herdr-remote 0.2.39 → 0.3.31

package/dist/keepalive/windows-task.js

@@ -1,191 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { configDir, stateDir } from '../paths.js';
-import { detachedLogsHint } from './detached.js';
-import { cliEntryPoint, serviceEnvironment } from './environment.js';
-import { currentServiceAccount, encodePowerShellCommand, escapePowerShellSingleQuoted, serviceId, windowsService, } from './windows-service.js';
-const TASK_START_TIMEOUT_MS = 15_000;
-const TASK_STOP_TIMEOUT_MS = 15_000;
-const TASK_POLL_INTERVAL_MS = 250;
-export function windowsTaskName(username = currentServiceAccount().user) {
-    return serviceId(username);
-}
-export function renderWindowsTaskLaunchScript(options) {
-    const environment = {
-        ...options.environment,
-        HERDR_REMOTE_CONFIG_DIR: options.configDirectory,
-        HERDR_REMOTE_STATE_DIR: options.stateDirectory,
-        HERDR_REMOTE_SERVICE: '1',
-    };
-    const environmentLines = Object.entries(environment).map(([key, value]) => `$env:${key} = '${escapePowerShellSingleQuoted(value)}'`);
-    return `$ErrorActionPreference = 'Stop'
-${environmentLines.join('\n')}
-Set-Location -LiteralPath '${escapePowerShellSingleQuoted(options.workingDirectory)}'
-& '${escapePowerShellSingleQuoted(options.nodePath)}' '${escapePowerShellSingleQuoted(options.entryPoint)}' run --daemon
-exit $LASTEXITCODE`;
-}
-export function renderWindowsTaskRegistrationScript(options) {
-    const taskName = escapePowerShellSingleQuoted(options.taskName);
-    const account = escapePowerShellSingleQuoted(options.account);
-    const powershellPath = escapePowerShellSingleQuoted(options.powershellPath);
-    const workingDirectory = escapePowerShellSingleQuoted(options.workingDirectory);
-    const launchArguments = `-NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand ${encodePowerShellCommand(options.launchScript)}`;
-    return `$ErrorActionPreference = 'Stop'
-$action = New-ScheduledTaskAction -Execute '${powershellPath}' -Argument '${launchArguments}' -WorkingDirectory '${workingDirectory}'
-$trigger = New-ScheduledTaskTrigger -AtLogOn -User '${account}'
-# Interactive logon uses the signed-in token and avoids storing account credentials.
-$principal = New-ScheduledTaskPrincipal -UserId '${account}' -LogonType Interactive -RunLevel Limited
-$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit ([TimeSpan]::Zero) -MultipleInstances IgnoreNew
-Register-ScheduledTask -TaskName '${taskName}' -Description 'Herdr Remote keep-alive' -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force | Out-Null
-Enable-ScheduledTask -TaskName '${taskName}' | Out-Null
-Start-ScheduledTask -TaskName '${taskName}'`;
-}
-export function parseWindowsTaskState(output) {
-    try {
-        const state = JSON.parse(output.replace(/^\uFEFF/, '').trim()).State;
-        return state === 'Ready' || state === 'Queued' || state === 'Running' || state === 'Disabled'
-            ? state
-            : 'Absent';
-    }
-    catch {
-        // Task status is best-effort; malformed scheduler output means no known task.
-        return 'Absent';
-    }
-}
-function windowsPowerShellPath() {
-    const root = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
-    return path.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
-}
-function taskStateScript(taskName) {
-    const safeName = escapePowerShellSingleQuoted(taskName);
-    return `$ErrorActionPreference = 'Stop'
-$task = Get-ScheduledTask -TaskName '${safeName}' -ErrorAction SilentlyContinue
-if ($null -eq $task) { '{"State":"Absent"}'; exit 0 }
-[pscustomobject]@{ State = [string]$task.State } | ConvertTo-Json -Compress`;
-}
-function invokePowerShell(script, label) {
-    const result = spawnSync(windowsPowerShellPath(), [
-        '-NoLogo',
-        '-NoProfile',
-        '-NonInteractive',
-        '-EncodedCommand',
-        encodePowerShellCommand(script),
-    ], { encoding: 'utf8', windowsHide: true });
-    if (result.error || result.status !== 0) {
-        const output = String(result.stderr || result.stdout || '').trim();
-        throw new Error(`${label} failed (${String(result.status)}): ${output}`);
-    }
-    return String(result.stdout || '').trim();
-}
-function taskState() {
-    const result = spawnSync(windowsPowerShellPath(), [
-        '-NoProfile',
-        '-NoLogo',
-        '-NonInteractive',
-        '-EncodedCommand',
-        encodePowerShellCommand(taskStateScript(windowsTaskName())),
-    ], { encoding: 'utf8', windowsHide: true });
-    if (result.error || result.status !== 0) {
-        // A status query must not make unrelated CLI commands fail on an unavailable scheduler.
