mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-28 14:15:24 +00:00
Lukas
3892381b95
* fix(desktop): send linked server proxy headers on WebSocket upgrades isLinkedOrigin compared the request origin with the link's http(s) origin, so the terminal WebSocket (wss://host/...) never matched and its upgrade went out without the proxy headers and basic auth. Behind a forward-auth proxy that upgrade was redirected to the login and the terminal closed with "connection closed unexpectedly". ws and wss now count as http and https for the comparison, the same mapping the WebSocket handshake itself uses, with host and port still matched exactly. * fix(desktop): allow a linked server's self-signed certificate for its WebSockets isInvalidCertificateAllowedForUrl compared the URL with a local getOrigin copy, so wss://host never matched the link's https://host origin and an allowed self-signed certificate did not cover the terminal and tunnel sockets. It now uses linkedServer.isLinkedOrigin, which maps ws and wss the same way as the proxy headers, and the local copy is removed.
3901 lines
111 KiB
JavaScript
3901 lines
111 KiB
JavaScript
const {
|
|
app,
|
|
BrowserWindow,
|
|
shell,
|
|
ipcMain,
|
|
dialog,
|
|
Menu,
|
|
session,
|
|
safeStorage,
|
|
Tray,
|
|
clipboard,
|
|
nativeImage,
|
|
} = require("electron");
|
|
const path = require("path");
|
|
const { getUnpackedAppRoot } = require("./backend-paths.cjs");
|
|
const { classifyBackendFailure } = require("./backend-failure.cjs");
|
|
const fs = require("fs");
|
|
const { renameLocalPath } = require("./rename-local-path.cjs");
|
|
const os = require("os");
|
|
const https = require("https");
|
|
const http = require("http");
|
|
const net = require("net");
|
|
const tls = require("tls");
|
|
const zlib = require("zlib");
|
|
const crypto = require("crypto");
|
|
const { URL, pathToFileURL } = require("url");
|
|
const { fork, spawn } = require("child_process");
|
|
const pty = require("node-pty");
|
|
const WebSocket = require("ws");
|
|
const linkedServer = require("./linked-server.cjs");
|
|
const desktopSettings = require("./desktop-settings.cjs");
|
|
const autoUpdates = require("./auto-updater.cjs");
|
|
const { launchNativeRdp } = require("./native-rdp.cjs");
|
|
const { isCloseActiveTabInput } = require("./keyboard-shortcuts.cjs");
|
|
const { quitApp } = require("./app-quit.cjs");
|
|
const { selectLinuxPasswordStore } = require("./linux-password-store.cjs");
|
|
const { resolveLocalShell, repairSpawnHelpers } = require("./local-shell.cjs");
|
|
const {
|
|
registerLocalFileHandlers,
|
|
setLocalBackendPort,
|
|
} = require("./local-files.cjs");
|
|
const {
|
|
EXTERNAL_EDITOR_SETTING,
|
|
isLaunchableFileName,
|
|
} = require("./external-editor.cjs");
|
|
const { isExternalLoginUrl, isCallbackPort } = require("./external-login.cjs");
|
|
|
|
const localTerminalSessions = new Map();
|
|
|
|
function ownedLocalTerminal(event, sessionId) {
|
|
if (typeof sessionId !== "string" || !/^[a-f0-9-]{36}$/.test(sessionId)) {
|
|
return null;
|
|
}
|
|
const session = localTerminalSessions.get(sessionId);
|
|
return session?.ownerId === event.sender.id ? session : null;
|
|
}
|
|
|
|
function closeLocalTerminalsFor(ownerId) {
|
|
for (const [sessionId, session] of localTerminalSessions) {
|
|
if (session.ownerId !== ownerId) continue;
|
|
session.process.kill();
|
|
localTerminalSessions.delete(sessionId);
|
|
}
|
|
}
|
|
|
|
// The main process's Node.js networking (the `https`/`http` modules used by
|
|
// httpFetch below and the global `fetch`) only
|
|
// trusts Node's bundled Mozilla CA list by default, not the OS/system trust
|
|
// store. Chromium (the renderer, i.e. the web app and the login iframe) uses
|
|
// the OS trust store instead, so a certificate that's valid in-browser --
|
|
// e.g. one issued by a reverse proxy's internal/corporate CA, or a system
|
|
// CA installed via Keychain/certmgr -- can still fail main-process requests
|
|
// with UNABLE_TO_VERIFY_LEAF_SIGNATURE. Merge the system store in so remote
|
|
// sync and the connection health check see the same trust as the browser.
|
|
try {
|
|
if (typeof tls.setDefaultCACertificates === "function") {
|
|
tls.setDefaultCACertificates([
|
|
...tls.getCACertificates("default"),
|
|
...tls.getCACertificates("system"),
|
|
]);
|
|
}
|
|
} catch (error) {
|
|
console.error("Failed to merge system CA certificates:", error);
|
|
}
|
|
|
|
// Portable mode: if a `.portable` marker exists next to the executable,
|
|
// store all data in a `data` folder beside the exe instead of %APPDATA%.
|
|
(function setupPortableDataDir() {
|
|
const exeDir = path.dirname(process.execPath);
|
|
const markerPath = path.join(exeDir, ".portable");
|
|
const envOverride = process.env.TERMIX_DATA_DIR;
|
|
|
|
let portableDataDir = null;
|
|
if (envOverride) {
|
|
portableDataDir = envOverride;
|
|
} else if (app.isPackaged && fs.existsSync(markerPath)) {
|
|
portableDataDir = path.join(exeDir, "data");
|
|
}
|
|
|
|
if (portableDataDir) {
|
|
try {
|
|
if (!fs.existsSync(portableDataDir)) {
|
|
fs.mkdirSync(portableDataDir, { recursive: true });
|
|
}
|
|
app.setPath("userData", portableDataDir);
|
|
} catch {
|
|
// Fall back to default userData if we can't create the directory.
|
|
}
|
|
}
|
|
})();
|
|
|
|
const logFile = path.join(app.getPath("userData"), "termix-main.log");
|
|
const electronAuthCookiesPath = path.join(
|
|
app.getPath("userData"),
|
|
"electron-auth-cookies.json",
|
|
);
|
|
const electronAuthCookies = new Map();
|
|
|
|
function logToFile(...args) {
|
|
const timestamp = new Date().toISOString();
|
|
const msg = args
|
|
.map((a) => (typeof a === "object" ? JSON.stringify(a) : String(a)))
|
|
.join(" ");
|
|
const line = `[${timestamp}] ${msg}\n`;
|
|
try {
|
|
fs.appendFileSync(logFile, line);
|
|
} catch {
|
|
// ignore
|
|
}
|
|
console.log(...args);
|
|
}
|
|
|
|
function getCookieOrigin(url) {
|
|
try {
|
|
const parsedUrl = new URL(url);
|
|
const protocol =
|
|
parsedUrl.protocol === "ws:"
|
|
? "http:"
|
|
: parsedUrl.protocol === "wss:"
|
|
? "https:"
|
|
: parsedUrl.protocol;
|
|
return `${protocol}//${parsedUrl.host}`;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function parseCookieTarget(url) {
|
|
try {
|
|
const parsedUrl = new URL(url);
|
|
if (parsedUrl.protocol === "ws:") {
|
|
parsedUrl.protocol = "http:";
|
|
} else if (parsedUrl.protocol === "wss:") {
|
|
parsedUrl.protocol = "https:";
|
|
}
|
|
return parsedUrl;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function getElectronAuthCookieKey(name, origin) {
|
|
return origin ? `${origin}|${name}` : null;
|
|
}
|
|
|
|
function getSafeStorageAvailable() {
|
|
try {
|
|
return safeStorage.isEncryptionAvailable();
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
function encodeElectronAuthCookieValue(value) {
|
|
return {
|
|
encrypted: true,
|
|
value: safeStorage.encryptString(value).toString("base64"),
|
|
};
|
|
}
|
|
|
|
function decodeElectronAuthCookieValue(record) {
|
|
if (!record.encrypted || !getSafeStorageAvailable()) {
|
|
return null;
|
|
}
|
|
|
|
try {
|
|
return safeStorage.decryptString(Buffer.from(record.value, "base64"));
|
|
} catch (error) {
|
|
logToFile(
|
|
"Failed to decrypt persisted Electron auth cookie:",
|
|
error.message,
|
|
);
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function isElectronAuthCookieExpired(cookie) {
|
|
return Number.isFinite(cookie.expiresAt) && cookie.expiresAt <= Date.now();
|
|
}
|
|
|
|
function saveElectronAuthCookiesToDisk() {
|
|
try {
|
|
if (!getSafeStorageAvailable()) {
|
|
if (fs.existsSync(electronAuthCookiesPath)) {
|
|
fs.rmSync(electronAuthCookiesPath, { force: true });
|
|
}
|
|
return;
|
|
}
|
|
|
|
const records = [];
|
|
|
|
for (const [key, cookie] of electronAuthCookies.entries()) {
|
|
if (isElectronAuthCookieExpired(cookie)) {
|
|
electronAuthCookies.delete(key);
|
|
continue;
|
|
}
|
|
|
|
records.push({
|
|
key,
|
|
name: cookie.name,
|
|
origin: cookie.origin,
|
|
path: cookie.path,
|
|
expiresAt: cookie.expiresAt,
|
|
...encodeElectronAuthCookieValue(cookie.value),
|
|
});
|
|
}
|
|
|
|
fs.writeFileSync(
|
|
electronAuthCookiesPath,
|
|
JSON.stringify({ version: 1, records }, null, 2),
|
|
);
|
|
} catch (error) {
|
|
logToFile("Failed to persist Electron auth cookies:", error.message);
|
|
}
|
|
}
|
|
|
|
function loadElectronAuthCookiesFromDisk() {
|
|
electronAuthCookies.clear();
|
|
|
|
try {
|
|
if (!getSafeStorageAvailable()) {
|
|
if (fs.existsSync(electronAuthCookiesPath)) {
|
|
fs.rmSync(electronAuthCookiesPath, { force: true });
|
|
}
|
|
return;
|
|
}
|
|
|
|
if (!fs.existsSync(electronAuthCookiesPath)) {
|
|
return;
|
|
}
|
|
|
|
const data = JSON.parse(fs.readFileSync(electronAuthCookiesPath, "utf8"));
|
|
const records = Array.isArray(data.records) ? data.records : [];
|
|
|
|
for (const record of records) {
|
|
if (
|
|
!record ||
|
|
typeof record.key !== "string" ||
|
|
typeof record.name !== "string" ||
|
|
typeof record.origin !== "string"
|
|
) {
|
|
continue;
|
|
}
|
|
|
|
const value = decodeElectronAuthCookieValue(record);
|
|
if (!value) {
|
|
continue;
|
|
}
|
|
|
|
const cookie = {
|
|
name: record.name,
|
|
value,
|
|
origin: record.origin,
|
|
path: typeof record.path === "string" ? record.path : "/",
|
|
expiresAt: Number.isFinite(record.expiresAt) ? record.expiresAt : null,
|
|
};
|
|
|
|
if (!isElectronAuthCookieExpired(cookie)) {
|
|
electronAuthCookies.set(record.key, cookie);
|
|
}
|
|
}
|
|
|
|
saveElectronAuthCookiesToDisk();
|
|
} catch (error) {
|
|
logToFile("Failed to load persisted Electron auth cookies:", error.message);
|
|
}
|
|
}
|
|
|
|
function clearPersistedElectronAuthCookies() {
|
|
electronAuthCookies.clear();
|
|
try {
|
|
if (fs.existsSync(electronAuthCookiesPath)) {
|
|
fs.rmSync(electronAuthCookiesPath, { force: true });
|
|
}
|
|
} catch (error) {
|
|
logToFile(
|
|
"Failed to clear persisted Electron auth cookies:",
|
|
error.message,
|
|
);
|
|
}
|
|
}
|
|
|
|
function parseSetCookieHeader(header) {
|
|
const [cookiePair, ...attributes] = String(header || "").split(";");
|
|
const separatorIndex = cookiePair.indexOf("=");
|
|
if (separatorIndex <= 0) return null;
|
|
|
|
const parsed = {
|
|
name: cookiePair.slice(0, separatorIndex).trim(),
|
|
value: cookiePair.slice(separatorIndex + 1).trim(),
|
|
path: "/",
|
|
maxAge: null,
|
|
expires: null,
|
|
};
|
|
|
|
for (const attribute of attributes) {
|
|
const [rawName, ...rawValueParts] = attribute.trim().split("=");
|
|
const attrName = rawName.toLowerCase();
|
|
const attrValue = rawValueParts.join("=");
|
|
|
|
if (attrName === "path" && attrValue) {
|
|
parsed.path = attrValue;
|
|
} else if (attrName === "max-age" && attrValue) {
|
|
const maxAge = Number(attrValue);
|
|
parsed.maxAge = Number.isFinite(maxAge) ? maxAge : null;
|
|
} else if (attrName === "expires" && attrValue) {
|
|
const expires = Date.parse(attrValue);
|
|
parsed.expires = Number.isFinite(expires) ? expires : null;
|
|
}
|
|
}
|
|
|
|
return parsed;
|
|
}
|
|
|
|
function rememberElectronAuthCookieFromHeader(url, header) {
|
|
const origin = getCookieOrigin(url);
|
|
if (!origin) return;
|
|
|
|
const cookie = parseSetCookieHeader(header);
|
|
if (!cookie || cookie.name !== "jwt") return;
|
|
|
|
const key = getElectronAuthCookieKey(cookie.name, origin);
|
|
if (!key) return;
|
|
|
|
const expired =
|
|
cookie.maxAge === 0 ||
|
|
(cookie.expires !== null && cookie.expires <= Date.now());
|
|
|
|
if (expired || !cookie.value) {
|
|
electronAuthCookies.delete(key);
|
|
saveElectronAuthCookiesToDisk();
|
|
return;
|
|
}
|
|
|
|
const expiresAt =
|
|
cookie.maxAge !== null ? Date.now() + cookie.maxAge * 1000 : cookie.expires;
|
|
|
|
electronAuthCookies.set(key, {
|
|
name: cookie.name,
|
|
value: cookie.value,
|
|
origin,
|
|
path: cookie.path,
|
|
expiresAt,
|
|
});
|
|
saveElectronAuthCookiesToDisk();
|
|
}
|
|
|
|
function getRememberedElectronAuthCookie(name, targetUrl) {
|
|
const target = parseCookieTarget(targetUrl);
|
|
if (!target) return null;
|
|
|
|
const exactKey = getElectronAuthCookieKey(name, target.origin);
|
|
const exactCookie = exactKey ? electronAuthCookies.get(exactKey) : null;
|
|
if (exactCookie && !isElectronAuthCookieExpired(exactCookie)) {
|
|
return exactCookie;
|
|
}
|
|
|
|
if (target.protocol !== "https:") {
|
|
return null;
|
|
}
|
|
|
|
const httpOrigin = `http://${target.host}`;
|
|
const httpKey = getElectronAuthCookieKey(name, httpOrigin);
|
|
const httpCookie = httpKey ? electronAuthCookies.get(httpKey) : null;
|
|
return httpCookie && !isElectronAuthCookieExpired(httpCookie)
|
|
? httpCookie
|
|
: null;
|
|
}
|
|
|
|
function getHeaderName(headers, name) {
|
|
const lowerName = name.toLowerCase();
|
|
return Object.keys(headers || {}).find(
|
|
(key) => key.toLowerCase() === lowerName,
|
|
);
|
|
}
|
|
|
|
function setCookieHeaderValue(requestHeaders, name, value) {
|
|
const headerName = getHeaderName(requestHeaders, "Cookie") || "Cookie";
|
|
const existing = requestHeaders[headerName];
|
|
const existingValue = Array.isArray(existing)
|
|
? existing.join("; ")
|
|
: existing;
|
|
const nextCookie = `${name}=${value}`;
|
|
const otherCookies = String(existingValue || "")
|
|
.split(";")
|
|
.map((cookie) => cookie.trim())
|
|
.filter((cookie) => cookie && !cookie.startsWith(`${name}=`));
|
|
|
|
requestHeaders[headerName] =
|
|
otherCookies.length > 0
|
|
? `${otherCookies.join("; ")}; ${nextCookie}`
|
|
: nextCookie;
|
|
}
|
|
|
|
function parseSemver(version) {
|
|
const match = String(version || "").match(/(\d+)\.(\d+)(?:\.(\d+))?/);
|
|
if (!match) return null;
|
|
|
|
return [Number(match[1]), Number(match[2]), Number(match[3] || 0)];
|
|
}
|
|
|
|
function compareSemver(a, b) {
|
|
const parsedA = parseSemver(a);
|
|
const parsedB = parseSemver(b);
|
|
if (!parsedA || !parsedB) return null;
|
|
|
|
for (let i = 0; i < 3; i += 1) {
|
|
if (parsedA[i] > parsedB[i]) return 1;
|
|
if (parsedA[i] < parsedB[i]) return -1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
const INSECURE_MODE_VALUES = new Set(["true", "1", "yes"]);
|
|
|
|
function isInsecureModeEnabled() {
|
|
return INSECURE_MODE_VALUES.has(
|
|
String(process.env.ENABLE_INSECURE_MODE || "")
|
|
.trim()
|
|
.toLowerCase(),
|
|
);
|
|
}
|
|
|
|
function isPrivateNetworkHost(hostname) {
|
|
if (
|
|
hostname === "localhost" ||
|
|
hostname === "127.0.0.1" ||
|
|
hostname === "::1"
|
|
) {
|
|
return true;
|
|
}
|
|
|
|
const ipv4Match = hostname.match(
|
|
/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
|
|
);
|
|
if (ipv4Match) {
|
|
const [, a, b] = ipv4Match.map(Number);
|
|
return (
|
|
a === 10 ||
|
|
(a === 172 && b >= 16 && b <= 31) ||
|
|
(a === 192 && b === 168) ||
|
|
(a === 169 && b === 254)
|
|
);
|
|
}
|
|
|
|
if (hostname.startsWith("fc") || hostname.startsWith("fd")) {
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
function isInvalidCertificateAllowedForUrl(url) {
|
|
if (isInsecureModeEnabled()) return true;
|
|
|
|
try {
|
|
const { hostname } = new URL(url);
|
|
if (isPrivateNetworkHost(hostname)) return true;
|
|
} catch {
|
|
// fall through
|
|
}
|
|
|
|
// Otherwise only the server this desktop is linked to, when its link
|
|
// allows a self-signed certificate.
