zerogterm 0.7.0-alpha2 → 0.8.0-alpha

package/dist/main/main/main.js

@@ -1,21 +1,40 @@
-import { app, BrowserWindow, clipboard, ipcMain, Menu, session, shell } from 'electron';
+import { app, BrowserWindow, clipboard, ipcMain, Menu, safeStorage, session, shell } from 'electron';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { writeClipboardText } from './clipboard.js';
 import { ScreenService, parseWslDistributions } from './session-service.js';
 import { discoverShellBackends } from './shell-catalog.js';
 import { SessionHistoryStore, defaultHistoryPath } from './session-history.js';
+import { CommandHistoryStore, defaultCommandHistoryPath } from './command-history-store.js';
+import { WorkspaceStore, defaultWorkspacePath } from './workspace-store.js';
+import { PortForwardService } from './port-forward-service.js';
+import { PortForwardStore, defaultPortForwardPath } from './port-forward-store.js';
 import { buildRemoteScreenAttachArgs, buildRemoteScreenDiscoveryArgs, listKnownConnections, parseRemoteScreenList, validateKnownConnection } from './ssh-inventory.js';
 import { createLocalDirectory, listLocalDirectory, localHome, removeLocalEntry, renameLocalEntry } from './local-fs.js';
+import { wslHomeDirectory } from './wsl-home.js';
 import { decideExternalLink, isApplicationUrl } from './external-links.js';
 import { SftpService } from './sftp-service.js';
+import { AI_API_KEY, SPEECH_API_KEY, SecretStore, defaultSecretsPath } from './secret-store.js';
+import { AiService } from './ai-service.js';
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
 const history = new SessionHistoryStore({ filePath: defaultHistoryPath(app.getPath('userData')) });
+// The only store holding what the user typed. Nothing reaches it that has not
+// been through command-redaction in the renderer, and it holds nothing at all
+// until the setting is turned on.
+const commands = new CommandHistoryStore({ filePath: defaultCommandHistoryPath(app.getPath('userData')) });
+const workspaceStore = new WorkspaceStore({ filePath: defaultWorkspacePath(app.getPath('userData')) });
+const forwardStore = new PortForwardStore({ filePath: defaultPortForwardPath(app.getPath('userData')) });
+// Tunnels outlive the Ports view being closed: authenticating again is a real
+// cost to pay for having looked away.
+const forwards = new PortForwardService({ onEvent: (event) => win?.webContents.send('forwards:event', event) });
 const service = new ScreenService({ onEvent: (event, session, available) => { void history.record(event, session, available); } });
 let win;
 // Transfer connections outlive any single panel opening, so the panel can be
 // closed and reopened without re-authenticating to the host.
 const sftp = new SftpService({ onEvent: (event) => win?.webContents.send('sftp:event', event) });
+// API keys for speech servers. safeStorage is only usable after the app is
+// ready, which every IPC call here already is.
+const secrets = new SecretStore({ filePath: defaultSecretsPath(app.getPath('userData')), crypto: safeStorage });
 /** A pane's measured size, as it arrives from the renderer. */
 function parsePtySize(value) {
     if (!value || typeof value !== 'object')
@@ -25,10 +44,53 @@ function parsePtySize(value) {
         return undefined;
     return { cols: cols, rows: rows };
 }
-// GPU is unstable under Toolbox/Wayland on this host; allow override.
-if (process.env.ZEROG_ENABLE_GPU !== '1') {
+/**
+ * Software rendering, on the one platform that needs it.
+ *
+ * The GPU is unstable under Toolbox/Wayland, which is where this was found and
+ * why the switch exists. It was applied everywhere, though, and on Windows that
+ * is a straight loss: every pane is then rasterised on the CPU, and a window
+ * holding a dozen terminals can stall long enough for the compositor to grey it
+ * out — which reads to the user as a crash. Scoped to Linux, with an override in
+ * each direction so a machine that disagrees can say so.
+ */
+if (process.env.ZEROG_DISABLE_GPU === '1') {
+    app.disableHardwareAcceleration();
+}
+else if (process.platform === 'linux' && process.env.ZEROG_ENABLE_GPU !== '1') {
     app.disableHardwareAcceleration();
 }
+/**
+ * How long the main process may block before it is worth saying so.