-        return 'Absent';
-    }
-    return parseWindowsTaskState(String(result.stdout || ''));
-}
-function accountName() {
-    const { domain, user } = currentServiceAccount();
-    return domain ? `${domain}\\${user}` : user;
-}
-function stopTaskScript(taskName) {
-    const safeName = escapePowerShellSingleQuoted(taskName);
-    return `$ErrorActionPreference = 'Stop'
-$task = Get-ScheduledTask -TaskName '${safeName}' -ErrorAction SilentlyContinue
-if ($null -eq $task -or ($task.State -ne 'Running' -and $task.State -ne 'Queued')) { exit 0 }
-Stop-ScheduledTask -TaskName '${safeName}'
-$deadline = [DateTime]::UtcNow.AddMilliseconds(${TASK_STOP_TIMEOUT_MS})
-do {
-  Start-Sleep -Milliseconds ${TASK_POLL_INTERVAL_MS}
-  $task = Get-ScheduledTask -TaskName '${safeName}' -ErrorAction SilentlyContinue
-} while ($task -and ($task.State -eq 'Running' -or $task.State -eq 'Queued') -and [DateTime]::UtcNow -lt $deadline)
-if ($task -and ($task.State -eq 'Running' -or $task.State -eq 'Queued')) { throw 'Scheduled task did not stop in time.' }`;
-}
-function stopTask() {
-    const state = taskState();
-    if (state === 'Running' || state === 'Queued')
-        invokePowerShell(stopTaskScript(windowsTaskName()), 'Stopping the Windows scheduled task');
-}
-function launchOptions() {
-    const workingDirectory = stateDir();
-    return {
-        nodePath: process.execPath,
-        entryPoint: cliEntryPoint(),
-        workingDirectory,
-        configDirectory: configDir(),
-        stateDirectory: workingDirectory,
-        environment: serviceEnvironment(),
-    };
-}
-function status() {
-    const state = taskState();
-    const installed = state !== 'Absent';
-    return {
-        manager: 'windows-task',
-        installed,
-        active: state === 'Running',
-        enabled: installed && state !== 'Disabled',
-        state: state.toLowerCase(),
-    };
-}
-async function install() {
-    if (taskState() !== 'Absent')
-        stopTask();
-    // Remove the earlier service before starting a second supervisor for this user.
-    if (windowsService.status().installed)
-        await windowsService.uninstall();
-    const options = launchOptions();
-    await fs.promises.mkdir(options.workingDirectory, { recursive: true });
-    const launchScript = renderWindowsTaskLaunchScript(options);
-    const script = renderWindowsTaskRegistrationScript({
-        taskName: windowsTaskName(),
-        account: accountName(),
-        powershellPath: windowsPowerShellPath(),
-        workingDirectory: options.workingDirectory,
-        launchScript,
-    });
-    invokePowerShell(script, 'Installing the Windows scheduled task');
-    const deadline = Date.now() + TASK_START_TIMEOUT_MS;
-    let state = taskState();
-    while (state !== 'Running' && state !== 'Absent' && Date.now() < deadline) {
-        await new Promise((resolve) => setTimeout(resolve, TASK_POLL_INTERVAL_MS));
-        state = taskState();
-    }
-    if (state !== 'Running')
-        throw new Error(`Windows scheduled task did not start (state: ${state.toLowerCase()}).`);
-    return { ok: true, taskName: windowsTaskName(), state };
-}
-async function uninstall() {
-    const name = windowsTaskName();
-    if (taskState() !== 'Absent') {
-        stopTask();
-        const safeName = escapePowerShellSingleQuoted(name);
-        invokePowerShell(`Unregister-ScheduledTask -TaskName '${safeName}' -Confirm:$false -ErrorAction Stop`, 'Removing the Windows scheduled task');
-    }
-    if (windowsService.status().installed)
-        await windowsService.uninstall();
-    return { ok: true, taskName: name };
-}
-function restart() {
-    stopTask();
-    const safeName = escapePowerShellSingleQuoted(windowsTaskName());
-    invokePowerShell(`Start-ScheduledTask -TaskName '${safeName}'`, 'Starting the Windows scheduled task');
-    return { ok: true };
-}
-export const windowsTask = {
-    name: 'windows-task',
-    status,
-    install,
-    uninstall,
-    restart,
-    stop: stopTask,
-    logsHint: () => detachedLogsHint('win32'),
-};

package/dist/lib/process.js

@@ -1,132 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import fs from 'node:fs';
-const PROCESS_QUERY_TIMEOUT_MS = 10_000;
-// Records written before start tokens existed carry only a pid. Until none are
-// left, such a record is trusted only while its process runs one of our entry
-// points: the relay, the host connector or `herdr-remote run`.