|
|
const linked = linkedServer.getLinkedServer();
|
|
if (!linked?.allowInvalidCertificate) return false;
|
|
return linkedServer.isLinkedOrigin(url);
|
|
}
|
|
|
|
function getTlsVerificationOptions(url) {
|
|
return {
|
|
rejectUnauthorized: !isInvalidCertificateAllowedForUrl(url),
|
|
};
|
|
}
|
|
|
|
function getWebSocketOptions(url, options = {}) {
|
|
return {
|
|
...options,
|
|
...(String(url).startsWith("wss:") ? getTlsVerificationOptions(url) : {}),
|
|
};
|
|
}
|
|
|
|
function httpFetch(url, options = {}) {
|
|
return new Promise((resolve, reject) => {
|
|
const urlObj = new URL(url);
|
|
const isHttps = urlObj.protocol === "https:";
|
|
const client = isHttps ? https : http;
|
|
|
|
const requestOptions = {
|
|
method: options.method || "GET",
|
|
headers: options.headers || {},
|
|
timeout: options.timeout || 10000,
|
|
...(isHttps
|
|
? options.allowInvalidCertificate
|
|
? { rejectUnauthorized: false }
|
|
: getTlsVerificationOptions(url)
|
|
: {}),
|
|
};
|
|
|
|
const req = client.request(url, requestOptions, (res) => {
|
|
const chunks = [];
|
|
// Reverse proxies (nginx and friends) commonly gzip/deflate/br-compress
|
|
// responses regardless of client Accept-Encoding. Unlike browser fetch,
|
|
// Node's http/https modules never auto-decompress, so an unhandled
|
|
// content-encoding here silently turns the body into garbage bytes.
|
|
let stream = res;
|
|
const maxResponseBytes = options.maxResponseBytes || 10 * 1024 * 1024;
|
|
let responseBytes = 0;
|
|
let settled = false;
|
|
const fail = (error) => {
|
|
if (settled) return;
|
|
settled = true;
|
|
stream.destroy();
|
|
req.destroy();
|
|
reject(error);
|
|
};
|
|
const encoding = (res.headers["content-encoding"] || "")
|
|
.toLowerCase()
|
|
.trim();
|
|
try {
|
|
if (encoding === "gzip" || encoding === "x-gzip") {
|
|
stream = res.pipe(zlib.createGunzip());
|
|
} else if (encoding === "br") {
|
|
stream = res.pipe(zlib.createBrotliDecompress());
|
|
} else if (encoding === "deflate") {
|
|
stream = res.pipe(zlib.createInflate());
|
|
}
|
|
} catch (decompressError) {
|
|
reject(decompressError);
|
|
return;
|
|
}
|
|
|
|
stream.on("data", (chunk) => {
|
|
responseBytes += chunk.length;
|
|
if (responseBytes > maxResponseBytes) {
|
|
fail(new Error(`Response exceeds ${maxResponseBytes} bytes`));
|
|
return;
|
|
}
|
|
chunks.push(chunk);
|
|
});
|
|
stream.on("end", () => {
|
|
if (settled) return;
|
|
settled = true;
|
|
const data = Buffer.concat(chunks).toString("utf8");
|
|
resolve({
|
|
ok: res.statusCode >= 200 && res.statusCode < 300,
|
|
status: res.statusCode,
|
|
text: () => Promise.resolve(data),
|
|
json: () => Promise.resolve(JSON.parse(data)),
|
|
});
|
|
});
|
|
stream.on("error", fail);
|
|
});
|
|
|
|
req.on("error", reject);
|
|
req.on("timeout", () => {
|
|
req.destroy();
|
|
reject(new Error("Request timeout"));
|
|
});
|
|
|
|
if (options.body) {
|
|
req.write(options.body);
|
|
}
|
|
req.end();
|
|
});
|
|
}
|
|
|
|
if (process.platform === "linux") {
|
|
app.commandLine.appendSwitch("--ozone-platform-hint=auto");
|
|
|
|
app.commandLine.appendSwitch("--enable-features=VaapiVideoDecoder");
|
|
|
|
// Fix click-coordinate misalignment with fractional display scaling on KDE/Wayland.
|
|
// Chromium's hit-testing uses unscaled coords while the compositor scales visually,
|
|
// so forcing scale factor 1 keeps them in sync. See: https://github.com/brave/brave-browser/issues/50028
|
|
app.commandLine.appendSwitch("--force-device-scale-factor", "1");
|
|
|
|
const passwordStore = selectLinuxPasswordStore(app.commandLine, process.env);
|
|
if (passwordStore) {
|
|
logToFile(
|
|
`[safeStorage] Selected the ${passwordStore} password store for this desktop.`,
|
|
);
|
|
}
|
|
}
|
|
|
|
if (process.platform === "win32" || process.env.ELECTRON_DISABLE_GPU === "1") {
|
|
app.disableHardwareAcceleration();
|
|
}
|
|
|
|
if (isInsecureModeEnabled()) {
|
|
logToFile(
|
|
"[security] ENABLE_INSECURE_MODE is enabled; TLS certificate validation is disabled.",
|
|
);
|
|
app.commandLine.appendSwitch("--ignore-certificate-errors");
|
|
app.commandLine.appendSwitch("--ignore-ssl-errors");
|
|
app.commandLine.appendSwitch("--ignore-certificate-errors-spki-list");
|
|
}
|
|
app.commandLine.appendSwitch("--enable-features=NetworkService");
|
|
|
|
let mainWindow = null;
|
|
const { createIsolatedWindows } = require("./isolated-window.cjs");
|
|
const isolatedWindows = createIsolatedWindows({
|
|
BrowserWindow,
|
|
session,
|
|
getMainWindow: () => mainWindow,
|
|
});
|
|
|
|
// Requests from the embedded backend over the fork IPC channel (the other
|
|
// direction from the "shutdown" message main already sends it). A plugin's
|
|
// ctx.desktop.openIsolatedWindow is the one caller today.
|
|
const BACKEND_REQUEST_HANDLERS = {
|
|
"open-isolated-window": (payload) => isolatedWindows.open(payload),
|
|
// The OS client for a protocol. Only RDP has one wired up.
|
|
"launch-external-client": (payload) =>
|
|
payload?.protocol === "rdp"
|
|
? launchNativeRdp(payload)
|
|
: {
|
|
success: false,
|
|
error: `No external client for ${payload?.protocol ?? "this protocol"}`,
|
|
},
|
|
"sync-proxy-config": (payload) => {
|
|
linkedServer.setLinkedServer(payload);
|
|
return { success: true };
|
|
},
|
|
};
|
|
|
|
function isDevRunner() {
|
|
return (
|
|
process.env.TERMIX_DEV_RUNNER === "true" &&
|
|
typeof process.send === "function"
|
|
);
|
|
}
|
|
|
|
async function handleBackendRequest(msg) {
|
|
if (!msg || msg.type !== "backend-request") return;
|
|
const { id, channel, payload } = msg;
|
|
const handler = BACKEND_REQUEST_HANDLERS[channel];
|
|
// Under npm run dev:electron the runner owns the backend and relays these messages.
|
|
const target =
|
|
backendProcess && !backendProcess.killed
|
|
? backendProcess
|
|
: isDevRunner()
|
|
? process
|
|
: null;
|
|
const reply = (response) => {
|
|
if (!target) return;
|
|
try {
|
|
target.send({ type: "backend-response", id, ...response });
|
|
} catch (error) {
|
|
logToFile("Failed to reply to backend request:", error.message);
|
|
}
|
|
};
|
|
if (!handler) {
|
|
reply({ ok: false, error: `Unknown backend request channel: ${channel}` });
|
|
return;
|
|
}
|
|
try {
|
|
const result = await handler(payload);
|
|
reply({ ok: true, result });
|
|
} catch (error) {
|
|
reply({ ok: false, error: error.message || String(error) });
|
|
}
|
|
}
|
|
|
|
let backendProcess = null;
|
|
let backendStartFailed = false;
|
|
// Why the embedded backend died, once it has. Null while it is healthy
|
|
// or still starting. The renderer polls this to tell "still booting"
|
|
// (keep waiting) apart from "never coming back" (show the reason).
|
|
let backendFailure = null;
|
|
// Set while we are deliberately tearing the backend down on quit, so a
|
|
// SIGKILL we sent ourselves is not reported to the user as a crash.
|
|
let backendStopRequested = false;
|
|
// Tail of the embedded backend's stderr, kept only so a failed start can be
|
|
// classified after the fact.
|
|
const BACKEND_STDERR_TAIL_LIMIT = 8192;
|
|
let backendStderrTail = "";
|
|
let tray = null;
|
|
let isQuitting = false;
|
|
const tempFiles = new Map();
|
|
const externalEditorSessions = new Map();
|
|
// Paths the user picked in an open dialog this session. Only these may be
|
|
// saved as the external editor, so the renderer cannot name an executable.
|
|
const dialogChosenPaths = new Set();
|
|
|
|
const isDev = process.env.NODE_ENV === "development" || !app.isPackaged;
|
|
const appRoot = isDev ? process.cwd() : path.join(__dirname, "..");
|
|
const windowsAppUserModelId = "com.karmaa.termix";
|
|
const electronCacheBuildPath = path.join(
|
|
app.getPath("userData"),
|
|
"client-cache-build.json",
|
|
);
|
|
const termixSessionPartition = "persist:termix";
|
|
|
|
function getTempRoot() {
|
|
const tempRoot = path.join(app.getPath("temp"), "termix");
|
|
fs.mkdirSync(tempRoot, { recursive: true });
|
|
return tempRoot;
|
|
}
|
|
|
|
function sanitizeFileName(fileName) {
|
|
const baseName = path.basename(String(fileName || "file"));
|
|
return baseName.replace(/[<>:"/\\|?*\x00-\x1f]/g, "_") || "file";
|
|
}
|
|
|
|
function decodeFileContent(content, encoding) {
|
|
if (encoding === "base64") {
|
|
return Buffer.from(String(content || ""), "base64");
|
|
}
|
|
return Buffer.from(String(content || ""), "utf8");
|
|
}
|
|
|
|
function createManagedTempFile(fileName, content, encoding = "utf8") {
|
|
const tempId = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
|
|
const tempDir = fs.mkdtempSync(path.join(getTempRoot(), `${tempId}-`));
|
|
const filePath = path.join(tempDir, sanitizeFileName(fileName));
|
|
fs.writeFileSync(filePath, decodeFileContent(content, encoding));
|
|
tempFiles.set(tempId, { path: filePath, dir: tempDir });
|
|
return { tempId, path: filePath };
|
|
}
|
|
|
|
function cleanupManagedTempFile(tempId) {
|
|
const temp = tempFiles.get(tempId);
|
|
if (!temp) return;
|
|
try {
|
|
fs.rmSync(temp.dir, { recursive: true, force: true });
|
|
} catch (error) {
|
|
logToFile("Failed to clean up temporary file:", error.message);
|
|
}
|
|
tempFiles.delete(tempId);
|
|
}
|
|
|
|
function closeExternalEditorSession(editId) {
|
|
const session = externalEditorSessions.get(editId);
|
|
if (!session) return;
|
|
if (session.timer) clearTimeout(session.timer);
|
|
try {
|
|
session.watcher.close();
|
|
} catch {
|
|
// watcher may already be closed
|
|
}
|
|
externalEditorSessions.delete(editId);
|
|
cleanupManagedTempFile(editId);
|
|
}
|
|
|
|
function notifyExternalEditorSaved(editId) {
|
|
const session = externalEditorSessions.get(editId);
|
|
if (!session || !mainWindow || mainWindow.isDestroyed()) return;
|
|
|
|
try {
|
|
const stat = fs.statSync(session.path);
|
|
if (stat.mtimeMs === session.lastMtimeMs) return;
|
|
session.lastMtimeMs = stat.mtimeMs;
|
|
|
|
const content = fs.readFileSync(session.path, "utf8");
|
|
mainWindow.webContents.send("external-editor-saved", {
|
|
editId,
|
|
content,
|
|
encoding: "utf8",
|
|
path: session.path,
|
|
});
|
|
} catch (error) {
|
|
logToFile("Failed to read external editor file:", error.message);
|
|
}
|
|
}
|
|
|
|
function openPathWithEditor(filePath, editorPath) {
|
|
if (!editorPath) {
|
|
return shell.openPath(filePath);
|
|
}
|
|
|
|
return new Promise((resolve) => {
|
|
let settled = false;
|
|
const child = spawn(editorPath, [filePath], {
|
|
detached: true,
|
|
stdio: "ignore",
|
|
});
|
|
|
|
child.once("error", (error) => {
|
|
if (settled) return;
|
|
settled = true;
|
|
resolve(error.message);
|
|
});
|
|
|
|
setTimeout(() => {
|
|
if (settled) return;
|
|
settled = true;
|
|
child.unref();
|
|
resolve("");
|
|
}, 500);
|
|
});
|
|
}
|
|
|
|
// Origins the renderer has explicitly marked as allowed to present an invalid
|
|
// certificate, for web endpoints whose ignoreCert is set. Session scoped and
|
|
// never persisted.
|
|
//
|
|
// Deliberately NOT wired into isInvalidCertificateAllowedForUrl: that function
|
|
// also governs this process's own outbound TLS via getTlsVerificationOptions,
|
|
// and widening it would grant more privilege than the feature needs.
|
|
//
|
|
// Entries expire rather than living until the app restarts (days, on a
|
|
// desktop app). Main has no host-database access, so it cannot verify a
|
|
// renderer's claim that an origin really is a configured web endpoint -- an
|
|
// unbounded allowance would make that an indefinite window rather than a
|
|
// momentary one. The renderer re-registers before each load, which refreshes
|
|
// the expiry, so a live endpoint keeps working while a stale entry lapses.
|
|
const WEB_ENDPOINT_CERTIFICATE_ALLOWLIST_TTL_MS = 5 * 60 * 1000;
|
|
const webEndpointCertificateAllowlist = new Map();
|
|
|
|
function isWebEndpointCertificateAllowed(url) {
|
|
try {
|
|
const parsed = new URL(url);
|
|
// The allowance exists solely to suppress a TLS certificate error, so a
|
|
// non-https origin in the map is meaningless at best.
|
|
if (parsed.protocol !== "https:") return false;
|
|
|
|
const expiresAt = webEndpointCertificateAllowlist.get(parsed.origin);
|
|
if (expiresAt === undefined) return false;
|
|
if (Date.now() >= expiresAt) {
|
|
webEndpointCertificateAllowlist.delete(parsed.origin);
|
|
return false;
|
|
}
|
|
return true;
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
ipcMain.handle("allow-invalid-certificate-for-origin", (_event, origin) => {
|
|
try {
|
|
// Store the PARSED origin, never the caller's string, so a path or a
|
|
// wildcard cannot widen the allowance.
|
|
const parsed = new URL(String(origin));
|
|
if (parsed.protocol !== "https:") {
|
|
return { success: false };
|
|
}
|
|
webEndpointCertificateAllowlist.set(
|
|
parsed.origin,
|
|
Date.now() + WEB_ENDPOINT_CERTIFICATE_ALLOWLIST_TTL_MS,
|
|
);
|
|
return { success: true };
|
|
} catch {
|
|
return { success: false };
|
|
}
|
|
});
|
|
|
|
app.on(
|
|
"certificate-error",
|
|
(event, _webContents, url, error, certificate, callback) => {
|
|
if (
|
|
isolatedWindows.handleCertificateError(event, _webContents, url, callback)
|
|
)
|
|
return;
|
|
if (isWebEndpointCertificateAllowed(url)) {
|
|
event.preventDefault();
|
|
logToFile("Allowed invalid certificate for configured web endpoint", {
|
|
url,
|
|
error,
|
|
issuer: certificate?.issuerName,
|
|
subject: certificate?.subjectName,
|
|
});
|
|
callback(true);
|
|
return;
|
|
}
|
|
|
|
if (isInvalidCertificateAllowedForUrl(url)) {
|
|
event.preventDefault();
|
|
logToFile("Allowed invalid certificate for configured server", {
|
|
url,
|
|
error,
|
|
issuer: certificate?.issuerName,
|
|
subject: certificate?.subjectName,
|
|
});
|
|
callback(true);
|
|
return;
|
|
}
|
|
|
|
callback(false);
|
|
},
|
|
);
|
|
|
|
// A reverse proxy in front of the linked server may ask for basic auth; the
|
|
// link's saved username and password answer it. Anything else gets the
|
|
// default behaviour.
|
|
app.on("login", (event, _webContents, details, authInfo, callback) => {
|
|
const credentials = linkedServer.answerLogin(authInfo, details?.url);
|
|
if (!credentials) return;
|
|
event.preventDefault();
|
|
callback(credentials.username, credentials.password || "");
|
|
});
|
|
|
|
function getElectronBuildTimestamp() {
|
|
try {
|
|
const buildInfo = require("./build-info.cjs");
|
|
if (Number.isInteger(buildInfo.buildTimestamp)) {
|
|
return buildInfo.buildTimestamp;
|
|
}
|
|
} catch {
|
|
// Development runs may not have generated build metadata yet.
