warpmetal 0.1.0

package/src/install-skill.js

@@ -0,0 +1,65 @@
+import { cp, mkdir, rm, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { CliError } from "./errors.js";
+
+const SOURCE = fileURLToPath(new URL("../skills/warpmetal", import.meta.url));
+
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+function destinationFor(target, scope, { cwd, env }) {
+  const userHome = env.HOME || env.USERPROFILE || homedir();
+  if (target === "codex") {
+    if (scope === "project") return join(cwd, ".codex", "skills", "warpmetal");
+    return join(resolve(env.CODEX_HOME || join(userHome, ".codex")), "skills", "warpmetal");
+  }
+  if (target === "claude") {
+    if (scope === "project") return join(cwd, ".claude", "skills", "warpmetal");
+    return join(userHome, ".claude", "skills", "warpmetal");
+  }
+  throw new CliError(`Unsupported agent target: ${target}`, { exitCode: 2 });
+}
+
+export async function installSkill(
+  target,
+  { scope = "user", force = false, cwd = process.cwd(), env = process.env } = {},
+) {
+  if (!["user", "project"].includes(scope)) {
+    throw new CliError("--scope must be user or project.", { exitCode: 2 });
+  }
+  const targets = target === "all" ? ["codex", "claude"] : [target];
+  const destinations = targets.map((name) => ({
+    target: name,
+    path: destinationFor(name, scope, { cwd, env }),
+  }));
+
+  if (!force) {
+    for (const destination of destinations) {
+      if (await exists(destination.path)) {
+        throw new CliError(
+          `A WarpMetal skill already exists for ${destination.target}: ${destination.path}. Use --force to replace it.`,
+          { exitCode: 2 },
+        );
+      }
+    }
+  }
+
+  for (const destination of destinations) {
+    if (force && (await exists(destination.path))) {
+      await rm(destination.path, { recursive: true, force: true });
+    }
+    await mkdir(dirname(destination.path), { recursive: true });
+    await cp(SOURCE, destination.path, { recursive: true, errorOnExist: true });
+  }
+  return destinations;
+}

package/src/ssh.js

@@ -0,0 +1,57 @@
+import { readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { mkdtemp } from "node:fs/promises";
+
+import { CliError } from "./errors.js";
+
+export async function readSshPublicKey(path) {
+  const resolved = resolve(path);
+  const value = (await readFile(resolved, "utf8")).trim();
+  if (value.includes("PRIVATE KEY") || !/^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp(256|384|521))\s+/.test(value)) {
+    throw new CliError(
+      "The SSH public-key file must contain one supported OpenSSH public key and never a private key.",
+      { exitCode: 2 },
+    );
+  }
+  if (value.includes("\n")) {
+    throw new CliError("The SSH public-key file must contain exactly one key.", { exitCode: 2 });
+  }
+  return value;
+}
+
+export async function signSshChallenge(payload, identityPath, { spawn = spawnSync } = {}) {
+  if (typeof payload !== "string" || !payload.startsWith("warpmetal-ssh-auth-v1\n")) {
+    throw new CliError("WarpMetal returned an invalid SSH signing payload.");
+  }
+  const identity = resolve(identityPath);
+  const directory = await mkdtemp(join(tmpdir(), "warpmetal-ssh-"));
+  const payloadPath = join(directory, "challenge.txt");
+  const signaturePath = `${payloadPath}.sig`;
+  try {
+    await writeFile(payloadPath, payload, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    const result = spawn(
+      "ssh-keygen",
+      ["-Y", "sign", "-f", identity, "-n", "warpmetal", payloadPath],
+      { stdio: ["inherit", "ignore", "inherit"] },
+    );
+    if (result.error?.code === "ENOENT") {
+      throw new CliError("ssh-keygen is required for WarpMetal SSH proof.", { exitCode: 2 });
+    }
+    if (result.error) throw result.error;
+    if (result.status !== 0) {
+      throw new CliError("ssh-keygen did not create a WarpMetal SSH signature.", { exitCode: 4 });
+    }
+    const signature = await readFile(signaturePath, "utf8");
+    if (
+      !signature.includes("-----BEGIN SSH SIGNATURE-----") ||
+      !signature.includes("-----END SSH SIGNATURE-----")
+    ) {
+      throw new CliError("ssh-keygen returned an invalid SSH signature.", { exitCode: 4 });
+    }
+    return signature;
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}

