diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 04cfeaf..29cfd85 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,40 @@ permissions: contents: write jobs: + # One job makes the draft, before the builds: three matrix jobs each running + # "view || create" could race and make duplicate drafts. The draft is tied to + # the pushed tag (the tag must already exist on GitHub, then tag_name is set + # explicitly), so scripts/publish-release.sh and `gh release upload` find it + # by tag. It is created with the REST API so the id comes straight back: the + # release list can lag a fresh draft (v0.4.2's first run found nothing and + # PATCHed releases/ with an empty id). tests/test_release_workflow.py runs + # this step against tests/fakegh. + draft: + if: startsWith(github.ref, 'refs/tags/') + runs-on: ubuntu-latest + steps: + - name: Create the draft release + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + run: | + tag="${GITHUB_REF_NAME}" + # A rerun finds the draft an earlier attempt made. + id=$(gh api --paginate "repos/$GH_REPO/releases?per_page=100" --jq ".[] | select(.tag_name == \"$tag\") | .id" | head -n 1) + if [ -z "$id" ]; then + # Given a missing tag, GitHub would create it on the default branch. + gh api "repos/$GH_REPO/git/ref/tags/$tag" >/dev/null \ + || { echo "tag $tag isn't on GitHub" >&2; exit 1; } + id=$(gh api -X POST "repos/$GH_REPO/releases" -f tag_name="$tag" -f name="Frame Control ${tag#v}" \ + -F draft=true -f body="" --jq .id) + fi + [ -n "$id" ] || { echo "no release id for $tag; not PATCHing releases/" >&2; exit 1; } + gh api -X PATCH "repos/$GH_REPO/releases/$id" -f tag_name="$tag" --jq '"release " + (.id|tostring) + " tag_name " + .tag_name' + build: + needs: draft + # Still runs for pull requests and manual runs, where the draft job is skipped. + if: ${{ !failure() && !cancelled() }} strategy: fail-fast: false matrix: @@ -40,15 +73,27 @@ jobs: run: npm ci && npm run ${{ matrix.script }} env: CSC_IDENTITY_AUTO_DISCOVERY: "false" + # The installer, not just the unpacked build: its 7-Zip payload once dropped + # the OpenXR layer's arm64 library without any error. Install it silently + # and compare every installed file with the unpacked build. + - name: Check the Windows installer installs every file + if: matrix.os == 'windows-latest' + shell: pwsh + run: | + $setup = Get-ChildItem app/dist/Frame-Control-Setup-*.exe | Select-Object -First 1 + $p = Start-Process -FilePath $setup.FullName -ArgumentList '/S' -Wait -PassThru + if ($p.ExitCode -ne 0) { throw "installer exited $($p.ExitCode)" } + $installed = Join-Path $env:LOCALAPPDATA 'Programs\Frame Control' + for ($i = 0; $i -lt 60 -and -not (Test-Path (Join-Path $installed 'Uninstall Frame Control.exe')); $i++) { Start-Sleep 2 } + node app/build/check-resources.js (Join-Path $installed 'resources') app/dist/win-unpacked/resources + if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } - name: Upload to the release if: startsWith(github.ref, 'refs/tags/') shell: bash env: GH_TOKEN: ${{ github.token }} run: | - tag="${GITHUB_REF_NAME}" - gh release view "$tag" >/dev/null 2>&1 || gh release create "$tag" --draft --title "Frame Control ${tag#v}" --notes "" - gh release upload "$tag" ${{ matrix.files }} --clobber + gh release upload "${GITHUB_REF_NAME}" ${{ matrix.files }} --clobber - uses: actions/upload-artifact@v4 with: name: frame-control-${{ matrix.os }} diff --git a/README.md b/README.md index 1fbfcd5..cdd94d8 100644 --- a/README.md +++ b/README.md @@ -213,6 +213,8 @@ Frame's software fits together, all checked against a real headset and labelled | [Scripts and headset setup](docs/scripts.md) | The command-line helpers, minimum typing, streaming options, floating panels | | [How the Frame works](docs/how-the-frame-works.md) | SteamVR → gamescope → Plasma, verified facts, debugging | | [Android apps (Lepton)](docs/apks.md) | Sideloading, the rated F-Droid catalogue, per-app instances | +| [Import from my Quest](docs/quest-import.md) | Copy games you own off your Quest by USB; what runs, and why licence-checked games may not | +| [My Meta library](docs/meta-library.md) | Experimental: install and test Quest games your Meta account owns, with your own token | | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection | | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste | | [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build | diff --git a/apk-catalog/reports.py b/apk-catalog/reports.py index b425d04..6429910 100644 --- a/apk-catalog/reports.py +++ b/apk-catalog/reports.py @@ -6,11 +6,25 @@ A report: package, version, result (runs | crashes | install_failed | instance_failed, from an automated test), rating (works | issues | broken, from a person), notes, via (harness | probe | user), date, steamos, lepton, runtime. Newest wins, and a person's rating beats an automated result. + +An install_failed report saying the file had no arm64-v8a build (or needed a +newer Android) is about that one APK file, often the wrong per-ABI download of +an app that has an arm64 build, so it says nothing about the app and is left out. """ +import re + +FILE_FAULT = re.compile(r'no arm64-v8a build|needs Android API') + + +def about_app(r): + """False for reports about one wrong APK file rather than the app itself.""" + return not (r.get('result') == 'install_failed' and not r.get('rating') + and FILE_FAULT.search(r.get('notes') or '')) def verdict(reports): """(verdict, summary lines) for one package's reports, or None.""" + reports = [r for r in reports