@twinsearth/w2m-dsh-plugin 0.4.9 → 0.5.1

package/deploy/networking/wireguard/server-setup.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# ============================================================================
+#  WireGuard hub for a W2M fleet -- rung 4 of the ladder in ../README.md
+# ============================================================================
+#
+#  WHAT THIS IS FOR, AND WHAT IT IS NOT
+#
+#  It makes every machine reachable by a stable address (10.66.0.x) no matter what its NAT does,
+#  encrypted, with no third-party coordination service. That is rung 4.
+#
+#  It is NOT a direct path between two machines behind NAT. WireGuard has no NAT traversal: with
+#  both machines as peers of this hub, their traffic to each other is forwarded through this VPS.
+#  Direct paths are rungs 2 and 3 of the ladder -- the simultaneous punch and the reverse dial --
+#  which live in the plugin, not here. Stated plainly because a tunnel that reports `p2p` in the
+#  ledger while the bytes cross a server is exactly the kind of thing that misleads an operator.
+#
+#  RUN IT ON THE ALWAYS-ON HOST (the shared server), as root, once:
+#
+#    bash server-setup.sh                 # keys are generated if absent, config is rewritten, wg0 up
+#    bash server-setup.sh --client mac    # print one client config to paste into the WireGuard app
+#
+#  Idempotent: re-running keeps existing keys (so paired clients keep working) and only rewrites the
+#  hub config and its peers.
+# ============================================================================
+set -euo pipefail
+
+HUB_ADDRESS="${HUB_ADDRESS:-10.66.0.1/24}"
+LISTEN_PORT="${LISTEN_PORT:-51820}"
+KEYS=/etc/wireguard/keys
+WG=/etc/wireguard/wg0.conf
+# Client name -> tunnel address. Add a line here to add a machine.
+CLIENTS=("win-desktop:10.66.0.2" "macmini:10.66.0.3")
+
+# 51820 is WireGuard's default and the fleet's own punch port is deliberately somewhere else
+# (41235 on this fleet) so the two never contend.
+if [ "$(id -u)" != "0" ]; then echo "run as root (this writes /etc/wireguard and edits the firewall)" >&2; exit 1; fi
+
+export DEBIAN_FRONTEND=noninteractive
+command -v wg >/dev/null 2>&1 || { apt-get update -qq; apt-get install -y -qq wireguard wireguard-tools >/dev/null; }
+
+umask 077
+mkdir -p "$KEYS"
+[ -f "$KEYS/server.key" ] || wg genkey > "$KEYS/server.key"
+wg pubkey < "$KEYS/server.key" > "$KEYS/server.pub"
+for entry in "${CLIENTS[@]}"; do
+  name="${entry%%:*}"
+  [ -f "$KEYS/$name.key" ] || wg genkey > "$KEYS/$name.key"
+  wg pubkey < "$KEYS/$name.key" > "$KEYS/$name.pub"
+done
+
+# Print one client's config and exit -- the only thing a client needs from this host.
+if [ "${1:-}" = "--client" ]; then
+  name="${2:-}"
+  address=""
+  for entry in "${CLIENTS[@]}"; do [ "${entry%%:*}" = "$name" ] && address="${entry##*:}"; done
+  [ -n "$address" ] || { echo "unknown client '$name'; known: ${CLIENTS[*]%%:*}" >&2; exit 1; }
+  endpoint="${ENDPOINT:-$(curl -fsS -m 8 https://api.ipify.org)}"
+  cat <<EOF
+[Interface]
+# $name -- rung 4 of the W2M delivery ladder (see deploy/networking/README.md)
+PrivateKey = $(cat "$KEYS/$name.key")
+Address = $address/24
+# No DNS line on purpose: only $HUB_ADDRESS is routed, so your resolver stays untouched.
+
+[Peer]
+PublicKey = $(cat "$KEYS/server.pub")
+Endpoint = $endpoint:$LISTEN_PORT
+AllowedIPs = $(echo "$HUB_ADDRESS" | cut -d/ -f1 | awk -F. '{print $1"."$2"."$3".0/24"}')
+PersistentKeepalive = 25
+EOF
+  exit 0
+fi
+
+{
+  echo "# W2M rung 4: a private hub so the fleet is reachable whatever the NATs do."
+  echo "# Traffic between clients is forwarded here -- WireGuard does not punch. See README.md."
+  echo "[Interface]"
+  echo "Address = $HUB_ADDRESS"
+  echo "ListenPort = $LISTEN_PORT"
+  echo "PrivateKey = $(cat "$KEYS/server.key")"
+  echo "# No PostUp MASQUERADE: clients route only the tunnel subnet here, so nothing needs NATing"
+  echo "# and none of their other traffic can leak through this host."
+  echo "SaveConfig = false"
+  echo
+  for entry in "${CLIENTS[@]}"; do
+    name="${entry%%:*}"; address="${entry##*:}"
+    echo "[Peer]"
+    echo "# $name"
+    echo "PublicKey = $(cat "$KEYS/$name.pub")"
+    echo "AllowedIPs = $address/32"
+    echo
+  done
+} > "$WG"
+chmod 600 "$WG"
+
+sysctl -qw net.ipv4.ip_forward=1
+grep -q '^net.ipv4.ip_forward=1' /etc/sysctl.conf || echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
+command -v ufw >/dev/null 2>&1 && ufw allow "$LISTEN_PORT/udp" >/dev/null || true
+
+systemctl enable wg-quick@wg0 >/dev/null 2>&1 || true
+systemctl restart wg-quick@wg0
+sleep 2
+systemctl is-active wg-quick@wg0
+wg show
+echo
+echo "client configs: bash $0 --client <name>   (known: ${CLIENTS[*]%%:*})"

