dsh-remote 0.8.14 → 0.8.16

package/lib/forwards.js

@@ -1,219 +1,219 @@
-// dsh-remote — SSH port forwarding manager (local & reverse tunnels).
-//
-// Local forward: listen on 127.0.0.1:<listenPort> → every connection is
-// piped through the SSH channel to <targetHost>:<targetPort> on the remote.
-// Reverse forward: ask the remote to listen on 127.0.0.1:<listenPort> and pipe
-// incoming connections back to <targetHost>:<targetPort> on the LOCAL side
-// (ssh2 `forwardIn` + the client `tcpip` event; requires AllowTcpForwarding on
-// the remote sshd).
-//
-// Definitions persist in forwards.json; forwards become active only while the
-// SSH connection is up (auto-restart on connect when `autoStart: true`), and
-// every tunnel is torn down when the pool disconnects — reverse tunnels are
-// never auto-restarted (they would re-expose a local port without asking).
-import net from 'node:net'
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
-import path from 'node:path'
-
-export class ForwardManager {
-  /** @param {object} pool SshPool (needs .connect() returning the ssh2 client). */
-  constructor(pool, { file } = {}) {
-    this.pool = pool
-    this.file = file || null
-    this.defs = this._load()
-    this.servers = new Map() // id → { server | remoteListen, sockets:Set, client }
-    this.client = null
-    this.onTcpip = null
-    this.onClose = null
-    this.attach = this.attach.bind(this)
-  }
-
-  _load() {
-    if (!this.file) return []
-    try {
-      const j = JSON.parse(readFileSync(this.file, 'utf8'))
-      if (Array.isArray(j.defs)) return j.defs
-    } catch {}
-    return []
-  }
-
-  _save() {
-    if (!this.file) return
-    try {
-      mkdirSync(path.dirname(this.file), { recursive: true })
-      writeFileSync(this.file, JSON.stringify({ defs: this.defs }, null, 2))
-    } catch {}
-  }
-
-  /** Called by the pool after a successful connect: restore autoStart tunnels. */
-  attach(client) {
-    if (this.client === client) return
-    this.client = client
-    this.onTcpip = (info, accept, reject) => this._handleTcpip(info, accept, reject)
-    client.on('tcpip', this.onTcpip)
-    this.onClose = () => this.stopAll()
-    client.on('close', this.onClose)
-    for (const d of this.defs) {
-      if (d.autoStart && d.direction === 'local' && !this.servers.has(d.id)) {
-        this.start(d).catch(() => {})
-      }
-    }
-  }
-
-  detach() {
-    this.stopAll()
-    if (this.client) {
-      if (this.onTcpip) this.client.removeListener('tcpip', this.onTcpip)
-      if (this.onClose) this.client.removeListener('close', this.onClose)
-    }
-    this.client = null
-    this.onTcpip = null
-    this.onClose = null
-  }
-
-  list() {
-    return this.defs.map((d) => ({
-      id: d.id,
-      direction: d.direction,
-      listenPort: d.listenPort,
-      targetHost: d.targetHost,
-      targetPort: d.targetPort,
-      machineId: d.machineId || null,
-      autoStart: !!d.autoStart,
-      active: this.servers.has(d.id),
-    }))
-  }
-
-  _defId() {
-    return 'fwd-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 6)
-  }
-
-  /** Create a forward definition (persisted). Does NOT start it. */
-  define({ direction = 'local', listenPort, targetHost, targetPort, autoStart = false, machineId } = {}) {
-    const d = {
-      id: this._defId(),
-      direction: direction === 'reverse' ? 'reverse' : 'local',
-      listenPort: Number(listenPort),
-      targetHost: String(targetHost || '127.0.0.1'),
-      targetPort: Number(targetPort),
-      autoStart: !!autoStart,
-      machineId: machineId || null,
-    }
-    this.defs.push(d)
-    this._save()
-    return d
-  }
-
-  remove(id) {
-    this.stop(id)
-    const i = this.defs.findIndex((d) => d.id === id)
-    if (i >= 0) { this.defs.splice(i, 1); this._save(); return true }
-    return false
-  }
-
-  async start(def) {
-    const d = this.defs.find((x) => x.id === def.id) || def
-    if (this.servers.has(d.id)) return { ok: true, active: true }
-    let client = await this.pool.connect()
-    if (!this.client) this.attach(client)
-    if (this.client !== client) {
-      // The pool reconnected while we were connecting — retry on the live client.
