agent-ssh-cli 0.1.2 → 0.2.0

package/src/config.js

@@ -1,177 +0,0 @@
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import process from "node:process";
-import { fileURLToPath } from "node:url";
-
-const DEFAULT_CONFIG_DIR = ".agent-ssh-cli";
-const DEFAULT_CONFIG_FILE = "config.json";
-const configCache = new Map();
-
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim() !== "";
-}
-
-function ensureRegexArray(patterns, fieldName, index) {
-  if (patterns === undefined) {
-    return [];
-  }
-  if (!Array.isArray(patterns)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项的 ${fieldName} 必须是字符串数组`);
-  }
-  return patterns.map((pattern) => {
-    if (!isNonEmptyString(pattern)) {
-      throw new Error(`ssh-config.json 第 ${index + 1} 项的 ${fieldName} 必须只包含非空字符串`);
-    }
-    try {
-      return {
-        pattern,
-        regex: new RegExp(pattern)
-      };
-    } catch (error) {
-      throw new Error(`ssh-config.json 第 ${index + 1} 项的 ${fieldName} 含有非法正则: ${pattern}，${error.message}`);
-    }
-  });
-}
-
-function ensureStringArray(values, fieldName, index) {
-  if (values === undefined) {
-    return [];
-  }
-  if (!Array.isArray(values)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项的 ${fieldName} 必须是字符串数组`);
-  }
-  return values.map((value) => {
-    if (!isNonEmptyString(value)) {
-      throw new Error(`ssh-config.json 第 ${index + 1} 项的 ${fieldName} 必须只包含非空字符串`);
-    }
-    return value;
-  });
-}
-
-function normalizeConfigEntry(entry, index) {
-  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项必须是对象`);
-  }
-  if (!isNonEmptyString(entry.name)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项缺少合法的 name`);
-  }
-  if (!isNonEmptyString(entry.host)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项缺少合法的 host`);
-  }
-  if (!isNonEmptyString(entry.username)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项缺少合法的 username`);
-  }
-  const port = Number(entry.port || 22);
-  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项的 port 非法`);
-  }
-  if (entry.pty !== undefined && typeof entry.pty !== "boolean") {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项的 pty 必须是布尔值`);
-  }
-  const hasPassword = isNonEmptyString(entry.password);
-  const hasPrivateKey = isNonEmptyString(entry.privateKey);
-  const hasAgent = isNonEmptyString(entry.agent);
-  const authMethodCount = [hasPassword, hasPrivateKey, hasAgent].filter(Boolean).length;
-  if (authMethodCount === 0) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项必须配置 password、privateKey 或 agent 其中之一`);
-  }
-  if (authMethodCount > 1) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项同时配置了多个认证方式，只允许保留一种`);
-  }
-  if (entry.passphrase !== undefined && !isNonEmptyString(entry.passphrase)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项的 passphrase 必须是非空字符串`);
-  }
-  if (entry.socksProxy !== undefined && !isNonEmptyString(entry.socksProxy)) {
-    throw new Error(`ssh-config.json 第 ${index + 1} 项的 socksProxy 必须是非空字符串`);
-  }
-  return {
-    name: entry.name,
-    host: entry.host,
-    port,
-    username: entry.username,
-    password: hasPassword ? entry.password : undefined,
-    privateKey: hasPrivateKey ? entry.privateKey : undefined,
-    passphrase: entry.passphrase,
-    agent: hasAgent ? entry.agent : undefined,
-    socksProxy: entry.socksProxy,
-    pty: entry.pty,
-    allowedLocalPaths: ensureStringArray(entry.allowedLocalPaths, "allowedLocalPaths", index),
-    commandWhitelist: ensureRegexArray(entry.commandWhitelist, "commandWhitelist", index),
-    commandBlacklist: ensureRegexArray(entry.commandBlacklist, "commandBlacklist", index)
-  };
-}
-
-export function getProjectRoot() {
-  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-}
-
-export function getDefaultConfigPath() {
-  if (isNonEmptyString(process.env.AGENT_SSH_CONFIG)) {
-    return path.resolve(process.env.AGENT_SSH_CONFIG);
-  }
-  return path.join(os.homedir(), DEFAULT_CONFIG_DIR, DEFAULT_CONFIG_FILE);
-}
-
-export function loadConfig(configPath = getDefaultConfigPath()) {
-  const resolvedConfigPath = path.resolve(configPath);
-  const stat = fs.statSync(resolvedConfigPath);
-  const cached = configCache.get(resolvedConfigPath);
-  if (cached && cached.mtimeMs === stat.mtimeMs && cached.size === stat.size) {
-    return cached.configs;
-  }
-  const raw = fs.readFileSync(resolvedConfigPath, "utf8");
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (error) {
-    throw new Error(`ssh-config.json 解析失败: ${error.message}`);
-  }
-  if (!Array.isArray(parsed)) {
-    throw new Error("ssh-config.json 必须是数组格式");
-  }
-  const configs = parsed.map((item, index) => normalizeConfigEntry(item, index));
-  if (configs.length === 0) {
-    throw new Error("ssh-config.json 不能为空");
-  }
-  const seenNames = new Set();
-  for (const config of configs) {
-    if (seenNames.has(config.name)) {
-      throw new Error(`ssh-config.json 存在重复的连接名: ${config.name}`);
-    }
-    seenNames.add(config.name);
-  }
-  configCache.set(resolvedConfigPath, {
-    mtimeMs: stat.mtimeMs,
-    size: stat.size,
-    configs
-  });
-  return configs;
-}
-
-export function findConnection(configs, connectionName) {
-  const name = connectionName || configs[0]?.name;
-  const config = configs.find((item) => item.name === name);
-  if (!config) {
-    throw new Error(`未找到连接配置: ${name}`);
-  }
-  return config;
-}
-
-export function validateLocalPath(configs, localPath, baseCwd = process.cwd()) {
-  const resolvedCwd = path.resolve(baseCwd);
-  const resolvedPath = path.resolve(resolvedCwd, localPath);
-  const allowedRoots = new Set([resolvedCwd, getProjectRoot()]);
-  for (const config of configs) {
-    for (const allowedPath of config.allowedLocalPaths || []) {
-      allowedRoots.add(path.resolve(allowedPath));
-    }
-  }
-  const isAllowed = Array.from(allowedRoots).some((allowedRoot) => {
-    return resolvedPath === allowedRoot || resolvedPath.startsWith(`${allowedRoot}${path.sep}`);
-  });
-  if (!isAllowed) {
-    throw new Error("本地路径不允许访问，必须位于当前工作目录、项目目录或显式允许的路径内");
-  }
-  return resolvedPath;
-}

