@livedesk/client 0.1.234 → 0.1.236

package/src/runtime/fast-runtime-repair.js

@@ -1,300 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  statSync,
-  writeFileSync
-} from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-
-const DEFAULT_TIMEOUT_MS = 120_000;
-const LOCK_POLL_MS = 200;
-const LOCK_STALE_MS = 10 * 60_000;
-const MAX_OUTPUT_CHARS = 64 * 1024;
-
-const PLATFORM_SPECS = Object.freeze({
-  'win32:x64': Object.freeze({
-    packageName: '@livedesk/fast-win-x64',
-    rid: 'win-x64',
-    executableName: 'livedesk-client-fast.exe'
-  }),
-  'linux:x64': Object.freeze({
-    packageName: '@livedesk/fast-linux-x64',
-    rid: 'linux-x64',
-    executableName: 'livedesk-client-fast'
-  }),
-  'darwin:x64': Object.freeze({
-    packageName: '@livedesk/fast-osx-x64',
-    rid: 'osx-x64',
-    executableName: 'livedesk-client-fast'
-  }),
-  'darwin:arm64': Object.freeze({
-    packageName: '@livedesk/fast-osx-arm64',
-    rid: 'osx-arm64',
-    executableName: 'livedesk-client-fast'
-  })
-});
-
-function exactVersion(value) {
-  const version = String(value || '').trim();
-  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)
-    ? version
-    : '';
-}
-
-function boundedText(previous, chunk) {
-  const next = `${previous}${String(chunk || '')}`;
-  return next.length <= MAX_OUTPUT_CHARS ? next : next.slice(next.length - MAX_OUTPUT_CHARS);
-}
-
-function delay(milliseconds) {
-  return new Promise(resolveDelay => setTimeout(resolveDelay, milliseconds));
-}
-
-function packageDirectory(installRoot, packageName) {
-  return join(installRoot, 'node_modules', ...String(packageName).split('/'));
-}
-
-function safeSegment(value) {
-  return String(value || '').replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 160) || 'unknown';
-}
-
-function readJson(filePath) {
-  try {
-    return JSON.parse(readFileSync(filePath, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-function isPidAlive(value) {
-  const pid = Number(value);
-  if (!Number.isInteger(pid) || pid <= 1) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error?.code === 'EPERM';
-  }
-}
-
-function reclaimStaleLock(lockPath) {
-  try {
-    const owner = readJson(join(lockPath, 'owner.json'));
-    const ageMs = Math.max(0, Date.now() - Number(statSync(lockPath).mtimeMs || 0));
-    const ownerAlive = isPidAlive(owner?.pid);
-    if ((owner?.pid && !ownerAlive && ageMs >= 1_000) || ageMs >= LOCK_STALE_MS) {
-      rmSync(lockPath, { recursive: true, force: true });
-      return true;
-    }
-  } catch {
-    // A concurrent owner may be creating or removing the lock.
