local-agent-dashboard 0.3.3 → 0.3.5

package/README.md

@@ -21,7 +21,7 @@ brew install openssl@3
 在终端运行：
 
 ```sh
-npx local-agent-dashboard@0.3.3
+npx local-agent-dashboard@0.3.5
 ```
 
 第一次运行时，npx 会询问是否下载，输入 `y` 确认即可。启动后会自动打开浏览器，显示这台电脑最近的任务。
@@ -30,7 +30,7 @@ npx local-agent-dashboard@0.3.3
 
 ## 连接 Android 手机
 
-1. 从 [GitHub 下载 0.3.3 的 Android 安装包](https://github.com/jiahim/local-agent-dashboard/releases/tag/v0.3.3)，在手机上安装。请选择 `.apk` 文件；无需安装 Expo Go。
+1. 从 [GitHub 下载 0.3.5 的 Android 安装包](https://github.com/jiahim/local-agent-dashboard/releases/tag/v0.3.5)，在手机上安装。请选择 `.apk` 文件；无需安装 Expo Go。
 2. 让手机和电脑连接同一个 Wi-Fi，或处于可以互相访问的局域网。
 3. 在电脑页面点击 **连接手机**，确认网络地址，再点击 **应用所选地址**。默认会选中所有可用地址，也可以用全选、反选来调整。
 4. 点击 **生成配对邀请**。打开手机 App，在 **设置 → 电脑连接** 中扫码；也可以把配对链接发送到手机，点击链接打开 App。
@@ -44,15 +44,15 @@ npx local-agent-dashboard@0.3.3
 
 | 用途 | 命令 |
 | --- | --- |
-| 检查运行环境，排查启动问题 | `npx local-agent-dashboard@0.3.3 --doctor` |
-| 用示例任务体验界面 | `npx local-agent-dashboard@0.3.3 --demo` |
-| 启动时不自动打开浏览器 | `npx local-agent-dashboard@0.3.3 --no-open` |
-| 查看全部参数 | `npx local-agent-dashboard@0.3.3 --help` |
+| 检查运行环境，排查启动问题 | `npx local-agent-dashboard@0.3.5 --doctor` |
+| 用示例任务体验界面 | `npx local-agent-dashboard@0.3.5 --demo` |
+| 启动时不自动打开浏览器 | `npx local-agent-dashboard@0.3.5 --no-open` |
+| 查看全部参数 | `npx local-agent-dashboard@0.3.5 --help` |
 
 如果下载的是 Release 中的 `.tgz` 文件，在文件所在目录运行：
 
 ```sh
-npx --package ./local-agent-dashboard-0.3.3.tgz local-agent-dashboard
+npx --package ./local-agent-dashboard-0.3.5.tgz local-agent-dashboard
 ```
 
 ## 数据保存在哪里？
@@ -67,7 +67,7 @@ npx --package ./local-agent-dashboard-0.3.3.tgz local-agent-dashboard
 
 也可以用 `--state-dir <目录>` 指定已有数据目录。同一个目录不要同时运行两个服务。通过源码启动时使用的 `.runtime` 目录不会自动迁移。
 
-**目前电脑服务重启后，需要在电脑上重新确认手机连接。** 电脑身份会保留，但已批准的手机连接尚未持久保存。
+已批准手机的授权和已启用的网络地址保存在同一用户数据目录。服务重启或更新 npm 版本后会恢复；撤销授权也会保存。旧版本已经丢失的授权需重新配对一次，之后可保留。
 
