rds_ssm_connect 1.7.13 → 1.7.15

package/configLoader.js

@@ -0,0 +1,86 @@
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+
+const CONFIG_DIR = path.join(os.homedir(), '.rds-ssm-connect')
+const CONFIG_FILE = 'projects.json'
+
+export function getConfigPath() {
+  return path.join(CONFIG_DIR, CONFIG_FILE)
+}
+
+export async function loadProjectConfigs(configPath) {
+  const filePath = configPath || getConfigPath()
+  try {
+    const data = await fs.readFile(filePath, 'utf-8')
+    return JSON.parse(data)
+  } catch (err) {
+    if (err.code === 'ENOENT') return {}
+    throw err
+  }
+}
+
+export async function saveProjectConfigs(configs, configPath) {
+  const filePath = configPath || getConfigPath()
+  await fs.mkdir(path.dirname(filePath), { recursive: true })
+  await fs.writeFile(filePath, JSON.stringify(configs, null, 2) + '\n')
+}
+
+export async function saveProjectConfig(key, config, configPath) {
+  const configs = await loadProjectConfigs(configPath)
+  configs[key] = config
+  await saveProjectConfigs(configs, configPath)
+}
+
+export async function deleteProjectConfig(key, configPath) {
+  const configs = await loadProjectConfigs(configPath)
+  delete configs[key]
+  await saveProjectConfigs(configs, configPath)
+}
+
+const REQUIRED_FIELDS = [
+  'name',
+  'region',
+  'database',
+  'secretPrefix',
+  'rdsType',
+  'rdsPattern',
+  'envPortMapping',
+  'defaultPort',
+]
+
+const VALID_RDS_TYPES = ['cluster', 'instance']
+const REGION_PATTERN = /^[a-z]{2}(-[a-z]+-\d+)$/
+const PORT_PATTERN = /^\d+$/
+
+export function validateProjectConfig(config) {
+  const errors = []
+
+  for (const field of REQUIRED_FIELDS) {
+    if (config[field] === undefined || config[field] === null || config[field] === '') {
+      errors.push(`Missing required field: ${field}`)
+    }
+  }
+
+  if (config.rdsType && !VALID_RDS_TYPES.includes(config.rdsType)) {
+    errors.push(`rdsType must be one of: ${VALID_RDS_TYPES.join(', ')}`)
+  }
+
+  if (config.region && !REGION_PATTERN.test(config.region)) {
+    errors.push(`Invalid region format: ${config.region}`)
+  }
+
+  if (config.defaultPort && !PORT_PATTERN.test(config.defaultPort)) {
+    errors.push(`defaultPort must be a numeric string: ${config.defaultPort}`)
+  }
+
+  if (config.envPortMapping && typeof config.envPortMapping === 'object') {
+    for (const [key, value] of Object.entries(config.envPortMapping)) {
+      if (!PORT_PATTERN.test(value)) {
+        errors.push(`Port for "${key}" must be a numeric string: ${value}`)
+      }
+    }
+  }
+
+  return { valid: errors.length === 0, errors }
+}

package/connect.js

@@ -1,16 +1,20 @@
 #!/usr/bin/env node
 
-import { exec } from 'node:child_process'
+import { exec, spawn } from 'node:child_process'
 import { EventEmitter } from 'node:events'
 import fs from 'node:fs/promises'
 import net from 'node:net'
 import os from 'node:os'
 import path from 'node:path'
 import { promisify } from 'node:util'
-import { PROJECT_CONFIGS } from './envPortMapping.js'
+import {
+  loadProjectConfigs,
+  saveProjectConfig,
+  validateProjectConfig,
+} from './configLoader.js'
 
 // Package info for version checking
-const packageJson = { name: 'rds_ssm_connect', version: '1.7.13' }
+const packageJson = { name: 'rds_ssm_connect', version: '1.7.15' }
 
 const execAsync = promisify(exec)
 
@@ -79,20 +83,30 @@ async function checkForUpdates() {
 // Store active child processes for cleanup
 let activeChildProcesses = []
 
