dsh-ssh-manage 0.2.2 → 0.3.1

package/index.js

@@ -18,15 +18,17 @@ const PTY_RESIZE_ROUTE = '/dsh-ssh-manage/pty/resize'
 const PTY_ATTACH_ROUTE = '/dsh-ssh-manage/pty/attach'
 const PTY_CLOSE_ROUTE = '/dsh-ssh-manage/pty/close'
 const PTY_CLEAR_ROUTE = '/dsh-ssh-manage/pty/clear'
+const PTY_TOUCH_ROUTE = '/dsh-ssh-manage/pty/touch'
 const MAX_PTY_SESSIONS = 16
 const PTY_BUFFER_BYTES = 256 * 1024
-const PTY_IDLE_MS = 6 * 60 * 60 * 1000
+const PTY_IDLE_MS = 30 * 60 * 1000
 const MAX_PTY_BUFFER_BYTES = 4 * 1024 * 1024
 const PACKAGE_DIRECTORY = path.dirname(fileURLToPath(import.meta.url))
 const ASSETS = [
   { path: '/dsh-ssh-manage/assets/xterm.js', file: 'xterm.js', contentType: 'text/javascript; charset=utf-8' },
   { path: '/dsh-ssh-manage/assets/xterm.css', file: 'xterm.css', contentType: 'text/css; charset=utf-8' },
   { path: '/dsh-ssh-manage/assets/addon-fit.js', file: 'addon-fit.js', contentType: 'text/javascript; charset=utf-8' },
+  { path: '/dsh-ssh-manage/assets/addon-search.js', file: 'addon-search.js', contentType: 'text/javascript; charset=utf-8' },
 ]
 const MAX_BODY_BYTES = 16 * 1024 * 1024
 const ACTIONS = ['overview', 'list_hosts', 'save_host', 'delete_host', 'set_metadata', 'save_password', 'delete_password', 'test_connection', 'inspect_host', 'exec', 'batch_exec', 'sftp_list', 'sftp_upload', 'sftp_download']
@@ -552,18 +554,48 @@ function registerPtyHttpRoutes(ctx, paths, runtime) {
       label,
     )
   }
+
+  register(
+    {
+      kind: 'exact',
+      path: PTY_TOUCH_ROUTE,
+      handler: async (req, res) => {
+        if (rejectUnauthenticated(ctx, req, res)) return
+        if (req.method !== 'POST') {
+          res.statusCode = 405
+          res.setHeader('allow', 'POST')
+          res.end()
+          return
+        }
+        const body = (await readJsonBody(req)) ?? {}
+        const ids = Array.isArray(body.ids) ? body.ids.slice(0, 256) : []
+        const now = Date.now()
+        let touched = 0
+        for (const id of ids) {
+          if (typeof id !== 'string') continue
+          const entry = ptyTextSessions.get(id)
+          if (!entry) continue
+          entry.lastActivity = now
+          touched += 1
+        }
+        sendJson(res, 200, { ok: true, value: { touched } })
+      },
+    },
+    'pty touch route',
+  )
 }
 
-const ptyIdleTimer = setInterval(() => {
-  // An attached SSE client keeps its sessions alive even at a silent prompt;
-  // only reap orphans after every browser event stream has gone away.
-  if (ptyEventClients.size > 0) return
-  const now = Date.now()
-  for (const [id, entry] of ptyTextSessions) {
-    if (now - entry.lastActivity > PTY_IDLE_MS) closeTextSession(id)
+/** Close every PTY text session idle beyond PTY_IDLE_MS and return the number reaped. */
+function sweepIdlePtySessions(now = Date.now()) {
+  let reaped = 0
+  for (const [id, entry] of [...ptyTextSessions]) {
+    if (now - entry.lastActivity > PTY_IDLE_MS) {
+      closeTextSession(id)
+      reaped += 1
+    }
   }
-}, 60_000)
-ptyIdleTimer.unref?.()
+  return reaped
+}
 
 function boundedInteger(value, min, max, fallback) {
   const numeric = Number(value)
@@ -762,7 +794,7 @@ function registerAssetRoutes(ctx) {
   }
 }
 
