zerogterm 0.5.0-alpha.1 → 0.7.0-alpha1

package/dist/main/main/local-fs.js

@@ -0,0 +1,115 @@
+// The local half of the transfer panel: directory listings and the three edits
+// the panel can make locally.
+//
+// Nothing here reads file *contents*. The renderer is sandboxed and has no
+// filesystem access of its own, and this module is deliberately the narrowest
+// widening of that boundary that a file browser needs: names, sizes, kinds, and
+// explicit create/rename/delete on a path the user pointed at.
+import { constants } from 'node:fs';
+import { access, lstat, mkdir, readdir, rename, rm, rmdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { isAbsolute, join, normalize, resolve } from 'node:path';
+import { sortEntries } from '../shared/files.js';
+/**
+ * A path this process will act on.
+ *
+ * Paths arrive from the renderer, so they are re-derived here rather than
+ * trusted: NUL terminates the path for the C library underneath and can make a
+ * check and the later operation disagree about which file is meant, and a
+ * relative path would resolve against whatever directory the app happens to
+ * have — never something the user chose.
+ */
+export function resolveLocalPath(input) {
+    if (typeof input !== 'string' || !input)
+        throw new Error('A filesystem path is required.');
+    if (input.includes('\0'))
+        throw new Error('That path is not valid.');
+    if (input.length > 4096)
+        throw new Error('That path is too long.');
+    const expanded = input === '~' || input.startsWith('~/') || input.startsWith('~\\')
+        ? join(homedir(), input.slice(1))
+        : input;
+    if (!isAbsolute(expanded))
+        throw new Error('Only absolute paths can be browsed.');
+    return resolve(normalize(expanded));
+}
+export function localHome() {
+    return homedir();
+}
+/**
+ * List a directory.
+ *
+ * A stat per entry is what makes kind and size real, and it is allowed to fail:
+ * a broken symlink or a file that has just been deleted should leave a row in
+ * the listing rather than emptying the pane.
+ *
+ * Entries are stat'd with lstat, so a symlink is reported as a symlink whatever
+ * it points at. Reporting a link to a directory as a directory instead would be
+ * a lie with consequences: deleting it would use `rmdir`, which refuses a
+ * symlink, so the row could not be removed at all. It also matches what the
+ * remote side shows, since `ls -l` describes the link rather than its target.
+ * Entering one still works — see isNavigable — because opening it simply reads
+ * through, and a link to a file reports that it is not a directory.
+ */
+export async function listLocalDirectory(path) {
+    const target = path ? resolveLocalPath(path) : homedir();
+    await access(target, constants.R_OK);
+    const dirents = await readdir(target, { withFileTypes: true });
+    const entries = await Promise.all(dirents.map(async (dirent) => {
+        const full = join(target, dirent.name);
+        try {
+            const info = await lstat(full);
+            return {
+                name: dirent.name,
+                kind: info.isSymbolicLink() ? 'symlink' : info.isDirectory() ? 'directory' : 'file',
+                size: info.size,
+                modified: info.mtime.toISOString()
+            };
+        }
+        catch {
+            return { name: dirent.name, kind: dirent.isSymbolicLink() ? 'symlink' : dirent.isDirectory() ? 'directory' : 'file', size: 0 };
+        }
+    }));
+    return { path: target, entries: sortEntries(entries) };
+}
+export async function createLocalDirectory(path) {
+    // No recursive create: the panel creates one folder in the directory on
+    // screen, and a mistyped path should fail rather than build a tree.
+    await mkdir(resolveLocalPath(path));
+}
+/**
+ * Rename an entry, refusing to land on a name that is already taken.
+ *
+ * rename() would silently replace an existing file, and the panel's rename is a
+ * relabel rather than an overwrite. The check is not atomic: nothing in Node's
+ * API offers a no-clobber rename on both platforms, so a different process that
+ * creates that name in the moment between the check and the rename would still
+ * be overwritten. That is a guard against the user's own mistake — the name is
+ * already in the folder they are looking at — not a guarantee against another
+ * writer, and anything able to win that race could equally overwrite the file
+ * directly.
+ */
+export async function renameLocalEntry(from, to) {
+    const source = resolveLocalPath(from);
+    const destination = resolveLocalPath(to);
+    const clash = await lstat(destination).then(() => true, () => false);
+    if (clash)
+        throw new Error('Something with that name already exists here.');
+    await rename(source, destination);
+}
+/**
+ * Delete one entry.
