@goodandready/dsh-remote-workspace 0.1.1 → 0.2.0

package/lib/tunnel-service.js

@@ -6,75 +6,112 @@ export class TunnelService {
    */
   constructor(sshService) {
     this.sshService = sshService;
-    /** @type {Map<string, { server?: net.Server, profileId: string, localPort: number, targetHost: string, remotePort: number }>} */
+    /** @type {Map<string, {
+     *   server: net.Server,
+     *   profileId: string,
+     *   localPort: number,
+     *   targetHost: string,
+     *   remotePort: number,
+     *   createdAt: number,
+     *   bytesRx: number,
+     *   bytesTx: number,
+     *   totalConnections: number,
+     *   activeConnections: number
+     * }>} */
     this.activeTunnels = new Map();
   }
 
   /**
-   * Start Local Port Forwarding: 127.0.0.1:localPort -> Remote:targetHost:targetPort
+   * Start local port forwarding tunnel: LocalPort -> RemoteHost:RemotePort with live telemetry
    */
-  async startLocalTunnel(profile, localPort, targetHost = '127.0.0.1', targetPort) {
-    const tunnelId = `${profile.id}:${localPort}->${targetPort}`;
+  async startLocalTunnel(profile, localPort, targetHost, remotePort) {
+    const tunnelId = `${profile.id}:${localPort}->${targetHost}:${remotePort}`;
     if (this.activeTunnels.has(tunnelId)) {
-      return { success: true, message: 'Tunnel already active', tunnelId, localPort, remotePort: targetPort };
+      return { success: true, tunnelId, alreadyRunning: true };
     }
 
     const conn = await this.sshService.getConnection(profile);
 
     return new Promise((resolve, reject) => {
-      const server = net.createServer((socket) => {
+      const tunnelMeta = {
+        server: null,
+        profileId: profile.id,
+        localPort,
+        targetHost,
+        remotePort,
+        createdAt: Date.now(),
+        bytesRx: 0,
+        bytesTx: 0,
+        totalConnections: 0,
+        activeConnections: 0
+      };
+
+      const server = net.createServer((clientSocket) => {
+        tunnelMeta.totalConnections++;
+        tunnelMeta.activeConnections++;
+
         conn.forwardOut(
           '127.0.0.1',
-          socket.remotePort || 0,
+          clientSocket.remotePort || 0,
           targetHost,
-          targetPort,
+          remotePort,
           (err, stream) => {
             if (err) {
-              try { socket.destroy(); } catch (_) {}
+              tunnelMeta.activeConnections = Math.max(0, tunnelMeta.activeConnections - 1);
+              clientSocket.destroy();
               return;
             }
-            stream.on('error', () => {
-              try { socket.destroy(); } catch (_) {}
+
+            // Telemetry: measure bytes flowing through the tunnel
+            clientSocket.on('data', (d) => {
+              tunnelMeta.bytesRx += d.length;
             });
-            socket.on('error', () => {
-              try { stream.destroy(); } catch (_) {}
+            stream.on('data', (d) => {
+              tunnelMeta.bytesTx += d.length;
             });
-            socket.pipe(stream).pipe(socket);
+
+            clientSocket.pipe(stream);
+            stream.pipe(clientSocket);
+
+            const cleanup = () => {
+              tunnelMeta.activeConnections = Math.max(0, tunnelMeta.activeConnections - 1);
+            };
+            clientSocket.on('close', cleanup);
+            clientSocket.on('error', cleanup);
+            stream.on('close', cleanup);
+            stream.on('error', cleanup);
           }
         );
       });
 
+      tunnelMeta.server = server;
+
       server.on('error', (err) => {
         this.activeTunnels.delete(tunnelId);
         reject(err);
       });
 
       server.listen(localPort, '127.0.0.1', () => {
-        this.activeTunnels.set(tunnelId, {
-          server,
-          profileId: profile.id,
+        this.activeTunnels.set(tunnelId, tunnelMeta);
+        resolve({
+          success: true,
+          tunnelId,
           localPort,
           targetHost,
-          remotePort: targetPort
+          remotePort
         });
-        resolve({ success: true, tunnelId, localPort, targetHost, remotePort: targetPort });
       });
     });
   }
 
