autodev-cli 1.4.0 → 1.4.4

package/out/rateLimit.js

@@ -0,0 +1,90 @@
+"use strict";
+// ---------------------------------------------------------------------------
+// Rate-limit detection — central registry of phrases Claude uses to signal
+// throttling, plus the reset-time parser. Add new wording in ONE place
+// (RateLimitDetector.PHRASES) and every call site picks it up.
+// ---------------------------------------------------------------------------
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimitDetector = exports.RateLimitError = void 0;
+class RateLimitError extends Error {
+    rawMessage;
+    resetAt;
+    constructor(rawMessage, resetAt) {
+        super(rawMessage);
+        this.rawMessage = rawMessage;
+        this.resetAt = resetAt;
+        this.name = 'RateLimitError';
+    }
+}
+exports.RateLimitError = RateLimitError;
+/**
+ * Phrases / regexes that mean "Claude is throttled, pause the loop". Each
+ * entry is matched case-insensitively against the candidate text. Add new
+ * wording here whenever Anthropic ships a new error string — no other site
+ * in the codebase needs to change.
+ */
+const PHRASES = [
+    /hit your limit/i, // "You've hit your limit · resets 9pm (Europe/Sofia)"
+    /rate limit/i, // "API Error: ... · Rate limited"
+    /out of extra usage/i, // "You're out of extra usage · resets 8:20pm (Europe/Sofia)"
+    /\bout of\b.*\busage\b/i, // future variants of "out of … usage"
+    /usage limit reached/i,
+];
+class RateLimitDetector {
+    /** True when text contains any known rate-limit phrase. */
+    static matches(text) {
+        if (!text) {
+            return false;
+        }
+        return PHRASES.some(p => p.test(text));
+    }
+    /** Build a RateLimitError from text, parsing the reset time if present. */
+    static toError(text) {
+        const trimmed = (text ?? '').trim();
+        return new RateLimitError(trimmed || 'Rate limited', RateLimitDetector.parseResetTime(trimmed));
+    }
+    /** Match + build in one step. Returns null when text is not a rate limit. */
+    static detect(text) {
+        return RateLimitDetector.matches(text) ? RateLimitDetector.toError(text) : null;
+    }
+    /**
+     * Parse "resets 9pm (Europe/Sofia)" / "resets 8:20pm (Europe/Sofia)" into a
+     * UTC Date. Returns undefined when no reset clause is present or parseable.
+     */
+    static parseResetTime(text) {
+        const m = text.match(/resets\s+(\d{1,2})(?::(\d{2}))?\s*(am|pm)\s*\(([^)]+)\)/i);
+        if (!m) {
+            return undefined;
+        }
+        try {
+            let hour = parseInt(m[1]);
+            const min = parseInt(m[2] ?? '0');
+            const isPm = m[3].toLowerCase() === 'pm';
+            const tz = m[4];
+            if (isPm && hour !== 12) {
+                hour += 12;
+            }
+            if (!isPm && hour === 12) {
+                hour = 0;
+            }
+            const now = new Date();
+            const dateStr = new Intl.DateTimeFormat('sv', { timeZone: tz }).format(now);
+            for (let d = 0; d <= 1; d++) {
+                const base = Date.parse(dateStr) + d * 86_400_000 + hour * 3_600_000 + min * 60_000;
+                const naiveDate = new Date(base);
+                const inTz = new Date(naiveDate.toLocaleString('en-US', { timeZone: tz }));
+                const offset = naiveDate.getTime() - inTz.getTime();
+                const resetUtc = new Date(base + offset);
+                if (resetUtc > now) {
+                    return resetUtc;
+                }
+            }
+            return undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+exports.RateLimitDetector = RateLimitDetector;
+//# sourceMappingURL=rateLimit.js.map