+ *
+ * Directories use rmdir, so a non-empty one fails: this panel deletes what the
+ * user pointed at, and a recursive local delete triggered by a single click is
+ * not a mistake worth making possible.
+ */
+export async function removeLocalEntry(path, kind) {
+    const target = resolveLocalPath(path);
+    if (target === resolve(homedir()))
+        throw new Error('Refusing to delete the home directory.');
+    if (kind === 'directory')
+        await rmdir(target);
+    else
+        await rm(target, { force: false });
+}

package/dist/main/main/main.js

@@ -1,4 +1,4 @@
-import { app, BrowserWindow, clipboard, ipcMain, Menu, session } from 'electron';
+import { app, BrowserWindow, clipboard, ipcMain, Menu, session, shell } from 'electron';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { writeClipboardText } from './clipboard.js';
@@ -6,10 +6,16 @@ import { ScreenService, parseWslDistributions } from './session-service.js';
 import { discoverShellBackends } from './shell-catalog.js';
 import { SessionHistoryStore, defaultHistoryPath } from './session-history.js';
 import { buildRemoteScreenAttachArgs, buildRemoteScreenDiscoveryArgs, listKnownConnections, parseRemoteScreenList, validateKnownConnection } from './ssh-inventory.js';
+import { createLocalDirectory, listLocalDirectory, localHome, removeLocalEntry, renameLocalEntry } from './local-fs.js';
+import { decideExternalLink, isApplicationUrl } from './external-links.js';
+import { SftpService } from './sftp-service.js';
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const history = new SessionHistoryStore({ filePath: defaultHistoryPath(app.getPath('userData')) });
 const service = new ScreenService({ onEvent: (event, session, available) => { void history.record(event, session, available); } });
 let win;
+// Transfer connections outlive any single panel opening, so the panel can be
+// closed and reopened without re-authenticating to the host.
+const sftp = new SftpService({ onEvent: (event) => win?.webContents.send('sftp:event', event) });
 /** A pane's measured size, as it arrives from the renderer. */
 function parsePtySize(value) {
     if (!value || typeof value !== 'object')
@@ -41,6 +47,29 @@ function createWindow() {
             sandbox: true
         }
     });
+    // A link in a pane belongs in the user's browser, not in a window of this app.
+    //
+    // Electron's default answer to window.open is a new BrowserWindow, and xterm
+    // activates an OSC 8 hyperlink by calling exactly that — so clicking a link in
+    // a terminal opened a bare Electron window with no address bar, no profile and
+    // no extensions, which is nobody's browser. Both handlers below refuse to
+    // navigate and hand the URL to the desktop instead.
+    //
+    // They are also the backstop for the renderer's own link handling: whatever
+    // asks for a window here, from any code path now or later, cannot get one.
+    win.webContents.setWindowOpenHandler(({ url }) => {
+        openExternalLink(url);
+        return { action: 'deny' };
+    });
+    // The same for a link that would replace the workspace with a web page, which
+    // would take every pane down with it.
+    const contents = win.webContents;
+    contents.on('will-navigate', (event, url) => {
+        if (isApplicationUrl(url, contents.getURL()))
+            return;
+        event.preventDefault();
+        openExternalLink(url);
+    });
     win.webContents.on('did-fail-load', (_event, code, desc, url) => {
         console.error('[zerog] did-fail-load', { code, desc, url });
     });
@@ -61,11 +90,41 @@ function createWindow() {
     win.on('closed', () => {
         win = undefined;
         service.detachAll();
+        sftp.closeAll();
     });
 }
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
+/**
+ * Hand a link to the desktop, if it is one this should open.
+ *
+ * The decision is in external-links.ts and is an allowlist of schemes: the URL
+ * comes from terminal output, and the operating system will do a great deal more
+ * with `file:` or an application's own scheme than open a web page. A refusal is
+ * reported in the status bar rather than silently dropped, so a click that does
+ * nothing still says why.
+ */
+function openExternalLink(url) {
+    const decision = decideExternalLink(url);
+    if (!decision.open) {
+        win?.webContents.send('links:refused', decision.reason);
+        console.warn('[zerog] refused to open link', { url, reason: decision.reason });
+        return;
+    }
+    void shell.openExternal(decision.url).catch((error) => {
+        win?.webContents.send('links:refused', 'That link could not be opened.');
+        console.error('[zerog] openExternal failed', error);
+    });
+}
+ipcMain.handle('links:openExternal', (_event, url) => {
+    const decision = decideExternalLink(url);
+    // Rejecting rather than resolving quietly: the renderer puts the reason in the
+    // status bar, so the user is never told nothing at all.