-  }
-  return false;
-}
-
-export function resolveFastPlatformSpec({
-  platform = process.platform,
-  arch = process.arch,
-  manifest = null
-} = {}) {
-  const base = PLATFORM_SPECS[`${platform}:${arch}`];
-  if (!base) return null;
-  const version = exactVersion(manifest?.optionalDependencies?.[base.packageName]);
-  if (!version) return null;
-  return Object.freeze({ ...base, version });
-}
-
-export function inspectFastRuntimePackage(packageRoot, spec) {
-  if (!packageRoot || !spec) return null;
-  const manifest = readJson(join(packageRoot, 'package.json'));
-  if (manifest?.name !== spec.packageName || manifest?.version !== spec.version) return null;
-  if (Array.isArray(manifest.os) && !manifest.os.includes(process.platform)) return null;
-  if (Array.isArray(manifest.cpu) && !manifest.cpu.includes(process.arch)) return null;
-  const fastRoot = join(packageRoot, 'fast');
-  const executable = join(fastRoot, spec.executableName);
-  const dll = join(fastRoot, 'livedesk-client-fast.dll');
-  if (!existsSync(executable) && !existsSync(dll)) return null;
-  return Object.freeze({
-    rid: spec.rid,
-    packageName: spec.packageName,
-    packageVersion: spec.version,
-    packageRoot,
-    executable,
-    dll
-  });
-}
-
-export function repairedFastInstallRoot(stateDir, spec) {
-  return join(
-    resolve(stateDir),
-    'runtime-packages',
-    `${safeSegment(spec.packageName)}-${safeSegment(spec.version)}`
-  );
-}
-
-export function inspectRepairedFastRuntime(stateDir, spec) {
-  const installRoot = repairedFastInstallRoot(stateDir, spec);
-  return inspectFastRuntimePackage(packageDirectory(installRoot, spec.packageName), spec);
-}
-
-function resolveNpmInvocation({ nodeExecutable, npmExecPath, npmExecutable }) {
-  const exactNode = resolve(String(nodeExecutable || process.execPath));
-  const cli = String(npmExecPath || '').trim();
-  const cliCandidates = cli
-    ? (/npx-cli\.js$/i.test(cli) ? [join(dirname(cli), 'npm-cli.js')] : [cli])
-    : [];
-  const npmCli = cliCandidates.find(candidate => existsSync(candidate));
-  if (npmCli) {
-    return { command: exactNode, argsPrefix: [resolve(npmCli)] };
-  }
-  const executable = String(npmExecutable || '').trim();
-  if (executable) return { command: executable, argsPrefix: [] };
-  const nodeDir = dirname(exactNode);
-  const candidates = process.platform === 'win32'
-    ? [join(nodeDir, 'npm.cmd'), join(nodeDir, 'npm.exe')]
-    : [join(nodeDir, 'npm')];
-  const fallback = candidates.find(existsSync);
-  return fallback ? { command: fallback, argsPrefix: [] } : null;
-}
-
-function runInstall({ invocation, installRoot, spec, timeoutMs, env }) {
-  return new Promise((resolveInstall, rejectInstall) => {
-    const args = [
-      ...invocation.argsPrefix,
-      'install',
-      '--ignore-scripts',
-      '--no-audit',
-      '--no-fund',
-      '--package-lock=false',
-      '--save=false',
-      '--omit=dev',
-      '--prefix', installRoot,
-      `${spec.packageName}@${spec.version}`
-    ];
-    const child = spawn(invocation.command, args, {
-      env: {
-        ...env,
-        npm_config_audit: 'false',
-        npm_config_fund: 'false',
-        npm_config_ignore_scripts: 'true',
-        npm_config_package_lock: 'false'
-      },
-      windowsHide: true,
-      stdio: ['ignore', 'pipe', 'pipe']
-    });
-    let stdout = '';
-    let stderr = '';
-    let settled = false;
-    let timer = null;
-    const finish = (error, result = null) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      if (error) rejectInstall(error);
-      else resolveInstall(result);
-    };
-    child.stdout?.on('data', chunk => { stdout = boundedText(stdout, chunk); });
-    child.stderr?.on('data', chunk => { stderr = boundedText(stderr, chunk); });
-    child.once('error', error => finish(error));
-    child.once('exit', (code, signal) => finish(null, {
-      code: Number.isInteger(code) ? code : 1,
-      signal: String(signal || ''),
-      stdout,
-      stderr
-    }));