package/out/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../src/rateLimit.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,uEAAuE;AACvE,+DAA+D;AAC/D,8EAA8E;;;AAE9E,MAAa,cAAe,SAAQ,KAAK;IAClB;IAA6B;IAAlD,YAAqB,UAAkB,EAAW,OAAyB;QACzE,KAAK,CAAC,UAAU,CAAC,CAAC;QADC,eAAU,GAAV,UAAU,CAAQ;QAAW,YAAO,GAAP,OAAO,CAAkB;QAEzE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AALD,wCAKC;AAED;;;;;GAKG;AACH,MAAM,OAAO,GAA0B;IACrC,iBAAiB,EAAiB,sDAAsD;IACxF,aAAa,EAAqB,kCAAkC;IACpE,qBAAqB,EAAa,6DAA6D;IAC/F,wBAAwB,EAAU,sCAAsC;IACxE,sBAAsB;CACvB,CAAC;AAEF,MAAa,iBAAiB;IAC5B,2DAA2D;IAC3D,MAAM,CAAC,OAAO,CAAC,IAAY;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,OAAO,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,IAAI,cAAc,CAAC,OAAO,IAAI,cAAc,EAAE,iBAAiB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,MAAM,CAAC,IAAY;QACxB,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,IAAY;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;YACzC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAAC,IAAI,IAAI,EAAE,CAAC;YAAC,CAAC;YACxC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAAC,IAAI,GAAG,CAAC,CAAC;YAAC,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,GAAG,GAAG,MAAM,CAAC;gBACpF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;gBACzC,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;oBAAC,OAAO,QAAQ,CAAC;gBAAC,CAAC;YAC1C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC/B,CAAC;CACF;AA7CD,8CA6CC"}

package/out/rdp/auth.d.ts

@@ -0,0 +1,55 @@
+/**
+ * RdpAuth — handles the security negotiation layer for RDP connections.
+ *
+ * Supported protocols (negotiated via X.224 Negotiation Request):
+ *   PROTOCOL_RDP    (0) — Classic RDP Security (RC4); rarely used today
+ *   PROTOCOL_SSL    (1) — TLS wrapping (most XRDP servers)
+ *   PROTOCOL_HYBRID (2) — CredSSP / NLA (Windows default; Phase 2)
+ *
+ * For Phase 1 (XRDP / local targets) we negotiate TLS-only (PROTOCOL_SSL).
+ * This avoids the full CredSSP/NTLM stack and works against:
+ *   - xrdp with TLS enabled  (default on modern Linux)
+ *   - Windows 2008+ with "Allow connections from … any version" security level
+ *
+ * NLA (CredSSP) is prepared as a future phase — see negotiateNla().
+ */
+import * as net from 'net';
+import * as tls from 'tls';
+/**
+ * Build an X.224 Connection Request TPDU with an RDP Negotiation Request
+ * appended as a type-length-value (TLV) trailer.
+ *
+ * The cookie (mstshash=<username>) is optional but recommended for xrdp
+ * load-balancing.
+ */
+export declare function buildX224ConnectRequest(requestedProtocols: number, username?: string): Buffer;
+/**
+ * Parse the X.224 Connection Confirm TPDU (and optional Negotiation Response).
+ * Returns the selected protocol or throws on failure.
+ */
+export declare function parseX224ConnectConfirm(data: Buffer): number;
+/**
+ * Upgrade a plain TCP socket to TLS.
+ * Returns the TLS socket once the handshake is complete.
+ * Certificate validation is disabled (self-signed is the norm for RDP).
+ */
+export declare function upgradeTls(sock: net.Socket, host: string): Promise<tls.TLSSocket>;
+/**
+ * Generate a 32-byte random client random for Classic RDP Security.
+ * Not used in TLS mode but exposed for completeness / future use.
+ */
+export declare function generateClientRandom(): Buffer;
+/**
+ * Placeholder for CredSSP / NLA negotiation.
+ * Full NTLM + CredSSP is complex; this throws with a clear message so callers
+ * can detect that NLA is required and surface a useful error to the user.
+ *
+ * @throws Always — NLA is not yet implemented.
+ */
+export declare function negotiateNla(_sock: tls.TLSSocket, _username: string, _password: string, _domain: string): Promise<void>;
+/**
+ * Choose the best protocol to request during X.224 negotiation.
+ * We always try TLS first; fall back to classic RDP only if the server
+ * explicitly rejects and the caller retries.
+ */
+export declare function selectRequestProtocol(): number;

