@kinocode/dsh-mobile-bridge 0.0.0-stage → 0.3.2

package/lib/web-sessions.mjs

@@ -0,0 +1,113 @@
+// WebView sessions for the gateway: a signed cookie value bound to one registered device.
+// The value is base64url(`deviceId.expiresAt`) followed by a 43-character HMAC-SHA256 (key derived
+// from the host secret), only [A-Za-z0-9_-] as the app expects,
+// so sessions survive a DSH restart; a removed device's sessions stop working at once because
+// `isActive` consults the device registry and `revokeDevice` remembers it for this process.
+
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto'
+
+export const SESSION_TTL_MS = 12 * 60 * 60 * 1000
+export const SESSION_COOKIE = 'dshmb_session'
+const VALUE = /^([A-Za-z0-9_-]{4,120})([A-Za-z0-9_-]{43})$/
+const PAYLOAD = /^([A-Za-z0-9_-]{1,64})\.(\d{1,15})$/
+
+export class WebSessions {
+  /**
+   * @param {{now?: () => number, secret?: () => string, isActive?: (deviceId: string) => boolean}} [options]
+   *   secret - host secret the signing key is derived from (default: a random per-process key)
+   *   isActive - whether a device is still registered (default: always)
+   */
+  constructor(options = {}) {
+    this.now = options.now ?? Date.now
+    const fallback = randomBytes(32).toString('base64url')
+    this.secret = options.secret ?? (() => fallback)
+    this.isActive = options.isActive ?? (() => true)
+    /** devices removed while this process runs */
+    this.revoked = new Set()
+    /** deviceId -> sockets to close when the device is removed */
+    this.sockets = new Map()
+  }
+
+  /** @param {string} payload */
+  mac(payload) {
+    const key = createHash('sha256').update(`dshmb-web-session\n${this.secret()}`).digest()
+    return createHmac('sha256', key).update(payload).digest('base64url')
+  }
+
+  /**
+   * @param {string} deviceId
+   * @returns {{cookieName: string, value: string, expiresAt: number}}
+   */
+  create(deviceId) {
+    this.revoked.delete(deviceId)
+    const expiresAt = this.now() + SESSION_TTL_MS
+    const payload = `${deviceId}.${expiresAt}`
+    return { cookieName: SESSION_COOKIE, value: `${Buffer.from(payload).toString('base64url')}${this.mac(payload)}`, expiresAt }
+  }
+
+  /**
+   * Device id for a Cookie header, or undefined.
+   * @param {string|undefined} cookieHeader
+   */
+  check(cookieHeader) {
+    const value = readCookie(cookieHeader, SESSION_COOKIE)
+    const match = value === undefined ? null : VALUE.exec(value)
+    if (match === null) return undefined
+    const payload = Buffer.from(match[1], 'base64url').toString()
+    const parts = PAYLOAD.exec(payload)
+    if (parts === null) return undefined
+    const [, deviceId, expires] = parts
+    const mac = match[2]
+    const expected = Buffer.from(this.mac(payload))
+    const given = Buffer.from(mac)
+    if (given.length !== expected.length || !timingSafeEqual(given, expected)) return undefined
+    if (Number(expires) <= this.now()) return undefined
+    if (this.revoked.has(deviceId) || !this.isActive(deviceId)) return undefined
+    return deviceId
+  }
+
+  /**
+   * Track a proxied WebSocket so removing the device closes it.
+   * @param {string} deviceId
+   * @param {import('node:net').Socket} socket
+   */
+  track(deviceId, socket) {
+    let set = this.sockets.get(deviceId)
+    if (set === undefined) {
+      set = new Set()
+      this.sockets.set(deviceId, set)
+    }
+    set.add(socket)
+    socket.once('close', () => set.delete(socket))
+  }
+
+  /** End every session and socket of a device. @param {string} deviceId */
+  revokeDevice(deviceId) {
+    this.revoked.add(deviceId)
+    for (const socket of this.sockets.get(deviceId) ?? []) socket.destroy()
+    this.sockets.delete(deviceId)
+  }
+}
+
+/**
+ * @param {string|undefined} header
+ * @param {string} name
+ */
+export function readCookie(header, name) {
+  if (typeof header !== 'string') return undefined
+  for (const part of header.split(';')) {
+    const eq = part.indexOf('=')
+    if (eq > 0 && part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim()
+  }
+  return undefined
+}
+
+/**
+ * Cookie header without one cookie.