-  /**
-   * Stop active tunnel
-   */
   stopTunnel(tunnelId) {
     const tunnel = this.activeTunnels.get(tunnelId);
-    if (tunnel && tunnel.server) {
-      try {
-        tunnel.server.close();
-      } catch (_) {}
-      this.activeTunnels.delete(tunnelId);
-      return true;
-    }
-    return false;
+    if (!tunnel) return false;
+    try {
+      tunnel.server.close();
+    } catch (_) {}
+    this.activeTunnels.delete(tunnelId);
+    return true;
   }
 
   listActiveTunnels() {
@@ -82,16 +119,22 @@ export class TunnelService {
       id,
       profileId: t.profileId,
       localPort: t.localPort,
-      targetHost: t.targetHost || '127.0.0.1',
-      remotePort: t.remotePort
+      targetHost: t.targetHost,
+      remotePort: t.remotePort,
+      createdAt: t.createdAt,
+      uptimeSeconds: Math.floor((Date.now() - t.createdAt) / 1000),
+      bytesRx: t.bytesRx,
+      bytesTx: t.bytesTx,
+      totalConnections: t.totalConnections,
+      activeConnections: t.activeConnections
     }));
   }
 
   stopAll() {
-    for (const [id, t] of this.activeTunnels.entries()) {
-      if (t.server) {
-        try { t.server.close(); } catch (_) {}
-      }
+    for (const [id, tunnel] of this.activeTunnels.entries()) {
+      try {
+        tunnel.server.close();
+      } catch (_) {}
     }
     this.activeTunnels.clear();
   }

