local-agent-dashboard 0.0.0-stage → 0.3.2

package/src/infrastructure/pairing-link.js

@@ -0,0 +1,3 @@
+import { deflateRawSync } from 'node:zlib';
+// The fragment stays out of HTTP requests. It wraps the existing short-lived invitation.
+export function pairingLink(descriptor) { return `agentsignal://pair#${deflateRawSync(Buffer.from(descriptor), { level: 9 }).toString('base64url')}`; }

package/src/infrastructure/qr.js

@@ -0,0 +1,22 @@
+import { existsSync } from 'node:fs';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+export function qrExecutable() {
+    const packaged = fileURLToPath(new URL('../../native/qr', import.meta.url));
+    return existsSync(packaged) ? packaged : fileURLToPath(new URL('../../.tools/qr', import.meta.url));
+}
+export function qr(payload) {
+    return new Promise((done, reject) => {
+        const child = spawn(qrExecutable(), [], { stdio: ['pipe', 'pipe', 'ignore'] });
+        const chunks = [];
+        let size = 0;
+        child.stdout.on('data', c => { size += c.length; if (size > 2 * 1024 * 1024)
+            child.kill();
+        else
+            chunks.push(c); });
+        child.on('error', reject);
+        child.on('exit', code => code === 0 ? done(Buffer.concat(chunks)) : reject(new Error('QR generator unavailable')));
+        child.stdin.on('error', reject);
+        child.stdin.end(payload);
+    });
+}

package/src/infrastructure/runtime-root.js

@@ -0,0 +1,6 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// npm/npx caches are disposable; computer identity belongs to the user.
+export function userRuntimeRoot(home = homedir()) {
+    return join(home, 'Library', 'Application Support', 'Agent Signal');
+}

package/src/server.js

@@ -0,0 +1,74 @@
+import { createServer } from 'node:http';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+import { body, reply } from "./transport/lan/server.js";
+import { randomBytes } from 'node:crypto';
+const publicRoot = fileURLToPath(new URL('../public/', import.meta.url));
+const files = { '/': ['index.html', 'text/html; charset=utf-8'], '/app.js': ['app.js', 'text/javascript; charset=utf-8'], '/style.css': ['style.css', 'text/css; charset=utf-8'] };
+export function createDashboard(snapshot, management) {
+    const csrf = randomBytes(32).toString('base64url');
+    let inFlight = null;
+    const server = createServer(async (req, res) => {
+        const address = server.address();
+        const expectedHost = typeof address === 'object' && address ? `127.0.0.1:${address.port}` : '';
+        res.setHeader('Cache-Control', 'no-store');
+        res.setHeader('Referrer-Policy', 'no-referrer');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('X-Frame-Options', 'DENY');
+        res.setHeader('Content-Security-Policy', "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'");
+        const fail = (status, message) => { res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' }); res.end(JSON.stringify({ error: message })); };
+        if (req.headers.host !== expectedHost)
+            return fail(403, 'Host rejected');
+        if (req.headers.origin && req.headers.origin !== `http://${expectedHost}`)
+            return fail(403, 'Origin rejected');
+        const path = req.url?.split('?')[0] ?? '';
+        if (management && path.startsWith('/api/manage/')) {
+            try {
+                if (req.method === 'GET' && path === '/api/manage/status')
+                    return reply(res, 200, { csrf, ...await management('status', {}) });
+                if (req.method !== 'POST' || req.headers.origin !== `http://${expectedHost}` || req.headers['x-agent-signal-csrf'] !== csrf)
+                    return fail(403, 'Management session rejected');
+                if (!['invite', 'approve', 'revoke', 'interfaces'].includes(path.slice(12)))
+                    return fail(404, 'Not found');
+                return reply(res, 200, await management(path.slice(12), await body(req)));
+            }
+            catch {
+                return fail(409, '操作未完成；请检查所选地址、端口占用或申请是否过期。');
+            }
+        }
+        if (req.method !== 'GET')
+            return fail(405, 'Read-only endpoint');
+        if (path === '/api/snapshot') {
+            try {
+                inFlight ??= Promise.resolve().then(snapshot).finally(() => { inFlight = null; });
+                const data = await inFlight;
+                res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' });
+                res.end(JSON.stringify(data));
+            }
+            catch {
+                fail(503, '采集暂不可用，请重试');
+            }
+        }
+        else if (files[path]) {
+            try {
+                const [file, type] = files[path];
+                const body = await readFile(resolve(publicRoot, file));
+                res.writeHead(200, { 'Content-Type': type });
+                res.end(body);
+            }
+            catch {
+                fail(503, '页面资源暂不可用');
+            }
+        }
+        else
+            fail(404, 'Not found');
+    });
+    server.requestTimeout = 10_000;
+    server.headersTimeout = 10_000;
+    server.maxConnections = 20;
+    return { server };
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    import("./composition/main.js").then(m => m.main()).catch(e => { console.error(`启动失败：${e.message}`); process.exitCode = 1; });
+}

package/src/state.js

@@ -0,0 +1,2 @@
+// Compatibility entry for the original probe; native format interpretation belongs to adapters.
+export * from "./adapters/agents/log-state.js";