-      client = this.client
-    }
-    try {
-      if (d.direction === 'reverse') {
-        await this._startReverse(d, client)
-      } else {
-        await this._startLocal(d, client)
-      }
-      return { ok: true, active: true }
-    } catch (err) {
-      return { ok: false, error: String((err && err.message) || err) }
-    }
-  }
-
-  _startLocal(d, client) {
-    return new Promise((resolve, reject) => {
-      const server = net.createServer((socket) => {
-        client.forwardOut('127.0.0.1', 0, d.targetHost, d.targetPort, (err, channel) => {
-          if (err) { socket.destroy(); return }
-          socket.pipe(channel)
-          channel.pipe(socket)
-          const kill = () => { try { socket.destroy() } catch {}; try { channel.close() } catch {} }
-          socket.on('error', kill)
-          channel.on('error', kill)
-          socket.on('close', kill)
-          channel.on('close', kill)
-        })
-      })
-      server.on('error', (e) => reject(new Error(`本地转发 ${d.listenPort} 启动失败: ${e.message}`)))
-      server.listen(d.listenPort, '127.0.0.1', () => {
-        this.servers.set(d.id, { kind: 'local', server, sockets: new Set(), client })
-        resolve()
-      })
-    })
-  }
-
-  _startReverse(d, client) {
-    return new Promise((resolve, reject) => {
-      // ssh2 calls the remote TCP listen API `forwardIn` (NOT openssh_forwardIn,
-      // which in ssh2 >= 1.16 is stream-local only).
-      if (typeof client.forwardIn !== 'function') {
-        return reject(new Error('此 ssh2 版本不支持反向转发 (forwardIn)'))
-      }
-      client.forwardIn('127.0.0.1', d.listenPort, (err) => {
-        if (err) return reject(new Error(`远端监听 ${d.listenPort} 失败: ${(err && err.message) || err}`))
-        this.servers.set(d.id, { kind: 'reverse', sockets: new Set(), client })
-        resolve()
-      })
-    })
-  }
-
-  _handleTcpip(info, accept, reject) {
-    for (const entry of this.servers.values()) {
-      if (entry.kind === 'reverse' && Number(info.destPort) === Number(this._defFor(entry).listenPort)) {
-        const channel = accept()
-        const socket = net.connect({ host: this._defFor(entry).targetHost, port: this._defFor(entry).targetPort })
-        socket.pipe(channel)
-        channel.pipe(socket)
-        entry.sockets.add(socket)
-        const kill = () => {
-          try { socket.destroy() } catch {}
-          try { channel.close() } catch {}
-          entry.sockets.delete(socket)
-        }
-        socket.on('error', kill)
-        channel.on('error', kill)
-        socket.on('close', kill)
-        return
-      }
-    }
-    reject()
-  }
-
-  _defFor(entry) {
-    for (const d of this.defs) {
-      if (this.servers.has(d.id) && this.servers.get(d.id) === entry) return d
-    }
-    return { listenPort: 0, targetHost: '127.0.0.1', targetPort: 0 }
-  }
-
-  stop(id) {
-    const entry = this.servers.get(id)
-    if (!entry) return
-    try {
-      if (entry.kind === 'local') {
-        entry.server.close()
-        for (const s of entry.sockets) { try { s.destroy() } catch {} }
-      } else if (entry.client && typeof entry.client.unforwardIn === 'function') {
-        const d = this._defFor(entry)
-        entry.client.unforwardIn('127.0.0.1', d.listenPort, () => {})
-      }
-    } catch {}
-    this.servers.delete(id)
-  }
-
-  stopAll() {
-    for (const id of [...this.servers.keys()]) this.stop(id)
-  }
-}
+// dsh-remote — SSH port forwarding manager (local & reverse tunnels).
+//
+// Local forward: listen on 127.0.0.1:<listenPort> → every connection is
+// piped through the SSH channel to <targetHost>:<targetPort> on the remote.