-const OUR_ENTRY_POINT = /herdr-remote-relay\.js|connector[\\/]main\.js|herdr-remote\.js"?\s+run\b/;
-/** Whether `pid` names a running process, including one owned by another user. */
-export function pidAlive(pid) {
-    if (!Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code === 'EPERM';
-    }
-}
-function runCommand(command, args) {
-    const result = spawnSync(command, args, {
-        encoding: 'utf8',
-        // The same instant must print the same text whenever and wherever it is asked.
-        env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' },
-        stdio: ['ignore', 'pipe', 'ignore'],
-        timeout: PROCESS_QUERY_TIMEOUT_MS,
-        windowsHide: true,
-    });
-    // The exit code is not trusted: ps and PowerShell fail when any one pid is
-    // gone, yet still print the rest. A command that could not run prints nothing.
-    return typeof result.stdout === 'string' ? result.stdout : '';
-}
-/** `<pid> <value>` lines, as ps and our PowerShell queries print them. */
-function parsePidLines(output) {
-    const details = new Map();
-    for (const line of output.split(/\r?\n/)) {
-        const match = /^\s*(\d+)\s+(\S.*?)\s*$/.exec(line);
-        if (match)
-            details.set(Number(match[1]), match[2]);
-    }
-    return details;
-}
-function linuxDetails(pids, detail, run) {
-    let bootId = '';
-    if (detail === 'start') {
-        try {
-            // Start times count clock ticks since boot, so they only identify a
-            // process together with the boot they were counted in.
-            bootId = fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
-        }
-        catch {
-            // A /proc without boot ids (some sandboxes) still has ps.
-            return psDetails(pids, detail, run);
-        }
-    }
-    const details = new Map();
-    for (const pid of pids) {
-        let text;
-        try {
-            text = fs.readFileSync(`/proc/${pid}/${detail === 'start' ? 'stat' : 'cmdline'}`, 'utf8');
-        }
-        catch {
-            // Not running, or hidden from us: either way it is not a process we can vouch for.
-            continue;
-        }
-        if (detail === 'command') {
-            details.set(pid, text.replaceAll('\0', ' ').trim());
-            continue;
-        }
-        // The command name before this may itself contain spaces and parentheses;
-        // after it, field 3 (state) comes first and field 22 is the start time.
-        const fields = text.slice(text.lastIndexOf(')') + 2).split(' ');
-        if (fields[19])
-            details.set(pid, `${bootId}:${fields[19]}`);
-    }
-    return details;
-}
-function psDetails(pids, detail, run) {
-    const column = detail === 'start' ? 'lstart' : 'command';
-    return parsePidLines(run('ps', ['-o', `pid=,${column}=`, '-p', pids.join(',')]));
-}
-function windowsDetails(pids, detail, run) {
-    const script = detail === 'start'
-        ? // StartTime is empty for processes we may not inspect; those are not ours anyway.
-            `Get-Process -Id ${pids.join(',')} -ErrorAction SilentlyContinue | Where-Object StartTime | ForEach-Object { "$($_.Id) $($_.StartTime.ToFileTimeUtc())" }`
-        : `Get-CimInstance Win32_Process -Filter "${pids.map((pid) => `ProcessId=${pid}`).join(' OR ')}" | ForEach-Object { "$($_.ProcessId) $($_.CommandLine)" }`;
-    return parsePidLines(run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]));
-}
-function processDetails(pids, detail, platform, run) {
-    // Dead pids are the common case after a clean stop, and ruling them out here
-    // saves spawning ps or PowerShell just to hear so.