+// Kill entire process group (shell + aws-vault + session-manager-plugin).
+// Requires the child to have been spawned with `detached: true` so that
+// setsid() makes it a process group leader.
+function killProcessTree(child) {
+  if (!child || !child.pid) return
+  try {
+    process.kill(-child.pid, 'SIGTERM') // negative PID = kill entire process group
+  } catch (_err) {
+    // ESRCH: process group already exited — safe to ignore
+  }
+}
+
 // Handle graceful shutdown
 function setupProcessCleanup() {
-  const cleanup = () => {
+  const killAll = () => {
     activeChildProcesses.forEach((child) => {
-      if (child && !child.killed) {
-        child.kill('SIGTERM')
-      }
+      killProcessTree(child)
     })
-    process.exit(0)
+    activeChildProcesses = []
   }
 
-  process.on('SIGINT', cleanup)
-  process.on('SIGTERM', cleanup)
-  process.on('exit', cleanup)
+  process.on('SIGINT', () => { killAll(); process.exit(0) })
+  process.on('SIGTERM', () => { killAll(); process.exit(0) })
+  process.on('exit', killAll)
 }
 
 async function readAwsConfig() {
@@ -247,6 +261,7 @@ async function handleTargetNotConnectedError(
   region,
   retryCount,
   maxRetries,
+  onChild,
 ) {
   // Terminate the disconnected instance
   await terminateBastionInstance(ENV, instanceId, region)
@@ -266,6 +281,7 @@ async function handleTargetNotConnectedError(
     region,
     retryCount + 1,
     maxRetries,
+    onChild,
   )
 }
 
@@ -278,7 +294,11 @@ function executePortForwardingCommand(
   region,
 ) {
   const portForwardingCommand = `aws-vault exec ${ENV} -- aws ssm start-session --region ${region} --target ${instanceId} --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters "host=${rdsEndpoint},portNumber='${remotePort}',localPortNumber='${portNumber}'" --cli-connect-timeout 0`
-  const child = exec(portForwardingCommand)
+  const child = spawn(portForwardingCommand, {
+    shell: true,
+    detached: true,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
 
   // Register child process for cleanup
   activeChildProcesses.push(child)
@@ -295,6 +315,7 @@ async function startPortForwardingWithConfig(
   region,
   retryCount = 0,
   maxRetries = RETRY_CONFIG.PORT_FORWARDING_MAX_RETRIES,
+  onChild,
 ) {
   return new Promise((resolve, reject) => {
     const child = executePortForwardingCommand(
@@ -305,6 +326,11 @@ async function startPortForwardingWithConfig(
       remotePort,
       region,
     )
+    // Notify caller of the new child (used for per-connection tracking).
+    // If the connection was already disconnected, the callback kills this
+    // child immediately so it doesn't linger as an orphan.
+    if (onChild) onChild(child)
+
     const sessionState = monitorPortForwardingSession(child)
 
     child.on('close', async (code) => {
@@ -327,6 +353,7 @@ async function startPortForwardingWithConfig(
             region,
             retryCount,
             maxRetries,
+            onChild,
           )
           resolve()
         } else if (code !== 0) {
@@ -389,21 +416,34 @@ async function getRdsPort(ENV, projectConfig) {
 }
 
 function getProfilesForProject(allProfiles, projectConfig, allProjectConfigs) {
-  const { profileFilter } = projectConfig
+  const { profileFilter, envPortMapping } = projectConfig
 
+  let filtered
   if (profileFilter) {
     // Project has explicit filter - return profiles starting with filter
-    return allProfiles.filter((env) => env.startsWith(profileFilter))
+    filtered = allProfiles.filter((env) => env.startsWith(profileFilter))
   } else {
     // No filter (legacy project like TLN) - return profiles that don't match any other project's filter
     const otherFilters = Object.values(allProjectConfigs)
       .filter((config) => config.profileFilter)
       .map((config) => config.profileFilter)
 
-    return allProfiles.filter(
+    filtered = allProfiles.filter(
       (env) => !otherFilters.some((filter) => env.startsWith(filter)),
     )
   }
+
+  // Further restrict to profiles matching an envPortMapping suffix
+  if (envPortMapping && Object.keys(envPortMapping).length > 0) {
+    const suffixes = Object.keys(envPortMapping).sort(
+      (a, b) => b.length - a.length,
+    )
+    filtered = filtered.filter((env) =>
+      suffixes.some((suffix) => env.endsWith(suffix) || env === suffix),
+    )
+  }
+
+  return filtered
 }
 
 // Get local port number based on environment suffix
@@ -480,6 +520,8 @@ async function getAvailableProjects() {
     return []
   }
 