-    timer = setTimeout(() => {
-      try { child.kill('SIGKILL'); } catch { }
-      finish(new Error(`remote-fast-repair-timeout:${timeoutMs}`));
-    }, timeoutMs);
-    timer.unref?.();
-  });
-}
-
-export async function ensureRepairedFastRuntime({
-  stateDir,
-  spec,
-  nodeExecutable = process.execPath,
-  npmExecPath = process.env.npm_execpath || process.env.NPM_EXECPATH,
-  npmExecutable = process.env.LIVEDESK_NPM_EXECUTABLE,
-  timeoutMs = DEFAULT_TIMEOUT_MS,
-  env = process.env,
-  installRunner = runInstall
-} = {}) {
-  if (!stateDir || !spec) throw new Error('remote-fast-repair-plan-required');
-  const alreadyRepaired = inspectRepairedFastRuntime(stateDir, spec);
-  if (alreadyRepaired) return alreadyRepaired;
-
-  const installRoot = repairedFastInstallRoot(stateDir, spec);
-  mkdirSync(dirname(installRoot), { recursive: true });
-  const lockPath = `${installRoot}.lock`;
-  const deadline = Date.now() + Math.max(10_000, Math.min(300_000, Number(timeoutMs) || DEFAULT_TIMEOUT_MS));
-  let ownsLock = false;
-  while (!ownsLock && Date.now() < deadline) {
-    try {
-      mkdirSync(lockPath, { recursive: false });
-      writeFileSync(join(lockPath, 'owner.json'), JSON.stringify({
-        pid: process.pid,
-        createdAt: new Date().toISOString(),
-        packageName: spec.packageName,
-        version: spec.version
-      }), { encoding: 'utf8', mode: 0o600 });
-      ownsLock = true;
-    } catch {
-      const concurrent = inspectRepairedFastRuntime(stateDir, spec);
-      if (concurrent) return concurrent;
-      if (!reclaimStaleLock(lockPath)) await delay(LOCK_POLL_MS);
-    }
-  }
-  if (!ownsLock) throw new Error('remote-fast-repair-lock-timeout');
-
-  const temporaryRoot = `${installRoot}.tmp-${process.pid}-${randomBytes(6).toString('hex')}`;
-  try {
-    const afterLock = inspectRepairedFastRuntime(stateDir, spec);
-    if (afterLock) return afterLock;
-    rmSync(temporaryRoot, { recursive: true, force: true });
-    mkdirSync(temporaryRoot, { recursive: true });
-    writeFileSync(join(temporaryRoot, 'package.json'), JSON.stringify({
-      private: true,
-      name: 'livedesk-fast-runtime-repair',
-      version: '0.0.0'
-    }), { encoding: 'utf8', mode: 0o600 });
-
-    const invocation = resolveNpmInvocation({ nodeExecutable, npmExecPath, npmExecutable });
-    if (!invocation && installRunner === runInstall) throw new Error('remote-fast-repair-npm-unavailable');
-    const remainingMs = Math.max(1_000, deadline - Date.now());
-    const result = await installRunner({
-      invocation,
-      installRoot: temporaryRoot,
-      spec,
-      timeoutMs: remainingMs,
-      env
-    });
-    if (result?.code !== 0) {
-      const detail = String(result?.stderr || result?.stdout || `exit-${result?.code ?? 'unknown'}`)
-        .replace(/\s+/g, ' ')
-        .trim()
-        .slice(0, 600);
-      throw new Error(`remote-fast-repair-install-failed:${detail || 'unknown'}`);
-    }
-    const temporaryRuntime = inspectFastRuntimePackage(
-      packageDirectory(temporaryRoot, spec.packageName),
-      spec
-    );
-    if (!temporaryRuntime) throw new Error('remote-fast-repair-package-invalid');
-
-    rmSync(installRoot, { recursive: true, force: true });
-    mkdirSync(dirname(installRoot), { recursive: true });
-    renameSync(temporaryRoot, installRoot);
-    const committed = inspectRepairedFastRuntime(stateDir, spec);
-    if (!committed) throw new Error('remote-fast-repair-commit-invalid');
-    return committed;
-  } finally {
-    rmSync(temporaryRoot, { recursive: true, force: true });
-    rmSync(lockPath, { recursive: true, force: true });
-  }
-}

package/src/security/device-credential-store.js

@@ -1,219 +0,0 @@
-import crypto from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { decodeCanonicalBase64Url } from '@livedesk/runtime-core';
-import { createOsSecretStore, OS_SECRET_REFERENCE } from '@livedesk/runtime-core/os-secret-store';
-
-const STORE_VERSION = 1;
-
-function credentialError(code) {