+// Reverse forward: ask the remote to listen on 127.0.0.1:<listenPort> and pipe
+// incoming connections back to <targetHost>:<targetPort> on the LOCAL side
+// (ssh2 `forwardIn` + the client `tcpip` event; requires AllowTcpForwarding on
+// the remote sshd).
+//
+// Definitions persist in forwards.json; forwards become active only while the
+// SSH connection is up (auto-restart on connect when `autoStart: true`), and
+// every tunnel is torn down when the pool disconnects — reverse tunnels are
+// never auto-restarted (they would re-expose a local port without asking).
+import net from 'node:net'
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs'
+import path from 'node:path'
+
+export class ForwardManager {
+  /** @param {object} pool SshPool (needs .connect() returning the ssh2 client). */
+  constructor(pool, { file } = {}) {
+    this.pool = pool
+    this.file = file || null
+    this.defs = this._load()
+    this.servers = new Map() // id → { server | remoteListen, sockets:Set, client }
+    this.client = null
+    this.onTcpip = null
+    this.onClose = null
+    this.attach = this.attach.bind(this)
+  }
+
+  _load() {
+    if (!this.file) return []
+    try {
+      const j = JSON.parse(readFileSync(this.file, 'utf8'))
+      if (Array.isArray(j.defs)) return j.defs
+    } catch {}
+    return []
+  }
+
+  _save() {
+    if (!this.file) return
+    try {
+      mkdirSync(path.dirname(this.file), { recursive: true })
+      writeFileSync(this.file, JSON.stringify({ defs: this.defs }, null, 2))
+    } catch {}
+  }
+
+  /** Called by the pool after a successful connect: restore autoStart tunnels. */
+  attach(client) {
+    if (this.client === client) return
+    this.client = client
+    this.onTcpip = (info, accept, reject) => this._handleTcpip(info, accept, reject)
+    client.on('tcpip', this.onTcpip)
+    this.onClose = () => this.stopAll()
+    client.on('close', this.onClose)
+    for (const d of this.defs) {
+      if (d.autoStart && d.direction === 'local' && !this.servers.has(d.id)) {
+        this.start(d).catch(() => {})
+      }
+    }
+  }
+
+  detach() {
+    this.stopAll()
+    if (this.client) {
+      if (this.onTcpip) this.client.removeListener('tcpip', this.onTcpip)
+      if (this.onClose) this.client.removeListener('close', this.onClose)
+    }
+    this.client = null
+    this.onTcpip = null
+    this.onClose = null
+  }
+
+  list() {
+    return this.defs.map((d) => ({
+      id: d.id,
+      direction: d.direction,
+      listenPort: d.listenPort,
+      targetHost: d.targetHost,
+      targetPort: d.targetPort,
+      machineId: d.machineId || null,
+      autoStart: !!d.autoStart,
+      active: this.servers.has(d.id),
+    }))
+  }
+
+  _defId() {
+    return 'fwd-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 6)
+  }
+
+  /** Create a forward definition (persisted). Does NOT start it. */
+  define({ direction = 'local', listenPort, targetHost, targetPort, autoStart = false, machineId } = {}) {
+    const d = {
+      id: this._defId(),
+      direction: direction === 'reverse' ? 'reverse' : 'local',
+      listenPort: Number(listenPort),
+      targetHost: String(targetHost || '127.0.0.1'),
+      targetPort: Number(targetPort),
+      autoStart: !!autoStart,
+      machineId: machineId || null,
+    }
+    this.defs.push(d)
+    this._save()
+    return d
+  }
+
+  remove(id) {
+    this.stop(id)
+    const i = this.defs.findIndex((d) => d.id === id)
+    if (i >= 0) { this.defs.splice(i, 1); this._save(); return true }
+    return false
+  }
+
+  async start(def) {
+    const d = this.defs.find((x) => x.id === def.id) || def
+    if (this.servers.has(d.id)) return { ok: true, active: true }
+    let client = await this.pool.connect()
+    if (!this.client) this.attach(client)
+    if (this.client !== client) {
+      // The pool reconnected while we were connecting — retry on the live client.