+ *
+ * Every pty write, every IPC reply and every window event goes through this one
+ * loop, so a stall here freezes the whole application however many panes are
+ * open. 250ms is well past a slow frame and well short of anything a person
+ * would call a hang, which makes it a warning rather than a report.
+ */
+const LOOP_STALL_MS = 250;
+const LOOP_SAMPLE_MS = 500;
+/**
+ * Watch the main process for stalls.
+ *
+ * A timer that knows when it should have fired is the whole instrument: the
+ * difference between that and when it did fire is time the loop spent unable to
+ * run anything. It cannot say what blocked — only that something did, and for
+ * how long, which is the fact that was missing when a frozen window had to be
+ * explained from a screenshot.
+ */
+function watchEventLoop() {
+    let due = Date.now() + LOOP_SAMPLE_MS;
+    const timer = setInterval(() => {
+        const now = Date.now();
+        const lag = now - due;
+        due = now + LOOP_SAMPLE_MS;
+        if (lag >= LOOP_STALL_MS)
+            console.warn(`[zerog] main process blocked for ${Math.round(lag)}ms`);
+    }, LOOP_SAMPLE_MS);
+    // Diagnostics must never be the reason the process stays alive.
+    timer.unref();
+}
 function createWindow() {
     win = new BrowserWindow({
         width: 1440,
@@ -76,8 +138,32 @@ function createWindow() {
     win.webContents.on('preload-error', (_event, path, error) => {
         console.error('[zerog] preload-error', path, error);
     });
-    win.webContents.on('console-message', (_event, _level, message) => {
-        console.log('[renderer]', message);
+    // The renderer's console, copied into this one — which is the only way a
+    // warning from the workspace reaches a log at all.
+    //
+    // Read from the event object rather than from the positional arguments that
+    // used to carry it. Electron still passes those, and says so on every start:
+    // "'console-message' arguments are deprecated and will be removed". When they
+    // go, a handler reading them would keep being called and print nothing, so the
+    // renderer would fall silent without anything appearing to break — the exact
+    // failure this logging exists to rule out.
+    win.webContents.on('console-message', (details) => {
+        console.log('[renderer]', details.message);
+    });
+    // The two ends of the symptom this instrumentation exists for. `unresponsive`
+    // is the window the desktop has started greying out; `render-process-gone` is
+    // the renderer having actually died, which is a different failure that looks
+    // similar from the outside. Only recorded here: what to *do* about either —
+    // offer a reload, reattach the panes — is a decision about the interface, not
+    // about diagnostics.
+    win.on('unresponsive', () => {
+        console.warn('[zerog] window unresponsive');
+    });
+    win.on('responsive', () => {
+        console.warn('[zerog] window responsive again');
+    });
+    win.webContents.on('render-process-gone', (_event, details) => {
+        console.error('[zerog] render-process-gone', details);
     });
     const devUrl = process.env.VITE_DEV_SERVER_URL;
     if (devUrl) {
@@ -91,6 +177,9 @@ function createWindow() {
         win = undefined;
         service.detachAll();
         sftp.closeAll();
+        // A tunnel is a listening socket on someone's machine. It does not outlive
+        // the window that opened it.
