@kinocode/dsh-mobile-bridge 0.0.0-stage → 0.3.2

package/lib/sessions.mjs

@@ -0,0 +1,131 @@
+// Small in-memory view of live sessions built from `session/event`:
+// titles, recent tool-call arguments (approval requests carry only callId), last assistant text.
+
+const MAX_SESSIONS = 100
+const MAX_CALLS_PER_SESSION = 64
+const MAX_ARGUMENT_CHARS = 8000
+
+/**
+ * @typedef {object} SessionInfo
+ * @property {string} title
+ * @property {Map<string, {name: string, arguments: string}>} calls
+ * @property {string} lastAssistantText
+ * @property {number} touchedAt
+ */
+
+export class SessionTracker {
+  /**
+   * @param {{onTurnEnd?: (sessionId: string, reason: string) => void, now?: () => number}} hooks
+   */
+  constructor(hooks = {}) {
+    this.hooks = hooks
+    this.now = hooks.now ?? Date.now
+    /** @type {Map<string, SessionInfo>} */
+    this.sessions = new Map()
+  }
+
+  /** @param {string} sessionId */
+  info(sessionId) {
+    let info = this.sessions.get(sessionId)
+    if (info === undefined) {
+      info = { title: '', calls: new Map(), lastAssistantText: '', touchedAt: this.now() }
+      this.sessions.set(sessionId, info)
+      if (this.sessions.size > MAX_SESSIONS) {
+        const oldest = [...this.sessions.entries()].sort((a, b) => a[1].touchedAt - b[1].touchedAt)[0]
+        if (oldest !== undefined) this.sessions.delete(oldest[0])
+      }
+    }
+    info.touchedAt = this.now()
+    return info
+  }
+
+  /** @param {string} sessionId */
+  title(sessionId) { return this.sessions.get(sessionId)?.title ?? '' }
+
+  /**
+   * Fill titles from Session Controller summaries (`projections.values.title.title`), so sessions
+   * titled before this plugin started still get a name. Live `session/title` events stay authoritative.
+   * @param {Array<{sessionId: string, projections?: {values?: Record<string, any>}}>} summaries
+   */
+  learnTitles(summaries) {
+    for (const summary of summaries) {
+      const title = summaryTitle(summary)
+      if (title === '' || typeof summary.sessionId !== 'string') continue
+      const known = this.sessions.get(summary.sessionId)
+      if (known !== undefined && known.title !== '') continue
+      this.info(summary.sessionId).title = title
+    }
+  }
+
+  /**
+   * @param {string} sessionId
+   * @param {string|undefined} callId
+   */
+  call(sessionId, callId) {
+    if (callId === undefined) return undefined
+    return this.sessions.get(sessionId)?.calls.get(callId)
+  }
+
+  /** @param {string} sessionId */
+  lastAssistantText(sessionId) { return this.sessions.get(sessionId)?.lastAssistantText ?? '' }
+
+  /**
+   * Consume one `session/event`.
+   * @param {{id: string}} session
+   * @param {{type: string, data?: any}} event
+   */
+  observe(session, event) {
+    const sessionId = session?.id
+    if (typeof sessionId !== 'string' || event === null || typeof event !== 'object') return
+    const data = event.data ?? {}
+    switch (event.type) {
+      case 'session/title':
+        if (typeof data.title === 'string') this.info(sessionId).title = data.title.slice(0, 200)
+        return
+      case 'tool/call': {
+        if (typeof data.callId !== 'string') return
+        const calls = this.info(sessionId).calls
+        calls.set(data.callId, {
+          name: typeof data.name === 'string' ? data.name : '',
+          arguments: typeof data.arguments === 'string' ? data.arguments.slice(0, MAX_ARGUMENT_CHARS) : '',
+        })
+        while (calls.size > MAX_CALLS_PER_SESSION) calls.delete(calls.keys().next().value)
+        return
+      }
+      case 'assistant/message': {
+        const text = textOf(data.message)
+        if (text !== '') this.info(sessionId).lastAssistantText = text.slice(-2000)
+        return
+      }
+      case 'turn/end': {
+        const reason = typeof data.reason?.kind === 'string' ? data.reason.kind : 'completed'
+        if (reason === 'forked') return
+        this.hooks.onTurnEnd?.(sessionId, reason)
+        return
+      }
+      default:
+    }
+  }
+}
+
+/**
+ * Title carried by a Session Controller summary, or ''.
