agent-ssh-cli 0.1.0

package/src/daemon-client.js

@@ -0,0 +1,133 @@
+import { spawn } from "node:child_process";
+import net from "node:net";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { getSocketPath, unlinkSocketPath } from "./daemon-paths.js";
+
+const DAEMON_START_TIMEOUT_MS = 3000;
+const DAEMON_REQUEST_TIMEOUT_MS = 86400000;
+
+function getDaemonEntryPath() {
+  return path.join(path.dirname(fileURLToPath(import.meta.url)), "ssh-daemon.js");
+}
+
+function isMissingSocketError(error) {
+  return ["ENOENT", "ECONNREFUSED"].includes(error.code);
+}
+
+function connectSocket(socketPath, timeoutMs = DAEMON_REQUEST_TIMEOUT_MS) {
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(socketPath);
+    const cleanup = () => {
+      clearTimeout(timer);
+      socket.removeListener("error", onError);
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const timer = setTimeout(() => {
+      socket.removeListener("error", onError);
+      socket.destroy();
+      reject(new Error("连接 SSH 缓存进程超时"));
+    }, timeoutMs);
+    socket.once("connect", () => {
+      cleanup();
+      resolve(socket);
+    });
+    socket.once("error", onError);
+  });
+}
+
+function spawnDaemon(socketPath) {
+  const child = spawn(process.execPath, [getDaemonEntryPath(), "--socket", socketPath], {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.unref();
+}
+
+async function waitForDaemon(socketPath) {
+  const startAt = Date.now();
+  let lastError;
+  while (Date.now() - startAt < DAEMON_START_TIMEOUT_MS) {
+    try {
+      const socket = await connectSocket(socketPath, 500);
+      socket.end();
+      return;
+    } catch (error) {
+      lastError = error;
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+  }
+  throw new Error(`启动 SSH 缓存进程失败: ${lastError?.message || "未知错误"}`);
+}
+
+async function ensureDaemon(socketPath) {
+  try {
+    const socket = await connectSocket(socketPath, 500);
+    socket.end();
+    return;
+  } catch (error) {
+    if (!isMissingSocketError(error)) {
+      throw error;
+    }
+    if (error.code === "ECONNREFUSED") {
+      unlinkSocketPath(socketPath);
+    }
+  }
+  spawnDaemon(socketPath);
+  await waitForDaemon(socketPath);
+}
+
+export async function requestDaemon(configPath, request) {
+  const socketPath = getSocketPath(configPath);
+  await ensureDaemon(socketPath);
+  const socket = await connectSocket(socketPath);
+  socket.setEncoding("utf8");
+
+  return new Promise((resolve, reject) => {
+    let buffer = "";
+    let settled = false;
+    const cleanup = () => {
+      socket.removeAllListeners();
+      socket.end();
+    };
+    const settle = (callback, value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      callback(value);
+    };
+
+    socket.on("data", (chunk) => {
+      buffer += chunk;
+      const lineEnd = buffer.indexOf("\n");
+      if (lineEnd === -1) {
+        return;
+      }
+      const line = buffer.slice(0, lineEnd);
+      let response;
+      try {
+        response = JSON.parse(line);
+      } catch (error) {
+        settle(reject, new Error(`SSH 缓存进程响应非法: ${error.message}`));
+        return;
+      }
+      if (!response.ok) {
+        settle(reject, new Error(response.message || "SSH 缓存进程执行失败"));
+        return;
+      }
+      settle(resolve, response);
+    });
+    socket.on("error", (error) => settle(reject, error));
+    socket.on("close", () => {
+      if (!settled) {
+        settle(reject, new Error("SSH 缓存进程提前关闭连接"));
+      }
+    });
+    socket.write(`${JSON.stringify(request)}\n`);
+  });
+}

package/src/daemon-paths.js

@@ -0,0 +1,57 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+
+export const DEFAULT_CACHE_TTL_MS = 180000;
+