or () if about_app(r)] if not reports: return None rs = sorted(reports, key=lambda r: r.get('date') or '') diff --git a/app/build/check-resources.js b/app/build/check-resources.js new file mode 100644 index 0000000..4eef75e --- /dev/null +++ b/app/build/check-resources.js @@ -0,0 +1,79 @@ +// Checks that the app's resources hold what Frame Control can't work without. +// The OpenXR compatibility layer is why this exists: VR APK installs need its +// arm64-v8a library (ui/frame_android.py XR_COMPAT_FILES). +// +// As electron-builder's afterPack hook it checks the unpacked app. From the +// command line it checks an installed copy, which is what caught the Windows +// installer silently dropping the library (see .github/workflows/release.yml): +// node build/check-resources.js INSTALLED_RESOURCES [REFERENCE_RESOURCES] +// With a reference (the unpacked build's resources), every file in it must also +// be in the installed copy, at the same size. +const fs = require("fs"); +const path = require("path"); + +const REQUIRED = [ + "ui/server.py", + "ui/frame_android.py", + "frame/android/lepton-app.sh", + "frame/openxr-compat/XrApiLayer_FRAME_compat.json", + "frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz", +]; + +function resourcesDir(context) { + if (context.electronPlatformName === "darwin" || context.electronPlatformName === "mas") { + const app = `${context.packager.appInfo.productFilename}.app`; + return path.join(context.appOutDir, app, "Contents", "Resources"); + } + return path.join(context.appOutDir, "resources"); +} + +function size(file) { + try { + return fs.statSync(file).size; + } catch { + return -1; + } +} + +// Required files that are missing or empty. +function missing(dir) { + return REQUIRED.filter((rel) => size(path.join(dir, rel)) <= 0); +} + +// Files under reference that aren't in dir at the same size. +function differences(dir, reference) { + const out = []; + (function walk(rel) { + for (const e of fs.readdirSync(path.join(reference, rel), { withFileTypes: true })) { + const r = path.join(rel, e.name); + if (e.isDirectory()) walk(r); + else if (e.isFile() && size(path.join(dir, r)) !== size(path.join(reference, r))) out.push(r.split(path.sep).join("/")); + } + })(""); + return out; +} + +exports.default = async function afterPack(context) { + const dir = resourcesDir(context); + const gone = missing(dir); + if (gone.length) { + throw new Error(`packaged app is missing required resources in ${dir}: ${gone.join(", ")}`); + } +}; +exports.missing = missing; +exports.differences = differences; +exports.REQUIRED = REQUIRED; + +if (require.main === module) { + const [dir, reference] = process.argv.slice(2); + if (!dir) { + console.error("usage: node build/check-resources.js INSTALLED_RESOURCES [REFERENCE_RESOURCES]"); + process.exit(2); + } + const problems = [...missing(dir), ...(reference ? differences(dir, reference) : [])]; + if (problems.length) { + console.error(`${dir} is missing or has the wrong size for:\n ${[...new Set(problems)].join("\n ")}`); + process.exit(1); + } + console.log(`${dir}: all required resources present${reference ? ", and every file of " + reference : ""}`); +} diff --git a/app/main.js b/app/main.js index 4497136..5150efb 100644 --- a/app/main.js +++ b/app/main.js @@ -1,7 +1,7 @@ // Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on // a free loopback port and shows it in a native window. The server does all the // work over the `frame` SSH alias; this file only hosts it. -const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, shell } = require("electron"); +const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, nativeImage, session, shell } = require("electron"); const { execFile, spawn } = require("child_process"); const { promisify } = require("util"); const fs = require("fs"); @@ -11,6 +11,7 @@ const os = require("os"); const path = require("path"); const { SCHEME, parseInstallLink, linkFromArgv } = require("./install-link"); const updater = require("./updater"); +const { createMetaSignIn } = require("./meta-signin"); const run = promisify(execFile); @@ -115,10 +116,11 @@ function ping(target) { } async function startServer() { - // The version and whether this is a built app go to ui/frame_telemetry.py, which - // sends nothing from a source checkout. + // The version, the time zone and whether this is a built app go to ui/frame_telemetry.py, + // which sends nothing from a source checkout. const env = { ...process.env, PATH: await loginPath(), FRAME_CONTROL_APP: "1", FRAME_CONTROL_VERSION: app.getVersion(), FRAME_CONTROL_LOG: LOG, + FRAME_CONTROL_TIMEZONE: Intl.DateTimeFormat().resolvedOptions().timeZone || "", ...(app.isPackaged ? { FRAME_CONTROL_PACKAGED: "1" } : {}), ...(fs.existsSync(TOOLS) ? { FRAME_CONTROL_TOOLS: TOOLS } : {}) }; python = await findPython(env); @@ -149,7 +151,7 @@ async function startServer() { const target = `http://127.0.0.1:${port}/`; for (let i = 0; i < 100; i++) { if (exited !== null) throw new Error(`The server exited (${exited}). See ${LOG}.`); - if (await ping(target)) { url = target; return; } + if (await ping(target)) { url = target; serverStarted = Date.now(); return; } await new Promise((r) => setTimeout(r, 100)); } if (server === child) server = null; @@ -175,18 +177,27 @@ function stopServer() { if (server) endServer(server); } -function errorPage(message) { +function errorPage(message, title = "Frame Control couldn't start") { const esc = (s) => s.replace(/[&<>]/g, (c) => ({ "&": "&", "<": "<", ">": ">" }[c])); const html = ` -