+        forwards.closeAll();
     });
 }
 function isRecord(value) {
@@ -128,6 +217,18 @@ ipcMain.handle('links:openExternal', (_event, url) => {
 ipcMain.handle('sessions:list', () => service.list());
 ipcMain.handle('sessions:history', () => history.list());
 ipcMain.handle('sessions:historyRemove', (_event, entryId) => history.remove(entryId));
+ipcMain.handle('commands:list', () => commands.list());
+ipcMain.handle('commands:record', (_event, record) => commands.record(requireCommandRecord(record)));
+ipcMain.handle('commands:pick', (_event, id) => commands.pick(requireString(id, 'A command')));
+ipcMain.handle('commands:clear', () => commands.clear());
+ipcMain.handle('forwards:list', () => forwards.list());
+ipcMain.handle('forwards:open', (_event, request) => forwards.open(requireForwardRequest(request)));
+ipcMain.handle('forwards:close', (_event, id) => forwards.close(requireString(id, 'A shared port')));
+ipcMain.handle('forwards:answerPrompt', (_event, id, answer) => forwards.answerPrompt(requireString(id, 'A shared port'), requireString(answer, 'An answer')));
+ipcMain.handle('forwards:load', () => forwardStore.load());
+ipcMain.handle('forwards:save', (_event, file) => forwardStore.save(file));
+ipcMain.handle('workspaces:load', () => workspaceStore.load());
+ipcMain.handle('workspaces:save', (_event, file) => workspaceStore.save(file));
 ipcMain.handle('sessions:backends', () => discoverShellBackends());
 ipcMain.handle('sessions:wslDistributions', async () => {
     try {
@@ -211,12 +312,100 @@ function requireString(value, field) {
         throw new Error(`${field} is required.`);
     return value;
 }
+/**
+ * A captured command, shaped.
+ *
+ * Only the shape is checked here. Whether the text is safe to store was decided
+ * in the renderer by command-redaction, next to the capture that produced it —
+ * that is where the rules and their tests live.
+ */
+function requireCommandRecord(value) {
+    if (!isRecord(value))
+        throw new Error('A command is required.');
+    const text = (field) => (typeof field === 'string' && field ? field : undefined);
+    return {
+        command: requireString(value.command, 'A command'),
+        ...(text(value.cwd) ? { cwd: String(value.cwd) } : {}),
+        ...(text(value.host) ? { host: String(value.host) } : {}),
+        ...(value.kind === 'ssh' || value.kind === 'local' ? { kind: value.kind } : {}),
+        ...(typeof value.exitCode === 'number' ? { exitCode: value.exitCode } : {})
+    };
+}
+function requireAiConfig(value) {
+    if (!isRecord(value))
+        throw new Error('An AI endpoint is required.');
+    return {
+        baseUrl: typeof value.baseUrl === 'string' ? value.baseUrl : '',
+        model: typeof value.model === 'string' ? value.model : ''
+    };
+}
+/**
+ * A suggestion request, shaped.
+ *
+ * The prompt and the context are checked for type here and for content by
+ * buildSuggestionRequest, which is where those rules are tested. The captured
+ * output is deliberately not inspected: it is untrusted by design, and
+ * ai-protocol is what makes it safe to include.
+ */
+function requireSuggestionRequest(value) {
+    if (!isRecord(value))
+        throw new Error('A request is required.');
+    const context = isRecord(value.context) ? value.context : {};
+    const text = (field) => (typeof field === 'string' && field ? field : undefined);
+    return {
+        prompt: typeof value.prompt === 'string' ? value.prompt : '',
+        ...(text(value.sessionId) ? { sessionId: String(value.sessionId) } : {}),
+        context: {
+            ...(text(context.shell) ? { shell: String(context.shell) } : {}),
+            ...(text(context.cwd) ? { cwd: String(context.cwd) } : {}),
+            ...(text(context.host) ? { host: String(context.host) } : {}),
+            ...(context.kind === 'ssh' || context.kind === 'local' ? { kind: context.kind } : {}),
+            ...(text(context.output) ? { output: String(context.output) } : {})
+        }
+    };
+}
+/**
+ * A forwarding request, shaped.
+ *
+ * Only the shape is checked here: the values are vetted by buildForwardArgs,
+ * which is where the rules live and where they are tested, and which throws a
+ * sentence the renderer can show as-is.
+ */
+function requireForwardRequest(value) {
+    if (!isRecord(value))
+        throw new Error('A shared port is required.');
+    return {
+        target: requireString(value.target, 'An SSH target'),
+        direction: value.direction,
+        bind: value.bind,
+        listenPort: value.listenPort,
+        destinationPort: value.destinationPort,
+        ...(typeof value.destinationHost === 'string' && value.destinationHost ? { destinationHost: value.destinationHost } : {}),
+        ...(typeof value.id === 'string' && value.id ? { id: value.id } : {})
+    };
+}
 function requireEntryKind(value) {
     if (value === 'file' || value === 'directory' || value === 'symlink')
         return value;
     throw new Error('An entry kind of file, directory, or symlink is required.');
 }
+// Electron's own reading of package.json, so the title bar shows what is
+// actually running rather than a string compiled in from the repo.