-    const candidates = [...new Set(pids)].filter(pidAlive);
-    if (candidates.length === 0)
-        return new Map();
-    if (platform === 'linux')
-        return linuxDetails(candidates, detail, run);
-    if (platform === 'win32')
-        return windowsDetails(candidates, detail, run);
-    return psDetails(candidates, detail, run);
-}
-/**
- * When each running process in `pids` started, as opaque tokens; pids that are
- * not running, or that the system will not describe, are left out.
- *
- * A pid alone does not identify a process: the number goes to another process
- * once this one exits, and after a reboot the same boot-time services land on
- * the same numbers again. On Linux the number of a thread in another process
- * even passes `pidAlive`. Recorded next to its pid, this token only ever
- * matches the process it was read from.
- */
-export function processStarts(pids, platform = process.platform, run = runCommand) {
-    return processDetails(pids, 'start', platform, run);
-}
-/** The command line of each running process in `pids`, which the system is willing to show. */
-export function processCommands(pids, platform = process.platform, run = runCommand) {
-    return processDetails(pids, 'command', platform, run);
-}
-export function processStart(pid, platform = process.platform) {
-    return processStarts([pid], platform).get(pid) ?? null;
-}
-/** The records that still name the very process they were taken from. */
-export function stillRunning(records) {
-    const pidsOf = (list) => list.map((record) => record.pid).filter((pid) => Number.isInteger(pid));
-    const legacy = records.filter((record) => typeof record.processStart !== 'string');
-    const starts = processStarts(pidsOf(records.filter((record) => !legacy.includes(record))));
-    const commands = legacy.length > 0 ? processCommands(pidsOf(legacy)) : new Map();
-    return records.filter((record) => legacy.includes(record)
-        ? // We only ever write start tokens, so a legacy record naming our own pid
-            // was left by an earlier process that happened to have it.
-            record.pid !== process.pid && OUR_ENTRY_POINT.test(commands.get(record.pid) ?? '')
-        : starts.get(record.pid) === record.processStart);
-}

package/dist/lifecycle.js

@@ -1,79 +0,0 @@
-// Start/stop/restart that respect the keep-alive manager.
-//
-// When systemd or launchd supervises the services, killing the processes just
-// makes the manager start them again — and starting them by hand produces a
-// second, unmanaged copy fighting for the port. Every entry point goes through
-// here so the managed and unmanaged paths behave the same from the outside.
-import { loadConfig } from './config.js';
-import * as keepalive from './keepalive/index.js';
-import { managedPids, readRuntime } from './runtime.js';
-import { restartServices, startServices, statusServices, stopServices } from './service.js';
-function managerInUse(config) {
-    const status = keepalive.status(config);
-    return status.installed || status.active ? status : null;
-}
-function startAll(config = loadConfig()) {
-    const managed = managerInUse(config);
-    if (managed) {
-        // Start means "make it run", not "restart it". Herdr runs this through the
-        // plugin's startup hook every time a Herdr server starts, and a restart
-        // there dropped every browser attached to the workstation — including the
-        // one that had just asked for that Herdr to be started.
-        if (!managed.active)
-            keepalive.restart(config);
-        return {
-            ok: true,
-            managed: true,
-            manager: managed.manager,
-            alreadyRunning: Boolean(managed.active),
-        };
-    }
-    return { ...startServices(), managed: false };
-}
-function stopAll(config = loadConfig()) {
-    const result = keepalive.stopManaged(config);
-    if (result.managed) {
-        // The manager stops the supervisor, which stops its children; clear the
-        // recorded pids so status does not report ghosts.