+      client = this.client
+    }
+    try {
+      if (d.direction === 'reverse') {
+        await this._startReverse(d, client)
+      } else {
+        await this._startLocal(d, client)
+      }
+      return { ok: true, active: true }
+    } catch (err) {
+      return { ok: false, error: String((err && err.message) || err) }
+    }
+  }
+
+  _startLocal(d, client) {
+    return new Promise((resolve, reject) => {
+      const server = net.createServer((socket) => {
+        client.forwardOut('127.0.0.1', 0, d.targetHost, d.targetPort, (err, channel) => {
+          if (err) { socket.destroy(); return }
+          socket.pipe(channel)
+          channel.pipe(socket)
+          const kill = () => { try { socket.destroy() } catch {}; try { channel.close() } catch {} }
+          socket.on('error', kill)
+          channel.on('error', kill)
+          socket.on('close', kill)
+          channel.on('close', kill)
+        })
+      })
+      server.on('error', (e) => reject(new Error(`本地转发 ${d.listenPort} 启动失败: ${e.message}`)))
+      server.listen(d.listenPort, '127.0.0.1', () => {
+        this.servers.set(d.id, { kind: 'local', server, sockets: new Set(), client })
+        resolve()
+      })
+    })
+  }
+
+  _startReverse(d, client) {
+    return new Promise((resolve, reject) => {
+      // ssh2 calls the remote TCP listen API `forwardIn` (NOT openssh_forwardIn,
+      // which in ssh2 >= 1.16 is stream-local only).
+      if (typeof client.forwardIn !== 'function') {
+        return reject(new Error('此 ssh2 版本不支持反向转发 (forwardIn)'))
+      }
+      client.forwardIn('127.0.0.1', d.listenPort, (err) => {
+        if (err) return reject(new Error(`远端监听 ${d.listenPort} 失败: ${(err && err.message) || err}`))
+        this.servers.set(d.id, { kind: 'reverse', sockets: new Set(), client })
+        resolve()
+      })
+    })
+  }
+
+  _handleTcpip(info, accept, reject) {
+    for (const entry of this.servers.values()) {
+      if (entry.kind === 'reverse' && Number(info.destPort) === Number(this._defFor(entry).listenPort)) {
+        const channel = accept()
+        const socket = net.connect({ host: this._defFor(entry).targetHost, port: this._defFor(entry).targetPort })
+        socket.pipe(channel)
+        channel.pipe(socket)
+        entry.sockets.add(socket)
+        const kill = () => {
+          try { socket.destroy() } catch {}
+          try { channel.close() } catch {}
+          entry.sockets.delete(socket)
+        }
+        socket.on('error', kill)
+        channel.on('error', kill)
+        socket.on('close', kill)
+        return
+      }
+    }
+    reject()
+  }
+
+  _defFor(entry) {
+    for (const d of this.defs) {
+      if (this.servers.has(d.id) && this.servers.get(d.id) === entry) return d
+    }
+    return { listenPort: 0, targetHost: '127.0.0.1', targetPort: 0 }
+  }
+
+  stop(id) {
+    const entry = this.servers.get(id)
+    if (!entry) return
+    try {
+      if (entry.kind === 'local') {
+        entry.server.close()
+        for (const s of entry.sockets) { try { s.destroy() } catch {} }
+      } else if (entry.client && typeof entry.client.unforwardIn === 'function') {
+        const d = this._defFor(entry)
+        entry.client.unforwardIn('127.0.0.1', d.listenPort, () => {})
+      }
+    } catch {}
+    this.servers.delete(id)
+  }
+
+  stopAll() {
+    for (const id of [...this.servers.keys()]) this.stop(id)
+  }
+}

package/lib/hostkey.js

@@ -1,48 +1,48 @@
-// dsh-remote — host-key fingerprint helpers (TOFU). Pure functions split out
-// of lib/index.js so the ssh2 hostVerifier contract (raw Buffer blob since
-// ssh2 v1.17) is unit-tested against the REAL wire shape — the v0.6.7 bug
-// class ("mock object hid a contract drift") must not regress.
-import { createHash } from 'node:crypto'
-
-/**
- * Extract the SSH host-key algorithm name from a raw SSH host-key blob
- * (SSH wire format: `uint32 len` + algorithm string + key data).
