dsh-mobile 0.1.0-alpha.2 → 0.1.0-alpha.21

package/lib/cli.js

@@ -1,10 +1,32 @@
 #!/usr/bin/env node
-import { X509Certificate } from "node:crypto";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
 import { generate } from "selfsigned";
-//#region src/cli.ts
+//#region src/managed-setup.ts
+const execFile$2 = promisify(execFile);
+const VIRTUAL_INTERFACE_MARKERS = [
+	"bridge",
+	"docker",
+	"hyper-v",
+	"mihomo",
+	"radmin",
+	"tailscale",
+	"tap",
+	"tun",
+	"utun",
+	"vbox",
+	"veth",
+	"virtual",
+	"vmware",
+	"vpn",
+	"vethernet",
+	"wsl",
+	"zerotier"
+];
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -19,93 +41,201 @@ function networkCidr(address, cidr) {
 		0
 	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
 }
-function availableAddresses() {
-	const candidates = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
 		address: entry.address,
 		cidr: networkCidr(entry.address, entry.cidr)
-	}));
-	return [...new Map(candidates.map((entry) => [entry.address, entry])).values()];
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
 }
-function parseOptions(args) {
-	let address;
-	let port = 3443;
-	let dshPort = 3080;
-	for (let index = 0; index < args.length; index += 1) {
-		const name = args[index];
-		const value = args[index + 1];
-		if (name === "--address" && value !== void 0) {
-			address = value;
-			index += 1;
-			continue;
-		}
-		if (name === "--port" && value !== void 0) {
-			port = Number(value);
-			index += 1;
-			continue;
+function likelyVirtualInterface(name) {
+	const normalized = name.toLowerCase().replaceAll(/[^a-z0-9]+/gu, " ");
+	return VIRTUAL_INTERFACE_MARKERS.some((marker) => normalized.includes(marker.replaceAll("-", " "))) || /^(?:br|wg)\d*\b/u.test(normalized);
+}
+async function runRouteCommand(file, args) {
+	return (await execFile$2(file, [...args], {
+		encoding: "utf8",
+		windowsHide: true
+	})).stdout;
+}
+function uniqueLines(output) {
+	return [...new Set(output.split(/\r?\n/gu).map((line) => line.trim()).filter(Boolean))];
+}
+/** Return operating-system default-route interfaces in routing preference order. */
+async function preferredLanInterfaceNames(platform = process.platform, run = runRouteCommand) {
+	try {
+		if (platform === "win32") return uniqueLines(await run("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			[
+				"$routes = Get-NetRoute -AddressFamily IPv4 -DestinationPrefix '0.0.0.0/0' -ErrorAction Stop",
+				"$ranked = $routes | Where-Object { $_.State -eq 'Alive' -and $_.NextHop -ne '0.0.0.0' } | ForEach-Object {",
+				"  $route = $_",
+				"  $adapter = Get-NetAdapter -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue",
+				"  $ip = Get-NetIPInterface -AddressFamily IPv4 -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue",
+				"  if ($adapter -and $ip -and $adapter.Status -eq 'Up' -and $adapter.HardwareInterface -eq $true -and $adapter.Virtual -ne $true) {",
+				"    [pscustomobject]@{ Name = $route.InterfaceAlias; Metric = [int]$route.RouteMetric + [int]$ip.InterfaceMetric }",
+				"  }",
+				"}",
+				"$ranked | Sort-Object Metric | Select-Object -ExpandProperty Name -Unique"
+			].join("; ")
+		]));
+		if (platform === "linux") {
+			const routes = uniqueLines(await run("ip", [
+				"-o",
+				"-4",
+				"route",
+				"show",
+				"default"
+			])).map((line) => ({
+				name: /(?:^|\s)dev\s+(\S+)/u.exec(line)?.[1],
+				metric: Number(/(?:^|\s)metric\s+(\d+)/u.exec(line)?.[1] ?? 0)
+			})).filter((route) => route.name !== void 0 && !likelyVirtualInterface(route.name)).sort((left, right) => left.metric - right.metric);
+			return [...new Set(routes.map((route) => route.name))];
 		}
-		if (name === "--dsh-port" && value !== void 0) {
-			dshPort = Number(value);
-			index += 1;
-			continue;
+		if (platform === "darwin") {
+			const name = /^\s*interface:\s*(\S+)\s*$/mu.exec(await run("route", [
+				"-n",
+				"get",
+				"default"
+			]))?.[1];
+			return name === void 0 || likelyVirtualInterface(name) ? [] : [name];
 		}
-		throw new Error(`unknown setup option: ${name ?? ""}`);
-	}
-	if (!Number.isSafeInteger(port) || port < 1024 || port > 65535) throw new Error("--port must be from 1024 through 65535");
-	if (!Number.isSafeInteger(dshPort) || dshPort < 1024 || dshPort > 65535) throw new Error("--dsh-port must be from 1024 through 65535");
-	if (address !== void 0 && !privateIpv4(address)) throw new Error("--address must be a private IPv4 address");
-	return {
-		...address === void 0 ? {} : { address },
-		port,
-		dshPort
-	};
+	} catch {}
+	return [];
 }
-function selectNetwork(requested) {
-	const candidates = availableAddresses();
-	if (requested !== void 0) {
-		const match = candidates.find((candidate) => candidate.address === requested);
-		if (match === void 0) throw new Error(`--address ${requested} is not an active private LAN address`);
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table, preferredInterfaces = []) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
