ddeck-remote 0.0.0-stage → 0.9.7-beta

package/lib/tls.js

@@ -0,0 +1,173 @@
+/**
+ * Certificates for the gateway.
+ *
+ * HTTPS is not an optional hardening step here: the phone's manifest forbids cleartext,
+ * so a plain-HTTP listener is a door nobody can open. The certificate must exist before
+ * the first pairing, and it must stay the same afterwards — the phone pins the CA
+ * fingerprint it learned, and a CA that changed on restart would break every phone
+ * already connected.
+ *
+ * The gateway's own contract decides the shape: `instanceId` must equal the SHA-256
+ * fingerprint of the pairing CA, and the leaf must be signed by that CA. So the CA is
+ * generated first, its fingerprint becomes the installation's identity, and the leaf is
+ * signed by it with the machine's address in `subjectAltName`.
+ *
+ * @module dsh-remote/tls
+ */
+
+import { createHash } from 'node:crypto'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { isIP } from 'node:net'
+import { join } from 'node:path'
+import forge from './node-forge-bundle.js'
+
+/** How long the installation CA lives: re-pinning every phone is the cost of shorter. */
+const CA_DAYS = 3650
+
+/** How long the leaf lives; short enough to rotate without touching the CA. */
+const LEAF_DAYS = 397
+
+/**
+ * Read a file, or return undefined when it is not there.
+ *
+ * @param {string} file
+ * @returns {Promise<string | undefined>}
+ */
+async function readIfPresent(file) {
+  try {
+    return await readFile(file, 'utf8')
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * SHA-256 of a DER certificate, lower-case hex without separators.
+ *
+ * This is exactly what the gateway compares against `instanceId`, and what the phone
+ * pins after pairing.
+ *
+ * @param {string} pem - certificate in PEM form.
+ * @returns {string} 64 hex characters.
+ */
+export function certificateFingerprint(pem) {
+  const der = forge.pem.decode(pem)[0].body
+  return createHash('sha256').update(der, 'binary').digest('hex')
+}
+
+/**
+ * Make a key pair.
+ *
+ * 2048 bits: the phone may be a modest device, and a longer key only slows the handshake
+ * down for no benefit on a home network.
+ *
+ * @returns {object} forge key pair.
+ */
+function keyPair() {
+  return forge.pki.rsa.generateKeyPair({ bits: 2048, workers: -1 })
+}
+
+/**
+ * Build the installation CA.
+ *
+ * @returns {{ cert: string, key: string, fingerprint: string }}
+ */
+function createCa() {
+  const pair = keyPair()
+  const certificate = forge.pki.createCertificate()
+  certificate.publicKey = pair.publicKey
+  certificate.serialNumber = `01${forge.util.bytesToHex(forge.random.getBytesSync(8))}`
+  certificate.validity.notBefore = new Date(Date.now() - 60_000)
+  certificate.validity.notAfter = new Date(Date.now() + CA_DAYS * 24 * 60 * 60 * 1000)
+  const attributes = [
+    { name: 'commonName', value: 'DDeck CA' },
+    { name: 'organizationName', value: 'DDeck' },
+  ]
+  certificate.setSubject(attributes)
+  certificate.setIssuer(attributes)
+  certificate.setExtensions([
+    { name: 'basicConstraints', cA: true, critical: true },
+    { name: 'keyUsage', keyCertSign: true, cRLSign: true, critical: true },
+  ])
+  certificate.sign(pair.privateKey, forge.md.sha256.create())
+  const cert = forge.pki.certificateToPem(certificate)
+  return { cert, key: forge.pki.privateKeyToPem(pair.privateKey), fingerprint: certificateFingerprint(cert) }
+}
+
+/**
+ * Sign a leaf for one address with the installation CA.
+ *
+ * @param {{ cert: string, key: string }} ca - the installation CA.
+ * @param {string} host - IPv4 address the phone dials.
+ * @returns {{ cert: string, key: string }}
+ */
+function createLeaf(ca, host) {
+  // A host list lets the same leaf cover the LAN address and a Tailscale name
+  // (`DSH_REMOTE_ORIGINS`); the first entry is the common name.
+  const hosts = String(host).split(',').map((entry) => entry.trim()).filter(Boolean)
+  const primary = hosts[0]
+  const pair = keyPair()
+  const certificate = forge.pki.createCertificate()
+  certificate.publicKey = pair.publicKey
+  certificate.serialNumber = `02${forge.util.bytesToHex(forge.random.getBytesSync(8))}`
+  certificate.validity.notBefore = new Date(Date.now() - 60_000)
+  certificate.validity.notAfter = new Date(Date.now() + LEAF_DAYS * 24 * 60 * 60 * 1000)
+  certificate.setSubject([{ name: 'commonName', value: primary }])
+  certificate.setIssuer(forge.pki.certificateFromPem(ca.cert).subject.attributes)
+  // Tailscale uses names (`mac.tailnet.ts.net`) as well as 100.x addresses. An IP in
+  // the `ip` field is what node-forge accepts for IP SANs; a DNS name belongs in a
+  // `dns` entry (type 2) — putting it in `ip` throws and the gateway would not start.
+  const altNames = hosts.map((entry) => (isIP(entry) === 0
+    ? { type: 2, value: entry }
+    : { type: 7, ip: entry }))
+    certificate.setExtensions([
+    { name: 'basicConstraints', cA: false },
+    { name: 'keyUsage', digitalSignature: true, keyEncipherment: true, critical: true },
+    { name: 'extKeyUsage', serverAuth: true },
+    { name: 'subjectAltName', altNames },
+  ])
+  certificate.sign(forge.pki.privateKeyFromPem(ca.key), forge.md.sha256.create())
+  return { cert: forge.pki.certificateToPem(certificate), key: forge.pki.privateKeyToPem(pair.privateKey) }
+}
+
+/**
+ * Load the installation's certificates, creating them on first use.
+ *
+ * @param {string} stateDirectory - where the material lives.
+ * @param {string} host - address the phone will dial.
+ * @returns {Promise<{ caFile: string, certFile: string, keyFile: string, instanceId: string }>}
+ */
+export async function ensureCertificates(stateDirectory, host) {
+  const directory = join(stateDirectory, 'tls')
+  await mkdir(directory, { recursive: true })
+  const caFile = join(directory, 'ca.pem')
+  const caKeyFile = join(directory, 'ca-key.pem')
+  const certFile = join(directory, 'server.pem')
+  const keyFile = join(directory, 'server-key.pem')
+  const hostFile = join(directory, 'leaf-host.txt')
+
+  let ca = await readIfPresent(caFile)
+  let caKey = await readIfPresent(caKeyFile)
+  if (ca === undefined || caKey === undefined) {
+    const created = createCa()
+    ca = created.cert
+    caKey = created.key
+    await writeFile(caFile, ca, { mode: 0o600 })
+    await writeFile(caKeyFile, caKey, { mode: 0o600 })
+  }
+  const instanceId = certificateFingerprint(ca)
+
+  // The leaf is re-signed when the address changes (a laptop moves between networks) or
+  // when it is missing. The CA stays, so phones keep their pin.
+  const previousHost = await readIfPresent(hostFile)
+  const cert = await readIfPresent(certFile)
+  const key = await readIfPresent(keyFile)
+  const wantedHost = String(host)
+  if (cert === undefined || key === undefined || previousHost?.trim() !== wantedHost) {
+    const leaf = createLeaf({ cert: ca, key: caKey }, wantedHost)
+    await writeFile(certFile, leaf.cert, { mode: 0o600 })
+    await writeFile(keyFile, leaf.key, { mode: 0o600 })
+    await writeFile(hostFile, `${wantedHost}\n`, { mode: 0o600 })
+  }
+  return { caFile, certFile, keyFile, instanceId }
+}

