dsh-mobile 0.3.16 → 0.4.1

package/lib/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { execFile } from "node:child_process";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
+import { execFile } from "node:child_process";
 import { generate } from "selfsigned";
 import "@deepseek-ai/cordis";
 import "@deepseek-ai/schemastery";
@@ -96,6 +96,8 @@ const VIRTUAL_INTERFACE_MARKERS = [
 	"wsl",
 	"zerotier"
 ];
+/** Route inspection is advisory; never let a system command hold setup open indefinitely. */
+const ROUTE_COMMAND_TIMEOUT_MS = 5e3;
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -126,7 +128,7 @@ function likelyVirtualInterface(name) {
 async function runRouteCommand(file, args) {
 	return (await execFileText(file, [...args], {
 		encoding: "utf8",
-		windowsHide: true
+		timeout: ROUTE_COMMAND_TIMEOUT_MS
 	})).stdout;
 }
 function uniqueLines(output) {
@@ -324,6 +326,88 @@ async function refreshManagedServerCertificate(setup, address) {
 	});
 	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
 }
+//#endregion
+//#region src/lan-setup.ts
+const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
+const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
+async function runElevatedPowerShell(script) {
+	await execFileText("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-Command",
+		[
+			"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
+			`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(script, "utf16le").toString("base64")}')`,
+			"; exit $process.ExitCode"
+		].join(" ")
+	], { windowsHide: true });
+}
+/** Install the two Windows inbound rules used by the managed LAN listener. */
+async function configureWindowsFirewall(port) {
+	if (process.platform !== "win32") return;
+	await runElevatedPowerShell([
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`
+	].join("; "));
+}
+/** Remove only the two Windows firewall rules owned by DSH Mobile. */
+async function removeWindowsFirewall() {
+	if (process.platform !== "win32") return;
+	await runElevatedPowerShell([
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
+	].join("; "));
+}
+/** Generate private TLS material and persist a managed setup selected by the user. */
+async function prepareManagedLanSetup(options) {
+	if (!isAbsolute(options.setupFile) || !isAbsolute(options.controlFile)) throw new Error("managed LAN setup paths must be absolute");
+	if (!Number.isSafeInteger(options.listenPort) || options.listenPort < 1024 || options.listenPort > 65535) throw new Error("managed LAN listenPort must be from 1024 through 65535");
+	if (!Number.isSafeInteger(options.dshPort) || options.dshPort < 1024 || options.dshPort > 65535) throw new Error("managed LAN dshPort must be from 1024 through 65535");
+	const directory = dirname(options.setupFile);
+	const tlsDirectory = join(directory, "tls");
+	await mkdir(tlsDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	const managedTls = {
+		mode: "managed",
+		caCertFile: join(tlsDirectory, "ca.pem"),
+		caKeyFile: join(tlsDirectory, "ca-key.pem"),
+		certFile: join(tlsDirectory, "server-cert.pem"),
+		keyFile: join(tlsDirectory, "server-key.pem")
+	};
+	const ca = await ensureManagedCa(managedTls, {
+		certFile: join(tlsDirectory, "cert.pem"),
+		keyFile: join(tlsDirectory, "key.pem")
+	});
+	const setup = {
+		version: 2,
+		networkInterface: options.network.name,
+		listenPort: options.listenPort,
+		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
+		tls: managedTls
+	};
+	await refreshManagedServerCertificate(setup, options.network.address);
+	const androidCertificate = join(tlsDirectory, "dsh-mobile-ca.cer");
+	await writeFile(androidCertificate, ca.raw, { mode: 384 });
+	await Promise.all([...Object.values(managedTls).filter((value) => value !== "managed").map((file) => restrictPrivateFile(file)), restrictPrivateFile(androidCertificate)]);
+	if (options.configureFirewall) await configureWindowsFirewall(options.listenPort);
+	await Promise.all([writeFile(options.setupFile, `${JSON.stringify({
+		...setup,
+		tls: Object.fromEntries(Object.entries(setup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
+	}, null, 2)}\n`, { mode: 384 }), writeFile(options.controlFile, "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
+	await Promise.all([restrictPrivateFile(options.setupFile), restrictPrivateFile(options.controlFile)]);
+	return Object.freeze({
+		setup: Object.freeze(setup),
+		network: Object.freeze({ ...options.network }),
+		origin: `https://${options.network.address}:${String(options.listenPort)}`,
+		androidCertificate
+	});
+}
 Object.freeze({
 	manifest: 65536,
 	script: 1048576,
