[Init] Initial commit - NetMesh terminal manager

electron/bridges/sftpBridge/scpShell.cjs

@@ -0,0 +1,443 @@
+/**
+ * Shell quoting + remote browse/manage command builders for SCP-mode sessions.
+ * Pure helpers — no SSH I/O. Commands are designed for POSIX / BusyBox shells.
+ */
+
+"use strict";
+
+class ScpShellError extends Error {
+  constructor(message, code = "SCP_SHELL_ERROR") {
+    super(message);
+    this.name = "ScpShellError";
+    this.code = code;
+  }
+}
+
+/**
+ * Single-quote a remote path/argument for POSIX sh.
+ * Rejects NUL and rejects empty strings for path ops (callers may allow empty for flags).
+ */
+function shellQuote(value, { allowEmpty = false } = {}) {
+  if (value == null) {
+    throw new ScpShellError("Shell argument is required");
+  }
+  const str = String(value);
+  if (str.includes("\0")) {
+    throw new ScpShellError("Shell argument must not contain NUL");
+  }
+  if (!allowEmpty && str.length === 0) {
+    throw new ScpShellError("Shell argument must not be empty");
+  }
+  // ' -> '\''  (end quote, escaped quote, re-open)
+  return `'${str.replace(/'/g, `'\\''`)}'`;
+}
+
+/**
+ * Validate a remote path used in shell commands.
+ * Blocks obvious injection patterns beyond quoting (newlines).
+ */
+function assertSafeRemotePath(remotePath) {
+  if (typeof remotePath !== "string" || !remotePath) {
+    throw new ScpShellError("Remote path is required");
+  }
+  if (remotePath.includes("\0") || /[\r\n]/.test(remotePath)) {
+    throw new ScpShellError("Remote path must not contain NUL or newlines");
+  }
+  return remotePath;
+}
+
+/**
+ * Build `scp -t` sink command (upload to remote directory parent).
+ * Destination is the directory that will receive the file named in the C line.
+ */
+function buildScpSinkCommand(remoteDir, encoding = "utf-8") {
+  const dir = assertSafeRemotePath(remoteDir || ".");
+  return `scp -t -- ${shellQuotePath(dir, encoding)}`;
+}
+
+/**
+ * Build `scp -f` source command (download from remote path).
+ */
+function buildScpSourceCommand(remotePath, encoding = "utf-8") {
+  const p = assertSafeRemotePath(remotePath);
+  return `scp -f -- ${shellQuotePath(p, encoding)}`;
+}
+
+/**
+ * Portable directory listing that emits one record per line:
+ *   T|MODE|SIZE|MTIME|B64NAME
+ * where T is f/d/l (file/dir/link), MODE is octal perms, MTIME unix seconds,
+ * B64NAME is base64 of the basename (handles spaces/unicode safely).
+ *
+ * Uses a POSIX-oriented shell loop; avoids GNU-only find -printf.
+ */
+function buildListCommand(remotePath, encoding = "utf-8") {
+  const p = assertSafeRemotePath(remotePath);
+  const q = shellQuotePath(p, encoding);
+  // Join the for-loop body with newlines so we never emit invalid `do;` (`;`
+  // after `do` is a syntax error on POSIX sh and would force the ls -la fallback).
+  const loop = [
+    "for f in * .[!.]* ..?*; do",
+    // Include broken symlinks: -e is false for dangling links, but -L is true.
+    '  { [ -e "$f" ] || [ -L "$f" ]; } || continue',
+    '  [ "$f" = "." ] && continue',
+    '  [ "$f" = ".." ] && continue',
+    '  if [ -L "$f" ]; then t=l',
+    '  elif [ -d "$f" ]; then t=d',
+    '  else t=f; fi',
+    '  lsline=$(ls -ld -- "$f" 2>/dev/null)',
+    '  mode=$(printf "%s\\n" "$lsline" | awk \'{print $1}\')',
+    '  owner=$(printf "%s\\n" "$lsline" | awk \'{print $3}\')',
+    // Use metadata only — never open the file (FIFOs/special files would hang on wc -c).
