sessioncast-cli 2.2.2 → 2.3.1

package/dist/agent/runner.js

@@ -32,12 +32,16 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgentRunner = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const yaml = __importStar(require("js-yaml"));
+const node_fetch_1 = __importDefault(require("node-fetch"));
 const session_handler_1 = require("./session-handler");
 const api_client_1 = require("./api-client");
 const tmux = __importStar(require("./tmux"));
@@ -52,7 +56,29 @@ class AgentRunner {
         this.running = false;
         this.config = config;
     }
-    static loadConfig(configPath) {
+    /**
+     * Fetch optimal relay URL from Platform API using agent token.
+     * Returns null on failure (caller should fall back to default).
+     */
+    static async fetchRelayUrlForAgent(token) {
+        try {
+            const apiUrl = (0, config_1.getApiUrl)();
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 3000);
+            const res = await (0, node_fetch_1.default)(`${apiUrl}/public/agent-tokens/${token}/relay`, {
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (!res.ok)
+                return null;
+            const data = await res.json();
+            return data.relayUrl || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    static async loadConfig(configPath) {
         // Check if agent token is available (for relay connection)
         const agentToken = (0, config_1.getAgentToken)();
         // Check environment variable
@@ -75,9 +101,18 @@ class AgentRunner {
         if ((!finalPath || !fs.existsSync(finalPath)) && agentToken) {
             console.log('Using OAuth authentication');
             const machineId = os.hostname();
+            // Try to fetch optimal relay URL from Platform API
+            let relayUrl = await AgentRunner.fetchRelayUrlForAgent(agentToken);
+            if (relayUrl) {
+                console.log(`Fetched relay URL from Platform API: ${relayUrl}`);
+            }
+            else {
+                relayUrl = (0, config_1.getRelayUrl)();
+                console.log(`Using default relay URL: ${relayUrl}`);
+            }
             return {
                 machineId,
-                relay: (0, config_1.getRelayUrl)(),
+                relay: relayUrl,
                 token: agentToken,
                 api: {
                     enabled: false
@@ -101,10 +136,23 @@ class AgentRunner {
         if (this.running)
             return;
         this.running = true;
+        // Fetch encryption key from Platform API if not already set
+        if (!this.config.encKey && this.config.token) {
+            try {
+                const encKey = await this.fetchEncKey(this.config.token);
+                if (encKey) {
+                    this.config.encKey = encKey;
+                }
+            }
+            catch (e) {
+                console.warn('Failed to fetch encryption key (E2E disabled):', e.message);
+            }
+        }
         console.log('Starting SessionCast Agent...');
         console.log(`Machine ID: ${this.config.machineId}`);
         console.log(`Relay: ${this.config.relay}`);
         console.log(`Token: ${this.config.token ? 'present' : 'none'}`);
+        console.log(`E2E Encryption: ${this.config.encKey ? 'enabled' : 'disabled'}`);
         // Check tmux/itmux availability before starting
         if (!tmux.isAvailable()) {
             const platform = os.platform();
@@ -220,6 +268,16 @@ class AgentRunner {
             console.error(`Failed to create tmux session: ${sanitized}`);
         }
     }
+    async fetchEncKey(agentToken) {
+        const fetch = (await Promise.resolve().then(() => __importStar(require('node-fetch')))).default;
+        const apiUrl = (0, config_1.getApiUrl)();
+        const url = `${apiUrl}/internal/agents/enc-key?token=${encodeURIComponent(agentToken)}`;
+        const res = await fetch(url, { timeout: 5000 });
+        if (!res.ok)
+            return null;
+        const data = await res.json();
+        return data.encKey || null;
+    }
     stop() {
         console.log('Shutting down Agent...');
         this.running = false;

package/dist/agent/session-handler.js

@@ -89,7 +89,8 @@ class TmuxSessionHandler {
             machineId: this.config.machineId,
             token: this.config.token,
             label: this.tmuxSession,
-            autoReconnect: true
+            autoReconnect: true,
+            encKey: this.config.encKey
         });
         this.wsClient.on('connected', () => {
             console.log(`[${this.tmuxSession}] Connected to relay`);

