dsh-mobile 0.6.3 → 0.6.4

package/lib/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, win32 } from "node:path";
 import { X509Certificate, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
 import { execFile } from "node:child_process";
 import { generate } from "selfsigned";
+import { performance } from "node:perf_hooks";
 import "@deepseek-ai/cordis";
 import "@deepseek-ai/schemastery";
 //#region src/exec-file.ts
@@ -34,24 +35,75 @@ function execFileText(file, args, options = {}) {
 //#endregion
 //#region src/private-file.ts
 let userSidTask;
+function commandFailureDetails(error) {
+	if (error === null || typeof error !== "object") return {};
+	let descriptors;
+	try {
+		descriptors = Object.getOwnPropertyDescriptors(error);
+	} catch (_error) {
+		return {};
+	}
+	const code = descriptors.code?.value;
+	const signal = descriptors.signal?.value;
+	const killed = descriptors.killed?.value;
+	return {
+		...code === null || typeof code === "number" && Number.isSafeInteger(code) || typeof code === "string" && /^[A-Z][A-Z0-9_]{0,63}$/u.test(code) ? { code } : {},
+		...signal === null || typeof signal === "string" && /^SIG[A-Z0-9]{1,16}$/u.test(signal) ? { signal } : {},
+		...typeof killed === "boolean" ? { killed } : {}
+	};
+}
+/** Phase and full await duration, including subprocess creation, without arguments, output or private paths. */
+var PrivateFilePermissionError = class extends Error {
+	stage;
+	elapsedMs;
+	code;
+	signal;
+	killed;
+	constructor(stage, elapsedMs, error) {
+		const details = commandFailureDetails(error);
+		const fields = [
+			...details.code === void 0 ? [] : [`code=${String(details.code)}`],
+			...details.signal === void 0 ? [] : [`signal=${String(details.signal)}`],
+			...details.killed === void 0 ? [] : [`killed=${String(details.killed)}`]
+		];
+		const summary = `Windows private-file ${stage} failed after ${String(elapsedMs)} ms${fields.length === 0 ? "" : ` (${fields.join(", ")})`}`;
+		const cause = Object.assign(/* @__PURE__ */ new Error("Windows permission operation failed"), details);
+		super(summary, { cause });
+		this.stage = stage;
+		this.elapsedMs = elapsedMs;
+		this.name = "PrivateFilePermissionError";
+		this.code = details.code;
+		this.signal = details.signal;
+		this.killed = details.killed;
+	}
+};
+async function permissionOperation(stage, operation) {
+	const started = performance.now();
+	try {
+		return await operation();
+	} catch (error) {
+		throw new PrivateFilePermissionError(stage, Math.max(0, Math.round(performance.now() - started)), error);
+	}
+}
 function windowsSystemTool(name) {
 	const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;
-	if (systemRoot === void 0 || !win32.isAbsolute(systemRoot)) throw new Error("Windows system root is unavailable");
+	if (systemRoot === void 0 || !win32.isAbsolute(systemRoot)) throw Object.assign(/* @__PURE__ */ new Error("Windows system root is unavailable"), { code: "WINDOWS_SYSTEM_ROOT_UNAVAILABLE" });
 	return win32.join(systemRoot, "System32", name);
 }
 async function currentWindowsUserSid() {
-	userSidTask ??= execFileText(windowsSystemTool("whoami.exe"), [
-		"/user",
-		"/fo",
-		"csv",
-		"/nh"
-	], {
-		encoding: "utf8",
-		windowsHide: true,
-		timeout: 1e4
-	}).then(({ stdout }) => {
+	userSidTask ??= permissionOperation("sid-query", async () => {
+		const { stdout } = await execFileText(windowsSystemTool("whoami.exe"), [
+			"/user",
+			"/fo",
+			"csv",
+			"/nh"
+		], {
+			encoding: "utf8",
+			windowsHide: true,
+			timeout: 1e4
+		});
 		const match = /,"(S-\d(?:-\d+)+)"\s*$/u.exec(stdout.trim());
-		if (match?.[1] === void 0) throw new Error("unable to resolve the current Windows user SID");
+		if (match?.[1] === void 0) throw Object.assign(/* @__PURE__ */ new Error("unable to resolve the current Windows user SID"), { code: "WINDOWS_USER_SID_INVALID" });
 		return match[1];
 	}).catch((error) => {
 		userSidTask = void 0;
@@ -59,12 +111,12 @@ async function currentWindowsUserSid() {
 	});
 	return userSidTask;
 }
-/** Restrict a sensitive regular file to the current user and Windows administrators. */
+/** Restrict a sensitive regular file to the current user and Windows administrators; reject Windows permission failures with redacted phase and duration. */
 async function restrictPrivateFile(file, mode = 384) {
 	await chmod(file, mode);
 	if (process.platform !== "win32") return;
 	const userSid = await currentWindowsUserSid();