+    if (!decision.open)
+        throw new Error(decision.reason);
+    return shell.openExternal(decision.url);
+});
 ipcMain.handle('sessions:list', () => service.list());
 ipcMain.handle('sessions:history', () => history.list());
 ipcMain.handle('sessions:historyRemove', (_event, entryId) => history.remove(entryId));
@@ -146,6 +205,37 @@ ipcMain.handle('clipboard:writeText', (_event, text) => {
     }
 });
 ipcMain.handle('clipboard:readText', () => clipboard.readText());
+/** A string that crossed the IPC boundary and is about to be used as one. */
+function requireString(value, field) {
+    if (typeof value !== 'string' || !value)
+        throw new Error(`${field} is required.`);
+    return value;
+}
+function requireEntryKind(value) {
+    if (value === 'file' || value === 'directory' || value === 'symlink')
+        return value;
+    throw new Error('An entry kind of file, directory, or symlink is required.');
+}
+ipcMain.handle('fs:localHome', () => localHome());
+ipcMain.handle('fs:listLocal', (_event, path) => listLocalDirectory(typeof path === 'string' && path ? path : undefined));
+ipcMain.handle('fs:mkdirLocal', (_event, path) => createLocalDirectory(requireString(path, 'A folder path')));
+ipcMain.handle('fs:renameLocal', (_event, from, to) => renameLocalEntry(requireString(from, 'The current path'), requireString(to, 'The new path')));
+ipcMain.handle('fs:removeLocal', (_event, path, kind) => removeLocalEntry(requireString(path, 'A path'), requireEntryKind(kind)));
+ipcMain.handle('sftp:open', (_event, target, cwd) => sftp.open(requireString(target, 'An SSH target'), typeof cwd === 'string' && cwd ? cwd : undefined));
+ipcMain.handle('sftp:list', (_event, id, path) => sftp.list(requireString(id, 'A transfer connection'), typeof path === 'string' && path ? path : undefined));
+ipcMain.handle('sftp:mkdir', (_event, id, path) => sftp.mkdir(requireString(id, 'A transfer connection'), requireString(path, 'A folder path')));
+ipcMain.handle('sftp:rename', (_event, id, from, to) => sftp.rename(requireString(id, 'A transfer connection'), requireString(from, 'The current path'), requireString(to, 'The new path')));
+ipcMain.handle('sftp:remove', (_event, id, path, kind) => sftp.remove(requireString(id, 'A transfer connection'), requireString(path, 'A path'), requireEntryKind(kind)));
+ipcMain.handle('sftp:upload', (_event, id, localPath, remoteDir) => sftp.upload(requireString(id, 'A transfer connection'), requireString(localPath, 'A local file'), requireString(remoteDir, 'A remote folder')));
+ipcMain.handle('sftp:download', (_event, id, remotePath, localDir, kind) => sftp.download(requireString(id, 'A transfer connection'), requireString(remotePath, 'A remote path'), requireString(localDir, 'A local folder'), requireEntryKind(kind)));
+// The answer is a secret in two of the three cases, so it is passed straight
+// through and never returned, logged, or kept.
+ipcMain.handle('sftp:answerPrompt', (_event, id, answer) => {
+    if (typeof answer !== 'string')
+        throw new Error('An answer is required.');
+    sftp.answerPrompt(requireString(id, 'A transfer connection'), answer);
+});
+ipcMain.handle('sftp:close', (_event, id) => sftp.close(requireString(id, 'A transfer connection')));
 ipcMain.handle('ai:suggest', () => ({
     command: 'git status --short',
     explanation: 'Read-only preview of changed files in the active workspace.'

