@hope_phenom/dsh-plugin-remote-use 0.0.0-stage → 0.2.24

package/slave/make-launch-spec.mjs

@@ -0,0 +1,184 @@
+// make-launch-spec.mjs -- generate the ACP agent launch spec for THIS machine.
+//
+// We deliberately do NOT launch `dsh.cmd`. That shim is:
+//     set "ELECTRON_RUN_AS_NODE=1"
+//     "<install>\DeepSeek Harness.exe" --expose-internals "<install>\resources\app.asar\
+//         dsh\node_modules\@deepseek-ai\dsh-desktop-host\lib\cli.js" %*
+// and we replicate it exactly with an argv ARRAY, which avoids every Windows quoting
+// hazard: `cmd.exe /c` loses quotes through the PowerShell -> node hand-off, and Node
+// refuses to spawn a `.cmd` without a shell (EINVAL).
+//
+// NOTE: the cli.js path lives INSIDE app.asar, so ordinary fs existence checks report
+// false -- Electron can read it, the filesystem API cannot. We therefore only test the
+// .exe and let the argv path be constructed.
+//
+// Usage: node make-launch-spec.mjs [--install <dir>] [--profile acp] [--out <file>]
+//                                   [--permission-mode <mode>] [--dsh-home <dir>]
+//                                   [--settings-file <file>]
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+
+import { checkPairing } from './permission-pairing.mjs'
+
+const argv = process.argv.slice(2)
+function arg(name, fallback) {
+  const i = argv.indexOf(`--${name}`)
+  return i >= 0 && argv[i + 1] !== undefined ? argv[i + 1] : fallback
+}
+const PROFILE = arg('profile', 'acp')
+const OUT = arg('out', 'agent-spec.json')
+// Permission mode is read by dsh-base's sandbox-policy/approval rows from the
+// environment, so it must be set in the CHILD's env to make experiments deterministic.
+// 'workspace-write' => sandbox denies out-of-workspace writes and approval policy is 'ask',
+//                      which is exactly the path that produces session/request_permission.
+//
+// NO --permission-mode MEANS "USE THE MACHINE'S CONFIGURED MODE", not "leave it unset": a
+// hand-managed relay and the plugin's settings page both write this one value, and letting the
+// manual path default to nothing is how a spec can silently keep an old mode after the setting was
+// changed. The flag still wins when given, so an explicit deployment stays reproducible.
+const PERMISSION_FLAG = arg('permission-mode', '')
+let PERMISSION_MODE = PERMISSION_FLAG
+let PERMISSION_MODE_SOURCE = PERMISSION_FLAG === '' ? 'none' : '--permission-mode'
+
+// ---------------------------------------------------------------------------
+// GATE: refuse a mode this worker's profile cannot compose (PITFALLS F34).
+//
+// This is the point where a spec is WRITTEN, so it is the point where a bad mode must be refused --
+// whether it came from --permission-mode or from the settings file. The plugin also knows the mode,
+// but arming fails at spec-build time; letting a typo through here would start a child whose
+// dsh-base rejects the value at load.
+//
+// Blocks on a KNOWN-BAD combination, and only warns when the profile cannot be read: refusing on
+// "unknown" would make a legitimate worker undeployable, while staying silent about "unknown" would
+// let the operator read silence as approval. The two cases are therefore reported differently.
+// ---------------------------------------------------------------------------
+const DSH_HOME = arg('dsh-home', process.env.DSH_HOME ?? join(process.env.USERPROFILE ?? '', '.dsh'))
+const SETTINGS_FILE = arg('settings-file', join(DSH_HOME, 'storages', 'dsh-plugin-remote-use', 'settings.json'))
+// Read once: the mode and the model both live in this file, and reading it twice invites the two
+// values coming from different generations of it.
+let SETTINGS = {}
+try {
+  SETTINGS = JSON.parse(readFileSync(SETTINGS_FILE, 'utf8').replace(/^\uFEFF/, ''))
+} catch {
+  // Missing settings file is the normal case for a hand-managed worker that never opened the
+  // plugin's page. A corrupt one is caught by the mode gate if it produced no usable value.
+  SETTINGS = {}
+}
+if (PERMISSION_MODE === '') {
+  const fromSettings = SETTINGS !== null && typeof SETTINGS === 'object' ? SETTINGS.workerSessionMode : undefined
+  if (typeof fromSettings === 'string' && fromSettings !== '') {
+    PERMISSION_MODE = fromSettings
+    PERMISSION_MODE_SOURCE = `settings: ${SETTINGS_FILE}`
+  }
+}
+/**
+ * The worker model, as `provider/model`. Empty means "leave the profile's acp row alone".
+ *
+ * It is applied as an OVERLAY passed with `--patch`, not by editing the profile: the plugin does
+ * not own `cordis.patch.yml`. The overlay is applied after the profile layer, so it wins.
+ */