-export const __test = { resolveSshPaths, listSshHosts, saveSshHost, deleteSshHost, runAction, managerTool, MAX_BODY_BYTES, PTY_ROUTE, PTY_EVENTS_ROUTE, PTY_OPEN_ROUTE, PTY_ATTACH_ROUTE, PTY_INPUT_ROUTE, PTY_RESIZE_ROUTE, PTY_CLOSE_ROUTE, PTY_CLEAR_ROUTE, MAX_PTY_SESSIONS, PTY_BUFFER_BYTES, ASSETS, handlePtyUpgrade, ptyTextSessions }
+export const __test = { resolveSshPaths, listSshHosts, saveSshHost, deleteSshHost, runAction, managerTool, MAX_BODY_BYTES, PTY_ROUTE, PTY_EVENTS_ROUTE, PTY_OPEN_ROUTE, PTY_ATTACH_ROUTE, PTY_INPUT_ROUTE, PTY_RESIZE_ROUTE, PTY_CLOSE_ROUTE, PTY_CLEAR_ROUTE, PTY_TOUCH_ROUTE, PTY_IDLE_MS, sweepIdlePtySessions, MAX_PTY_SESSIONS, PTY_BUFFER_BYTES, ASSETS, handlePtyUpgrade, ptyTextSessions }
 
 export const inject = ['webServer']
 
@@ -772,6 +804,14 @@ export function apply(ctx) {
   }
   const paths = resolveSshPaths(process.env)
   const runtime = createPtyRuntime()
+  const runtimeIdleTimer = setInterval(() => {
+    if (!runtime.active) return
+    // Browser heartbeats (/pty/touch) keep attached sessions alive, so a session
+    // left behind by a closed tab is reclaimed even while another tab retains
+    // an SSE stream. All liveness sources refresh lastActivity.
+    sweepIdlePtySessions()
+  }, 60_000)
+  runtimeIdleTimer.unref?.()
   ctx.effect(
     () =>
       ctx.webServer.register({
@@ -857,7 +897,7 @@ export function apply(ctx) {
         try { shutdown() } catch {}
       }
       runtime.upgrades.clear()
-      clearInterval(ptyIdleTimer)
+      clearInterval(runtimeIdleTimer)
       for (const session of ptySessions) {
         try { session.close() } catch {}
       }