package/dist/main/main/preload.cjs

@@ -1,33 +1,58 @@
-const { contextBridge, ipcRenderer } = require('electron');
-
-const api = {
-  listSessions: () => ipcRenderer.invoke('sessions:list'),
-  listHistory: () => ipcRenderer.invoke('sessions:history'),
-  removeHistory: (entryId) => ipcRenderer.invoke('sessions:historyRemove', entryId),
-  listBackends: () => ipcRenderer.invoke('sessions:backends'),
-  listWslDistributions: () => ipcRenderer.invoke('sessions:wslDistributions'),
-  createLocalSession: (request) => ipcRenderer.invoke('sessions:createLocal', request),
-  createSshSession: (request) => ipcRenderer.invoke('sessions:createSsh', request),
-  listKnownConnections: () => ipcRenderer.invoke('connections:listKnown'),
-  discoverRemoteScreens: (connection) => ipcRenderer.invoke('screens:discoverRemote', connection),
-  buildRemoteScreenAttach: (connection, screenName) => ipcRenderer.invoke('screens:attachRemote', connection, screenName),
-  attachSession: (id, size) => ipcRenderer.invoke('sessions:attach', id, size),
-  closeSession: (id) => ipcRenderer.invoke('sessions:close', id),
-  write: (sessionId, data) => ipcRenderer.send('terminal:write', sessionId, data),
-  resize: (sessionId, cols, rows) => ipcRenderer.send('terminal:resize', sessionId, cols, rows),
-  copyText: (text) => ipcRenderer.invoke('clipboard:writeText', text),
-  readText: () => ipcRenderer.invoke('clipboard:readText'),
-  onData: (callback) => {
-    const listener = (_event, sessionId, data) => callback(sessionId, data);
-    ipcRenderer.on('terminal:data', listener);
-    return () => ipcRenderer.removeListener('terminal:data', listener);
-  },
-  onStatus: (callback) => {
-    const listener = (_event, sessionId, message) => callback(sessionId, message);
-    ipcRenderer.on('terminal:status', listener);
-    return () => ipcRenderer.removeListener('terminal:status', listener);
-  },
-  requestAiCommand: () => ipcRenderer.invoke('ai:suggest')
-};
-
-contextBridge.exposeInMainWorld('zerog', api);
+const { contextBridge, ipcRenderer } = require('electron');
+
+const api = {
+  listSessions: () => ipcRenderer.invoke('sessions:list'),
+  listHistory: () => ipcRenderer.invoke('sessions:history'),
+  removeHistory: (entryId) => ipcRenderer.invoke('sessions:historyRemove', entryId),
+  listBackends: () => ipcRenderer.invoke('sessions:backends'),
+  listWslDistributions: () => ipcRenderer.invoke('sessions:wslDistributions'),
+  createLocalSession: (request) => ipcRenderer.invoke('sessions:createLocal', request),
+  createSshSession: (request) => ipcRenderer.invoke('sessions:createSsh', request),
+  listKnownConnections: () => ipcRenderer.invoke('connections:listKnown'),
+  discoverRemoteScreens: (connection) => ipcRenderer.invoke('screens:discoverRemote', connection),
+  buildRemoteScreenAttach: (connection, screenName) => ipcRenderer.invoke('screens:attachRemote', connection, screenName),
+  attachSession: (id, size) => ipcRenderer.invoke('sessions:attach', id, size),
+  closeSession: (id) => ipcRenderer.invoke('sessions:close', id),
+  write: (sessionId, data) => ipcRenderer.send('terminal:write', sessionId, data),
+  resize: (sessionId, cols, rows) => ipcRenderer.send('terminal:resize', sessionId, cols, rows),
+  copyText: (text) => ipcRenderer.invoke('clipboard:writeText', text),
+  readText: () => ipcRenderer.invoke('clipboard:readText'),
+  onData: (callback) => {
+    const listener = (_event, sessionId, data) => callback(sessionId, data);
+    ipcRenderer.on('terminal:data', listener);
+    return () => ipcRenderer.removeListener('terminal:data', listener);
+  },
+  onStatus: (callback) => {
+    const listener = (_event, sessionId, message) => callback(sessionId, message);
+    ipcRenderer.on('terminal:status', listener);
+    return () => ipcRenderer.removeListener('terminal:status', listener);
+  },
+  requestAiCommand: () => ipcRenderer.invoke('ai:suggest'),
+  listLocalDirectory: (path) => ipcRenderer.invoke('fs:listLocal', path),
+  localHome: () => ipcRenderer.invoke('fs:localHome'),
+  createLocalDirectory: (path) => ipcRenderer.invoke('fs:mkdirLocal', path),
+  renameLocalEntry: (from, to) => ipcRenderer.invoke('fs:renameLocal', from, to),
+  removeLocalEntry: (path, kind) => ipcRenderer.invoke('fs:removeLocal', path, kind),
+  sftpOpen: (target, cwd) => ipcRenderer.invoke('sftp:open', target, cwd),
+  sftpList: (sessionId, path) => ipcRenderer.invoke('sftp:list', sessionId, path),