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
async function clearElectronClientCacheIfBuildChanged() {
|
|
const buildTimestamp = getElectronBuildTimestamp();
|
|
let cacheTimestamp = 0;
|
|
|
|
try {
|
|
if (fs.existsSync(electronCacheBuildPath)) {
|
|
const data = JSON.parse(fs.readFileSync(electronCacheBuildPath, "utf8"));
|
|
cacheTimestamp = Number.isInteger(data.buildTimestamp)
|
|
? data.buildTimestamp
|
|
: 0;
|
|
}
|
|
} catch (error) {
|
|
logToFile(
|
|
"Failed to read Electron client cache build info:",
|
|
error.message,
|
|
);
|
|
}
|
|
|
|
if (cacheTimestamp === buildTimestamp) {
|
|
return;
|
|
}
|
|
|
|
const clearStep = async (label, action) => {
|
|
try {
|
|
await action();
|
|
} catch (error) {
|
|
logToFile(`Failed to clear Electron ${label}:`, error.message);
|
|
}
|
|
};
|
|
|
|
try {
|
|
const defaultSession = session.defaultSession;
|
|
await clearStep("HTTP cache", () => defaultSession.clearCache());
|
|
await clearStep("code cache", () =>
|
|
defaultSession.clearCodeCaches({ urls: [] }),
|
|
);
|
|
await clearStep("auth cache", () => defaultSession.clearAuthCache());
|
|
await clearStep("storage data", () =>
|
|
defaultSession.clearStorageData({
|
|
storages: [
|
|
"appcache",
|
|
"cookies",
|
|
"filesystem",
|
|
"shadercache",
|
|
"websql",
|
|
"serviceworkers",
|
|
"cachestorage",
|
|
],
|
|
}),
|
|
);
|
|
|
|
fs.writeFileSync(
|
|
electronCacheBuildPath,
|
|
JSON.stringify(
|
|
{
|
|
buildTimestamp,
|
|
appVersion: app.getVersion(),
|
|
updatedAt: new Date().toISOString(),
|
|
},
|
|
null,
|
|
2,
|
|
),
|
|
);
|
|
|
|
logToFile("Electron client cache cleared for build change", {
|
|
from: cacheTimestamp,
|
|
to: buildTimestamp,
|
|
appVersion: app.getVersion(),
|
|
});
|
|
} catch (error) {
|
|
logToFile("Failed to clear Electron client cache:", error.message);
|
|
}
|
|
}
|
|
|
|
function getCookieRemovalUrl(cookie) {
|
|
const scheme = cookie.secure ? "https" : "http";
|
|
const domain = cookie.domain?.startsWith(".")
|
|
? cookie.domain.slice(1)
|
|
: cookie.domain || "localhost";
|
|
return `${scheme}://${domain}${cookie.path || "/"}`;
|
|
}
|
|
|
|
async function clearElectronJwtCookiesAtStartup() {
|
|
loadElectronAuthCookiesFromDisk();
|
|
|
|
const targetSessions = new Set([
|
|
session.defaultSession,
|
|
session.fromPartition(termixSessionPartition),
|
|
]);
|
|
|
|
for (const targetSession of targetSessions) {
|
|
try {
|
|
const cookies = await targetSession.cookies.get({ name: "jwt" });
|
|
await Promise.all(
|
|
cookies.map((cookie) =>
|
|
targetSession.cookies.remove(
|
|
getCookieRemovalUrl(cookie),
|
|
cookie.name,
|
|
),
|
|
),
|
|
);
|
|
|
|
if (cookies.length > 0) {
|
|
logToFile("Cleared Electron JWT cookies from cookie store", {
|
|
count: cookies.length,
|
|
});
|
|
}
|
|
} catch (error) {
|
|
logToFile("Failed to clear Electron JWT cookies:", error.message);
|
|
}
|
|
}
|
|
}
|
|
|
|
function getBackendPaths() {
|
|
if (isDev) {
|
|
const backendDir = path.join(appRoot, "dist", "backend", "backend");
|
|
return {
|
|
entryPath: path.join(backendDir, "starter.js"),
|
|
backendCwd: backendDir,
|
|
};
|
|
}
|
|
// fork() does not go through Electron's asar redirector, use the unpacked path.
|
|
// On macOS multi-arch builds (mergeASARs: false), electron-builder names the ASAR
|
|
// app-arm64.asar / app-x64.asar instead of app.asar, so match all variants.
|
|
const unpackedRoot = getUnpackedAppRoot(appRoot);
|
|
const backendDir = path.join(unpackedRoot, "dist", "backend", "backend");
|
|
return {
|
|
entryPath: path.join(backendDir, "starter.js"),
|
|
backendCwd: backendDir,
|
|
};
|
|
}
|
|
|
|
function getBackendDataDir() {
|
|
const userDataPath = app.getPath("userData");
|
|
const dataDir = path.join(userDataPath, "server-data");
|
|
if (!fs.existsSync(dataDir)) {
|
|
fs.mkdirSync(dataDir, { recursive: true });
|
|
}
|
|
return dataDir;
|
|
}
|
|
|
|
function getBackendPidFilePath() {
|
|
return path.join(app.getPath("userData"), "backend.pid");
|
|
}
|
|
|
|
// If the app was previously killed abnormally (crash, force-quit, Task
|
|
// Manager) rather than through the normal quit flow, will-quit never fires
|
|
// and stopBackendServer() never runs -- the forked backend child is a
|
|
// genuinely separate OS process on Windows/mac/Linux, so it keeps running
|
|
// and holding the port the backend binds (30001). Every subsequent
|
|
// launch's own backend then fails outright
|
|
// with EADDRINUSE and the app is stuck until something manually kills the
|
|
// orphan. Reap any such leftover process, identified by PID file, before
|
|
// spawning a new one.
|
|
function reapOrphanedBackendProcess() {
|
|
const pidFilePath = getBackendPidFilePath();
|
|
let recordedPid;
|
|
try {
|
|
recordedPid = parseInt(fs.readFileSync(pidFilePath, "utf8").trim(), 10);
|
|
} catch {
|
|
return;
|
|
}
|
|
if (!Number.isInteger(recordedPid) || recordedPid <= 0) return;
|
|
|
|
try {
|
|
// Signal 0 does not kill the process -- it only checks whether a
|
|
// process with this PID exists and is signalable, throwing ESRCH if
|
|
// not. This avoids killing an unrelated process that happens to have
|
|
// reused the same PID since the last run.
|
|
process.kill(recordedPid, 0);
|
|
} catch {
|
|
// No live process at that PID; nothing to reap.
|
|
try {
|
|
fs.unlinkSync(pidFilePath);
|
|
} catch {
|
|
// already absent
|
|
}
|
|
return;
|
|
}
|
|
|
|
logToFile(
|
|
`Found orphaned backend process from a previous session (pid ${recordedPid}), terminating it before starting a new one`,
|
|
);
|
|
try {
|
|
process.kill(recordedPid, "SIGKILL");
|
|
} catch {
|
|
// already gone
|
|
}
|
|
try {
|
|
fs.unlinkSync(pidFilePath);
|
|
} catch {
|
|
// already absent
|
|
}
|
|
}
|
|
|
|
const DEFAULT_BACKEND_PORT = 30001;
|
|
let backendPort = DEFAULT_BACKEND_PORT;
|
|
|
|
function canListenOn(port) {
|
|
return new Promise((resolve) => {
|
|
const probe = net.createServer();
|
|
probe.once("error", () => resolve(null));
|
|
probe.listen(port, "127.0.0.1", () => {
|
|
const { port: bound } = probe.address();
|
|
probe.close(() => resolve(bound));
|
|
});
|
|
});
|
|
}
|
|
|
|
// 30001 when it is free, otherwise any free port. Only the desktop app talks
|
|
// to this backend, so the number itself does not matter.
|
|
async function findBackendPort() {
|
|
const preferred = await canListenOn(DEFAULT_BACKEND_PORT);
|
|
if (preferred) return preferred;
|
|
const fallback = await canListenOn(0);
|
|
if (fallback) {
|
|
logToFile(
|
|
`Port ${DEFAULT_BACKEND_PORT} is in use, starting the backend on ${fallback}`,
|
|
);
|
|
return fallback;
|
|
}
|
|
return DEFAULT_BACKEND_PORT;
|
|
}
|
|
|
|
function startBackendServer() {
|
|
reapOrphanedBackendProcess();
|
|
backendFailure = null;
|
|
backendStopRequested = false;
|
|
backendStderrTail = "";
|
|
return new Promise((resolve) => {
|
|
const { entryPath, backendCwd } = getBackendPaths();
|
|
|
|
logToFile("isDev:", isDev, "appRoot:", appRoot);
|
|
logToFile("app.isPackaged:", app.isPackaged);
|
|
logToFile("process.env.NODE_ENV:", process.env.NODE_ENV);
|
|
|
|
if (!fs.existsSync(entryPath)) {
|
|
logToFile("Backend entry not found:", entryPath);
|
|
backendFailure = { reason: "crashed", port: null };
|
|
resolve(false);
|
|
return;
|
|
}
|
|
|
|
const dataDir = getBackendDataDir();
|
|
logToFile("Starting embedded backend server...");
|
|
logToFile("Backend entry:", entryPath);
|
|
logToFile("Data directory:", dataDir);
|
|
logToFile("Backend cwd:", backendCwd);
|
|
|
|
logToFile("Checking paths...");
|
|
logToFile(" entryPath exists:", fs.existsSync(entryPath));
|
|
logToFile(" dataDir exists:", fs.existsSync(dataDir));
|
|
logToFile(" backendCwd exists:", fs.existsSync(backendCwd));
|
|
|
|
backendProcess = fork(entryPath, [], {
|
|
cwd:
|
|
fs.existsSync(backendCwd) && fs.statSync(backendCwd).isDirectory()
|
|
? backendCwd
|
|
: dataDir,
|
|
env: {
|
|
...process.env,
|
|
DATA_DIR: dataDir,
|
|
NODE_ENV: "production",
|
|
ELECTRON_EMBEDDED: "true",
|
|
PORT: String(backendPort),
|
|
EMBEDDED_BACKEND_PORT: String(backendPort),
|
|
VERSION: app.getVersion(),
|
|
},
|
|
stdio: ["pipe", "pipe", "pipe", "ipc"],
|
|
});
|
|
|
|
logToFile("Backend process spawned, pid:", backendProcess.pid);
|
|
try {
|
|
fs.writeFileSync(getBackendPidFilePath(), String(backendProcess.pid));
|
|
} catch {
|
|
// Non-fatal: only means a future crash won't self-heal via reap.
|
|
}
|
|
|
|
let resolved = false;
|
|
const readyTimeout = setTimeout(() => {
|
|
if (!resolved) {
|
|
resolved = true;
|
|
logToFile("Backend ready timeout (15s), proceeding anyway...");
|
|
resolve(true);
|
|
}
|
|
}, 15000);
|
|
|
|
backendProcess.stdout.on("data", (data) => {
|
|
const msg = data.toString().trim();
|
|
logToFile("[backend]", msg);
|
|
if (!resolved && msg.includes("started successfully")) {
|
|
resolved = true;
|
|
clearTimeout(readyTimeout);
|
|
logToFile("Backend ready signal received");
|
|
resolve(true);
|
|
}
|
|
});
|
|
|
|
// The reason for a failed start is only ever visible in what the child
|
|
// wrote to stderr before dying, so keep a bounded tail of it. Bounded
|
|
// because a backend that stays up for days can otherwise log without
|
|
// limit into a buffer nothing ever drains.
|
|
backendProcess.stderr.on("data", (data) => {
|
|
const chunk = data.toString();
|
|
backendStderrTail = (backendStderrTail + chunk).slice(
|
|
-BACKEND_STDERR_TAIL_LIMIT,
|
|
);
|
|
logToFile("[backend:stderr]", chunk.trim());
|
|
});
|
|
|
|
backendProcess.on("message", (msg) => {
|
|
if (!resolved && msg?.type === "backend-ready") {
|
|
resolved = true;
|
|
clearTimeout(readyTimeout);
|
|
logToFile("Backend ready signal received via IPC");
|
|
resolve(true);
|
|
}
|
|
void handleBackendRequest(msg);
|
|
});
|
|
|
|
backendProcess.on("exit", (code, signal) => {
|
|
logToFile(`Backend process exited with code ${code}, signal ${signal}`);
|
|
if (!resolved && code !== 0) {
|
|
backendStartFailed = true;
|
|
}
|
|
// Classified whether or not the ready promise already settled: the
|
|
// 15s ready timeout resolves optimistically, so a backend that dies
|
|
// at second 20 still has to be reported rather than silently dropped.
|
|
// backendStopRequested is the only evidence that an exit was asked
|
|
// for, so it is the sole guard here -- past it, every exit means the
|
|
// backend is gone and the renderer must stop waiting for it.
|
|
if (!backendStopRequested) {
|
|
backendFailure = classifyBackendFailure(backendStderrTail);
|
|
logToFile("Backend failure classified as:", backendFailure.reason);
|
|
}
|
|
backendProcess = null;
|
|
clearBackendPidFile();
|
|
if (!resolved) {
|
|
resolved = true;
|
|
clearTimeout(readyTimeout);
|
|
resolve(false);
|
|
}
|
|
});
|
|
|
|
backendProcess.on("error", (err) => {
|
|
logToFile("Failed to start backend process:", err.message);
|
|
backendFailure = { reason: "crashed", port: null };
|
|
backendProcess = null;
|
|
if (!resolved) {
|
|
resolved = true;
|
|
clearTimeout(readyTimeout);
|
|
resolve(false);
|
|
}
|
|
});
|
|
});
|
|
}
|
|
|
|
function clearBackendPidFile() {
|
|
try {
|
|
fs.unlinkSync(getBackendPidFilePath());
|
|
} catch {
|
|
// already absent
|
|
}
|
|
}
|
|
|
|
function stopBackendServer() {
|
|
if (!backendProcess) return;
|
|
|
|
console.log("Stopping embedded backend server...");
|
|
backendStopRequested = true;
|
|
|
|
try {
|
|
backendProcess.send({ type: "shutdown" });
|
|
} catch {
|
|
// IPC channel may already be closed
|
|
}
|
|
|
|
const forceKillTimeout = setTimeout(() => {
|
|
if (backendProcess) {
|
|
console.log("Force killing backend process...");
|
|
backendProcess.kill("SIGKILL");
|
|
backendProcess = null;
|
|
}
|
|
}, 5000);
|
|
|
|
backendProcess.on("exit", () => {
|
|
clearTimeout(forceKillTimeout);
|
|
backendProcess = null;
|
|
clearBackendPidFile();
|
|
});
|
|
}
|
|
|
|
// App Sandbox denies the singleton socket bind, which reads as a held lock and
|
|
// quits the app on every launch. macOS reactivates bundled apps anyway.
|
|
const gotTheLock = process.mas || app.requestSingleInstanceLock();
|
|
if (!gotTheLock) {
|
|
console.log("Another instance is already running, quitting...");
|
|
app.quit();
|
|
process.exit(0);
|
|
} else {
|
|
app.on("second-instance", (event, commandLine, workingDirectory) => {
|
|
if (mainWindow) {
|
|
if (mainWindow.isMinimized()) mainWindow.restore();
|
|
mainWindow.focus();
|
|
mainWindow.show();
|
|
}
|
|
});
|
|
}
|
|
|
|
function createTray() {
|
|
try {
|
|
const { nativeImage } = require("electron");
|
|
|
|
// Native APIs (Tray, nativeImage) can't load files from inside app.asar,
|
|
// use the unpacked path so the OS sees a real file.