+    '  size=$(stat -c %s -- "$f" 2>/dev/null || stat -f %z -- "$f" 2>/dev/null || echo 0)',
+    '  [ -z "$size" ] && size=0',
+    '  mtime=$(date -r "$f" +%s 2>/dev/null || stat -c %Y -- "$f" 2>/dev/null || stat -f %m -- "$f" 2>/dev/null || echo 0)',
+    // basename base64: prefer base64 -w0 (GNU), fallback base64, then od
+    // Prefer `base64` when present; otherwise openssl. Avoid `cmd | tr || fallback`
+    // because a missing base64 still lets tr succeed with empty input.
+    '  if command -v base64 >/dev/null 2>&1; then b64=$(printf "%s" "$f" | base64 2>/dev/null | tr -d "\\r\\n")',
+    '  elif command -v openssl >/dev/null 2>&1; then b64=$(printf "%s" "$f" | openssl base64 2>/dev/null | tr -d "\\r\\n")',
+    '  else b64=; fi',
+    '  printf "%s|%s|%s|%s|%s|%s\\n" "$t" "${mode:-?}" "$size" "$mtime" "$b64" "${owner:-}"',
+    "done",
+  ].join("\n");
+  return `cd ${q} || exit 1; ${loop}`;
+}
+
+/**
+ * Simpler listing using `ls -la` as a fallback parse path (for tests / remotes
+ * where the loop above is too heavy). Primary runtime still prefers buildListCommand.
+ */
+function buildListCommandLs(remotePath, encoding = "utf-8") {
+  const p = assertSafeRemotePath(remotePath);
+  const q = shellQuotePath(p, encoding);
+  return `LC_ALL=C ls -la -- ${q} 2>/dev/null || LC_ALL=C ls -la ${q}`;
+}
+
+function buildStatCommand(remotePath, encoding = "utf-8") {
+  const p = assertSafeRemotePath(remotePath);
+  const q = shellQuotePath(p, encoding);
+  // Emit: T|MODE_OCT|SIZE|MTIME|ABS|INO
+  // INO is optional identity for staged-upload race checks (SFTP v3 has none).
+  return [
+    `p=${q}`,
+    'if [ ! -e "$p" ] && [ ! -L "$p" ]; then echo "ENOENT" >&2; exit 2; fi',
+    'if [ -L "$p" ]; then t=l',
+    'elif [ -d "$p" ]; then t=d',
+    'else t=f; fi',
+    'mode=$(ls -ld -- "$p" 2>/dev/null | awk \'{print $1}\')',
+    'size=$(stat -c %s -- "$p" 2>/dev/null || stat -f %z -- "$p" 2>/dev/null || echo 0)',
+    'mtime=$(date -r "$p" +%s 2>/dev/null || stat -c %Y -- "$p" 2>/dev/null || stat -f %m -- "$p" 2>/dev/null || echo 0)',
+    'abs=$(cd "$(dirname -- "$p")" 2>/dev/null && printf "%s/%s\\n" "$(pwd -P 2>/dev/null || pwd)" "$(basename -- "$p")" || printf "%s\\n" "$p")',
+    'ino=$(stat -c %i -- "$p" 2>/dev/null || stat -f %i -- "$p" 2>/dev/null || echo)',
+    'printf "%s|%s|%s|%s|%s|%s\\n" "$t" "${mode:-?}" "${size:-0}" "${mtime:-0}" "$abs" "${ino}"',
+  ].join("; ");
+}
+
+function buildMkdirCommand(remotePath, { recursive = true, encoding = "utf-8" } = {}) {
+  const p = assertSafeRemotePath(remotePath);
+  const q = shellQuotePath(p, encoding);
+  return recursive
+    ? `mkdir -p -- ${q}`
+    : `mkdir -- ${q}`;
+}
+
+function buildDeleteCommand(remotePath, { recursive = false, encoding = "utf-8" } = {}) {
+  const p = assertSafeRemotePath(remotePath);
+  const q = shellQuotePath(p, encoding);
+  if (recursive) {
+    return `rm -rf -- ${q}`;
+  }
+  return `rm -f -- ${q} 2>/dev/null || rmdir -- ${q}`;
+}
+
+function buildUnlinkCommand(remotePath, encoding = "utf-8") {
+  const p = assertSafeRemotePath(remotePath);
+  const q = shellQuotePath(p, encoding);
+  return `rm -f -- ${q}`;
+}
+
+function buildRenameCommand(oldPath, newPath, encoding = "utf-8") {
+  const a = shellQuotePath(assertSafeRemotePath(oldPath), encoding);
+  const b = shellQuotePath(assertSafeRemotePath(newPath), encoding);
+  return `mv -- ${a} ${b}`;
+}
+
+function buildChmodCommand(remotePath, modeOctal, encoding = "utf-8") {
+  const p = assertSafeRemotePath(remotePath);
+  const mode = String(modeOctal);
+  if (!/^[0-7]{3,4}$/.test(mode)) {
+    throw new ScpShellError(`Invalid chmod mode: ${mode}`);
+  }
+  // Mode is validated digits-only; path is shell-quoted.