+ipcMain.handle('app:version', () => app.getVersion());
 ipcMain.handle('fs:localHome', () => localHome());
+// Cached on success only, so a distribution that was not running when it was
+// first asked can answer later.
+const wslHomes = new Map();
+ipcMain.handle('fs:wslHome', async (_event, distribution) => {
+    const name = typeof distribution === 'string' ? distribution : '';
+    const known = wslHomes.get(name);
+    if (known)
+        return known;
+    const home = await wslHomeDirectory(name);
+    if (home)
+        wslHomes.set(name, home);
+    return home;
+});
 ipcMain.handle('fs:listLocal', (_event, path) => listLocalDirectory(typeof path === 'string' && path ? path : undefined));
 ipcMain.handle('fs:mkdirLocal', (_event, path) => createLocalDirectory(requireString(path, 'A folder path')));
 ipcMain.handle('fs:renameLocal', (_event, from, to) => renameLocalEntry(requireString(from, 'The current path'), requireString(to, 'The new path')));
@@ -236,10 +425,39 @@ ipcMain.handle('sftp:answerPrompt', (_event, id, answer) => {
     sftp.answerPrompt(requireString(id, 'A transfer connection'), answer);
 });
 ipcMain.handle('sftp:close', (_event, id) => sftp.close(requireString(id, 'A transfer connection')));
-ipcMain.handle('ai:suggest', () => ({
-    command: 'git status --short',
-    explanation: 'Read-only preview of changed files in the active workspace.'
-}));
+// The key is read here, per request, and never handed to the renderer.
+const ai = new AiService({ readApiKey: () => secrets.get(AI_API_KEY) });
+ipcMain.handle('ai:suggest', (_event, config, request) => ai.suggest(requireAiConfig(config), requireSuggestionRequest(request)));
+ipcMain.handle('ai:models', (_event, baseUrl) => ai.listModels(requireString(baseUrl, 'A base URL')));
+ipcMain.handle('ai:test', (_event, config) => ai.test(requireAiConfig(config)));
+ipcMain.handle('ai:cancel', () => ai.cancel());
+async function aiKeyStatus() {
+    return { stored: await secrets.has(AI_API_KEY), encryptionAvailable: secrets.encryptionAvailable() };
+}
+ipcMain.handle('aiKey:status', () => aiKeyStatus());
+ipcMain.handle('aiKey:save', async (_event, key) => {
+    await secrets.set(AI_API_KEY, typeof key === 'string' ? key.trim() : '');
+    return aiKeyStatus();
+});
+ipcMain.handle('aiKey:clear', async () => {
+    await secrets.clear(AI_API_KEY);
+    return aiKeyStatus();
+});
+async function speechKeyStatus() {
+    return { stored: await secrets.has(SPEECH_API_KEY), encryptionAvailable: secrets.encryptionAvailable() };
+}
+ipcMain.handle('speechKey:status', () => speechKeyStatus());
+ipcMain.handle('speechKey:save', async (_event, key) => {
+    // An empty key means "clear", which SecretStore already does — but the
+    // string still has to be a string, and a pasted key often carries newlines.
+    await secrets.set(SPEECH_API_KEY, typeof key === 'string' ? key.trim() : '');
+    return speechKeyStatus();
+});
+ipcMain.handle('speechKey:clear', async () => {
+    await secrets.clear(SPEECH_API_KEY);
+    return speechKeyStatus();
+});
+ipcMain.handle('speechKey:read', () => secrets.get(SPEECH_API_KEY));
 app.whenReady().then(() => {
     // Voice input captures the local microphone only. Electron denies all
     // permission requests unless a handler answers, so grant media explicitly.
