Repo-side hardening and tooling from the intensive test round (none of this ships in the app installer). - gateway: registry.json (holds bearer tokens) now gets a best-effort owner-only NTFS ACL on Windows via `icacls /inheritance:r /grant:r <user>:F` (the chmod 0600 is a no-op on NTFS); verified the file ends up <user>:(F) only. - gateway: connect_server now reads the app version from the real get_system_info shape (data.app.version / data.agent.version), so "connected to vX.Y.Z" works. - gateway: read_log tool description documents grep as a case-insensitive substring filter with "|" alternation (not a regex), matching the agent-side change. - gateway: standalone verification harnesses moved to gateway/verify/ (so `node --test` only sweeps real unit tests) and exposed via `npm run verify`: e2e-verify, integration-mcp (live gateway-MCP <-> agent, all 14 tools), and adversarial-probe (redaction fuzz + ReDoS + lockout). `npm test` runs the units. - eslint: gateway/** now lints as ESM (sourceType module) via a dedicated block; global ignores fixed so `eslint .` is clean across the whole project (0 errors). - docs/remote-diagnostics-setup.md: made the transport story honest — the agent speaks plaintext ws:// over enforced loopback; the SSH/WireGuard tunnel is the ONLY confidentiality layer (wss/TLS + cert-pin is a documented future mode, not active). Removed the stale "bind to a LAN/VPN IP" guidance (loopback is enforced). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
64 lines
2.0 KiB
JavaScript
64 lines
2.0 KiB
JavaScript
import { readFile, writeFile, chmod } from 'node:fs/promises';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { dirname, join } from 'node:path';
|
|
import { execFile } from 'node:child_process';
|
|
import { userInfo } from 'node:os';
|
|
|
|
const HERE = dirname(fileURLToPath(import.meta.url));
|
|
const REGISTRY_PATH = join(HERE, 'registry.json');
|
|
|
|
export async function loadRegistry() {
|
|
try {
|
|
const raw = await readFile(REGISTRY_PATH, 'utf8');
|
|
const parsed = JSON.parse(raw);
|
|
if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
|
|
return {};
|
|
}
|
|
return parsed;
|
|
} catch {
|
|
return {};
|
|
}
|
|
}
|
|
|
|
function tightenWindowsAcl(path) {
|
|
return new Promise((resolve) => {
|
|
let user;
|
|
try { user = userInfo().username; } catch { resolve(); return; }
|
|
if (!user) { resolve(); return; }
|
|
execFile('icacls', [path, '/inheritance:r', '/grant:r', `${user}:F`], { windowsHide: true }, () => resolve());
|
|
});
|
|
}
|
|
|
|
export async function saveRegistry(registry) {
|
|
const data = registry && typeof registry === 'object' ? registry : {};
|
|
await writeFile(REGISTRY_PATH, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
|
|
try { await chmod(REGISTRY_PATH, 0o600); } catch {}
|
|
if (process.platform === 'win32') { try { await tightenWindowsAcl(REGISTRY_PATH); } catch {} }
|
|
}
|
|
|
|
export async function upsertEntry(entry) {
|
|
if (!entry || typeof entry.label !== 'string' || entry.label.length === 0) {
|
|
throw new Error('upsertEntry: entry.label is required');
|
|
}
|
|
const registry = await loadRegistry();
|
|
registry[entry.label] = {
|
|
host: entry.host,
|
|
port: entry.port,
|
|
token: entry.token,
|
|
fp: entry.fp,
|
|
label: entry.label,
|
|
version: entry.version,
|
|
lastConnectedAt: entry.lastConnectedAt ?? new Date().toISOString(),
|
|
};
|
|
await saveRegistry(registry);
|
|
return registry[entry.label];
|
|
}
|
|
|
|
export async function getEntry(label) {
|
|
if (typeof label !== 'string' || label.length === 0) return null;
|
|
const registry = await loadRegistry();
|
|
return registry[label] ?? null;
|
|
}
|
|
|
|
export { REGISTRY_PATH };
|