feat: direct TCP URI with SSL toggle and optional password auth (#635)

* feat: direct TCP URI with SSL toggle and optional password auth Replaces the heuristic-driven direct-connection model with a user-controlled one. The Add Host dialog now exposes structured Host, Port, "Use SSL", and masked Password fields that compose the canonical `tcp://host:port?ssl=true&password=xxx` URI used as the storage form. The daemon gains optional shared-secret auth: `Authorization: Bearer <pw>` on HTTP and `Sec-WebSocket-Protocol: paseo.bearer.<pw>` on the WS upgrade (browser WebSocket can't set custom headers). Configured via config.json `auth.password` or `PASEO_PASSWORD` env. Off by default — old clients keep working unchanged. The `port === 443` heuristic for ws/wss is gone; the explicit `useTls` flag drives scheme selection at every call site. * fix: stabilize direct tcp auth ci checks * fix: restore fetch stub in bootstrap smoke test * fix(app): collapse Advanced section in add-host modal * feat(server): hash daemon password in config * fix: update lockfile signatures and Nix hash * Improve direct TCP auth failures * Fix workspace cwd updates after rebase --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-04-30 22:05:49 +08:00
parent 30f7842e8f
commit 088a6c14c0
48 changed files with 1829 additions and 129 deletions
@@ -3,6 +3,7 @@ import { startCommand } from "./start.js";
 import { runStatusCommand } from "./status.js";
 import { runStopCommand } from "./stop.js";
 import { runRestartCommand } from "./restart.js";
+import { runSetPasswordCommand } from "./set-password.js";
 import { pairCommand } from "./pair.js";
 import { withOutput } from "../../output/index.js";
 import { addJsonOption } from "../../utils/command-options.js";
@@ -60,5 +61,13 @@ export function createDaemonCommand(): Command {
      }),
    );

+  addJsonOption(
+    daemon
+      .command("set-password")
+      .description("Prompt for and save a hashed daemon password to config.json"),
+  )
+    .option("--home <path>", "Paseo home directory (default: ~/.paseo)")
+    .action(withOutput(runSetPasswordCommand));
+
  return daemon;
 }
@@ -0,0 +1,126 @@
+import path from "node:path";
+import type { Command } from "commander";
+import { isCancel, password as passwordPrompt } from "@clack/prompts";
+import {
+  hashDaemonPassword,
+  loadPersistedConfig,
+  savePersistedConfig,
+  type PersistedConfig,
+} from "@getpaseo/server";
+import type {
+  CommandError,
+  CommandOptions,
+  OutputOptions,
+  OutputSchema,
+  SingleResult,
+} from "../../output/index.js";
+import { resolveLocalPaseoHome } from "./local-daemon.js";
+
+const CONFIG_FILENAME = "config.json";
+
+interface SetPasswordResult {
+  action: "password_set";
+  configPath: string;
+  restartCommand: string;
+  message: string;
+}
+
+export type PromptPassword = (message: string) => Promise<string | symbol>;
+
+export interface SetPasswordOptions {
+  home?: string;
+  promptPassword?: PromptPassword;
+}
+
+const setPasswordResultSchema: OutputSchema<SetPasswordResult> = {
+  idField: "action",
+  columns: [
+    { header: "STATUS", field: "action", color: () => "green" },
+    { header: "CONFIG", field: "configPath" },
+    { header: "RESTART", field: "restartCommand" },
+  ],
+  renderHuman: (result, options: OutputOptions) => {
+    const data = result.data as SetPasswordResult;
+    const rows = [
+      `Password written to ${data.configPath}`,
+      "Restart the daemon for the change to take effect.",
+      `Run: ${data.restartCommand}`,
+    ];
+    if (options.format === "table") {
+      return rows.join("\n");
+    }
+    return data.message;
+  },
+};
+
+function createCommandError(code: string, message: string, details?: string): CommandError {
+  return { code, message, ...(details ? { details } : {}) };
+}
+
+async function promptForPassword(promptPassword: PromptPassword): Promise<string> {
+  const first = await promptPassword("New daemon password");
+  if (isCancel(first)) {
+    throw createCommandError("PASSWORD_CANCELLED", "Password update cancelled");
+  }
+  if (typeof first !== "string" || first.length === 0) {
+    throw createCommandError("PASSWORD_REQUIRED", "Password cannot be empty");
+  }
+
+  const second = await promptPassword("Confirm daemon password");
+  if (isCancel(second)) {
+    throw createCommandError("PASSWORD_CANCELLED", "Password update cancelled");
+  }
+  if (first !== second) {
+    throw createCommandError("PASSWORD_MISMATCH", "Passwords do not match");
+  }
+
+  return first;
+}
+
+export async function setDaemonPasswordInConfig(
+  newPassword: string,
+  options: SetPasswordOptions = {},
+): Promise<SetPasswordResult> {
+  const paseoHome = resolveLocalPaseoHome(options.home);
+  const configPath = path.join(paseoHome, CONFIG_FILENAME);
+  const persisted = loadPersistedConfig(paseoHome);
+  const nextConfig: PersistedConfig = {
+    ...persisted,
+    daemon: {
+      ...persisted.daemon,
+      auth: {
+        ...persisted.daemon?.auth,
+        password: hashDaemonPassword(newPassword),
+      },
+    },
+  };
+
+  savePersistedConfig(paseoHome, nextConfig);
+
+  return {
+    action: "password_set",
+    configPath,
+    restartCommand: "paseo daemon restart",
+    message: `Password written to ${configPath}\nRestart the daemon for the change to take effect.\nRun: paseo daemon restart`,
+  };
+}
+
+export async function runSetPasswordCommand(
+  options: CommandOptions,
+  _command: Command,
+): Promise<SingleResult<SetPasswordResult>> {
+  const promptPassword =
+    typeof options.promptPassword === "function"
+      ? (options.promptPassword as PromptPassword)
+      : (message: string) => passwordPrompt({ message });
+  const newPassword = await promptForPassword(promptPassword);
+  const result = await setDaemonPasswordInConfig(newPassword, {
+    home: typeof options.home === "string" ? options.home : undefined,
+  });
+
+  return {
+    type: "single",
+    data: result,
+    schema: setPasswordResultSchema,
+  };
+}