package/out/rdp/auth.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * RdpAuth — handles the security negotiation layer for RDP connections.
+ *
+ * Supported protocols (negotiated via X.224 Negotiation Request):
+ *   PROTOCOL_RDP    (0) — Classic RDP Security (RC4); rarely used today
+ *   PROTOCOL_SSL    (1) — TLS wrapping (most XRDP servers)
+ *   PROTOCOL_HYBRID (2) — CredSSP / NLA (Windows default; Phase 2)
+ *
+ * For Phase 1 (XRDP / local targets) we negotiate TLS-only (PROTOCOL_SSL).
+ * This avoids the full CredSSP/NTLM stack and works against:
+ *   - xrdp with TLS enabled  (default on modern Linux)
+ *   - Windows 2008+ with "Allow connections from … any version" security level
+ *
+ * NLA (CredSSP) is prepared as a future phase — see negotiateNla().
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildX224ConnectRequest = buildX224ConnectRequest;
+exports.parseX224ConnectConfirm = parseX224ConnectConfirm;
+exports.upgradeTls = upgradeTls;
+exports.generateClientRandom = generateClientRandom;
+exports.negotiateNla = negotiateNla;
+exports.selectRequestProtocol = selectRequestProtocol;
+const tls = __importStar(require("tls"));
+const constants_1 = require("./constants");
+// ── X.224 helpers ──────────────────────────────────────────────────────────
+/**
+ * Build an X.224 Connection Request TPDU with an RDP Negotiation Request
+ * appended as a type-length-value (TLV) trailer.
+ *
+ * The cookie (mstshash=<username>) is optional but recommended for xrdp
+ * load-balancing.
+ */
+function buildX224ConnectRequest(requestedProtocols, username) {
+    const cookie = username
+        ? `Cookie: mstshash=${username}\r\n`
+        : '';
+    // RDP Negotiation Request TLV: type(1) + flags(1) + length(2) + protocols(4)
+    const negReq = Buffer.alloc(8);
+    negReq[0] = 0x01; // TYPE_RDP_NEG_REQ
+    negReq[1] = 0x00; // flags
+    negReq.writeUInt16LE(0x0008, 2); // length = 8
+    negReq.writeUInt32LE(requestedProtocols, 4);
+    // TPDU variable part: cookie + negotiation request
+    const varPart = Buffer.concat([
+        Buffer.from(cookie, 'ascii'),
+        negReq,
+    ]);
+    // X.224 CR TPDU header: LI(1) + code(1) + dstRef(2) + srcRef(2) + class(1)
+    const li = 6 + varPart.length; // header length indicator (bytes after LI itself)
+    const tpdu = Buffer.alloc(7 + varPart.length);
+    tpdu[0] = li;
+    tpdu[1] = constants_1.X224_TPDU_CONNECTION_REQUEST;
+    tpdu.writeUInt16BE(0x0000, 2); // dst ref
+    tpdu.writeUInt16BE(0x0000, 4); // src ref
+    tpdu[6] = 0x00; // class 0
+    varPart.copy(tpdu, 7);
+    // TPKT header: version(1) + reserved(1) + length(2)
+    const totalLen = 4 + tpdu.length;
+    const tpkt = Buffer.alloc(4 + tpdu.length);
+    tpkt[0] = 0x03; // TPKT version
+    tpkt[1] = 0x00; // reserved
+    tpkt.writeUInt16BE(totalLen, 2);
+    tpdu.copy(tpkt, 4);
+    return tpkt;
+}
+/**
+ * Parse the X.224 Connection Confirm TPDU (and optional Negotiation Response).
+ * Returns the selected protocol or throws on failure.
+ */
+function parseX224ConnectConfirm(data) {
+    if (data.length < 7)
+        throw new Error('X.224 CC too short');
+    if (data[0] !== 0x03)
+        throw new Error('Not a TPKT packet');
+    const tpduStart = 4;
+    const code = data[tpduStart + 1];
+    if (code !== constants_1.X224_TPDU_CONNECTION_CONFIRM) {
+        throw new Error(`Expected X.224 CC (0xD0), got 0x${code.toString(16)}`);
+    }
+    // Check for optional RDP Negotiation TLV appended after the fixed 7-byte header
+    const varOffset = tpduStart + 7;
+    if (data.length >= varOffset + 8) {
+        const tlvType = data[varOffset];
+        if (tlvType === 0x02) {
+            // TYPE_RDP_NEG_RSP — server accepted our requested protocol.
+            // The flags field here contains capability bits (e.g. EXTENDED_CLIENT_DATA_SUPPORTED=0x01)
+            // which are NOT error indicators — do not treat them as failures.
+            return data.readUInt32LE(varOffset + 4);
+        }
+        if (tlvType === 0x03) {
+            // TYPE_RDP_NEG_FAILURE — server rejected our protocol request.
+            const failureCode = data.readUInt32LE(varOffset + 4);
+            const reasons = {
+                1: 'SSL_REQUIRED_BY_SERVER',
+                2: 'SSL_NOT_ALLOWED_BY_SERVER',
+                3: 'SSL_CERT_NOT_ON_SERVER',
+                4: 'INCONSISTENT_FLAGS',
+                5: 'HYBRID_REQUIRED_BY_SERVER (NLA required)',
+                6: 'SSL_WITH_USER_AUTH_REQUIRED_BY_SERVER',
+            };
+            throw new Error(`RDP Negotiation Failure: ${reasons[failureCode] ?? `code ${failureCode}`}`);
+        }
+    }
+    // No negotiation TLV — server accepted default (classic RDP security)
+    return constants_1.PROTOCOL_RDP;
+}
+// ── TLS upgrade ───────────────────────────────────────────────────────────
+/**
+ * Upgrade a plain TCP socket to TLS.
+ * Returns the TLS socket once the handshake is complete.
+ * Certificate validation is disabled (self-signed is the norm for RDP).
+ */
+function upgradeTls(sock, host) {
+    return new Promise((resolve, reject) => {
+        const tlsSock = tls.connect({
+            socket: sock,
+            host,
+            rejectUnauthorized: false, // RDP servers use self-signed certs
+        });
+        tlsSock.once('secureConnect', () => resolve(tlsSock));
+        tlsSock.once('error', reject);
+    });
+}
+// ── RDP Security (Classic — no longer recommended but kept for completeness) ─
+/**
+ * Generate a 32-byte random client random for Classic RDP Security.
+ * Not used in TLS mode but exposed for completeness / future use.
+ */
+function generateClientRandom() {
+    const crypto = require('crypto');
+    return crypto.randomBytes(32);
+}
+// ── NLA / CredSSP stub (Phase 2) ──────────────────────────────────────────
+/**
+ * Placeholder for CredSSP / NLA negotiation.
+ * Full NTLM + CredSSP is complex; this throws with a clear message so callers
+ * can detect that NLA is required and surface a useful error to the user.
+ *
+ * @throws Always — NLA is not yet implemented.
+ */
+function negotiateNla(
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_sock, 
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_username, 
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_password, 
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_domain) {
+    return Promise.reject(new Error('NLA / CredSSP authentication is not yet supported. ' +
+        'Connect to an RDP server configured for SSL/TLS security level, ' +
+        'or use xrdp with TLS enabled.'));
+}
+// ── Protocol selection helper ─────────────────────────────────────────────
+/**
+ * Choose the best protocol to request during X.224 negotiation.
+ * We always try TLS first; fall back to classic RDP only if the server
+ * explicitly rejects and the caller retries.
+ */
+function selectRequestProtocol() {
+    return constants_1.PROTOCOL_SSL;
+}
+//# sourceMappingURL=auth.js.map