 		return match;
 	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
 	if (candidates.length === 1) return candidates[0];
 	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
-	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
+	for (const name of preferredInterfaces) {
+		const matches = candidates.filter((candidate) => candidate.name === name);
+		if (matches.length === 1) return matches[0];
+	}
+	const physicalCandidates = candidates.filter((candidate) => !likelyVirtualInterface(candidate.name));
+	if (physicalCandidates.length === 1) return physicalCandidates[0];
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => `${entry.name}=${entry.address}`).join(", ")}`);
 }
-function dshHome() {
-	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
 }
-async function setup(args) {
-	const options = parseOptions(args);
-	const network = selectNetwork(options.address);
-	const home = dshHome();
-	const directory = join(home, "mobile-access");
-	const tls = join(directory, "tls");
-	await mkdir(tls, {
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
 		recursive: true,
 		mode: 448
 	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
+async function ensureManagedCa(setup, legacy) {
+	let certPem;
+	let keyPem;
+	try {
+		[certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		let migrated = false;
+		if (legacy !== void 0) try {
+			[certPem, keyPem] = await Promise.all([readFile(legacy.certFile, "utf8"), readFile(legacy.keyFile, "utf8")]);
+			assertMatchingCa(certPem, keyPem);
+			migrated = true;
+		} catch (legacyError) {
+			if (legacyError.code !== "ENOENT") throw legacyError;
+		}
+		if (!migrated) {
+			const now = /* @__PURE__ */ new Date();
+			const notAfter = new Date(now);
+			notAfter.setFullYear(notAfter.getFullYear() + 5);
+			const generated = await generate([{
+				name: "commonName",
+				value: "DeepSeek Harness Mobile CA"
+			}], {
+				keyType: "ec",
+				curve: "P-256",
+				algorithm: "sha256",
+				notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+				notAfterDate: notAfter,
+				extensions: [{
+					name: "basicConstraints",
+					cA: true,
+					critical: true
+				}, {
+					name: "keyUsage",
+					digitalSignature: true,
+					keyCertSign: true,
+					cRLSign: true,
+					critical: true
+				}]
+			});
+			certPem = generated.cert;
+			keyPem = generated.private;
+		}
+		if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+		await Promise.all([atomicWrite(setup.caCertFile, certPem), atomicWrite(setup.caKeyFile, keyPem)]);
+	}
+	if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+	return assertMatchingCa(certPem, keyPem);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
 	const now = /* @__PURE__ */ new Date();
 	const notAfter = new Date(now);
 	notAfter.setDate(notAfter.getDate() + 397);
-	const certificate = await generate([{
+	const server = await generate([{
 		name: "commonName",
-		value: network.address
+		value: "DeepSeek Harness Mobile"
 	}], {
 		keyType: "ec",
 		curve: "P-256",
 		algorithm: "sha256",
 		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
 		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
 		extensions: [
 			{
 				name: "basicConstraints",
-				cA: true,
+				cA: false,
 				critical: true
 			},
 			{
 				name: "keyUsage",
 				digitalSignature: true,
-				keyCertSign: true,
-				cRLSign: true,
 				critical: true
 			},
 			{
@@ -116,24 +246,138 @@ async function setup(args) {
 				name: "subjectAltName",
 				altNames: [{
 					type: 7,
-					ip: network.address
+					ip: address
 				}]
 			}
 		]
 	});
-	const certFile = join(tls, "cert.pem");
-	const keyFile = join(tls, "key.pem");
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
+}
+//#endregion
+//#region src/cli.ts
+const execFile$1 = promisify(execFile);
+const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
+const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
+function parseOptions(args) {
+	let address;
+	let port = 3443;
+	let dshPort = 3080;
+	let configureFirewall = true;
+	for (let index = 0; index < args.length; index += 1) {
+		const name = args[index];
+		const value = args[index + 1];
+		if (name === "--address" && value !== void 0) {
+			address = value;
+			index += 1;
+			continue;
+		}
+		if (name === "--port" && value !== void 0) {
+			port = Number(value);
+			index += 1;
+			continue;
+		}
+		if (name === "--dsh-port" && value !== void 0) {
+			dshPort = Number(value);
+			index += 1;
+			continue;
+		}
+		if (name === "--no-firewall") {
+			configureFirewall = false;
+			continue;
+		}
+		throw new Error(`unknown setup option: ${name ?? ""}`);
+	}
+	if (!Number.isSafeInteger(port) || port < 1024 || port > 65535) throw new Error("--port must be from 1024 through 65535");
+	if (!Number.isSafeInteger(dshPort) || dshPort < 1024 || dshPort > 65535) throw new Error("--dsh-port must be from 1024 through 65535");
