248 lines
7.8 KiB
JavaScript
Executable File
248 lines
7.8 KiB
JavaScript
Executable File
#!/usr/bin/env node
|
|
/**
|
|
* grok-glance CLI.
|
|
*
|
|
* Privileged operations (minting enrollment codes, revoking devices) are authenticated with
|
|
* a local admin token read from $GLANCE_HOME/admin.token, not by "is this request from
|
|
* localhost". That distinction matters: `tailscale serve` proxies remote traffic to
|
|
* 127.0.0.1, so the daemon cannot tell a local caller from a tunnelled one by address alone.
|
|
*/
|
|
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { spawn } from "node:child_process";
|
|
import {
|
|
PLUGIN_ROOT,
|
|
baseUrl,
|
|
glanceHome,
|
|
isDaemonUp,
|
|
readConfig,
|
|
sleep,
|
|
} from "./glance-lib.mjs";
|
|
|
|
const SERVER_ENTRY = path.join(PLUGIN_ROOT, "dist", "server", "index.js");
|
|
const cfg = readConfig();
|
|
const cmd = process.argv[2] ?? "status";
|
|
const args = process.argv.slice(3);
|
|
|
|
function adminToken() {
|
|
try {
|
|
return fs.readFileSync(path.join(glanceHome(), "admin.token"), "utf8").trim();
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
async function api(pathname, { method = "GET", body, admin = false } = {}) {
|
|
const headers = { "content-type": "application/json" };
|
|
if (admin) {
|
|
const token = adminToken();
|
|
if (!token) {
|
|
throw new Error("no admin token found - is the daemon running? try `glance up`");
|
|
}
|
|
headers["x-glance-admin"] = token;
|
|
}
|
|
const res = await fetch(`${baseUrl(cfg)}${pathname}`, {
|
|
method,
|
|
headers,
|
|
body: body ? JSON.stringify(body) : undefined,
|
|
signal: AbortSignal.timeout(10_000),
|
|
});
|
|
const text = await res.text();
|
|
let data = null;
|
|
try {
|
|
data = text ? JSON.parse(text) : null;
|
|
} catch {
|
|
data = null;
|
|
}
|
|
if (!res.ok) throw new Error(data?.error ?? `${res.status} ${res.statusText}`);
|
|
return data;
|
|
}
|
|
|
|
function requireBuild() {
|
|
if (!fs.existsSync(SERVER_ENTRY)) {
|
|
console.error(`grok-glance is not built yet.\n\n cd ${PLUGIN_ROOT}\n npm install && npm run build\n`);
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
async function ensureUp() {
|
|
if (await isDaemonUp(cfg)) return true;
|
|
requireBuild();
|
|
const home = glanceHome();
|
|
fs.mkdirSync(home, { recursive: true });
|
|
const logFd = fs.openSync(path.join(home, "daemon.log"), "a");
|
|
const child = spawn(process.execPath, [SERVER_ENTRY], {
|
|
detached: true,
|
|
stdio: ["ignore", logFd, logFd],
|
|
});
|
|
child.unref();
|
|
for (let i = 0; i < 40; i++) {
|
|
await sleep(200);
|
|
if (await isDaemonUp(cfg, 300)) return true;
|
|
}
|
|
console.error(`daemon did not come up; see ${path.join(home, "daemon.log")}`);
|
|
return false;
|
|
}
|
|
|
|
switch (cmd) {
|
|
case "serve":
|
|
case "start": {
|
|
requireBuild();
|
|
await import(SERVER_ENTRY);
|
|
break;
|
|
}
|
|
|
|
case "up": {
|
|
if (await ensureUp()) console.log(`grok-glance running on ${baseUrl(cfg)}`);
|
|
else process.exit(1);
|
|
break;
|
|
}
|
|
|
|
case "stop": {
|
|
if (!(await isDaemonUp(cfg))) {
|
|
console.log("not running");
|
|
break;
|
|
}
|
|
await api("/local/shutdown", { method: "POST", admin: true });
|
|
console.log("stopped");
|
|
break;
|
|
}
|
|
|
|
case "status": {
|
|
if (!(await isDaemonUp(cfg))) {
|
|
console.log(`grok-glance: not running (port ${cfg.port})`);
|
|
console.log("start it with: glance up");
|
|
break;
|
|
}
|
|
const s = await api("/local/status", { admin: true });
|
|
console.log(`grok-glance ${s.version} on ${baseUrl(cfg)}`);
|
|
console.log(` public origin : ${s.origin ?? "(not configured - see README)"}`);
|
|
console.log(` rp id : ${s.rpId ?? "(not configured)"}`);
|
|
console.log(` devices : ${s.devices}`);
|
|
console.log(` approval mode : ${s.approval.mode}`);
|
|
console.log(` watchers : ${s.watchers}`);
|
|
console.log(` sessions : ${s.sessions}`);
|
|
console.log(` events kept : ${s.events}`);
|
|
if (s.devices === 0) console.log("\nNo device enrolled yet. Run: glance enroll");
|
|
break;
|
|
}
|
|
|
|
case "enroll": {
|
|
