ccdeck 3.29.11 → 3.30.0

package/src/server/prefs-routes.mjs

@@ -0,0 +1,76 @@
+// The deck's settings routes: GET /api/prefs, which answers what a page may see
+// of them and what the machine allows, and POST /api/prefs, which writes a
+// patch and hands the result to the LAN engine.
+//
+// These lived in src/server/index.mjs, beside the desktop notifier that reads
+// the same settings, and moved once the settings had (prefs-state.mjs) and the
+// engine had (lan-deck.mjs): what is left of them is a body read, a write
+// through the one, a push to the other, and an answer. The notifier stays in
+// index.mjs, beside the desktop-app connections it notifies through.
+import { notificationsOn, notificationsVetoed, prefsRefusalDetail, prefsWriteRefusal, publicPrefs } from "./deck-prefs.mjs";
+import { PRODUCT } from "./brand.mjs";
+import { heldPrefs } from "./prefs-state.mjs";
+import { applyLanPrefs, forgetReach } from "./lan-deck.mjs";
+import { readBody, send } from "./http-io.mjs";
+
+/**
+ * GET the deck's settings, and what the machine is allowing.
+ *
+ * THREE fields, not two, and the third is the one a first attempt got wrong.
+ * `notificationsAllowed` is the effective answer, after the environment
+ * variable has had its say — but "false" there means either "the user switched
+ * it off" or "the machine forbids it", and the menu has to say a different
+ * sentence for each. Deriving the second from the first made the switch read
+ * "off — set at launch" the moment anybody turned it off on a deck launched
+ * with no variable at all, which is the deck telling the user their own press
+ * was somebody else's doing. `notificationsVetoed` answers only the machine's
+ * half.
+ */
+function prefsPayload() {
+  const prefs = heldPrefs.current();
+  return {
+    ok: true,
+    // `publicPrefs`, never the held prefs whole. This route answers anything
+    // that can reach the loopback port, and the LAN group passphrase is in the
+    // stored object — one field, and sending it here would put it in front of
+    // every page on the machine. What goes out is whether one is set.
+    prefs: publicPrefs(prefs),
+    notificationsAllowed: notificationsOn(prefs),
+    notificationsVetoed: notificationsVetoed(),
+  };
+}
+
+export function handlePrefsRead(req, res) {
+  return send(res, 200, prefsPayload());
+}
+
+/** POST a patch. Fields nobody sent keep their value — see writePrefs. */
+export async function handlePrefsWrite(req, res) {
+  const raw = await readBody(req, res).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
+  try {
+    await heldPrefs.write(body);
+  } catch (err) {
+    // A settings file or folder this user cannot reach is the machine's to fix,
+    // not the deck's, and `guard`'s bare 500 left the panel with nothing to say
+    // about it (#1335). Anything else is still a bug and still goes to `guard`.
+    const reason = prefsWriteRefusal(err);
+    if (!reason) throw err;
+    console.error(`${PRODUCT}: settings were not saved:`, err?.message ?? err);
+    // What blocked it, from closed sets and without the path, so a screenshot
+    // of the panel is enough to tell the cases apart (#1335).
+    const detail = prefsRefusalDetail(err);
+    return send(res, 500, detail ? { ok: false, reason, detail } : { ok: false, reason });
+  }
+  // The engine reads its settings from here rather than holding its own copy,
+  // so turning the switch off in the panel really does stop the sockets rather
+  // than only changing what the panel says.
+  await applyLanPrefs();
+  // Somebody has just switched this on and is watching the panel for the answer
+  // to one question: is anything going to turn up. Whatever the probe said
+  // before is about a deck whose sockets were down — see forgetReach.
+  if (body.lan?.enabled === true) forgetReach();
+  return send(res, 200, prefsPayload());
+}