package/src/state.js

@@ -0,0 +1,200 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, open, readFile, rename, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+
+import { CliError } from "./errors.js";
+
+const STATE_VERSION = 1;
+
+function emptyState() {
+  return {
+    version: STATE_VERSION,
+    orders: {},
+    servers: {},
+    operations: {},
+  };
+}
+
+export function resolveStateDirectory({ env = process.env, platform = process.platform } = {}) {
+  if (env.WARPMETAL_HOME) return resolve(env.WARPMETAL_HOME);
+  if (platform === "win32" && env.APPDATA) return join(env.APPDATA, "WarpMetal");
+  if (env.XDG_CONFIG_HOME) return join(env.XDG_CONFIG_HOME, "warpmetal");
+  return join(homedir(), ".config", "warpmetal");
+}
+
+async function ensurePrivateDirectory(path) {
+  await mkdir(path, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") await chmod(path, 0o700);
+}
+
+async function atomicWriteJson(path, value) {
+  await ensurePrivateDirectory(dirname(path));
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  const handle = await open(temporary, "wx", 0o600);
+  try {
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename(temporary, path);
+  if (process.platform !== "win32") await chmod(path, 0o600);
+}
+
+function validateState(value) {
+  if (!value || value.version !== STATE_VERSION) {
+    throw new CliError("Unsupported or corrupt WarpMetal state file.", { exitCode: 2 });
+  }
+  if (!value.orders || !value.servers || !value.operations) {
+    throw new CliError("Incomplete WarpMetal state file.", { exitCode: 2 });
+  }
+  return value;
+}
+
+export class StateStore {
+  constructor(directory = resolveStateDirectory()) {
+    this.directory = isAbsolute(directory) ? directory : resolve(directory);
+    this.path = join(this.directory, "state.json");
+  }
+
+  async read() {
+    try {
+      return validateState(JSON.parse(await readFile(this.path, "utf8")));
+    } catch (error) {
+      if (error?.code === "ENOENT") return emptyState();
+      if (error instanceof SyntaxError) {
+        throw new CliError(`WarpMetal state is not valid JSON: ${this.path}`, { exitCode: 2 });
+      }
+      throw error;
+    }
+  }
+
+  async write(state) {
+    await atomicWriteJson(this.path, validateState(state));
+  }
+
+  async update(mutator) {
+    const state = await this.read();
+    const result = await mutator(state);
+    await this.write(state);
+    return result;
+  }
+
+  async savePreparedOrder(response, checkoutBody) {
+    const { task, ownerToken } = response;
+    if (!task?.id || !task?.serverId || !ownerToken) {
+      throw new CliError("WarpMetal returned an incomplete prepared order.");
+    }
+    await this.update((state) => {
+      state.orders[task.id] = {
+        taskId: task.id,
+        serverId: task.serverId,
+        planId: task.planId,
+        checkoutPath: task.checkoutPath,
+        checkoutBody,
+        ownerToken,
+        createdAt: new Date().toISOString(),
+      };
+      state.servers[task.serverId] = {
+        ...(state.servers[task.serverId] || {}),
+        serverId: task.serverId,
+        taskId: task.id,
+        ownerToken,
+      };
+    });
+  }
+
+  async savePaymentChallenge(taskId, { paymentRequired, paymentAttemptId }) {
+    await this.update((state) => {
+      const order = state.orders[taskId];
+      if (!order) throw new CliError(`No local order state exists for ${taskId}.`, { exitCode: 2 });
+      order.paymentRequired = paymentRequired;
+      order.paymentAttemptId = paymentAttemptId;
+      order.paymentChallengeSavedAt = new Date().toISOString();
+    });
+  }
+
+  async saveAccessToken(serverId, accessToken, expiresAt) {
+    await this.update((state) => {
+      const server = state.servers[serverId] || { serverId };
+      server.accessToken = accessToken;
+      server.accessTokenExpiresAt = expiresAt;
+      state.servers[serverId] = server;
+    });
+  }
+
+  async saveOperation(operationId, serverId, kind) {
+    await this.update((state) => {
+      state.operations[operationId] = {
+        operationId,
+        serverId,
+        kind,
+        createdAt: new Date().toISOString(),
+      };
+    });
+  }
+
+  async order(taskId) {
+    return (await this.read()).orders[taskId];
+  }
+
+  async server(serverId) {
+    return (await this.read()).servers[serverId];
+  }
+
+  async operation(operationId) {
+    return (await this.read()).operations[operationId];
+  }
+
+  async taskToken(taskId, env = process.env) {
+    if (env.WARPMETAL_OWNER_TOKEN) return env.WARPMETAL_OWNER_TOKEN;
+    return (await this.order(taskId))?.ownerToken;
+  }
+
+  async serverToken(serverId, env = process.env) {
+    if (env.WARPMETAL_ACCESS_TOKEN) return env.WARPMETAL_ACCESS_TOKEN;
+    if (env.WARPMETAL_OWNER_TOKEN) return env.WARPMETAL_OWNER_TOKEN;
+    const server = await this.server(serverId);
+    if (!server) return undefined;
+    if (
+      server.accessToken &&
+      server.accessTokenExpiresAt &&
+      Date.parse(server.accessTokenExpiresAt) > Date.now() + 5_000
+    ) {
+      return server.accessToken;
+    }
+    return server.ownerToken;
+  }
+
+  async summary() {
+    const state = await this.read();
+    return {
+      stateFile: this.path,
+      orders: Object.values(state.orders).map((order) => ({
+        taskId: order.taskId,
+        serverId: order.serverId,
+        planId: order.planId,
+        paymentAttemptId: order.paymentAttemptId,
+        credentialStored: Boolean(order.ownerToken),
+      })),
+      servers: Object.values(state.servers).map((server) => ({
+        serverId: server.serverId,
+        taskId: server.taskId,
+        recoveryCredentialStored: Boolean(server.ownerToken),
+        accessTokenExpiresAt: server.accessTokenExpiresAt,
+      })),
+      operations: Object.values(state.operations),
+    };
+  }
+
+  async permissions() {
+    try {
+      const info = await stat(this.path);
+      return info.mode & 0o777;
+    } catch (error) {
+      if (error?.code === "ENOENT") return undefined;
+      throw error;
+    }
+  }
+}