+export function isWindowsPlatform() {
+  return process.platform === "win32";
+}
+
+export function getDaemonDir() {
+  const uid = typeof process.getuid === "function" ? process.getuid() : "nouid";
+  const daemonDir = path.join(os.tmpdir(), `agent-ssh-cli-${uid}`);
+  fs.mkdirSync(daemonDir, { recursive: true, mode: 0o700 });
+  fs.chmodSync(daemonDir, 0o700);
+  return daemonDir;
+}
+
+export function getSocketPath(configPath) {
+  const digest = crypto.createHash("sha256").update(path.resolve(configPath)).digest("hex").slice(0, 24);
+  if (isWindowsPlatform()) {
+    // Windows 下 Node IPC 使用 named pipe，不是文件系统 socket。
+    const userKey = process.env.USERPROFILE || process.env.USERNAME || os.homedir() || "nouser";
+    const userDigest = crypto.createHash("sha256").update(userKey).digest("hex").slice(0, 12);
+    return `\\\\.\\pipe\\agent-ssh-cli-${userDigest}-${digest}`;
+  }
+  return path.join(getDaemonDir(), `${digest}.sock`);
+}
+
+export function unlinkSocketPath(socketPath) {
+  if (isWindowsPlatform()) {
+    return;
+  }
+  try {
+    fs.unlinkSync(socketPath);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+}
+
+export function chmodSocketPath(socketPath) {
+  if (!isWindowsPlatform()) {
+    fs.chmodSync(socketPath, 0o600);
+  }
+}
+
+export function normalizeCacheTtl(value) {
+  const ttl = value === undefined ? DEFAULT_CACHE_TTL_MS : Number(value);
+  if (!Number.isInteger(ttl) || ttl <= 0) {
+    throw new Error("cache-ttl 必须是正整数毫秒值");
+  }
+  return ttl;
+}

package/src/ssh-client.js

@@ -0,0 +1,215 @@
+import fs from "node:fs";
+import { Client } from "ssh2";
+
+function compilePatterns(patterns, label) {
+  return (patterns || []).map((pattern) => {
+    try {
+      return new RegExp(pattern);
+    } catch (error) {
+      throw new Error(`${label} 正则非法: ${pattern}，${error.message}`);
+    }
+  });
+}
+
+export function validateCommand(connection, command) {
+  const whitelist = compilePatterns(connection.commandWhitelist, "白名单");
+  const blacklist = compilePatterns(connection.commandBlacklist, "黑名单");
+
+  if (whitelist.length > 0 && !whitelist.some((item) => item.test(command))) {
+    throw new Error("命令未命中白名单，拒绝执行");
+  }
+  if (blacklist.length > 0 && blacklist.some((item) => item.test(command))) {
+    throw new Error("命令命中黑名单，拒绝执行");
+  }
+}
+
+function createConnectConfig(connection) {
+  const connectConfig = {
+    host: connection.host,
+    port: connection.port,
+    username: connection.username
+  };
+  if (connection.agent) {
+    connectConfig.agent = connection.agent;
+  } else if (connection.privateKey) {
+    connectConfig.privateKey = fs.readFileSync(connection.privateKey, "utf8");
+    if (connection.passphrase) {
+      connectConfig.passphrase = connection.passphrase;
+    }
+  } else if (connection.password) {
+    connectConfig.password = connection.password;
+  } else {
+    throw new Error(`连接 ${connection.name} 缺少可用认证信息`);
+  }
+  return connectConfig;
+}
+
+export async function connectSshClient(connection) {
+  const client = new Client();
+  const connectConfig = createConnectConfig(connection);
+  await new Promise((resolve, reject) => {
+    client.once("ready", resolve);
+    client.once("error", reject);
+    client.connect(connectConfig);
+  });
+  return client;
+}
+
+export async function withConnection(connection, handler) {
+  const client = await connectSshClient(connection);
+  try {
+    return await handler(client);
+  } finally {
+    client.end();
+  }
+}
+
+export async function executeRemoteCommand(connection, command, directory, timeout = 30000) {
+  validateCommand(connection, command);
+  const remoteCommand = directory ? `cd -- ${JSON.stringify(directory)} && ${command}` : command;