-  const error = new Error(code);
-  error.code = code;
-  return error;
-}
-
-function clean(value, maximum = 512) {
-  return String(value || '').replace(/[\0\r\n]/g, '').trim().slice(0, maximum);
-}
-
-function credentialRoot() {
-  const configured = clean(process.env.LIVEDESK_CLIENT_CREDENTIAL_ROOT, 4096);
-  return configured ? path.resolve(configured) : path.join(os.homedir(), '.livedesk-client');
-}
-
-function defaultCredentialPath(deviceId) {
-  const deviceHash = crypto.createHash('sha256').update(String(deviceId), 'utf8').digest('hex');
-  return path.join(credentialRoot(), 'security', 'device-credentials', `${deviceHash}.json`);
-}
-
-function legacyCredentialPath() {
-  return path.join(credentialRoot(), 'device-credential-v1.json');
-}
-
-function atomicPrivateJson(filePath, value) {
-  mkdirSync(path.dirname(filePath), { recursive: true });
-  const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-  renameSync(temporary, filePath);
-}
-
-function loadJson(filePath) {
-  try {
-    const value = JSON.parse(readFileSync(filePath, 'utf8'));
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-
-function requirePrivateKey(value) {
-  const der = decodeCanonicalBase64Url(value, 100, 512);
-  let key;
-  try {
-    key = crypto.createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-  } catch {
-    throw credentialError('device-private-key-invalid');
-  }
-  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
-    throw credentialError('device-private-key-invalid');
-  }
-  return key;
-}
-
-function parseCredential(credential) {
-  const text = String(credential || '');
-  const parts = text.split('.');
-  if (parts.length !== 2 || text.length > 8192) throw credentialError('device-credential-invalid');
-  const payloadBytes = decodeCanonicalBase64Url(parts[0], 32, 4096);
-  const signature = decodeCanonicalBase64Url(parts[1], 64, 64);
-  let payload;
-  try {
-    payload = JSON.parse(payloadBytes.toString('utf8'));
-  } catch {
-    throw credentialError('device-credential-invalid');
-  }
-  if (!payload || Number(payload.version) !== 1) throw credentialError('device-credential-invalid');
-  const hubPublicDer = decodeCanonicalBase64Url(payload.hubPublicKey, 80, 160);
-  let hubPublicKey;
-  try {
-    hubPublicKey = crypto.createPublicKey({ key: hubPublicDer, format: 'der', type: 'spki' });
-  } catch {
-    throw credentialError('device-credential-invalid');
-  }
-  if (hubPublicKey.asymmetricKeyType !== 'ec'
-    || hubPublicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1'
-    || !crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), { key: hubPublicKey, dsaEncoding: 'ieee-p1363' }, signature)) {
-    throw credentialError('device-credential-signature-invalid');
-  }
-  const normalized = {
-    serial: clean(payload.serial, 128),
-    accountId: clean(payload.accountId, 128),
-    hubId: clean(payload.hubId, 128),
-    deviceId: clean(payload.deviceId, 128),
-    devicePublicKey: clean(payload.devicePublicKey, 512),
-    hubPublicKey: hubPublicDer.toString('base64url'),
-    issuedAt: Number(payload.issuedAt),
-    expiresAt: Number(payload.expiresAt)
-  };
-  if (!normalized.serial || !normalized.accountId || !normalized.hubId || !normalized.deviceId
-    || !Number.isSafeInteger(normalized.issuedAt) || !Number.isSafeInteger(normalized.expiresAt)
-    || normalized.expiresAt <= Date.now()) {
-    throw credentialError('device-credential-expired');
-  }
-  return { text, payloadText: parts[0], payload: normalized, hubPublicKey };
-}
-
-export function createClientDeviceCredentialStore({
-  filePath = String(process.env.LIVEDESK_DEVICE_CREDENTIAL_PATH || '').trim(),
-  deviceId
-} = {}) {
-  const normalizedDeviceId = clean(deviceId, 128);
-  if (!normalizedDeviceId) throw credentialError('device-id-required');
-  const configuredPath = clean(filePath, 4096);
-  const resolvedFilePath = configuredPath
-    ? path.resolve(configuredPath)
-    : defaultCredentialPath(normalizedDeviceId);
-  const privateKeyStore = createOsSecretStore({