+ * @param {{projections?: {values?: Record<string, any>}}} summary
+ */
+export function summaryTitle(summary) {
+  const value = summary?.projections?.values?.title
+  const title = typeof value === 'string' ? value : value?.title
+  return typeof title === 'string' ? title.slice(0, 200) : ''
+}
+
+/** Join the text parts of an assistant message. */
+function textOf(message) {
+  const content = message?.content
+  if (typeof content === 'string') return content.trim()
+  if (!Array.isArray(content)) return ''
+  return content
+    .filter(part => part !== null && typeof part === 'object' && part.type === 'text' && typeof part.text === 'string')
+    .map(part => part.text)
+    .join('\n')
+    .trim()
+}

package/lib/state.mjs

@@ -0,0 +1,187 @@
+// Durable plugin state: host identity and registered devices (one JSON file, mode 0600).
+
+import { randomBytes, randomUUID } from 'node:crypto'
+import { mkdir, readFile, rename, writeFile, chmod } from 'node:fs/promises'
+import { join } from 'node:path'
+
+export const MAX_DEVICES = 16
+export const MAX_WATCHES_PER_DEVICE = 50
+
+/**
+ * @typedef {object} DeviceRecord
+ * @property {string} publicKey - SPKI DER base64url
+ * @property {string} label
+ * @property {string|null} fcmToken
+ * @property {'redacted'|'full'} previewMode
+ * @property {boolean} pushEnabled
+ * @property {boolean} watchAll
+ * @property {Record<string, number>} watches - sessionId -> expiry (epoch ms)
+ * @property {number} createdAt
+ * @property {number} lastSeenAt
+ */
+
+/** Owns the state file; writes are serialized and atomic (tmp + rename). */
+export class StateStore {
+  /**
+   * @param {string} dir
+   * @param {{now?: () => number, log?: (...args: unknown[]) => void}} [options]
+   */
+  constructor(dir, options = {}) {
+    this.dir = dir
+    this.file = join(dir, 'state.json')
+    this.now = options.now ?? Date.now
+    this.log = options.log ?? (() => {})
+    /** @type {{version: 1, hostId: string, hostSecret: string, devices: Record<string, DeviceRecord>}} */
+    this.data = { version: 1, hostId: '', hostSecret: '', devices: {} }
+    this.writing = Promise.resolve()
+    this.dirty = false
+    this.timer = undefined
+  }
+
+  async load() {
+    await mkdir(this.dir, { recursive: true, mode: 0o700 })
+    try {
+      const parsed = JSON.parse(await readFile(this.file, 'utf8'))
+      if (parsed?.version !== 1 || typeof parsed.hostId !== 'string' || typeof parsed.hostSecret !== 'string') {
+        throw new Error('unsupported state file')
+      }
+      this.data = { version: 1, hostId: parsed.hostId, hostSecret: parsed.hostSecret, devices: sanitizeDevices(parsed.devices) }
+    } catch (error) {
+      if (error?.code !== 'ENOENT') {
+        // A corrupt file must not silently re-key the host: keep a copy and start fresh loudly.
+        this.log('state file unreadable; starting a new host identity:', error?.message ?? String(error))
+        try {
+          await rename(this.file, `${this.file}.corrupt-${this.now()}`)
+        } catch { /* best effort: the original may already be gone */ }
+      }
+      this.data = { version: 1, hostId: randomUUID(), hostSecret: randomBytes(32).toString('base64url'), devices: {} }
+      await this.flush()
+    }
+    return this
+  }
+
+  get hostId() { return this.data.hostId }
+  get hostSecret() { return this.data.hostSecret }
+
+  /** @returns {Array<[string, DeviceRecord]>} */
+  devices() { return Object.entries(this.data.devices) }
+
+  /** @param {string} id */
+  device(id) { return Object.hasOwn(this.data.devices, id) ? this.data.devices[id] : undefined }
+
+  /**
+   * Add a device; an older registration with the same device key (re-pairing) is replaced.