+  return `chmod ${mode} -- ${shellQuotePath(p, encoding)}`;
+}
+
+function buildHomeCommand() {
+  return 'printf "%s\\n" "$HOME"';
+}
+
+function buildRealpathCommand(remotePath, encoding = "utf-8") {
+  const p = assertSafeRemotePath(remotePath);
+  const q = shellQuotePath(p, encoding);
+  return (
+    `realpath -- ${q} 2>/dev/null || ` +
+    `readlink -f -- ${q} 2>/dev/null || ` +
+    `(cd ${q} 2>/dev/null && pwd -P) || ` +
+    `(cd "$(dirname -- ${q})" 2>/dev/null && printf "%s/%s\\n" "$(pwd -P 2>/dev/null || pwd)" "$(basename -- ${q})")`
+  );
+}
+
+/**
+ * Decode a base64-encoded remote basename using the session filename encoding.
+ * @param {string} b64
+ * @param {string} [encoding] utf-8 | gb18030 | auto
+ */
+function decodeListBasename(b64, encoding = "utf-8") {
+  const raw = Buffer.from(b64, "base64");
+  const enc = String(encoding || "utf-8").toLowerCase();
+  if (enc === "gb18030" || enc === "gbk" || enc === "gb2312") {
+    try {
+      // eslint-disable-next-line global-require
+      const iconv = require("iconv-lite");
+      return iconv.decode(raw, "gb18030");
+    } catch {
+      return raw.toString("utf8");
+    }
+  }
+  return raw.toString("utf8");
+}
+
+/**
+ * Quote a remote path for shell, encoding non-UTF-8 path bytes when needed.
+ * For gb18030 hosts the remote filesystem expects gb18030 bytes, not UTF-8.
+ */
+function shellQuotePath(remotePath, encoding = "utf-8") {
+  assertSafeRemotePath(remotePath);
+  const enc = String(encoding || "utf-8").toLowerCase();
+  if (enc === "gb18030" || enc === "gbk" || enc === "gb2312") {
+    // eslint-disable-next-line global-require
+    const iconv = require("iconv-lite");
+    const b64 = iconv.encode(remotePath, "gb18030").toString("base64");
+    // Expand base64 to raw bytes on the remote. Prefer base64, then openssl
+    // (same fallback used when listing names on minimal NAS hosts).
+    return `"$(printf '%s' '${b64}' | base64 -d 2>/dev/null || printf '%s' '${b64}' | base64 -D 2>/dev/null || printf '%s' '${b64}' | openssl base64 -d 2>/dev/null || printf '%s' '${b64}' | openssl enc -base64 -d 2>/dev/null)"`;
+  }
+  return shellQuote(remotePath);
+}
+
+/**
+ * Parse a username from an SFTP longname / `ls -l` line.
