dsh-remote-control-plugin 0.3.5 → 0.4.0

package/index.js

@@ -9,6 +9,10 @@ import { fileURLToPath } from 'node:url'
 import { createFabric } from './host/fabric.js'
 import { createRelayLink } from './host/relay-link.js'
 import { createRelay } from './host/relay-core.js'
+import { checkRelayUrl, ensureReachable } from './host/reachability.js'
+import { qrSvg } from './host/qr.js'
+import { createUploadManager } from './host/uploads.js'
+import { loadOrCreateIdentity } from './host/identity.js'
 
 const HERE = path.dirname(fileURLToPath(import.meta.url))
 const WEB_DIR = path.join(HERE, 'web')
@@ -38,6 +42,7 @@ export function apply(ctx, rawConfig) {
   const config = normalizeConfig(rawConfig)
   const stateFile = path.join(dshHome(), 'remote-control.json')
   const peersFile = path.join(dshHome(), 'remote-control-peers.json')
+  const identityFile = path.join(dshHome(), 'remote-control-identity.json')
   const streams = new Set()
   const published = { urls: [], code: '' }
   const info = { port: config.port, proto: config.tls ? 'https' : 'http' }
@@ -48,7 +53,10 @@ export function apply(ctx, rawConfig) {
   let fabric
   let relayLink
   let relayCore
+  let deviceIdentity
   let hostedKey = ''
+  let hostedPairCode = ''
+  let joinPairCode = ''
 
   const sessions = {
     async list() {
@@ -75,12 +83,29 @@ export function apply(ctx, rawConfig) {
         signal,
       )
     },
-    prompt(sessionId, text) {
+    async prompt(sessionId, input) {
+      const text = typeof input === 'string' ? input : String(input?.text ?? '')
+      const requested = typeof input === 'object' && Array.isArray(input?.attachments) ? input.attachments : []
+      const parts = []
+      if (text.trim()) parts.push({ type: 'text', text })
+      for (const item of requested) {
+        if (!item || typeof item !== 'object') continue
+        if (item.type === 'image' || item.type === 'file') {
+          if (item.attachment && typeof item.attachment === 'object') parts.push({ type: item.type, attachment: item.attachment })
+        }
+      }
+      if (parts.length === 0) throw new Error('empty prompt')
+      // Admit through the attachment service so encoded images are normalized
+      // and durable references pass unchanged.
+      const attachments = typeof ctx.get === 'function' ? safely(() => ctx.get('attachments')) : undefined
+      const content = attachments && typeof attachments.admitPromptContent === 'function'
+        ? await attachments.admitPromptContent(parts)
+        : parts
       return ctx.sessionController.prompt({
         requestId: randomUUID(),
         sessionId,
         mode: 'queue',
-        content: [{ type: 'text', text }],
+        content,
         clientTimeZone: timeZone(),
       }, AbortSignal.timeout(30000))
     },
@@ -92,10 +117,15 @@ export function apply(ctx, rawConfig) {
      * remote read must not have side effects on the target.
      */
     async config(sessionId) {
-      const values = {}
-      const liveSession = typeof ctx.sessions?.get === 'function' ? ctx.sessions.get(sessionId) : undefined
-      const agent = typeof ctx.agents?.get === 'function' ? ctx.agents.get(sessionId) : undefined
-      const out = { sessionId, live: Boolean(liveSession), running: Boolean(agent) }
+      const out = { sessionId }
+      // Cordis throws when a service is read as a property without `inject`,
+      // so every optional service is reached through ctx.get inside a guard.
+      let liveSession
+      let agent
+      try { liveSession = ctx.get?.('sessions')?.get?.(sessionId) } catch { /* not injected */ }
+      try { agent = ctx.get?.('agents')?.get?.(sessionId) } catch { /* not injected */ }
+      out.live = Boolean(liveSession)
+      out.running = Boolean(agent)
 
       try {
         const catalog = await ctx.sessionController.modelCatalog()
@@ -148,7 +178,9 @@ export function apply(ctx, rawConfig) {
 