+   * @param {Omit<DeviceRecord, 'watches'|'createdAt'|'lastSeenAt'|'pushEnabled'|'watchAll'>} input
+   * @returns {string} new device id
+   */
+  addDevice(input) {
+    for (const [id, record] of this.devices()) if (record.publicKey === input.publicKey) delete this.data.devices[id]
+    const entries = this.devices().sort((a, b) => a[1].lastSeenAt - b[1].lastSeenAt)
+    while (entries.length >= MAX_DEVICES) delete this.data.devices[entries.shift()[0]]
+    const id = randomBytes(16).toString('hex')
+    const now = this.now()
+    this.data.devices[id] = { ...input, pushEnabled: true, watchAll: false, watches: {}, createdAt: now, lastSeenAt: now }
+    this.save(true)
+    return id
+  }
+
+  /** @param {string} id */
+  removeDevice(id) {
+    if (!Object.hasOwn(this.data.devices, id)) return false
+    delete this.data.devices[id]
+    this.save(true)
+    return true
+  }
+
+  /**
+   * @param {string} id
+   * @param {(record: DeviceRecord) => void} mutate
+   * @param {boolean} [urgent]
+   */
+  updateDevice(id, mutate, urgent = false) {
+    const record = this.device(id)
+    if (record === undefined) return false
+    mutate(record)
+    this.save(urgent)
+    return true
+  }
+
+  /**
+   * Devices that should hear about a session right now.
+   * @param {string} sessionId
+   * @returns {Array<[string, DeviceRecord]>}
+   */
+  watchers(sessionId) {
+    const now = this.now()
+    return this.devices().filter(([, record]) => record.pushEnabled && record.fcmToken
+      && (record.watchAll || (record.watches[sessionId] ?? 0) > now))
+  }
+
+  /** Schedule a write; urgent writes go out immediately, others are coalesced for 2 s. */
+  save(urgent = false) {
+    this.dirty = true
+    if (urgent) {
+      clearTimeout(this.timer)
+      this.timer = undefined
+      void this.flush()
+      return
+    }
+    if (this.timer === undefined) {
+      this.timer = setTimeout(() => {
+        this.timer = undefined
+        void this.flush()
+      }, 2000)
+      this.timer.unref?.()
+    }
+  }
+
+  flush() {
+    this.writing = this.writing.then(async () => {
+      this.dirty = false
+      const tmp = `${this.file}.tmp-${process.pid}`
+      await writeFile(tmp, `${JSON.stringify(this.data, null, 2)}\n`, { mode: 0o600 })
+      await chmod(tmp, 0o600)
+      await rename(tmp, this.file)
+    }).catch((error) => {
+      this.log('state write failed:', error?.message ?? String(error))
+    })
+    return this.writing
+  }
+
+  async close() {
+    clearTimeout(this.timer)
+    this.timer = undefined
+    if (this.dirty) await this.flush()
+    await this.writing
+  }
+}
+
+/** Keep only well-formed device records from disk. */
+function sanitizeDevices(value) {
+  /** @type {Record<string, DeviceRecord>} */
+  const out = {}
+  if (value === null || typeof value !== 'object') return out
+  for (const [id, record] of Object.entries(value)) {
+    if (!/^[a-f0-9]{32}$/.test(id) || record === null || typeof record !== 'object') continue
+    // v1 records were bound to a dsh-mobile device (mobileDeviceId); they cannot be trusted any more.
+    if (typeof record.publicKey !== 'string' || record.mobileDeviceId !== undefined) continue
+    const watches = {}
+    if (record.watches !== null && typeof record.watches === 'object') {
+      for (const [sessionId, expiry] of Object.entries(record.watches)) {
+        if (typeof expiry === 'number' && sessionId.length <= 200) watches[sessionId] = expiry
+      }
+    }
+    out[id] = {
+      publicKey: record.publicKey,
+      label: typeof record.label === 'string' ? record.label.slice(0, 80) : '',
+      fcmToken: typeof record.fcmToken === 'string' ? record.fcmToken : null,
+      previewMode: record.previewMode === 'full' ? 'full' : 'redacted',
+      pushEnabled: record.pushEnabled !== false,
+      watchAll: record.watchAll === true,
+      watches,
+      createdAt: typeof record.createdAt === 'number' ? record.createdAt : 0,
+      lastSeenAt: typeof record.lastSeenAt === 'number' ? record.lastSeenAt : 0,
+    }
+  }
+  return out
+}

package/lib/tls-store.mjs

@@ -0,0 +1,107 @@
+// Gateway TLS material: one private CA (kept for years, pinned by phones) and a server
+// certificate reissued whenever the set of listening addresses changes.