+ * @param {string|undefined} header
+ * @param {string} name
+ */
+export function withoutCookie(header, name) {
+  if (typeof header !== 'string') return ''
+  return header.split(';').map(p => p.trim()).filter(p => p !== '' && !p.startsWith(`${name}=`)).join('; ')
+}

package/lib/x509.mjs

@@ -0,0 +1,228 @@
+// Minimal X.509 v3 certificate builder for the gateway's private CA and server certificate.
+// Only what the gateway needs: EC P-256 keys, ECDSA-SHA256 signatures, basicConstraints,
+// keyUsage, extKeyUsage(serverAuth), subjectAltName (IP + DNS), subject/authority key ids.
+// Verified with node:crypto X509Certificate after creation.
+
+import { createHash, generateKeyPairSync, randomBytes, sign, X509Certificate } from 'node:crypto'
+import { isIP, isIPv4 } from 'node:net'
+
+// ---- DER primitives ---------------------------------------------------------------
+
+function length(n) {
+  if (n < 0x80) return Buffer.from([n])
+  const bytes = []
+  while (n > 0) {
+    bytes.unshift(n & 0xff)
+    n >>>= 8
+  }
+  return Buffer.from([0x80 | bytes.length, ...bytes])
+}
+
+function tlv(tag, content) {
+  const body = Buffer.isBuffer(content) ? content : Buffer.concat(content)
+  return Buffer.concat([Buffer.from([tag]), length(body.length), body])
+}
+
+const seq = (...items) => tlv(0x30, items)
+const set = (...items) => tlv(0x31, items)
+const octets = (buf) => tlv(0x04, buf)
+const bool = (value) => tlv(0x01, Buffer.from([value ? 0xff : 0x00]))
+const utf8 = (text) => tlv(0x0c, Buffer.from(text, 'utf8'))
+const ia5 = (text, tag = 0x16) => tlv(tag, Buffer.from(text, 'ascii'))
+const bitString = (buf, unusedBits = 0) => tlv(0x03, Buffer.concat([Buffer.from([unusedBits]), buf]))
+const explicit = (n, inner) => tlv(0xa0 | n, inner)
+
+function integer(buf) {
+  let bytes = Buffer.from(buf)
+  while (bytes.length > 1 && bytes[0] === 0 && (bytes[1] & 0x80) === 0) bytes = bytes.subarray(1)
+  if (bytes[0] & 0x80) bytes = Buffer.concat([Buffer.from([0]), bytes])
+  return tlv(0x02, bytes)
+}
+
+function oid(dotted) {
+  const parts = dotted.split('.').map(Number)
+  const out = [40 * parts[0] + parts[1]]
+  for (const part of parts.slice(2)) {
+    const stack = [part & 0x7f]
+    let value = part >>> 7
+    while (value > 0) {
+      stack.unshift((value & 0x7f) | 0x80)
+      value >>>= 7
+    }
+    out.push(...stack)
+  }
+  return tlv(0x06, Buffer.from(out))
+}
+
+function time(date) {
+  const iso = date.toISOString().replace(/[-:T]/g, '').slice(0, 14) // YYYYMMDDHHMMSS
+  return date.getUTCFullYear() < 2050 ? ia5(`${iso.slice(2)}Z`, 0x17) : ia5(`${iso}Z`, 0x18)
+}
+
+// ---- OIDs ---------------------------------------------------------------------------
+
+const OID = {
+  ecdsaWithSHA256: '1.2.840.10045.4.3.2',
+  commonName: '2.5.4.3',
+  organization: '2.5.4.10',
+  subjectKeyIdentifier: '2.5.29.14',
+  keyUsage: '2.5.29.15',
+  subjectAltName: '2.5.29.17',
+  basicConstraints: '2.5.29.19',
+  authorityKeyIdentifier: '2.5.29.35',
+  extKeyUsage: '2.5.29.37',
+  serverAuth: '1.3.6.1.5.5.7.3.1',
+}
+
+const signatureAlgorithm = () => seq(oid(OID.ecdsaWithSHA256))
+
+function name(commonName) {
+  return seq(
+    set(seq(oid(OID.organization), utf8('DSH Mobile'))),
+    set(seq(oid(OID.commonName), utf8(commonName))),
+  )
+}
+
+function extension(id, critical, valueDer) {
+  return critical ? seq(oid(id), bool(true), octets(valueDer)) : seq(oid(id), octets(valueDer))
+}
+
+/** keyUsage bits: digitalSignature=0, keyCertSign=5, cRLSign=6. */
+function keyUsage(bits) {
+  let byte = 0
+  for (const bit of bits) byte |= 0x80 >> bit
+  let unused = 0
+  while (unused < 7 && ((byte >> unused) & 1) === 0) unused += 1
+  return bitString(Buffer.from([byte]), unused)
+}
+
+function keyIdentifier(spkiDer) {
+  // RFC 5280 method 1: SHA-1 of the subjectPublicKey BIT STRING contents. For P-256 SPKI the
+  // uncompressed point is the last 65 bytes.