+	return {
+		...address === void 0 ? {} : { address },
+		port,
+		dshPort,
+		configureFirewall
+	};
+}
+function dshHome() {
+	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
+}
+async function runElevatedPowerShell(script) {
+	const launch = [
+		"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
+		`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(script, "utf16le").toString("base64")}')`,
+		"; exit $process.ExitCode"
+	].join(" ");
+	await execFile$1("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-Command",
+		launch
+	], { windowsHide: true });
+}
+async function configureWindowsFirewall(port) {
+	if (process.platform !== "win32") return;
+	const script = [
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`
+	].join("; ");
+	console.log("Windows will request administrator approval for two LAN-only firewall rules.");
+	await runElevatedPowerShell(script);
+}
+async function removeWindowsFirewall() {
+	if (process.platform !== "win32") return;
+	await runElevatedPowerShell([
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
+	].join("; "));
+}
+async function setup(args) {
+	const options = parseOptions(args);
+	const preferredInterfaces = options.address === void 0 ? await preferredLanInterfaceNames() : [];
+	const network = selectLanNetwork(options.address, void 0, void 0, preferredInterfaces);
+	const home = dshHome();
+	const directory = join(home, "mobile-access");
+	const tls = join(directory, "tls");
+	await mkdir(tls, {
+		recursive: true,
+		mode: 448
+	});
+	const legacyCertFile = join(tls, "cert.pem");
+	const legacyKeyFile = join(tls, "key.pem");
+	const certFile = join(tls, "server-cert.pem");
+	const keyFile = join(tls, "server-key.pem");
+	const caCertFile = join(tls, "ca.pem");
+	const caKeyFile = join(tls, "ca-key.pem");
 	const androidCertificate = join(tls, "dsh-mobile-ca.cer");
+	const managedTls = {
+		mode: "managed",
+		caCertFile,
+		caKeyFile,
+		certFile,
+		keyFile
+	};
+	const ca = await ensureManagedCa(managedTls, {
+		certFile: legacyCertFile,
+		keyFile: legacyKeyFile
+	});
+	const managedSetup = {
+		version: 2,
+		networkInterface: network.name,
+		listenPort: options.port,
+		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
+		tls: managedTls
+	};
+	await refreshManagedServerCertificate(managedSetup, network.address);
+	await writeFile(androidCertificate, ca.raw, { mode: 384 });
 	await Promise.all([
-		writeFile(certFile, certificate.cert, { mode: 384 }),
-		writeFile(keyFile, certificate.private, { mode: 384 }),
-		writeFile(androidCertificate, new X509Certificate(certificate.cert).raw, { mode: 384 })
-	]);
-	await Promise.all([
+		chmod(caCertFile, 384),
+		chmod(caKeyFile, 384),
 		chmod(certFile, 384),
 		chmod(keyFile, 384),
 		chmod(androidCertificate, 384)
 	]);
+	if (options.configureFirewall) await configureWindowsFirewall(options.port);
 	const customCss = join(directory, "mobile.css");
 	try {
 		await readFile(customCss);
@@ -165,22 +409,14 @@ async function setup(args) {
 	}
 	const origin = `https://${network.address}:${String(options.port)}`;
 	await Promise.all([writeFile(join(directory, "setup.json"), `${JSON.stringify({
-		version: 1,
-		publicOrigin: origin,
-		listenHost: network.address,
-		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
-		allowedCidrs: [network.cidr],
-		tls: {
-			mode: "provided",
-			certFile: certFile.replaceAll("\\", "/"),
-			keyFile: keyFile.replaceAll("\\", "/")
-		}
+		...managedSetup,
+		tls: Object.fromEntries(Object.entries(managedSetup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
 	}, null, 2)}\n`, { mode: 384 }), writeFile(join(directory, "control.json"), "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
-	console.log(`DSH Mobile is configured for ${origin}`);
-	console.log(`Install this certificate on Android before connecting: ${androidCertificate}`);
+	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${origin}`);
+	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
 	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);
 	console.log("Start DSH with: dsh --profile web");
-	console.log("Then open the Mobile card in the lower-left corner and create a pairing link.");
+	console.log("Then open the Mobile card in the lower-left corner and create a pairing key.");
 }
 async function purge(args) {
 	if (args.length !== 1 || args[0] !== "--yes") throw new Error("purge requires --yes");
@@ -189,11 +425,12 @@ async function purge(args) {
 		recursive: true,
 		force: true
 	});
+	await removeWindowsFirewall();
 	console.log("Removed DSH Mobile certificates, devices, preferences, and custom Web files.");
 }
 function help() {
 	console.log([
-		"dsh-mobile setup [--address 192.168.x.x] [--port 3443] [--dsh-port 3080]",
+		"dsh-mobile setup [--address 192.168.x.x] [--port 3443] [--dsh-port 3080] [--no-firewall]",
 		"dsh-mobile purge --yes",
 		"",
 		"Run through the DSH profile:",