-        stopServices();
-        return { ok: true, managed: true, manager: result.manager };
-    }
-    return { ...stopServices(), managed: false };
-}
-function restartAll(config = loadConfig()) {
-    const managed = managerInUse(config);
-    if (managed) {
-        keepalive.restart(config);
-        return { ok: true, managed: true, manager: managed.manager };
-    }
-    return { ...restartServices(), managed: false };
-}
-/** Whether the host connector is up, under a keep-alive manager or detached. */
-function servicesRunning(config = loadConfig()) {
-    if (managerInUse(config)?.active)
-        return true;
-    const state = readRuntime();
-    return managedPids(state).some(({ pid }) => pid === state.hostPid);
-}
-/** Stop Windows keep-alive processes while npm replaces their package files. */
-async function whileServicesStopped(config, task, { platform = process.platform, isRunning = () => servicesRunning(config), stop = stopAll, start = startAll, } = {}) {
-    if (platform !== 'win32' || !isRunning())
-        return task();
-    await stop(config);
-    try {
-        return await task();
-    }
-    finally {
-        await start(config);
-    }
-}
-/** Service status plus the keep-alive picture, which is what the TUI shows. */
-async function fullStatus(config = loadConfig()) {
-    const [services, keepaliveStatus] = [await statusServices(), keepalive.status(config)];
-    return {
-        ...services,
-        keepalive: keepaliveStatus,
-        logsHint: keepalive.logsHint(config),
-    };
-}
-export { startAll, stopAll, restartAll, fullStatus, managerInUse, servicesRunning, whileServicesStopped, };

package/dist/net-interfaces.js

@@ -1,82 +0,0 @@
-import os from 'node:os';
-// Interface names that are almost always virtual bridges rather than something
-// a phone can reach. They are still listed, just ranked last.
-const VIRTUAL_NAME_PATTERN = /^(docker|br-|virbr|veth|vmnet|vboxnet|lxcbr|cni|flannel|kube|vmware network adapter|virtualbox host-only)/i;
-const TAILSCALE_NAME_PATTERN = /^(tailscale|ts)\d*$/i;
-/**
- * Is this address inside Tailscale's 100.64.0.0/10 CGNAT range? Interface names
- * differ per platform (tailscale0 on Linux, utunN on macOS), so the address
- * range is the portable signal.
- */
-function isTailscaleAddress(address) {
-    const octets = String(address).split('.');
-    if (octets.length !== 4)
-        return false;
-    const first = Number(octets[0]);
-    const second = Number(octets[1]);
-    if (!Number.isInteger(first) || !Number.isInteger(second))
-        return false;
-    return first === 100 && second >= 64 && second <= 127;
-}
-/**
- * Windows assigns 169.254 addresses when DHCP fails, and other devices cannot
- * reach them.
- */
-function isLinkLocalAddress(address) {
-    const octets = String(address).split('.');
-    if (octets.length !== 4)
-        return false;
-    return Number(octets[0]) === 169 && Number(octets[1]) === 254;
-}
-function classify(name, info) {
-    if (info.internal)
-        return 'loopback';
-    if (TAILSCALE_NAME_PATTERN.test(name) || isTailscaleAddress(info.address))
-        return 'tailscale';
-    if (isLinkLocalAddress(info.address) || VIRTUAL_NAME_PATTERN.test(name))
-        return 'virtual';
-    return 'lan';
-}
-const KIND_ORDER = { tailscale: 0, lan: 1, virtual: 2, loopback: 3 };
-/**
- * Addresses this machine can be reached at, best candidate first.
- *
- * Tailscale addresses come first because a device on the tailnet reaches them
- * from anywhere, which is exactly the "works away from home without running a
- * relay" case; plain LAN addresses follow, then virtual bridges, then loopback.
- */
-function listReachableAddresses({ includeLoopback = true, includeIpv6 = false, interfaces = os.networkInterfaces(), } = {}) {
-    const results = [];
-    for (const [name, entries] of Object.entries(interfaces)) {
-        for (const info of entries || []) {
-            // Older Node releases reported the family as a number.
-            const rawFamily = info.family;
-            const family = typeof rawFamily === 'string' ? rawFamily : `IPv${rawFamily}`;
-            if (family !== 'IPv4' && !(includeIpv6 && family === 'IPv6'))
-                continue;
-            const kind = classify(name, info);
-            if (kind === 'loopback' && !includeLoopback)
-                continue;
-            results.push({
-                name,
-                address: info.address,
-                family,
-                kind,
-                internal: Boolean(info.internal),
-            });
-        }
-    }
-    results.sort((a, b) => {
-        const byKind = KIND_ORDER[a.kind] - KIND_ORDER[b.kind];
-        if (byKind !== 0)
-            return byKind;
-        return a.address.localeCompare(b.address);
-    });
-    return results;
-}
-/** Best guess for the address to advertise when binding to every interface. */
-function preferredLanAddress(interfaces = os.networkInterfaces()) {
-    const candidates = listReachableAddresses({ includeLoopback: false, interfaces });
-    return candidates.length > 0 ? candidates[0].address : null;
-}
-export { isTailscaleAddress, listReachableAddresses, preferredLanAddress };

package/dist/node-pty-loader.js

@@ -1,80 +0,0 @@
-// Where node-pty is loaded from.