package/src/server/prefs-set-aside.mjs

@@ -0,0 +1,86 @@
+// Moving a prefs.json nobody can use out of the way, before anything can write
+// over it: the bytes of a file that is not JSON (#1002), and a file another
+// user owns (#1335). Moved out of deck-prefs.mjs unchanged; loadPrefs decides
+// when, and this is how.
+import { stat } from "node:fs/promises";
+import { renameWithRetry } from "./atomic-write.mjs";
+import { deckDataDir } from "./deck-home.mjs";
+import { prefsDir, prefsPath } from "./prefs-path.mjs";
+
+/** Where the bytes of a prefs.json nothing could parse are put.
+ *
+ *  `Date.now()` rather than an ISO timestamp because a colon is not a legal
+ *  filename character on Windows, and a quarantine that cannot be created on
+ *  the platform it is protecting is not a quarantine. */
+export const quarantinePath = (home = deckDataDir(), at = Date.now()) =>
+  `${prefsPath(home)}.corrupt-${at}`;
+
+/** The read errors that can mean "not yours" rather than "broken". Only these
+ *  send a read to setAsideForeign; EISDIR, EIO and EMFILE never do. */
+export const DENIED = new Set(["EACCES", "EPERM"]);
+
+/** Where a prefs.json another user owns is put. Beside the file, like
+ *  quarantinePath, and stamped in milliseconds for the same Windows reason —
+ *  but a name of its own, because nothing is wrong with these bytes. */
+export const foreignPath = (home = deckDataDir(), at = Date.now()) =>
+  `${prefsPath(home)}.foreign-${at}`;
+
+/**
+ * Move a prefs.json that ANOTHER USER OWNS out of the way, or say why not.
+ *
+ * #1335. A `sudo ccdeck` that kept the user's HOME writes a root-owned 0600
+ * prefs.json into the user's own folder. From then on every
+ * deck that user starts is refused the read, refuses every settings write on
+ * top of it — rightly — and so can never keep anything: a new LAN identity on
+ * every start, a share tick that says "Could not share that account", and no
+ * way out from inside the deck.
+ *
+ * WHY MOVING IT IS SAFE HERE WHEN IT IS NOT FOR "unreadable". The refusal
+ * exists so the deck never loses a key it could still have read. A file owned
+ * by somebody else is not one this user's deck will ever read — waiting does
+ * not help, and the deck is already running on defaults. A rename reads and
+ * changes nothing: owner and mode travel with the file, so the key in it stays
+ * private and whole, and `sudo chown` plus a move puts it back.
+ *
+ * Only when the owner is KNOWN to be somebody else. A file this user owns and
+ * still cannot read (a mode bit, a lock, a sandbox) is left exactly where it
+ * is, and so is anything on Windows, where there is no uid to compare and
+ * EPERM is usually another program holding the file.
+ *
+ * Answers `{ moved, uid }`, `{ gone }` when the file vanished under it, or,
+ * when it stayed, `{ why, owner, on }`: a sentence for the log, possibly empty,
+ * and who owns what blocked the read — "you", "other" or "unknown" — and
+ * whether that is the "file" or its "folder". The last two are what the panel
+ * is told (see prefsRefusalDetail); the sentence, which has the path, is not.
+ */
+export async function setAsideForeign(path, home, deps) {
+  const uid = deps.getuid ? deps.getuid() : process.getuid?.();
+  if (uid === undefined) return { why: "", owner: "unknown", on: "file" };
+  const look = deps.stat ?? stat;
+  let st;
+  try {
+    st = await look(path);
+  } catch (err) {
+    if (err?.code === "ENOENT") return { gone: true };
+    // The folder itself is out of reach, so nothing in it can be looked at, let
+    // alone moved. Name the folder and its owner, which is what a person needs.
+    const folder = prefsDir(home);
+    const owner = await look(folder).then(s => s.uid, () => undefined);
+    if (owner === undefined) return { why: "", owner: "unknown", on: "folder" };
+    if (owner === uid) return { why: "", owner: "you", on: "folder" };
+    return {
+      why: ` The folder ${folder} belongs to another user (uid ${owner}), most likely from a run with sudo; sudo chown -R "$(id -un)" "${folder}" gives it back.`,
+      owner: "other",
+      on: "folder",
+    };
+  }
+  if (st.uid === uid) return { why: "", owner: "you", on: "file" };
+  const to = foreignPath(home);
+  try {
+    await (deps.rename ?? renameWithRetry)(path, to);
+  } catch (err) {
+    if (err?.code === "ENOENT") return { gone: true };
+    return { why: ` It belongs to another user (uid ${st.uid}) and could not be moved aside either: ${err?.message ?? err}.`, owner: "other", on: "file" };
+  }
+  return { moved: to, uid: st.uid };
+}

