vana-cli 0.25.0 → 0.26.0

package/dist/personal-server/local/owner-secret.js

@@ -0,0 +1,119 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { localServerHome } from "./config.js";
+const KEYCHAIN_SERVICE = "org.vana.cli.personal-server-owner";
+export function ownerSecretKey(accountUrl, address) {
+    return `${new URL(accountUrl).host}:${address.toLowerCase()}`;
+}
+function parse(raw) {
+    if (!raw)
+        return null;
+    try {
+        const value = JSON.parse(raw);
+        if (typeof value.signature === "string" &&
+            typeof value.signerAddress === "string") {
+            return {
+                signature: value.signature,
+                signerAddress: value.signerAddress,
+                trustToken: typeof value.trustToken === "string" ? value.trustToken : null,
+            };
+        }
+    }
+    catch {
+        // Unreadable entry: treat as absent.
+    }
+    return null;
+}
+function keychainStore() {
+    const run = (args) => execFileSync("security", args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+    return {
+        get(key) {
+            try {
+                return parse(run([
+                    "find-generic-password",
+                    "-s",
+                    KEYCHAIN_SERVICE,
+                    "-a",
+                    key,
+                    "-w",
+                ]).trim());
+            }
+            catch {
+                return null;
+            }
+        },
+        set(key, binding) {
+            run([
+                "add-generic-password",
+                "-U",
+                "-s",
+                KEYCHAIN_SERVICE,
+                "-a",
+                key,
+                "-w",
+                JSON.stringify(binding),
+            ]);
+        },
+        delete(key) {
+            try {
+                run(["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", key]);
+            }
+            catch {
+                // Already gone.
+            }
+        },
+    };
+}
+function fileStore(file = path.join(localServerHome(), "owner-bindings.json")) {
+    const read = () => {
+        try {
+            return JSON.parse(fs.readFileSync(file, "utf8"));
+        }
+        catch {
+            return {};
+        }
+    };
+    const write = (entries) => {
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(file, `${JSON.stringify(entries, null, 2)}\n`, {
+            mode: 0o600,
+        });
+    };
+    return {
+        get: (key) => parse(read()[key]),
+        set(key, binding) {
+            write({ ...read(), [key]: JSON.stringify(binding) });
+        },
+        delete(key) {
+            const entries = read();
+            delete entries[key];
+            write(entries);
+        },
+    };
+}
+// Without a default keychain (a HOME with no login keychain, a fresh
+// account), `security add-generic-password` does not fail: it puts up a GUI
+// dialog and waits. Asking for the default keychain never prompts.
+function hasDefaultKeychain() {
+    try {
+        execFileSync("security", ["default-keychain"], {
+            stdio: ["ignore", "ignore", "ignore"],
+            timeout: 5_000,
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function defaultOwnerSecretStore() {
+    return process.platform === "darwin" && hasDefaultKeychain()
+        ? keychainStore()
+        : fileStore();
+}
+export { fileStore as fileOwnerSecretStore };
+//# sourceMappingURL=owner-secret.js.map

package/dist/personal-server/local/owner-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-secret.js","sourceRoot":"","sources":["../../../src/personal-server/local/owner-secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAe9C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAE9D,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,OAAe;IAChE,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,KAAK,CAAC,GAA8B;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACvD,IACE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,EACvC,CAAC;YACD,OAAO;gBACL,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,UAAU,EACR,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;aACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,EAAE,CAC7B,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC;IACL,OAAO;QACL,GAAG,CAAC,GAAG;YACL,IAAI,CAAC;gBACH,OAAO,KAAK,CACV,GAAG,CAAC;oBACF,uBAAuB;oBACvB,IAAI;oBACJ,gBAAgB;oBAChB,IAAI;oBACJ,GAAG;oBACH,IAAI;iBACL,CAAC,CAAC,IAAI,EAAE,CACV,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,OAAO;YACd,GAAG,CAAC;gBACF,sBAAsB;gBACtB,IAAI;gBACJ,IAAI;gBACJ,gBAAgB;gBAChB,IAAI;gBACJ,GAAG;gBACH,IAAI;gBACJ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,GAAG;YACR,IAAI,CAAC;gBACH,GAAG,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,qBAAqB,CAAC;IAE1D,MAAM,IAAI,GAAG,GAA2B,EAAE;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAG9C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,OAA+B,EAAE,EAAE;QAChD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC9D,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,EAAE,OAAO;YACd,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,GAAG;YACR,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;YACpB,KAAK,CAAC,OAAO,CAAC,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,4EAA4E;AAC5E,mEAAmE;AACnE,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE;YAC7C,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;YACrC,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,kBAAkB,EAAE;QAC1D,CAAC,CAAC,aAAa,EAAE;QACjB,CAAC,CAAC,SAAS,EAAE,CAAC;AAClB,CAAC;AAED,OAAO,EAAE,SAAS,IAAI,oBAAoB,EAAE,CAAC"}