- */
-export function blobAlgorithm(blob) {
-  if (!Buffer.isBuffer(blob) || blob.length < 4) return ''
-  try {
-    const len = blob.readUInt32BE(0)
-    return blob.toString('utf8', 4, 4 + len)
-  } catch {
-    return ''
-  }
-}
-
-/**
- * SHA-256 fingerprint (base64) of an ssh2 host-key blob, like `SHA256:…`
- * in a known_hosts file (without the `SHA256:` prefix).
- *
- * ssh2 v1.17 passes hostVerifier the RAW host-key blob Buffer (the SSH
- * wire-format `string(algo) string(keydata)`), NOT the old `{ algo, hash }`
- * object. Fingerprinting `key.hash` on a raw Buffer crashed with "The 'data'
- * argument must be of type string or an instance of Buffer…" on EVERY connect
- * (v0.6.6 bug). Accept both shapes defensively.
- */
-export function keyFingerprint(key) {
-  const blob = Buffer.isBuffer(key) ? key : (key && key.hash)
-  if (!blob) throw new Error('host key missing (hostVerifier received no key blob)')
-  return createHash('sha256').update(blob).digest('base64')
-}
-
-/** Build a fake-but-wire-shaped host-key blob for tests:
- * `string(algo) string(32 bytes)`. */
-export function makeKeyBlob(algo, seed) {
-  const algoBuf = Buffer.from(algo, 'utf8')
-  const data = Buffer.alloc(32, seed || 1)
-  const blob = Buffer.alloc(4 + algoBuf.length + 4 + data.length)
-  blob.writeUInt32BE(algoBuf.length, 0)
-  algoBuf.copy(blob, 4)
-  blob.writeUInt32BE(data.length, 4 + algoBuf.length)
-  data.copy(blob, 8 + algoBuf.length)
-  return blob
-}
+// dsh-remote — host-key fingerprint helpers (TOFU). Pure functions split out
+// of lib/index.js so the ssh2 hostVerifier contract (raw Buffer blob since
+// ssh2 v1.17) is unit-tested against the REAL wire shape — the v0.6.7 bug
+// class ("mock object hid a contract drift") must not regress.
+import { createHash } from 'node:crypto'
+
+/**
+ * Extract the SSH host-key algorithm name from a raw SSH host-key blob
+ * (SSH wire format: `uint32 len` + algorithm string + key data).
+ */
+export function blobAlgorithm(blob) {
+  if (!Buffer.isBuffer(blob) || blob.length < 4) return ''
+  try {
+    const len = blob.readUInt32BE(0)
+    return blob.toString('utf8', 4, 4 + len)
+  } catch {
+    return ''
+  }
+}
+
+/**
+ * SHA-256 fingerprint (base64) of an ssh2 host-key blob, like `SHA256:…`
+ * in a known_hosts file (without the `SHA256:` prefix).
+ *
+ * ssh2 v1.17 passes hostVerifier the RAW host-key blob Buffer (the SSH
+ * wire-format `string(algo) string(keydata)`), NOT the old `{ algo, hash }`
+ * object. Fingerprinting `key.hash` on a raw Buffer crashed with "The 'data'
+ * argument must be of type string or an instance of Buffer…" on EVERY connect
+ * (v0.6.6 bug). Accept both shapes defensively.
+ */
+export function keyFingerprint(key) {
+  const blob = Buffer.isBuffer(key) ? key : (key && key.hash)
+  if (!blob) throw new Error('host key missing (hostVerifier received no key blob)')
+  return createHash('sha256').update(blob).digest('base64')
+}
+
+/** Build a fake-but-wire-shaped host-key blob for tests:
+ * `string(algo) string(32 bytes)`. */
+export function makeKeyBlob(algo, seed) {
+  const algoBuf = Buffer.from(algo, 'utf8')
+  const data = Buffer.alloc(32, seed || 1)
+  const blob = Buffer.alloc(4 + algoBuf.length + 4 + data.length)
+  blob.writeUInt32BE(algoBuf.length, 0)
+  algoBuf.copy(blob, 4)
+  blob.writeUInt32BE(data.length, 4 + algoBuf.length)
+  data.copy(blob, 8 + algoBuf.length)
+  return blob
+}

package/lib/http-transport.js

@@ -0,0 +1,104 @@
+// The routes in index.js are bounded JSON handlers, not arbitrary HTTP proxy
+// handlers. Keep their implementation shared with legacy Web hosts while using
+// Connection's authenticated, carrier-neutral channel on portless Desktop.