package/src/server/prefs-state.mjs

@@ -0,0 +1,51 @@
+// The deck's settings as this process holds them: the one in-memory copy every
+// reader asks, and the one place a write's answer is kept.
+//
+// This was `let _prefs` in src/server/index.mjs, and it is the reason the LAN
+// section could not leave that file. The notifier and the away-update read it;
+// the settings route, the LAN peer route and six of the LAN engine's callbacks
+// each assigned it back with `_prefs = await writePrefs(...)`; and a
+// module-level `let` is one no other module can assign. So the variable moved
+// first, behind the three things its callers actually do with it: read it,
+// write a patch, and compute a patch from the file. Every write now goes
+// through here, which is also what keeps the promise the comment below has
+// always made — that the copy and the file cannot drift within one process —
+// true by construction rather than by every caller remembering the assignment.
+//
+// The disk half is deck-prefs.mjs, unchanged: the queue, the merge and the
+// refusal to write over a file it could not read all live there. This holds
+// what they return and nothing else.
+import { DEFAULTS, readPrefs, updatePrefs, writePrefs } from "./deck-prefs.mjs";
+
+/**
+ * The deck's own settings, in memory, refreshed whenever they are written.
+ *
+ * Read once at boot and then kept here rather than read per event: `consider`
+ * is on the ingest path every hook event goes through, and a file read there
+ * would be a syscall per event to answer a question that changes when somebody
+ * presses a switch. The write path below updates this, so the in-memory copy
+ * and the file cannot drift within one process — and a second deck writing the
+ * file is picked up on ITS next write or this one's next boot, which is the
+ * same freshness every other cross-deck setting has.
+ */
+let _prefs = { ...DEFAULTS };
+
+// Read at import, so `consider` has its answer from the first event. LAN sync
+// used to start from this same read, and it must not: bin/deck.js imports the
+// server module to ASK whether a deck is already up, and a launcher that then
+// attaches and exits had already bound the beacon and the sync port on the way
+// in — which is the `lan sync (listen): EADDRINUSE` line a second `ccdeck`
+// printed above `deck already running`. The engine starts from the listen that
+// succeeds, in startServer, which is the only process that may hold a port.
+export const prefsRead = readPrefs().then(p => { _prefs = p; }).catch(() => {});
+
+export const heldPrefs = Object.freeze({
+  /** What the last read or write left here. Never a disk read — see above. */
+  current: () => _prefs,
+  /** `writePrefs(patch)`, and keep what it wrote. A write that throws keeps
+   *  nothing, so the copy is never ahead of the file. */
+  write: async patch => (_prefs = await writePrefs(patch)),
+  /** `updatePrefs(mutate)`, and keep what it wrote: for a patch that has to be
+   *  computed from the file rather than from `current()` — see updatePrefs. */
+  update: async mutate => (_prefs = await updatePrefs(mutate)),
+});