Frame Control couldn't start

-

${esc(message)}

Fix it, then choose Frame → Restart Server.

`; +

${esc(title)}

+

${esc(message)}

+

+

Frame → Restart Server does the same.

`; return "data:text/html;charset=utf-8," + encodeURIComponent(html); } +// A server that had been running starts again by itself (something stopped it: a +// signal, a crash). One that stops again within a minute shows the error instead, +// so a server that can't stay up doesn't restart forever. +let serverStarted = 0; function serverDied(why) { url = null; - if (win) win.loadURL(errorPage(`The server stopped unexpectedly (${why}). See ${LOG}.`)); + if (!win) return; + if (Date.now() - serverStarted > 60000) restartServer(); + else win.loadURL(errorPage(`Its server stopped unexpectedly (${why}). See ${LOG}.`, "Frame Control stopped")); } // Restarts that overlap share one: two could each start a server, and the one @@ -263,7 +274,20 @@ function fromUi(e) { } catch { return false; } } +// The error page's Try Again button. The error page is the only data: page the window +// shows (`url` can still be set then: the server answered but the page failed to load). +ipcMain.handle("server:restart", (e) => { + if (win && e.sender === win.webContents && e.senderFrame && e.senderFrame.url.startsWith("data:")) restartServer(); +}); ipcMain.handle("clipboard:read", (e) => fromUi(e) ? clipboard.readText() : ""); +// A PNG or JPEG (a screenshot) onto the clipboard as an image. +ipcMain.handle("clipboard:writeImage", (e, bytes) => { + if (!fromUi(e) || !(bytes instanceof Uint8Array)) return false; + const img = nativeImage.createFromBuffer(Buffer.from(bytes)); + if (img.isEmpty()) throw new Error("not an image"); + clipboard.writeImage(img); + return true; +}); ipcMain.handle("connection:setup", (e) => { if (fromUi(e)) setUpConnection(); }); ipcMain.on("keys:capture", (e, on) => { if (fromUi(e)) win.webContents.setIgnoreMenuShortcuts(on === true); }); ipcMain.handle("update:get", (e) => fromUi(e) ? publicUpdate() : null); @@ -325,6 +349,47 @@ ipcMain.handle("comfort:notify", (e, message) => { }); }); +// ---- Sign in with Meta (app/meta-signin.js, docs/meta-library.md) ---- +// The token goes from the sign-in window's own session straight to the server's +// connect path; the page asks for it and only hears the server's answer. +function postApi(apiPath, body) { + return new Promise((resolve, reject) => { + if (!url) return reject(new Error("Frame Control's server isn't running.")); + const data = JSON.stringify(body); + const req = http.request(new URL(apiPath, url), { + method: "POST", timeout: 60000, + headers: { "Content-Type": "application/json", "X-Frame-UI": process.env.FRAME_UI_KEY || "1", + "Content-Length": Buffer.byteLength(data) }, + }, (res) => { + let text = ""; + res.setEncoding("utf8"); + res.on("data", (c) => { text += c; }); + res.on("end", () => { + let parsed = {}; + try { parsed = JSON.parse(text); } catch {} + resolve({ status: res.statusCode, data: parsed }); + }); + }); + req.on("error", reject); + req.on("timeout", () => req.destroy(new Error("the server didn't answer"))); + req.end(data); + }); +} + +let metaSignIn = null; +const meta = () => (metaSignIn ||= createMetaSignIn({ + BrowserWindow, session, shell, parent: () => win, + // The page only offers sign-in after its "I understand" box is ticked (checked again below). + connect: (token, attempt) => postApi("/api/meta", { action: "connect", token, acknowledged: true, attempt }), + cancel: (attempt) => postApi("/api/meta", { action: "cancel-signin", attempt }), +})); +ipcMain.handle("meta:signin", (e, acknowledged) => { + if (!fromUi(e)) return null; + if (acknowledged !