@whyvix/remote 0.3.3 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "private": false,
   "type": "module",
   "files": [

package/packages/agent/src/agent.js

@@ -8,7 +8,7 @@ import { RemoteExecutionManager } from "./remote-execution-manager.js";
 import { DeploymentManager } from "./deployment-manager.js";
 import { createToolExecutor } from "./tools.js";
 
-export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUID(),deviceName=os.hostname(),token="",workspaces=[process.cwd()],remoteTargets=[],deploymentProfiles=[],agentVersion="unknown",capabilities=[],reconnectMs=1000,reconnect=true,audit=()=>{},log=console.log,errorLog=console.error,onRegistered=()=>{}}={}) {
+export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUID(),deviceName=os.hostname(),token="",workspaces=[process.cwd()],remoteTargets=[],deploymentProfiles=[],agentVersion="unknown",capabilities=[],reconnectMs=1000,reconnect=true,heartbeatMs=30000,audit=()=>{},log=console.log,errorLog=console.error,onRegistered=()=>{}}={}) {
   let ws=null,reconnectTimer=null,stopped=false,generation=0;
   const security=createSecurity({token,workspaces,audit});
   const processManager=new ProcessManager({audit});
@@ -25,10 +25,21 @@ export function createAgent({gatewayUrl="ws://127.0.0.1:8787",deviceId=randomUUI
     clearTimeout(reconnectTimer); reconnectTimer=null;
     const current=++generation;
     const socket=new WebSocket(gatewayUrl); ws=socket;
+    let alive=true,heartbeatTimer=null;
+    const stopHeartbeat=()=>{if(heartbeatTimer){clearInterval(heartbeatTimer);heartbeatTimer=null;}};
+    if(heartbeatMs>0){
+      socket.on("pong",()=>{alive=true;});
+      heartbeatTimer=setInterval(()=>{
+        if(ws!==socket||socket.readyState!==WebSocket.OPEN)return;
+        if(!alive){errorLog("[agent:heartbeat-timeout]","generation="+current);socket.terminate();return;}
+        alive=false;socket.ping();
+      },heartbeatMs);
+      heartbeatTimer.unref?.();
+    }
     log("[agent:connecting]",gatewayUrl,"generation="+current);
     socket.on("open",()=>{if(ws!==socket)return;log("[agent:connected]",gatewayUrl);socket.send(JSON.stringify(envelope(TYPES.REGISTER,{auth:{token},device:{id:deviceId,name:deviceName,platform:process.platform,agentVersion,capabilities:[...new Set(capabilities.map(String))].sort()}})));});
     socket.on("message",async(raw)=>{if(ws!==socket)return;try{const m=parseMessage(raw);if(m.type===TYPES.REGISTERED){log("[agent:registered]",m.deviceId);onRegistered({deviceId:m.deviceId,authorizedAccount:m.authorizedAccount||""});return;}if(m.type!==TYPES.REQUEST)return;log("[tool:request]",m.tool,{path:m.arguments?.path,cwd:m.arguments?.cwd});try{const result=await executeTool(m.tool,m.arguments);if(m.tool==="device.ping")Object.assign(result,{deviceId,deviceName});log("[tool:success]",m.tool);if(socket.readyState===WebSocket.OPEN)socket.send(JSON.stringify(envelope(TYPES.RESPONSE,{requestId:m.requestId,result})));}catch(error){errorLog("[tool:rejected]",m.tool,error.code||"TOOL_ERROR",error.message);if(socket.readyState===WebSocket.OPEN)socket.send(JSON.stringify(envelope(TYPES.ERROR,{requestId:m.requestId,error:{code:error.code||"TOOL_ERROR",message:error.message}})));}}catch(error){errorLog("[agent:protocol-error]",error.message);}});
-    socket.on("close",(code)=>{log("[agent:disconnected]","generation="+current,"code="+code);if(ws===socket)ws=null;if(code===1008){errorLog("[agent:authorization-required] device credential rejected");return;}if(code===4001){errorLog("[agent:replaced] newer WHYVIX Remote connection is active");return;}scheduleReconnect("close");});
+    socket.on("close",(code)=>{stopHeartbeat();log("[agent:disconnected]","generation="+current,"code="+code);if(ws===socket)ws=null;if(code===1008){errorLog("[agent:authorization-required] device credential rejected");return;}if(code===4001){errorLog("[agent:replaced] newer WHYVIX Remote connection is active");return;}scheduleReconnect("close");});
     socket.on("error",(e)=>{errorLog("[agent:socket-error]",e.message);scheduleReconnect("error");});
   }
   async function stop(){stopped=true;clearTimeout(reconnectTimer);reconnectTimer=null;const socket=ws;ws=null;if(socket&&socket.readyState<WebSocket.CLOSING)await new Promise(r=>{socket.once("close",r);socket.close();});}

package/packages/agent/src/process-manager.js

@@ -1,13 +1,10 @@
 import { spawn } from "node:child_process";
 import path from "node:path";
 
-const DEFAULT_EXECUTABLES = Object.freeze({
-  node: process.execPath,
-  npm: "npm",
-  npx: "npx",
-  php: "php",
-  composer: "composer"
-});
+const DEFAULT_EXECUTABLES = null;
+const BLOCKED_SHELL_EXECUTABLES = new Set([
+  "cmd", "command", "powershell", "pwsh", "sh", "bash", "dash", "zsh", "fish", "wsl"
+]);
 
 function fail(code, message) { throw Object.assign(new Error(message), { code }); }
 
@@ -20,19 +17,25 @@ function appendBounded(state, key, chunk, maxBytes) {
 }
 
 function normalizeRegistry(value) {
-  if (Array.isArray(value)) return new Map(value.map((x) => [String(x).toLowerCase(), String(x)]));
-  return new Map(Object.entries(value || {}).map(([name, command]) => [String(name).toLowerCase(), String(command)]));
+  if (value == null) return null;
+  if (Array.isArray(value)) return new Map(value.map((x) => [String(x).toLowerCase().replace(/\.exe$/, ""), String(x)]));
+  return new Map(Object.entries(value || {}).map(([name, command]) => [String(name).toLowerCase().replace(/\.exe$/, ""), String(command)]));
 }
 
 function resolveExecutable(registry, requested) {
   const raw = String(requested || "").trim();
   if (!raw) fail("INVALID_ARGUMENT", "command is required");
+  if (raw.includes("/") || raw.includes("\\") || raw.includes(":") || raw === "." || raw === "..") {
+    fail("LOCAL_EXEC_NOT_ALLOWED", "Executable must be a bare command name resolved by the operating system");
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(raw)) fail("LOCAL_EXEC_NOT_ALLOWED", "Executable name is invalid");
   const key = raw.toLowerCase().replace(/\.exe$/, "");
-  if (registry.has(key) && !raw.includes("/") && !raw.includes("\\") && !raw.includes(":")) return { name: key, command: registry.get(key) };
-  for (const [name, command] of registry) {
-    if (raw.toLowerCase() === command.toLowerCase()) return { name, command };
+  if (BLOCKED_SHELL_EXECUTABLES.has(key)) fail("LOCAL_EXEC_NOT_ALLOWED", "Shell executables are not allowed");
+  if (registry) {
+    if (registry.has(key)) return { name: key, command: registry.get(key) };
+    fail("LOCAL_EXEC_NOT_ALLOWED", "Local executable is not allowed by configured policy");
   }
-  fail("LOCAL_EXEC_NOT_ALLOWED", "Local executable is not allowed");
+  return { name: key, command: raw };
 }
 
 export class ProcessManager {