package/src/server/process-command.mjs

@@ -0,0 +1,104 @@
+// What of a process's command line the Machine panel may show: the arguments,
+// with the executable that carries them taken off the front (commandTail), and
+// then with the shapes a secret takes removed and the rest capped
+// (redactCommand).
+//
+// Moved out of process-list.mjs unchanged. attachDetail there runs both on
+// every candidate's argument vector before it leaves that module, because
+// /api/system/processes answers anything that can reach the loopback port;
+// process-list.mjs re-exports CMD_MAX, redactCommand and commandTail, which is
+// where the suite reaches them.
+
+/**
+ * An argument vector with the parts that must not be looked at taken out, and
+ * the parts nobody reads cut off.
+ *
+ * THIS IS A BLOCKLIST AND A BLOCKLIST LEAKS. It is written down here rather
+ * than implied, because the alternative — `comm`, which is what this replaced —
+ * leaked nothing and told the reader nothing either. What it removes is the
+ * shapes a secret actually takes on a command line; what it cannot remove is a
+ * secret that looks like an ordinary word, and no rule here pretends otherwise.
+ *
+ * The cap is the other half, and it is not a nicety. Measured on this machine:
+ * one Chrome helper's argv is 906 characters of `--field-trial-handle`,
+ * base64 `--gpu-preferences` and shared-memory handles. Forty of those is 36 KB
+ * on the wire every four seconds to render a column nobody can read. What
+ * identifies a process is its first few arguments — `ng serve admin-portal
+ * --port 44440` — and that is what fits.
+ */
+export const CMD_MAX = 180;
+
+const SECRET_FLAG =
+  /(-{1,2}[\w.-]*(?:token|password|passwd|secret|api[-_]?key|apikey|auth|credential|bearer|cookie|session[-_]?id|private[-_]?key)[\w.-]*)(=|\s+)(\S+)/gi;
+// The shapes that are a secret on their own, with no flag in front of them.
+const BARE_SECRET =
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{12,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,})/g;
+// user:password@host, in any URL. The password goes; the rest is a location.
+const URL_CREDENTIALS = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:@/]+):[^\s@/]+@/gi;
+
+export function redactCommand(argv, home = "") {
+  let s = String(argv ?? "").trim();
+  if (!s) return "";
+  s = s.replace(SECRET_FLAG, (_, flag, sep, value) => `${flag}${sep === "=" ? "=" : " "}\u2022\u2022\u2022`);
+  s = s.replace(URL_CREDENTIALS, "$1:\u2022\u2022\u2022@");
+  s = s.replace(BARE_SECRET, "\u2022\u2022\u2022");
+  // `~` last, so a home path inside a redacted value is already gone. Only a
+  // whole path segment, so a user called `con` cannot rewrite the middle of an
+  // unrelated word.
+  if (home && home.length > 1) s = s.split(home + "/").join("~/").split(home + " ").join("~ ");
+  if (s.length > CMD_MAX) s = s.slice(0, CMD_MAX - 1).trimEnd() + "\u2026";
+  return s;
+}
+
+/**
+ * The ARGUMENTS, with the executable that carries them taken off the front.
+ *
+ * The name column already says `Google Chrome Helper`; repeating
+ * `/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome
+ * Framework.framework/Versions/152.0.7977.76/Helpers/Google Chrome
+ * Helper.app/Contents/MacOS/Google Chrome Helper` beside it spends the entire
+ * 180-character budget on a path the reader can already see the end of, and
+ * cuts off `--type=renderer`, which is the part that says WHICH helper this is.
+ *
+ * argv[0] cannot be found by splitting on whitespace — on macOS the executable
+ * path routinely contains spaces, and `/Applications/Google Chrome.app/…` would
+ * be cut at "Google". The name from the first `ps` call is what resolves it:
+ * argv begins with a path whose last segment IS that name.
+ *
+ * "Last segment" is the whole of the rule, and the first version of this got it
+ * wrong in a way only the render showed. A plain `indexOf` cuts at the FIRST
+ * occurrence, and a macOS bundle contains the name twice — `…/Helpers/Google
+ * Chrome Helper.app/Contents/MacOS/Google Chrome Helper` — so every browser row
+ * read `.app/Contents/MacOS/Google Chrome Helper --type=gpu-process`, having
+ * spent the budget on the half of the path it was supposed to remove. A plain
+ * `lastIndexOf` is wrong the other way: `node /srv/node_modules/x` would cut
+ * inside `node_modules`.
+ *
+ * So: the first occurrence that a path segment actually ends at — preceded by a
+ * separator or nothing, followed by whitespace or nothing. `node /srv/app.js
+ * --port 3000` leaves `/srv/app.js --port 3000`; `/usr/local/bin/dotnet exec
+ * --runtimeconfig …` leaves `exec --runtimeconfig …`, which is what identifies
+ * it.
+ *
+ * When the name is not in argv at all — a process that rewrote argv[0], or a
+ * `comm` that Linux truncated at 15 characters — the first whitespace token
+ * goes only if it looks like a path, because dropping the first word of
+ * something already short would take the only word there was.
+ */
+export function commandTail(argv, name) {
+  const s = String(argv ?? "").trim();
+  if (!s) return "";
+  const n = String(name ?? "").trim();
+  if (n) {
+    for (let at = s.indexOf(n); at >= 0; at = s.indexOf(n, at + 1)) {
+      const before = at === 0 ? "" : s[at - 1];
+      const after = s[at + n.length] ?? "";
+      if ((before === "" || before === "/" || before === "\\" || /\s/.test(before))
+        && (after === "" || /\s/.test(after))) {
+        return s.slice(at + n.length).trim();
+      }
+    }
+  }
+  const first = s.split(/\s+/)[0] ?? "";
+  return first.includes("/") ? s.slice(first.length).trim() : s;
+}