@@ -249,6 +467,7 @@ app.whenReady().then(() => {
     // Keep the normal window chrome, but let the ZeroG UI occupy the full
     // client area instead of showing Electron's default File/Edit/etc. menu.
     Menu.setApplicationMenu(null);
+    watchEventLoop();
     createWindow();
     app.on('activate', () => {
         if (!BrowserWindow.getAllWindows().length)

package/dist/main/main/port-forward-protocol.js

@@ -0,0 +1,161 @@
+// Turning a forwarding request into an ssh command line, and reading back
+// whether the tunnel came up.
+//
+// Kept apart from the service so the part that decides what `ssh` is asked to do
+// can be tested exhaustively without spawning anything. That matters more here
+// than usual: every field lands in an argv element, and the whole point of the
+// feature is to open a listening socket.
+import { parseSshTarget, sshExecutable } from './session-service.js';
+import { isSshHostName } from './ssh-inventory.js';
+/** Where traffic goes when the request does not say. */
+const DEFAULT_DESTINATION_HOST = 'localhost';
+/**
+ * How long to wait for a tunnel to declare itself before assuming it is up.
+ *
+ * Only a fallback: an ssh that has authenticated and gone quiet without saying
+ * it started listening is almost certainly listening. The explicit signals in
+ * readForwardOutcome are what normally settle this, and they arrive in
+ * milliseconds.
+ */
+export const FORWARD_SETTLE_MS = 1500;
+function requirePort(value, what) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 1 || value > 65535) {
+        throw new Error(`${what} must be a whole number between 1 and 65535.`);
+    }
+    return value;
+}
+function requireDirection(value) {
+    if (value !== 'local' && value !== 'remote')
+        throw new Error('A forward must be local or remote.');
+    return value;
+}
+function requireBind(value) {
+    if (value !== 'loopback' && value !== 'all')
+        throw new Error('A forward must bind to loopback or to all interfaces.');
+    return value;
+}
+/**
+ * The host on the receiving side of the tunnel.
+ *
+ * Vetted with the same rule as a HostName in ~/.ssh/config, because it is
+ * concatenated into the forward spec — one argv element — and a value beginning
+ * with '-' would be read by ssh's getopt as an option instead.
+ *
+ * Colons are then refused on top of that rule, which a HostName is allowed to
+ * carry for an IPv6 literal. ssh splits a forward spec on colons, so an
+ * unbracketed IPv6 address there does not mean what it looks like: `[::1]` is
+ * the syntax, and accepting a bare `::1` would silently build a spec describing
+ * a different tunnel. Bracketed literals are a separate job, so this says no
+ * rather than guessing.
+ */
+function requireDestinationHost(value) {
+    if (value === undefined || value === '')
+        return DEFAULT_DESTINATION_HOST;
+    if (typeof value !== 'string' || !isSshHostName(value)) {
+        throw new Error('The destination host must be a hostname or IP address.');
+    }
+    if (value.includes(':')) {
+        throw new Error('An IPv6 destination is not supported yet. Use a hostname or an IPv4 address.');
+    }
+    return value;
+}
+/**
+ * The bind address to put in the spec, or nothing.
+ *
+ * The two directions are not symmetric here, and it is the server's rule that
+ * makes them differ. A `-L` forward binds on this machine, so the address is
+ * ours to state and is always stated. A `-R` forward binds on the remote, where
+ * sshd's GatewayPorts decides: the default (`no`) binds loopback and rejects a
+ * client-specified address outright, so loopback has to be expressed by saying
+ * nothing at all. `*` is used for the wide case because it is accepted under
+ * both `yes` and `clientspecified`.
+ */
+function bindPrefix(direction, bind) {
+    if (direction === 'local')
+        return bind === 'all' ? '0.0.0.0:' : '127.0.0.1:';
+    return bind === 'all' ? '*:' : '';
+}
+/**
+ * Build the command line for a forward.
+ *
+ * Two options carry most of the weight:
+ *
+ * `ExitOnForwardFailure=yes` — without it, ssh stays connected when the forward
+ * cannot bind, and there is no way to tell a working tunnel from a useless one
+ * short of trying to use it. With it, a forward that fails is a process that
+ * exits, and the UI can say so.