|
|
const publicRoot = isDev
|
|
? path.join(appRoot, "public")
|
|
: path.join(
|
|
appRoot.replace(
|
|
/app(-[a-z0-9]+)?\.asar(?!\.unpacked)/,
|
|
"app.asar.unpacked",
|
|
),
|
|
"public",
|
|
);
|
|
|
|
let trayIcon;
|
|
if (process.platform === "darwin") {
|
|
const iconPath = path.join(publicRoot, "icons", "16x16.png");
|
|
trayIcon = nativeImage.createFromPath(iconPath);
|
|
trayIcon.setTemplateImage(true);
|
|
} else if (process.platform === "win32") {
|
|
trayIcon = path.join(publicRoot, "icon.ico");
|
|
} else {
|
|
trayIcon = loadLinuxTrayIcon(nativeImage, publicRoot);
|
|
if (!trayIcon) {
|
|
logToFile("Tray icon not found, skipping the system tray");
|
|
return;
|
|
}
|
|
if (/gnome/i.test(process.env.XDG_CURRENT_DESKTOP || "")) {
|
|
logToFile(
|
|
"GNOME shows tray icons only with the AppIndicator extension installed",
|
|
);
|
|
}
|
|
}
|
|
|
|
tray = new Tray(trayIcon);
|
|
tray.setToolTip("Termix");
|
|
|
|
const contextMenu = Menu.buildFromTemplate([
|
|
{
|
|
label: "Show Window",
|
|
click: () => {
|
|
if (mainWindow) {
|
|
mainWindow.show();
|
|
mainWindow.focus();
|
|
}
|
|
},
|
|
},
|
|
{
|
|
label: "Quit",
|
|
click: () => {
|
|
isQuitting = true;
|
|
quitApp(app, mainWindow);
|
|
},
|
|
},
|
|
]);
|
|
|
|
tray.setContextMenu(contextMenu);
|
|
|
|
tray.on("click", () => {
|
|
if (mainWindow) {
|
|
if (mainWindow.isVisible()) {
|
|
mainWindow.hide();
|
|
} else {
|
|
mainWindow.show();
|
|
mainWindow.focus();
|
|
}
|
|
}
|
|
});
|
|
|
|
logToFile("System tray created");
|
|
} catch (err) {
|
|
tray = null;
|
|
logToFile("Failed to create system tray:", err?.message || String(err));
|
|
}
|
|
}
|
|
|
|
function loadLinuxTrayIcon(nativeImage, publicRoot) {
|
|
const roots = [
|
|
publicRoot,
|
|
path.join(process.resourcesPath || "", "app.asar.unpacked", "public"),
|
|
];
|
|
for (const root of roots) {
|
|
for (const size of ["32x32", "24x24", "48x48"]) {
|
|
const image = nativeImage.createFromPath(
|
|
path.join(root, "icons", `${size}.png`),
|
|
);
|
|
if (!image.isEmpty()) return image;
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function createWindow() {
|
|
const appVersion = app.getVersion();
|
|
const electronVersion = process.versions.electron;
|
|
const platform =
|
|
process.platform === "win32"
|
|
? "Windows"
|
|
: process.platform === "darwin"
|
|
? "macOS"
|
|
: "Linux";
|
|
|
|
mainWindow = new BrowserWindow({
|
|
width: 1200,
|
|
height: 800,
|
|
minWidth: 800,
|
|
minHeight: 600,
|
|
title: "Termix",
|
|
icon: path.join(
|
|
appRoot,
|
|
"public",
|
|
process.platform === "win32" ? "icon.ico" : "icon.png",
|
|
),
|
|
webPreferences: {
|
|
nodeIntegration: false,
|
|
contextIsolation: true,
|
|
sandbox: true,
|
|
webSecurity: true,
|
|
preload: path.join(__dirname, "preload.js"),
|
|
additionalArguments: [`--termix-backend-port=${backendPort}`],
|
|
partition: termixSessionPartition,
|
|
allowRunningInsecureContent: false,
|
|
webviewTag: false,
|
|
offscreen: false,
|
|
},
|
|
show: true,
|
|
});
|
|
|
|
mainWindow.webContents.session.setPermissionRequestHandler(
|
|
(webContents, permission, callback) => {
|
|
if (
|
|
permission === "clipboard-read" ||
|
|
permission === "clipboard-write" ||
|
|
permission === "clipboard-sanitized-write"
|
|
) {
|
|
callback(true);
|
|
return;
|
|
}
|
|
callback(false);
|
|
},
|
|
);
|
|
|
|
if (process.platform !== "darwin") {
|
|
mainWindow.setMenuBarVisibility(false);
|
|
}
|
|
|
|
const customUserAgent = `Termix-Desktop/${appVersion} (${platform}; Electron/${electronVersion})`;
|
|
mainWindow.webContents.setUserAgent(customUserAgent);
|
|
|
|
mainWindow.webContents.on("before-input-event", (event, input) => {
|
|
if (process.platform !== "win32" || !isCloseActiveTabInput(input)) return;
|
|
|
|
event.preventDefault();
|
|
mainWindow.webContents.send("close-active-tab");
|
|
});
|
|
|
|
mainWindow.webContents.session.webRequest.onBeforeSendHeaders(
|
|
(details, callback) => {
|
|
details.requestHeaders["X-Electron-App"] = "true";
|
|
|
|
details.requestHeaders["User-Agent"] = customUserAgent;
|
|
|
|
// YouTube refuses embeds without a Referer, which file:// never sends.
|
|
if (
|
|
details.url.startsWith("https://www.youtube-nocookie.com/embed/") &&
|
|
!details.requestHeaders.Referer
|
|
) {
|
|
details.requestHeaders.Referer = "https://termix.site/";
|
|
}
|
|
|
|
const rememberedJwt = getRememberedElectronAuthCookie("jwt", details.url);
|
|
if (rememberedJwt) {
|
|
setCookieHeaderValue(
|
|
details.requestHeaders,
|
|
rememberedJwt.name,
|
|
rememberedJwt.value,
|
|
);
|
|
}
|
|
|
|
callback({
|
|
requestHeaders: linkedServer.applyLinkHeaders(
|
|
details.url,
|
|
details.requestHeaders,
|
|
),
|
|
});
|
|
},
|
|
);
|
|
|
|
if (isDev) {
|
|
mainWindow.loadURL("http://localhost:5173");
|
|
mainWindow.webContents.openDevTools();
|
|
} else {
|
|
const indexPath = path.join(appRoot, "dist", "index.html");
|
|
mainWindow.loadFile(indexPath).catch((err) => {
|
|
console.error("Failed to load file:", err);
|
|
});
|
|
}
|
|
|
|
mainWindow.webContents.session.webRequest.onHeadersReceived(
|
|
(details, callback) => {
|
|
const headers = details.responseHeaders;
|
|
|
|
if (headers) {
|
|
delete headers["x-frame-options"];
|
|
delete headers["X-Frame-Options"];
|
|
|
|
if (headers["content-security-policy"]) {
|
|
headers["content-security-policy"] = headers[
|
|
"content-security-policy"
|
|
]
|
|
.map((value) => value.replace(/frame-ancestors[^;]*/gi, ""))
|
|
.filter((value) => value.trim().length > 0);
|
|
|
|
if (headers["content-security-policy"].length === 0) {
|
|
delete headers["content-security-policy"];
|
|
}
|
|
}
|
|
if (headers["Content-Security-Policy"]) {
|
|
headers["Content-Security-Policy"] = headers[
|
|
"Content-Security-Policy"
|
|
]
|
|
.map((value) => value.replace(/frame-ancestors[^;]*/gi, ""))
|
|
.filter((value) => value.trim().length > 0);
|
|
|
|
if (headers["Content-Security-Policy"].length === 0) {
|
|
delete headers["Content-Security-Policy"];
|
|
}
|
|
}
|
|
|
|
const setCookieHeaderName = getHeaderName(headers, "Set-Cookie");
|
|
if (setCookieHeaderName) {
|
|
const setCookieHeaders = Array.isArray(headers[setCookieHeaderName])
|
|
? headers[setCookieHeaderName]
|
|
: [headers[setCookieHeaderName]];
|
|
|
|
setCookieHeaders.forEach((cookie) => {
|
|
rememberElectronAuthCookieFromHeader(details.url, cookie);
|
|
});
|
|
|
|
headers[setCookieHeaderName] = setCookieHeaders.map((cookie) => {
|
|
let modified = cookie.replace(
|
|
/;\s*SameSite=Strict/gi,
|
|
"; SameSite=None",
|
|
);
|
|
modified = modified.replace(
|
|
/;\s*SameSite=Lax/gi,
|
|
"; SameSite=None",
|
|
);
|
|
if (!modified.includes("SameSite=")) {
|
|
modified += "; SameSite=None";
|
|
}
|
|
if (
|
|
!modified.includes("Secure") &&
|
|
details.url.startsWith("https")
|
|
) {
|
|
modified += "; Secure";
|
|
}
|
|
return modified;
|
|
});
|
|
}
|
|
}
|
|
|
|
callback({ responseHeaders: headers });
|
|
},
|
|
);
|
|
|
|
mainWindow.once("ready-to-show", () => {
|
|
mainWindow.show();
|
|
mainWindow.focus();
|
|
});
|
|
|
|
setTimeout(() => {
|
|
if (mainWindow && !mainWindow.isVisible()) {
|
|
mainWindow.show();
|
|
}
|
|
}, 3000);
|
|
|
|
mainWindow.webContents.on(
|
|
"did-fail-load",
|
|
(event, errorCode, errorDescription, validatedURL) => {
|
|
console.error(
|
|
"Failed to load:",
|
|
errorCode,
|
|
errorDescription,
|
|
validatedURL,
|
|
);
|
|
},
|
|
);
|
|
|
|
mainWindow.webContents.on("did-finish-load", () => {
|
|
console.log("Frontend loaded successfully");
|
|
});
|
|
|
|
mainWindow.webContents.on("will-prevent-unload", (event) => {
|
|
// Explicit Quit must not be vetoed by the renderer's connection guard.
|
|
// In this Electron event, preventDefault allows the unload to proceed.
|
|
if (isQuitting) event.preventDefault();
|
|
});
|
|
|
|
mainWindow.on("close", (event) => {
|
|
if (!isQuitting && tray && !tray.isDestroyed()) {
|
|
event.preventDefault();
|
|
// Stock GNOME has no tray to bring a hidden window back from.
|
|
if (
|
|
process.platform === "linux" &&
|
|
/gnome/i.test(process.env.XDG_CURRENT_DESKTOP || "")
|
|
) {
|
|
mainWindow.minimize();
|
|
} else {
|
|
mainWindow.hide();
|
|
}
|
|
}
|
|
});
|
|
|
|
mainWindow.on("closed", () => {
|
|
mainWindow = null;
|
|
});
|
|
|
|
mainWindow.webContents.setWindowOpenHandler(({ url }) => {
|
|
try {
|
|
const parsed = new URL(url);
|
|
if (parsed.protocol === "http:" || parsed.protocol === "https:") {
|
|
shell.openExternal(url);
|
|
}
|
|
} catch {
|
|
// invalid URL, ignore
|
|
}
|
|
return { action: "deny" };
|
|
});
|
|
|
|
mainWindow.webContents.on("will-navigate", (event, url) => {
|
|
const allowedUrl = isDev
|
|
? url.startsWith("http://localhost:5173/")
|
|
: url === pathToFileURL(path.join(appRoot, "dist", "index.html")).href;
|
|
if (!allowedUrl) event.preventDefault();
|
|
});
|
|
}
|
|
|
|
ipcMain.handle("get-app-version", () => {
|
|
return app.getVersion();
|
|
});
|
|
|
|
ipcMain.handle("get-platform", () => {
|
|
return process.platform;
|
|
});
|
|
|
|
ipcMain.handle("get-embedded-server-status", () => {
|
|
return {
|
|
running:
|
|
backendProcess !== null && !backendProcess.killed && !backendStartFailed,
|
|
// A backend that is merely slow to boot reports no failure, so the
|
|
// renderer keeps waiting for it. Only a classified failure means the
|
|
// process is gone for good and waiting is pointless.
|
|
failure: backendFailure,
|
|
dataDir: isDev ? null : getBackendDataDir(),
|
|
};
|
|
});
|
|
|
|
// External login through the system browser (RFC 8252)
|
|
ipcMain.handle(
|
|
"external-browser-login",
|
|
async (_event, authUrl, callbackPort) => {
|
|
if (!isExternalLoginUrl(authUrl)) {
|
|
return { success: false, error: "Invalid authentication URL" };
|
|
}
|
|
if (!isCallbackPort(callbackPort)) {
|
|
return { success: false, error: "Invalid callback port" };
|
|
}
|
|
const http = require("http");
|
|
|
|
return new Promise((resolve) => {
|
|
let timeout;
|
|
let settled = false;
|
|
const server = http.createServer((req, res) => {
|
|
const url = new URL(req.url || "/", `http://localhost:${callbackPort}`);
|
|
if (url.pathname === "/oidc-callback") {
|
|
const success = url.searchParams.get("success");
|
|
const error = url.searchParams.get("error");
|
|
const token = url.searchParams.get("token");
|
|
const secondFactor = url.searchParams.get("second_factor") === "1";
|
|
|
|
res.writeHead(200, { "Content-Type": "text/html" });
|
|
res.end(
|
|
`<html><body><h2>${success === "true" || secondFactor ? "Authentication successful!" : "Authentication failed."}</h2><p>You can close this tab and return to Termix.</p><script>window.close()</script></body></html>`,
|
|
);
|
|
|
|
if (secondFactor) {
|
|
finish({
|
|
success: false,
|
|
secondFactor: true,
|
|
tempToken: url.searchParams.get("temp_token"),
|
|
factors: url.searchParams.get("second_factors"),
|
|
});
|
|
} else if (success === "true") {
|
|
finish({ success: true, token });
|
|
} else {
|
|
finish({
|
|
success: false,
|
|
error: error || "Authentication failed",
|
|
});
|
|
}
|
|
return;
|
|
}
|
|
|
|
res.writeHead(404, { "Content-Type": "text/plain" });
|
|
res.end("Not found");
|
|
});
|
|
|
|
const finish = (result) => {
|
|
if (settled) return;
|
|
settled = true;
|
|
if (timeout) clearTimeout(timeout);
|
|
try {
|
|
server.close();
|
|
} catch {
|
|
// Server may not have started yet.
|
|
}
|
|
resolve(result);
|
|
};
|
|
|
|
const fail = (error) => {
|
|
finish({
|
|
success: false,
|
|
error: error instanceof Error ? error.message : String(error),
|
|
});
|
|
};
|
|
|
|
server.once("error", fail);
|
|
|
|
server.listen(callbackPort, "localhost", async () => {
|
|
try {
|
|
await shell.openExternal(authUrl);
|
|
} catch (error) {
|
|
fail(error);
|
|
}
|
|
});
|
|
|
|
// Timeout after 5 minutes
|
|
timeout = setTimeout(
|
|
() => {
|
|
fail(new Error("External login timed out"));
|
|
},
|
|
5 * 60 * 1000,
|
|
);
|
|
});
|
|
},
|
|
);
|
|
|
|
// Desktop-only settings, such as whether hosts connect from this device or
|
|
// through the linked server by default.
|
|
ipcMain.handle("get-desktop-settings", () => {
|
|
return desktopSettings.getDesktopSettings();
|
|
});
|
|
|
|
ipcMain.handle("save-desktop-settings", (_event, settings) => {
|
|
return desktopSettings.saveDesktopSettings(settings);
|
|
});
|
|
|
|
let appUpdater = null;
|
|
|
|
function startAppUpdater() {
|
|
const kind = autoUpdates.getInstallKind({
|
|
platform: process.platform,
|
|
arch: process.arch,
|
|
isPackaged: app.isPackaged,
|
|
mas: !!process.mas,
|
|
env: process.env,
|
|
execPath: process.execPath,
|
|
resourcesPath: process.resourcesPath,
|
|
exists: (target) => fs.existsSync(target),
|
|
readFile: (target) => fs.readFileSync(target, "utf8"),
|
|
});
|
|
logToFile("Updater install kind:", kind);
|
|
appUpdater = autoUpdates.createUpdater({
|
|
currentVersion: app.getVersion(),
|
|
platform: process.platform,
|
|
arch: process.arch,
|
|
kind,
|
|
getMode: () => desktopSettings.getDesktopSettings().updateMode,
|
|
saveMode: (mode) =>
|
|
desktopSettings.saveDesktopSettings({ updateMode: mode }),
|
|
fetchReleases: async () => {
|
|
const { net } = require("electron");
|
|
const response = await net.fetch(autoUpdates.RELEASES_API, {
|
|
headers: { Accept: "application/vnd.github+json" },
|
|
});
|
|
if (!response.ok) {
|
|
throw new Error(`GitHub releases returned ${response.status}`);
|
|
}
|
|
return response.json();
|
|
},
|
|
loadAutoUpdater: () => require("electron-updater").autoUpdater,
|
|
send: (state) => {
|
|
if (mainWindow && !mainWindow.isDestroyed()) {
|
|
mainWindow.webContents.send("desktop-update-state", state);
|
|
}
|
|
},
|
|
log: logToFile,
|
|
beforeInstall: () => {
|
|
isQuitting = true;
|
|
},
|
|
});
|
|
appUpdater.start();
|
|
}
|
|
|
|
ipcMain.handle(
|
|
"desktop-update-get-state",
|
|
() => appUpdater?.getState() ?? null,
|
|
);
|
|
ipcMain.handle("desktop-update-check", () => appUpdater?.check() ?? null);
|
|
ipcMain.handle("desktop-update-download", () => appUpdater?.download() ?? null);
|
|
ipcMain.handle("desktop-update-install", () => appUpdater?.install() ?? false);
|
|
ipcMain.handle(
|
|
"desktop-update-set-mode",
|
|
(_event, mode) => appUpdater?.setMode(mode) ?? null,
|
|
);
|
|
|
|
// The server an older version of the app was pointed at, offered again when
|
|
// linking so upgraded installs do not have to look it up.