-//
-// npm updates this package by renaming its directory and deleting the old one,
-// and Windows refuses both while a process has a file in it loaded: node-pty's
-// .node modules, or the OpenConsole.exe that ConPTY starts from beside them.
-// The host connector and the admin broker hold those for as long as they run,
-// so on Windows node-pty is loaded from a copy in the state directory, one per
-// build. Copies are never deleted: a process of an older release may still
-// have one loaded, and a build is a few megabytes.
-import { createHash } from 'node:crypto';
-import fs from 'node:fs';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import { stateDir } from './paths.js';
-const require = createRequire(import.meta.url);
-/** What node-pty loads or starts; debug symbols are most of the prebuilds' size. */
-const BINARY_EXTENSIONS = ['.node', '.dll', '.exe'];
-/** The files a running node-pty needs, relative to its package directory. */
-function runtimeFiles(source, platform, arch) {
-    const files = ['package.json'];
-    const collect = (directory, keep) => {
-        const absolute = path.join(source, directory);
-        if (!fs.existsSync(absolute))
-            return;
-        for (const entry of fs.readdirSync(absolute, { recursive: true, withFileTypes: true })) {
-            if (entry.isFile() && keep(entry.name))
-                files.push(path.relative(source, path.join(entry.parentPath, entry.name)));
-        }
-    };
-    collect('lib', (name) => name.endsWith('.js') && !name.endsWith('.test.js'));
-    const binary = (name) => BINARY_EXTENSIONS.includes(path.extname(name));
-    // Where node-pty looks for its modules: a local build, then the prebuilds.
-    collect(path.join('build', 'Release'), binary);
-    collect(path.join('prebuilds', `${platform}-${arch}`), binary);
-    return files;
-}
-/** Copy node-pty's run-time files under `directory`, once per build; returns the copy. */
-export function copyNodePty(source, directory, platform, arch) {
-    const files = runtimeFiles(source, platform, arch);
-    const hash = createHash('sha256');
-    for (const file of files)
-        hash.update(`${file}\0`).update(fs.readFileSync(path.join(source, file)));
-    const target = path.join(directory, hash.digest('hex').slice(0, 16));
-    if (fs.existsSync(target))
-        return target;
-    // Renamed into place whole, so a copy that exists is complete.
-    const staging = `${target}.${process.pid}.tmp`;
-    for (const file of files) {
-        fs.mkdirSync(path.dirname(path.join(staging, file)), { recursive: true });
-        fs.copyFileSync(path.join(source, file), path.join(staging, file));
-    }
-    try {
-        fs.renameSync(staging, target);
-    }
-    catch (error) {
-        fs.rmSync(staging, { recursive: true, force: true });
-        // Another process put the same build in place first.
-        if (!fs.existsSync(target))
-            throw error;
-    }
-    return target;
-}
-export function loadNodePty({ platform = process.platform, arch = process.arch, source = path.dirname(require.resolve('node-pty/package.json')), directory = path.join(stateDir(), 'node-pty'), warn = (message) => process.stderr.write(`${message}\n`), } = {}) {
-    if (platform !== 'win32')
-        return require(source);
-    try {
-        return require(copyNodePty(source, directory, platform, arch));
-    }
-    catch (error) {
-        // Terminals still work from the package; only an update has to wait for them to end.
-        warn(`herdr-remote: could not copy node-pty out of the package: ${error.message}`);
-        return require(source);
-    }
-}
-let loaded = null;
-/** node-pty, loaded on first use: only processes that start terminals pay for it. */
-export function nodePty() {
-    loaded ??= loadNodePty();
-    return loaded;
-}

package/dist/pasted-files.js

@@ -1,115 +0,0 @@
-/**
- * Secure file storage and validation for pasted clipboard images.
- *
- * Security requirements:
- * 1. Pinned directory: writes strictly to path.join(stateDir(), 'pasted') (directory mode 0o700).
- * 2. Unpredictable filename: generated via crypto.randomUUID(), never using client-provided strings.
- * 3. Whitelisted extension: derived exclusively from verified MIME type.
- * 4. Host-side size check: re-validated to enforce <= 3 MB independently of relay checks.
