linkshell-cli 0.10.65 → 0.10.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linkshell-cli",
-  "version": "0.10.65",
+  "version": "0.10.66",
   "description": "Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone",
   "type": "module",
   "main": "dist/cli/src/index.js",
@@ -34,9 +34,9 @@
     "node-pty": "^1.1.0",
     "qrcode-terminal": "^0.12.0",
     "ws": "^8.21.0",
-    "@linkshell/gateway": "0.6.37",
+    "@linkshell/host": "0.4.63",
     "@linkshell/wire": "0.2.20",
-    "@linkshell/host": "0.4.62"
+    "@linkshell/gateway": "0.6.37"
   },
   "devDependencies": {
     "@types/ws": "^8.5.14",

package/src/commands/desktop.ts

@@ -12,6 +12,7 @@ import { sep, join } from "node:path";
 import { ensureHostRunning, silenceSqliteWarning, withRunningHost } from "./host.js";
 import { linkshellDir, readHostLaunch, readHostOwner, readPid, stopDaemonAndWait } from "../utils/daemon.js";
 import { cachedMembership, redeemDesktopPro, refreshMembership } from "../pro-membership.js";
+import { accessPasswordEnabled, applyAccessPassword } from "./password.js";
 
 export function installationSource(path: string): "homebrew" | "npm" {
   return path.includes(`${sep}Cellar${sep}linkshell${sep}`) ? "homebrew" : "npm";
@@ -27,7 +28,8 @@ export async function desktopSnapshot(version: string) {
   let executable = process.argv[1]!;
   try { executable = realpathSync(executable); } catch { /* Retain the launch path for diagnosis. */ }
   const account = desktopAccount();
-  const base = { account, schema: 1, cliVersion: version, home: linkshellDir(), source: standaloneBundle() ? "standalone" : installationSource(executable), executable, hostOwner: readPid("host") ? readHostOwner(readPid("host")!) ?? "external" : "none", appBundle: standaloneBundle() };
+  const access = { password: await accessPasswordEnabled().catch(() => false) };
+  const base = { account, access, schema: 1, cliVersion: version, home: linkshellDir(), source: standaloneBundle() ? "standalone" : installationSource(executable), executable, hostOwner: readPid("host") ? readHostOwner(readPid("host")!) ?? "external" : "none", appBundle: standaloneBundle() };
   const result = await withRunningHost(async (client) => {
     const machine = await client.call("machine.info", {}, 5000);
     const [gateway, sessions] = await Promise.all([
@@ -40,6 +42,22 @@ export async function desktopSnapshot(version: string) {
   return result ? { ...base, status: "running", ...result } : { ...base, status: readPid("host") ? "unreachable" : "stopped" };
 }
 
+/** The new password, as JSON on stdin (never on the command line, where `ps` shows it). */
+async function passwordInput(input: AsyncIterable<string | Buffer>): Promise<string> {
+  const chunks: Buffer[] = [];
+  let length = 0;
+  for await (const chunk of input) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    length += buffer.length;
+    if (length > 4096) throw new Error("密码过长，请输入 4 到 128 位");
+    chunks.push(buffer);
+  }
+  let password: unknown;
+  try { password = JSON.parse(Buffer.concat(chunks).toString("utf8"))?.password; } catch { /* Never echo the input. */ }
+  if (typeof password !== "string" || password.length < 4 || password.length > 128) throw new Error("密码需要 4 到 128 位");
+  return password;
+}
+
 async function redemptionInput(input: AsyncIterable<string | Buffer>): Promise<{ code: string; userId: string }> {
   const chunks: Buffer[] = [];
   let length = 0;
@@ -122,6 +140,8 @@ export async function runDesktop(version: string, action: string, input: AsyncIt
       await ensureHostRunning();
       await refreshGateway(15_000);
     }
+    else if (action === "set-password") await applyAccessPassword(await passwordInput(input));
+    else if (action === "remove-password") await applyAccessPassword(undefined);
     else if (action === "prepare-update") { await prepareDesktopUpdate(); }
     else if (action === "recover-update") { await recoverDesktopUpdate(version); }
     else if (action === "stop-update-host") { await stopDesktopUpdateHost(); }

package/src/commands/password.ts

@@ -1,6 +1,6 @@
 import { RpcError } from "@linkshell/wire";
 import { linkshellDir } from "../utils/daemon.js";
-import { assertHostRuntime, withRunningHost } from "./host.js";
+import { assertHostRuntime, silenceSqliteWarning, withRunningHost } from "./host.js";
 
 /** Reads a line without echoing it; from a pipe, just the first line. */
 function readHidden(prompt: string): Promise<string> {
@@ -44,7 +44,7 @@ function unknownMethod(error: unknown): boolean {
 }
 
 /** Applies the change through the running host, or writes it for the next start. */
-async function apply(password: string | undefined): Promise<"live" | "restart" | "file"> {
+export async function applyAccessPassword(password: string | undefined): Promise<"live" | "restart" | "file"> {
   try {
     const result = await withRunningHost((client) => client.call("access.set", password ? { password } : {}));
     if (result) return "live";
@@ -60,8 +60,17 @@ async function apply(password: string | undefined): Promise<"live" | "restart" |
   return "file";
 }
 
+/** Whether this computer has an access password: the running host's answer, else the file. */
+export async function accessPasswordEnabled(): Promise<boolean> {
+  const live = await withRunningHost((client) => client.call("access.status", {})).catch(() => undefined);
+  if (live) return live.password;
+  const host = await import("@linkshell/host");
+  return new host.AccessControl(linkshellDir()).enabled;
+}
+
 export async function runPassword(action: "status" | "set" | "remove"): Promise<void> {
   assertHostRuntime();
+  silenceSqliteWarning();
   const host = await import("@linkshell/host");
   if (action === "status") {
     const live = await withRunningHost((client) => client.call("access.status", {})).catch(() => undefined);
@@ -84,7 +93,7 @@ export async function runPassword(action: "status" | "set" | "remove"): Promise<
       throw error;
     }
   }
-  const how = await apply(password);
+  const how = await applyAccessPassword(password);
   const what = password ? "Access password set." : "Access password removed.";
   const when =
     how === "live"