package/locale/en.json

@@ -0,0 +1,4 @@
+{
+  "title": "DDeck",
+  "description": "Connect your phone to this computer: show a code, scan it once."
+}

package/locale/ru.json

@@ -0,0 +1,4 @@
+{
+  "title": "DDeck",
+  "description": "Подключите телефон к этому компьютеру: покажите код, отсканируйте его один раз."
+}

package/package.json

@@ -1,6 +1,65 @@
 {
   "name": "ddeck-remote",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.9.7-beta",
+  "private": false,
+  "type": "module",
+  "description": "Connect your phone to DeepSeek Harness: one code on the computer, one scan on the phone.",
+  "license": "Apache-2.0",
+  "main": "./lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./icon": "./icon.svg",
+    "./locale/*.json": "./locale/*.json",
+    "./package.json": "./package.json",
+    "./client": "./lib/client.js"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "install.sh",
+    "install.ps1",
+    "install.cmd",
+    "uninstall.sh",
+    "uninstall.ps1",
+    "icon.svg",
+    "locale/*.json",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "THIRD-PARTY-LICENSES.md"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nemezida1337/ddeck-client.git"
+  },
+  "homepage": "https://github.com/nemezida1337/ddeck-client#readme",
+  "bugs": {
+    "url": "https://github.com/nemezida1337/ddeck-client/issues"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "remote",
+    "android",
+    "plugin"
+  ],
+  "engines": {
+    "dsh": "^0.1.5-rc.1 || ^0.2.1-rc.2"
+  },
+  "devDependencies": {
+    "qrcode": "^1.5.4",
+    "node-forge": "^1.3.1",
+    "esbuild": "^0.28.2"
+  }
+}