+import { Readable } from 'node:stream'
+
+const MAX_BODY_BYTES = 1024 * 1024
+
+export function connectionRoute(route) {
+  // Only the prefix is a real invariant here. `kind`/`exact` belongs to
+  // dsh-host-webserver's registry (WebRouteKind); Connection's
+  // ConnectionFetchRoute has no `kind` field and assertFetchRoute never reads
+  // one, so requiring it would let a future route that omits it silently lose
+  // itself and every route registered after it.
+  if (!route.path.startsWith('/dsh-remote/')) {
+    throw new Error('dsh-remote: expected a plugin route under /dsh-remote/')
+  }
+  return {
+    path: '/api' + route.path,
+    methods: ['GET', 'POST'],
+    requestBody: 'buffered',
+    async fetch(request) {
+      const chunks = []
+      let size = 0
+      // Desktop's IPC carrier need not impose the Web carrier's JSON cap.
+      // Enforce our own cap before dispatch: oversized input must never become
+      // an empty object that could accidentally trigger a default operation.
+      const reader = request.body?.getReader()
+      try {
+        if (reader) {
+          while (true) {
+            request.signal.throwIfAborted()
+            const { done, value } = await reader.read()
+            if (done) break
+            size += value.byteLength
+            if (size > MAX_BODY_BYTES) {
+              await reader.cancel()
+              return Response.json({ ok: false, error: 'request body too large' }, { status: 413 })
+            }
+            chunks.push(Buffer.from(value))
+          }
+        }
+      } finally {
+        reader?.releaseLock()
+      }
+      request.signal.throwIfAborted()
+      const url = new URL(request.url)
+      // The legacy JSON reader joins chunks as strings. Supply one bounded
+      // buffer so UTF-8 characters split by the IPC stream remain intact.
+      const req = Readable.from(size ? [Buffer.concat(chunks, size)] : [])
+      req.method = request.method
+      req.url = route.path + url.search
+      const headers = new Headers()
+      let response
+      const res = {
+        statusCode: 200,
+        setHeader(key, value) { headers.set(key, value) },
+        end(body) { response = new Response(body, { status: this.statusCode, headers }) },
+      }
+      try {
+        await route.handler(req, res)
+        if (!response) throw new Error('JSON handler did not finish its response')
+        return response
+      } finally {
+        req.destroy()
+      }
+    },
+  }
+}
+
+export function registerHttpTransports(ctx, routes) {
+  // Reactive injection matters: either service can arrive after the plugin.
+  // Neither optional transport is a hard prerequisite for the SSH tools.
+  ctx.inject(['webServer'], (inner) => {
+    const disposers = routes.map((route) => inner.get('webServer').register(route))
+    inner.effect(() => () => disposers.forEach((dispose) => dispose()), 'dsh-remote.web-routes')
+  })
+  ctx.inject(['connection'], (inner) => {
+    const connection = inner.get('connection')
+    // Older Web compositions may have Connection without exact Fetch routes.
+    // dsh < 0.1.2-rc.1 is such a composition: the Desktop transport is simply
+    // absent there, and the legacy /dsh-remote/* routes above still serve.
+    if (typeof connection.fetch?.register !== 'function') return
+    // Register one route at a time. A single failing route must not abort the
+    // rest of the list (which would silently drop every later route) nor leak
+    // the routes already registered, because this callback is a ctx.inject
+    // child fiber: its throw is caught and logged by the loader, so the parent
+    // plugin stays ACTIVE and the failure is easy to miss.
+    const disposers = []
+    const failed = []
+    for (const route of routes) {
+      try {
+        disposers.push(connection.fetch.register(connectionRoute(route)))
+      } catch (err) {
+        failed.push(route.path + ': ' + String((err && err.message) || err))
+      }
+    }
+    inner.effect(() => () => Promise.all(disposers.map((dispose) => dispose())), 'dsh-remote.fetch-routes')
+    if (failed.length) {
+      // Surface a partial registration instead of swallowing it; the Web
+      // transport is unaffected, so this is a warning rather than a failure.
+      console.warn('[dsh-remote] some Connection Fetch routes did not register:', failed.join('; '))
+    }
+  })
+}