remote-dsh 0.6.0 → 0.7.0

package/README.md

@@ -4,10 +4,11 @@ Secure remote access for [DeepSeek Harness](https://github.com/deepseek-ai/deeps
 
 ```bash
 npm install -g remote-dsh
-rdsh serve   # LAN auth gateway in front of dsh web (M1 MVP)
+rdsh host setup lan   # write ~/.rdsh/host.json (LAN gateway: pair auth)
+rdsh host serve       # run the gateway in the foreground
 ```
 
-> **v0.1.0** is a name-reservation skeleton. Commands land with the M1 MVP.
+> See `doc/overview/usage.md` for the full manual (`rdsh host setup lan|cloud`, `rdsh host join <hub>`, `rdsh hub serve`, ...).
 
 ## License
 

package/dist/bin.js

@@ -10,7 +10,6 @@
  */
 import { createInterface } from "node:readline";
 import { rm } from "node:fs/promises";
-import { hostname as osHostname } from "node:os";
 import { dirname } from "node:path";
 import { serve, join, registerJoin, findDsh, selfRevoke, readPersistedToken, clearPersistedToken, UserManager, resolveConfigPath, loadConfig, saveConfig, installService, uninstallService, serviceStatus, HOST_SERVICE_NAME, JOIN_SERVICE_NAME, HUB_SERVICE_NAME, } from "rdsh-gateway";
 import { loadHubConfig, resolveHubConfigPath, HubDb, hashPassword, serveHub, } from "rdsh-hub";
@@ -25,7 +24,7 @@ Usage:
   rdsh host leave             Unregister this machine from the hub
   rdsh host user ...          Manage gateway users (LAN/cloud password auth)
   rdsh hub serve              Start the hub server (cloud, multi-host)
-  rdsh hub user add|passwd|rm|ls|unlock|reset-2fa
+  rdsh hub user add|passwd|rm|ls|unlock|reset-2fa|ban|unban
   rdsh hub audit ls           Audit log (login/2FA/sharing/email events)
   rdsh hub host ls|revoke     List / revoke hosts (revoke drops the tunnel instantly)
   rdsh hub service ...        Run hub as a systemd/launchd service
@@ -61,7 +60,7 @@ Run the hub server or manage it.
 
 Subcommands:
   serve                 Start the hub server (TLS required)
-  user add|passwd|rm|ls|unlock|reset-2fa   Manage users (admin creates accounts; unlock / reset-2fa)
+  user add|passwd|rm|ls|unlock|reset-2fa|ban|unban   Manage users (admin creates accounts; unlock / reset-2fa / ban / unban)
   audit ls [--user <n>] [--event <e>] [--since 24h|7d]   Query the audit log
   host ls|revoke        List / revoke hosts (revoke drops the tunnel instantly)
   service install|status|uninstall   Run hub as a systemd/launchd service
@@ -286,7 +285,7 @@ async function handleHostJoin(args, configPath) {
     const config = await loadConfig(target);
     config.mode = "join";
     config.hub = hubUrl;
-    config.name = opts.name ?? osHostname();
+    config.name = outcome.name;
     config.insecure = outcome.insecure;
     config.dshPath = opts.dshPath ?? findDsh() ?? config.dshPath;
     await saveConfig(target, config);
@@ -358,7 +357,7 @@ async function maybeRegisterForServiceInstall(args, target) {
     const cfg = await loadConfig(target);
     cfg.mode = "join";
     cfg.hub = maybeHub;
-    cfg.name = joinOpts.name ?? osHostname();
+    cfg.name = outcome.name;
     cfg.insecure = outcome.insecure;
     cfg.dshPath = joinOpts.dshPath ?? findDsh() ?? cfg.dshPath;
     await saveConfig(target, cfg);
@@ -584,20 +583,21 @@ async function handleHubUser(args, configPath) {
             case "add": {
                 const name = args[1];
                 if (name === undefined)
-                    throw new Error("usage: rdsh hub user add <name> [--no-password]");
+                    throw new Error("usage: rdsh hub user add <name> [--no-password] [--role <user|readonly|operator|admin>]");
                 const noPassword = args.includes("--no-password");
+                const roleIdx = args.indexOf("--role");
+                const role = roleIdx >= 0 && args[roleIdx + 1] !== undefined ? args[roleIdx + 1] : "user";
+                if (!["user", "readonly", "operator", "admin"].includes(role))
+                    throw new Error(`invalid role '${role}' (user|readonly|operator|admin)`);
                 const hubConfigPath = resolveHubConfigPath(configPath);
                 if (db.getUserByName(name) !== null)
                     throw new Error(`user '${name}' already exists`);
-                if (noPassword) {
-                    db.createUser(name, "scrypt:disabled", new Date().toISOString(), true);
-                    console.log(`rdsh: user '${name}' created — they must set a password on first sign-in (${hubConfigPath})`);
-                }
-                else {
-                    const password = await promptPasswordTwice(`password for ${name}: `);
-                    db.createUser(name, await hashPassword(password));
-                    console.log(`rdsh: user '${name}' created (hub db: ${db.path})`);
-                }
+                const user = noPassword
+                    ? db.createUser(name, "scrypt:disabled", new Date().toISOString(), true)
+                    : db.createUser(name, await hashPassword(await promptPasswordTwice(`password for ${name}: `)));
+                if (role !== "user")
+                    db.setRole(user.id, role);
+                console.log(`rdsh: user '${name}' created (role: ${role}${noPassword ? " — must set password on first sign-in" : ""})`);
                 return;
             }
             case "passwd": {
@@ -614,7 +614,7 @@ async function handleHubUser(args, configPath) {
             }
             case "ls": {
                 const users = db.listUsers();
-                console.log(users.length > 0 ? users.map((u) => u.name).join("\n") : "(no users)");
+                console.log(users.length > 0 ? users.map((u) => `${u.name}\t${u.role}`).join("\n") : "(no users)");
                 return;
             }
             case "rm": {
@@ -651,8 +651,30 @@ async function handleHubUser(args, configPath) {
                 console.log(`rdsh: 2FA reset for '${name}' (their sessions revoked)`);
                 return;
             }
+            case "ban": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user ban <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.setAccountStatus(user.id, "banned");
+                console.log(`rdsh: user '${name}' banned (login + host access blocked)`);
+                return;
+            }
+            case "unban": {
+                const name = args[1];
+                if (name === undefined)
+                    throw new Error("usage: rdsh hub user unban <name>");
+                const user = db.getUserByName(name);
+                if (user === null)
+                    throw new Error(`user '${name}' not found`);
+                db.setAccountStatus(user.id, "active");
+                console.log(`rdsh: user '${name}' unbanned (plan restored)`);
+                return;
+            }
             default:
-                throw new Error("usage: rdsh hub user add|passwd|ls|rm|unlock|reset-2fa");
+                throw new Error("usage: rdsh hub user add|passwd|ls|rm|unlock|reset-2fa|ban|unban");
         }
     }
     finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "remote-dsh",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Secure remote access for DeepSeek Harness: rdsh serve / rdsh join / rdsh hub",
   "license": "MIT",
   "type": "module",
@@ -23,8 +23,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "rdsh-gateway": "0.4.0",
-    "rdsh-hub": "0.4.0"
+    "rdsh-gateway": "0.5.0",
+    "rdsh-hub": "0.5.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",