package/dist/agent/tunnel-handler.d.ts

@@ -0,0 +1,12 @@
+export declare class TunnelHandler {
+    private port;
+    private host;
+    private activeRequests;
+    private readonly MAX_CONCURRENT;
+    private readonly MAX_RESPONSE_SIZE;
+    private readonly CHUNK_SIZE;
+    constructor(port: number, host?: string);
+    handleRequest(requestId: string, method: string, path: string, queryString: string, headers: Record<string, string>, body: string | undefined, sendResponse: (msg: any) => void): Promise<void>;
+    private getBase64ChunkSize;
+    private makeHttpRequest;
+}

package/dist/agent/tunnel-handler.js

@@ -0,0 +1,180 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TunnelHandler = void 0;
+const http = __importStar(require("http"));
+const debug_1 = require("./debug");
+const ALLOWED_HOSTS = ['localhost', '127.0.0.1', '::1'];
+class TunnelHandler {
+    constructor(port, host = 'localhost') {
+        this.activeRequests = 0;
+        this.MAX_CONCURRENT = 10;
+        this.MAX_RESPONSE_SIZE = 5 * 1024 * 1024; // 5MB
+        this.CHUNK_SIZE = 200 * 1024; // 200KB before base64
+        this.port = port;
+        this.host = host;
+    }
+    async handleRequest(requestId, method, path, queryString, headers, body, sendResponse) {
+        // Check concurrent limit
+        if (this.activeRequests >= this.MAX_CONCURRENT) {
+            sendResponse({
+                requestId,
+                statusCode: 503,
+                headers: { 'content-type': 'text/plain' },
+                body: Buffer.from('Too many concurrent requests').toString('base64'),
+            });
+            return;
+        }
+        // Validate host (SSRF prevention)
+        if (!ALLOWED_HOSTS.includes(this.host)) {
+            sendResponse({
+                requestId,
+                statusCode: 403,
+                headers: { 'content-type': 'text/plain' },
+                body: Buffer.from('Forbidden: only localhost connections allowed').toString('base64'),
+            });
+            return;
+        }
+        this.activeRequests++;
+        try {
+            const fullPath = queryString ? `${path}?${queryString}` : path;
+            const requestBody = body ? Buffer.from(body, 'base64') : undefined;
+            (0, debug_1.debugLog)('TUNNEL', `${method} ${fullPath} -> ${this.host}:${this.port}`);
+            const { statusCode, responseHeaders, responseBody } = await this.makeHttpRequest(method, fullPath, headers, requestBody);
+            const bodyBase64 = responseBody.toString('base64');
+            if (responseBody.length > this.CHUNK_SIZE) {
+                // Split into chunks
+                const totalChunks = Math.ceil(bodyBase64.length / this.getBase64ChunkSize());
+                for (let i = 0; i < totalChunks; i++) {
+                    const start = i * this.getBase64ChunkSize();
+                    const end = Math.min(start + this.getBase64ChunkSize(), bodyBase64.length);
+                    const chunk = bodyBase64.slice(start, end);
+                    const isFinal = i === totalChunks - 1;
+                    sendResponse({
+                        requestId,
+                        statusCode,
+                        headers: responseHeaders,
+                        body: chunk,
+                        chunkIndex: i,
+                        isFinal,
+                        chunked: true,
+                    });
+                }
+            }
+            else {
+                sendResponse({
+                    requestId,
+                    statusCode,
+                    headers: responseHeaders,
+                    body: bodyBase64,
+                });
+            }
+        }
+        catch (error) {
+            (0, debug_1.debugLog)('TUNNEL', `Error: ${error.message}`);
+            sendResponse({
+                requestId,
+                statusCode: 502,
+                headers: { 'content-type': 'text/plain' },
+                body: Buffer.from(`Bad Gateway: ${error.message}`).toString('base64'),
+            });
+        }
+        finally {
+            this.activeRequests--;
+        }
+    }
+    getBase64ChunkSize() {
+        // base64 encoding expands data by ~4/3, so chunk size in base64 chars
+        // for 200KB raw data is approximately 200*1024*4/3 ≈ 273KB base64
+        return Math.ceil(this.CHUNK_SIZE * 4 / 3);
+    }
+    makeHttpRequest(method, path, headers, body) {
+        return new Promise((resolve, reject) => {
+            // Build headers, removing hop-by-hop headers that shouldn't be forwarded
+            const forwardHeaders = {
+                ...headers,
+                host: `${this.host}:${this.port}`,
+            };
+            delete forwardHeaders['connection'];
+            delete forwardHeaders['keep-alive'];
+            delete forwardHeaders['transfer-encoding'];
+            const options = {
+                hostname: this.host,
+                port: this.port,
+                path,
+                method,
+                headers: forwardHeaders,
+                timeout: 30000,
+            };
+            const req = http.request(options, (res) => {
+                const chunks = [];
+                let totalSize = 0;
+                res.on('data', (chunk) => {
+                    totalSize += chunk.length;
+                    if (totalSize > this.MAX_RESPONSE_SIZE) {
+                        req.destroy();
+                        reject(new Error(`Response exceeds maximum size of ${this.MAX_RESPONSE_SIZE} bytes`));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                res.on('end', () => {
+                    const responseHeaders = {};
+                    for (const [key, value] of Object.entries(res.headers)) {
+                        if (value) {
+                            responseHeaders[key] = Array.isArray(value) ? value.join(', ') : value;
+                        }
+                    }
+                    resolve({
+                        statusCode: res.statusCode || 502,
+                        responseHeaders,
+                        responseBody: Buffer.concat(chunks),
+                    });
+                });
+                res.on('error', reject);
+            });
+            req.on('error', reject);
+            req.on('timeout', () => {
+                req.destroy();
+                reject(new Error('Request timed out'));
+            });
+            if (body) {
+                req.write(body);
+            }
+            req.end();
+        });
+    }
+}
+exports.TunnelHandler = TunnelHandler;

package/dist/agent/types.d.ts

@@ -2,6 +2,7 @@ export interface AgentConfig {
     machineId: string;
     relay: string;
     token: string;
+    encKey?: string;
     api?: ApiConfig;
 }
 export interface ApiConfig {
@@ -34,7 +35,7 @@ export interface ExecConfig {
 }
 export interface LlmConfig {
     enabled: boolean;
-    provider: 'ollama' | 'openai' | 'anthropic' | 'claude-code';
+    provider: 'ollama' | 'openai' | 'anthropic' | 'claude-code' | 'codex' | 'gemini' | 'cursor';
     baseUrl: string;
     model: string;
     apiKey?: string;
@@ -64,6 +65,26 @@ export interface ExecResult {
     stderr: string;
     duration: number;
 }
+export interface TunnelConfig {
+    chromePath?: string;
+    width?: number;
+    height?: number;
+    cdpPort?: number;
+}
+export interface WebInputEvent {
+    inputType?: string;
+    type?: string;
+    x?: number;
+    y?: number;
+    button?: string;
+    clickCount?: number;
+    key?: string;
+    code?: string;
+    text?: string;
+    modifiers?: number;
+    deltaX?: number;
+    deltaY?: number;
+}
 export interface LlmMessage {
     role: 'system' | 'user' | 'assistant';
     content: string;

package/dist/agent/websocket.d.ts

@@ -7,6 +7,8 @@ interface WebSocketClientOptions {
     token: string;
     label?: string;
     autoReconnect?: boolean;
+    encKey?: string;
+    skipAutoRegister?: boolean;
 }
 export declare class RelayWebSocketClient extends EventEmitter {
     private ws;
@@ -16,6 +18,8 @@ export declare class RelayWebSocketClient extends EventEmitter {
     private token;
     private label;
     private autoReconnect;
+    private encKeyBuf;
+    private skipAutoRegister;
     private isConnected;
     private reconnectAttempts;
     private circuitBreakerOpen;
@@ -25,12 +29,14 @@ export declare class RelayWebSocketClient extends EventEmitter {
     constructor(options: WebSocketClientOptions);
     connect(): void;
     private registerAsHost;
+    private decryptPayload;
     private handleMessage;
     private handleError;
     private scheduleReconnect;
     send(message: Message): boolean;
     sendScreen(data: Buffer): boolean;
     sendScreenWithMeta(data: Buffer, meta: Record<string, string>): boolean;
+    private compressAndEncrypt;
     sendScreenCompressed(data: Buffer): boolean;
     sendScreenCompressedWithMeta(data: Buffer, meta: Record<string, string>): boolean;
     sendSessionMeta(meta: Record<string, string>): boolean;
@@ -60,6 +66,18 @@ export declare class RelayWebSocketClient extends EventEmitter {
      * Send upload error notification to web viewer
      */
     sendUploadError(filename: string, error: string): boolean;
+    /**
+     * Send a single rrweb DOM event to the relay.
+     */
+    sendWebDom(event: any): boolean;
+    /**
+     * Send a batch of rrweb DOM events.
+     */
+    sendWebDomBatch(events: any[]): boolean;
+    /**
+     * Send web page metadata (title, URL, viewport).
+     */
+    sendWebMeta(meta: Record<string, string>): boolean;
     getConnected(): boolean;
     destroy(): void;
 }

package/dist/agent/websocket.js

@@ -40,6 +40,8 @@ exports.RelayWebSocketClient = void 0;
 const ws_1 = __importDefault(require("ws"));
 const events_1 = require("events");
 const zlib = __importStar(require("zlib"));
+const zstd = __importStar(require("zstd-napi"));
+const crypto_1 = require("./crypto");
 const debug_1 = require("./debug");
 const MAX_RECONNECT_ATTEMPTS = 5;
 const BASE_RECONNECT_DELAY_MS = 2000;
@@ -49,6 +51,7 @@ class RelayWebSocketClient extends events_1.EventEmitter {
     constructor(options) {
         super();
         this.ws = null;
+        this.encKeyBuf = null;
         this.isConnected = false;
         this.reconnectAttempts = 0;
         this.circuitBreakerOpen = false;
@@ -61,6 +64,10 @@ class RelayWebSocketClient extends events_1.EventEmitter {
         this.token = options.token;
         this.label = options.label || options.sessionId;
         this.autoReconnect = options.autoReconnect ?? true;
+        if (options.encKey) {
+            this.encKeyBuf = Buffer.from(options.encKey, 'base64url');
+        }
+        this.skipAutoRegister = options.skipAutoRegister ?? false;
     }
     connect() {
         if (this.destroyed)
@@ -72,7 +79,9 @@ class RelayWebSocketClient extends events_1.EventEmitter {
                 this.reconnectAttempts = 0;
                 this.circuitBreakerOpen = false;
                 this.emit('connected');
-                this.registerAsHost();
+                if (!this.skipAutoRegister) {
+                    this.registerAsHost();
+                }
             });
             this.ws.on('message', (data) => {
                 try {
@@ -116,9 +125,28 @@ class RelayWebSocketClient extends events_1.EventEmitter {
             meta
         });
     }
+    decryptPayload(payload) {
+        if (!this.encKeyBuf)
+            return payload;
+        try {
+            const buf = Buffer.from(payload, 'base64');
+            const decrypted = (0, crypto_1.decrypt)(buf, this.encKeyBuf);
+            return decrypted.toString('utf-8');
+        }
+        catch {
+            // If decryption fails, return as-is (unencrypted message)
+            return payload;
+        }
+    }
     handleMessage(message) {
         (0, debug_1.debugLog)('WS:IN', message.type, message.session);
         switch (message.type) {
+            case 'keysEnc':
+                if (message.session === this.sessionId && message.payload) {
+                    const keys = this.decryptPayload(message.payload);
+                    this.emit('keys', keys, message.meta?.pane);
+                }
+                break;
             case 'keys':
                 if (message.session === this.sessionId && message.payload) {
                     this.emit('keys', message.payload, message.meta?.pane);
@@ -148,6 +176,25 @@ class RelayWebSocketClient extends events_1.EventEmitter {
                     this.emit('createWorktree', message.meta.branch);
                 }
                 break;
+            case 'webInput':
+                if (message.session === this.sessionId && message.payload) {
+                    try {
+                        const inputEvent = JSON.parse(message.payload);
+                        this.emit('webInput', inputEvent);
+                    }
+                    catch { /* ignore parse errors */ }
+                }
+                break;
+            case 'webNavigate':
+                if (message.session === this.sessionId && message.meta?.url) {
+                    this.emit('webNavigate', message.meta.url);
+                }
+                break;
+            case 'requestSnapshot':
+                if (message.session === this.sessionId) {
+                    this.emit('requestSnapshot');
+                }
+                break;
             case 'requestFileView':
                 if (message.session === this.sessionId && message.meta?.filePath) {
                     this.emit('requestFileView', message.meta.filePath);
@@ -268,17 +315,37 @@ class RelayWebSocketClient extends events_1.EventEmitter {
             meta
         });
     }
+    compressAndEncrypt(data) {
+        // Step 1: Compress with zstd (fallback to gzip)
+        let compressed;
+        let compressType = 'zstd';
+        try {
+            compressed = zstd.compress(data, { compressionLevel: 3 });
+        }
+        catch {
+            compressed = zlib.gzipSync(data);
+            compressType = 'gz';
+        }
+        // Step 2: Encrypt if encKey is available
+        if (this.encKeyBuf) {
+            const encrypted = (0, crypto_1.encrypt)(compressed, this.encKeyBuf);
+            return {
+                payload: encrypted.toString('base64'),
+                type: 'screenEnc'
+            };
+        }
+        // No encryption — send compressed only
+        return {
+            payload: compressed.toString('base64'),
+            type: compressType === 'zstd' ? 'screenZstd' : 'screenGz'
+        };
+    }
     sendScreenCompressed(data) {
         if (!this.isConnected)
             return false;
         try {
-            const compressed = zlib.gzipSync(data);
-            const base64Data = compressed.toString('base64');
-            return this.send({
-                type: 'screenGz',
-                session: this.sessionId,
-                payload: base64Data
-            });
+            const { payload, type } = this.compressAndEncrypt(data);
+            return this.send({ type, session: this.sessionId, payload });
         }
         catch {
             return this.sendScreen(data);
@@ -288,13 +355,8 @@ class RelayWebSocketClient extends events_1.EventEmitter {
         if (!this.isConnected)
             return false;
         try {
-            const compressed = zlib.gzipSync(data);
-            return this.send({
-                type: 'screenGz',
-                session: this.sessionId,
-                payload: compressed.toString('base64'),
-                meta
-            });
+            const { payload, type } = this.compressAndEncrypt(data);
+            return this.send({ type, session: this.sessionId, payload, meta });
         }
         catch {
             return this.sendScreenWithMeta(data, meta);
@@ -370,6 +432,42 @@ class RelayWebSocketClient extends events_1.EventEmitter {
             }
         });
     }
+    /**
+     * Send a single rrweb DOM event to the relay.
+     */
+    sendWebDom(event) {
+        if (!this.isConnected)
+            return false;
+        return this.send({
+            type: 'webDom',
+            session: this.sessionId,
+            payload: JSON.stringify(event),
+        });
+    }
+    /**
+     * Send a batch of rrweb DOM events.
+     */
+    sendWebDomBatch(events) {
+        if (!this.isConnected)
+            return false;
+        return this.send({
+            type: 'webDomBatch',
+            session: this.sessionId,
+            payload: JSON.stringify(events),
+        });
+    }
+    /**
+     * Send web page metadata (title, URL, viewport).
+     */
+    sendWebMeta(meta) {
+        if (!this.isConnected)
+            return false;
+        return this.send({
+            type: 'webMeta',
+            session: this.sessionId,
+            meta,
+        });
+    }
     getConnected() {
         return this.isConnected;
     }

package/dist/commands/agent.js

@@ -14,7 +14,7 @@ async function startAgent(options) {
             (0, debug_1.setDebug)(true);
             console.log(chalk_1.default.yellow('[DEBUG] Debug mode enabled'));
         }
-        const config = runner_1.AgentRunner.loadConfig(options.config);
+        const config = await runner_1.AgentRunner.loadConfig(options.config);
         const runner = new runner_1.AgentRunner(config);
         await runner.start();
     }

package/dist/commands/tunnel.d.ts

@@ -0,0 +1,10 @@
+interface TunnelOptions {
+    config?: string;
+    debug?: boolean;
+    width?: number;
+    height?: number;
+    chromePath?: string;
+    cdpPort?: number;
+}
+export declare function startTunnel(url: string, options: TunnelOptions): Promise<void>;
+export {};