| import fs from "node:fs/promises"; |
| import net from "node:net"; |
| import os from "node:os"; |
| import path from "node:path"; |
| import { afterEach, describe, expect, it, vi } from "vitest"; |
| import { isSecretValueRegisteredForRedaction } from "../../logging/secret-redaction-registry.js"; |
| import { |
| createHostDesktopService, |
| createHostDesktopSource, |
| inspectHostDesktop, |
| } from "./host-source.js"; |
| import type { ManagedLinuxDesktop } from "./managed-linux.js"; |
| import * as rfbProbe from "./rfb-probe.js"; |
| import { createDesktopSessionRegistry } from "./session-registry.js"; |
|
|
| const cleanups: Array<() => Promise<void>> = []; |
|
|
| afterEach(async () => { |
| await Promise.all(cleanups.splice(0).map((cleanup) => cleanup())); |
| vi.restoreAllMocks(); |
| vi.useRealTimers(); |
| }); |
|
|
| async function listenRfb(params: { banner?: string; securityTypes?: number[] }) { |
| const sockets = new Set<net.Socket>(); |
| const server = net.createServer((socket) => { |
| sockets.add(socket); |
| socket.once("close", () => sockets.delete(socket)); |
| socket.write(Buffer.from(params.banner ?? "RFB 003.008\n", "ascii")); |
| if (params.securityTypes) { |
| socket.once("data", () => { |
| socket.write(Buffer.from([params.securityTypes!.length, ...params.securityTypes!])); |
| }); |
| } |
| }); |
| await new Promise<void>((resolve, reject) => { |
| server.once("error", reject); |
| server.listen(0, "127.0.0.1", resolve); |
| }); |
| const address = server.address(); |
| if (!address || typeof address === "string") { |
| throw new Error("expected RFB server address"); |
| } |
| cleanups.push( |
| async () => |
| await new Promise<void>((resolve) => { |
| for (const socket of sockets) { |
| socket.destroy(); |
| } |
| server.close(() => resolve()); |
| }), |
| ); |
| return address.port; |
| } |
|
|
| async function unusedPort(): Promise<number> { |
| const server = net.createServer(); |
| await new Promise<void>((resolve) => { |
| server.listen(0, "127.0.0.1", resolve); |
| }); |
| const address = server.address(); |
| if (!address || typeof address === "string") { |
| throw new Error("expected TCP address"); |
| } |
| await new Promise<void>((resolve) => { |
| server.close(() => resolve()); |
| }); |
| return address.port; |
| } |
|
|
| function fakeManagedDesktop( |
| status: ReturnType<ManagedLinuxDesktop["status"]> = { state: "not-started" }, |
| ) { |
| let active = true; |
| const leases = new Set<{ onStop(): Promise<void> }>(); |
| const acquire = vi.fn(async () => ({ |
| attachment: { kind: "tcp" as const, host: "127.0.0.1" as const, port: 46_001 }, |
| auth: "vnc-password" as const, |
| vncPassword: "managed-secret", |
| })); |
| const acquireComputer = vi.fn(async (params: { onStop(): Promise<void> }) => { |
| leases.add(params); |
| return { |
| env: { DISPLAY: ":99", DBUS_SESSION_BUS_ADDRESS: "unix:path=/managed/bus" }, |
| isCurrent: () => active && leases.has(params), |
| release: () => { |
| leases.delete(params); |
| }, |
| }; |
| }); |
| const stop = vi.fn(async () => { |
| active = false; |
| await Promise.all([...leases].map(async (lease) => await lease.onStop())); |
| leases.clear(); |
| }); |
| const managed: ManagedLinuxDesktop = { acquire, acquireComputer, stop, status: () => status }; |
| return { acquire, acquireComputer, managed, stop }; |
| } |
|
|
| describe("gateway host desktop source", () => { |
| it("refuses an unauthenticated VNC server", async () => { |
| const port = await listenRfb({ securityTypes: [1] }); |
| const source = createHostDesktopSource({ config: { enabled: true, port } }); |
| await expect(source.acquire()).rejects.toThrow( |
| `refusing unauthenticated VNC server on 127.0.0.1:${port}`, |
| ); |
| }); |
|
|
| it("returns a loopback attachment and redacted password-file value for VncAuth", async () => { |
| const port = await listenRfb({ securityTypes: [2] }); |
| const root = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-host-desktop-")); |
| const passwordFile = path.join(root, "passwd"); |
| const password = "desktop-secret"; |
| await fs.writeFile(passwordFile, `${password}\n`); |
| cleanups.push(async () => fs.rm(root, { recursive: true, force: true })); |
|
|
| const source = createHostDesktopSource({ |
| config: { enabled: true, port, passwordFile }, |
| }); |
| await expect(source.acquire()).resolves.toEqual({ |
| attachment: { kind: "tcp", host: "127.0.0.1", port }, |