+  return withConnection(connection, (client) => executeRemoteCommandWithClient(client, connection, remoteCommand, timeout));
+}
+
+export async function executeRemoteCommandWithClient(client, connection, remoteCommand, timeout = 30000) {
+  return new Promise((resolve, reject) => {
+    let stdout = "";
+    let stderr = "";
+    let exitCode;
+    let exitSignal;
+    let settled = false;
+    const timer = setTimeout(() => {
+      settled = true;
+      reject(new Error(`命令执行超时，超过 ${timeout}ms`));
+    }, timeout);
+
+    client.exec(remoteCommand, { pty: connection.pty ?? true }, (err, stream) => {
+      if (err) {
+        clearTimeout(timer);
+        reject(err);
+        return;
+      }
+
+      stream.on("data", (chunk) => {
+        stdout += chunk.toString();
+      });
+      stream.stderr.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      stream.on("exit", (code, signal) => {
+        exitCode = code;
+        exitSignal = signal;
+      });
+      stream.on("close", (code, signal) => {
+        clearTimeout(timer);
+        if (settled) {
+          return;
+        }
+        settled = true;
+        exitCode = exitCode ?? code;
+        exitSignal = exitSignal ?? signal;
+        if ((exitCode ?? 0) !== 0 || exitSignal) {
+          const parts = [];
+          if (stdout.trim()) {
+            parts.push(stdout.trimEnd());
+          }
+          if (stderr.trim()) {
+            parts.push(`[stderr]\n${stderr.trimEnd()}`);
+          }
+          if (exitCode !== undefined) {
+            parts.push(`[exit code] ${exitCode}`);
+          }
+          if (exitSignal) {
+            parts.push(`[signal] ${exitSignal}`);
+          }
+          reject(new Error(parts.join("\n") || "命令执行失败"));
+          return;
+        }
+        resolve(stdout.trimEnd());
+      });
+      stream.on("error", (streamError) => {
+        clearTimeout(timer);
+        if (settled) {
+          return;
+        }
+        settled = true;
+        reject(streamError);
+      });
+    });
+  });
+}
+
+export async function uploadFile(connection, localPath, remotePath) {
+  return withConnection(connection, (client) => uploadFileWithClient(client, localPath, remotePath));
+}
+
+export async function uploadFileWithClient(client, localPath, remotePath) {
+  return new Promise((resolve, reject) => {
+    client.sftp((err, sftp) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      const readStream = fs.createReadStream(localPath);
+      const writeStream = sftp.createWriteStream(remotePath);
+      let closed = false;
+      const cleanup = () => {
+        if (!closed) {
+          closed = true;
+          sftp.end();
+        }
+      };
+
+      readStream.on("error", (readError) => {
+        cleanup();
+        reject(readError);
+      });
+      writeStream.on("error", (writeError) => {
+        cleanup();
+        reject(writeError);
+      });
+      writeStream.on("close", () => {
+        cleanup();
+        resolve();
+      });
+      readStream.pipe(writeStream);
+    });
+  });
+}
+
+export async function downloadFile(connection, remotePath, localPath) {
+  return withConnection(connection, (client) => downloadFileWithClient(client, remotePath, localPath));
+}
+
+export async function downloadFileWithClient(client, remotePath, localPath) {
+  return new Promise((resolve, reject) => {
+    client.sftp((err, sftp) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      const readStream = sftp.createReadStream(remotePath);
+      const writeStream = fs.createWriteStream(localPath);
+      let closed = false;
+      const cleanup = () => {
+        if (!closed) {
+          closed = true;