+  const PROJECT_CONFIGS = await loadProjectConfigs()
+
   return Object.entries(PROJECT_CONFIGS)
     .filter(([_key, config]) => {
       const matchingProfiles = getProfilesForProject(
@@ -498,6 +540,7 @@ async function getAvailableProjects() {
 // Get profiles for a specific project
 async function getProfilesForProjectKey(projectKey) {
   const allProfiles = await readAwsConfig()
+  const PROJECT_CONFIGS = await loadProjectConfigs()
   const projectConfig = PROJECT_CONFIGS[projectKey]
 
   if (!projectConfig) {
@@ -511,6 +554,7 @@ async function getProfilesForProjectKey(projectKey) {
 // Includes keepalive (prevents SSM idle timeout) and auto-reconnect
 // (transparently reconnects on the same port if session drops unexpectedly).
 async function connect(projectKey, profile, options = {}) {
+  const PROJECT_CONFIGS = await loadProjectConfigs()
   const projectConfig = PROJECT_CONFIGS[projectKey]
   if (!projectConfig) {
     throw new Error(`Unknown project: ${projectKey}`)
@@ -522,6 +566,18 @@ async function connect(projectKey, profile, options = {}) {
 
   let manualDisconnect = false
   let stopKeepalive = null
+  let currentChild = null // per-connection child tracking
+
+  // Called whenever a new child process is spawned for this connection.
+  // If disconnect() was already called, kills the child immediately so
+  // it doesn't linger as an orphan during retry chains.
+  const onChild = (child) => {
+    currentChild = child
+    if (manualDisconnect) {
+      killProcessTree(child)
+      activeChildProcesses = activeChildProcesses.filter((p) => p !== child)
+    }
+  }
 
   // Emit status updates
   const emit = (event, data) => {
@@ -579,6 +635,7 @@ async function connect(projectKey, profile, options = {}) {
           region,
           0,
           RETRY_CONFIG.PORT_FORWARDING_MAX_RETRIES,
+          onChild,
         )
 
         // Session ended — clean up keepalive
@@ -651,13 +708,12 @@ async function connect(projectKey, profile, options = {}) {
     disconnect: () => {
       manualDisconnect = true
       stopKeepalive?.()
-      // Kill all active child processes
-      activeChildProcesses.forEach((child) => {
-        if (child && !child.killed) {
-          child.kill('SIGTERM')
-        }
-      })
-      activeChildProcesses = []
+      // Kill only THIS connection's child process group
+      if (currentChild) {
+        killProcessTree(currentChild)
+        activeChildProcesses = activeChildProcesses.filter((p) => p !== currentChild)
+        currentChild = null
+      }
     },
     waitForClose: () => portForwardingPromise,
   }
@@ -674,6 +730,116 @@ async function main() {
   await checkForUpdates()
 