| auth: "vnc-password", |
| vncPassword: password, |
| }); |
| expect(isSecretValueRegisteredForRedaction(password)).toBe(true); |
| }); |
|
|
| it("keeps the VncAuth credential prompt path when passwordFile is omitted", async () => { |
| const port = await listenRfb({ securityTypes: [2] }); |
| const source = createHostDesktopSource({ config: { enabled: true, port } }); |
| await expect(source.acquire()).resolves.toEqual({ |
| attachment: { kind: "tcp", host: "127.0.0.1", port }, |
| auth: "vnc-password", |
| }); |
| }); |
|
|
| it("attaches ARD and keeps account credentials only in the observer token", async () => { |
| const port = await listenRfb({ banner: "RFB 003.889\n", securityTypes: [30] }); |
| const source = createHostDesktopSource({ |
| config: { enabled: true, port }, |
| platform: "darwin", |
| }); |
| await expect(source.acquire()).resolves.toEqual({ |
| attachment: { kind: "tcp", host: "127.0.0.1", port }, |
| auth: "ard-account", |
| }); |
|
|
| const registry = createDesktopSessionRegistry(); |
| const service = createHostDesktopService({ |
| config: { enabled: true, port }, |
| platform: "darwin", |
| registry, |
| }); |
| cleanups.push(async () => registry.stopAll()); |
| await expect(service.observe({ control: false })).rejects.toThrow( |
| "macOS account credentials are required", |
| ); |
| const password = "mac-account-password"; |
| const observed = await service.observe({ |
| control: false, |
| credentials: { username: "operator", password }, |
| }); |
| expect(observed).toMatchObject({ auth: "ard-account", control: false }); |
| expect(observed).not.toHaveProperty("vncPassword"); |
| expect(observed.wsPath).toMatch(/^\/desktop\/observe\?token=[a-f0-9]{48}$/u); |
| expect(observed.wsPath).not.toContain("operator"); |
| expect(observed.wsPath).not.toContain(password); |
| expect(isSecretValueRegisteredForRedaction(password)).toBe(true); |
|
|
| await expect( |
| inspectHostDesktop({ config: { enabled: true, port }, platform: "darwin" }), |
| ).resolves.toMatchObject({ |
| status: { state: "attached", security: "ARD" }, |
| detail: `attached (127.0.0.1:${port}, security: ARD)`, |
| }); |
| }); |
|
|
| it("still refuses VeNCrypt", async () => { |
| const port = await listenRfb({ securityTypes: [19] }); |
| const source = createHostDesktopSource({ config: { enabled: true, port } }); |
| await expect(source.acquire()).rejects.toThrow("VeNCrypt is not supported"); |
| }); |
|
|
| it("reports a non-VNC occupant and the port config next step", async () => { |
| const port = await listenRfb({ banner: "HTTP/1.1 200" }); |
| const source = createHostDesktopSource({ config: { enabled: true, port } }); |
| await expect(source.acquire()).rejects.toThrow( |
| `desktop.host.port ${port} is occupied by a non-VNC service; configure desktop.host.port`, |
| ); |
| }); |
|
|
| it("reports unreachable Linux setup guidance", async () => { |
| const port = await unusedPort(); |
| const source = createHostDesktopSource({ |
| config: { enabled: true, port }, |
| platform: "linux", |
| }); |
| await expect(source.acquire()).rejects.toThrow("apt install tigervnc-standalone-server"); |
| }); |
|
|
| it("keeps an explicitly configured port ahead of managed mode", async () => { |
| const port = await listenRfb({ securityTypes: [2] }); |
| const managed = fakeManagedDesktop(); |
| const source = createHostDesktopSource({ |
| config: { enabled: true, managed: true, port }, |
| platform: "linux", |
| managedDesktop: managed.managed, |
| }); |
| await expect(source.acquire()).resolves.toEqual({ |
| attachment: { kind: "tcp", host: "127.0.0.1", port }, |
| auth: "vnc-password", |
| }); |
| expect(managed.acquire).not.toHaveBeenCalled(); |
| await expect(source.acquireComputer({ onStop: async () => undefined })).rejects.toThrow( |
| "selected host desktop is an external VNC server", |
| ); |
| expect(managed.acquireComputer).not.toHaveBeenCalled(); |
| }); |
|
|
| it("keeps a default-port RFB listener ahead of managed mode", async () => { |
| const managed = fakeManagedDesktop(); |
| const source = createHostDesktopSource({ |
| config: { enabled: true, managed: true }, |
| platform: "linux", |
| managedDesktop: managed.managed, |
| probeRfb: async () => ({ kind: "rfb", securityTypes: [2] }), |
| }); |
| await expect(source.acquire()).resolves.toEqual({ |
| attachment: { kind: "tcp", host: "127.0.0.1", port: 5900 }, |
| auth: "vnc-password", |
| }); |
