true) view.writeOnly = true;
+  if (body.activation === "not_required") view.activation = body.activation;
+  if (body.expiresAt === null) view.expiresAt = null;
+  if (Array.isArray(body.scopes)) view.scopes = body.scopes.filter((scope) => typeof scope === "string").slice(0, 16);
+  if (body.scopeStatus === "valid" || body.scopeStatus === "missing_telemetry_write") view.scopeStatus = body.scopeStatus;
+  if (typeof body.ingestAuthorized === "boolean") view.ingestAuthorized = body.ingestAuthorized;
+  if (typeof body.deviceBinding === "string" && deviceBindings.has(body.deviceBinding)) view.deviceBinding = body.deviceBinding;
+  for (const key of ["profileHandle", "deviceName", "platform", "cliVersion", "lastFailureCode"]) {
+    if (typeof body[key] === "string") view[key] = safeText(body[key], secret);
+  }
+  for (const key of ["createdAt", "lastSeenAt", "lastSuccessAt", "lastFailureAt"]) {
+    if (typeof body[key] === "number" && Number.isSafeInteger(body[key])) view[key] = body[key];
+    else if (body[key] === null) view[key] = null;
+  }
+  if (!view.status) {
+    view.status = httpStatus === 401 ? "rejected" : "unavailable";
+    view.reason = httpStatus === 401
+      ? "UsageMax did not accept this collector token. It may be unknown, revoked, disabled, or from another deployment."
+      : "UsageMax returned an incomplete collector status.";
+  }
+  return view;
+}
+
+export async function requestCollectorStatus(endpoint, config, {
+  timeout = 15_000,
+  fetchImpl = fetch,
+} = {}) {
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "GET",
+      headers: {
+        authorization: `Bearer ${config.token}`,
+        ...(config.deviceId ? { "x-usagemax-device-id": config.deviceId } : {}),
+      },
+      cache: "no-store",
+      signal: AbortSignal.timeout(timeout),
+    });
+  } catch {
+    throw new Error("Collector status could not reach UsageMax or timed out. Check your network connection.");
+  }
+  const body = await response.json().catch(() => null);
+  return { httpStatus: response.status, body };
+}
+
 // Only snapshot operations have server receipts. Never automatically replay a
 // one-use link request or apply this policy to arbitrary POST operations.
 export async function requestSnapshot(endpoint, config, operation, payload, {

package/src/updates.js

@@ -0,0 +1,99 @@
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { spawn } from "node:child_process";
+
+export const REGISTRY_URL = "https://registry.npmjs.org/usagemax/latest";
+export const UPDATE_CHECK_TTL_MS = 12 * 60 * 60 * 1000;
+
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+
+export function compareVersions(left, right) {
+  const a = String(left || "").split(".").map(Number);
+  const b = String(right || "").split(".").map(Number);
+  if (a.length !== 3 || b.length !== 3 || a.some((part) => !Number.isInteger(part)) || b.some((part) => !Number.isInteger(part))) return 0;
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] > b[index] ? 1 : -1;
+  }
+  return 0;
+}
+
+function cachePath(directory) {
+  return join(directory, "update-check.json");
+}
+
+async function readCache(directory) {
+  try {
+    const value = record(JSON.parse(await readFile(cachePath(directory), "utf8")));
+    if (!value || !Number.isFinite(value.checkedAt)) return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+
+async function writeCache(directory, value) {
+  await mkdir(dirname(cachePath(directory)), { recursive: true, mode: 0o700 });
+  const path = cachePath(directory);
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(value)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await unlink(temporary).catch(() => undefined);
+  }
+}
+
+export async function latestVersion({ fetchImpl = fetch, timeout = 1_500 } = {}) {
+  try {
+    const response = await fetchImpl(REGISTRY_URL, {
+      headers: { accept: "application/json" },
+      cache: "no-store",
+      signal: AbortSignal.timeout(timeout),
+    });
+    if (!response.ok) return null;
+    const body = record(await response.json());
+    return /^\d+\.\d+\.\d+$/.test(body?.version || "") ? body.version : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check npm at most twice a day. A failed check is deliberately non-fatal.
+ * The result contains no account data and is safe to cache locally.
+ */
+export async function checkForUpdate(directory, currentVersion, { force = false, now = Date.now(), fetchImpl = fetch } = {}) {
+  const cached = await readCache(directory);
+  if (!force && cached && now - cached.checkedAt < UPDATE_CHECK_TTL_MS) {
+    return { ...cached, newer: compareVersions(cached.latest, currentVersion) > 0 };
+  }
+  const latest = await latestVersion({ fetchImpl });
+  const result = { checkedAt: now, latest: latest || cached?.latest || null };
+  await writeCache(directory, result).catch(() => undefined);
+  return { ...result, newer: compareVersions(result.latest, currentVersion) > 0 };
+}
+
+function runner() {
+  const override = process.env.USAGEMAX_PACKAGE_RUNNER?.trim();
+  if (override) return { command: override, prefix: [] };
+  if (process.env.npm_execpath) return { command: "npm", prefix: ["exec", "--yes"] };
+  return { command: "bunx", prefix: ["--bun"] };
+}
+
+/** Re-run a command through the current npm dist-tag without requiring @latest. */
+export async function runLatest(args, { spawnImpl = spawn } = {}) {
+  const selected = runner();
+  const child = spawnImpl(selected.command, [...selected.prefix, "usagemax@latest", "--", ...args], {
+    stdio: "inherit",
+    env: { ...process.env, USAGEMAX_UPDATE_HANDOFF: "1" },
+  });
+  const code = await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (status) => resolve(status ?? 1));
+  });
+  process.exitCode = code;
+  return code;
+}