package/out/rdp/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/rdp/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeH,0DAwCC;AAMD,0DAuCC;AASD,gCAaC;AAQD,oDAGC;AAWD,oCAiBC;AASD,sDAEC;AAzKD,yCAA2B;AAC3B,2CAAqH;AAErH,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,kBAA0B,EAC1B,QAAiB;IAEjB,MAAM,MAAM,GAAG,QAAQ;QACrB,CAAC,CAAC,oBAAoB,QAAQ,MAAM;QACpC,CAAC,CAAC,EAAE,CAAC;IAEP,6EAA6E;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAY,mBAAmB;IAChD,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAY,QAAQ;IACrC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa;IAC9C,MAAM,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAE5C,mDAAmD;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;QAC5B,MAAM;KACP,CAAC,CAAC;IAEH,2EAA2E;IAC3E,MAAM,EAAE,GAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,kDAAkD;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,CAAC,CAAC,GAAG,wCAA4B,CAAC;IACvC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;IACzC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;IACzC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAe,UAAU;IACxC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEtB,oDAAoD;IACpD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,eAAe;IAC/B,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW;IAC3B,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,IAAY;IAClD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAE3D,MAAM,SAAS,GAAG,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,wCAA4B,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,gFAAgF;IAChF,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,6DAA6D;YAC7D,2FAA2F;YAC3F,kEAAkE;YAClE,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,+DAA+D;YAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACrD,MAAM,OAAO,GAA2B;gBACtC,CAAC,EAAE,wBAAwB;gBAC3B,CAAC,EAAE,2BAA2B;gBAC9B,CAAC,EAAE,wBAAwB;gBAC3B,CAAC,EAAE,oBAAoB;gBACvB,CAAC,EAAE,0CAA0C;gBAC7C,CAAC,EAAE,uCAAuC;aAC3C,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,WAAW,CAAC,IAAI,QAAQ,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,OAAO,wBAAY,CAAC;AACtB,CAAC;AAED,6EAA6E;AAE7E;;;;GAIG;AACH,SAAgB,UAAU,CACxB,IAAgB,EAChB,IAAY;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC1B,MAAM,EAAE,IAAI;YACZ,IAAI;YACJ,kBAAkB,EAAE,KAAK,EAAE,oCAAoC;SAChE,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,SAAgB,oBAAoB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAA4B,CAAC;IAC5D,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,6EAA6E;AAE7E;;;;;;GAMG;AACH,SAAgB,YAAY;AAC1B,6DAA6D;AAC7D,KAAoB;AACpB,6DAA6D;AAC7D,SAAiB;AACjB,6DAA6D;AAC7D,SAAiB;AACjB,6DAA6D;AAC7D,OAAe;IAEf,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,qDAAqD;QACrD,kEAAkE;QAClE,+BAA+B,CAChC,CACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAE7E;;;;GAIG;AACH,SAAgB,qBAAqB;IACnC,OAAO,wBAAY,CAAC;AACtB,CAAC"}