package/src/daemon-client.js

@@ -1,153 +0,0 @@
-import { spawn } from "node:child_process";
-import crypto from "node:crypto";
-import fs from "node:fs";
-import net from "node:net";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { getSocketPath, getTokenPath, unlinkSocketPath } from "./daemon-paths.js";
-
-const DAEMON_START_TIMEOUT_MS = 3000;
-const DAEMON_REQUEST_TIMEOUT_MS = 86400000;
-
-function getDaemonEntryPath() {
-  return path.join(path.dirname(fileURLToPath(import.meta.url)), "ssh-daemon.js");
-}
-
-function isMissingSocketError(error) {
-  return ["ENOENT", "ECONNREFUSED"].includes(error.code);
-}
-
-function connectSocket(socketPath, timeoutMs = DAEMON_REQUEST_TIMEOUT_MS) {
-  return new Promise((resolve, reject) => {
-    const socket = net.createConnection(socketPath);
-    const cleanup = () => {
-      clearTimeout(timer);
-      socket.removeListener("error", onError);
-    };
-    const onError = (error) => {
-      cleanup();
-      reject(error);
-    };
-    const timer = setTimeout(() => {
-      socket.removeListener("error", onError);
-      socket.destroy();
-      reject(new Error("连接 SSH 缓存进程超时"));
-    }, timeoutMs);
-    socket.once("connect", () => {
-      cleanup();
-      resolve(socket);
-    });
-    socket.once("error", onError);
-  });
-}
-
-function readToken(tokenPath) {
-  return fs.readFileSync(tokenPath, "utf8").trim();
-}
-
-function createToken(tokenPath) {
-  const token = crypto.randomBytes(32).toString("hex");
-  fs.writeFileSync(tokenPath, token, { mode: 0o600 });
-  fs.chmodSync(tokenPath, 0o600);
-  return token;
-}
-
-function spawnDaemon(socketPath, configPath, tokenPath) {
-  const child = spawn(process.execPath, [getDaemonEntryPath(), "--socket", socketPath, "--config", path.resolve(configPath), "--token-file", tokenPath], {
-    detached: true,
-    stdio: "ignore"
-  });
-  child.unref();
-}
-
-async function waitForDaemon(socketPath) {
-  const startAt = Date.now();
-  let lastError;
-  while (Date.now() - startAt < DAEMON_START_TIMEOUT_MS) {
-    try {
-      const socket = await connectSocket(socketPath, 500);
-      socket.end();
-      return;
-    } catch (error) {
-      lastError = error;
-      await new Promise((resolve) => setTimeout(resolve, 100));
-    }
-  }
-  throw new Error(`启动 SSH 缓存进程失败: ${lastError?.message || "未知错误"}`);
-}
-
-async function ensureDaemon(socketPath, configPath, tokenPath) {
-  try {
-    const socket = await connectSocket(socketPath, 500);
-    socket.end();
-    try {
-      return readToken(tokenPath);
-    } catch (error) {
-      unlinkSocketPath(socketPath);
-    }
-  } catch (error) {
-    if (!isMissingSocketError(error)) {
-      throw error;
-    }
-    if (error.code === "ECONNREFUSED") {
-      unlinkSocketPath(socketPath);
-    }
-  }
-  const token = createToken(tokenPath);
-  spawnDaemon(socketPath, configPath, tokenPath);
-  await waitForDaemon(socketPath);
-  return token;
-}
-
-export async function requestDaemon(configPath, request) {
-  const socketPath = getSocketPath(configPath);
-  const tokenPath = getTokenPath(configPath);
-  const token = await ensureDaemon(socketPath, configPath, tokenPath);
-  const socket = await connectSocket(socketPath);
-  socket.setEncoding("utf8");
-
-  return new Promise((resolve, reject) => {
-    let buffer = "";
-    let settled = false;
-    const cleanup = () => {
-      socket.removeAllListeners();
-      socket.end();
-    };
-    const settle = (callback, value) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      cleanup();
-      callback(value);
-    };
-
-    socket.on("data", (chunk) => {
-      buffer += chunk;
-      const lineEnd = buffer.indexOf("\n");
-      if (lineEnd === -1) {
-        return;
-      }
-      const line = buffer.slice(0, lineEnd);
-      let response;
-      try {
-        response = JSON.parse(line);
-      } catch (error) {
-        settle(reject, new Error(`SSH 缓存进程响应非法: ${error.message}`));
-        return;
-      }
-      if (!response.ok) {
-        settle(reject, new Error(response.message || "SSH 缓存进程执行失败"));
-        return;
-      }
-      settle(resolve, response);
-    });
-    socket.on("error", (error) => settle(reject, error));
-    socket.on("close", () => {
-      if (!settled) {
-        settle(reject, new Error("SSH 缓存进程提前关闭连接"));
-      }
-    });
-    socket.write(`${JSON.stringify({ ...request, token })}\n`);
-  });
-}