+  return createHash('sha1').update(spkiDer.subarray(spkiDer.length - 65)).digest()
+}
+
+function ipBytes(ip) {
+  if (isIPv4(ip)) return Buffer.from(ip.split('.').map(Number))
+  throw new Error(`unsupported IP SAN ${ip}`)
+}
+
+function serial() {
+  const bytes = randomBytes(16)
+  bytes[0] &= 0x7f
+  if (bytes[0] === 0) bytes[0] = 1
+  return bytes
+}
+
+/**
+ * @param {object} o
+ * @param {string} o.subjectCN
+ * @param {string} o.issuerCN
+ * @param {Buffer} o.subjectSpki - SPKI DER of the subject key
+ * @param {Buffer} o.issuerSpki - SPKI DER of the issuer key (for the authority key id)
+ * @param {import('node:crypto').KeyObject} o.issuerKey - private key that signs
+ * @param {Date} o.notBefore
+ * @param {Date} o.notAfter
+ * @param {Buffer[]} o.extensions
+ * @returns {Buffer} certificate DER
+ */
+function build(o) {
+  const tbs = seq(
+    explicit(0, integer(Buffer.from([2]))),
+    integer(serial()),
+    signatureAlgorithm(),
+    name(o.issuerCN),
+    seq(time(o.notBefore), time(o.notAfter)),
+    name(o.subjectCN),
+    o.subjectSpki,
+    explicit(3, seq(...o.extensions)),
+  )
+  const signature = sign('sha256', tbs, { key: o.issuerKey, dsaEncoding: 'der' })
+  return seq(tbs, signatureAlgorithm(), bitString(signature))
+}
+
+const DAY = 24 * 60 * 60 * 1000
+
+/**
+ * Create a self-signed EC P-256 CA.
+ * @param {{commonName?: string, days?: number, now?: Date}} [options]
+ * @returns {{certDer: Buffer, certPem: string, keyPem: string, fingerprint: string}}
+ */
+export function createCa(options = {}) {
+  const now = options.now ?? new Date()
+  const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' })
+  const spki = publicKey.export({ format: 'der', type: 'spki' })
+  const cn = options.commonName ?? 'DSH Mobile Gateway CA'
+  const certDer = build({
+    subjectCN: cn,
+    issuerCN: cn,
+    subjectSpki: spki,
+    issuerSpki: spki,
+    issuerKey: privateKey,
+    notBefore: new Date(now.getTime() - DAY),
+    notAfter: new Date(now.getTime() + (options.days ?? 3650) * DAY),
+    extensions: [
+      extension(OID.basicConstraints, true, seq(bool(true), integer(Buffer.from([0])))),
+      extension(OID.keyUsage, true, keyUsage([5, 6])),
+      extension(OID.subjectKeyIdentifier, false, octets(keyIdentifier(spki))),
+    ],
+  })
+  const cert = new X509Certificate(certDer)
+  if (!cert.ca || !cert.verify(publicKey)) throw new Error('generated CA failed verification')
+  return { certDer, certPem: toPem(certDer), keyPem: privateKey.export({ format: 'pem', type: 'pkcs8' }), fingerprint: fingerprintOf(certDer) }
+}
+
+/**
+ * Issue a server certificate signed by the CA.