       const needsLive = typeof patch.permission === 'string' || typeof patch.plan === 'boolean'
       if (needsLive) {
-        let agent = typeof ctx.agents?.get === 'function' ? ctx.agents.get(sessionId) : undefined
+        let agent
+        let session
+        try { agent = ctx.get?.('agents')?.get?.(sessionId) } catch { /* not injected */ }
         if (!agent) {
           try {
             const resolved = await ctx.sessionController.resolveAgent(sessionId)
@@ -157,7 +189,7 @@ export function apply(ctx, rawConfig) {
             failures.push(`resume: ${error?.message || error}`)
           }
         }
-        const session = typeof ctx.sessions?.get === 'function' ? ctx.sessions.get(sessionId) : undefined
+        try { session = ctx.get?.('sessions')?.get?.(sessionId) } catch { /* not injected */ }
 
         if (typeof patch.permission === 'string') {
           try {
@@ -187,16 +219,30 @@ export function apply(ctx, rawConfig) {
     },
   }
 
+  const uploads = createUploadManager({
+    log,
+    getAttachments: () => (typeof ctx.get === 'function' ? safely(() => ctx.get('attachments')) : undefined),
+  })
+
   fabric = createFabric({
     log,
     config,
     stateFile: peersFile,
+    store: createCredentialStore(ctx, peersFile, log),
+    uploads,
+    identity: () => deviceIdentity,
+    limits: { rateMax: config.rateMax, rateWindowMs: config.rateWindowMs },
     self: () => ({
       deviceId: state?.deviceId ?? '',
       deviceName: config.deviceName,
       userId: identity.userId,
       port: info.port,
       proto: info.proto,
+      relayUrl: relayLink?.url() ?? '',
+      pairCode: hostedPairCode || joinPairCode || config.pairCode || '',
+      publicKey: deviceIdentity?.ed25519?.publicKeyPem ?? '',
+      fingerprint: deviceIdentity?.fingerprint ?? '',
+      agreementKey: deviceIdentity?.x25519?.publicKeyPem ?? '',
     }),
     sessions,
   })
@@ -204,6 +250,11 @@ export function apply(ctx, rawConfig) {
   const ready = loadState(stateFile, config, log)
     .then(async (loaded) => {
       state = loaded
+      deviceIdentity = await loadOrCreateIdentity(
+        identityFile,
+        log,
+        createCredentialStore(ctx, identityFile, log, 'remote-control/identity'),
+      )
       await refreshIdentity()
       await start()
       try {
@@ -221,11 +272,12 @@ export function apply(ctx, rawConfig) {
         const persisted = await loadRelayConfig()
         if (persisted?.hosted && persisted.key) {
           try {
-            await startHostedRelay(persisted.key)
+            await startHostedRelay(persisted.key, persisted.pairCode)
           } catch (error) {
             log.warn(`[remote-control] hosted relay disabled: ${error?.message || error}`)
           }
         } else if (persisted) {
+          joinPairCode = typeof persisted.pairCode === 'string' ? persisted.pairCode : ''
           try {
             await startRelay(persisted.url, persisted.key)
           } catch (error) {
@@ -305,10 +357,11 @@ export function apply(ctx, rawConfig) {
   }
 
   /** Serve the relay from this Host and point our own link at it. */
-  async function startHostedRelay(key) {
+  async function startHostedRelay(key, code) {
     stopHostedRelay()
     relayCore = createRelay({ log })
     hostedKey = key
+    hostedPairCode = code || generatePairCode()
     try {
       await startRelay(`http://127.0.0.1:${info.port}`, key)
     } catch (error) {
@@ -323,6 +376,7 @@ export function apply(ctx, rawConfig) {
       relayCore = undefined
     }
     hostedKey = ''
+    hostedPairCode = ''
   }
 