|
|
ipcMain.handle("get-previous-server-url", () => {
|
|
return { serverUrl: desktopSettings.getPreviousServerUrl() };
|
|
});
|
|
|
|
function getC2STunnelConfigPath() {
|
|
return path.join(app.getPath("userData"), "c2s-tunnels.json");
|
|
}
|
|
|
|
ipcMain.handle("get-c2s-tunnel-config", () => {
|
|
try {
|
|
const configPath = getC2STunnelConfigPath();
|
|
if (!fs.existsSync(configPath)) {
|
|
return [];
|
|
}
|
|
const configData = fs.readFileSync(configPath, "utf8");
|
|
const parsed = JSON.parse(configData);
|
|
return Array.isArray(parsed) ? parsed : [];
|
|
} catch (error) {
|
|
console.error("Error reading C2S tunnel config:", error);
|
|
return [];
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("save-c2s-tunnel-config", async (_event, config) => {
|
|
try {
|
|
if (!Array.isArray(config)) {
|
|
return { success: false, error: "C2S tunnel config must be an array" };
|
|
}
|
|
const autoStartListeners = new Set();
|
|
const autoStartRemoteListeners = new Set();
|
|
for (const tunnel of config) {
|
|
if (!tunnel?.autoStart) continue;
|
|
const mode = tunnel.mode || tunnel.tunnelType || "local";
|
|
if (mode === "remote") {
|
|
const sourceHostId = Number(tunnel.sourceHostId);
|
|
const sourcePort = Number(tunnel.sourcePort);
|
|
const remoteAddress = getC2SRemoteAddress(tunnel);
|
|
if (
|
|
!Number.isInteger(sourceHostId) ||
|
|
sourceHostId < 1 ||
|
|
!Number.isInteger(sourcePort) ||
|
|
sourcePort < 1 ||
|
|
sourcePort > 65535
|
|
) {
|
|
return {
|
|
success: false,
|
|
error: "Invalid remote client tunnel endpoint or port",
|
|
};
|
|
}
|
|
const listenerKey = `${sourceHostId}:${remoteAddress}:${sourcePort}`;
|
|
if (autoStartRemoteListeners.has(listenerKey)) {
|
|
return {
|
|
success: false,
|
|
error: `Another auto-start client tunnel already uses remote ${listenerKey}`,
|
|
};
|
|
}
|
|
autoStartRemoteListeners.add(listenerKey);
|
|
continue;
|
|
}
|
|
|
|
const bindHost = getC2SLocalAddress(tunnel);
|
|
const sourcePort = Number(tunnel.sourcePort);
|
|
const listenerKey = `${bindHost}:${sourcePort}`;
|
|
if (autoStartListeners.has(listenerKey)) {
|
|
return {
|
|
success: false,
|
|
error: `Another auto-start client tunnel already uses ${listenerKey}`,
|
|
};
|
|
}
|
|
autoStartListeners.add(listenerKey);
|
|
}
|
|
for (const listenerKey of autoStartListeners) {
|
|
const sourcePortSeparator = listenerKey.lastIndexOf(":");
|
|
const bindHost = listenerKey.slice(0, sourcePortSeparator);
|
|
const sourcePort = listenerKey.slice(sourcePortSeparator + 1);
|
|
const result = await checkLocalPortAvailable(
|
|
bindHost,
|
|
Number(sourcePort),
|
|
);
|
|
const ownedByClientTunnel = Array.from(c2sTunnelRuntimes.values()).some(
|
|
(runtime) =>
|
|
runtime.bindHost === bindHost &&
|
|
runtime.sourcePort === Number(sourcePort),
|
|
);
|
|
if (!result.available && !ownedByClientTunnel) {
|
|
return {
|
|
success: false,
|
|
error: `Cannot auto-start client tunnel on ${listenerKey}: ${result.error || "port is already in use"}`,
|
|
};
|
|
}
|
|
}
|
|
const userDataPath = app.getPath("userData");
|
|
if (!fs.existsSync(userDataPath)) {
|
|
fs.mkdirSync(userDataPath, { recursive: true });
|
|
}
|
|
fs.writeFileSync(getC2STunnelConfigPath(), JSON.stringify(config, null, 2));
|
|
return { success: true };
|
|
} catch (error) {
|
|
console.error("Error saving C2S tunnel config:", error);
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
function checkLocalPortAvailable(host, port) {
|
|
return new Promise((resolve) => {
|
|
const server = net.createServer();
|
|
server.once("error", (error) => {
|
|
resolve({ available: false, error: error.message });
|
|
});
|
|
server.once("listening", () => {
|
|
server.close(() => resolve({ available: true }));
|
|
});
|
|
server.listen({ host, port });
|
|
});
|
|
}
|
|
|
|
function checkTcpConnection(host, port) {
|
|
return new Promise((resolve) => {
|
|
const socket = net.createConnection({ host, port });
|
|
const timer = setTimeout(() => {
|
|
socket.destroy();
|
|
resolve({ success: false, error: "Connection timed out" });
|
|
}, 5000);
|
|
|
|
socket.once("connect", () => {
|
|
clearTimeout(timer);
|
|
socket.destroy();
|
|
resolve({ success: true });
|
|
});
|
|
socket.once("error", (error) => {
|
|
clearTimeout(timer);
|
|
socket.destroy();
|
|
resolve({ success: false, error: error.message });
|
|
});
|
|
});
|
|
}
|
|
|
|
function getC2SAddress(value, fallback) {
|
|
const address = typeof value === "string" ? value.trim() : "";
|
|
return address || fallback;
|
|
}
|
|
|
|
function getC2SLocalAddress(tunnel) {
|
|
return getC2SAddress(tunnel?.localAddress || tunnel?.bindHost, "127.0.0.1");
|
|
}
|
|
|
|
function getC2SRemoteAddress(tunnel) {
|
|
return getC2SAddress(
|
|
tunnel?.remoteAddress || tunnel?.targetHost,
|
|
"127.0.0.1",
|
|
);
|
|
}
|
|
|
|
function normalizeC2STunnelAddresses(tunnel) {
|
|
const localAddress = getC2SLocalAddress(tunnel);
|
|
const remoteAddress = getC2SRemoteAddress(tunnel);
|
|
return {
|
|
...tunnel,
|
|
localAddress,
|
|
remoteAddress,
|
|
bindHost: localAddress,
|
|
targetHost: remoteAddress,
|
|
};
|
|
}
|
|
|
|
const c2sTunnelRuntimes = new Map();
|
|
const C2S_WS_HIGH_WATERMARK = 1024 * 1024;
|
|
const C2S_WS_LOW_WATERMARK = 256 * 1024;
|
|
const C2S_STREAM_WRITE_LIMIT = 8 * 1024 * 1024;
|
|
|
|
// A proxy in front of the server may drop an idle WebSocket, which stopped
|
|
// the tunnel. Pings count as traffic.
|
|
function keepC2SSocketAlive(ws) {
|
|
const timer = setInterval(() => {
|
|
if (ws.readyState === WebSocket.OPEN) ws.ping();
|
|
}, 25_000);
|
|
timer.unref?.();
|
|
ws.once("close", () => clearInterval(timer));
|
|
}
|
|
|
|
// C2S (client-to-server) tunnels relay through the server this desktop is
|
|
// linked to, not the embedded backend.
|
|
function getC2SRemoteBaseUrl() {
|
|
const serverUrl = linkedServer.getLinkedServer()?.serverUrl;
|
|
if (!serverUrl) {
|
|
throw new Error(
|
|
"This device is not linked to a Termix server. Link it in Sync first.",
|
|
);
|
|
}
|
|
return serverUrl.replace(/\/$/, "");
|
|
}
|
|
|
|
// The socket path on the linked server that relays C2S streams. The plugin
|
|
// that owns the relay tells us where it is, so nothing here names it.
|
|
let c2sRelayPath = null;
|
|
const C2S_RELAY_PATH_PATTERN =
|
|
/^\/plugin-ws\/[a-z0-9][a-z0-9-]*\/[A-Za-z0-9/_-]+$/;
|
|
|
|
ipcMain.handle("set-c2s-relay-path", (_event, relayPath) => {
|
|
if (
|
|
typeof relayPath !== "string" ||
|
|
!C2S_RELAY_PATH_PATTERN.test(relayPath)
|
|
) {
|
|
return { success: false, error: "Invalid relay path" };
|
|
}
|
|
c2sRelayPath = relayPath;
|
|
return { success: true };
|
|
});
|
|
|
|
function getC2SRelayUrl() {
|
|
if (!c2sRelayPath) {
|
|
throw new Error("Client tunnels are not available yet. Try again shortly.");
|
|
}
|
|
const relayHttpUrl = `${getC2SRemoteBaseUrl()}${c2sRelayPath}`;
|
|
return relayHttpUrl.replace(/^http:/, "ws:").replace(/^https:/, "wss:");
|
|
}
|
|
|
|
const C2S_REMOTE_SESSION_EXPIRED_ERROR =
|
|
"This device was signed out of its server. Sign in again from Sync and try again.";
|
|
|
|
function normalizeC2SAuthToken(authToken) {
|
|
return typeof authToken === "string" ? authToken.trim() : "";
|
|
}
|
|
|
|
function isC2SAuthError(message) {
|
|
const value = String(message || "")
|
|
.trim()
|
|
.toLowerCase();
|
|
return (
|
|
value === "authentication required" ||
|
|
value === "missing authentication token" ||
|
|
value === "invalid token" ||
|
|
value === "session expired" ||
|
|
value === "session not found" ||
|
|
// The plugin relay refuses an unauthenticated upgrade before any message.
|
|
value === "unexpected server response: 401"
|
|
);
|
|
}
|
|
|
|
function normalizeC2SErrorMessage(message, fallback = "Client tunnel failed") {
|
|
const value = message || fallback;
|
|
return isC2SAuthError(value) ? C2S_REMOTE_SESSION_EXPIRED_ERROR : value;
|
|
}
|
|
|
|
function createC2SFailure(message, fallback) {
|
|
const error = normalizeC2SErrorMessage(message, fallback);
|
|
return {
|
|
success: false,
|
|
error,
|
|
...(error === C2S_REMOTE_SESSION_EXPIRED_ERROR
|
|
? { code: "REMOTE_SESSION_EXPIRED" }
|
|
: {}),
|
|
};
|
|
}
|
|
|
|
async function fetchC2SRemoteJson(pathname) {
|
|
if (!linkedServer.getLinkedServer()?.token) {
|
|
throw new Error(C2S_REMOTE_SESSION_EXPIRED_ERROR);
|
|
}
|
|
|
|
const url = `${getC2SRemoteBaseUrl()}${pathname}`;
|
|
const response = await httpFetch(url, {
|
|
headers: linkedServer.linkedRequestHeaders(),
|
|
});
|
|
if (response.status === 401 || response.status === 403) {
|
|
throw new Error(C2S_REMOTE_SESSION_EXPIRED_ERROR);
|
|
}
|
|
if (!response.ok) {
|
|
throw new Error(`Request failed (${response.status}): ${url}`);
|
|
}
|
|
return response.json();
|
|
}
|
|
|
|
async function resolveC2SRemoteSourceHost(tunnel) {
|
|
const normalized = normalizeC2STunnelAddresses(tunnel);
|
|
const sourceHostSyncId =
|
|
typeof normalized.sourceHostSyncId === "string"
|
|
? normalized.sourceHostSyncId.trim()
|
|
: "";
|
|
if (!sourceHostSyncId) return normalized;
|
|
|
|
let remoteHost = null;
|
|
try {
|
|
remoteHost = await fetchC2SRemoteJson(
|
|
`/sync/v2/hosts/${encodeURIComponent(sourceHostSyncId)}`,
|
|
);
|
|
} catch (error) {
|
|
if (error.message === C2S_REMOTE_SESSION_EXPIRED_ERROR) throw error;
|
|
}
|
|
const remoteHostId = Number(remoteHost?.id);
|
|
if (!Number.isInteger(remoteHostId) || remoteHostId < 1) {
|
|
throw new Error(
|
|
"The intermediate host is not on the server yet. Sync, then try again.",
|
|
);
|
|
}
|
|
|
|
return {
|
|
...normalized,
|
|
sourceHostId: remoteHostId,
|
|
sourceHostSyncId,
|
|
sourceHostName: remoteHost.name || normalized.sourceHostName,
|
|
endpointHost: normalized.endpointHost || remoteHost.name,
|
|
};
|
|
}
|
|
|
|
async function getC2SRelayHeaders(relayUrl) {
|
|
if (linkedServer.getLinkedServer()?.token) {
|
|
return linkedServer.linkedRequestHeaders();
|
|
}
|
|
const headers = { "X-Electron-App": "true" };
|
|
|
|
if (!mainWindow?.webContents?.session) {
|
|
throw new Error(C2S_REMOTE_SESSION_EXPIRED_ERROR);
|
|
}
|
|
|
|
const cookieUrl = relayUrl
|
|
.replace(/^ws:/, "http:")
|
|
.replace(/^wss:/, "https:");
|
|
const cookies = await mainWindow.webContents.session.cookies.get({
|
|
url: cookieUrl,
|
|
name: "jwt",
|
|
});
|
|
const jwt = cookies[0]?.value;
|
|
if (!jwt) {
|
|
throw new Error(C2S_REMOTE_SESSION_EXPIRED_ERROR);
|
|
}
|
|
|
|
headers.Cookie = `jwt=${encodeURIComponent(jwt)}`;
|
|
return headers;
|
|
}
|
|
|
|
const attachC2SAuth = require("./c2s-auth.cjs").createC2SAuthBridge(
|
|
ipcMain,
|
|
() => mainWindow,
|
|
);
|
|
|
|
function getC2STunnelName(tunnel, index = 0) {
|
|
if (tunnel.name) return tunnel.name;
|
|
const localAddress = getC2SLocalAddress(tunnel);
|
|
const remoteAddress = getC2SRemoteAddress(tunnel);
|
|
return [
|
|
"c2s",
|
|
index,
|
|
tunnel.sourceHostId || 0,
|
|
tunnel.mode || tunnel.tunnelType || "local",
|
|
localAddress,
|
|
remoteAddress,
|
|
tunnel.sourcePort,
|
|
tunnel.endpointPort || 0,
|
|
].join("::");
|
|
}
|
|
|
|
function getC2STunnelStatus(tunnelName) {
|
|
return (
|
|
c2sTunnelRuntimes.get(tunnelName)?.status || {
|
|
connected: false,
|
|
status: "DISCONNECTED",
|
|
}
|
|
);
|
|
}
|
|
|
|
function getAllC2STunnelStatuses() {
|
|
const statuses = {};
|
|
for (const [tunnelName] of c2sTunnelRuntimes.entries()) {
|
|
statuses[tunnelName] = getC2STunnelStatus(tunnelName);
|
|
}
|
|
return statuses;
|
|
}
|
|
|
|
function emitC2STunnelStatuses() {
|
|
if (!mainWindow || mainWindow.isDestroyed()) return;
|
|
mainWindow.webContents.send("c2s-tunnel-statuses", getAllC2STunnelStatuses());
|
|
}
|
|
|
|
function setC2STunnelStatus(tunnelName, status) {
|
|
const runtime = c2sTunnelRuntimes.get(tunnelName);
|
|
if (runtime) {
|
|
runtime.status = status;
|
|
emitC2STunnelStatuses();
|
|
}
|
|
}
|
|
|
|
function setC2STunnelError(tunnelName, message) {
|
|
logToFile(`[c2s] ${tunnelName} failed:`, message);
|
|
setC2STunnelStatus(tunnelName, {
|
|
connected: false,
|
|
status: "ERROR",
|
|
reason: message,
|
|
});
|
|
}
|
|
|
|
function parseSocks5Target(buffer) {
|
|
if (buffer.length < 7 || buffer[0] !== 0x05 || buffer[1] !== 0x01) {
|
|
return null;
|
|
}
|
|
|
|
const addressType = buffer[3];
|
|
let offset = 4;
|
|
let host;
|
|
|
|
if (addressType === 0x01) {
|
|
if (buffer.length < offset + 4 + 2) return null;
|
|
host = Array.from(buffer.subarray(offset, offset + 4)).join(".");
|
|
offset += 4;
|
|
} else if (addressType === 0x03) {
|
|
const length = buffer[offset];
|
|
offset += 1;
|
|
if (buffer.length < offset + length + 2) return null;
|
|
host = buffer.subarray(offset, offset + length).toString("utf8");
|
|
offset += length;
|
|
} else if (addressType === 0x04) {
|
|
if (buffer.length < offset + 16 + 2) return null;
|
|
const parts = [];
|
|
for (let i = 0; i < 16; i += 2) {
|
|
parts.push(buffer.readUInt16BE(offset + i).toString(16));
|
|
}
|
|
host = parts.join(":");
|
|
offset += 16;
|
|
} else {
|
|
throw new Error("Unsupported SOCKS5 address type");
|
|
}
|
|
|
|
const port = buffer.readUInt16BE(offset);
|
|
return { host, port, bytesRead: offset + 2 };
|
|
}
|
|
|
|
async function openC2SRelay(
|
|
tunnel,
|
|
targetHost,
|
|
targetPort,
|
|
socket,
|
|
initialData,
|
|
authToken,
|
|
) {
|
|
const tunnelConfig = normalizeC2STunnelAddresses(tunnel);
|
|
const tunnelName = tunnel.name || getC2STunnelName(tunnel);
|
|
const relayUrl = getC2SRelayUrl();
|
|
const headers = await getC2SRelayHeaders(relayUrl, authToken);
|
|
logToFile(`[c2s] opening relay for ${tunnelName}`, {
|
|
relayUrl,
|
|
targetHost,
|
|
targetPort,
|
|
});
|
|
const ws = new WebSocket(
|
|
relayUrl,
|
|
getWebSocketOptions(relayUrl, { headers }),
|
|
);
|
|
attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
|
|
keepC2SSocketAlive(ws);
|
|
const pendingChunks = [];
|
|
let ready = false;
|
|
let closed = false;
|
|
|
|
const cleanup = () => {
|
|
if (closed) return;
|
|
closed = true;
|
|
try {
|
|
socket.destroy();
|
|
} catch {
|
|
// expected during shutdown
|
|
}
|
|
try {
|
|
ws.close();
|
|
} catch {
|
|
// expected during shutdown
|
|
}
|
|
};
|
|
|
|
const sendChunk = (chunk) => {
|
|
if (ready && ws.readyState === WebSocket.OPEN) {
|
|
ws.send(chunk);
|
|
} else {
|
|
pendingChunks.push(chunk);
|
|
}
|
|
};
|
|
|
|
socket.on("data", sendChunk);
|
|
socket.on("close", cleanup);
|
|
// One connection failing must not stop the tunnel: the listener refuses
|
|
// new connections while the tunnel is not connected, and a browser opens
|
|
// many at once.