 ## 隐私与使用范围
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-agent-dashboard",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "在 Android 手机上查看 Mac 的 Codex 和 Claude Code 任务状态",
   "repository": {
     "type": "git",

package/src/application/pairing.js

@@ -14,7 +14,9 @@ export class Pairing {
     revokeListeners = new Set();
     now;
     onRevoke;
-    constructor(now = Date.now, onRevoke = () => { }) { this.now = now; this.onRevoke = onRevoke; }
+    store;
+    constructor(now = Date.now, onRevoke = () => { }, store) { this.now = now; this.onRevoke = onRevoke; this.store = store; for (const d of store?.load() ?? [])
+        this.devices.set(d.id, d); }
     createInvite() {
         this.requests.clear();
         return this.invite = { secret: secret(), expiresAt: this.now() + 120_000, consumed: false };
@@ -57,7 +59,9 @@ export class Pairing {
         if (this.devices.size >= 64)
             throw new ProtocolError(429, 'device_limit');
         const token = secret(), deviceId = randomUUID();
-        this.devices.set(deviceId, { id: deviceId, name: r.name, tokenHash: hash(token), createdAt: this.now(), revoked: false });
+        const device = { id: deviceId, name: r.name.trim(), tokenHash: hash(token), createdAt: this.now(), revoked: false };
+        this.store?.save([...this.devices.values(), device]);
+        this.devices.set(deviceId, device);
         r.state = 'claimed';
         this.invite.consumed = true;
         return { state: 'paired', deviceId, token };
@@ -70,7 +74,7 @@ export class Pairing {
     }
     subscribeRevoke(listener) { this.revokeListeners.add(listener); return () => this.revokeListeners.delete(listener); }
     revoke(id) { const d = this.devices.get(id); if (!d)
-        throw new ProtocolError(404, 'unknown_device'); d.revoked = true; this.onRevoke(id); for (const listener of this.revokeListeners)
+        throw new ProtocolError(404, 'unknown_device'); this.store?.save([...this.devices.values()].map(item => item.id === id ? { ...item, revoked: true } : item)); d.revoked = true; this.onRevoke(id); for (const listener of this.revokeListeners)
         listener(id); }
     ack(d, instanceId, revision) {
         if (d.revoked)