+          sftp.end();
+        }
+      };
+
+      readStream.on("error", (readError) => {
+        cleanup();
+        reject(readError);
+      });
+      writeStream.on("error", (writeError) => {
+        cleanup();
+        reject(writeError);
+      });
+      writeStream.on("close", () => {
+        cleanup();
+        resolve();
+      });
+      readStream.pipe(writeStream);
+    });
+  });
+}

package/src/ssh-daemon.js

@@ -0,0 +1,236 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import net from "node:net";
+import path from "node:path";
+import process from "node:process";
+import { findConnection, loadConfig, validateLocalPath } from "./config.js";
+import { chmodSocketPath, DEFAULT_CACHE_TTL_MS, normalizeCacheTtl, unlinkSocketPath } from "./daemon-paths.js";
+import {
+  connectSshClient,
+  downloadFileWithClient,
+  executeRemoteCommandWithClient,
+  uploadFileWithClient,
+  validateCommand
+} from "./ssh-client.js";
+
+const connections = new Map();
+let activeRequests = 0;
+let lastActivityAt = Date.now();
+let exitTimer;
+let server;
+let socketPath;
+
+function parseArgs(argv) {
+  const socketIndex = argv.indexOf("--socket");
+  const value = socketIndex === -1 ? undefined : argv[socketIndex + 1];
+  if (!value) {
+    throw new Error("daemon 缺少 --socket 参数");
+  }
+  return {
+    socketPath: value
+  };
+}
+
+function writeResponse(socket, response) {
+  socket.write(`${JSON.stringify(response)}\n`, () => socket.end());
+}
+
+function buildConnectionKey(configPath, connection) {
+  const auth = connection.agent
+    ? { type: "agent", value: connection.agent }
+    : connection.privateKey
+      ? { type: "privateKey", value: connection.privateKey, passphrase: connection.passphrase }
+      : { type: "password", value: connection.password };
+  const raw = JSON.stringify({
+    configPath: path.resolve(configPath),
+    name: connection.name,
+    host: connection.host,
+    port: connection.port,
+    username: connection.username,
+    auth
+  });
+  return crypto.createHash("sha256").update(raw).digest("hex");
+}
+
+function removeEntry(key) {
+  const entry = connections.get(key);
+  if (!entry) {
+    return;
+  }
+  connections.delete(key);
+  if (entry.client) {
+    entry.client.end();
+  }
+}
+
+function scheduleExitCheck() {
+  clearTimeout(exitTimer);
+  if (activeRequests > 0) {
+    return;
+  }
+  const now = Date.now();
+  let waitMs = DEFAULT_CACHE_TTL_MS;
+  if (connections.size === 0) {
+    waitMs = Math.max(100, DEFAULT_CACHE_TTL_MS - (now - lastActivityAt));
+  }
+  for (const entry of connections.values()) {
+    waitMs = Math.min(waitMs, Math.max(100, entry.ttlMs - (now - entry.lastUsedAt)));
+  }
+  exitTimer = setTimeout(() => {
+    if (activeRequests > 0) {
+      scheduleExitCheck();
+      return;
+    }
+    const checkedAt = Date.now();
+    for (const [key, entry] of connections.entries()) {
+      if (checkedAt - entry.lastUsedAt >= entry.ttlMs) {
+        removeEntry(key);
+      }
+    }
+    if (connections.size === 0 && checkedAt - lastActivityAt >= DEFAULT_CACHE_TTL_MS) {
+      shutdown();
+      return;
+    }
+    if (connections.size === 0) {
+      shutdown();
+      return;
+    }
+    scheduleExitCheck();
+  }, waitMs);
+}
+
+async function getPoolEntry(configPath, connection, ttlMs) {
+  const key = buildConnectionKey(configPath, connection);
+  let entry = connections.get(key);
+  if (!entry) {
+    entry = {
+      key,
+      client: undefined,
+      clientPromise: undefined,
+      queue: Promise.resolve(),
+      lastUsedAt: Date.now(),
+      ttlMs
+    };
+    entry.clientPromise = connectSshClient(connection)
+      .then((client) => {
+        entry.client = client;