if (!(await ensureUp())) process.exit(1);
|
|
const out = await api("/local/enroll", { method: "POST", admin: true });
|
|
console.log("\n Open this on your phone:\n");
|
|
console.log(` ${out.url}\n`);
|
|
console.log(` Enrollment code: ${out.code}`);
|
|
console.log(` Valid for: ${Math.round(out.expiresInMs / 60000)} minutes (single use)\n`);
|
|
if (!out.originConfigured) {
|
|
console.log(" Note: no public origin configured yet, so the URL above is localhost.");
|
|
console.log(" Set one up first (see README), e.g.:\n");
|
|
console.log(" tailscale serve --bg 127.0.0.1:" + cfg.port);
|
|
console.log(" glance set-origin https://<your-box>.<tailnet>.ts.net\n");
|
|
}
|
|
break;
|
|
}
|
|
|
|
case "set-origin": {
|
|
const origin = args[0];
|
|
if (!origin) {
|
|
console.error("usage: glance set-origin https://your-box.tailnet.ts.net");
|
|
process.exit(1);
|
|
}
|
|
if (!(await ensureUp())) process.exit(1);
|
|
const out = await api("/local/origin", { method: "POST", admin: true, body: { origin } });
|
|
console.log(`origin : ${out.origin}`);
|
|
console.log(`rp id : ${out.rpId}`);
|
|
console.log("\nEnrolled devices are bound to the rp id. Changing it invalidates them.");
|
|
break;
|
|
}
|
|
|
|
case "devices": {
|
|
if (!(await isDaemonUp(cfg))) {
|
|
console.error("not running");
|
|
process.exit(1);
|
|
}
|
|
const out = await api("/local/devices", { admin: true });
|
|
if (!out.devices.length) {
|
|
console.log("no devices enrolled - run: glance enroll");
|
|
break;
|
|
}
|
|
for (const d of out.devices) {
|
|
console.log(`${d.id.slice(0, 16)}… ${d.label.padEnd(24)} added ${new Date(d.createdAt).toISOString().slice(0, 10)} last seen ${d.lastUsedAt ? new Date(d.lastUsedAt).toISOString().slice(0, 16).replace("T", " ") : "never"}`);
|
|
}
|
|
break;
|
|
}
|
|
|
|
case "revoke": {
|
|
if (!args[0]) {
|
|
console.error("usage: glance revoke <device-id-prefix>");
|
|
process.exit(1);
|
|
}
|
|
const out = await api("/local/devices/revoke", {
|
|
method: "POST",
|
|
admin: true,
|
|
body: { idPrefix: args[0] },
|
|
});
|
|
console.log(`revoked ${out.revoked} device(s)`);
|
|
break;
|
|
}
|
|
|
|
case "approval": {
|
|
const mode = args[0];
|
|
if (!["off", "risky", "all"].includes(mode)) {
|
|
console.error("usage: glance approval <off|risky|all>");
|
|
process.exit(1);
|
|
}
|
|
const out = await api("/local/approval", { method: "POST", admin: true, body: { mode } });
|
|
console.log(`approval mode: ${out.mode}`);
|
|
break;
|
|
}
|
|
|
|
case "sync-hooks": {
|
|
const file = path.join(PLUGIN_ROOT, "hooks", "hooks.json");
|
|
const doc = JSON.parse(fs.readFileSync(file, "utf8"));
|
|
let changed = 0;
|
|
for (const groups of Object.values(doc.hooks ?? {})) {
|
|
for (const group of groups) {
|
|
for (const h of group.hooks ?? []) {
|
|
if (h.type === "http" && typeof h.url === "string") {
|
|
const next = h.url.replace(/127\.0\.0\.1:\d+/, `127.0.0.1:${cfg.port}`);
|
|
if (next !== h.url) changed++;
|
|
h.url = next;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
fs.writeFileSync(file, JSON.stringify(doc, null, 2) + "\n");
|
|
console.log(`rewrote ${changed} hook url(s) to port ${cfg.port}`);
|
|
break;
|
|
}
|
|
|
|
case "logs": {
|
|
const file = path.join(glanceHome(), "daemon.log");
|
|
if (!fs.existsSync(file)) {
|
|
console.log("no log yet");
|
|
break;
|
|
}
|
|
process.stdout.write(fs.readFileSync(file, "utf8").split("\n").slice(-60).join("\n") + "\n");
|
|
break;
|
|
}
|
|
|
|
default:
|
|
console.log(`grok-glance - glance at Grok Build from your phone
|
|
|
|
glance up start the daemon in the background
|
|
glance serve run it in the foreground
|
|
glance stop stop it
|
|
glance status show what is running
|
|
glance enroll mint a one-time code to enrol a phone
|
|
glance set-origin <url> set the public https origin (and webauthn rp id)
|
|
glance devices list enrolled devices
|
|
glance revoke <id-prefix> revoke a device
|
|
glance approval <off|risky|all> remote approval policy
|
|
glance sync-hooks rewrite hook urls after a port change
|
|
glance logs tail the daemon log
|
|
`);
|
|
}
|