package/lib/vault-service.js

@@ -0,0 +1,184 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+/**
+ * VaultService manages credentials (password, privateKey, passphrase)
+ * stored in an isolated, secure .env file instead of DSH profiles JSON.
+ */
+export class VaultService {
+  constructor(customPath = null) {
+    if (customPath) {
+      this.envPath = customPath;
+    } else {
+      const homeDir = os.homedir();
+      const secretsDir = path.join(homeDir, '.dsh', 'secrets');
+      try {
+        if (!fs.existsSync(secretsDir)) {
+          fs.mkdirSync(secretsDir, { recursive: true, mode: 0o700 });
+        }
+      } catch (_) {}
+      this.envPath = path.join(secretsDir, 'dsh-remote-workspace.env');
+    }
+    this.ensureEnvFile();
+  }
+
+  ensureEnvFile() {
+    try {
+      if (!fs.existsSync(this.envPath)) {
+        fs.writeFileSync(this.envPath, '# DSH Remote Workspace Encrypted Secrets Vault\n', { mode: 0o600, encoding: 'utf8' });
+      } else {
+        // Ensure file permissions are restricted to owner only
+        try { fs.chmodSync(this.envPath, 0o600); } catch (_) {}
+      }
+    } catch (_) {}
+  }
+
+  /**
+   * Parse .env file into key-value map
+   */
+  readAll() {
+    this.ensureEnvFile();
+    try {
+      const content = fs.readFileSync(this.envPath, 'utf8');
+      const lines = content.split('\n');
+      const store = {};
+      let currentKey = null;
+      let currentValue = '';
+      let isMultiline = false;
+
+      for (const line of lines) {
+        if (!isMultiline) {
+          const trimmed = line.trim();
+          if (!trimmed || trimmed.startsWith('#')) continue;
+          const eqIdx = line.indexOf('=');
+          if (eqIdx === -1) continue;
+          const key = line.slice(0, eqIdx).trim();
+          let val = line.slice(eqIdx + 1);
+
+          if (val.startsWith('"') && !val.endsWith('"')) {
+            isMultiline = true;
+            currentKey = key;
+            currentValue = val.slice(1) + '\n';
+          } else if (val.startsWith('"') && val.endsWith('"') && val.length >= 2) {
+            store[key] = val.slice(1, -1).replace(/\\n/g, '\n').replace(/\\r/g, '\r');
+          } else {
+            store[key] = val;
+          }
+        } else {
+          if (line.endsWith('"')) {
+            currentValue += line.slice(0, -1);
+            store[currentKey] = currentValue.replace(/\\n/g, '\n').replace(/\\r/g, '\r');
+            isMultiline = false;
+            currentKey = null;
+            currentValue = '';
+          } else {
+            currentValue += line + '\n';
+          }
+        }
+      }
+      return store;
+    } catch (err) {
+      return {};
+    }
+  }
+
+  writeAll(store) {
+    this.ensureEnvFile();
+    const lines = ['# DSH Remote Workspace Secrets Vault - Auto Generated', ''];
+    for (const [key, val] of Object.entries(store)) {
+      if (val === undefined || val === null || val === '') continue;
+      const strVal = String(val);
+      if (strVal.includes('\n') || strVal.includes('"') || strVal.includes('=')) {
+        const escaped = strVal.replace(/"/g, '\\"').replace(/\r/g, '\\r').replace(/\n/g, '\\n');
+        lines.push(`${key}="${escaped}"`);
+      } else {
+        lines.push(`${key}=${strVal}`);
+      }
+    }
+    lines.push('');
+    fs.writeFileSync(this.envPath, lines.join('\n'), { mode: 0o600, encoding: 'utf8' });
+  }
+
+  keyPrefix(profileId) {
+    const cleanId = profileId.replace(/[^a-zA-Z0-9_]/g, '_').toUpperCase();
+    return `DRW_${cleanId}`;
+  }
+
+  getProfileSecrets(profileId) {
+    if (!profileId) return {};
+    const store = this.readAll();
+    const prefix = this.keyPrefix(profileId);
+    return {
+      password: store[`${prefix}_PASSWORD`] || '',
+      privateKey: store[`${prefix}_PRIVATE_KEY`] || '',
+      passphrase: store[`${prefix}_PASSPHRASE`] || ''
+    };
+  }
+
+  setProfileSecrets(profileId, secrets = {}) {
+    if (!profileId) return;
+    const store = this.readAll();
+    const prefix = this.keyPrefix(profileId);
+
+    if (secrets.password !== undefined) {
+      if (secrets.password) store[`${prefix}_PASSWORD`] = secrets.password;
+      else delete store[`${prefix}_PASSWORD`];
+    }
+    if (secrets.privateKey !== undefined) {
+      if (secrets.privateKey) store[`${prefix}_PRIVATE_KEY`] = secrets.privateKey;
+      else delete store[`${prefix}_PRIVATE_KEY`];
+    }
+    if (secrets.passphrase !== undefined) {
+      if (secrets.passphrase) store[`${prefix}_PASSPHRASE`] = secrets.passphrase;
+      else delete store[`${prefix}_PASSPHRASE`];
+    }
+
+    this.writeAll(store);
+  }
+
+  deleteProfileSecrets(profileId) {
+    if (!profileId) return;
+    const store = this.readAll();
+    const prefix = this.keyPrefix(profileId);
+    delete store[`${prefix}_PASSWORD`];
+    delete store[`${prefix}_PRIVATE_KEY`];
+    delete store[`${prefix}_PASSPHRASE`];
+    this.writeAll(store);
+  }
+
+  /**
+   * Enrich profile with secrets from .env vault before connecting
+   */
+  hydrateProfile(profile) {
+    if (!profile || !profile.id) return profile;
+    const secrets = this.getProfileSecrets(profile.id);
+    return {
+      ...profile,
+      password: secrets.password || profile.password || '',
+      privateKey: secrets.privateKey || profile.privateKey || '',
+      passphrase: secrets.passphrase || profile.passphrase || ''
+    };
+  }
+
+  /**
+   * Strip secrets for public config/UI serialization
+   */
+  sanitizeProfile(profile) {
+    if (!profile) return profile;
+    const secrets = this.getProfileSecrets(profile.id);
+    const hasPassword = Boolean(secrets.password || profile.password);
+    const hasPrivateKey = Boolean(secrets.privateKey || profile.privateKey);
+    const hasPassphrase = Boolean(secrets.passphrase || profile.passphrase);
+
+    return {
+      ...profile,
+      password: hasPassword ? '••••••••' : '',
+      privateKey: hasPrivateKey ? '••••••••' : '',
+      passphrase: hasPassphrase ? '••••••••' : '',
+      hasStoredPassword: hasPassword,
+      hasStoredPrivateKey: hasPrivateKey,
+      hasStoredPassphrase: hasPassphrase
+    };
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-remote-workspace",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Enterprise Remote Workspace Plugin for DeepSeek Harness: SSH2 connection pool, SFTP operations, 3-way conflict-aware mirror sync, port forwarding, and native DSH UI.",
   "type": "module",
   "main": "lib/index.js",