+ *
+ * `-v` — so that the tunnel being up is something ssh said rather than something
+ * we assumed. `-N` produces no output of its own on success, so without this the
+ * only signal available is the absence of an error.
+ */
+export function buildForwardArgs(request, options = {}) {
+    const direction = requireDirection(request.direction);
+    const bind = requireBind(request.bind);
+    const listenPort = requirePort(request.listenPort, 'The port to open');
+    const destinationPort = requirePort(request.destinationPort, 'The port to forward to');
+    const destinationHost = requireDestinationHost(request.destinationHost);
+    const { destination, port } = parseSshTarget(request.target);
+    const spec = `${bindPrefix(direction, bind)}${listenPort}:${destinationHost}:${destinationPort}`;
+    const args = ['-v', '-N', '-o', 'ExitOnForwardFailure=yes', '-o', 'ConnectTimeout=20'];
+    if (port)
+        args.push('-p', port);
+    args.push(direction === 'local' ? '-L' : '-R', spec);
+    // '--' ends option parsing, so the destination can never be read as a flag.
+    args.push('--', destination);
+    return { file: sshExecutable(options), args, spec };
+}
+const FAILURES = [
+    {
+        pattern: /bind \[?([^\]\s]+)\]?:(\d+): (.+)/,
+        reason: (match) => `Could not bind ${match[1]}:${match[2]} — ${match[3].trim()}.`
+    },
+    {
+        pattern: /Warning: remote port forwarding failed for listen port (\d+)/,
+        reason: (match) => `The remote host refused to open port ${match[1]}. Its sshd may need GatewayPorts enabled to bind beyond loopback.`
+    },
+    {
+        pattern: /channel_setup_fwd_listener_tcpip: cannot listen to port: (\d+)/,
+        reason: (match) => `Could not listen on port ${match[1]}.`
+    },
+    { pattern: /Permission denied \(([^)]*)\)/, reason: (match) => `Authentication failed (${match[1]}).` },
+    { pattern: /(?:ssh: )?Could not resolve hostname ([^\s:]+)/, reason: (match) => `Could not resolve ${match[1]}.` },
+    { pattern: /Connection (?:refused|timed out|closed) by ([^\s]+)/, reason: (match) => `The host ${match[1]} refused the connection.` },
+    { pattern: /(ssh: connect to host [^\r\n]+)/, reason: (match) => `${match[1].trim()}.` },
+    { pattern: /Host key verification failed/, reason: () => 'Host key verification failed.' }
+];
+/**
+ * What the client's output so far says about the tunnel.
+ *
+ * Read from the whole buffer rather than the tail: `-v` is talkative, and the one
+ * line that matters is followed by many that do not. Failure is checked before
+ * success because ssh reports a partial success — one forward of several — while
+ * still exiting.
+ */
+export function readForwardOutcome(buffer, direction) {
+    for (const { pattern, reason } of FAILURES) {
+        const match = buffer.match(pattern);
+        if (match)
+            return { kind: 'failed', reason: reason(match) };
+    }
+    const success = direction === 'local'
+        ? /Local forwarding listening on \S+ port (\d+)/
+        : /remote forward success for: listen (\d+)/;
+    if (success.test(buffer))
+        return { kind: 'open' };
+    // Not proof of a tunnel, but it does mean the connection got that far — the
+    // service uses it to start the settle timer rather than waiting the full
+    // timeout on a host that never answered at all.
+    if (/Authentication succeeded|debug1: Entering interactive session/.test(buffer)) {
+        return { kind: 'authenticated' };
+    }
+    return null;
+}
+/** How a forward reads in the UI and in a log line. */
+export function describeForward(request) {
+    const destinationHost = request.destinationHost || DEFAULT_DESTINATION_HOST;
+    const listener = request.bind === 'all' ? '0.0.0.0' : 'localhost';
+    return request.direction === 'local'
+        ? `${listener}:${request.listenPort} → ${destinationHost}:${request.destinationPort} on ${request.target}`
+        : `${request.target}:${request.listenPort} → ${destinationHost}:${request.destinationPort} here`;
+}