package/src/daemon-paths.js

@@ -1,62 +0,0 @@
-import crypto from "node:crypto";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import process from "node:process";
-
-export const DEFAULT_CACHE_TTL_MS = 180000;
-
-export function isWindowsPlatform() {
-  return process.platform === "win32";
-}
-
-export function getDaemonDir() {
-  const uid = typeof process.getuid === "function" ? process.getuid() : "nouid";
-  const daemonDir = path.join(os.tmpdir(), `agent-ssh-cli-${uid}`);
-  fs.mkdirSync(daemonDir, { recursive: true, mode: 0o700 });
-  fs.chmodSync(daemonDir, 0o700);
-  return daemonDir;
-}
-
-export function getSocketPath(configPath) {
-  const digest = crypto.createHash("sha256").update(path.resolve(configPath)).digest("hex").slice(0, 24);
-  if (isWindowsPlatform()) {
-    // Windows 下 Node IPC 使用 named pipe，不是文件系统 socket。
-    const userKey = process.env.USERPROFILE || process.env.USERNAME || os.homedir() || "nouser";
-    const userDigest = crypto.createHash("sha256").update(userKey).digest("hex").slice(0, 12);
-    return `\\\\.\\pipe\\agent-ssh-cli-${userDigest}-${digest}`;
-  }
-  return path.join(getDaemonDir(), `${digest}.sock`);
-}
-
-export function getTokenPath(configPath) {
-  const digest = crypto.createHash("sha256").update(path.resolve(configPath)).digest("hex").slice(0, 24);
-  return path.join(getDaemonDir(), `${digest}.token`);
-}
-
-export function unlinkSocketPath(socketPath) {
-  if (isWindowsPlatform()) {
-    return;
-  }
-  try {
-    fs.unlinkSync(socketPath);
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      throw error;
-    }
-  }
-}
-
-export function chmodSocketPath(socketPath) {
-  if (!isWindowsPlatform()) {
-    fs.chmodSync(socketPath, 0o600);
-  }
-}
-
-export function normalizeCacheTtl(value) {
-  const ttl = value === undefined ? DEFAULT_CACHE_TTL_MS : Number(value);
-  if (!Number.isInteger(ttl) || ttl <= 0) {
-    throw new Error("cache-ttl 必须是正整数毫秒值");
-  }
-  return ttl;
-}