package/deploy/windows/install-service.ps1

@@ -56,6 +56,7 @@ param(
   [string]$Bin = '',
   [string]$AgentArgs = '',
   [int]$RestartBackoffMs = 60000,
+  [int]$WatchdogMinutes = 5,
   [switch]$Interactive,
   [switch]$Uninstall,
   [switch]$WhatIfOnly
@@ -133,11 +134,34 @@ $json = $config | ConvertTo-Json -Depth 4
 Write-Host "wrote $configPath"
 
 $action = New-ScheduledTaskAction -Execute $node -Argument ($arguments -join ' ') -WorkingDirectory $PSScriptRoot
+# ---------------------------------------------------------------------------------------------
+# SELF-HEALING WITHOUT ELEVATION
+#
+# Measured twice on this machine: the whole process tree (supervisor + agent) is killed with
+# 0xC000013A (STATUS_CONTROL_C_EXIT -- its console went away), the log ends mid-sentence, and Task
+# Scheduler does NOT bring it back even with RestartCount 999: the task simply ends. The fleet then
+# silently loses the machine, which is exactly the failure a supervisor was supposed to prevent --
+# a supervisor that shares the console dies with it.
+#
+# A repeating trigger fixes that without any administrator right: combined with
+# `MultipleInstances IgnoreNew` the task means "be running, or start", so a death from any cause is
+# repaired at the next tick. The window is the repetition interval, and that is the honest trade:
+# up to N minutes offline after a console-close death, versus needing elevation for a session-0
+# service (the real fix, and the default mode above).
+# ---------------------------------------------------------------------------------------------
+$repetition = if ($Interactive) {
+  # `[TimeSpan]::MaxValue` is NOT a valid duration here -- Task Scheduler rejects it and the whole
+  # registration fails (measured: the script had already stopped the old task, so the machine was
+  # left with no agent at all). Ten years is the idiomatic stand-in for "repeat indefinitely".
+  New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) `
+    -RepetitionInterval (New-TimeSpan -Minutes $WatchdogMinutes) `
+    -RepetitionDuration ([TimeSpan]::FromDays(3650))
+} else { $null }
 # AtStartup only makes sense for the session-0 (S4U) shape, which also runs whether or not anyone is
 # signed in. Registering an AtStartup trigger on an interactive task is refused without elevation --
 # measured, and the reason this list is conditional rather than always two entries.
 $triggers = if ($Interactive) {
-  @(New-ScheduledTaskTrigger -AtLogOn -User "$env:USERDOMAIN\$env:USERNAME")
+  @((New-ScheduledTaskTrigger -AtLogOn -User "$env:USERDOMAIN\$env:USERNAME"), $repetition)
 } else {
   @(
     (New-ScheduledTaskTrigger -AtStartup),