package/src/composition/main.js

@@ -2,10 +2,11 @@ import { networkInterfaces, hostname } from 'node:os';
 import { readFile, writeFile, mkdir, unlink } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import { join, resolve } from 'node:path';
-import { X509Certificate } from 'node:crypto';
+import { X509Certificate, createHash } from 'node:crypto';
 import { Collector, demoSnapshot } from "../adapters/agents/log-collector.js";
 import { Snapshots } from "../application/snapshots.js";
 import { Pairing } from "../application/pairing.js";
+import { PairingStore } from "../infrastructure/pairing-store.js";
 import { certificates } from "../infrastructure/certificates.js";
 import { pairingLink } from "../infrastructure/pairing-link.js";
 import { spawn } from 'node:child_process';
@@ -18,10 +19,21 @@ export async function main(options = {}) {
     const port = Number(value('--port') ?? 0), lanPort = Number(value('--lan-port') ?? 63982), hours = Number(value('--hours') ?? 24);
     if (![port, lanPort].every(p => Number.isInteger(p) && p >= 0 && p <= 65535) || !Number.isFinite(hours) || hours < 1 || hours > 168)
         throw new Error('端口或 hours 参数无效');
-    const initial = value('--lan')?.split(',') ?? [];
+    const explicitLan = args.includes('--lan');
     const runtime = options.runtimeRoot ?? (value('--state-dir') ? resolve(value('--state-dir')) : fileURLToPath(new URL('../../.runtime/', import.meta.url)));
-    let interfacesConfigured = args.includes('--lan');
     await mkdir(runtime, { recursive: true, mode: 0o700 });
+    const authorizations = new PairingStore(runtime);
+    let savedIdentity;
+    try {
+        savedIdentity = createHash('sha256').update(new X509Certificate(await readFile(join(runtime, 'identity', 'ca.pem'))).raw).digest('hex');
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+    }
+    authorizations.verifyIdentity(savedIdentity);
+    let interfacesConfigured = explicitLan || authorizations.addresses !== null;
+    const initial = explicitLan ? (value('--lan')?.split(',').filter(Boolean) ?? []) : (authorizations.addresses ?? []).filter(a => interfaces().some(i => i.address === a));
     const lock = join(runtime, 'host.lock');
     try {
         await writeFile(lock, String(process.pid), { flag: 'wx', mode: 0o600 });
@@ -43,14 +55,14 @@ export async function main(options = {}) {
     }
     const collector = new Collector({ hours });
     const snapshots = new Snapshots(() => args.includes('--demo') ? demoSnapshot() : collector.snapshot());
-    const pairing = new Pairing();
+    const pairing = new Pairing(Date.now, () => { }, authorizations);
     const lanServers = new Map();
     let localServer;
     let identity;
     let addresses = [], endpoints = [], servicePort = lanPort, changing = false, stopping = false;
     let certificateWarning = '';
     const close = (s) => { s.closeAllConnections(); s.close(); };
-    async function chooseInterfaces(next) {
+    async function chooseInterfaces(next, persist = true) {
         const available = interfaces();
         if (changing || stopping || next.length > 8 || new Set(next).size !== next.length || next.some(a => typeof a !== 'string' || !available.some(i => i.address === a)))
             throw new Error('请选择本机现有的明确 IPv4 地址');
@@ -59,6 +71,7 @@ export async function main(options = {}) {
         try {
             if (next.length) {
                 const renewed = await certificates(join(runtime, 'identity'), next);
+                authorizations.verifyIdentity(renewed.computerId);
                 if (identity && renewed.computerId !== identity.computerId)
                     throw new Error('电脑根已改变，需要明确重新配对');
                 for (const address of next)
@@ -74,6 +87,8 @@ export async function main(options = {}) {
                 identity = renewed;
                 certificateWarning = '';
             }
+            if (persist)
+                authorizations.configure(identity?.computerId ?? savedIdentity, next);
             for (const [address, server] of lanServers)
                 if (!next.includes(address)) {
                     close(server);
@@ -106,10 +121,10 @@ export async function main(options = {}) {
     }, 3600000);
     renewal.unref();
     try {
-        await chooseInterfaces(initial);
+        await chooseInterfaces(initial, explicitLan);
         const local = createDashboard(() => snapshots.get(), async (action, input) => {
             if (action === 'status')
-                return { ...pairing.status(), available: interfaces(), selectedAddresses: addresses, interfacesConfigured, endpoints, computerId: identity?.computerId, name: hostname(), restartRequiresApproval: true, certificateWarning };
+                return { ...pairing.status(), available: interfaces(), selectedAddresses: addresses, interfacesConfigured, endpoints, computerId: identity?.computerId, name: hostname(), restartRequiresApproval: false, certificateWarning };
             if (action === 'interfaces') {
                 if (!Array.isArray(input.addresses))
                     throw new Error('invalid addresses');
@@ -145,7 +160,7 @@ export async function main(options = {}) {
             browser.on('error', () => { });
             browser.unref();
         }
-        console.log(`Local Agent Dashboard（${args.includes('--demo') ? '示例任务' : '读取本机任务状态'}）\n电脑管理页面：${url}\n${endpoints.length ? `手机连接地址：${endpoints.join(', ')}\n服务重启后，需要在电脑上重新确认手机连接。` : '尚未开启手机连接。请在电脑页面点击「连接手机」，选择网络地址后启用。'}`);
+        console.log(`Local Agent Dashboard（${args.includes('--demo') ? '示例任务' : '读取本机任务状态'}）\n电脑管理页面：${url}\n${endpoints.length ? `手机连接地址：${endpoints.join(', ')}\n已批准手机的授权已保存，服务重启后可继续连接。` : '尚未开启手机连接。请在电脑页面点击「连接手机」，选择网络地址后启用。'}`);
     }
     catch (e) {
         clearInterval(renewal);