package/lib/known-hosts.js

@@ -0,0 +1,136 @@
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+/** Resolve the known_hosts file: SSH_KNOWN_HOSTS, else ~/.ssh/known_hosts. */
+export function knownHostsPath(env = process.env) {
+  return env.SSH_KNOWN_HOSTS || path.join(env.HOME || os.homedir(), '.ssh', 'known_hosts')
+}
+
+/** OpenSSH-style SHA256 fingerprint of a raw SSH public key blob. */
+export function keyFingerprint(key) {
+  const buffer = Buffer.isBuffer(key) ? key : Buffer.from(key ?? '')
+  return `SHA256:${createHash('sha256').update(buffer).digest('base64').replace(/=+$/, '')}`
+}
+
+/** Host token used by known_hosts: plain host on port 22, bracketed host:port otherwise. */
+export function hostKeyTarget(host) {
+  const hostname = String((host && (host.hostname || host.host)) || '')
+  const raw = Number((host && host.port) || 22)
+  const port = Number.isInteger(raw) && raw > 0 && raw <= 65535 ? raw : 22
+  return port === 22 ? hostname : `[${hostname}]:${port}`
+}
+
+function hashedPatternMatches(pattern, target) {
+  const parts = pattern.split('|')
+  if (parts.length !== 4 || parts[1] !== '1') return false
+  let salt
+  let expected
+  try {
+    salt = Buffer.from(parts[2], 'base64')
+    expected = Buffer.from(parts[3], 'base64')
+  } catch {
+    return false
+  }
+  if (salt.length === 0 || expected.length === 0) return false
+  const candidates = target === target.toLowerCase() ? [target] : [target, target.toLowerCase()]
+  return candidates.some((candidate) => {
+    const actual = createHmac('sha1', salt).update(candidate).digest()
+    return actual.length === expected.length && timingSafeEqual(actual, expected)
+  })
+}
+
+function globPatternMatches(pattern, target) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')
+  return new RegExp(`^${escaped}$`, 'i').test(target)
+}
+
+/** Match one known_hosts host pattern against a target token (supports hashes, wildcards and negation). */
+export function matchHostPattern(pattern, target) {
+  const value = String(pattern ?? '').trim()
+  if (value === '') return false
+  if (value.startsWith('|1|')) return hashedPatternMatches(value, target)
+  if (value.includes('*') || value.includes('?')) return globPatternMatches(value, target)
+  return value.toLowerCase() === target.toLowerCase()
+}
+
+function patternsMatch(patterns, target) {
+  let matched = false
+  for (const raw of patterns) {
+    const pattern = String(raw ?? '').trim()
+    if (pattern === '') continue
+    const negated = pattern.startsWith('!')
+    const body = negated ? pattern.slice(1) : pattern
+    if (!matchHostPattern(body, target)) continue
+    if (negated) return false
+    matched = true
+  }
+  return matched
+}
+
+/** Parse a known_hosts file body into `{ marker, patterns, keyType, keyBlob }` entries. */
+export function parseKnownHosts(text = '') {
+  const entries = []
+  for (const raw of String(text).split(/\r?\n/)) {
+    const line = raw.trim()
+    if (line === '' || line.startsWith('#')) continue
+    const tokens = line.split(/\s+/)
+    let index = 0
+    let marker = null
+    if (tokens[0].startsWith('@')) {
+      marker = tokens[0].toLowerCase()
+      index = 1
+    }
+    const patternToken = tokens[index]
+    const keyType = tokens[index + 1]
+    const keyBlob = tokens[index + 2]
+    if (!patternToken || !keyType || !keyBlob) continue
+    entries.push({ marker, patterns: patternToken.split(','), keyType, keyBlob, line })
+  }
+  return entries
+}
+
+function sameBlob(knownHostsBlob, presented) {
+  const known = Buffer.from(String(knownHostsBlob), 'base64')
+  return known.length > 0 && known.equals(presented)
+}
+
+/**
+ * Synchronously verify a server host key (raw SSH public key blob) against known_hosts.
+ * Returns `{ ok: true, fingerprint, path, target }` or
+ * `{ ok: false, reason, fingerprint, path, target }`; mismatches also include `expected`.
+ */
+export function verifyHostKey(host, key, env = process.env) {
+  const keyBuffer = Buffer.isBuffer(key) ? key : Buffer.from(key ?? '')
+  const fingerprint = keyFingerprint(keyBuffer)
+  const target = hostKeyTarget(host)
+  const filePath = knownHostsPath(env)
+  let text
+  try {
+    text = readFileSync(filePath, 'utf8')
+  } catch (error) {
+    const reason = error?.code === 'ENOENT'
+      ? `known_hosts is missing at ${filePath}`
+      : `cannot read known_hosts at ${filePath}: ${error?.message ?? String(error)}`
+    return { ok: false, reason, fingerprint, path: filePath, target }
+  }
+  const entries = parseKnownHosts(text).filter((entry) => patternsMatch(entry.patterns, target))
+  const revoked = entries.find((entry) => entry.marker === '@revoked' && sameBlob(entry.keyBlob, keyBuffer))
+  if (revoked) return { ok: false, reason: `host key is revoked for ${target}`, fingerprint, path: filePath, target }
+  let hostMatched = false
+  let expected = ''
+  for (const entry of entries) {
+    if (entry.marker) continue
+    hostMatched = true
+    if (sameBlob(entry.keyBlob, keyBuffer)) return { ok: true, fingerprint, path: filePath, target }
+    if (expected === '') {
+      const blob = Buffer.from(entry.keyBlob, 'base64')
+      if (blob.length > 0) expected = keyFingerprint(blob)
+    }
+  }
+  if (hostMatched) return { ok: false, reason: `host key mismatch for ${target}`, fingerprint, expected, path: filePath, target }
+  return { ok: false, reason: `host key is not in known_hosts for ${target}`, fingerprint, path: filePath, target }
+}
+
+export const __test = { patternsMatch, globPatternMatches, hashedPatternMatches }