package/src/transport/lan/server.js

@@ -0,0 +1,98 @@
+import { createServer } from 'node:https';
+import { ProtocolError } from "../../application/pairing.js";
+export async function body(req) {
+    if (req.headers['content-type'] !== 'application/json')
+        throw new ProtocolError(415, 'json_required');
+    let bytes = 0;
+    const chunks = [];
+    for await (const chunk of req) {
+        bytes += chunk.length;
+        if (bytes > 8192)
+            throw new ProtocolError(413, 'request_too_large');
+        chunks.push(chunk);
+    }
+    try {
+        const result = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        if (!result || typeof result !== 'object' || Array.isArray(result))
+            throw 0;
+        return result;
+    }
+    catch {
+        throw new ProtocolError(400, 'invalid_json');
+    }
+}
+export function reply(res, code, value) { res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' }); res.end(JSON.stringify(value)); }
+export const tlsPolicy = { minVersion: 'TLSv1.2', maxVersion: 'TLSv1.3',
+    ciphers: 'TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256', honorCipherOrder: true };
+export function createLan(identity, pairing, snapshots, allowedHosts) {
+    const deviceSockets = new Map();
+    const attempts = new Map();
+    const unsubscribe = pairing.subscribeRevoke(id => { for (const socket of deviceSockets.get(id) ?? [])
+        socket.destroy(); deviceSockets.delete(id); });
+    const server = createServer({ key: identity.key, cert: identity.cert, ...tlsPolicy, handshakeTimeout: 10000 }, async (req, res) => {
+        try {
+            if (!allowedHosts().includes(req.headers.host ?? '') || req.headers.origin)
+                throw new ProtocolError(403, 'origin_rejected');
+            if (req.url?.includes('?') || req.url?.includes('#'))
+                throw new ProtocolError(400, 'query_rejected');
+            const ip = req.socket.remoteAddress ?? 'unknown', now = Date.now();
+            for (const [key, v] of attempts)
+                if (now - v.start > 60000)
+                    attempts.delete(key);
+            if (!attempts.has(ip) && attempts.size >= 256)
+                throw new ProtocolError(429, 'busy');
+            const bucket = attempts.get(ip) ?? { start: now, count: 0 };
+            attempts.set(ip, bucket);
+            if (++bucket.count > 120)
+                throw new ProtocolError(429, 'rate_limited');
+            if (req.method === 'GET' && req.url === '/v1/identity')
+                return reply(res, 200, { protocol: 1, computerId: identity.computerId, fingerprint: identity.fingerprint });
+            if (req.method === 'POST' && req.url === '/v1/pair/request') {
+                const b = await body(req);
+                return reply(res, 200, pairing.request(String(b.invitation ?? ''), String(b.challenge ?? ''), String(b.name ?? '')));
+            }
+            if (req.method === 'POST' && req.url === '/v1/pair/claim') {
+                const b = await body(req);
+                return reply(res, 200, pairing.claim(String(b.requestId ?? ''), String(b.challenge ?? '')));
+            }
+            const authorization = req.headers.authorization ?? '';
+            if (!authorization.startsWith('Bearer '))
+                throw new ProtocolError(401, 'repair_required');
+            const token = authorization.slice(7), device = pairing.authenticate(token);
+            const socket = req.socket;
+            if (!deviceSockets.has(device.id))
+                deviceSockets.set(device.id, new Set());
+            if (!deviceSockets.get(device.id).has(socket)) {
+                deviceSockets.get(device.id).add(socket);
+                socket.once('close', () => deviceSockets.get(device.id)?.delete(socket));
+            }
+            if (req.method === 'GET' && req.url === '/v1/snapshot') {
+                const snapshot = await snapshots.get();
+                pairing.authenticate(token); // revocation may have happened while collecting
+                device.issued = { instanceId: snapshot.instanceId, revision: snapshot.revision, generatedAt: snapshot.generatedAt };
+                return reply(res, 200, snapshot);
+            }
+            if (req.method === 'POST' && req.url === '/v1/ack') {
+                const b = await body(req);
+                pairing.ack(device, b.instanceId, b.revision);
+                return reply(res, 200, { accepted: true });
+            }
+            throw new ProtocolError(404, 'not_found');
+        }
+        catch (e) {
+            if (!res.destroyed)
+                reply(res, e instanceof ProtocolError ? e.status : 503, { error: e instanceof ProtocolError ? e.code : 'unavailable' });
+        }
+    });
+    server.requestTimeout = 10000;
+    server.headersTimeout = 10000;
+    server.maxConnections = 32;
+    server.keepAliveTimeout = 5000;
+    const rawSockets = new Set();
+    server.on('connection', socket => { rawSockets.add(socket); socket.once('close', () => rawSockets.delete(socket)); });
+    const closeHTTP = server.closeAllConnections.bind(server);
+    server.closeAllConnections = () => { closeHTTP(); for (const socket of rawSockets)
+        socket.destroy(); };
+    server.once('close', () => { unsubscribe(); deviceSockets.clear(); });
+    return server;
+}