package/deploy/windows/w2m-agent-supervisor.mjs

@@ -35,7 +35,7 @@
 //
 // Nothing here is Windows-specific except the defaults; the same supervisor works on POSIX hosts.
 import { spawn } from 'node:child_process';
-import { createWriteStream, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { createWriteStream, existsSync, mkdirSync, openSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 /** Minimal `--flag value` / `--flag` parser: no dependency, no surprises. */
@@ -149,6 +149,9 @@ if (!existsSync(bin)) {
 
 mkdirSync(dirname(logPath), { recursive: true });
 const log = createWriteStream(logPath, { flags: 'a' });
+// A second handle on the same file, as a descriptor: this is what the detached agent writes into,
+// because a descriptor is not connected to this process's console or to any pipe of ours.
+const logFd = openSync(logPath, 'a');
 const stamp = () => new Date().toISOString();
 const say = (line) => {
   console.log(line);
@@ -177,14 +180,33 @@ let runs = 0;
 while (!stopping) {
   runs += 1;
   const startedAt = Date.now();
-  const child = spawn(process.execPath, argv, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
-  child.stdout.on('data', (chunk) => {
-    process.stdout.write(chunk);
-    log.write(chunk);
-  });
-  child.stderr.on('data', (chunk) => {
-    process.stderr.write(chunk);
-    log.write(chunk);
+  // ---------------------------------------------------------------------------------------------
+  // THE AGENT MUST NOT SHARE THIS PROCESS'S CONSOLE.
+  //
+  // Measured twice on the fleet: the whole tree -- supervisor and agent together -- is killed with
+  // 0xC000013A (STATUS_CONTROL_C_EXIT, "the console went away"), the log ends mid-sentence, and
+  // nothing restarts it. A supervisor that shares the console dies with the thing it supervises,
+  // which was its one job. A study of v2rayN (GPL-3.0, read-only; see deploy/networking/LESSONS.md)
+  // turned up why its core cannot die this way: it is started with no console window and redirected
+  // stdio at all.
+  //
+  // `detached: true` plus stdio that is NOT connected to this process is the documented way to make
+  // a long-running child independent of its parent's console: with `detached`, a long-running child
+  // "will not stay running in the background after the parent exits unless it is provided with a
+  // `stdio` configuration that is not connected to the parent". So the agent gets file descriptors --
+  // never `inherit`, never pipes -- and that is the whole of the console-severing change.
+  //
+  // NOT `child.unref()`. It was the obvious-looking addition and it is wrong here: unref'ing the
+  // child leaves this process with no handle at all, so its event loop drains and **the supervisor
+  // exits immediately after spawning the agent** -- measured, and caught by noticing that no
+  // supervisor process existed at all. `unref()` is for a parent that intends to leave; this one
+  // exists to stay. Pipes would be the other trap: a detached child writing into a pipe whose reader
+  // has died blocks instead of failing loudly, which is why the log is a descriptor.
+  // ---------------------------------------------------------------------------------------------
+  const child = spawn(process.execPath, argv, {
+    detached: true,
+    stdio: ['ignore', logFd, logFd],
+    windowsHide: true,
   });
 
   const result = await new Promise((resolve) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/w2m-dsh-plugin",
-  "version": "0.4.9",
+  "version": "0.5.1",
   "description": "DSH: Windows2MacOS — drive the same project on online Windows and macOS machines from one DeepSeek account, across networks and regions. P2P hole punching is the default path (relay + shared server as rendezvous, ledger and fallback), with a bundled STUN responder, Tailscale/public-VPS/tunnel shapes, Rabbit relay + per-machine Localside + eight DSH tools (replicate / split), nine aggregate verdicts and signed requests.",
   "type": "module",
   "main": "lib/index.js",