@huakirax/dsh-plugin-pocket 0.0.0-stage → 0.1.0

package/src/transport-pref.js

@@ -0,0 +1,47 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+/** Phone path is always host:port WebSocket (Tailscale or LAN). */
+export const TRANSPORTS = Object.freeze(['tailscale'])
+
+/**
+ * @param {unknown} v
+ * @returns {'tailscale'|null}
+ */
+export function normalizeTransport(v) {
+  if (v === 'tailscale') return v
+  return null
+}
+
+/**
+ * Resolve remote transport: explicit config > persisted last choice > default tailscale.
+ * Legacy `iroh` values in the transport file are ignored (phone path no longer supports them).
+ * @param {string} dataDir
+ * @param {unknown} [configTransport]
+ * @returns {'tailscale'}
+ */
+export function loadTransport(dataDir, configTransport) {
+  const fromConfig = normalizeTransport(configTransport)
+  if (fromConfig) return fromConfig
+  try {
+    const raw = readFileSync(join(dataDir, 'transport'), 'utf8').trim()
+    const fromFile = normalizeTransport(raw)
+    if (fromFile) return fromFile
+  } catch {
+    // missing file is fine
+  }
+  return 'tailscale'
+}
+
+/**
+ * Persist last choice (ignored when cordis config.transport is set).
+ * @param {string} dataDir
+ * @param {'tailscale'} mode
+ */
+export function saveTransport(dataDir, mode) {
+  const m = normalizeTransport(mode)
+  if (!m) throw new Error(`transport must be one of: ${TRANSPORTS.join(', ')}`)
+  mkdirSync(dataDir, { recursive: true })
+  writeFileSync(join(dataDir, 'transport'), `${m}\n`, { mode: 0o600 })
+  return m
+}

package/src/trust.js

@@ -0,0 +1,25 @@
+/** Loopback hostnames: localhost, IPv6 loopback, and the entire 127/8 range. */
+export function isLoopbackHostname(hostname) {
+  if (hostname === 'localhost' || hostname === '[::1]' || hostname === '::1') return true
+  const parts = hostname.split('.')
+  return parts.length === 4 && parts[0] === '127'
+    && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/**
+ * Browser-trust fence matching dsh's own `/api` Host/Origin rules (and tether):
+ * Host must be a loopback authority; refuse `sec-fetch-site: cross-site`;
+ * when Origin is present it must match Host. Does not accept trustedHosts —
+ * management routes are local-operator only.
+ */
+export function isTrustedRequest(req) {
+  const host = req.headers.host
+  if (typeof host !== 'string') return false
+  let hostUrl
+  try { hostUrl = new URL(`http://${host}`) } catch { return false }
+  if (!isLoopbackHostname(hostUrl.hostname)) return false
+  if (req.headers['sec-fetch-site'] === 'cross-site') return false
+  const origin = req.headers.origin
+  if (typeof origin !== 'string') return true
+  try { return new URL(origin).host === hostUrl.host } catch { return false }
+}

package/src/user-question-hook.js

@@ -0,0 +1,93 @@
+const never = new Promise(() => {})
+const questionError = (message, code) => Object.assign(new Error(message), { name: 'UserQuestionError', code })
+
+/**
+ * Keep the mobile offer alongside the desktop waterfall, including reconnects.
+ * A timed mobile claim has the Host's remaining duration, never an indefinite hold.
+ */
+export function createUserQuestionHook(server, { userQuestions } = {}) {
+  return async function onUserQuestionRequest(req, next) {
+    const sessionId = req.agent?.session?.id ?? req.agent?.id
+    if (!sessionId || req.signal?.aborted) return next()
+    const original = req.signal
+    const withdraw = new AbortController()
+    req.signal = original ? AbortSignal.any([original, withdraw.signal]) : withdraw.signal
+    let rejectLifecycle
+    const lifecycle = new Promise((_, reject) => { rejectLifecycle = reject })
+    let claim
+    let timer
+    let deadline
+    let finished = false
+    const offer = server.offerUserQuestion({
+      sessionId,
+      callId: req.wait?.callId,
+      questions: req.questions ?? [],
+      wait: req.wait ? { callId: req.wait.callId, timed: Boolean(req.wait.timed) } : undefined,
+    }, { isActive: () => !finished && !original?.aborted && (deadline === undefined || Date.now() < deadline) })
+    const fail = (error) => {
+      if (finished) return
+      offer.close('aborted', 'host')
+      rejectLifecycle(error)
+    }
+    const aborted = () => fail(original.reason ?? questionError('user-question aborted', 'ASK_ABORTED'))
+    original?.addEventListener('abort', aborted, { once: true })
+    const releaseClaim = () => {
+      clearTimeout(timer)
+      deadline = undefined
+      claim?.abort()
+      claim = undefined
+    }
+    const updateClaim = () => {
+      if (finished || !req.wait?.timed || !userQuestions?.attachWait) return
+      if (!server.hasDevices()) { releaseClaim(); return }
+      if (claim) return
+      const lifetime = new AbortController()
+      claim = lifetime
+      const signal = original ? AbortSignal.any([original, lifetime.signal]) : lifetime.signal
+      void (async () => {
+        try {
+          for await (const frame of userQuestions.attachWait(req.agent, req.wait.callId, signal)) {
+            if (signal.aborted || finished || claim !== lifetime) return
+            deadline = Date.now() + frame.remainingMs
+            timer = setTimeout(() => fail(questionError('ask_user_question timed out before the user answered', 'ASK_TIMED_OUT')), frame.remainingMs)
+          }
+          if (!signal.aborted && !finished && claim === lifetime) {
+            fail(questionError('the foreground question wait ended', 'ASK_ABORTED'))
+          }
+        } catch (error) {
+          if (!signal.aborted && !finished && claim === lifetime) fail(error)
+        }
+      })()
+    }
+    const unwatch = server.onDevicePresence?.(updateClaim)
+    updateClaim()
+    const chain = Promise.resolve().then(next).then(
+      (answer) => {
+        if (answer === undefined || answer === 'unavailable') return never
+        offer.close('answered', 'chain')
+        return { answer, by: 'chain' }
+      },
+      (error) => {
+        // NO_PROVIDER only means the desktop declined; mobile may still answer.
+        if (error?.code === 'NO_PROVIDER' && (req.wait?.timed || server.hasDevices())) return never
+        offer.close('aborted', 'chain')
+        throw error
+      },
+    )
+    try {
+      const winner = await Promise.race([offer.answer, chain, lifecycle])
+      offer.close('answered', winner.by)
+      return winner.answer
+    } finally {
+      finished = true
+      unwatch?.()
+      clearTimeout(timer)
+      original?.removeEventListener('abort', aborted)
+      withdraw.abort(questionError('question answerer withdrawn', 'ASK_ABORTED'))
+      offer.close('aborted', 'host')
+      // An accepted answer must reach askTimed before its last claim is released.
+      if (claim && original && !original.aborted) original.addEventListener('abort', releaseClaim, { once: true })
+      else releaseClaim()
+    }
+  }
+}