+const WORKER_MODEL = SETTINGS !== null && typeof SETTINGS === 'object' && typeof SETTINGS.workerModel === 'string'
+  ? SETTINGS.workerModel.trim()
+  : ''
+let modelPatch = ''
+if (WORKER_MODEL !== '') {
+  const slash = WORKER_MODEL.indexOf('/')
+  const provider = slash > 0 ? WORKER_MODEL.slice(0, slash).trim() : ''
+  const model = slash > 0 ? WORKER_MODEL.slice(slash + 1).trim() : ''
+  if (provider === '' || model === '' || /[\r\n]/.test(WORKER_MODEL) || /\s/.test(model)) {
+    console.error(`[make-launch-spec] REFUSING: workerModel "${WORKER_MODEL}" is not "provider/model"`)
+    console.error('Nothing was written. Fix the setting, then run this again.')
+    process.exit(3)
+  }
+  modelPatch = join(DSH_HOME, 'storages', 'dsh-plugin-remote-use', 'acp-model-overlay.yml')
+  const overlay = [
+    '# --- dsh-plugin-remote-use managed: worker model (generated from this machine\'s "workerModel" setting) ---',
+    '- id: acp',
+    "  name: '@deepseek-ai/dsh-acp'",
+    '  config:',
+    `    provider: ${JSON.stringify(provider)}`,
+    `    model: ${JSON.stringify(model)}`,
+    '# --- end dsh-plugin-remote-use managed: worker model ---',
+    '',
+  ].join('\n')
+  try {
+    mkdirSync(dirname(modelPatch), { recursive: true })
+    writeFileSync(modelPatch, overlay, 'utf8')
+  } catch (error) {
+    console.error(`[make-launch-spec] REFUSING: cannot write the model overlay ${modelPatch}: ${error.message}`)
+    console.error('Nothing was written. Fix DSH_HOME or permissions, then run this again.')
+    process.exit(3)
+  }
+}
+const PROFILE_PATH = join(DSH_HOME, 'profiles', PROFILE, 'cordis.patch.yml')
+let profileText
+try {
+  profileText = readFileSync(PROFILE_PATH, 'utf8')
+} catch {
+  profileText = undefined
+}
+
+const pairing = checkPairing({ mode: PERMISSION_MODE, profileText, profilePath: PROFILE_PATH })
+if (pairing.severity === 'block') {
+  console.error(`[make-launch-spec] REFUSING to generate this spec: --permission-mode ${PERMISSION_MODE}`)
+  console.error('')
+  console.error(pairing.reason)
+  console.error('')
+  console.error('Nothing was written. Fix the profile, then run this again.')
+  process.exit(3)
+}
+if (pairing.severity === 'warn') {
+  console.error(`[make-launch-spec] WARNING: ${pairing.reason}`)
+  if (profileText === undefined) {
+    // "Could not verify" is not "verified fine", and the operator still needs to know what to check
+    // by hand when this script cannot read the profile (an unusual DSH_HOME, for instance).
+    console.error(`                 expected the profile patch at ${PROFILE_PATH}`)
+    console.error('                 if it pins the approval policy, apply slave/acp-profile-approval.patch.yml')
+  }
+}
+
+// Hard-coded profile paths first: under a SYSTEM scheduled task LOCALAPPDATA points at
+// C:\Windows\system32\config\systemprofile, so environment-derived candidates miss.
+const CANDIDATES = [
+  arg('install', ''),
+  join(process.env.LOCALAPPDATA ?? '', 'Programs', 'DeepSeek Harness'),
+  'C:\\Program Files\\DeepSeek Harness',
+].filter((p) => typeof p === 'string' && p !== '')
+
+let installDir = null
+for (const c of CANDIDATES) {
+  if (existsSync(join(c, 'DeepSeek Harness.exe'))) { installDir = c; break }
+}
+if (installDir === null) {
+  console.error('[make-launch-spec] could not find "DeepSeek Harness.exe". Tried:')
+  for (const c of CANDIDATES) console.error('  ' + c)
+  process.exit(2)
+}
+
+const exe = join(installDir, 'DeepSeek Harness.exe')
+const cli = [
+  installDir, 'resources', 'app.asar', 'dsh', 'node_modules',
+  '@deepseek-ai', 'dsh-desktop-host', 'lib', 'cli.js',
+].join('\\')
+
+const spec = {
+  command: exe,
+  // `--patch` is applied AFTER the profile layer: that is how the model setting wins without
+  // editing the operator's `cordis.patch.yml`.
+  args: ['--expose-internals', cli, '--profile', PROFILE, ...(modelPatch === '' ? [] : ['--patch', modelPatch])],
+  env: {
+    ELECTRON_RUN_AS_NODE: '1',
+    ...(PERMISSION_MODE === '' ? {} : { DSH_PERMISSION_MODE: PERMISSION_MODE }),
+  },
+  _note: 'replicates dsh.cmd with an argv array; never launch the .cmd shim from Node on Windows',
+  _installDir: installDir,
+  _permissionMode: PERMISSION_MODE === '' ? '(inherited)' : PERMISSION_MODE,
+  _permissionModeSource: PERMISSION_MODE_SOURCE,
+  _workerModel: WORKER_MODEL === '' ? '(inherit profile)' : WORKER_MODEL,
+  _modelOverlay: modelPatch,
+}
+
+writeFileSync(OUT, JSON.stringify(spec, null, 2), 'utf8')
+console.log(`wrote ${resolve(OUT)}`)
+console.log(`mode: ${spec._permissionMode}${PERMISSION_MODE_SOURCE === 'none' ? '' : ` (from ${PERMISSION_MODE_SOURCE})`}`)
+console.log(JSON.stringify(spec, null, 2))