| expect(managed.acquire).not.toHaveBeenCalled(); |
| await expect(source.acquireComputer({ onStop: async () => undefined })).rejects.toThrow( |
| "selected host desktop is an external VNC server", |
| ); |
| expect(managed.acquireComputer).not.toHaveBeenCalled(); |
| }); |
|
|
| it("starts managed mode only on Linux after the default port is unreachable", async () => { |
| const managed = fakeManagedDesktop(); |
| const source = createHostDesktopSource({ |
| config: { enabled: true, managed: true }, |
| platform: "linux", |
| managedDesktop: managed.managed, |
| probeRfb: async () => ({ kind: "unreachable" }), |
| }); |
| await expect(source.acquire()).resolves.toMatchObject({ |
| attachment: { host: "127.0.0.1", port: 46_001 }, |
| auth: "vnc-password", |
| }); |
| expect(managed.acquire).toHaveBeenCalledOnce(); |
| const onStop = vi.fn(async () => undefined); |
| const computer = await source.acquireComputer({ onStop }); |
| expect(computer.env.DISPLAY).toBe(":99"); |
| expect(computer.isCurrent()).toBe(true); |
| await source.teardown?.(); |
| expect(computer.isCurrent()).toBe(false); |
| expect(onStop).toHaveBeenCalledOnce(); |
| }); |
|
|
| it("keeps computer activity alive after all eight observers detach, then expires after release", async () => { |
| vi.useFakeTimers(); |
| vi.spyOn(rfbProbe, "probeRfbServer").mockResolvedValue({ kind: "unreachable" }); |
| const managed = fakeManagedDesktop(); |
| const registry = createDesktopSessionRegistry({ lingerMs: 10 }); |
| const service = createHostDesktopService({ |
| config: { enabled: true, managed: true }, |
| platform: "linux", |
| registry, |
| managedDesktop: managed.managed, |
| }); |
| cleanups.push(() => registry.stopAll()); |
| const computer = await service.acquireComputer({ onStop: async () => undefined }); |
| await service.observe({ control: false }); |
| const observers = Array.from({ length: 8 }, () => |
| registry.attachObserver("host", { |
| control: false, |
| ownerEpoch: 0, |
| close: vi.fn(), |
| }), |
| ); |
| expect(observers.every(Boolean)).toBe(true); |
| for (const observer of observers) { |
| observer?.release(); |
| } |
| await vi.advanceTimersByTimeAsync(20); |
| expect(managed.stop).not.toHaveBeenCalled(); |
| expect(computer.isCurrent()).toBe(true); |
| computer.release(); |
| await vi.advanceTimersByTimeAsync(20); |
| expect(managed.stop).toHaveBeenCalled(); |
| expect(computer.isCurrent()).toBe(false); |
| }); |
|
|
| it("reports managed mode as Linux-only on other platforms", async () => { |
| const managed = fakeManagedDesktop(); |
| const source = createHostDesktopSource({ |
| config: { enabled: true, managed: true }, |
| platform: "darwin", |
| managedDesktop: managed.managed, |
| probeRfb: async () => ({ kind: "unreachable" }), |
| }); |
| await expect(source.acquire()).rejects.toThrow( |
| "desktop.host.managed is available only on Linux", |
| ); |
| await expect( |
| inspectHostDesktop({ |
| config: { enabled: true, managed: true }, |
| platform: "darwin", |
| managedDesktop: managed.managed, |
| probeRfb: async () => ({ kind: "unreachable" }), |
| }), |
| ).resolves.toMatchObject({ |
| status: { state: "unavailable" }, |
| detail: expect.stringContaining("available only on Linux"), |
| }); |
| }); |
|
|
| it("reports managed lifecycle states without exposing password material", async () => { |
| const managed = fakeManagedDesktop({ state: "running", display: 99, port: 46_001 }); |
| await expect( |
| inspectHostDesktop({ |
| config: { enabled: true, managed: true }, |
| platform: "linux", |
| managedDesktop: managed.managed, |
| probeRfb: async () => ({ kind: "unreachable" }), |
| }), |
| ).resolves.toEqual({ |
| status: { |
| enabled: true, |
| state: "managed", |
| managedState: "running", |
| display: 99, |
| port: 46_001, |
| security: "VncAuth", |
| }, |
| detail: "managed (running, display :99, port 46001, security: VncAuth)", |
| }); |
| }); |
|
|
| it("does not infer process-local managed state from standalone inspection", async () => { |
| await expect( |
| inspectHostDesktop({ |
| config: { enabled: true, managed: true }, |
| platform: "linux", |
| probeRfb: async () => ({ kind: "unreachable" }), |
| }), |
| ).resolves.toEqual({ |
| status: { |
| enabled: true, |
| state: "managed", |
| managedState: "unknown", |
| port: 5900, |
| }, |
| detail: "managed (configured; runtime state is available from the running Gateway status)", |
| }); |
| }); |
| }); |
|
|
