@sksoftofficial/ocduet 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sksoftofficial/ocduet",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Duet for opencode: pair your phone with a local opencode TUI. Type on mobile, see it live on both screens. LAN-first, QR pairing, zero config.",
   "type": "module",
   "bin": {

package/src/commands/install.js

@@ -88,11 +88,40 @@ function unitFlag(argv, name) {
   return i !== -1 && argv[i + 1] ? argv[i + 1] : null;
 }
 
+const SYS_UNIT_PATH = "/etc/systemd/system/ocduet-relayer.service";
+
+function shellQuote(a) {
+  return /^[\w\/.:=-]+$/.test(a) ? a : JSON.stringify(a);
+}
+
+function unitText(entry, root, dir, serveArgs, system) {
+  return [
+    "[Unit]",
+    "Description=ocduet relayer — public tunnel for the ocduet daemon",
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    `WorkingDirectory=${root}`,
+    `ExecStart=${[process.execPath, ...serveArgs].map(shellQuote).join(" ")}`,
+    `Environment=OCDUET_RELAYER_DIR=${dir}`,
+    "Restart=always",
+    "RestartSec=3",
+    "",
+    "[Install]",
+    `WantedBy=${system ? "multi-user.target" : "default.target"}`,
+    "",
+  ].join("\n");
+}
+
 // `ocduet install relayer` — set the relayer up as a boot-persistent service
-// on a public box. systemd user unit when available (enable-linger keeps it
-// alive without a login session), detached process + pid file otherwise.
+// on a public box, no manual steps. Prefers a system systemd unit (the usual
+// VPS case: root over ssh, or passwordless sudo), then a systemd user unit
+// (enable-linger keeps it alive without a login session), and finally a
+// detached process + pid file.
 export async function installRelayer(argv = []) {
   const root = pkgRoot();
+  const entry = path.join(root, "bin/ocduet.js");
   const dir = relayerDir();
   const port = unitFlag(argv, "--port") || process.env.OCDUET_RELAYER_PORT || "4290";
   const cert = unitFlag(argv, "--cert");
@@ -100,44 +129,55 @@ export async function installRelayer(argv = []) {
   fs.mkdirSync(dir, { recursive: true });
 
   // make sure the store (and the enroll secret) exists before we print it
-  const secret = spawnSync(process.execPath, [path.join(root, "bin/ocduet.js"), "relay", "secret"], { encoding: "utf8", env: { ...process.env, OCDUET_RELAYER_DIR: dir } });
+  const secret = spawnSync(process.execPath, [entry, "relay", "secret"], { encoding: "utf8", env: { ...process.env, OCDUET_RELAYER_DIR: dir } });
   const enroll = (secret.stdout || "").trim() || "(unknown — run `ocduet relayer secret`)";
 
-  const serveArgs = ["ocduet.js", "relayer", "serve", "--port", port];
+  const serveArgs = [entry, "relay", "serve", "--port", port];
   if (cert && key) serveArgs.push("--cert", cert, "--key", key);
 
+  const hasSystemd = fs.existsSync("/run/systemd/system");
+  const euid = typeof process.geteuid === "function" ? process.geteuid() : -1;
+  const canSudo = () => spawnSync("sudo", ["-n", "true"]).status === 0;
+
   let managedBy = null;
-  const unitDir = path.join(os.homedir(), ".config/systemd/user");
-  const unitPath = path.join(unitDir, "ocduet-relayer.service");
-  try {
-    fs.mkdirSync(unitDir, { recursive: true });
-    fs.writeFileSync(unitPath, [
-      "[Unit]",
-      "Description=ocduet relayer — public tunnel for the ocduet daemon",
-      "After=network-online.target",
-      "Wants=network-online.target",
-      "",
-      "[Service]",
-      `WorkingDirectory=${root}`,
-      `ExecStart=${process.execPath} ${serveArgs.map((a) => a.includes(" ") ? JSON.stringify(a) : a).join(" ")}`,
-      "Environment=OCDUET_RELAYER_DIR=" + dir,
-      "Restart=always",
-      "RestartSec=3",
-      "",
-      "[Install]",
-      "WantedBy=default.target",
-      "",
-    ].join("\n"));
-    const ctl = spawnSync("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
-    if (ctl.status === 0) {
-      spawnSync("systemctl", ["--user", "enable", "--now", "ocduet-relayer.service"], { encoding: "utf8" });
-      managedBy = "systemd --user";
+  if (hasSystemd && (euid === 0 || canSudo())) {
+    // root, or passwordless sudo: real system unit — starts now, survives reboots
+    const unit = unitText(entry, root, dir, serveArgs, true);
+    const wrote = euid === 0
+      ? (() => { try { fs.writeFileSync(SYS_UNIT_PATH, unit); return true; } catch { return false; } })()
+      : spawnSync("sudo", ["-n", "tee", SYS_UNIT_PATH], { input: unit, encoding: "utf8" }).status === 0;
+    const sys = (args) => euid === 0
+      ? spawnSync("systemctl", args, { encoding: "utf8" })
+      : spawnSync("sudo", ["-n", "systemctl", ...args], { encoding: "utf8" });
+    if (wrote && sys(["daemon-reload"]).status === 0) {
+      sys(["enable", "--now", "ocduet-relayer.service"]);
+      sys(["restart", "ocduet-relayer.service"]); // pick up unit changes on re-install
+      if (sys(["is-active", "--quiet", "ocduet-relayer.service"]).status === 0) {
+        managedBy = `systemd system unit (${SYS_UNIT_PATH})`;
+      }
     }
-  } catch {}
+  }
+
+  if (!managedBy) {
+    const unitDir = path.join(os.homedir(), ".config/systemd/user");
+    const unitPath = path.join(unitDir, "ocduet-relayer.service");
+    try {
+      fs.mkdirSync(unitDir, { recursive: true });
+      fs.writeFileSync(unitPath, unitText(entry, root, dir, serveArgs, false));
+      const ctl = spawnSync("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
+      if (ctl.status === 0) {
+        spawnSync("systemctl", ["--user", "enable", "--now", "ocduet-relayer.service"], { encoding: "utf8" });
+        spawnSync("systemctl", ["--user", "restart", "ocduet-relayer.service"], { encoding: "utf8" });
+        if (spawnSync("systemctl", ["--user", "is-active", "--quiet", "ocduet-relayer.service"], { encoding: "utf8" }).status === 0) {
+          managedBy = "systemd --user";
+        }
+      }
+    } catch {}
+  }
 
