dsh-mobile 0.8.4 → 0.8.6

package/lib/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { homedir, networkInterfaces } from "node:os";
+import { chmod, lstat, mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir, networkInterfaces, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, win32 } from "node:path";
 import { X509Certificate, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
 import { execFile } from "node:child_process";
@@ -9,6 +9,39 @@ import { performance } from "node:perf_hooks";
 import "@deepseek-ai/cordis";
 import "@deepseek-ai/schemastery";
 // src/exec-file.ts
+/**
+* Longest stream text attached to a failed subprocess result.
+*
+* The text exists for diagnostics only: a caller decides which part is safe to
+* show. It is bounded here so a chatty child cannot turn one failure into an
+* unbounded buffer in every future consumer of that rejection.
+*/
+const MAX_SUBPROCESS_ERROR_STREAM_CHARS = 8192;
+function boundedStream(value) {
+	if (typeof value !== "string" || value === "") return void 0;
+	return value.length <= 8192 ? value : value.slice(0, MAX_SUBPROCESS_ERROR_STREAM_CHARS);
+}
+/**
+* Attach the captured streams to a subprocess failure, best effort.
+*
+* `execFile` reports a non-zero exit as an Error whose only text is the command
+* line with stderr merged into `message`; the raw stream strings are handed to
+* the callback and otherwise discarded, so a caller cannot read them from the
+* rejection. They are copied onto it when it accepts properties. A frozen,
+* exotic or primitive rejection value must keep `message` as its diagnostic
+* rather than turn one failure into a different error, so every write is
+* guarded and an existing property is never overwritten.
+*/
+function attachCapturedStreams(error, stdout, stderr) {
+	if (typeof error !== "object" || error === null) return;
+	const target = error;
+	try {
+		const capturedStderr = boundedStream(stderr);
+		const capturedStdout = boundedStream(stdout);
+		if (target.stderr === void 0 && capturedStderr !== void 0) target.stderr = capturedStderr;
+		if (target.stdout === void 0 && capturedStdout !== void 0) target.stdout = capturedStdout;
+	} catch {}
+}
 /** Capture both output streams even when a desktop host wraps execFile without Node's promisify metadata. */
 function execFileText(file, args, options = {}) {
 	return new Promise((resolve, reject) => {
@@ -18,6 +51,7 @@ function execFileText(file, args, options = {}) {
 			encoding: "utf8"
 		}, (error, stdout, stderr) => {
 			if (error !== null) {
+				attachCapturedStreams(error, stdout, stderr);
 				reject(error);
 				return;
 			}
@@ -176,7 +210,7 @@ const VIRTUAL_INTERFACE_MARKERS = [
 const ROUTE_COMMAND_TIMEOUT_MS = 5e3;
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
-	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
 }
 function networkCidr(address, cidr) {
 	const prefix = Number(cidr.slice(cidr.lastIndexOf("/") + 1));
@@ -512,28 +546,126 @@ async function refreshManagedServerCertificate(setup, address) {
 // src/lan-setup.ts
 const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
 const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
+const MIN_MANAGED_PORT = 1024;
+const MAX_MANAGED_PORT = 65535;
+function assertManagedPort(port, name) {
+	if (!Number.isSafeInteger(port) || port < MIN_MANAGED_PORT || port > MAX_MANAGED_PORT) throw new Error(`${name} must be from ${String(MIN_MANAGED_PORT)} through ${String(MAX_MANAGED_PORT)}`);
+}
+/** Longest failure detail carried in the thrown message. */
+const MAX_FAILURE_DETAIL_CHARS = 512;
+/**
+* Strip the elevated invocation and filesystem locations from PowerShell text.
+*
+* The launcher's stderr quotes the command it ran, including the base64
+* `-EncodedCommand` payload, and the elevated script quotes its own scratch
+* path. Neither helps an operator, and both can push the one useful line past
+* the length bound, so they are replaced before the detail is bounded.
+*/
+function redactPowerShellDetail(value) {
+	return value.replace(/EncodedCommand\s+\S+/giu, "EncodedCommand <redacted>").replace(/\b[A-Za-z0-9+/]{64,}={0,2}\b/gu, "<redacted>").replace(/(?<![A-Za-z])[A-Za-z]:[\\/][^\s'"]*/gu, "<path>");
+}
+/** Bounded, redacted detail for a failed elevated Windows operation. */
+function powerShellFailureDetail(error, innerError = "") {
+	if (!(error instanceof Error)) return "unknown failure";
+	const code = "code" in error && (typeof error.code === "string" || typeof error.code === "number") ? ` (${String(error.code)})` : "";
+	const detail = redactPowerShellDetail(innerError.trim() === "" && "stderr" in error && typeof error.stderr === "string" ? error.stderr : innerError).trim().replace(/\s+/gu, " ").slice(0, MAX_FAILURE_DETAIL_CHARS);
+	return `${code}${detail === "" ? "" : `: ${detail}`}`;
+}
+/** Default sink for a scratch directory that could not be removed. */
+function warnFirewallCleanupFailure(detail) {
+	process.emitWarning(`Windows firewall temporary cleanup failed (${detail})`, { code: "DSH_MOBILE_FIREWALL_CLEANUP_FAILED" });
+}
+/**
+* Remove the elevated helper's scratch directory without touching the run's outcome.
+*
+* The directory is created before elevation and removed in a `finally`, so a
+* cleanup failure must not replace the firewall error that explains the
+* failure, and must not fail a run that already succeeded. It stays observable
+* instead: the removal error's code is reported to the warning sink, whose own
+* failure is ignored for the same reason.