+        client.on("error", () => removeEntry(key));
+        client.on("close", () => removeEntry(key));
+        return client;
+      })
+      .catch((error) => {
+        connections.delete(key);
+        throw error;
+      });
+    connections.set(key, entry);
+  }
+  entry.ttlMs = ttlMs;
+  entry.lastUsedAt = Date.now();
+  await entry.clientPromise;
+  return entry;
+}
+
+async function runSerialized(entry, operation) {
+  const run = async () => {
+    const client = await entry.clientPromise;
+    return operation(client);
+  };
+  const resultPromise = entry.queue.then(run, run);
+  entry.queue = resultPromise.catch(() => undefined);
+  return resultPromise;
+}
+
+async function executeRequest(request) {
+  const ttlMs = normalizeCacheTtl(request.cacheTtlMs);
+  const configs = loadConfig(request.configPath);
+  const connection = findConnection(configs, request.connectionName);
+  if (request.operation === "execute") {
+    validateCommand(connection, request.command);
+  }
+  const entry = await getPoolEntry(request.configPath, connection, ttlMs);
+
+  try {
+    if (request.operation === "execute") {
+      const remoteCommand = request.directory ? `cd -- ${JSON.stringify(request.directory)} && ${request.command}` : request.command;
+      const stdout = await runSerialized(entry, (client) => {
+        return executeRemoteCommandWithClient(client, connection, remoteCommand, request.timeout);
+      });
+      return { stdout };
+    }
+    if (request.operation === "upload") {
+      const localPath = validateLocalPath(configs, request.localPath, request.cwd);
+      await runSerialized(entry, (client) => uploadFileWithClient(client, localPath, request.remotePath));
+      return {};
+    }
+    if (request.operation === "download") {
+      const localPath = validateLocalPath(configs, request.localPath, request.cwd);
+      fs.mkdirSync(path.dirname(localPath), { recursive: true });
+      await runSerialized(entry, (client) => downloadFileWithClient(client, request.remotePath, localPath));
+      return {};
+    }
+    throw new Error(`不支持的 daemon 操作: ${request.operation}`);
+  } finally {
+    entry.lastUsedAt = Date.now();
+    lastActivityAt = entry.lastUsedAt;
+  }
+}
+
+function handleSocket(socket) {
+  socket.setEncoding("utf8");
+  let buffer = "";
+  socket.on("data", (chunk) => {
+    buffer += chunk;
+    const lineEnd = buffer.indexOf("\n");
+    if (lineEnd === -1) {
+      return;
+    }
+    const line = buffer.slice(0, lineEnd);
+    activeRequests += 1;
+    Promise.resolve()
+      .then(() => JSON.parse(line))
+      .then((request) => executeRequest(request))
+      .then((result) => writeResponse(socket, { ok: true, ...result }))
+      .catch((error) => writeResponse(socket, { ok: false, message: error.message }))
+      .finally(() => {
+        activeRequests -= 1;
+        lastActivityAt = Date.now();
+        scheduleExitCheck();
+      });
+  });
+}
+
+function shutdown() {
+  clearTimeout(exitTimer);
+  for (const key of Array.from(connections.keys())) {
+    removeEntry(key);
+  }
+  if (server) {
+    server.close(() => {
+      try {
+        unlinkSocketPath(socketPath);
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          process.stderr.write(`${error.message}\n`);
+        }
+      }
+      process.exit(0);
+    });
+    return;
+  }
+  process.exit(0);
+}
+
+try {
+  ({ socketPath } = parseArgs(process.argv.slice(2)));
+  unlinkSocketPath(socketPath);
+  server = net.createServer(handleSocket);
+  server.listen(socketPath, () => {
+    chmodSocketPath(socketPath);
+    scheduleExitCheck();
+  });
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exit(1);
+}