2a602d5289
1. `.gitignore` swallowed a source file. `agent/src/dist/buildBinary.ts` is the
packaging config, not build output, but the blanket `dist/` rule meant it was
never committed — a fresh clone could neither typecheck `agent/src/index.ts`
nor import it from the committed `agent/test/buildBinary.test.ts`. Re-included
the DIRECTORY first (git does not descend into an excluded one, so un-ignoring
just the file would not have worked) and committed the file. Verified build
output under `agent/dist/`, `dist/`, `public/build/` is still ignored.
2. Tunnel logs named no host. `pair` learned hostId/subdomain from the enroll
response and threw them away, so the long-running `run` process logged
`{"subdomain":null,"hostId":null}` — including all 6380 warnings during the
8-day outage, at exactly the moment you want to know which host. New
`config/hostRecord.ts` persists them at enrol; `resolveHostIdentity` resolves
config > record > the subdomain embedded in the leaf's SPIFFE SAN, so hosts
enrolled before the record existed get an identifier back without re-pairing.
3. The phone track had no recovery path. Added `POST /device/:id/recover`,
mirroring the host route: cert in the body, device-CA path validation, SPIFFE
parse, `notBefore` never graced, and the full registry check (active + same
account + `:id` matches the cert + same key) — only `notAfter` is relaxed.
Verified: agent 300/300, control-plane 296/296, tsc clean on both.
NOTE: the iOS/Android clients are not wired to call /device/:id/recover yet —
the server capability exists, the client-side trigger does not.
46 lines
1.5 KiB
TypeScript
46 lines
1.5 KiB
TypeScript
/**
|
|
* Static-binary build spec — PLAN_RELAY_AGENT T16 (EXPLORE §6 distribution rank 2). Produces a
|
|
* `bun --compile` spec for a one-`curl | sh` install. `npx web-terminal-agent` stays the MVP path
|
|
* (rank 1). The bundle EXCLUDES dev/test deps and any terminal parser (INV11 re-check at the
|
|
* package boundary — the agent is a byte-shuttle, never an ANSI interpreter).
|
|
*/
|
|
export type BinaryTarget = 'darwin-arm64' | 'darwin-x64' | 'linux-x64' | 'linux-arm64'
|
|
|
|
export const BINARY_TARGETS: readonly BinaryTarget[] = [
|
|
'darwin-arm64',
|
|
'darwin-x64',
|
|
'linux-x64',
|
|
'linux-arm64',
|
|
]
|
|
|
|
export interface BuildSpec {
|
|
readonly tool: 'bun'
|
|
readonly entry: string
|
|
readonly target: BinaryTarget
|
|
readonly bunTarget: string // bun's --target triple
|
|
readonly outfile: string
|
|
readonly minify: true
|
|
/** Package-name substrings that must NOT appear in the bundle graph (INV11 tripwire). */
|
|
readonly forbiddenDeps: readonly string[]
|
|
}
|
|
|
|
const BUN_TRIPLE: Readonly<Record<BinaryTarget, string>> = {
|
|
'darwin-arm64': 'bun-darwin-arm64',
|
|
'darwin-x64': 'bun-darwin-x64',
|
|
'linux-x64': 'bun-linux-x64',
|
|
'linux-arm64': 'bun-linux-arm64',
|
|
}
|
|
|
|
/** Build the `bun --compile` spec for a target triple. Entry is the CLI. */
|
|
export function buildBinaryConfig(target: BinaryTarget): BuildSpec {
|
|
return {
|
|
tool: 'bun',
|
|
entry: 'src/cli.ts',
|
|
target,
|
|
bunTarget: BUN_TRIPLE[target],
|
|
outfile: `dist/web-terminal-agent-${target}`,
|
|
minify: true,
|
|
forbiddenDeps: ['xterm', 'ansi', 'vt100'],
|
|
}
|
|
}
|