   try {
+    // Load project configs from user config file
+    let PROJECT_CONFIGS = await loadProjectConfigs()
+
+    // First-run wizard: if no projects configured, prompt to create one
+    if (Object.keys(PROJECT_CONFIGS).length === 0) {
+      const { setupNow } = await inquirer.default.prompt([
+        {
+          type: 'confirm',
+          name: 'setupNow',
+          message:
+            'No projects configured. Would you like to set up a project now?',
+          default: true,
+        },
+      ])
+
+      if (!setupNow) {
+        console.log(
+          `\nTo configure manually, create ~/.rds-ssm-connect/projects.json\nSee the README for the config schema.\n`,
+        )
+        return
+      }
+
+      const answers = await inquirer.default.prompt([
+        {
+          type: 'input',
+          name: 'key',
+          message: 'Project key (lowercase, hyphens):',
+          validate: (v) =>
+            /^[a-z][a-z0-9-]*$/.test(v) || 'Lowercase letters, digits, hyphens',
+        },
+        { type: 'input', name: 'name', message: 'Display name:' },
+        {
+          type: 'input',
+          name: 'region',
+          message: 'AWS region:',
+          default: 'us-east-1',
+        },
+        { type: 'input', name: 'database', message: 'Database name:' },
+        {
+          type: 'input',
+          name: 'secretPrefix',
+          message: 'Secret prefix (e.g. rds!cluster):',
+        },
+        {
+          type: 'select',
+          name: 'rdsType',
+          message: 'RDS type:',
+          choices: ['cluster', 'instance'],
+        },
+        {
+          type: 'input',
+          name: 'rdsPattern',
+          message: 'RDS identifier pattern:',
+        },
+        {
+          type: 'input',
+          name: 'profileFilter',
+          message: 'Profile filter prefix (leave empty for none):',
+          default: '',
+        },
+        {
+          type: 'input',
+          name: 'defaultPort',
+          message: 'Default local port:',
+          default: '5432',
+        },
+      ])
+
+      // Collect port mappings
+      const envPortMappingInput = {}
+      let addMore = true
+      while (addMore) {
+        const mapping = await inquirer.default.prompt([
+          { type: 'input', name: 'suffix', message: 'Environment suffix:' },
+          { type: 'input', name: 'port', message: 'Local port:' },
+          {
+            type: 'confirm',
+            name: 'more',
+            message: 'Add another port mapping?',
+            default: false,
+          },
+        ])
+        envPortMappingInput[mapping.suffix] = mapping.port
+        addMore = mapping.more
+      }
+
+      const newConfig = {
+        name: answers.name,
+        region: answers.region,
+        database: answers.database,
+        secretPrefix: answers.secretPrefix,
+        rdsType: answers.rdsType,
+        rdsPattern: answers.rdsPattern,
+        profileFilter: answers.profileFilter || null,
+        envPortMapping: envPortMappingInput,
+        defaultPort: answers.defaultPort,
+      }
+
+      const validation = validateProjectConfig(newConfig)
+      if (!validation.valid) {
+        console.log('\nValidation errors:')
+        validation.errors.forEach((e) => console.log(`  - ${e}`))
+        return
+      }
+
+      await saveProjectConfig(answers.key, newConfig)
+      console.log(`\nProject "${answers.name}" saved!\n`)
+      PROJECT_CONFIGS = await loadProjectConfigs()
+    }
+
     // Read all AWS profiles first
     const allProfiles = await readAwsConfig()
 
@@ -834,6 +1000,6 @@ export {
   getLocalPort,
   connect,
   ipcEmitter,
-  PROJECT_CONFIGS,
+  loadProjectConfigs,
   RETRY_CONFIG,
 }

package/gui-adapter.js

@@ -22,8 +22,13 @@ import {
   getAvailableProjects,
   getLocalPort,
   getProfilesForProjectKey,
-  PROJECT_CONFIGS,
+  loadProjectConfigs,
 } from './connect.js'
+import {
+  deleteProjectConfig,
+  saveProjectConfig,
+  validateProjectConfig,
+} from './configLoader.js'
 
 // Active connections Map - connectionId -> connection control object
 const activeConnections = new Map()
@@ -51,19 +56,6 @@ async function isPortAvailable(port) {
   })
 }
 
-// Find next available port starting from basePort
-async function findAvailablePort(basePort, usedPorts = []) {
-  const usedSet = new Set(usedPorts.map((p) => parseInt(p, 10)))
-
-  for (let port = basePort; port < basePort + 100; port++) {
-    if (usedSet.has(port)) continue
-    if (await isPortAvailable(port)) {
-      return port.toString()
-    }
-  }
-  throw new Error(`No available ports found starting from ${basePort}`)
-}
-
 // Handle incoming commands
 async function handleCommand(command) {
   const { id, action, ...params } = command
@@ -100,7 +92,8 @@ async function handleCommand(command) {
         const connectionId = `conn_${randomUUID().slice(0, 8)}`
 
         // Determine port to use
-        const projectConfig = PROJECT_CONFIGS[projectKey]
+        const configs = await loadProjectConfigs()
+        const projectConfig = configs[projectKey]
         if (!projectConfig) {
           sendResponse(id, 'error', {
             message: `Unknown project: ${projectKey}`,
@@ -108,31 +101,21 @@ async function handleCommand(command) {
           break
         }
 