+
+import { createPrivateKey, X509Certificate } from 'node:crypto'
+import { hostname, networkInterfaces } from 'node:os'
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { createCa, fingerprintOf, issueServerCertificate } from './x509.mjs'
+
+const RENEW_BEFORE_MS = 30 * 24 * 60 * 60 * 1000
+
+/**
+ * Private IPv4 addresses a phone can reach: RFC 1918 LAN ranges and 100.64/10 (Tailscale CGNAT).
+ * LAN addresses come first so QR origins try the local network before Tailscale.
+ * @param {ReturnType<typeof networkInterfaces>} [table]
+ * @returns {string[]}
+ */
+export function reachableAddresses(table = networkInterfaces()) {
+  const lan = []
+  const tailnet = []
+  for (const entries of Object.values(table)) {
+    for (const entry of entries ?? []) {
+      if (entry.family !== 'IPv4' && entry.family !== 4) continue
+      if (entry.internal) continue
+      const [a, b] = entry.address.split('.').map(Number)
+      if (a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168)) lan.push(entry.address)
+      else if (a === 100 && b >= 64 && b <= 127) tailnet.push(entry.address)
+    }
+  }
+  return [...new Set([...lan, ...tailnet])]
+}
+
+/** DNS names to put in the server certificate (helps `.local` and Tailscale MagicDNS users). */
+export function localDnsNames(name = hostname()) {
+  const short = name.replace(/\.(local|lan|home)$/i, '')
+  return [...new Set([short, `${short}.local`].filter(n => /^[A-Za-z0-9-]{1,63}(\.local)?$/.test(n)))]
+}
+
+export class TlsStore {
+  /**
+   * @param {string} dir - stateDir/tls
+   * @param {{log?: (...a: unknown[]) => void, now?: () => number}} [options]
+   */
+  constructor(dir, options = {}) {
+    this.dir = dir
+    this.log = options.log ?? (() => {})
+    this.now = options.now ?? Date.now
+    this.ca = undefined
+    this.server = undefined
+  }
+
+  /** Load or create the CA. */
+  async loadCa() {
+    await mkdir(this.dir, { recursive: true, mode: 0o700 })
+    try {
+      const certPem = await readFile(join(this.dir, 'ca.pem'), 'utf8')
+      const keyPem = await readFile(join(this.dir, 'ca-key.pem'), 'utf8')
+      const cert = new X509Certificate(certPem)
+      if (!cert.ca || new Date(cert.validTo).getTime() <= this.now()) throw new Error('CA expired or invalid')
+      this.ca = { certPem, key: createPrivateKey(keyPem), der: cert.raw, fingerprint: fingerprintOf(cert.raw) }
+    } catch (error) {
+      if (error?.code !== 'ENOENT') this.log('gateway CA unusable; creating a new one (phones must pair again):', error?.message ?? String(error))
+      const ca = createCa({ now: new Date(this.now()) })
+      await this.write('ca-key.pem', ca.keyPem, 0o600)
+      await this.write('ca.pem', ca.certPem, 0o644)
+      this.ca = { certPem: ca.certPem, key: createPrivateKey(ca.keyPem), der: ca.certDer, fingerprint: ca.fingerprint }
+    }
+    return this.ca
+  }
+
+  /**
+   * Server certificate covering exactly these addresses (reused while it still matches).