+ * Example: "-rwxr-xr-x  1 root  root  4096 Jan 1 00:00 filename"
+ */
+function ownerFromSftpLongname(longname) {
+  if (!longname) return undefined;
+  const match = String(longname).match(/^[dlbcps\-][rwxsStT\-]{9}[+.@]?\s+\d+\s+(\S+)\s+\S+\s+/);
+  const owner = match?.[1]?.trim();
+  return owner || undefined;
+}
+
+function ownerFromUid(uid) {
+  if (typeof uid !== "number" || !Number.isFinite(uid)) return undefined;
+  return String(uid);
+}
+
+function normalizeListingOwner(value) {
+  if (typeof value !== "string") return undefined;
+  const owner = value.trim();
+  if (!owner || owner === "?" || owner === "UNKNOWN") return undefined;
+  return owner;
+}
+
+function resolveListingOwner({ owner, longname, uid } = {}) {
+  return normalizeListingOwner(owner)
+    || ownerFromSftpLongname(longname)
+    || ownerFromUid(uid);
+}
+
+/**
+ * Parse records from buildListCommand output.
+ * @returns {Array<{ name: string, type: 'file'|'directory'|'symlink', size: number, modifyTime: number, permissions?: string, owner?: string }>}
+ */
+function parseListRecords(stdout, encoding = "utf-8") {
+  const lines = String(stdout || "").split(/\r?\n/).filter(Boolean);
+  const results = [];
+  for (const line of lines) {
+    const parts = line.split("|");
+    if (parts.length < 5) continue;
+    const [t, modeStr, sizeStr, mtimeStr, b64, ownerRaw] = parts;
+    let name;
+    try {
+      name = decodeListBasename(b64, encoding);
+    } catch {
+      continue;
+    }
+    if (!name || name === "." || name === "..") continue;
+    const type = t === "d" ? "directory" : t === "l" ? "symlink" : "file";
+    const size = Number(sizeStr) || 0;
+    const modifyTime = (Number(mtimeStr) || 0) * 1000;
+    const permissions = parseLsModeToPermissions(modeStr);
+    const owner = resolveListingOwner({ owner: ownerRaw });
+    results.push({ name, type, size, modifyTime, permissions, ...(owner ? { owner } : {}) });
+  }
+  return results;
+}
+
+/**
+ * Parse classic `ls -la` output as a fallback.
+ */
+function parseLsLaOutput(stdout, { basePath = "" } = {}) {
+  const lines = String(stdout || "").split(/\r?\n/);
+  const results = [];
+  for (const line of lines) {
+    if (!line || line.startsWith("total ")) continue;
+    // permissions links owner group size month day time/year name
+    const match = line.match(
+      /^([dlbcps\-])([rwxsStT\-]{9})[+.@]?\s+\d+\s+(\S+)\s+\S+\s+(\d+)\s+(\S+\s+\S+\s+\S+)\s+(.+)$/,
+    );
+    if (!match) continue;
+    const typeChar = match[1];
+    const perm = match[2];
+    const owner = resolveListingOwner({ owner: match[3] });
+    const size = Number(match[4]) || 0;
+    let name = match[6];
+    // strip " -> target" only for symlink rows (backslash filenames may contain " -> ")
+    if (typeChar === "l") {
+      const arrow = name.indexOf(" -> ");
+      if (arrow >= 0) name = name.slice(0, arrow);
+    }
+    name = name.trim();
+    if (!name || name === "." || name === "..") continue;
+    // when listing a directory, ls -la path shows path prefix sometimes — use basename
+    if (name.includes("/") && basePath) {
+      const base = name.endsWith("/") ? name.slice(0, -1) : name;
+      const idx = base.lastIndexOf("/");
+      if (idx >= 0) name = base.slice(idx + 1);
+    }
+    const type = typeChar === "d" ? "directory" : typeChar === "l" ? "symlink" : "file";
+    results.push({
+      name,
+      type,
+      size,
+      modifyTime: Date.now(),
+      permissions: perm,
+      ...(owner ? { owner } : {}),
+    });
+  }
+  return results;
+}
+