package/dist/personal-server/local/runtime-pkg/entry.mjs

@@ -0,0 +1,153 @@
+// The Personal Server process `vana server start` runs, modeled on Vana
+// Desktop's sidecar (apps/desktop/personal-server/index.js in unity-surfaces).
+//
+// It reads one JSON line on stdin, so the owner signature never appears in the
+// process list or environment:
+//   { rootPath, port, ownerSignature, ownerAddress, network: { gatewayUrl, chainId,
+//     contracts, storageApiUrl } }
+// and writes one JSON object per line on stdout: ready, error, stopped.
+// Logs go to stderr.
+
+import { readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import readline from "node:readline";
+
+import {
+  loadConfig,
+  startPersonalServer,
+} from "@opendatalabs/personal-server-ts/node";
+
+const send = (message) => process.stdout.write(`${JSON.stringify(message)}\n`);
+
+function isPlainObject(value) {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) !== null
+  );
+}
+
+// Derived leaves win and every other persisted key survives, as in Desktop's
+// applyDerivedServerConfig.
+function applyDerived(persisted, derived) {
+  if (!isPlainObject(persisted)) return structuredClone(derived);
+  const merged = { ...persisted };
+  for (const [key, value] of Object.entries(derived)) {
+    merged[key] =
+      isPlainObject(value) && isPlainObject(merged[key])
+        ? applyDerived(merged[key], value)
+        : structuredClone(value);
+  }
+  return merged;
+}
+
+// Everything that follows from the network. Local only for now: no tunnel,
+// so nothing is reachable from outside and nothing may be registered, and no
+// sync to Vana storage until registration exists.
+function derivedConfig(network) {
+  return {
+    devUi: { enabled: true },
+    gateway: {
+      url: network.gatewayUrl,
+      chainId: network.chainId,
+      contracts: network.contracts,
+    },
+    inference: {
+      baseUrl: `${network.gatewayUrl.replace(/\/+$/, "")}/v1/inference`,
+    },
+    logging: { level: "info", pretty: false },
+    storage: {
+      backend: "vana",
+      config: { vana: { apiUrl: network.storageApiUrl } },
+    },
+    sync: { enabled: false },
+    tunnel: { enabled: false },
+  };
+}
+
+async function readInput() {
+  const rl = readline.createInterface({ input: process.stdin });
+  for await (const line of rl) {
+    if (line.trim()) {
+      rl.close();
+      return JSON.parse(line);
+    }
+  }
+  throw new Error("No configuration on stdin.");
+}
+
+let ps = null;
+
+async function main() {
+  const input = await readInput();
+  const { rootPath, port, ownerSignature, ownerAddress, network } = input;
+  const configPath = join(rootPath, "server.json");
+  const derived = derivedConfig(network);
+
+  // Persist the derived block the way Desktop does, so a network change can
+  // never leave an old gateway or storage host behind in server.json.
+  let persisted = null;
+  try {
+    persisted = JSON.parse(await readFile(configPath, "utf8"));
+  } catch {
+    persisted = null;
+  }
+  const next = applyDerived(persisted, derived);
+  const temporary = `${configPath}.${process.pid}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(next, null, 2)}\n`, {
+    mode: 0o600,
+  });
+  await rename(temporary, configPath);
+
+  // configDefaults merges shallowly for some sections, so hand back whole
+  // sections from the schema-complete loaded config.
+  const loaded = await loadConfig({ configPath, rootPath });
+  const configDefaults = {
+    server: {
+      ...loaded.server,
+      port,
+      ...(ownerAddress ? { address: ownerAddress } : {}),
+    },
+  };
+  for (const key of Object.keys(derived)) {
+    configDefaults[key] = applyDerived(loaded[key], derived[key]);
+  }
+
+  ps = await startPersonalServer({
+    configPath,
+    rootPath,
+    port,
+    ownerSignature,
+    mcpOAuthApprovalUrl: "vana://mcp-authorization",
+    configDefaults,
+    onStatus: (status) => process.stderr.write(`[status] ${status}\n`),
+  });
+  const info = await ps.ready();
+  send({
+    type: "ready",
+    port,
+    url: info.urls?.local ?? `http://localhost:${port}`,
+  });
+}
+
+async function shutdown(signal) {
+  process.stderr.write(`[entry] ${signal}, stopping\n`);
+  try {
+    await ps?.stop();
+  } finally {
+    send({ type: "stopped" });
+    process.exit(0);
+  }
+}
+
+process.on("SIGINT", () => void shutdown("SIGINT"));
+process.on("SIGTERM", () => void shutdown("SIGTERM"));
+
+main().catch((error) => {
+  send({
+    type: "error",
+    message: error instanceof Error ? error.message : String(error),
+  });
+  process.exit(1);
+});