package/uninstall.ps1

@@ -0,0 +1,60 @@
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Удаляет плагин DDeck из профиля DeepSeek Harness на Windows.
+.DESCRIPTION
+  Убирает link-зависимость, бандл, строку cordis.patch.yml и junction.
+  Данные сопряжений в ~/.dsh/dsh-remote не трогает.
+#>
+[CmdletBinding()]
+param([string]$Profile = $env:DSH_PROFILE)
+
+$ErrorActionPreference = 'Stop'
+$PackageName = 'ddeck-remote'
+$LegacyName = 'dsh-remote'
+if ([string]::IsNullOrWhiteSpace($Profile)) {
+  $Profile = Join-Path $HOME '.dsh\profiles\desktop'
+} elseif (-not [System.IO.Path]::IsPathRooted($Profile)) {
+  $Profile = Join-Path (Join-Path $HOME '.dsh\profiles') $Profile
+}
+if (-not (Test-Path $Profile)) { throw "профиль DSH не найден: $Profile" }
+$Profile = (Resolve-Path $Profile).Path
+
+$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
+$backup = Join-Path $Profile ".dsh-remote-backups\$stamp"
+New-Item -ItemType Directory -Path $backup -Force | Out-Null
+$manifestPath = Join-Path $Profile 'package.json'
+if (Test-Path $manifestPath) {
+  Copy-Item $manifestPath (Join-Path $backup 'package.json') -Force
+  $manifest = Get-Content $manifestPath -Raw | ConvertFrom-Json
+  if ($manifest.PSObject.Properties['dependencies']) {
+    foreach ($name in @($PackageName, $LegacyName)) {
+      $manifest.dependencies.PSObject.Properties.Remove($name)
+    }
+  }
+  if ($manifest.PSObject.Properties['dsh'] -and $manifest.dsh.PSObject.Properties['profile'] -and $manifest.dsh.profile.PSObject.Properties['bundles']) {
+    $manifest.dsh.profile.bundles = @($manifest.dsh.profile.bundles | Where-Object { $_ -ne $PackageName -and $_ -ne $LegacyName })
+  }
+  [System.IO.File]::WriteAllText($manifestPath, (($manifest | ConvertTo-Json -Depth 50) + [Environment]::NewLine), (New-Object System.Text.UTF8Encoding($false)))
+}
+$patchPath = Join-Path $Profile 'cordis.patch.yml'
+if (Test-Path $patchPath) {
+  Copy-Item $patchPath (Join-Path $backup 'cordis.patch.yml') -Force
+  $patch = Get-Content $patchPath -Raw
+  foreach ($name in @($PackageName, $LegacyName)) {
+    $pattern = '(?ms)^\s*[-]\s*insert:\s*\r?\n\s*-\s*id:\s*' + [regex]::Escape($name) + '\s*\r?\n\s*name:\s*' + [regex]::Escape($name) + '\s*\r?\n?'
+    $patch = [regex]::Replace($patch, $pattern, '')
+  }
+  [System.IO.File]::WriteAllText($patchPath, $patch, (New-Object System.Text.UTF8Encoding($false)))
+}
+foreach ($name in @($PackageName, $LegacyName)) {
+  $target = Join-Path (Join-Path $Profile 'node_modules') $name
+  if (-not (Test-Path $target)) { continue }
+  $item = Get-Item $target -Force
+  if ($item.LinkType -eq 'Junction') {
+    $item.Delete()
+  } else {
+    Move-Item $target (Join-Path $backup "node_modules-$name.old") -Force
+  }
+}
+Write-Host "DDeck удалён. Бэкап: $backup`nПерезапустите DeepSeek Harness."

package/uninstall.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# Удаляет DDeck из профиля DSH, не трогая данные сопряжений (~/.dsh/dsh-remote).
+set -eu
+PROFILE="${1:-${DSH_PROFILE:-$HOME/.dsh/profiles/desktop}}"
+# DSH выставляет DSH_PROFILE как имя профиля («desktop»), а не путь.
+case "$PROFILE" in /*) ;; *) PROFILE="$HOME/.dsh/profiles/$PROFILE" ;; esac
+[ -d "$PROFILE" ] || { echo "профиль DSH не найден: $PROFILE" >&2; exit 1; }
+python3 - "$PROFILE" <<'PY'
+import json, pathlib, sys
+profile = pathlib.Path(sys.argv[1])
+manifest = profile / 'package.json'
+if manifest.exists():
+    data = json.loads(manifest.read_text())
+    for name in ('ddeck-remote', 'dsh-remote'):
+        data.get('dependencies', {}).pop(name, None)
+    bundles = data.get('dsh', {}).get('profile', {}).get('bundles', [])
+    for name in ('ddeck-remote', 'dsh-remote'):
+        while name in bundles:
+            bundles.remove(name)
+    manifest.write_text(json.dumps(data, ensure_ascii=False, indent=2) + '\n')
+patch = profile / 'cordis.patch.yml'
+if patch.exists():
+    text = patch.read_text()
+    for name in ('ddeck-remote', 'dsh-remote'):
+        marker = f"- insert:\n    - id: {name}\n      name: {name}\n"
+        text = text.replace(marker, '')
+    patch.write_text(text)
+PY
+rm -f "$PROFILE/node_modules/ddeck-remote" "$PROFILE/node_modules/dsh-remote"
+echo "DDeck удалён из профиля. Данные сопряжений остались в ~/.dsh/dsh-remote."
+echo "Перезапустите DeepSeek Harness."