+ * @param {object} o
+ * @param {string} o.caCertPem
+ * @param {import('node:crypto').KeyObject} o.caKey
+ * @param {string[]} o.ips - IPv4 addresses for IP SANs
+ * @param {string[]} o.dnsNames
+ * @param {number} [o.days]
+ * @param {Date} [o.now]
+ * @returns {{certPem: string, keyPem: string}}
+ */
+export function issueServerCertificate(o) {
+  const now = o.now ?? new Date()
+  const ca = new X509Certificate(o.caCertPem)
+  const caSpki = ca.publicKey.export({ format: 'der', type: 'spki' })
+  const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' })
+  const spki = publicKey.export({ format: 'der', type: 'spki' })
+  const ips = [...new Set(o.ips.filter(ip => isIP(ip) === 4))]
+  const dnsNames = [...new Set(o.dnsNames.filter(n => /^[A-Za-z0-9.-]{1,253}$/.test(n)))]
+  if (ips.length + dnsNames.length === 0) throw new Error('server certificate needs at least one SAN')
+  const sans = [...ips.map(ip => tlv(0x87, ipBytes(ip))), ...dnsNames.map(n => ia5(n, 0x82))]
+  const certDer = build({
+    subjectCN: ips[0] ?? dnsNames[0],
+    issuerCN: ca.subject.split('\n').find(l => l.startsWith('CN='))?.slice(3) ?? 'DSH Mobile Gateway CA',
+    subjectSpki: spki,
+    issuerSpki: caSpki,
+    issuerKey: o.caKey,
+    notBefore: new Date(now.getTime() - DAY),
+    notAfter: new Date(now.getTime() + (o.days ?? 397) * DAY),
+    extensions: [
+      extension(OID.basicConstraints, true, seq()),
+      extension(OID.keyUsage, true, keyUsage([0])),
+      extension(OID.extKeyUsage, false, seq(oid(OID.serverAuth))),
+      extension(OID.subjectAltName, false, seq(...sans)),
+      extension(OID.subjectKeyIdentifier, false, octets(keyIdentifier(spki))),
+      extension(OID.authorityKeyIdentifier, false, seq(tlv(0x80, keyIdentifier(caSpki)))),
+    ],
+  })
+  const cert = new X509Certificate(certDer)
+  if (!cert.verify(ca.publicKey) || cert.ca) throw new Error('generated server certificate failed verification')
+  for (const ip of ips) if (cert.checkIP(ip) === undefined) throw new Error(`server certificate missing IP SAN ${ip}`)
+  return { certPem: toPem(certDer), keyPem: privateKey.export({ format: 'pem', type: 'pkcs8' }) }
+}
+
+/** @param {Buffer} der */
+export function fingerprintOf(der) {
+  return createHash('sha256').update(der).digest('hex')
+}
+
+/** @param {Buffer} der */
+export function toPem(der) {
+  const b64 = der.toString('base64').match(/.{1,64}/g).join('\n')
+  return `-----BEGIN CERTIFICATE-----\n${b64}\n-----END CERTIFICATE-----\n`
+}

package/package.json

@@ -1,6 +1,65 @@
 {
   "name": "@kinocode/dsh-mobile-bridge",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.2",
+  "description": "DeepSeek Harness host plugin for the DSH Mobile Android app: pair with a QR, use DSH on the phone through its own HTTPS gateway, answer approvals and questions from notifications, push turn completion.",
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "plugin",
+    "mobile",
+    "android",
+    "push-notifications",
+    "approval",
+    "relay"
+  ],
+  "author": "kinocode",
+  "homepage": "https://www.npmjs.com/package/@kinocode/dsh-mobile-bridge",
+  "type": "module",
+  "main": "lib/index.mjs",
+  "exports": {
+    ".": "./lib/index.mjs",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "cordis.patch.yml",
+    "lib/**/*.mjs",
+    "lib/client.js",
+    "lib/vendor/*.mjs"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-workspace",
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ],
+      "platform": "web"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.4"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=22.4",
+    "dsh": ">=0.2.1-rc.2 <0.3.0"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}