-        let portToUse
-        if (localPort) {
-          // Use specified port if available
-          const portNum = parseInt(localPort, 10)
-          if (
-            usedPorts.includes(localPort) ||
-            !(await isPortAvailable(portNum))
-          ) {
-            sendResponse(id, 'error', {
-              message: `Port ${localPort} is not available`,
-            })
-            break
-          }
-          portToUse = localPort
-        } else {
-          // Find next available port based on project's base port
-          const basePort = parseInt(getLocalPort(profile, projectConfig), 10)
-          // Combine usedPorts from params with currently active connections
-          const allUsedPorts = [
-            ...usedPorts,
-            ...Array.from(activeConnections.values()).map(
-              (c) => c.connectionInfo?.port,
-            ),
-          ].filter(Boolean)
-          portToUse = await findAvailablePort(basePort, allUsedPorts)
+        const portToUse = localPort || getLocalPort(profile, projectConfig)
+        const portNum = parseInt(portToUse, 10)
+
+        // Strict port check — never silently increment
+        const allUsedPorts = new Set([
+          ...usedPorts.map((p) => parseInt(p, 10)),
+          ...Array.from(activeConnections.values())
+            .map((c) => parseInt(c.connectionInfo?.port, 10))
+            .filter(Boolean),
+        ])
+        if (allUsedPorts.has(portNum) || !(await isPortAvailable(portNum))) {
+          sendResponse(id, 'error', {
+            message: `Port ${portToUse} is not available. Close the application using it or change the port in project settings.`,
+          })
+          break
         }
 
         // Start new connection with the determined port
@@ -220,6 +203,43 @@ async function handleCommand(command) {
         break
       }
 
+      case 'list-project-configs': {
+        const configs = await loadProjectConfigs()
+        sendResponse(id, 'success', { configs })
+        break
+      }
+
+      case 'save-project-config': {
+        const { key, config } = params
+        if (!key || !config) {
+          sendResponse(id, 'error', {
+            message: 'key and config are required',
+          })
+          break
+        }
+        const validation = validateProjectConfig(config)
+        if (!validation.valid) {
+          sendResponse(id, 'error', {
+            message: `Validation failed: ${validation.errors.join(', ')}`,
+          })
+          break
+        }
+        await saveProjectConfig(key, config)
+        sendResponse(id, 'success', { message: 'Project config saved' })
+        break
+      }
+
+      case 'delete-project-config': {
+        const { key: deleteKey } = params
+        if (!deleteKey) {
+          sendResponse(id, 'error', { message: 'key is required' })
+          break
+        }
+        await deleteProjectConfig(deleteKey)
+        sendResponse(id, 'success', { message: 'Project config deleted' })
+        break
+      }
+
       case 'ping': {
         sendResponse(id, 'success', { message: 'pong' })
         break
@@ -233,19 +253,19 @@ async function handleCommand(command) {
   }
 }
 
-// Handle process signals for cleanup
-function setupCleanup() {
-  const cleanup = () => {
-    for (const [_connId, connection] of activeConnections) {
-      connection.disconnect()
-    }
-    activeConnections.clear()
-    process.exit(0)
+// Disconnect all active connections (idempotent — safe to call multiple times)
+function disconnectAll() {
+  for (const [_connId, connection] of activeConnections) {
+    connection.disconnect()
   }
+  activeConnections.clear()
+}
 
-  process.on('SIGINT', cleanup)
-  process.on('SIGTERM', cleanup)
-  process.on('exit', cleanup)
+// Handle process signals for cleanup
+function setupCleanup() {
+  process.on('SIGINT', () => { disconnectAll(); process.exit(0) })
+  process.on('SIGTERM', () => { disconnectAll(); process.exit(0) })
+  process.on('exit', disconnectAll)
 }
 
 // Main entry point
@@ -274,10 +294,7 @@ async function main() {
   })
 
   rl.on('close', () => {
-    for (const [_connId, connection] of activeConnections) {
-      connection.disconnect()
-    }
-    activeConnections.clear()
+    disconnectAll()
     process.exit(0)
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rds_ssm_connect",
-  "version": "1.7.13",
+  "version": "1.7.15",
   "type": "module",
   "repository": {
     "type": "git",

package/scripts/generate-update-json.js

@@ -98,3 +98,13 @@ const updateManifest = {
 
 const outputPath = path.join(__dirname, '../latest.json')
 fs.writeFileSync(outputPath, JSON.stringify(updateManifest, null, 2))
+
+// Warn if latest.json is not gitignored (it should never be committed)
+const gitignorePath = path.join(__dirname, '../.gitignore')
+try {
+  const gitignore = fs.readFileSync(gitignorePath, 'utf-8')
+  if (!gitignore.includes('latest.json')) {
+    console.warn('WARNING: latest.json is not in .gitignore — add it to avoid accidental commits')
+  }
+} catch {}
+