- * 5. Magic bytes sniffing: inspects raw binary headers (PNG, JPEG, GIF, WebP) to prevent file-type spoofing.
- * 6. File mode: files are created with mode 0o600.
- * 7. Automatic pruning: caps at 20 files and 50 MB (oldest deleted first), removes >24h stale files at startup.
- */
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { stateDir } from './paths.js';
-import { ensureDir } from 'herdr-remote-relay/state';
-import { PASTE_MAX_BYTES, PASTE_IMAGE_EXTENSIONS, isPasteImageMime, hasImageSignature, } from 'herdr-remote-relay/protocol';
-const MAX_SAVED_FILES = 20;
-const MAX_TOTAL_BYTES = 50 * 1024 * 1024; // 50 MB
-const MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
-function getPastedDir() {
-    const dir = path.join(stateDir(), 'pasted');
-    ensureDir(dir);
-    return dir;
-}
-/**
- * Prunes the pasted directory:
- * - Removes files older than maxAgeMs (default 24 hours).
- * - Caps total file count (default 20) and total disk footprint (default 50 MB),
- *   deleting oldest files first.
- */
-function cleanPastedDir({ dir = getPastedDir(), maxFiles = MAX_SAVED_FILES, maxBytes = MAX_TOTAL_BYTES, maxAgeMs = MAX_AGE_MS, now = Date.now(), } = {}) {
-    let entries;
-    try {
-        entries = fs.readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return;
-    }
-    const fileInfos = [];
-    for (const entry of entries) {
-        if (!entry.isFile())
-            continue;
-        const fullPath = path.join(dir, entry.name);
-        try {
-            const stat = fs.statSync(fullPath);
-            if (now - stat.mtimeMs > maxAgeMs) {
-                try {
-                    fs.unlinkSync(fullPath);
-                }
-                catch {
-                    // Removed by another process meanwhile, or not ours to remove: skip it.
-                }
-                continue;
-            }
-            fileInfos.push({ path: fullPath, size: stat.size, mtimeMs: stat.mtimeMs });
-        }
-        catch {
-            // The file vanished between listing and stat; nothing to account for.
-        }
-    }
-    // Sort oldest first
-    fileInfos.sort((a, b) => a.mtimeMs - b.mtimeMs);
-    let totalSize = fileInfos.reduce((sum, f) => sum + f.size, 0);
-    while (fileInfos.length > maxFiles || totalSize > maxBytes) {
-        const oldest = fileInfos.shift();
-        if (!oldest)
-            break;
-        try {
-            fs.unlinkSync(oldest.path);
-            totalSize -= oldest.size;
-        }
-        catch {
-            // Pruning is best effort; the next save prunes again.
-        }
-    }
-}
-/**
- * Validates base64 data, checks payload limits, sniffs magic bytes against declared MIME,
- * writes to state storage with mode 0o600, and returns the absolute local path.
- */
-function savePastedFile({ mime, dataBase64, dir = getPastedDir(), }) {
-    if (!isPasteImageMime(mime)) {
-        throw new Error(`unsupported MIME type: ${mime}`);
-    }
-    if (typeof dataBase64 !== 'string') {
-        throw new Error('missing or invalid dataBase64 payload');
-    }
-    const buf = Buffer.from(dataBase64, 'base64');
-    if (buf.length > PASTE_MAX_BYTES) {
-        throw new Error(`file size (${buf.length} bytes) exceeds maximum limit of 3 MB`);
-    }
-    if (buf.length === 0) {
-        throw new Error('file payload is empty');
-    }
-    if (!hasImageSignature(mime, buf)) {
-        throw new Error(`file magic bytes do not match declared MIME type ${mime}`);
-    }
-    // Prune before writing new file
-    cleanPastedDir({ dir });
-    const fileName = `${crypto.randomUUID()}${PASTE_IMAGE_EXTENSIONS[mime]}`;
-    const filePath = path.join(dir, fileName);
-    fs.writeFileSync(filePath, buf, { mode: 0o600, flag: 'wx' });
-    try {
-        fs.chmodSync(filePath, 0o600);
-    }
-    catch {
-        // The file was created 0600 already; chmod only guards against a lax umask.
-    }
-    // Prune again after writing to strictly observe count/size ceiling
-    cleanPastedDir({ dir });
-    return filePath;
-}
-export { cleanPastedDir, savePastedFile };