   function shareUrls() {
@@ -335,6 +389,7 @@ export function apply(ctx, rawConfig) {
       try { controller.abort() } catch { /* ignore */ }
     }
     streams.clear()
+    try { uploads?.close() } catch { /* ignore */ }
     try { relayLink?.stop() } catch { /* ignore */ }
     try { relayCore?.close() } catch { /* ignore */ }
     try { fabric?.stop() } catch { /* ignore */ }
@@ -380,11 +435,13 @@ export function apply(ctx, rawConfig) {
         peers: relayLink?.peers().length ?? 0,
         hosted: Boolean(relayCore),
         urls,
-        invite: relayCore && hostedKey && urls[0] ? `${urls[0]} ${hostedKey}` : '',
+        invite: relayCore && hostedKey && urls[0] ? `${urls[0]} ${hostedKey}#${hostedPairCode}` : '',
+        pairCode: hostedPairCode || joinPairCode || '',
       }
       return json(res, 200, snapshot)
     }
     if (action === '/relay/host' && req.method === 'POST') {
+      await ready
       const body = await readJson(req)
       if (body?.enabled === false) {
         stopRelay()
@@ -393,40 +450,66 @@ export function apply(ctx, rawConfig) {
         return json(res, 200, { ok: true })
       }
       let key = typeof body?.key === 'string' && body.key.length >= 16 ? body.key : ''
+      const persisted = await loadRelayConfig()
       if (!key) {
-        const persisted = await loadRelayConfig()
         key = persisted?.hosted && persisted.key ? persisted.key : randomBytes(16).toString('hex')
       }
+      const code = persisted?.pairCode && /^\d{4,8}$/.test(persisted.pairCode) ? persisted.pairCode : ''
       try {
-        await startHostedRelay(key)
+        await startHostedRelay(key, code)
       } catch (error) {
         return json(res, 502, { error: 'relay-failed', message: String(error?.message || error) })
       }
       const urls = shareUrls()
-      await saveRelayConfig({ hosted: true, url: urls[0] ?? '', key })
-      log.info(`[remote-control] hosting a relay at ${urls[0] ?? '(no address)'}`)
-      return json(res, 200, { ok: true, urls, invite: `${urls[0] ?? ''} ${key}` })
+      let reachability = null
+      try {
+        reachability = await ensureReachable({ port: info.port, allowInsecure: config.allowInsecureRelay })
+      } catch { /* diagnostics only */ }
+      const inviteBase = reachability?.ok && reachability.url ? reachability.url : (urls[0] ?? '')
+      const allUrls = reachability?.ok && reachability.url ? [reachability.url, ...urls] : urls
+      await saveRelayConfig({ hosted: true, url: inviteBase, key, pairCode: hostedPairCode })
+      log.info(`[remote-control] hosting a relay at ${inviteBase || '(no address)'}`)
+      return json(res, 200, {
+        ok: true,
+        urls: allUrls,
+        pairCode: hostedPairCode,
+        reachability,
+        invite: `${inviteBase} ${key}#${hostedPairCode}`,
+      })
     }
     if (action === '/relay' && req.method === 'POST') {
+      await ready
       const body = await readJson(req)
-      const url = String(body?.url || '').trim()
-      const key = String(body?.key || '')
-      let parsed
-      try { parsed = new URL(url) } catch { return json(res, 400, { error: 'bad-url', message: 'Relay URL must be absolute.' }) }
-      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-        return json(res, 400, { error: 'bad-url', message: 'Relay URL must use http or https.' })
-      }
+      let url = String(body?.url || '').trim()