@@ -351,8 +435,6 @@ function assertExtensionId(value) {
 }
 //#endregion
 //#region src/cli.ts
-const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
-const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
 function parseOptions(args) {
 	let address;
 	let port = 3443;
@@ -394,84 +476,16 @@ function parseOptions(args) {
 function dshHome() {
 	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
 }
-async function runElevatedPowerShell(script) {
-	await execFileText("powershell.exe", [
-		"-NoProfile",
-		"-NonInteractive",
-		"-Command",
-		[
-			"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
-			`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(script, "utf16le").toString("base64")}')`,
-			"; exit $process.ExitCode"
-		].join(" ")
-	], { windowsHide: true });
-}
-async function configureWindowsFirewall(port) {
-	if (process.platform !== "win32") return;
-	const script = [
-		"$ErrorActionPreference = 'Stop'",
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`
-	].join("; ");
-	console.log("Windows will request administrator approval for two LAN-only firewall rules.");
-	await runElevatedPowerShell(script);
-}
-async function removeWindowsFirewall() {
-	if (process.platform !== "win32") return;
-	await runElevatedPowerShell([
-		"$ErrorActionPreference = 'Stop'",
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
-	].join("; "));
-}
 async function setup(args) {
 	const options = parseOptions(args);
 	const preferredInterfaces = options.address === void 0 ? await preferredLanInterfaceNames() : [];
 	const network = selectLanNetwork(options.address, void 0, void 0, preferredInterfaces);
 	const home = dshHome();
 	const directory = join(home, "mobile-access");
-	const tls = join(directory, "tls");
-	await mkdir(tls, {
+	await mkdir(directory, {
 		recursive: true,
 		mode: 448
 	});
-	const legacyCertFile = join(tls, "cert.pem");
-	const legacyKeyFile = join(tls, "key.pem");
-	const certFile = join(tls, "server-cert.pem");
-	const keyFile = join(tls, "server-key.pem");
-	const caCertFile = join(tls, "ca.pem");
-	const caKeyFile = join(tls, "ca-key.pem");
-	const androidCertificate = join(tls, "dsh-mobile-ca.cer");
-	const managedTls = {
-		mode: "managed",
-		caCertFile,
-		caKeyFile,
-		certFile,
-		keyFile
-	};
-	const ca = await ensureManagedCa(managedTls, {
-		certFile: legacyCertFile,
-		keyFile: legacyKeyFile
-	});
-	const managedSetup = {
-		version: 2,
-		networkInterface: network.name,
-		listenPort: options.port,
-		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
-		tls: managedTls
-	};
-	await refreshManagedServerCertificate(managedSetup, network.address);
-	await writeFile(androidCertificate, ca.raw, { mode: 384 });
-	await Promise.all([
-		restrictPrivateFile(caCertFile),
-		restrictPrivateFile(caKeyFile),
-		restrictPrivateFile(certFile),
-		restrictPrivateFile(keyFile),
-		restrictPrivateFile(androidCertificate)
-	]);
-	if (options.configureFirewall) await configureWindowsFirewall(options.port);
 	const customCss = join(directory, "mobile.css");
 	try {
 		await readFile(customCss);
@@ -507,14 +521,17 @@ async function setup(args) {
 		mode: 448
 	});
 	await createExtensionScaffold(extensions, "custom", "自定义移动扩展", false);
-	const origin = `https://${network.address}:${String(options.port)}`;
-	await Promise.all([writeFile(join(directory, "setup.json"), `${JSON.stringify({
-		...managedSetup,
-		tls: Object.fromEntries(Object.entries(managedSetup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
-	}, null, 2)}\n`, { mode: 384 }), writeFile(join(directory, "control.json"), "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
-	await Promise.all([restrictPrivateFile(join(directory, "setup.json")), restrictPrivateFile(join(directory, "control.json"))]);
-	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${origin}`);
-	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
+	if (options.configureFirewall && process.platform === "win32") console.log("Windows will request administrator approval for two LAN-only firewall rules.");
+	const result = await prepareManagedLanSetup({
+		setupFile: join(directory, "setup.json"),
+		controlFile: join(directory, "control.json"),
+		network,
+		listenPort: options.port,
+		dshPort: options.dshPort,
+		configureFirewall: options.configureFirewall
+	});
+	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${result.origin}`);
+	console.log(`Install this CA certificate on Android once: ${result.androidCertificate}`);
 	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);
 	console.log(`Additional extensions live in: ${extensions}`);
 	console.log("Start DSH with: dsh --profile web");