|
|
socket.on("error", (error) => {
|
|
logToFile(`[c2s] ${tunnelName} local socket error:`, error.message);
|
|
cleanup();
|
|
});
|
|
ws.on("close", cleanup);
|
|
ws.on("error", (error) => {
|
|
logToFile(`[c2s] ${tunnelName} relay error:`, error.message);
|
|
cleanup();
|
|
});
|
|
|
|
ws.on("open", () => {
|
|
logToFile(`[c2s] relay connected for ${tunnelName}`);
|
|
ws.send(
|
|
JSON.stringify({
|
|
type: "open",
|
|
tunnelConfig,
|
|
targetHost,
|
|
targetPort,
|
|
}),
|
|
);
|
|
});
|
|
|
|
ws.on("message", (data, isBinary) => {
|
|
if (isBinary) {
|
|
socket.write(Buffer.isBuffer(data) ? data : Buffer.from(data));
|
|
return;
|
|
}
|
|
|
|
try {
|
|
const message = JSON.parse(data.toString());
|
|
if (message.type === "ready") {
|
|
ready = true;
|
|
logToFile(`[c2s] relay ready for ${tunnelName}`);
|
|
if (initialData?.length) {
|
|
ws.send(initialData);
|
|
}
|
|
while (pendingChunks.length > 0) {
|
|
ws.send(pendingChunks.shift());
|
|
}
|
|
} else if (message.type === "error") {
|
|
const relayError = normalizeC2SErrorMessage(
|
|
message.error,
|
|
"Relay rejected the client tunnel",
|
|
);
|
|
logToFile("[c2s] relay error:", relayError);
|
|
if (relayError === C2S_REMOTE_SESSION_EXPIRED_ERROR) {
|
|
setC2STunnelError(tunnelName, relayError);
|
|
}
|
|
cleanup();
|
|
}
|
|
} catch (error) {
|
|
logToFile("[c2s] invalid relay message:", error.message);
|
|
cleanup();
|
|
}
|
|
});
|
|
}
|
|
|
|
async function testC2SRelay(
|
|
tunnel,
|
|
targetHost,
|
|
targetPort,
|
|
authToken,
|
|
runtime,
|
|
) {
|
|
const tunnelConfig = normalizeC2STunnelAddresses(tunnel);
|
|
const relayUrl = getC2SRelayUrl();
|
|
const headers = await getC2SRelayHeaders(relayUrl, authToken);
|
|
if (runtime && c2sTunnelRuntimes.get(tunnel.name) !== runtime) {
|
|
return { success: false, error: "Tunnel stopped" };
|
|
}
|
|
const ws = new WebSocket(
|
|
relayUrl,
|
|
getWebSocketOptions(relayUrl, { headers }),
|
|
);
|
|
attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
|
|
keepC2SSocketAlive(ws);
|
|
|
|
if (runtime) runtime.authSocket = ws;
|
|
return new Promise((resolve) => {
|
|
let settled = false;
|
|
// The relay sends its reason and then closes; keep the reason.
|
|
let relayError = null;
|
|
const settle = (result) => {
|
|
if (settled) return;
|
|
settled = true;
|
|
try {
|
|
if (!runtime || !result.success) ws.close();
|
|
} catch {
|
|
// expected during shutdown
|
|
}
|
|
resolve(result);
|
|
};
|
|
|
|
const timer = setTimeout(() => {
|
|
settle({ success: false, error: "Tunnel test timed out" });
|
|
}, 180_000);
|
|
|
|
ws.on("open", () => {
|
|
ws.send(
|
|
JSON.stringify({
|
|
type: "test",
|
|
keepAlive: !!runtime,
|
|
tunnelConfig,
|
|
targetHost,
|
|
targetPort,
|
|
}),
|
|
);
|
|
});
|
|
ws.on("message", (data, isBinary) => {
|
|
if (isBinary) return;
|
|
|
|
try {
|
|
const message = JSON.parse(data.toString());
|
|
if (message.type === "ready") {
|
|
clearTimeout(timer);
|
|
settle({ success: true });
|
|
} else if (message.type === "error") {
|
|
clearTimeout(timer);
|
|
relayError = normalizeC2SErrorMessage(
|
|
message.error,
|
|
"Tunnel test failed",
|
|
);
|
|
settle(createC2SFailure(message.error, "Tunnel test failed"));
|
|
}
|
|
} catch (error) {
|
|
clearTimeout(timer);
|
|
settle(createC2SFailure(error.message, "Tunnel test failed"));
|
|
}
|
|
});
|
|
ws.on("error", (error) => {
|
|
clearTimeout(timer);
|
|
settle(createC2SFailure(error.message, "Tunnel test failed"));
|
|
});
|
|
ws.on("close", () => {
|
|
if (runtime && c2sTunnelRuntimes.get(tunnel.name) === runtime) {
|
|
setC2STunnelError(
|
|
tunnel.name,
|
|
relayError || "Endpoint SSH connection closed",
|
|
);
|
|
}
|
|
clearTimeout(timer);
|
|
settle({ success: false, error: "Tunnel test connection closed" });
|
|
});
|
|
});
|
|
}
|
|
|
|
async function testC2STunnel(tunnel, index = 0, authToken) {
|
|
const resolvedTunnel = await resolveC2SRemoteSourceHost(tunnel);
|
|
const mode = resolvedTunnel.mode || resolvedTunnel.tunnelType || "local";
|
|
const testTunnel = {
|
|
...normalizeC2STunnelAddresses(resolvedTunnel),
|
|
name: `${getC2STunnelName(resolvedTunnel, index)}::test`,
|
|
mode,
|
|
};
|
|
const localAddress = getC2SLocalAddress(testTunnel);
|
|
const remoteAddress = getC2SRemoteAddress(testTunnel);
|
|
const sourcePort = Number(resolvedTunnel.sourcePort);
|
|
const endpointPort = Number(resolvedTunnel.endpointPort);
|
|
|
|
if (!resolvedTunnel.sourceHostId) {
|
|
return { success: false, error: "Endpoint SSH host is required" };
|
|
}
|
|
|
|
if (mode === "remote") {
|
|
const localTarget = await checkTcpConnection(localAddress, endpointPort);
|
|
if (!localTarget.success) {
|
|
return {
|
|
success: false,
|
|
error: `Local target ${localAddress}:${endpointPort} is not reachable: ${localTarget.error}`,
|
|
};
|
|
}
|
|
|
|
return testC2SRelay(testTunnel, undefined, undefined, authToken);
|
|
}
|
|
|
|
if (!Number.isInteger(sourcePort) || sourcePort < 1 || sourcePort > 65535) {
|
|
return { success: false, error: "Invalid local port" };
|
|
}
|
|
|
|
const runtime = c2sTunnelRuntimes.get(
|
|
getC2STunnelName(resolvedTunnel, index),
|
|
);
|
|
if (!runtime) {
|
|
const availability = await checkLocalPortAvailable(
|
|
localAddress,
|
|
sourcePort,
|
|
);
|
|
if (!availability.available) {
|
|
return {
|
|
success: false,
|
|
error: `Local listener ${localAddress}:${sourcePort} is not available: ${availability.error}`,
|
|
};
|
|
}
|
|
}
|
|
|
|
if (mode === "dynamic") {
|
|
return testC2SRelay(testTunnel, undefined, undefined, authToken);
|
|
}
|
|
|
|
if (!Number.isInteger(endpointPort) || endpointPort < 1) {
|
|
return { success: false, error: "Invalid remote port" };
|
|
}
|
|
|
|
return testC2SRelay(testTunnel, remoteAddress, endpointPort, authToken);
|
|
}
|
|
|
|
function handleC2SDynamicConnection(tunnel, socket, authToken) {
|
|
const tunnelName = tunnel.name || getC2STunnelName(tunnel);
|
|
let buffer = Buffer.alloc(0);
|
|
let stage = "greeting";
|
|
|
|
const fail = (code = 0x01, message = "SOCKS5 request failed") => {
|
|
setC2STunnelError(tunnelName, message);
|
|
if (!socket.destroyed) {
|
|
socket.write(Buffer.from([0x05, code, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
|
|
socket.destroy();
|
|
}
|
|
};
|
|
|
|
const onData = (chunk) => {
|
|
buffer = Buffer.concat([buffer, chunk]);
|
|
|
|
try {
|
|
if (stage === "greeting") {
|
|
if (buffer.length < 2) return;
|
|
if (buffer[0] !== 0x05) {
|
|
fail(0x01, "Invalid SOCKS5 greeting");
|
|
return;
|
|
}
|
|
const methodsLength = buffer[1];
|
|
if (buffer.length < 2 + methodsLength) return;
|
|
socket.write(Buffer.from([0x05, 0x00]));
|
|
buffer = buffer.subarray(2 + methodsLength);
|
|
stage = "connect";
|
|
}
|
|
|
|
if (stage === "connect") {
|
|
const target = parseSocks5Target(buffer);
|
|
if (!target) return;
|
|
|
|
stage = "piping";
|
|
socket.off("data", onData);
|
|
const remainder = buffer.subarray(target.bytesRead);
|
|
socket.write(Buffer.from([0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
|
|
openC2SRelay(
|
|
tunnel,
|
|
target.host,
|
|
target.port,
|
|
socket,
|
|
remainder,
|
|
authToken,
|
|
).catch((error) => {
|
|
const message = normalizeC2SErrorMessage(
|
|
error.message,
|
|
"Dynamic relay failed",
|
|
);
|
|
logToFile("[c2s] dynamic relay failed:", message);
|
|
fail(0x05, message);
|
|
});
|
|
}
|
|
} catch (error) {
|
|
logToFile("[c2s] SOCKS5 parse failed:", error.message);
|
|
fail(0x01, error.message || "SOCKS5 parse failed");
|
|
}
|
|
};
|
|
|
|
socket.on("data", onData);
|
|
socket.on("error", () => socket.destroy());
|
|
}
|
|
|
|
function handleC2SLocalConnection(tunnel, socket, authToken) {
|
|
const tunnelName = tunnel.name || getC2STunnelName(tunnel);
|
|
const targetHost = getC2SRemoteAddress(tunnel);
|
|
const targetPort = Number(tunnel.endpointPort);
|
|
openC2SRelay(
|
|
tunnel,
|
|
targetHost,
|
|
targetPort,
|
|
socket,
|
|
undefined,
|
|
authToken,
|
|
).catch((error) => {
|
|
const message = normalizeC2SErrorMessage(
|
|
error.message,
|
|
"Local relay failed",
|
|
);
|
|
logToFile("[c2s] local relay failed:", message);
|
|
if (message === C2S_REMOTE_SESSION_EXPIRED_ERROR) {
|
|
setC2STunnelError(tunnelName, message);
|
|
}
|
|
socket.destroy();
|
|
});
|
|
}
|
|
|
|
function pauseSourceForC2SWebSocket(ws, source) {
|
|
if (!source?.pause || !source?.resume) return;
|
|
if (ws.bufferedAmount <= C2S_WS_HIGH_WATERMARK) return;
|
|
|
|
source.pause();
|
|
const resumeTimer = setInterval(() => {
|
|
if (
|
|
ws.readyState !== WebSocket.OPEN ||
|
|
source.destroyed ||
|
|
ws.bufferedAmount <= C2S_WS_LOW_WATERMARK
|
|
) {
|
|
clearInterval(resumeTimer);
|
|
if (ws.readyState === WebSocket.OPEN && !source.destroyed) {
|
|
source.resume();
|
|
}
|
|
}
|
|
}, 25);
|
|
}
|
|
|
|
function sendC2SRemoteMessage(ws, message, source) {
|
|
if (ws.readyState === WebSocket.OPEN) {
|
|
ws.send(JSON.stringify(message), (error) => {
|
|
if (error && source?.destroy) {
|
|
source.destroy(error);
|
|
}
|
|
});
|
|
pauseSourceForC2SWebSocket(ws, source);
|
|
}
|
|
}
|
|
|
|
function writeC2SRemoteChunk(target, chunk, ws, closeTarget) {
|
|
if (!target || target.destroyed) return;
|
|
|
|
if (target.writableLength > C2S_STREAM_WRITE_LIMIT) {
|
|
closeTarget();
|
|
return;
|
|
}
|
|
|
|
const canContinue = target.write(chunk);
|
|
if (!canContinue && typeof ws.pause === "function") {
|
|
ws.pause();
|
|
target.once("drain", () => {
|
|
if (ws.readyState === WebSocket.OPEN && typeof ws.resume === "function") {
|
|
ws.resume();
|
|
}
|
|
});
|
|
}
|
|
}
|
|
|
|
async function startC2SRemoteTunnel(tunnel, index = 0, authToken) {
|
|
const tunnelName = getC2STunnelName(tunnel, index);
|
|
const tunnelConfig = normalizeC2STunnelAddresses(tunnel);
|
|
const localHost = getC2SLocalAddress(tunnelConfig);
|
|
const remoteHost = getC2SRemoteAddress(tunnelConfig);
|
|
const localPort = Number(tunnel.endpointPort);
|
|
const remotePort = Number(tunnel.sourcePort);
|
|
|
|
if (!tunnel.sourceHostId) {
|
|
return { success: false, error: "Endpoint SSH host is required" };
|
|
}
|
|
if (!Number.isInteger(remotePort) || remotePort < 1 || remotePort > 65535) {
|
|
return { success: false, error: "Invalid remote port" };
|
|
}
|
|
if (!Number.isInteger(localPort) || localPort < 1 || localPort > 65535) {
|
|
return { success: false, error: "Invalid local port" };
|
|
}
|
|
|
|
const localTarget = await checkTcpConnection(localHost, localPort);
|
|
if (!localTarget.success) {
|
|
return {
|
|
success: false,
|
|
error: `Local target ${localHost}:${localPort} is not reachable: ${localTarget.error}`,
|
|
};
|
|
}
|
|
|
|
const existing = c2sTunnelRuntimes.get(tunnelName);
|
|
if (existing) {
|
|
return { success: true, tunnelName };
|
|
}
|
|
|
|
for (const runtime of c2sTunnelRuntimes.values()) {
|
|
if (
|
|
runtime.mode === "remote" &&
|
|
runtime.sourceHostId === Number(tunnel.sourceHostId) &&
|
|
runtime.remoteAddress === remoteHost &&
|
|
runtime.sourcePort === remotePort
|
|
) {
|
|
return {
|
|
success: false,
|
|
error: `Another client remote tunnel already uses ${remoteHost}:${remotePort} on this endpoint`,
|
|
};
|
|
}
|
|
}
|
|
|
|
const relayUrl = getC2SRelayUrl();
|
|
const headers = await getC2SRelayHeaders(relayUrl, authToken);
|
|
const ws = new WebSocket(
|
|
relayUrl,
|
|
getWebSocketOptions(relayUrl, { headers }),
|
|
);
|
|
attachC2SAuth(ws, tunnel.name || getC2STunnelName(tunnel));
|
|
keepC2SSocketAlive(ws);
|
|
const sockets = new Map();
|
|
let closed = false;
|
|
|
|
const cleanup = () => {
|
|
if (closed) return;
|
|
closed = true;
|
|
for (const socket of sockets.values()) {
|
|
socket.destroy();
|
|
}
|
|
sockets.clear();
|
|
try {
|
|
ws.close();
|
|
} catch {
|
|
// expected during shutdown
|
|
}
|
|
};
|
|
|
|
c2sTunnelRuntimes.set(tunnelName, {
|
|
ws,
|
|
sockets,
|
|
mode: "remote",
|
|
sourceHostId: Number(tunnel.sourceHostId),
|
|
sourcePort: remotePort,
|
|
bindHost: localHost,
|
|
remoteAddress: remoteHost,
|
|
status: { connected: false, status: "CONNECTING" },
|
|
close: cleanup,
|
|
});
|
|
emitC2STunnelStatuses();
|
|
|
|
return new Promise((resolve) => {
|
|
let settled = false;
|
|
const settle = (result) => {
|
|
if (settled) return;
|
|
settled = true;
|
|
resolve(result);
|
|
};
|
|
|
|
ws.on("open", () => {
|
|
logToFile(`[c2s] opening remote tunnel ${tunnelName}`, {
|
|
relayUrl,
|
|
remoteHost,
|
|
remotePort,
|
|
localHost,
|
|
localPort,
|
|
});
|
|
ws.send(
|
|
JSON.stringify({
|
|
type: "open",
|
|
tunnelConfig: { ...tunnelConfig, name: tunnelName, mode: "remote" },
|
|
}),
|
|
);
|
|
});
|
|
|
|
ws.on("message", (data, isBinary) => {
|
|
if (isBinary) return;
|
|
|
|
let message;
|
|
try {
|
|
message = JSON.parse(data.toString());
|
|
} catch (error) {
|
|
const message = normalizeC2SErrorMessage(
|
|
error.message,
|
|
"Invalid relay message",
|
|
);
|
|
setC2STunnelError(tunnelName, message);
|
|
cleanup();
|
|
settle(createC2SFailure(message, "Invalid relay message"));
|
|
return;
|
|
}
|
|
|
|
if (message.type === "ready") {
|
|
setC2STunnelStatus(tunnelName, {
|
|
connected: true,
|
|
status: "CONNECTED",
|
|
});
|
|
settle({ success: true, tunnelName });
|
|
return;
|
|
}
|
|
|
|
if (message.type === "error") {
|
|
const error = normalizeC2SErrorMessage(
|
|
message.error,
|
|
"Relay rejected the client tunnel",
|
|
);
|
|
setC2STunnelError(tunnelName, error);
|
|
cleanup();
|
|
c2sTunnelRuntimes.delete(tunnelName);
|
|
emitC2STunnelStatuses();
|
|
settle(createC2SFailure(error, "Relay rejected the client tunnel"));
|
|
return;
|
|
}
|
|
|
|
if (message.type === "connection" && message.streamId) {
|
|
const socket = net.createConnection(
|
|
{ host: localHost, port: localPort },
|
|
() => {
|
|
logToFile(`[c2s] remote stream ${message.streamId} connected`, {
|
|
tunnelName,
|
|
localHost,
|
|
localPort,
|
|
});
|
|
},
|
|
);
|
|
sockets.set(message.streamId, socket);
|
|
socket.on("data", (chunk) => {
|
|
sendC2SRemoteMessage(
|
|
ws,
|
|
{
|
|
type: "data",
|
|
streamId: message.streamId,
|
|
data: chunk.toString("base64"),
|
|
},
|
|
socket,
|
|
);
|
|
});
|
|
socket.on("close", () => {
|
|
sockets.delete(message.streamId);
|
|
sendC2SRemoteMessage(ws, {
|
|
type: "close",
|
|
streamId: message.streamId,
|
|
});
|
|
});
|
|
socket.on("error", (error) => {
|
|
logToFile(`[c2s] remote stream ${message.streamId} failed:`, {
|
|
tunnelName,
|
|
error: error.message,
|
|
});
|
|
sockets.delete(message.streamId);
|
|
sendC2SRemoteMessage(ws, {
|
|
type: "close",
|
|
streamId: message.streamId,
|
|
error: error.message,
|
|
});
|
|
});
|
|
return;
|
|
}
|
|
|
|
if (message.type === "data" && message.streamId && message.data) {
|
|
const socket = sockets.get(message.streamId);
|
|
writeC2SRemoteChunk(
|
|
socket,
|
|
Buffer.from(message.data, "base64"),
|
|
ws,
|
|
() => {
|
|
if (socket) {
|
|
sockets.delete(message.streamId);
|
|
socket.destroy();
|
|
}
|
|
},
|
|
);
|
|
return;
|
|
}
|
|
|
|
if (message.type === "close" && message.streamId) {
|
|
const socket = sockets.get(message.streamId);
|
|
if (socket) {
|
|
sockets.delete(message.streamId);
|
|
socket.destroy();
|
|
}
|
|
}
|
|
});
|
|
|
|
ws.on("close", () => {
|
|
cleanup();
|
|
c2sTunnelRuntimes.delete(tunnelName);
|
|
emitC2STunnelStatuses();
|
|
settle({ success: false, error: "Remote tunnel relay closed" });
|
|
});
|
|
|
|
ws.on("error", (error) => {
|
|