package/src/infrastructure/pairing-store.js

@@ -0,0 +1,116 @@
+import { constants, openSync, closeSync, readFileSync, writeFileSync, fsyncSync, renameSync, unlinkSync, lstatSync, fstatSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { isIP } from 'node:net';
+const fingerprint = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+function decode(value) {
+    const s = value;
+    const addressesValid = s && (s.addresses === null || Array.isArray(s.addresses)
+        && s.addresses.length <= 8 && new Set(s.addresses).size === s.addresses.length
+        && s.addresses.every(a => typeof a === 'string' && isIP(a) === 4 && a !== '0.0.0.0'));
+    if (!s || s.version !== 1 || !(s.computerId === null || fingerprint(s.computerId))
+        || !addressesValid || !Array.isArray(s.devices) || s.devices.length > 64) {
+        throw Error('设备授权文件无效；请恢复备份，不会自动清空授权。');
+    }
+    const ids = new Set(), tokens = new Set();
+    for (const d of s.devices) {
+        if (!d || typeof d.id !== 'string' || !/^[a-f0-9-]{36}$/.test(d.id) || ids.has(d.id)
+            || !fingerprint(d.tokenHash) || tokens.has(d.tokenHash) || typeof d.name !== 'string'
+            || !d.name.trim() || d.name.length > 60 || /[\x00-\x1f]/.test(d.name)
+            || !Number.isSafeInteger(d.createdAt) || d.createdAt < 0 || typeof d.revoked !== 'boolean') {
+            throw Error('设备授权记录无效；不会自动清空授权。');
+        }
+        ids.add(d.id);
+        tokens.add(d.tokenHash);
+    }
+    if (s.devices.length && !s.computerId)
+        throw Error('设备授权缺少电脑身份。');
+    return {
+        version: 1, computerId: s.computerId, addresses: s.addresses,
+        devices: s.devices.map(({ id, name, tokenHash, createdAt, revoked }) => ({ id, name, tokenHash, createdAt, revoked })),
+    };
+}
+// Only approved token hashes are durable. Invitations and delivery ACKs are process-local.
+export class PairingStore {
+    file;
+    state;
+    constructor(privateRoot) {
+        const root = lstatSync(privateRoot);
+        if (!root.isDirectory() || root.isSymbolicLink() || (root.mode & 0o077) !== 0
+            || process.getuid && root.uid !== process.getuid()) {
+            throw Error('用户数据目录必须由当前用户独占（权限 0700）。');
+        }
+        this.file = join(privateRoot, 'authorized-devices.json');
+        this.state = { version: 1, computerId: null, addresses: null, devices: [] };
+        let fd;
+        try {
+            fd = openSync(this.file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT') {
+                // A dangling link must not masquerade as a missing file.
+                try {
+                    lstatSync(this.file);
+                    throw Error('拒绝链接形式的设备授权文件。');
+                }
+                catch (check) {
+                    if (check.code === 'ENOENT')
+                        return;
+                    throw check;
+                }
+            }
+            throw Error('无法安全读取设备授权文件。');
+        }
+        try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.size > 65536 || (stat.mode & 0o077) !== 0
+                || process.getuid && stat.uid !== process.getuid())
+                throw Error('设备授权文件权限或大小无效。');
+            let value;
+            try {
+                value = JSON.parse(readFileSync(fd, 'utf8'));
+            }
+            catch {
+                throw Error('设备授权文件无法读取或已损坏；请恢复备份，不会自动清空授权。');
+            }
+            this.state = decode(value);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    get addresses() { return this.state.addresses === null ? null : [...this.state.addresses]; }
+    verifyIdentity(computerId) {
+        if (this.state.computerId && this.state.computerId !== computerId) {
+            throw Error('电脑身份与已保存的设备授权不一致；请恢复原身份，或明确重新配对。');
+        }
+    }
+    load() { return this.state.devices.map(d => ({ ...d })); }
+    save(devices) { this.persist({ ...this.state, devices }); }
+    configure(computerId, addresses) {
+        this.verifyIdentity(computerId);
+        this.persist({ ...this.state, computerId: computerId ?? null, addresses });
+    }
+    persist(value) {
+        const next = decode(value), temporary = `${this.file}.${randomUUID()}.tmp`;
+        const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(next) + '\n');
+            fsyncSync(fd);
+        }
+        catch (e) {
+            closeSync(fd);
+            unlinkSync(temporary);
+            throw e;
+        }
+        closeSync(fd);
+        try {
+            renameSync(temporary, this.file);
+        }
+        catch (e) {
+            unlinkSync(temporary);
+            throw e;
+        }
+        this.state = next;
+    }
+}