   if (!managedBy) {
     const log = fs.openSync(path.join(dir, "relayer.log"), "a", 0o600);
-    const child = spawn(process.execPath, [path.join(root, "bin/ocduet.js"), ...serveArgs], {
+    const child = spawn(process.execPath, serveArgs, {
       env: { ...process.env, OCDUET_RELAYER_DIR: dir },
       detached: true,
       stdio: ["ignore", log, log],
@@ -161,7 +201,10 @@ export async function installRelayer(argv = []) {
   console.log("on your DESKTOP, link it:");
   console.log(`  ocduet relay link https://${host}:${port} ${enroll}`);
   if (ips.length > 1) console.log(`  (this box has multiple IPs: ${ips.join(", ")} — use the public one)`);
-  if (managedBy.startsWith("systemd")) {
+  if (managedBy.startsWith("systemd system")) {
+    console.log("");
+    console.log("logs: journalctl -u ocduet-relayer -f");
+  } else if (managedBy === "systemd --user") {
     console.log("");
     console.log("to survive reboots without a login session, run once (may need root):");
     console.log(`  sudo loginctl enable-linger $USER`);

package/src/commands/relay.js

@@ -40,7 +40,9 @@ function registerOnce(url, desktopId, pubB64, sign, secret, certPem) {
   return new Promise((resolve, reject) => {
     const wsUrl = new URL("/desktop", url);
     wsUrl.protocol = wsUrl.protocol === "http:" ? "ws:" : "wss:";
-    const tlsOpts = certPem ? { ca: certPem } : { rejectUnauthorized: false };
+    // pinned cert = the identity itself; hostname/SAN matching would always
+    // fail for a bare-IP relayer with a self-signed cert
+    const tlsOpts = certPem ? { ca: certPem, checkServerIdentity: () => undefined } : { rejectUnauthorized: false };
     const ws = new WebSocket(wsUrl, { ...tlsOpts, handshakeTimeout: 10_000 });
     const fail = (why) => { try { ws.close(); } catch {} reject(new Error(why)); };
     const timer = setTimeout(() => fail("register timeout"), 12_000);

package/src/relay-client.js

@@ -33,7 +33,9 @@ export function readRelayConfig() {
 // auth still comes from the ed25519 register signature — the pin kills
 // silent MITM even without a domain.
 export function relayTlsOpts(cfg) {
-  return cfg?.certPem ? { ca: cfg.certPem } : { rejectUnauthorized: false };
+  // when pinned, the exact cert IS the identity — skip hostname/SAN matching,
+  // which can never pass for a bare-IP host anyway
+  return cfg?.certPem ? { ca: cfg.certPem, checkServerIdentity: () => undefined } : { rejectUnauthorized: false };
 }
 
 const state = { linked: false, connected: false, url: null, desktopId: null, since: null, lastError: null, reconnects: 0 };

package/src/relayer.js

@@ -75,11 +75,17 @@ function ensureCert() {
     return { cert: fs.readFileSync(certP), key: fs.readFileSync(keyP) };
   }
   fs.mkdirSync(relayerDir(), { recursive: true });
+  // cover every address the box might be reached on — desktops link by bare IP
+  const ips = [];
+  for (const addrs of Object.values(os.networkInterfaces())) {
+    for (const a of addrs || []) if (a.family === "IPv4" && !a.internal) ips.push(a.address);
+  }
+  const san = ["DNS:localhost", "IP:127.0.0.1", ...ips.map((ip) => `IP:${ip}`)];
   const out = spawnSync("openssl", [
     "req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:prime256v1",
     "-keyout", keyP, "-out", certP, "-days", "3650", "-nodes",
     "-subj", "/CN=ocduet-relayer",
-    "-addext", "subjectAltName=DNS:localhost,IP:127.0.0.1",
+    "-addext", `subjectAltName=${san.join(",")}`,
   ], { stdio: "ignore" });
   if (out.status !== 0) throw new Error("openssl cert generation failed — is openssl installed?");
   try { fs.chmodSync(keyP, 0o600); } catch {}