+function parseStatRecord(stdout) {
+  const line = String(stdout || "").trim().split(/\r?\n/)[0] || "";
+  if (!line || line === "ENOENT") {
+    const err = new ScpShellError("No such file", "ENOENT");
+    err.code = "ENOENT";
+    throw err;
+  }
+  const parts = line.split("|");
+  if (parts.length < 5) {
+    throw new ScpShellError(`Malformed stat record: ${line.slice(0, 80)}`);
+  }
+  const [t, modeStr, sizeStr, mtimeStr, abs, inoStr] = parts;
+  const ino = inoStr && /^\d+$/.test(String(inoStr).trim())
+    ? String(inoStr).trim()
+    : undefined;
+  return {
+    type: t === "d" ? "directory" : t === "l" ? "symlink" : "file",
+    isDirectory: t === "d",
+    isSymbolicLink: t === "l",
+    size: Number(sizeStr) || 0,
+    modifyTime: (Number(mtimeStr) || 0) * 1000,
+    mode: lsModeToNumber(modeStr),
+    permissions: parseLsModeToPermissions(modeStr),
+    path: abs,
+    ...(ino ? { ino } : {}),
+  };
+}
+
+function parseLsModeToPermissions(modeStr) {
+  if (!modeStr || modeStr === "?") return undefined;
+  // -rwxr-xr-x or drwxr-xr-x → rwxr-xr-x
+  if (modeStr.length >= 10) return modeStr.slice(1, 10);
+  if (modeStr.length === 9) return modeStr;
+  return undefined;
+}
+
+function lsModeToNumber(modeStr) {
+  const perm = parseLsModeToPermissions(modeStr);
+  if (!perm || perm.length < 9) return 0;
+  const bit = (ch, w, r, x) => {
+    if (ch === "r") return r;
+    if (ch === "w") return w;
+    // lowercase s/t include execute; uppercase S/T are special-bit-only
+    if (ch === "x" || ch === "s" || ch === "t") return x;
+    return 0;
+  };
+  let mode = 0;
+  mode |= bit(perm[0], 0, 0o400, 0);
+  mode |= bit(perm[1], 0o200, 0, 0);
+  mode |= bit(perm[2], 0, 0, 0o100);
+  mode |= bit(perm[3], 0, 0o040, 0);
+  mode |= bit(perm[4], 0o020, 0, 0);
+  mode |= bit(perm[5], 0, 0, 0o010);
+  mode |= bit(perm[6], 0, 0o004, 0);
+  mode |= bit(perm[7], 0o002, 0, 0);
+  mode |= bit(perm[8], 0, 0, 0o001);
+  // Special bits: setuid / setgid / sticky (s/S in user/group exec, t/T in other)
+  if (perm[2] === "s" || perm[2] === "S") mode |= 0o4000;
+  if (perm[5] === "s" || perm[5] === "S") mode |= 0o2000;
+  if (perm[8] === "t" || perm[8] === "T") mode |= 0o1000;
+  return mode;
+}
+
+function modeToPermissionsString(mode) {
+  if (typeof mode !== "number") return undefined;
+  const toTriplet = (bits) =>
+    `${bits & 4 ? "r" : "-"}${bits & 2 ? "w" : "-"}${bits & 1 ? "x" : "-"}`;
+  return `${toTriplet((mode >> 6) & 7)}${toTriplet((mode >> 3) & 7)}${toTriplet(mode & 7)}`;
+}
+
+/**
+ * Normalize file protocol preference from host/open options.
+ * @returns {'auto'|'sftp'|'scp'}
+ */
+function normalizeFileProtocol(value) {
+  const v = String(value || "auto").toLowerCase().trim();
+  if (v === "sftp" || v === "scp") return v;
+  return "auto";
+}
+
+function isScpModeClient(client) {
+  return !!(client && client.__netcattyFileProtocol === "scp");
+}
+
+module.exports = {
+  ScpShellError,
+  shellQuote,
+  assertSafeRemotePath,
+  buildScpSinkCommand,
+  buildScpSourceCommand,
+  buildListCommand,
+  buildListCommandLs,
+  buildStatCommand,
+  buildMkdirCommand,
+  buildDeleteCommand,
+  buildUnlinkCommand,
+  buildRenameCommand,
+  buildChmodCommand,
+  buildHomeCommand,
+  buildRealpathCommand,
+  parseListRecords,
+  parseLsLaOutput,
+  ownerFromSftpLongname,
+  ownerFromUid,
+  resolveListingOwner,
+  parseStatRecord,
+  parseLsModeToPermissions,
+  lsModeToNumber,
+  modeToPermissionsString,
+  decodeListBasename,
+  shellQuotePath,
+  normalizeFileProtocol,
+  isScpModeClient,
+};