+  sftpMkdir: (sessionId, path) => ipcRenderer.invoke('sftp:mkdir', sessionId, path),
+  sftpRename: (sessionId, from, to) => ipcRenderer.invoke('sftp:rename', sessionId, from, to),
+  sftpRemove: (sessionId, path, kind) => ipcRenderer.invoke('sftp:remove', sessionId, path, kind),
+  sftpUpload: (sessionId, localPath, remoteDir) => ipcRenderer.invoke('sftp:upload', sessionId, localPath, remoteDir),
+  sftpDownload: (sessionId, remotePath, localDir, kind) => ipcRenderer.invoke('sftp:download', sessionId, remotePath, localDir, kind),
+  sftpAnswerPrompt: (sessionId, answer) => ipcRenderer.invoke('sftp:answerPrompt', sessionId, answer),
+  sftpClose: (sessionId) => ipcRenderer.invoke('sftp:close', sessionId),
+  onSftpEvent: (callback) => {
+    const listener = (_event, payload) => callback(payload);
+    ipcRenderer.on('sftp:event', listener);
+    return () => ipcRenderer.removeListener('sftp:event', listener);
+  },
+  openExternal: (url) => ipcRenderer.invoke('links:openExternal', url),
+  onLinkRefused: (callback) => {
+    const listener = (_event, reason) => callback(reason);
+    ipcRenderer.on('links:refused', listener);
+    return () => ipcRenderer.removeListener('links:refused', listener);
+  }
+};
+
+contextBridge.exposeInMainWorld('zerog', api);

package/dist/main/main/session-service.js

@@ -3,7 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
 import { promisify } from 'node:util';
-import { defaultShellBackend, isLocalShellBackend, resolveShellBackend } from './shell-catalog.js';
+import { defaultShellBackend, findOpenSshTool, isLocalShellBackend, resolveShellBackend } from './shell-catalog.js';
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,48}$/;
@@ -41,7 +41,13 @@ export function validateSessionName(name) {
     }
     return value;
 }
-export function validateSshTarget(input) {
+/**
+ * Split an SSH target into the pieces a client needs, rejecting anything that
+ * is not one. Shared with the SFTP side (see sftp-protocol.ts) so that both
+ * clients are handed destinations vetted by the same rule — a target ssh would
+ * read as an option must not become an sftp option either.
+ */
+export function parseSshTarget(input) {
     const value = input.trim();
     const match = value.match(SSH_TARGET);
     if (!match) {
@@ -54,13 +60,38 @@ export function validateSshTarget(input) {
             throw new Error('SSH port must be between 1 and 65535.');
         }
     }
-    const destination = user ? `${user}@${host}` : host;
+    return {
+        target: value,
+        destination: user ? `${user}@${host}` : host,
+        ...(user ? { user } : {}),
+        host,
+        ...(portText ? { port: portText } : {})
+    };
+}
+export function validateSshTarget(input) {
+    const { target, destination, port } = parseSshTarget(input);
     const args = ['-tt'];
-    if (portText)
-        args.push('-p', portText);
+    if (port)
+        args.push('-p', port);
     // '--' ends option parsing, so the destination can never be read as a flag.
     args.push('--', destination);
-    return { target: value, args };
+    return { target, args };
+}
+/**
+ * The ssh client, as a path a pty can actually start.
+ *
+ * node-pty passes the file straight to CreateProcess on Windows, which does not
+ * append `.exe` — so a pty asked for `ssh` fails with "File not found" on a
+ * machine that has it. Resolving it here also turns a missing client into a
+ * sentence rather than that message. Where OpenSSH is looked for lives in
+ * findOpenSshTool, shared with the transfer side's sftpExecutable.
+ */
+export function sshExecutable(options = {}) {
+    const file = findOpenSshTool('ssh', options);
+    if (!file) {
+        throw new Error('The OpenSSH client was not found. Install the OpenSSH client tools to connect over SSH.');
+    }
+    return file;
 }
 export function parseWslDistributions(output) {
     return output.split(/\r?\n/).slice(1).map((line) => line.replace(/^\*?\s*/, '').trim())
@@ -240,7 +271,7 @@ export class ScreenService {
         session.status = 'connected';
         session.lastSeen = new Date().toISOString();
         try {
-            this.spawnCommand(id, 'ssh', args, onData, onExit, homedir(), size);
+            this.spawnCommand(id, sshExecutable(), args, onData, onExit, homedir(), size);
         }
         catch (error) {
             session.status = 'error';