const message = normalizeC2SErrorMessage(
|
|
error.message,
|
|
"Relay connection failed",
|
|
);
|
|
setC2STunnelError(tunnelName, message);
|
|
cleanup();
|
|
c2sTunnelRuntimes.delete(tunnelName);
|
|
emitC2STunnelStatuses();
|
|
settle(createC2SFailure(message, "Relay connection failed"));
|
|
});
|
|
});
|
|
}
|
|
|
|
async function startC2STunnel(tunnel, index = 0, authToken) {
|
|
const resolvedTunnel = await resolveC2SRemoteSourceHost(tunnel);
|
|
const mode = resolvedTunnel.mode || resolvedTunnel.tunnelType || "local";
|
|
const tunnelName = getC2STunnelName(resolvedTunnel, index);
|
|
const tunnelConfig = {
|
|
...normalizeC2STunnelAddresses(resolvedTunnel),
|
|
sessionId: crypto.randomUUID(),
|
|
};
|
|
const bindHost = getC2SLocalAddress(tunnelConfig);
|
|
const sourcePort = Number(resolvedTunnel.sourcePort);
|
|
logToFile(`[c2s] starting tunnel ${tunnelName}`, {
|
|
mode,
|
|
bindHost,
|
|
remoteAddress: getC2SRemoteAddress(tunnelConfig),
|
|
sourcePort,
|
|
sourceHostId: resolvedTunnel.sourceHostId,
|
|
sourceHostSyncId: resolvedTunnel.sourceHostSyncId,
|
|
endpointPort: resolvedTunnel.endpointPort,
|
|
});
|
|
|
|
if (mode === "remote") {
|
|
return startC2SRemoteTunnel(resolvedTunnel, index, authToken);
|
|
}
|
|
if (!resolvedTunnel.sourceHostId) {
|
|
return { success: false, error: "Endpoint SSH host is required" };
|
|
}
|
|
if (!Number.isInteger(sourcePort) || sourcePort < 1 || sourcePort > 65535) {
|
|
return { success: false, error: "Invalid local port" };
|
|
}
|
|
|
|
const existing = c2sTunnelRuntimes.get(tunnelName);
|
|
if (existing) {
|
|
return { success: true, tunnelName };
|
|
}
|
|
|
|
for (const runtime of c2sTunnelRuntimes.values()) {
|
|
if (
|
|
runtime.mode !== "remote" &&
|
|
runtime.bindHost === bindHost &&
|
|
runtime.sourcePort === sourcePort
|
|
) {
|
|
return {
|
|
success: false,
|
|
error: `Another client tunnel already uses ${bindHost}:${sourcePort}`,
|
|
};
|
|
}
|
|
}
|
|
|
|
const availability = await checkLocalPortAvailable(bindHost, sourcePort);
|
|
if (!availability.available) {
|
|
return {
|
|
success: false,
|
|
error: availability.error || "Port is already in use",
|
|
};
|
|
}
|
|
|
|
const sockets = new Set();
|
|
const server = net.createServer((socket) => {
|
|
if (!c2sTunnelRuntimes.get(tunnelName)?.status.connected) {
|
|
socket.destroy();
|
|
return;
|
|
}
|
|
sockets.add(socket);
|
|
socket.on("close", () => sockets.delete(socket));
|
|
if (mode === "dynamic") {
|
|
handleC2SDynamicConnection(
|
|
{ ...tunnelConfig, name: tunnelName, mode },
|
|
socket,
|
|
authToken,
|
|
);
|
|
} else {
|
|
handleC2SLocalConnection(
|
|
{ ...tunnelConfig, name: tunnelName, mode },
|
|
socket,
|
|
authToken,
|
|
);
|
|
}
|
|
});
|
|
|
|
c2sTunnelRuntimes.set(tunnelName, {
|
|
server,
|
|
sockets,
|
|
bindHost,
|
|
sourcePort,
|
|
status: { connected: false, status: "CONNECTING" },
|
|
});
|
|
|
|
return new Promise((resolve) => {
|
|
server.once("error", (error) => {
|
|
c2sTunnelRuntimes.delete(tunnelName);
|
|
logToFile(`[c2s] failed to listen for ${tunnelName}:`, error.message);
|
|
emitC2STunnelStatuses();
|
|
resolve({ success: false, error: error.message });
|
|
});
|
|
server.listen({ host: bindHost, port: sourcePort }, () => {
|
|
logToFile(
|
|
`[c2s] listening for ${tunnelName} on ${bindHost}:${sourcePort}`,
|
|
);
|
|
setC2STunnelStatus(tunnelName, {
|
|
connected: false,
|
|
status: "CONNECTING",
|
|
reason: "Verifying endpoint SSH connection",
|
|
});
|
|
|
|
const runtime = c2sTunnelRuntimes.get(tunnelName);
|
|
const verifyTunnel = testC2SRelay(
|
|
{ ...tunnelConfig, name: tunnelName, mode },
|
|
mode === "dynamic" ? undefined : getC2SRemoteAddress(tunnelConfig),
|
|
mode === "dynamic" ? undefined : Number(tunnelConfig.endpointPort),
|
|
authToken,
|
|
runtime,
|
|
);
|
|
|
|
verifyTunnel
|
|
.then((result) => {
|
|
if (c2sTunnelRuntimes.get(tunnelName) !== runtime) return;
|
|
if (result.success) {
|
|
setC2STunnelStatus(tunnelName, {
|
|
connected: true,
|
|
status: "CONNECTED",
|
|
});
|
|
} else {
|
|
setC2STunnelError(
|
|
tunnelName,
|
|
result.error || "Endpoint SSH connection failed",
|
|
);
|
|
}
|
|
})
|
|
.catch((error) => {
|
|
if (c2sTunnelRuntimes.get(tunnelName) === runtime) {
|
|
setC2STunnelError(
|
|
tunnelName,
|
|
error.message || "Endpoint SSH connection failed",
|
|
);
|
|
}
|
|
});
|
|
|
|
resolve({ success: true, tunnelName });
|
|
});
|
|
});
|
|
}
|
|
|
|
async function stopC2STunnel(tunnelName) {
|
|
const runtime = c2sTunnelRuntimes.get(tunnelName);
|
|
if (!runtime) {
|
|
return { success: true };
|
|
}
|
|
|
|
setC2STunnelStatus(tunnelName, {
|
|
connected: false,
|
|
status: "DISCONNECTING",
|
|
});
|
|
runtime.authSocket?.close();
|
|
|
|
return new Promise((resolve) => {
|
|
if (typeof runtime.close === "function") {
|
|
runtime.close();
|
|
c2sTunnelRuntimes.delete(tunnelName);
|
|
emitC2STunnelStatuses();
|
|
resolve({ success: true });
|
|
return;
|
|
}
|
|
|
|
for (const socket of runtime.sockets || []) {
|
|
socket.destroy();
|
|
}
|
|
runtime.server?.close(() => {
|
|
c2sTunnelRuntimes.delete(tunnelName);
|
|
emitC2STunnelStatuses();
|
|
resolve({ success: true });
|
|
});
|
|
});
|
|
}
|
|
|
|
function stopAllC2STunnels() {
|
|
for (const [tunnelName, runtime] of c2sTunnelRuntimes.entries()) {
|
|
try {
|
|
runtime.authSocket?.close();
|
|
if (typeof runtime.close === "function") {
|
|
runtime.close();
|
|
} else {
|
|
for (const socket of runtime.sockets || []) {
|
|
socket.destroy();
|
|
}
|
|
runtime.server?.close();
|
|
}
|
|
} catch (error) {
|
|
logToFile(`[c2s] failed to stop tunnel ${tunnelName}:`, error.message);
|
|
}
|
|
c2sTunnelRuntimes.delete(tunnelName);
|
|
}
|
|
emitC2STunnelStatuses();
|
|
}
|
|
|
|
async function startC2SAutoStartTunnels() {
|
|
const configPath = getC2STunnelConfigPath();
|
|
if (!fs.existsSync(configPath)) {
|
|
return { success: true, started: 0, errors: [] };
|
|
}
|
|
|
|
const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
|
|
const tunnels = Array.isArray(config) ? config : [];
|
|
const errors = [];
|
|
let started = 0;
|
|
|
|
for (let index = 0; index < tunnels.length; index += 1) {
|
|
const tunnel = tunnels[index];
|
|
if (!tunnel?.autoStart) continue;
|
|
const result = await startC2STunnel(tunnel, index);
|
|
if (result.success) {
|
|
started += 1;
|
|
} else {
|
|
errors.push(result.error || "Failed to start client tunnel");
|
|
}
|
|
}
|
|
|
|
return { success: errors.length === 0, started, errors };
|
|
}
|
|
|
|
ipcMain.handle("check-local-port-available", async (_event, host, port) => {
|
|
const sourcePort = Number(port);
|
|
if (
|
|
!host ||
|
|
!Number.isInteger(sourcePort) ||
|
|
sourcePort < 1 ||
|
|
sourcePort > 65535
|
|
) {
|
|
return { available: false, error: "Invalid local bind address or port" };
|
|
}
|
|
return checkLocalPortAvailable(host, sourcePort);
|
|
});
|
|
|
|
ipcMain.handle("start-c2s-tunnel", async (_event, tunnel, index, authToken) => {
|
|
try {
|
|
return await startC2STunnel(
|
|
tunnel,
|
|
Number(index) || 0,
|
|
normalizeC2SAuthToken(authToken),
|
|
);
|
|
} catch (error) {
|
|
return createC2SFailure(error.message, "Failed to start client tunnel");
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("test-c2s-tunnel", async (_event, tunnel, index, authToken) => {
|
|
try {
|
|
return await testC2STunnel(
|
|
tunnel,
|
|
Number(index) || 0,
|
|
normalizeC2SAuthToken(authToken),
|
|
);
|
|
} catch (error) {
|
|
return createC2SFailure(error.message, "Failed to test client tunnel");
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("stop-c2s-tunnel", async (_event, tunnelName) => {
|
|
try {
|
|
return await stopC2STunnel(tunnelName);
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("get-c2s-tunnel-statuses", () => {
|
|
return getAllC2STunnelStatuses();
|
|
});
|
|
|
|
ipcMain.handle("start-c2s-autostart-tunnels", async () => {
|
|
try {
|
|
return await startC2SAutoStartTunnels();
|
|
} catch (error) {
|
|
return { success: false, started: 0, errors: [error.message] };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("get-c2s-tunnel-preset-default-name", () => {
|
|
const now = new Date();
|
|
const date = now.toISOString().slice(0, 10);
|
|
const platform =
|
|
process.platform === "darwin"
|
|
? "macOS"
|
|
: process.platform === "win32"
|
|
? "Windows"
|
|
: "Linux";
|
|
const release = os.release();
|
|
const computerName = os.hostname();
|
|
return `[${date}] ${computerName} (${platform} ${release})`;
|
|
});
|
|
|
|
function readSetting(key) {
|
|
const settingsPath = path.join(app.getPath("userData"), "settings.json");
|
|
if (!fs.existsSync(settingsPath)) return null;
|
|
const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
|
|
return settings[key] !== undefined ? settings[key] : null;
|
|
}
|
|
|
|
ipcMain.handle("get-setting", (event, key) => {
|
|
try {
|
|
return readSetting(key);
|
|
} catch (error) {
|
|
console.error("Error reading setting:", error);
|
|
return null;
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("set-setting", (event, key, value) => {
|
|
if (typeof key !== "string") {
|
|
return { success: false, error: "Invalid setting key" };
|
|
}
|
|
if (
|
|
key === EXTERNAL_EDITOR_SETTING &&
|
|
value &&
|
|
!dialogChosenPaths.has(value)
|
|
) {
|
|
return { success: false, error: "Choose the editor in the file dialog" };
|
|
}
|
|
try {
|
|
const userDataPath = app.getPath("userData");
|
|
const settingsPath = path.join(userDataPath, "settings.json");
|
|
|
|
if (!fs.existsSync(userDataPath)) {
|
|
fs.mkdirSync(userDataPath, { recursive: true });
|
|
}
|
|
|
|
let settings = {};
|
|
if (fs.existsSync(settingsPath)) {
|
|
const settingsData = fs.readFileSync(settingsPath, "utf8");
|
|
settings = JSON.parse(settingsData);
|
|
}
|
|
|
|
settings[key] = value;
|
|
fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
|
|
return { success: true };
|
|
} catch (error) {
|
|
console.error("Error saving setting:", error);
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("clear-session-cookies", async () => {
|
|
try {
|
|
clearPersistedElectronAuthCookies();
|
|
const ses = mainWindow?.webContents?.session;
|
|
if (ses) {
|
|
const cookies = await ses.cookies.get({});
|
|
for (const cookie of cookies) {
|
|
await ses.cookies.remove(getCookieRemovalUrl(cookie), cookie.name);
|
|
}
|
|
}
|
|
} catch (error) {
|
|
console.error("Failed to clear session cookies:", error);
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("clipboard-write-text", (_event, text) => {
|
|
clipboard.writeText(typeof text === "string" ? text : String(text ?? ""));
|
|
return true;
|
|
});
|
|
|
|
ipcMain.handle("clipboard-read-text", () => clipboard.readText());
|
|
|
|
ipcMain.handle("local-terminal-start", (event, dimensions = {}) => {
|
|
const cols = Math.min(500, Math.max(2, Number(dimensions.cols) || 80));
|
|
const rows = Math.min(300, Math.max(1, Number(dimensions.rows) || 24));
|
|
const sessionId = crypto.randomUUID();
|
|
const shellConfig = resolveLocalShell(process.platform, dimensions.shell);
|
|
const spawnShell = () =>
|
|
pty.spawn(shellConfig.file, shellConfig.args, {
|
|
name: "xterm-256color",
|
|
cols,
|
|
rows,
|
|
cwd: os.homedir(),
|
|
env: {
|
|
...process.env,
|
|
TERM: "xterm-256color",
|
|
COLORTERM: "truecolor",
|
|
},
|
|
});
|
|
let child;
|
|
try {
|
|
child = spawnShell();
|
|
} catch (error) {
|
|
const ptyDir = path.dirname(require.resolve("node-pty/package.json"));
|
|
if (
|
|
!String(error?.message).includes("posix_spawnp") ||
|
|
repairSpawnHelpers(ptyDir) === 0
|
|
) {
|
|
throw error;
|
|
}
|
|
logToFile("[local-terminal] restored the spawn-helper execute bit");
|
|
child = spawnShell();
|
|
}
|
|
const ownerId = event.sender.id;
|
|
const session = { ownerId, process: child, ready: false, buffered: "" };
|
|
localTerminalSessions.set(sessionId, session);
|
|
child.onData((data) => {
|
|
if (!session.ready) {
|
|
session.buffered = (session.buffered + data).slice(-1024 * 1024);
|
|
return;
|
|
}
|
|
if (!event.sender.isDestroyed()) {
|
|
event.sender.send(`local-terminal:data:${sessionId}`, data);
|
|
}
|
|
});
|
|
child.onExit(({ exitCode }) => {
|
|
localTerminalSessions.delete(sessionId);
|
|
if (!event.sender.isDestroyed()) {
|
|
event.sender.send(`local-terminal:exit:${sessionId}`, exitCode);
|
|
}
|
|
});
|
|
event.sender.once("destroyed", () => closeLocalTerminalsFor(ownerId));
|
|
return { sessionId, shell: shellConfig.file };
|
|
});
|
|
|
|
ipcMain.handle("local-terminal-ready", (event, sessionId) => {
|
|
const session = ownedLocalTerminal(event, sessionId);
|
|
if (!session) return false;
|
|
session.ready = true;
|
|
if (session.buffered && !event.sender.isDestroyed()) {
|
|
event.sender.send(`local-terminal:data:${sessionId}`, session.buffered);
|
|
session.buffered = "";
|
|
}
|
|
return true;
|
|
});
|
|
|
|
ipcMain.handle("local-terminal-write", (event, sessionId, data) => {
|
|
const session = ownedLocalTerminal(event, sessionId);
|
|
if (!session || typeof data !== "string" || data.length > 64 * 1024) {
|
|
return false;
|
|
}
|
|
session.process.write(data);
|
|
return true;
|
|
});
|
|
|
|
ipcMain.handle("local-terminal-resize", (event, sessionId, cols, rows) => {
|
|
const session = ownedLocalTerminal(event, sessionId);
|
|
const width = Number(cols);
|
|
const height = Number(rows);
|
|
if (
|
|
!session ||
|
|
!Number.isInteger(width) ||
|
|
!Number.isInteger(height) ||
|
|
width < 2 ||
|
|
width > 500 ||
|
|
height < 1 ||
|
|
height > 300
|
|
) {
|
|
return false;
|
|
}
|
|
session.process.resize(width, height);
|
|
return true;
|
|
});
|
|
|
|
ipcMain.handle("local-terminal-close", (event, sessionId) => {
|
|
const session = ownedLocalTerminal(event, sessionId);
|
|
if (!session) return false;
|
|
localTerminalSessions.delete(sessionId);
|
|
session.process.kill();
|
|
return true;
|
|
});
|
|
|
|
ipcMain.handle("show-save-dialog", async (_event, options) => {
|
|
return dialog.showSaveDialog(mainWindow, options || {});
|
|
});
|
|
|
|
ipcMain.handle("show-open-dialog", async (_event, options) => {
|
|
const result = await dialog.showOpenDialog(mainWindow, options || {});
|
|
for (const filePath of result.filePaths) dialogChosenPaths.add(filePath);
|
|
return result;
|
|
});
|
|
|
|
function toLocalFileType(stat) {
|
|
if (stat.isDirectory()) return "directory";
|
|
if (stat.isFile()) return "file";
|
|
if (stat.isSymbolicLink()) return "link";
|
|
return "other";
|
|
}
|
|
|
|
function getLocalEntry(entryPath, name = path.basename(entryPath)) {
|
|
const stat = fs.lstatSync(entryPath);
|
|
return {
|
|
name,
|
|
path: entryPath,
|
|
type: toLocalFileType(stat),
|
|
size: stat.isFile() ? stat.size : 0,
|
|
created: stat.birthtime.toISOString(),
|
|
modified: stat.mtime.toISOString(),
|
|
modifiedTimestamp: stat.mtimeMs,
|
|
hidden: name.startsWith("."),
|
|
permissions: (stat.mode & 0o777).toString(8).padStart(3, "0"),
|
|
owner: String(stat.uid),
|
|
group: String(stat.gid),
|
|
};
|
|
}
|
|
|
|
function normalizeRelativeLocalPath(relativePath) {
|
|
return relativePath.split(path.sep).join("/");
|
|
}
|
|
|
|
function validateLocalName(name) {
|
|
if (typeof name !== "string" || !name.trim()) {
|
|
throw new Error("Missing name");
|
|
}
|
|
const trimmed = name.trim();
|
|
if (
|
|
trimmed.includes("/") ||
|
|
trimmed.includes("\\") ||
|
|
trimmed === "." ||
|
|
trimmed === ".."