package/lib/ssh-client.js

@@ -1,4 +1,5 @@
 import { Client } from 'ssh2'
+import { verifyHostKey } from './known-hosts.js'
 
 const DEFAULT_TIMEOUT = 15_000
 const MAX_OUTPUT_BYTES = 1024 * 1024
@@ -13,14 +14,28 @@ const PROBE_COMMAND = [
   `printf 'SYS=%s\\nOS=%s\\nCORES=%s\\nMEM_MB=%s\\nDISK_MB=%s\\n' "$SYS" "$OS" "$CORES" "$MEM_MB" "$DISK_MB"`,
 ].join('\n')
 
-function connectionConfig(host, password) {
+function connectionConfig(host, password, verifyState = {}) {
+  const label = host.host || host.hostname || ''
   const config = {
     host: host.hostname || host.host,
     port: Number(host.port || 22),
     username: host.user || undefined,
     password,
     readyTimeout: DEFAULT_TIMEOUT,
+    keepaliveInterval: 15_000,
+    keepaliveCountMax: 3,
     tryKeyboard: true,
+    hostVerifier: (key) => {
+      // Emergency-only escape hatch: disables host-key verification entirely.
+      if (process.env.DSH_SSH_MANAGER_INSECURE_HOSTKEY === '1') return true
+      const result = verifyHostKey(host, key)
+      if (result.ok) return true
+      const expected = result.expected ? ` (expected ${result.expected})` : ''
+      verifyState.error = new Error(
+        `Host key verification failed for "${label}": ${result.reason}${expected} (fingerprint ${result.fingerprint}; known_hosts: ${result.path})`,
+      )
+      return false
+    },
   }
   if (host.proxyJump) throw new Error('ProxyJump is not supported by the plugin transport yet')
   return config
@@ -30,6 +45,7 @@ function connect(host, password, timeout = DEFAULT_TIMEOUT) {
   if (typeof password !== 'string' || password.length === 0) return Promise.reject(new Error('Password is required'))
   return new Promise((resolve, reject) => {
     const client = new Client()
+    const verifyState = {}
     let settled = false
     const timer = setTimeout(() => {
       if (settled) return
@@ -42,7 +58,8 @@ function connect(host, password, timeout = DEFAULT_TIMEOUT) {
       settled = true
       clearTimeout(timer)
       client.end()
-      reject(error instanceof Error ? error : new Error(String(error)))
+      const reported = verifyState.error ?? error
+      reject(reported instanceof Error ? reported : new Error(String(reported)))
     }
     client.once('ready', () => {
       if (settled) return
@@ -55,7 +72,7 @@ function connect(host, password, timeout = DEFAULT_TIMEOUT) {
     client.on('keyboard-interactive', (_name, _instructions, _language, prompts, finish) => {
       finish(prompts.map(() => password))
     })
-    try { client.connect(connectionConfig(host, password)) } catch (error) { fail(error) }
+    try { client.connect(connectionConfig(host, password, verifyState)) } catch (error) { fail(error) }
   })
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ssh-manage",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "A DSH sidebar plugin for managing SSH host profiles with a real interactive PTY terminal.",
   "license": "MIT",
   "private": false,