+      let key = String(body?.key || '')
+      let code = String(body?.pairCode || '')
+      // Invite form "<url> <key>#<code>": accept it whole or already split.
+      const urlHash = url.indexOf('#')
+      if (urlHash >= 0) { code = code || url.slice(urlHash + 1); url = url.slice(0, urlHash) }
+      const keyHash = key.indexOf('#')
+      if (keyHash >= 0) { code = code || key.slice(keyHash + 1); key = key.slice(0, keyHash) }
+      const verdict = checkRelayUrl(url, { allowInsecure: config.allowInsecureRelay })
+      if (!verdict.ok) return json(res, 400, { error: verdict.error, message: verdict.message })
       if (key.length < 16) {
         return json(res, 400, { error: 'bad-key', message: 'Workspace key must be at least 16 characters.' })
       }
+      joinPairCode = /^\d{4,8}$/.test(code) ? code : ''
       try {
         await startRelay(url, key)
       } catch (error) {
         return json(res, 502, { error: 'relay-unreachable', message: String(error?.message || error) })
       }
       stopHostedRelay()
-      await saveRelayConfig({ hosted: false, url, key })
-      return json(res, 200, { ok: true })
+      await saveRelayConfig({ hosted: false, url, key, pairCode: joinPairCode })
+      return json(res, 200, { ok: true, pairCode: joinPairCode })
+    }
+    if (action === '/relay/reachability' && req.method === 'GET') {
+      await ready
+      if (!relayCore) {
+        return json(res, 409, { error: 'not-hosting', message: 'Create a relay on this device first.' })
+      }
+      const result = await ensureReachable({ port: info.port, allowInsecure: config.allowInsecureRelay })
+      return json(res, 200, result)
     }
     if (action === '/relay/clear' && req.method === 'POST') {
       stopRelay()
@@ -434,6 +517,33 @@ export function apply(ctx, rawConfig) {
       await clearRelayConfig()
       return json(res, 200, { ok: true })
     }
+    if (action === '/qr' && req.method === 'GET') {
+      const text = String(url.searchParams.get('text') || '')
+      if (!text || text.length > 106) return json(res, 400, { error: 'bad-text' })
+      res.writeHead(200, { 'content-type': 'image/svg+xml; charset=utf-8', 'cache-control': 'no-store' })
+      return res.end(qrSvg(text))
+    }
+    if (action.startsWith('/upload/') && req.method === 'POST') {
+      const name = action.slice('/upload/'.length)
+      const handler = uploads?.[name]
+      if (typeof handler !== 'function') return json(res, 404, { error: 'not-found' })
+      let body
+      try {
+        body = await readJson(req, 8 * 1024 * 1024)
+      } catch {
+        return json(res, 400, { error: 'bad-body' })
+      }
+      const result = await handler(body)
+      return json(res, result.status ?? 200, result)
+    }
+    if (action === '/revoke' && req.method === 'POST') {
+      const body = await readJson(req)
+      return json(res, 200, fabric.revoke(String(body?.deviceId || '')))
+    }
+    if (action === '/scopes' && req.method === 'POST') {
+      const body = await readJson(req)
+      return json(res, 200, fabric.setScopes(String(body?.deviceId || ''), body?.scopes))
+    }
     if (action === '/approve' && req.method === 'POST') {
       const body = await readJson(req)
       return json(res, 200, await fabric.approveRequest(String(body?.requestId || '')))
@@ -815,6 +925,75 @@ function escapeHtml(value) {
   }[character]))
 }
 