+* @param directory - scratch path created for this run.
+* @param options - injectable removal and warning sink for tests.
+*/
+async function discardFirewallScratch(directory, options = {}) {
+	const remove = options.remove ?? ((path) => rm(path, {
+		recursive: true,
+		force: true
+	}));
+	try {
+		await remove(directory);
+	} catch (error) {
+		const code = error !== null && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : "unknown";
+		const warn = options.warn ?? warnFirewallCleanupFailure;
+		try {
+			warn(code);
+		} catch {}
+	}
+}
 async function runElevatedPowerShell(script) {
-	await execFileText("powershell.exe", [
-		"-NoProfile",
-		"-NonInteractive",
-		"-Command",
-		[
-			"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
-			`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(script, "utf16le").toString("base64")}')`,
-			"; exit $process.ExitCode"
-		].join(" ")
-	], { windowsHide: true });
-}
-/** Install the two Windows inbound rules used by the managed LAN listener. */
+	const temporary = await mkdtemp(join(tmpdir(), "dsh-mobile-firewall-"));
+	const errorFile = join(temporary, "error.log");
+	const wrapped = [
+		`$__dshMobileErrorFile = '${errorFile.replaceAll("'", "''")}'`,
+		"try {",
+		script,
+		"} catch {",
+		"  try { [IO.File]::WriteAllText($__dshMobileErrorFile, ($_ | Out-String)) } catch {}",
+		"  throw",
+		"}"
+	].join("\n");
+	const launch = [
+		"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
+		`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(wrapped, "utf16le").toString("base64")}')`,
+		"; exit $process.ExitCode"
+	].join(" ");
+	try {
+		await execFileText("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			launch
+		], { windowsHide: true });
+	} catch (error) {
+		let innerError = "";
+		try {
+			innerError = (await readFile(errorFile, "utf8")).replace(/^\uFEFF/u, "");
+		} catch {}
+		throw new Error(`Windows firewall operation failed${powerShellFailureDetail(error, innerError)}`, { cause: error });
+	} finally {
+		await discardFirewallScratch(temporary);
+	}
+}
+function firewallRuleScript(name, protocol, port) {
+	return [
+		`$rules = @(Get-NetFirewallRule -DisplayName '${name}' -ErrorAction SilentlyContinue)`,
+		"if ($rules.Count -eq 0) {",
+		`  New-NetFirewallRule -DisplayName '${name}' -Direction Inbound -Action Allow -Protocol ${protocol} -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
+		"} else {",
+		"  foreach ($rule in $rules) {",
+		"    $rule | Set-NetFirewallRule -Enabled True -Direction Inbound -Action Allow -Profile Any",
+		`    $rule | Get-NetFirewallPortFilter | Set-NetFirewallPortFilter -Protocol ${protocol} -LocalPort ${String(port)}`,
+		"    $rule | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress LocalSubnet",
+		"  }",
+		"}",
+		`$verified = @(Get-NetFirewallRule -DisplayName '${name}' -ErrorAction Stop | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' -and $_.Profile -eq 'Any' })`,
+		`$matchingPort = @($verified | Get-NetFirewallPortFilter | Where-Object { $_.Protocol -eq '${protocol}' -and $_.LocalPort -contains '${String(port)}' })`,
+		`$matchingAddress = @($verified | Get-NetFirewallAddressFilter | Where-Object { $_.RemoteAddress -contains 'LocalSubnet' })`,
+		`if ($verified.Count -eq 0 -or $matchingPort.Count -eq 0 -or $matchingAddress.Count -eq 0) { throw "DSH Mobile firewall rule '${name}' is not active with the expected scope" }`
+	];
+}
+/** Build the elevated Windows firewall script without removing a working rule first. */
+function windowsFirewallSetupScript(port) {
+	assertManagedPort(port, "Windows firewall port");
+	return [
+		"$ErrorActionPreference = 'Stop'",
+		...firewallRuleScript(FIREWALL_TCP_RULE, "TCP", port),
+		...firewallRuleScript(FIREWALL_UDP_RULE, "UDP", port)
+	].join("\n");
+}
+/** Install or update the two Windows inbound rules used by the managed LAN listener. */
 async function configureWindowsFirewall(port) {
 	if (process.platform !== "win32") return;
-	await runElevatedPowerShell([
-		"$ErrorActionPreference = 'Stop'",
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`
-	].join("; "));
+	await runElevatedPowerShell(windowsFirewallSetupScript(port));
 }
 /** Remove only the two Windows firewall rules owned by DSH Mobile. */
 async function removeWindowsFirewall() {
@@ -547,8 +679,8 @@ async function removeWindowsFirewall() {
 /** Generate private TLS material and persist a managed setup selected by the user. */
 async function prepareManagedLanSetup(options) {
 	if (!isAbsolute(options.setupFile) || !isAbsolute(options.controlFile)) throw new Error("managed LAN setup paths must be absolute");
-	if (!Number.isSafeInteger(options.listenPort) || options.listenPort < 1024 || options.listenPort > 65535) throw new Error("managed LAN listenPort must be from 1024 through 65535");
-	if (!Number.isSafeInteger(options.dshPort) || options.dshPort < 1024 || options.dshPort > 65535) throw new Error("managed LAN dshPort must be from 1024 through 65535");
+	assertManagedPort(options.listenPort, "managed LAN listenPort");
+	assertManagedPort(options.dshPort, "managed LAN dshPort");
 	const directory = dirname(options.setupFile);
 	const tlsDirectory = join(directory, "tls");
 	await mkdir(tlsDirectory, {