-    service: 'LiveDesk',
-    account: `client-device-private-key:${normalizedDeviceId}`,
-    dataDir: path.dirname(resolvedFilePath)
-  });
-  let state = loadJson(resolvedFilePath);
-  let migratedLegacy = false;
-  if (!state && !configuredPath && !existsSync(resolvedFilePath)) {
-    const legacyState = loadJson(legacyCredentialPath());
-    if (Number(legacyState?.version) === STORE_VERSION && legacyState?.deviceId === normalizedDeviceId) {
-      state = legacyState;
-      migratedLegacy = true;
-    }
-  }
-  let privateKey;
-  let publicKey;
-  if (state) {
-    if (Number(state.version) !== STORE_VERSION || state.deviceId !== normalizedDeviceId) throw credentialError('device-key-state-invalid');
-    const plaintextPrivateKey = clean(state.privateKey, 1024);
-    if (plaintextPrivateKey) {
-      if (!privateKeyStore.write(plaintextPrivateKey)) throw credentialError('device-private-key-migration-failed');
-      state = { ...state, privateKeyRef: OS_SECRET_REFERENCE, updatedAt: new Date().toISOString() };
-      delete state.privateKey;
-      atomicPrivateJson(resolvedFilePath, state);
-    }
-    if (state.privateKeyRef !== OS_SECRET_REFERENCE) throw credentialError('device-private-key-reference-invalid');
-    const privateKeyText = privateKeyStore.read();
-    if (!privateKeyText) throw credentialError('device-private-key-secure-store-unavailable');
-    privateKey = requirePrivateKey(privateKeyText);
-    publicKey = crypto.createPublicKey(privateKey);
-    const publicText = publicKey.export({ format: 'der', type: 'spki' }).toString('base64url');
-    if (publicText !== state.publicKey) throw credentialError('device-key-mismatch');
-    if (migratedLegacy) {
-      atomicPrivateJson(resolvedFilePath, state);
-      try { rmSync(legacyCredentialPath(), { force: true }); } catch {}
-    }
-  } else {
-    const generated = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
-    privateKey = generated.privateKey;
-    publicKey = generated.publicKey;
-    const privateKeyText = privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64url');
-    if (!privateKeyStore.write(privateKeyText)) throw credentialError('device-private-key-secure-store-unavailable');
-    state = {
-      version: STORE_VERSION,
-      deviceId: normalizedDeviceId,
-      publicKey: publicKey.export({ format: 'der', type: 'spki' }).toString('base64url'),
-      privateKeyRef: OS_SECRET_REFERENCE,
-      credential: '',
-      createdAt: new Date().toISOString(),
-      updatedAt: new Date().toISOString()
-    };
-    atomicPrivateJson(resolvedFilePath, state);
-  }
-
-  function saveCredential(credential) {
-    const parsed = parseCredential(credential);
-    if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) {
-      throw credentialError('device-credential-binding-invalid');
-    }
-    state.credential = parsed.text;
-    state.accountId = parsed.payload.accountId;
-    state.hubId = parsed.payload.hubId;
-    state.updatedAt = new Date().toISOString();
-    atomicPrivateJson(resolvedFilePath, state);
-    return parsed;
-  }
-
-  function readCredential() {
-    if (!state.credential) return null;
-    try {
-      const parsed = parseCredential(state.credential);
-      if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) return null;
-      return parsed;
-    } catch {
-      return null;
-    }
-  }
-
-  function clearCredential() {
-    state.credential = '';
-    state.accountId = '';
-    state.hubId = '';
-    state.updatedAt = new Date().toISOString();
-    atomicPrivateJson(resolvedFilePath, state);
-  }
-
-  return Object.freeze({
-    filePath: resolvedFilePath,
-    deviceId: normalizedDeviceId,
-    publicKey: state.publicKey,
-    privateKey,
-    sign(message) {
-      return crypto.sign('sha256', Buffer.from(String(message || ''), 'utf8'), {
-        key: privateKey,
-        dsaEncoding: 'ieee-p1363'
-      }).toString('base64url');
-    },
-    readCredential,
-    saveCredential,
-    clearCredential,
-    parseCredential
-  });
-}