[Init] Initial commit - NetMesh terminal manager

electron/bridges/sshBridge/execCommand.cjs

@@ -0,0 +1,219 @@
+/* eslint-disable no-undef */
+const { runWhenProxyConnectionReady } = require("../proxyUtils.cjs");
+const { executeBoundedSshCommand } = require("../boundedSshExec.cjs");
+
+const SSH_EXEC_COMMAND_MAX_OUTPUT_BYTES = 1024 * 1024;
+
+function createExecCommandApi(ctx) {
+  with (ctx) {
+    async function execCommand(event, payload) {
+      const enableKeyboardInteractive = !!payload.enableKeyboardInteractive;
+      const commandTimeoutMs = payload.timeout || 10000;
+      const { tcpConnectTimeoutMs, authReadyTimeoutMs } = resolveSshConnectionTimeouts(payload);
+      const sender = event.sender;
+      const sessionId = payload.sessionId || randomUUID();
+      const hasCertificate = typeof payload.certificate === "string" && payload.certificate.trim().length > 0;
+      const fallbackAgentSocket = payload.useSshAgent === false
+        ? null
+        : payload.useSshAgent === true
+          ? undefined
+          : await getAvailableAgentSocket();
+      const systemAuthAgent = hasCertificate
+        ? null
+        : await prepareSystemSshAgentForAuth(payload, "[SSH Exec]");
+      const defaultKeys = enableKeyboardInteractive && !(systemAuthAgent && payload.identitiesOnly)
+        ? await findAllDefaultPrivateKeysFromHelper()
+        : [];
+      let identityFilePrivateKey = null;
+      let identityFilePassphrase = null;
+      const inlineKey = payload.privateKey && !systemAuthAgent
+        ? await preparePrivateKeyForAuth({
+          sender,
+          privateKey: payload.privateKey,
+          keyId: payload.keyId,
+          keyName: payload.keyId || payload.username,
+          hostname: payload.hostname,
+          initialPassphrase: payload.passphrase,
+          logPrefix: "[SSH Exec]",
+        })
+        : null;
+    
+      if (!payload.privateKey && !systemAuthAgent && payload.identityFilePaths?.length > 0) {
+        for (const keyPath of payload.identityFilePaths) {
+          try {
+            const identityFile = await loadIdentityFileForAuth({
+              sender,
+              keyPath,
+              hostname: payload.hostname,
+              initialPassphrase: payload.passphrase,
+              logPrefix: "[SSH Exec]",
+            });
+            if (!identityFile) {
+              continue;
+            }
+            identityFilePrivateKey = identityFile.privateKey;
+            identityFilePassphrase = identityFile.passphrase || null;
+            break;
+          } catch (err) {
+            if (isPassphraseCancelledError(err)) {
+              throw err;
+            }
+            console.warn("[SSH Exec] Failed to read identity file:", err?.message || err);
+          }
+        }
+      }
+    
+      return new Promise((resolve, reject) => {
+        const conn = new SSHClient();
+        let settled = false;
+        let authReadyTimer = null;
+        let commandController = null;
+        const clearTimers = () => {
+          if (authReadyTimer) clearTimeout(authReadyTimer);
+          authReadyTimer = null;
+        };
+        const rejectConnection = (err) => {
+          if (settled) return;
+          settled = true;
+          clearTimers();
+          commandController?.abort?.(err);
+          conn.end();
+          reject(err);
+        };
+    
+        conn
+          .once("connect", () => {
+            runWhenProxyConnectionReady(conn._sock, () => {
+              try { conn._sock?.setTimeout?.(0); } catch { /* ignore */ }
+              authReadyTimer = setTimeout(() => {
+                rejectConnection(new Error(`SSH authentication timeout to ${payload.hostname}`));
+              }, authReadyTimeoutMs);
+              authReadyTimer.unref?.();
+            });
+          })
+          .once("ready", () => {
+            if (authReadyTimer) clearTimeout(authReadyTimer);
+            authReadyTimer = null;
+            commandController = new AbortController();
+            void executeBoundedSshCommand(conn, payload.command, {
+              signal: commandController.signal,
+              openingTimeoutMs: commandTimeoutMs,
+              runTimeoutMs: commandTimeoutMs,
+              maxOutputBytes: SSH_EXEC_COMMAND_MAX_OUTPUT_BYTES,
+            }).then((result) => {
+              if (settled) return;
+              settled = true;
+              clearTimers();
+              conn.end();
+              resolve({
+                stdout: result.stdout,
+                stderr: result.stderr,
+                code: result.code ?? (result.stderr ? 1 : 0),
+              });
+            }, rejectConnection);
+          })
+          .on("error", (err) => {
+            rejectConnection(err);
+          })
+          .once("timeout", () => {
+            rejectConnection(new Error(`SSH connection timeout to ${payload.hostname}`));
+          })
+          .once("end", () => {
+            if (settled) return;
+            rejectConnection(new Error("SSH connection closed unexpectedly"));
+          });
+    
+        const connectOpts = {
+          host: payload.hostname,
+          port: payload.port || 22,
+          username: payload.username,
+          timeout: tcpConnectTimeoutMs,
+          readyTimeout: 0,
+          keepaliveInterval: 0,
+          // Honor the host's algorithm settings so one-off commands (e.g. the
+          // keychain "export public key to host" flow) negotiate with the same
+          // KEX / cipher / host-key set as the interactive terminal. Without
+          // this, a host that needs the ECDSA skip or legacy algorithms would
+          // connect in the terminal but still fail the same handshake here.