package/out/rdp/bridge.d.ts

@@ -0,0 +1,86 @@
+/**
+ * RdpBridge — TCP/TLS connection to an RDP server.
+ *
+ * Implements the minimal RDP protocol phases needed for screen + input:
+ *
+ *   Phase 1  X.224 Connection Request / Confirm  (TPKT/X.224)
+ *   Phase 2  TLS upgrade  (PROTOCOL_SSL negotiated in Phase 1)
+ *   Phase 3  MCS Connect  (T.125 / GCC Conference Create)
+ *   Phase 4  MCS Erect Domain + Attach User
+ *   Phase 5  MCS Channel Joins  (Global + optional cliprdr)
+ *   Phase 6  RDP Security Exchange + Client Info  (Classic RDP Security disabled; TLS carries everything)
+ *   Phase 7  Demand-Active / Confirm-Active capability exchange
+ *   Phase 8  Running — bitmap updates, input events, clipboard
+ *
+ * Emits:
+ *   'fbu'       (rects: RdpRect[])               — one or more bitmap rectangles
+ *   'cursor'    ({ hotX, hotY, width, height, rgba: string }) — cursor shape update
+ *   'clipboard' (text: string)                   — remote clipboard changed
+ *   'error'     (err: Error)                     — unrecoverable error
+ *   'close'     ()                               — TCP/TLS connection closed
+ */
+import { EventEmitter } from 'events';
+import type { RdpInfo, RdpConnectOptions } from './types';
+export declare class RdpBridge extends EventEmitter {
+    private _sock;
+    private _closed;
+    private _recvBuf;
+    private _handshakeBuf;
+    private _width;
+    private _height;
+    private _colorDepth;
+    private _userId;
+    private _shareId;
+    private _connected;
+    private _opts;
+    private _reconnectCount;
+    private static readonly _MAX_RECONNECTS;
+    /** Optional external logger — set before calling connect(). */
+    log: (msg: string) => void;
+    get width(): number;
+    get height(): number;
+    /**
+     * Connect to an RDP server.  Resolves once the desktop is ready.
+     */
+    connect(opts: RdpConnectOptions): Promise<RdpInfo>;
+    /** Send a mouse event. buttonMask: bit0=left, bit1=right, bit2=middle */
+    sendMouse(x: number, y: number, buttonMask: number): void;
+    /** Send a key event. jsKeyCode is the browser keyCode value. */
+    sendKey(jsKeyCode: number, down: boolean): void;
+    /** Push local clipboard text to the remote. */
+    sendClipboardText(text: string): void;
+    close(): void;
+    /**
+     * Reconnect using saved opts — called after xrdp's clean TCP close that
+     * follows the initial session-creation handshake.
+     */
+    private _doReconnect;
+    private _handshake;
+    /**
+     * Handle RDP license exchange after Client Info PDU.
+     * Responds to SERVER_LICENSE_REQUEST and PLATFORM_CHALLENGE until the
+     * server completes licensing (or sends a non-license PDU).
+     */
+    private _doLicenseExchange;
+    private _runLoop;
+    private _dispatchPdu;
+    private _handleDataPdu;
+    private _handleUpdatePdu;
+    private _parseBitmapUpdate;
+    private _sendInput;
+    private _sendX224Data;
+    private _sendMcsData;
+    /** Read a complete TPKT from the given socket (used during handshake only). */
+    private _readTpkt;
+    /** Read a TPKT and return only the payload (after TPKT+X.224 headers). */
+    private _readTpktPayload;
+    /**
+     * Wait for an RDP PDU with a specific pduType in the Share Control Header.
+     * Times out after `timeoutMs` ms.
+     */
+    private _waitForPduType;
+    /** Try to parse one complete TPKT from _recvBuf without blocking.
+     * Fast-path PDUs (first byte != 0x03) are skipped with a warning since we
+     * advertise no fast-path support; they should not appear, but guard anyway. */
+    private _tryParseTpkt;
+}