58cc162c4a
Relay (X23, X27): the intake key is its own tier (upload and file drops only, RELAY_INTAKE_COMPAT=0 closes it);
a run task needs an Ed25519 signature by the Mac run key over {to, nonce, body sha256, flags} (RELAY_RUN_PUB,
401 without) and an HMAC tag with the target's machine secret that the agent verifies before anything runs;
results and registration are bound to the machine the secret proves (403 on a forged from).
X24: every client and Mac tool sends x-relay-token as a header to /api/relay?fn=; the path token stays for the
phone page only. X25: the agent arms the logon task only for a restart a task asked for and disarms on start
and exit. X26: 30-day retention with blob deletion, feed capped at 100, the dl base as RELAY_DL_BASE held by the
agent, never in a body. X28: GET inbox never acks (POST inbox does), RELAY-REBOOT on its own line and only with a
reboot flag, 120/min and 10 failed auths/min per IP, no username or folder on register, WSL sudo scoped to
apt-get and dpkg with SETENV, no password on a command line. X29: the intake key reaches curl through -K in
upload.sh and both upload-log.bat; tools/ci/curl-header-check.sh fails the class. G14: TZ=UTC in ship-app.mjs
and publish-jobs.sh; tools/ci/commit-tz-check.sh fails the class; history-rewrite.md names the .old-2026-10-05
files as the values in the history. The handler moved to relay/lib/handler.mjs with injected sql and blobs
(relay/lib/blob.mjs holds @vercel/blob) so relay/test/handler.test.mjs drives it without a database:
47 tests across 6 suites, all green.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
84 lines
4.2 KiB
JavaScript
84 lines
4.2 KiB
JavaScript
// Shared pieces for the Igneum relay function. Zero dependencies (the Vercel Blob calls live in lib/blob.mjs, so
|
|
// lib/handler.mjs and its tests load without node_modules). Storage: Neon (HTTP SQL driver) for every item,
|
|
// Vercel Blob (store igneum-relay, public URLs with a random suffix) for files. The token in the URL path is the
|
|
// only secret the web page holds; scripts send it in x-relay-token; the relay key and the intake key go in
|
|
// x-igneum-key with the powers lib/guard.mjs gives them (5 October 2026, night: X23, X24, X27).
|
|
import { randomBytes } from 'node:crypto';
|
|
import { authVia } from './guard.mjs';
|
|
|
|
export const MAX_INLINE = 4 * 1024 * 1024; // raw upload through the function (Vercel body cap is 4.5 MB)
|
|
export const MAX_BLOB = 50 * 1024 * 1024; // direct-to-Blob upload with a client token
|
|
export const MAX_BODY = 1024 * 1024; // text body per item
|
|
export const KINDS = new Set(['text', 'file', 'task', 'result', 'run']);
|
|
export const ROLES = new Set(['miner', 'prover', 'bench', 'mac', 'phone', '']);
|
|
|
|
export function neon() {
|
|
const url = process.env.DATABASE_URL;
|
|
if (!url) throw new Error('DATABASE_URL is not set');
|
|
const host = new URL(url).hostname.replace('-pooler', '');
|
|
return async (query, params = []) => {
|
|
const r = await fetch(`https://${host}/sql`, {
|
|
method: 'POST',
|
|
headers: { 'Neon-Connection-String': url, 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ query, params }),
|
|
});
|
|
const j = await r.json();
|
|
if (!r.ok) throw new Error(j.message || JSON.stringify(j));
|
|
return j.rows;
|
|
};
|
|
}
|
|
|
|
export const str = (v, max) => (v === undefined || v === null ? '' : String(v)).slice(0, max);
|
|
|
|
/** 'token', 'key', 'intake' or null (lib/guard.mjs). The intake tier may only upload and drop files. */
|
|
export const authed = (req, env = process.env) => authVia({ query: req.query || {}, headers: req.headers || {} }, env);
|
|
/** The same, with the intake tier excluded: the console and the wake POST take reports from nobody's package. */
|
|
export const authedNoIntake = (req, env = process.env) => { const v = authed(req, env); return v === 'intake' ? null : v; };
|
|
|
|
export async function readJson(req) {
|
|
if (req.body !== undefined && req.body !== null) {
|
|
if (typeof req.body === 'string') return req.body ? JSON.parse(req.body) : {};
|
|
if (Buffer.isBuffer(req.body)) return req.body.length ? JSON.parse(req.body.toString('utf8')) : {};
|
|
return req.body;
|
|
}
|
|
const chunks = [];
|
|
for await (const c of req) chunks.push(c);
|
|
const s = Buffer.concat(chunks).toString('utf8');
|
|
return s ? JSON.parse(s) : {};
|
|
}
|
|
|
|
export async function readRaw(req) {
|
|
if (Buffer.isBuffer(req.body)) return req.body;
|
|
if (typeof req.body === 'string') return Buffer.from(req.body, 'utf8');
|
|
const chunks = [];
|
|
for await (const c of req) chunks.push(c);
|
|
return Buffer.concat(chunks);
|
|
}
|
|
|
|
export function safeName(name) {
|
|
const n = str(name, 200).replace(/[\\/]+/g, '_').replace(/[^\w.\-+ ()\[\]]/g, '_').trim();
|
|
return n || 'file';
|
|
}
|
|
|
|
export function blobPath(name) {
|
|
return `relay/${randomBytes(6).toString('hex')}/${safeName(name)}`;
|
|
}
|
|
|
|
export const ITEM_COLS = 'id, ts, from_machine, to_machine, kind, title, body, file_name, file_url, size, read, read_at, done, done_at, flags, task_id, (file_b64 IS NOT NULL) AS inline';
|
|
export const BLOB_URL_RE = /^https:\/\/[a-z0-9.-]+\.public\.blob\.vercel-storage\.com\//i;
|
|
|
|
export const iso = v => { if (!v) return null; const d = new Date(String(v).replace(' ', 'T').replace(/([+-]\d\d)$/, '$1:00')); return isNaN(d) ? String(v) : d.toISOString(); };
|
|
|
|
export function rowOut(r) {
|
|
return {
|
|
id: Number(r.id), ts: iso(r.ts), from: r.from_machine, to: r.to_machine, kind: r.kind, title: r.title, body: r.body,
|
|
file_name: r.file_name, has_file: !!(r.file_url || r.inline), size: Number(r.size || 0),
|
|
read: !!r.read, read_at: iso(r.read_at), done: !!r.done, done_at: iso(r.done_at), flags: r.flags || {}, task_id: r.task_id == null ? null : Number(r.task_id),
|
|
};
|
|
}
|
|
|
|
export async function touch(sql, name) {
|
|
if (!name) return;
|
|
await sql(`INSERT INTO relay_machines (name, role, named, last_seen) VALUES ($1, '', false, now())
|
|
ON CONFLICT (name) DO UPDATE SET last_seen = now()`, [str(name, 80)]);
|
|
}
|