-	await execFileText(windowsSystemTool("icacls.exe"), [
+	await permissionOperation("acl-apply", () => execFileText(windowsSystemTool("icacls.exe"), [
 		file,
 		"/inheritance:r",
 		"/grant:r",
@@ -79,7 +131,7 @@ async function restrictPrivateFile(file, mode = 384) {
 		encoding: "utf8",
 		windowsHide: true,
 		timeout: 1e4
-	});
+	}));
 }
 Object.freeze([
 	[0n, 8],
@@ -243,7 +295,7 @@ function assertMatchingCa(certPem, keyPem) {
 	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
 	return certificate;
 }
-async function atomicWrite(file, contents) {
+async function stagePrivateFile(file, contents) {
 	const directory = dirname(file);
 	await mkdir(directory, {
 		recursive: true,
@@ -251,17 +303,85 @@ async function atomicWrite(file, contents) {
 	});
 	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
 	try {
-		await writeFile(temporary, contents, {
+		await writeFile(temporary, "", {
 			mode: 384,
 			flag: "wx"
 		});
 		await restrictPrivateFile(temporary);
+		await writeFile(temporary, contents);
+		return temporary;
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+async function atomicWrite(file, contents) {
+	const temporary = await stagePrivateFile(file, contents);
+	try {
 		await rename(temporary, file);
 		await restrictPrivateFile(file);
 	} finally {
 		await rm(temporary, { force: true });
 	}
 }
+const certificatePublications = /* @__PURE__ */ new Map();
+/** Stage both files before promotion and retain a private rollback copy until the pair is installed. */
+async function installServerCertificatePair(output, cert, key) {
+	const identity = `${output.certFile}\0${output.keyFile}`;
+	const publication = (certificatePublications.get(identity) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+		const files = [output.certFile, output.keyFile];
+		const contents = [cert, key];
+		const staged = [];
+		const backups = [];
+		let promoted = 0;
+		let restored = true;
+		const failures = [];
+		try {
+			for (let index = 0; index < files.length; index += 1) {
+				const file = files[index];
+				staged.push(await stagePrivateFile(file, contents[index]));
+				let old;
+				try {
+					const metadata = await lstat(file);
+					if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error("managed TLS output is not a regular file");
+					old = await readFile(file);
+				} catch (error) {
+					if (error.code !== "ENOENT") throw error;
+				}
+				backups.push(old === void 0 ? void 0 : await stagePrivateFile(file, old));
+			}
+			for (let index = 0; index < files.length; index += 1) {
+				await rename(staged[index], files[index]);
+				promoted += 1;
+			}
+		} catch (error) {
+			failures.push(error);
+			for (let index = promoted - 1; index >= 0; index -= 1) try {
+				const backup = backups[index];
+				if (backup === void 0) await rm(files[index], { force: true });
+				else await rename(backup, files[index]);
+			} catch (restoreError) {
+				restored = false;
+				failures.push(restoreError);
+			}
+		} finally {
+			const cleanup = await Promise.allSettled(staged.map((file) => rm(file, { force: true })));
+			for (const result of cleanup) if (result.status === "rejected") failures.push(result.reason);
+			if (restored) {
+				const backupCleanup = await Promise.allSettled(backups.filter((file) => file !== void 0).map((file) => rm(file, { force: true })));
+				for (const result of backupCleanup) if (result.status === "rejected") failures.push(result.reason);
+			}
+		}
+		if (failures.length > 1) throw new AggregateError(failures, "managed TLS certificate replacement, rollback or cleanup failed");
+		if (failures.length === 1) throw failures[0];
+	});
+	certificatePublications.set(identity, publication);
+	try {
+		await publication;
+	} finally {
+		if (certificatePublications.get(identity) === publication) certificatePublications.delete(identity);
+	}
+}
 /** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
 async function ensureManagedCa(setup, legacy) {
 	let certPem;
@@ -376,7 +496,7 @@ async function issueServerCertificate(authority, target, output, lifetimeDays =
 			}
 		]
 	});
-	await Promise.all([atomicWrite(output.certFile, server.cert), atomicWrite(output.keyFile, server.private)]);
+	await installServerCertificatePair(output, server.cert, server.private);
 }
 /** Sign and atomically install a server leaf for the interface's current address. */
 async function refreshManagedServerCertificate(setup, address) {