+          algorithms: buildAlgorithms(payload.legacyAlgorithms, {
+            skipEcdsaHostKey: payload.skipEcdsaHostKey,
+            algorithmOverrides: payload.algorithmOverrides,
+          }),
+        };
+    
+        let authAgent = null;
+        const effectivePrivateKey = inlineKey?.privateKey || identityFilePrivateKey;
+        const effectivePassphrase = inlineKey?.passphrase || identityFilePassphrase;
+        if (systemAuthAgent) {
+          connectOpts.agent = systemAuthAgent;
+        } else if (hasCertificate) {
+          authAgent = new NetcattyAgent({
+            mode: "certificate",
+            webContents: event.sender,
+            meta: {
+              label: payload.keyId || payload.username || "",
+              certificate: payload.certificate,
+              privateKey: effectivePrivateKey,
+              passphrase: effectivePassphrase,
+            },
+          });
+          connectOpts.agent = authAgent;
+        } else if (effectivePrivateKey) {
+          connectOpts.privateKey = effectivePrivateKey;
+          if (effectivePassphrase) {
+            connectOpts.passphrase = effectivePassphrase;
+          }
+        }
+    
+        if (payload.password) connectOpts.password = payload.password;
+    
+        let authBanner = "";
+        if (enableKeyboardInteractive) {
+          connectOpts.tryKeyboard = true;
+    
+          const authConfig = buildAuthHandler({
+            authMethod: payload.authMethod,
+            requiresMfa: !!payload.requiresMfa,
+            privateKey: connectOpts.privateKey,
+            password: connectOpts.password,
+            passphrase: connectOpts.passphrase,
+            agent: connectOpts.agent,
+            username: connectOpts.username,
+            logPrefix: "[SSH Exec]",
+            defaultKeys,
+            sshAgentSocketOverride: fallbackAgentSocket,
+            allowAgentFallback: payload.useSshAgent !== false,
+          });
+    
+          applyAuthToConnOpts(connectOpts, authConfig);
+          const execAuthPhase = authConfig.authPhase || { hadPartialSuccess: false };
+
+          conn.on("banner", (message) => {
+            authBanner = String(message || "").trim();
+          });
+          conn.on("keyboard-interactive", createKeyboardInteractiveHandler({
+            sender,
+            sessionId,
+            hostId: payload.hostId,
+            hostname: payload.hostname,
+            password: payload.password,
+            logPrefix: "[SSH Exec]",
+            scope: "external",
+            getAuthBanner: () => authBanner,
+            shouldSkipAutoFill: () => shouldSkipKiPasswordAutoFill(execAuthPhase),
+          }));
+        } else if (connectOpts.agent) {
+          const order = ["agent"];
+          if (connectOpts.password) order.push("password");
+          connectOpts.authHandler = order;
+        }
+    
+        conn.connect(connectOpts);
+      });
+    }
+
+    return { execCommand };
+  }
+}
+
+module.exports = { createExecCommandApi, SSH_EXEC_COMMAND_MAX_OUTPUT_BYTES };