package/src/web-route.js

@@ -0,0 +1,116 @@
+import { isTrustedRequest } from './trust.js'
+
+const json = (res, status, body) => {
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+  res.end(JSON.stringify(body))
+}
+
+const refuse = (res) => json(res, 403, { error: 'forbidden' })
+
+const networkSelection = (req) => new URL(req.url, 'http://localhost').searchParams.get('network') ?? undefined
+const networkResponse = (req, res, action) => {
+  try {
+    return json(res, 200, action(networkSelection(req)))
+  } catch (error) {
+    return json(res, error?.statusCode === 400 ? 400 : 503, { error: String(error?.message ?? error) })
+  }
+}
+
+async function readJson(req, res, limit = 4096) {
+  let body = ''
+  for await (const c of req) {
+    body += c
+    if (body.length > limit) {
+      json(res, 413, { error: 'too large' })
+      return undefined
+    }
+  }
+  if (!body) return {}
+  try { return JSON.parse(body) } catch {
+    json(res, 400, { error: 'invalid json' })
+    return undefined
+  }
+}
+
+/**
+ * Management routes on dsh's webServer (loopback Host/Origin fence).
+ * @param {import('@deepseek-ai/cordis').Context} ctx
+ * @param {{
+ *   openPairing: (network?: string) => object,
+ *   closePairing?: () => object,
+ *   pairingStatus: (network?: string) => object,
+ *   getStatus: (network?: string) => object,
+ *   listDevices: () => object[],
+ *   revokeDevice: (id: string) => boolean,
+ *   renameDevice: (id: string, name: string) => boolean,
+ *   setTransport?: (mode: string) => object,
+ * }} api
+ */
+export function registerPairRoute(ctx, api) {
+  const gate = (req, res) => {
+    if (!isTrustedRequest(req)) { refuse(res); return false }
+    return true
+  }
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact', path: '/pocket/status',
+    handler: async (req, res) => {
+      if (!gate(req, res)) return
+      if (req.method === 'GET') return networkResponse(req, res, api.getStatus)
+      if (req.method === 'PATCH') {
+        const body = await readJson(req, res)
+        if (body === undefined) return
+        if (typeof body.transport !== 'string') return json(res, 400, { error: 'transport required' })
+        if (typeof api.setTransport !== 'function') return json(res, 405, { error: 'method not allowed' })
+        try {
+          api.setTransport(body.transport)
+          return networkResponse(req, res, api.getStatus)
+        } catch (e) {
+          return json(res, 400, { error: String(e?.message ?? e) })
+        }
+      }
+      return json(res, 405, { error: 'method not allowed' })
+    },
+  }))
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact', path: '/pocket/pair',
+    handler: (req, res) => {
+      if (!gate(req, res)) return
+      if (req.method === 'POST') return networkResponse(req, res, api.openPairing)
+      if (req.method === 'DELETE') return json(res, 200, (api.closePairing ?? (() => ({ open: false })))())
+      if (req.method === 'GET') return networkResponse(req, res, api.pairingStatus)
+      return json(res, 405, { error: 'method not allowed' })
+    },
+  }))
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact', path: '/pocket/devices',
+    handler: async (req, res) => {
+      if (!gate(req, res)) return
+      if (req.method === 'GET') return json(res, 200, { devices: api.listDevices() })
+      if (req.method === 'POST') {
+        const body = await readJson(req, res)
+        if (body === undefined) return
+        const id = body.id
+        if (typeof id !== 'string' || !id) return json(res, 400, { error: 'id required' })
+        return json(res, 200, { removed: api.revokeDevice(id), devices: api.listDevices() })
+      }
+      if (req.method === 'PATCH') {
+        const body = await readJson(req, res)
+        if (body === undefined) return
+        const id = body.id
+        const name = body.name
+        if (typeof id !== 'string' || !id) return json(res, 400, { error: 'id required' })
+        if (typeof name !== 'string' || !name.trim()) return json(res, 400, { error: 'name required' })
+        const renamed = api.renameDevice(id, name.trim())
+        if (!renamed) return json(res, 404, { error: 'not found' })
+        return json(res, 200, { renamed: true, devices: api.listDevices() })
+      }
+      return json(res, 405, { error: 'method not allowed' })
+    },
+  }))
+}
+
+/** @deprecated use isTrustedRequest — kept as alias for existing imports/tests */
+export const isLocalRequest = isTrustedRequest