@livedesk/client 0.1.130 → 0.1.132

package/bin/livedesk-client-node.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 import net from 'net';
 import os from 'os';
@@ -197,7 +197,7 @@ function parseArgs(argv) {
     return result;
 }
 
-function parseManagerAddress(value) {
+function parseManagerAddress(value) {
     let text = String(value || DEFAULT_MANAGER).trim();
     text = text.replace(/^tcp:\/\//i, '');
     const separator = text.lastIndexOf(':');
@@ -210,11 +210,25 @@ function parseManagerAddress(value) {
 
     const host = text.slice(0, separator).trim() || '127.0.0.1';
     const port = Number(text.slice(separator + 1));
-    return {
-        host,
-        port: Number.isFinite(port) ? port : 5197
-    };
-}
+    return {
+        host,
+        port: Number.isFinite(port) ? port : 5197
+    };
+}
+
+function isPrivateLanHost(host) {
+    const value = String(host || '').trim().toLowerCase().replace(/^\[|\]$/g, '');
+    if (!value || value === 'localhost' || value === '::1') return true;
+    if (net.isIPv4(value)) {
+        const octets = value.split('.').map(Number);
+        return octets[0] === 10
+            || (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31)
+            || (octets[0] === 192 && octets[1] === 168)
+            || octets[0] === 127;
+    }
+    if (net.isIPv6(value)) return value.startsWith('fc') || value.startsWith('fd') || value.startsWith('fe80:');
+    return false;
+}
 
 function normalizeDeviceId(value) {
     return String(value || '').trim().replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
@@ -1267,10 +1281,27 @@ function normalizeNodeAgentTaskResult(result) {
 }
 
 const NODE_AGENT_OPERATIONS = new Set(['process.control', 'service.control', 'application.launch', 'application.close', 'file.read', 'file.write', 'file.delete', 'file.list', 'command.run', 'script.run', 'software.install', 'network.status', 'system.power', 'system.configure', 'logs.collect']);
-
-async function handleRemoteCommand(socket, options, message, nextFrameSeq, activeStreams) {
+
+function remotePolicyAllows(options, command) {
+    const policy = options.effectivePolicy;
+    if (!policy || typeof policy !== 'object') return { ok: true };
+    if (policy.accessMode === 'block-remote-access') return { ok: false, error: 'remote-access-blocked-by-settings' };
+    const required = command === 'input.control'
+        ? ['allowControl']
+        : command.startsWith('file.transfer')
+            ? ['allowFileTransfer']
+            : command === 'audio.start'
+                ? ['allowRemoteAudio']
+                : command === 'agent.task' || NODE_AGENT_OPERATIONS.has(command)
+                    ? ['allowAgent']
+                    : [];
+    const denied = required.find(key => policy[key] === false);
+    return denied ? { ok: false, error: `${denied}-blocked-by-settings` } : { ok: true };
+}
+
+async function handleRemoteCommand(socket, options, message, nextFrameSeq, activeStreams) {
     const command = String(message.command || '');
-    if (command === 'ping') {
+    if (command === 'ping') {
         writeJsonLine(socket, {
             type: 'command.result',
             commandId: message.commandId,
@@ -1279,8 +1310,19 @@ async function handleRemoteCommand(socket, options, message, nextFrameSeq, activ
                 at: new Date().toISOString()
             }
         });
-        return;
-    }
+        return;
+    }
+
+    const policyDecision = remotePolicyAllows(options, command);
+    if (!policyDecision.ok) {
+        writeJsonLine(socket, {
+            type: 'command.result',
+            commandId: message.commandId,
+            error: policyDecision.error,
+            result: { ok: false, status: 'failed', error: policyDecision.error }
+        });
+        return;
+    }
 
     if (NODE_AGENT_OPERATIONS.has(command)) {
         if (!options.taskEnabled) {
@@ -1544,9 +1586,12 @@ async function handleRemoteCommand(socket, options, message, nextFrameSeq, activ
     });
 }
 
-function connectOnce(options, deviceId) {
-    const manager = parseManagerAddress(options.manager);
-    return new Promise((resolve, reject) => {
+function connectOnce(options, deviceId) {
+    const manager = parseManagerAddress(options.manager);
+    if (!isPrivateLanHost(manager.host) && !isTruthy(process.env.LIVEDESK_ALLOW_UNENCRYPTED_LAN)) {
+        return Promise.reject(new Error('Plain TCP LiveDesk connections are limited to loopback/private LAN. Use an encrypted endpoint for external connections.'));
+    }
+    return new Promise((resolve, reject) => {
         const socket = net.createConnection({
             host: manager.host,
             port: manager.port
@@ -1636,9 +1681,12 @@ function connectOnce(options, deviceId) {
                     continue;
                 }
 
-                const message = JSON.parse(line);
-                if (message.type === 'welcome') {
-                    console.log(`Connected to LiveDesk Hub as ${options.name} (${deviceId})`);
+                const message = JSON.parse(line);
+                if (message.type === 'welcome') {
+                    options.effectivePolicy = message.effectivePolicy && typeof message.effectivePolicy === 'object'
+                        ? message.effectivePolicy
+                        : null;
+                    console.log(`Connected to LiveDesk Hub as ${options.name} (${deviceId})`);
                     writeJsonLine(socket, {
                         type: 'status',
                         status: getStatus(options)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.130",
+  "version": "0.1.132",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {