smart-home-engine 1.0.10 → 1.1.1

package/src/lib/ssh-deploy.js

@@ -0,0 +1,162 @@
+'use strict';
+
+/**
+ * ssh-deploy.js — SSH/SCP file deployment helper for remote broker management.
+ *
+ * Shells out to the system ssh and scp clients — no npm dependencies required.
+ * SSH keypair generation uses the system ssh-keygen binary.
+ *
+ * Requires ssh, scp, and ssh-keygen available in PATH on the she host.
+ *
+ * StrictHostKeyChecking=accept-new trusts new hosts on first connect and
+ * verifies the key on subsequent connections, protecting against MITM after
+ * the initial handshake without blocking automation.
+ */
+
+const { execFile } = require('child_process');
+const { promisify } = require('util');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const execFileAsync = promisify(execFile);
+
+function expandHome(p) {
+    if (typeof p === 'string' && (p.startsWith('~/') || p === '~')) {
+        return path.join(os.homedir(), p.slice(2));
+    }
+    return p;
+}
+
+/**
+ * Build the common ssh argument list (flags only, no target/command).
+ * @param {object} sshConfig - config.broker.ssh
+ * @returns {string[]}
+ */
+function sshArgs(sshConfig) {
+    const identityFile = expandHome(sshConfig.identityFile || '~/.she/ssh/broker_id_ed25519');
+    return ['-i', identityFile, '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=accept-new', '-p', String(sshConfig.port || 22)];
+}
+
+/**
+ * Build the scp argument list prefix.
+ * scp uses -P (capital) for port, unlike ssh which uses -p.
+ * @param {object} sshConfig
+ * @returns {string[]}
+ */
+function scpArgs(sshConfig) {
+    const identityFile = expandHome(sshConfig.identityFile || '~/.she/ssh/broker_id_ed25519');
+    return ['-i', identityFile, '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=accept-new', '-P', String(sshConfig.port || 22)];
+}
+
+function sshTarget(sshConfig) {
+    return `${sshConfig.user || 'she'}@${sshConfig.host}`;
+}
+
+/**
+ * Run a command on the remote host via the system ssh client.
+ * @param {object} sshConfig - config.broker.ssh
+ * @param {string} command
+ * @returns {Promise<{ stdout: string, stderr: string }>}
+ */
+async function runCommand(sshConfig, command) {
+    const args = [...sshArgs(sshConfig), sshTarget(sshConfig), command];
+    try {
+        const { stdout, stderr } = await execFileAsync('ssh', args, { timeout: 15000 });
+        return { stdout: stdout.trim(), stderr: stderr.trim() };
+    } catch (err) {
+        const detail = (err.stderr || '').trim() || (err.stdout || '').trim() || err.message;
+        throw new Error(detail);
+    }
+}
+
+/**
+ * Read the content of a file on the remote host via ssh cat.
+ * @param {object} sshConfig
+ * @param {string} remotePath
+ * @returns {Promise<string>}
+ */
+async function readRemoteFile(sshConfig, remotePath) {
+    const { stdout } = await runCommand(sshConfig, `cat -- "${remotePath}"`);
+    return stdout;
+}
+
+/**
+ * Upload a local file to the remote host via scp.
+ * @param {object} sshConfig
+ * @param {string} localPath
+ * @param {string} remotePath
+ */
+async function uploadFile(sshConfig, localPath, remotePath) {
+    const args = [...scpArgs(sshConfig), localPath, `${sshTarget(sshConfig)}:${remotePath}`];
+    try {
+        await execFileAsync('scp', args, { timeout: 30000 });
+    } catch (err) {
+        const detail = (err.stderr || '').trim() || err.message;
+        throw new Error(detail);
+    }
+}
+
+/**
+ * Upload a string as file content to the remote host.
+ * Writes to a local temp file then uploads via scp.
+ * @param {object} sshConfig
+ * @param {string} content
+ * @param {string} remotePath
+ */
+async function uploadContent(sshConfig, content, remotePath) {
+    const tmp = path.join(os.tmpdir(), `she-ssh-${Date.now()}.tmp`);
+    fs.writeFileSync(tmp, content, 'utf8');
+    try {
+        await uploadFile(sshConfig, tmp, remotePath);
+    } finally {
+        try {
+            fs.unlinkSync(tmp);
+        } catch {
+            /* ignore */
+        }
+    }
+}
+
+/**
+ * Test SSH connectivity. Resolves to { ok: true } on success, or throws.
+ * @param {object} sshConfig
+ */
+async function testConnection(sshConfig) {
+    await runCommand(sshConfig, 'echo ok');
+    return { ok: true };
+}
+
+/**
+ * Generate an Ed25519 SSH keypair using the system ssh-keygen binary.
+ * @param {string} identityFile - path for the private key (e.g. ~/.she/broker_id_ed25519)
+ * @returns {Promise<string>} the public key text
+ */
+async function generateKeypair(identityFile) {
+    const expandedPath = expandHome(identityFile || '~/.she/ssh/broker_id_ed25519');
+    const dir = path.dirname(expandedPath);
+    fs.mkdirSync(dir, { recursive: true });
+
+    try {
+        fs.unlinkSync(expandedPath);
+    } catch {
+        /* ok */
+    }
+    try {
+        fs.unlinkSync(expandedPath + '.pub');
+    } catch {
+        /* ok */
+    }
+
+    await execFileAsync('ssh-keygen', ['-t', 'ed25519', '-f', expandedPath, '-N', '', '-C', 'she-broker'], { timeout: 15000 });
+
+    try {
+        fs.chmodSync(expandedPath, 0o600);
+    } catch {
+        /* ignore */
+    }
+
+    return fs.readFileSync(expandedPath + '.pub', 'utf8').trim();
+}
+
+module.exports = { runCommand, readRemoteFile, uploadFile, uploadContent, testConnection, generateKeypair };

package/src/sandbox/broker-sandbox.js

@@ -0,0 +1,113 @@
+'use strict';
+
+/**
+ * broker sandbox module — adds she.broker.* to every script context.
+ *
+ * Loaded automatically by loadSandbox() in index.js (all *.js files in
+ * src/sandbox/ are scanned). If dynsec is not configured, she.broker is still
+ * defined but every method rejects with a descriptive error so scripts can
+ * detect the situation gracefully.
+ *
+ * she.broker API:
+ *   she.broker.createUser(username, password)          → Promise
+ *   she.broker.deleteUser(username)                    → Promise
+ *   she.broker.setPassword(username, password)         → Promise
+ *   she.broker.listUsers()                             → Promise<User[]>
+ *   she.broker.getUser(username)                       → Promise<User>
+ *   she.broker.createRole(rolename)                    → Promise
+ *   she.broker.deleteRole(rolename)                    → Promise
+ *   she.broker.listRoles()                             → Promise<Role[]>
+ *   she.broker.getRole(rolename)                       → Promise<Role>
+ *   she.broker.addACL(rolename, {type, topic, allow})  → Promise
+ *   she.broker.removeACL(rolename, {type, topic})      → Promise
+ *   she.broker.assignRole(username, rolename)          → Promise
+ *   she.broker.revokeRole(username, rolename)          → Promise
+ *   she.broker.createGroup(groupname)                  → Promise
+ *   she.broker.deleteGroup(groupname)                  → Promise
+ *   she.broker.listGroups()                            → Promise<Group[]>
+ *   she.broker.addToGroup(username, groupname)         → Promise
+ *   she.broker.removeFromGroup(username, groupname)    → Promise
+ *   she.broker.assignRoleToGroup(groupname, rolename)  → Promise
+ *
+ * ACL types (dynsec):
+ *   'publishClientSend' | 'publishClientReceive' |
+ *   'subscribeLiteral'  | 'subscribePattern'     |
+ *   'unsubscribeLiteral'| 'unsubscribePattern'
+ */
+
+const dynsec = require('../lib/dynsec');
+
+module.exports = function (she) {
+    she.broker = {
+        // ── Users ──────────────────────────────────────────────────────────────
+        createUser(username, password) {
+            return dynsec.createClient(username, password);
+        },
+        deleteUser(username) {
+            return dynsec.deleteClient(username);
+        },
+        setPassword(username, password) {
+            return dynsec.setClientPassword(username, password);
+        },
+        listUsers() {
+            return dynsec.listClients(/* verbose= */ true);
+        },
+        getUser(username) {
+            return dynsec.getClient(username);
+        },
+
+        // ── Roles ──────────────────────────────────────────────────────────────
+        createRole(rolename) {
+            return dynsec.createRole(rolename);
+        },
+        deleteRole(rolename) {
+            return dynsec.deleteRole(rolename);
+        },
+        listRoles() {
+            return dynsec.listRoles(/* verbose= */ true);
+        },
+        getRole(rolename) {
+            return dynsec.getRole(rolename);
+        },
+        /**
+         * Add an ACL rule to a role.
+         * @param {string} rolename
+         * @param {{ type: string, topic: string, allow: boolean }} acl
+         */
+        addACL(rolename, { type, topic, allow }) {
+            return dynsec.addRoleACL(rolename, type, topic, allow);
+        },
+        removeACL(rolename, { type, topic }) {
+            return dynsec.removeRoleACL(rolename, type, topic);
+        },
+
+        // ── Role ↔ user assignment ─────────────────────────────────────────────
+        assignRole(username, rolename) {
+            return dynsec.addClientRole(username, rolename);
+        },
+        revokeRole(username, rolename) {
+            return dynsec.removeClientRole(username, rolename);
+        },
+
+        // ── Groups ─────────────────────────────────────────────────────────────
+        createGroup(groupname) {
+            return dynsec.createGroup(groupname);
+        },
+        deleteGroup(groupname) {
+            return dynsec.deleteGroup(groupname);
+        },
+        listGroups() {
+            return dynsec.listGroups(/* verbose= */ true);
+        },
+        addToGroup(username, groupname) {
+            // dynsec groups are addressed by group; client is the arg
+            return dynsec.addGroupClient(groupname, username);
+        },
+        removeFromGroup(username, groupname) {
+            return dynsec.removeGroupClient(groupname, username);
+        },
+        assignRoleToGroup(groupname, rolename) {
+            return dynsec.addGroupRole(groupname, rolename);
+        },
+    };
+};

package/src/sandbox/stdlib.js

@@ -161,10 +161,7 @@ module.exports = function (she, ctx = {}) {
             if (!signal) {
                 const ac = new AbortController();
                 signal = ac.signal;
-                timer = setTimeout(
-                    () => ac.abort(new Error(`she.http.fetch timed out after ${TIMEOUT_MS / 1000}s`)),
-                    TIMEOUT_MS,
-                );
+                timer = setTimeout(() => ac.abort(new Error(`she.http.fetch timed out after ${TIMEOUT_MS / 1000}s`)), TIMEOUT_MS);
             }
             return fetch(url, { ...options, signal })
                 .then((r) => {

package/src/web/ai-api.js

@@ -449,7 +449,7 @@ router.post('/prompt', (req, res) => {
 router.post('/chat', async (req, res) => {
     const ai = readAiConfig(req.app.locals.configPath);
     const { messages = [], currentScript, currentView, currentDoc, context = {}, modelOverride, extraFiles } = req.body || {};
-    const effectiveModel = (modelOverride && typeof modelOverride === 'string') ? modelOverride : ai?.model;
+    const effectiveModel = modelOverride && typeof modelOverride === 'string' ? modelOverride : ai?.model;
     if (!ai?.provider || !effectiveModel) {
         return res.status(400).json({ error: 'AI provider not configured. Set ai.provider and ai.model in Config.' });
     }
@@ -480,7 +480,7 @@ router.post('/chat', async (req, res) => {
 router.post('/chat/stream', async (req, res) => {
     const ai = readAiConfig(req.app.locals.configPath);
     const { messages = [], currentScript, currentView, currentDoc, context = {}, modelOverride, extraFiles } = req.body || {};
-    const effectiveModel = (modelOverride && typeof modelOverride === 'string') ? modelOverride : ai?.model;
+    const effectiveModel = modelOverride && typeof modelOverride === 'string' ? modelOverride : ai?.model;
     if (!ai?.provider || !effectiveModel) {
         return res.status(400).json({ error: 'AI provider not configured. Set ai.provider and ai.model in Config.' });
     }
@@ -553,15 +553,21 @@ router.get('/conversations', (req, res) => {
     ensureAiDir();
     let list = [];
     try {
-        const files = fs.readdirSync(AI_DIR).filter(f => f.endsWith('.json'));
-        list = files.map(f => {
-            try {
-                const data = JSON.parse(fs.readFileSync(path.join(AI_DIR, f), 'utf8'));
-                return { id: data.id, title: data.title || data.id, updatedAt: data.updatedAt || 0 };
-            } catch { return null; }
-        }).filter(Boolean);
+        const files = fs.readdirSync(AI_DIR).filter((f) => f.endsWith('.json'));
+        list = files
+            .map((f) => {
+                try {
+                    const data = JSON.parse(fs.readFileSync(path.join(AI_DIR, f), 'utf8'));
+                    return { id: data.id, title: data.title || data.id, updatedAt: data.updatedAt || 0 };
+                } catch {
+                    return null;
+                }
+            })
+            .filter(Boolean);
         list.sort((a, b) => b.updatedAt - a.updatedAt);
-    } catch { /* empty dir */ }
+    } catch {
+        /* empty dir */
+    }
     res.json(list);
 });
 
@@ -593,7 +599,11 @@ router.put('/conversations/:id', (req, res) => {
 router.delete('/conversations/:id', (req, res) => {
     const p = convPath(req.params.id);
     if (!p) return res.status(400).json({ error: 'invalid id' });
-    try { fs.unlinkSync(p); } catch { /* already gone */ }
+    try {
+        fs.unlinkSync(p);
+    } catch {
+        /* already gone */
+    }
     res.json({ ok: true });
 });