+/* ------------------------------------------------------------------ */
+/* approval secret store                                               */
+/* ------------------------------------------------------------------ */
+
+/**
+ * Peer grants live in the Host credential store as a `grant` record, the
+ * sanctioned secret store, with the legacy 0600 JSON file as a fallback: a
+ * credential failure may never stop the plugin from starting, and a first run
+ * migrates the file content into the record.
+ */
+function createCredentialStore(ctx, legacyFile, log, key = 'remote-control/peers') {
+  const file = {
+    async load() {
+      try {
+        return JSON.parse(await readFile(legacyFile, 'utf8'))
+      } catch (error) {
+        if (error?.code !== 'ENOENT') log.warn(`[remote-control] could not read ${legacyFile}: ${error?.message || error}`)
+        return null
+      }
+    },
+    async save(value) {
+      try {
+        await mkdir(path.dirname(legacyFile), { recursive: true })
+        await writeFile(legacyFile, JSON.stringify(value, null, 2), { mode: 0o600 })
+      } catch (error) {
+        log.warn(`[remote-control] could not persist ${legacyFile}: ${error?.message || error}`)
+      }
+    },
+  }
+
+  let credentials
+  try {
+    credentials = typeof ctx.get === 'function' ? ctx.get('credentials') : undefined
+  } catch {
+    credentials = undefined
+  }
+  if (!credentials || typeof credentials.readRecord !== 'function' || typeof credentials.modifyRecord !== 'function') {
+    return file
+  }
+
+  return {
+    async load() {
+      try {
+        const record = await credentials.readRecord(key)
+        if (record && record.kind === 'grant' && record.payload) return record.payload
+      } catch (error) {
+        log.warn(`[remote-control] credential record read failed: ${error?.message || error}`)
+      }
+      const legacy = await file.load()
+      if (legacy) {
+        try {
+          await credentials.modifyRecord(key, async () => ({ kind: 'grant', payload: legacy }))
+          log.info('[remote-control] migrated peer grants into the credential store')
+        } catch { /* the file copy remains authoritative */ }
+      }
+      return legacy
+    },
+    async save(value) {
+      try {
+        await credentials.modifyRecord(key, async () => ({ kind: 'grant', payload: value }))
+        return
+      } catch (error) {
+        log.warn(`[remote-control] credential record write failed, using the file fallback: ${error?.message || error}`)
+      }
+      await file.save(value)
+    },
+  }
+}
+
 /* ------------------------------------------------------------------ */
 /* configuration                                                       */
 /* ------------------------------------------------------------------ */
@@ -832,6 +1011,14 @@ function normalizeConfig(raw = {}) {
     discoveryPort: Number.isInteger(raw?.discoveryPort) ? raw.discoveryPort : 57331,
     relayUrl: typeof raw?.relayUrl === 'string' ? raw.relayUrl.trim() : '',
     relayKey: typeof raw?.relayKey === 'string' ? raw.relayKey : '',
+    allowInsecureRelay: raw?.allowInsecureRelay === true,
+    pairCode: typeof raw?.pairCode === 'string' ? raw.pairCode.trim() : '',
+    rateMax: Number.isInteger(raw?.rateMax) ? raw.rateMax : 120,
+    rateWindowMs: Number.isInteger(raw?.rateWindowMs) ? raw.rateWindowMs : 10_000,
+    punchPort: Number.isInteger(raw?.punchPort) ? raw.punchPort : 0,
+    stunHost: raw?.stunHost === false ? false : (typeof raw?.stunHost === 'string' ? raw.stunHost : 'stun.l.google.com'),
+    stunPort: Number.isInteger(raw?.stunPort) ? raw.stunPort : 19302,
+    stunTimeoutMs: Number.isInteger(raw?.stunTimeoutMs) ? raw.stunTimeoutMs : 1500,
     deviceName: typeof raw?.deviceName === 'string' && raw.deviceName.trim() ? raw.deviceName.trim() : os.hostname(),
     tls: raw?.tls && typeof raw.tls === 'object' ? { certFile: raw.tls.certFile, keyFile: raw.tls.keyFile } : null,
   }
@@ -848,15 +1035,8 @@ function normalizeConfig(raw = {}) {
     }
   }
   if (config.relayUrl) {
-    let parsed
-    try {
-      parsed = new URL(config.relayUrl)
-    } catch {
-      throw new Error('remote-control: `relayUrl` must be an absolute http(s) URL')
-    }
-    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
-      throw new Error('remote-control: `relayUrl` must use http or https')
-    }
+    const verdict = checkRelayUrl(config.relayUrl, { allowInsecure: config.allowInsecureRelay })
+    if (!verdict.ok) throw new Error(`remote-control: ${verdict.message}`)
     if (!config.relayKey || config.relayKey.length < 16) {
       throw new Error('remote-control: `relayKey` must be at least 16 characters when `relayUrl` is set')
     }
@@ -912,6 +1092,10 @@ function generateCode() {
   return String(randomInt(0, 1_000_000)).padStart(6, '0')
 }
 
+function generatePairCode() {
+  return String(randomInt(0, 1_000_000)).padStart(6, '0')
+}
+
 function timeZone() {
   try { return Intl.DateTimeFormat().resolvedOptions().timeZone } catch { return undefined }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-control-plugin",
-  "version": "0.3.5",
+  "version": "0.4.0",
   "type": "module",
   "description": "Remote control for DSH: a Devices panel that discovers other DSH desktops signed into the same account, pairs with them once, and drives their sessions.",
   "exports": {