|
|
) {
|
|
throw new Error("Name cannot contain path separators");
|
|
}
|
|
return trimmed;
|
|
}
|
|
|
|
function ensureLocalDirectory(dirPath) {
|
|
if (typeof dirPath !== "string" || !dirPath) {
|
|
throw new Error("Missing directory path");
|
|
}
|
|
const stat = fs.statSync(dirPath);
|
|
if (!stat.isDirectory()) {
|
|
throw new Error("Path is not a directory");
|
|
}
|
|
}
|
|
|
|
function collectLocalFilesFromPath(rootPath, rootName, files, limit) {
|
|
if (files.length >= limit) return;
|
|
|
|
const stat = fs.lstatSync(rootPath);
|
|
if (stat.isSymbolicLink()) return;
|
|
|
|
if (stat.isFile()) {
|
|
files.push({
|
|
path: rootPath,
|
|
name: path.basename(rootPath),
|
|
relativePath: normalizeRelativeLocalPath(rootName),
|
|
size: stat.size,
|
|
created: stat.birthtime.toISOString(),
|
|
modified: stat.mtime.toISOString(),
|
|
});
|
|
return;
|
|
}
|
|
|
|
if (!stat.isDirectory()) return;
|
|
|
|
for (const childName of fs.readdirSync(rootPath)) {
|
|
if (files.length >= limit) return;
|
|
const childPath = path.join(rootPath, childName);
|
|
collectLocalFilesFromPath(
|
|
childPath,
|
|
path.join(rootName, childName),
|
|
files,
|
|
limit,
|
|
);
|
|
}
|
|
}
|
|
|
|
ipcMain.handle("get-local-home-directory", () => os.homedir());
|
|
|
|
ipcMain.handle("list-local-directory", (_event, dirPath) => {
|
|
try {
|
|
const requestedPath =
|
|
typeof dirPath === "string" && dirPath.trim() ? dirPath : os.homedir();
|
|
const stat = fs.statSync(requestedPath);
|
|
if (!stat.isDirectory()) {
|
|
return {
|
|
success: false,
|
|
path: requestedPath,
|
|
entries: [],
|
|
error: "Path is not a directory",
|
|
};
|
|
}
|
|
|
|
const entries = fs
|
|
.readdirSync(requestedPath, { withFileTypes: true })
|
|
.map((entry) => {
|
|
try {
|
|
return getLocalEntry(
|
|
path.join(requestedPath, entry.name),
|
|
entry.name,
|
|
);
|
|
} catch {
|
|
return null;
|
|
}
|
|
})
|
|
.filter(Boolean)
|
|
.sort((a, b) => {
|
|
if (a.type === "directory" && b.type !== "directory") return -1;
|
|
if (a.type !== "directory" && b.type === "directory") return 1;
|
|
return a.name.localeCompare(b.name);
|
|
});
|
|
|
|
return {
|
|
success: true,
|
|
path: requestedPath,
|
|
parent: path.dirname(requestedPath),
|
|
entries,
|
|
};
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
path: typeof dirPath === "string" ? dirPath : "",
|
|
entries: [],
|
|
error: error instanceof Error ? error.message : "Failed to list path",
|
|
};
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("stat-local-paths", (_event, paths) => {
|
|
const pathList = Array.isArray(paths) ? paths : [];
|
|
return pathList.map((entryPath) => {
|
|
try {
|
|
return { success: true, ...getLocalEntry(entryPath) };
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
path: entryPath,
|
|
error: error instanceof Error ? error.message : "Failed to stat path",
|
|
};
|
|
}
|
|
});
|
|
});
|
|
|
|
ipcMain.handle("collect-local-files", (_event, paths) => {
|
|
try {
|
|
const pathList = Array.isArray(paths) ? paths : [];
|
|
const files = [];
|
|
const limit = 10000;
|
|
|
|
for (const entryPath of pathList) {
|
|
if (typeof entryPath !== "string" || !entryPath) continue;
|
|
collectLocalFilesFromPath(
|
|
entryPath,
|
|
path.basename(entryPath),
|
|
files,
|
|
limit + 1,
|
|
);
|
|
if (files.length > limit) break;
|
|
}
|
|
|
|
return {
|
|
success: true,
|
|
files: files.slice(0, limit),
|
|
truncated: files.length > limit,
|
|
};
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
files: [],
|
|
error: error instanceof Error ? error.message : "Failed to collect files",
|
|
};
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("create-local-folder", (_event, parentPath, folderName) => {
|
|
try {
|
|
ensureLocalDirectory(parentPath);
|
|
const safeName = validateLocalName(folderName);
|
|
const targetPath = path.join(parentPath, safeName);
|
|
fs.mkdirSync(targetPath);
|
|
return { success: true, ...getLocalEntry(targetPath, safeName) };
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
error: error instanceof Error ? error.message : "Failed to create folder",
|
|
};
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("rename-local-path", (_event, entryPath, newName) => {
|
|
try {
|
|
if (typeof entryPath !== "string" || !entryPath) {
|
|
throw new Error("Missing path");
|
|
}
|
|
const safeName = validateLocalName(newName);
|
|
const targetPath = path.join(path.dirname(entryPath), safeName);
|
|
renameLocalPath(entryPath, targetPath);
|
|
return { success: true, ...getLocalEntry(targetPath, safeName) };
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
error: error instanceof Error ? error.message : "Failed to rename path",
|
|
};
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("trash-local-path", async (_event, entryPath) => {
|
|
try {
|
|
if (typeof entryPath !== "string" || !entryPath) {
|
|
throw new Error("Missing path");
|
|
}
|
|
await shell.trashItem(entryPath);
|
|
return { success: true };
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
error: error instanceof Error ? error.message : "Failed to delete path",
|
|
};
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("chmod-local-path", (_event, entryPath, permissions) => {
|
|
try {
|
|
if (typeof entryPath !== "string" || !entryPath) {
|
|
throw new Error("Missing path");
|
|
}
|
|
if (typeof permissions !== "string" || !/^[0-7]{3,4}$/.test(permissions)) {
|
|
throw new Error("Permissions must be an octal value");
|
|
}
|
|
fs.chmodSync(entryPath, parseInt(permissions, 8));
|
|
return { success: true, ...getLocalEntry(entryPath) };
|
|
} catch (error) {
|
|
return {
|
|
success: false,
|
|
error:
|
|
error instanceof Error ? error.message : "Failed to update permissions",
|
|
};
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("create-temp-file", async (_event, fileData) => {
|
|
try {
|
|
const result = createManagedTempFile(
|
|
fileData?.fileName,
|
|
fileData?.content,
|
|
fileData?.encoding,
|
|
);
|
|
return { success: true, ...result };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("create-temp-folder", async (_event, folderData) => {
|
|
try {
|
|
const tempId = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
|
|
const tempDir = fs.mkdtempSync(path.join(getTempRoot(), `${tempId}-`));
|
|
const folderPath = path.join(
|
|
tempDir,
|
|
sanitizeFileName(folderData?.folderName || "files"),
|
|
);
|
|
fs.mkdirSync(folderPath, { recursive: true });
|
|
|
|
for (const file of folderData?.files || []) {
|
|
const relativePath = String(file.relativePath || "")
|
|
.split(/[\\/]+/)
|
|
.map(sanitizeFileName)
|
|
.filter(Boolean)
|
|
.join(path.sep);
|
|
if (!relativePath) continue;
|
|
const targetPath = path.join(folderPath, relativePath);
|
|
fs.mkdirSync(path.dirname(targetPath), { recursive: true });
|
|
fs.writeFileSync(
|
|
targetPath,
|
|
decodeFileContent(file.content, file.encoding),
|
|
);
|
|
}
|
|
|
|
tempFiles.set(tempId, { path: folderPath, dir: tempDir });
|
|
return { success: true, tempId, path: folderPath };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("start-drag-to-desktop", (event, dragData) => {
|
|
try {
|
|
const temp = tempFiles.get(dragData?.tempId);
|
|
if (!temp) return { success: false, error: "Temporary file not found" };
|
|
|
|
event.sender.startDrag({
|
|
file: temp.path,
|
|
icon: nativeImage.createEmpty(),
|
|
});
|
|
return { success: true };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("cleanup-temp-file", (_event, tempId) => {
|
|
try {
|
|
cleanupManagedTempFile(tempId);
|
|
return { success: true };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("open-external-editor", async (_event, fileData) => {
|
|
try {
|
|
// The editor comes from the saved setting, never from the caller.
|
|
const editorPath = readSetting(EXTERNAL_EDITOR_SETTING) || null;
|
|
if (!editorPath && isLaunchableFileName(fileData?.fileName)) {
|
|
return {
|
|
success: false,
|
|
error: "Choose an external editor to open this file type",
|
|
};
|
|
}
|
|
|
|
const result = createManagedTempFile(
|
|
fileData?.fileName,
|
|
fileData?.content,
|
|
fileData?.encoding,
|
|
);
|
|
const editId = result.tempId;
|
|
const stat = fs.statSync(result.path);
|
|
const watcher = fs.watch(result.path, { persistent: false }, () => {
|
|
const session = externalEditorSessions.get(editId);
|
|
if (!session) return;
|
|
if (session.timer) clearTimeout(session.timer);
|
|
session.timer = setTimeout(() => notifyExternalEditorSaved(editId), 500);
|
|
});
|
|
|
|
externalEditorSessions.set(editId, {
|
|
path: result.path,
|
|
watcher,
|
|
timer: null,
|
|
lastMtimeMs: stat.mtimeMs,
|
|
});
|
|
|
|
const openError = await openPathWithEditor(result.path, editorPath);
|
|
if (openError) {
|
|
closeExternalEditorSession(editId);
|
|
return { success: false, error: openError };
|
|
}
|
|
|
|
return { success: true, editId, path: result.path };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
ipcMain.handle("close-external-editor", (_event, editId) => {
|
|
try {
|
|
closeExternalEditorSession(editId);
|
|
return { success: true };
|
|
} catch (error) {
|
|
return { success: false, error: error.message };
|
|
}
|
|
});
|
|
|
|
// Local disk browsing + streamed local<->remote transfers for the file
|
|
// manager's dual-pane mode (see electron/local-files.cjs).
|
|
registerLocalFileHandlers({ ipcMain, shell });
|
|
|
|
function createMenu() {
|
|
if (process.platform === "darwin") {
|
|
const template = [
|
|
{
|
|
label: app.name,
|
|
submenu: [
|
|
{ role: "about" },
|
|
{ type: "separator" },
|
|
{ role: "services" },
|
|
{ type: "separator" },
|
|
{ role: "hide" },
|
|
{ role: "hideOthers" },
|
|
{ role: "unhide" },
|
|
{ type: "separator" },
|
|
{ role: "quit" },
|
|
],
|
|
},
|
|
{
|
|
label: "Edit",
|
|
submenu: [
|
|
{ role: "undo" },
|
|
{ role: "redo" },
|
|
{ type: "separator" },
|
|
{ role: "cut" },
|
|
{ role: "copy" },
|
|
{ role: "paste" },
|
|
{ role: "selectAll" },
|
|
],
|
|
},
|
|
{
|
|
label: "View",
|
|
submenu: [
|
|
{ role: "reload" },
|
|
{ role: "forceReload" },
|
|
{ role: "toggleDevTools" },
|
|
{ type: "separator" },
|
|
{ role: "resetZoom" },
|
|
{ role: "zoomIn" },
|
|
{ role: "zoomOut" },
|
|
{ type: "separator" },
|
|
{ role: "togglefullscreen" },
|
|
],
|
|
},
|
|
{
|
|
label: "Window",
|
|
submenu: [
|
|
{ role: "minimize" },
|
|
{ role: "zoom" },
|
|
{ type: "separator" },
|
|
{ role: "front" },
|
|
{ type: "separator" },
|
|
{ role: "window" },
|
|
],
|
|
},
|
|
];
|
|
const menu = Menu.buildFromTemplate(template);
|
|
Menu.setApplicationMenu(menu);
|
|
}
|
|
}
|
|
|
|
app.whenReady().then(async () => {
|
|
logToFile("=== App ready ===");
|
|
logToFile(
|
|
"isDev:",
|
|
isDev,
|
|
"platform:",
|
|
process.platform,
|
|
"arch:",
|
|
process.arch,
|
|
);
|
|
if (process.platform === "win32") {
|
|
app.setAppUserModelId(windowsAppUserModelId);
|
|
}
|
|
createMenu();
|
|
await clearElectronClientCacheIfBuildChanged();
|
|
await clearElectronJwtCookiesAtStartup();
|
|
|
|
if (!isDev) {
|
|
backendPort = await findBackendPort();
|
|
setLocalBackendPort(backendPort);
|
|
const result = await startBackendServer();
|
|
logToFile("startBackendServer result:", result);
|
|
} else {
|
|
logToFile(
|
|
"Skipping embedded backend (isDev=true) - expecting the dev runner's backend",
|
|
);
|
|
if (isDevRunner()) {
|
|
process.on("message", (msg) => void handleBackendRequest(msg));
|
|
}
|
|
}
|
|
|
|
createTray();
|
|
createWindow();
|
|
startAppUpdater();
|
|
desktopSettings.removeOldSyncFiles();
|
|
logToFile("=== Startup complete ===");
|
|
});
|
|
|
|
app.on("window-all-closed", () => {
|
|
if (!tray || tray.isDestroyed()) {
|
|
app.quit();
|
|
}
|
|
});
|
|
|
|
app.on("activate", () => {
|
|
if (BrowserWindow.getAllWindows().length === 0) {
|
|
createWindow();
|
|
} else if (mainWindow) {
|
|
mainWindow.show();
|
|
mainWindow.focus();
|
|
}
|
|
});
|
|
|
|
app.on("before-quit", () => {
|
|
isQuitting = true;
|
|
});
|
|
|
|
app.on("will-quit", () => {
|
|
console.log("App will quit...");
|
|
for (const editId of externalEditorSessions.keys()) {
|
|
closeExternalEditorSession(editId);
|
|
}
|
|
for (const tempId of tempFiles.keys()) {
|
|
cleanupManagedTempFile(tempId);
|
|
}
|
|
stopAllC2STunnels();
|
|
stopBackendServer();
|
|
});
|
|
|
|
process.on("uncaughtException", (error) => {
|
|
console.error("Uncaught Exception:", error);
|
|
});
|
|
|
|
process.on("unhandledRejection", (reason, promise) => {
|
|
console.error("Unhandled Rejection at:", promise, "reason:", reason);
|
|
});
|