+   * @param {string[]} ips
+   * @returns {Promise<{certPem: string, keyPem: string}>}
+   */
+  async serverFor(ips) {
+    if (this.ca === undefined) await this.loadCa()
+    const key = [...ips].sort().join(',')
+    if (this.server?.key === key && this.server.notAfter - this.now() > RENEW_BEFORE_MS) return this.server
+    try {
+      const certPem = await readFile(join(this.dir, 'server.pem'), 'utf8')
+      const keyPem = await readFile(join(this.dir, 'server-key.pem'), 'utf8')
+      const cert = new X509Certificate(certPem)
+      const notAfter = new Date(cert.validTo).getTime()
+      const covers = ips.every(ip => cert.checkIP(ip) !== undefined) && cert.verify(new X509Certificate(this.ca.certPem).publicKey)
+      const sameSet = (cert.subjectAltName ?? '').split(', ').filter(s => s.startsWith('IP Address:')).length === ips.length
+      if (covers && sameSet && notAfter - this.now() > RENEW_BEFORE_MS) {
+        this.server = { key, certPem, keyPem, notAfter }
+        return this.server
+      }
+    } catch { /* missing or stale: issue below */ }
+    const issued = issueServerCertificate({ caCertPem: this.ca.certPem, caKey: this.ca.key, ips, dnsNames: localDnsNames(), now: new Date(this.now()) })
+    await this.write('server-key.pem', issued.keyPem, 0o600)
+    await this.write('server.pem', issued.certPem, 0o644)
+    this.server = { key, ...issued, notAfter: new Date(new X509Certificate(issued.certPem).validTo).getTime() }
+    this.log('gateway certificate issued', JSON.stringify({ ips }))
+    return this.server
+  }
+
+  async write(name, content, mode) {
+    const path = join(this.dir, name)
+    const tmp = `${path}.tmp-${process.pid}`
+    await writeFile(tmp, content, { mode })
+    await chmod(tmp, mode)
+    await rename(tmp, path)
+  }
+}

package/lib/upstream.mjs

@@ -0,0 +1,61 @@
+// Authenticated access to the local DSH Web server for the gateway.
+// DSH's browser login is `/?token=<launch token>` → signed host-bound cookie. The gateway does
+// that once (server side) and attaches the cookie to proxied requests; phones never see it.
+
+import { request } from 'node:http'
+
+export class Upstream {
+  /**
+   * @param {object} deps
+   * @param {() => number|undefined} deps.port - DSH webServer port (127.0.0.1)
+   * @param {(baseUrl: string) => string} deps.authenticatedUrl - ctx.connection.authenticatedUrl
+   * @param {(...a: unknown[]) => void} deps.log
+   */
+  constructor(deps) {
+    this.deps = deps
+    /** @type {{port: number, cookie: string} | undefined} */
+    this.cached = undefined
+    this.pending = undefined
+  }
+
+  invalidate() { this.cached = undefined }
+
+  /** @returns {Promise<{port: number, cookie: string} | undefined>} */
+  async target() {
+    const port = this.deps.port()
+    if (port === undefined || port === 0) return undefined
+    if (this.cached?.port === port) return this.cached
+    this.pending ??= this.login(port).finally(() => { this.pending = undefined })
+    return this.pending
+  }
+
+  /** @param {number} port */
+  async login(port) {
+    let url
+    try {
+      url = new URL(this.deps.authenticatedUrl(`http://127.0.0.1:${port}/`))
+    } catch (error) {
+      this.deps.log('gateway: cannot build DSH login URL:', error?.message ?? String(error))
+      return undefined
+    }
+    const cookie = await new Promise((resolve) => {
+      const req = request({ host: '127.0.0.1', port, method: 'GET', path: `${url.pathname}${url.search}`, headers: { host: `127.0.0.1:${port}`, accept: 'text/html' } }, (res) => {
+        res.resume()
+        const setCookie = res.headers['set-cookie'] ?? []
+        resolve(setCookie.map(line => line.split(';')[0].trim()).filter(Boolean).join('; '))
+      })
+      req.on('error', (error) => {
+        this.deps.log('gateway: DSH login failed:', error?.code ?? error?.message)
+        resolve('')
+      })
+      req.setTimeout(10_000, () => req.destroy(new Error('timeout')))
+      req.end()
+    })
+    if (cookie === '') {
+      this.deps.log('gateway: DSH login returned no cookie')
+      return undefined
+    }
+    this.cached = { port, cookie }
+    return this.cached
+  }
+}