package/slave/net-address.mjs

@@ -0,0 +1,138 @@
+/**
+ * Choosing which local address to advertise, and which ones may be bound.
+ *
+ * WHY THIS IS ITS OWN MODULE: two callers need the same answer -- the relay, to put an address
+ * in a pairing string, and the plugin's arming path, to offer a list of interfaces and to
+ * refuse a bind that is not one of them. Two copies of "which address is the real LAN one"
+ * would drift, and the failure mode is a pairing string or a listener that is well-formed and
+ * unreachable.
+ *
+ * THE MEASUREMENT THAT SHAPED IT: a Windows machine with Hyper-V, WSL, Docker or VirtualBox
+ * installed has several non-internal IPv4 addresses, enumerated in no useful order. Taking the
+ * FIRST one produced `172.20.0.1` on the development host -- a Hyper-V switch no peer can
+ * reach. So candidates are scored rather than filtered, and interfaces whose names give them
+ * away as virtual are rejected outright.
+ *
+ * It is a heuristic, which is why an explicit override exists at every call site.
+ */
+
+/**
+ * Interface names that are virtual adapters, with the switch that owns them.
+ * Rejected outright rather than down-ranked: an operator who wants one can still name it
+ * explicitly, but nothing should ever pick it by accident.
+ */
+const VIRTUAL_ADAPTER = /(hyper-v|vethernet|wsl|docker|vmware|virtualbox|vbox|loopback|tailscale|zerotier|tap|tun|npcap|bluetooth)/iu
+
+/** `a.b.c.d` -> a number, or -1 when it is not a dotted quad. */
+export function ipv4Value(address) {
+  const parts = String(address).split('.')
+  if (parts.length !== 4) return -1
+  let value = 0
+  for (const part of parts) {
+    if (!/^\d{1,3}$/u.test(part)) return -1
+    const n = Number(part)
+    if (n > 255) return -1
+    value = (value * 256) + n
+  }
+  return value
+}
+
+/** True for the private ranges a LAN peer can normally reach. */
+export function isPrivateIpv4(address) {
+  return address.startsWith('192.168.')
+    || address.startsWith('10.')
+    || /^172\.(1[6-9]|2\d|3[01])\./u.test(address)
+}
+
+/**
+ * How good an address is to advertise or bind. Higher wins; `-1` means never choose it.
+ *
+ * Private ranges beat anything else because a peer on the LAN can reach them, and the classic
+ * `192.168.0.0/16` beats `10/8` beats the `172.16/12` block -- where container and switch
+ * addresses usually land. Link-local (`169.254.`) scores lowest but is not rejected: it is a
+ * real answer when nothing else is configured, and saying so beats offering nothing.
+ */
+export function addressScore(address, name) {
+  if (VIRTUAL_ADAPTER.test(String(name))) return -1
+  const value = ipv4Value(address)
+  if (value < 0) return -1
+  if (address === '127.0.0.1' || address.startsWith('127.')) return -1
+  if (address.startsWith('192.168.')) return 40
+  if (address.startsWith('10.')) return 30
+  if (/^172\.(1[6-9]|2\d|3[01])\./u.test(address)) return 20
+  if (address.startsWith('169.254.')) return 1
+  return 10
+}
+
+/**
+ * Every IPv4 address this machine could plausibly be reached on.
+ *
+ * @param {Record<string, Array<{address: string, family: string, internal: boolean}>>} interfaces
+ *        as `os.networkInterfaces()` returns it -- injected so this is testable off-machine
+ * @returns {Array<{ address: string, name: string, score: number, private: boolean, virtual: boolean }>}
+ *          best first; virtual adapters are included but scored -1, so a UI can explain why
+ *          they are not offered
+ */
+export function candidateAddresses(interfaces) {
+  const out = []
+  for (const [name, list] of Object.entries(interfaces ?? {})) {
+    for (const info of list ?? []) {
+      if (info?.family !== 'IPv4' || info.internal === true) continue
+      const address = String(info.address ?? '')
+      // A malformed entry is not an address at all, so it is dropped. A VIRTUAL adapter is a
+      // real address that merely should not be chosen by default, so it stays in the list with
+      // a negative score -- that is what lets a UI say why it is not offered.
+      if (ipv4Value(address) < 0) continue
+      const virtual = VIRTUAL_ADAPTER.test(name)
+      out.push({
+        address,
+        name,
+        score: addressScore(address, name),
+        private: isPrivateIpv4(address),
+        virtual,
+      })
+    }
+  }
+  // Best score first, then the lower address, so the order is stable across calls.
+  return out.sort((a, b) => (b.score - a.score) || (ipv4Value(a.address) - ipv4Value(b.address)))
+}
+
+/**
+ * The best address to advertise, or '' when there is none.
+ * @param {Record<string, any>} interfaces
+ * @returns {string}
+ */
+export function bestAddress(interfaces) {
+  const [first] = candidateAddresses(interfaces)
+  return first === undefined || first.score <= 0 ? '' : first.address
+}
+
+/**
+ * May `address` be bound as the worker listener?
+ *
+ * `0.0.0.0` is REFUSED, not merely defaulted against. The decision was "bind a specific LAN
+ * interface, and do not offer a one-click all-interfaces option", and a rule that only lives in
+ * a dropdown is a rule the next caller ignores.
+ *
+ * @param {string} address
+ * @param {Record<string, any>} interfaces
+ * @returns {{ ok: boolean, error: string }}
+ */
+export function assertBindable(address, interfaces) {
+  const value = String(address ?? '').trim()
+  if (value === '') return { ok: false, error: 'no bind address given' }
+  if (value === '0.0.0.0' || value === '::' || value === '*') {
+    return { ok: false, error: 'binding every interface is not offered; name the LAN address to listen on' }
+  }
+  if (value === '127.0.0.1' || value.startsWith('127.')) {
+    // Allowed, but only as an explicit choice: a loopback listener cannot be reached by a peer,
+    // so it is a test mode rather than a pairing.
+    return { ok: true, error: '' }
+  }
+  if (ipv4Value(value) < 0) return { ok: false, error: `not an IPv4 address: ${value}` }
+  const known = candidateAddresses(interfaces).find((c) => c.address === value)
+  if (known === undefined) {
+    return { ok: false, error: `${value} is not an address of this machine (choose one of the listed interfaces)` }
+  }
+  return { ok: true, error: '' }
+}

package/slave/node_modules/.package-lock.json

@@ -0,0 +1,26 @@
+{
+  "name": "dsh-plugin-remote-use-slave",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "node_modules/ws": {
+      "version": "8.22.0",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}

package/slave/node_modules/ws/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
+Copyright (c) 2013 Arnout Kazemier and contributors
+Copyright (c) 2016 Luigi Pinca and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.