== true) return { ok: false, error: "My Meta library is experimental: tick that you understand the warning first." }; + return meta().signIn(); +}); +ipcMain.handle("meta:signout", (e) => fromUi(e) ? meta().signOut() : false); + // frame-control://install links from websites (docs/web-install.md). They can // arrive before the window or server exists (macOS open-url on a cold launch), // so they wait here until the page asks for them. The page checks the link with diff --git a/app/meta-signin.js b/app/meta-signin.js new file mode 100644 index 0000000..1da77ea --- /dev/null +++ b/app/meta-signin.js @@ -0,0 +1,252 @@ +// "Sign in with Meta" for My Meta library (docs/meta-library.md), the way BSManager's +// "Log in with Meta" works: Meta's own login page in a Frame Control window, then the +// access token cookie (oc_ac_at) that page sets is handed to the local server's +// existing connect path (format check, "who am I" with Meta, 0600 file). +// +// The window has its own persistent session (PARTITION), so the cookie is read only +// from there: never from Frame Control's main window, never from any browser. It has +// no preload and no Node, and it only navigates within Meta's login sites; anything +// else opens in the system browser. Nothing here logs the token, and the page only +// ever gets back the server's answer (connected, display name), never the token. +// Electron is passed in, so app/test/meta-signin.test.js can run it with fakes. +const crypto = require("crypto"); + +const PARTITION = "persist:meta-signin"; +// BSManager's loginUrl (src/main/services/bs-version-download/bs-oculus-downloader.service.ts). +const LOGIN_URL = "https://secure.oculus.com"; +const COOKIE = "oc_ac_at"; +// Sites the login can go through: the Oculus store web, Meta accounts, Facebook login, +// and Instagram (Meta's login passes through www.instagram.com: seen live, 2026-10-14). +const ALLOWED = ["oculus.com", "meta.com", "facebook.com", "instagram.com"]; +const TIMEOUT = 10 * 60 * 1000; // as BSManager + +const underDomain = (host, domains) => { + host = String(host || "").replace(/^\./, "").toLowerCase(); + return domains.some((d) => host === d || host.endsWith("." + d)); +}; + +// Plain HTTPS on the default port, to one of the login sites. +function allowedUrl(raw) { + let u; + try { u = new URL(String(raw)); } catch { return false; } + if (u.protocol !== "https:" || u.username || u.password || (u.port && u.port !== "443")) return false; + return underDomain(u.hostname, ALLOWED); +} + +// Frames inside the page: any HTTPS address (Meta's login can embed captcha and CDN +// frames from other sites), or an empty frame; never data:, blob:, javascript:, http:, +// file: or any other scheme. Frames can't reach the cookie read or IPC (main process only). +function allowedSubframeUrl(raw) { + if (/^about:(?:blank|srcdoc)$/.test(String(raw))) return true; + let u; + try { u = new URL(String(raw)); } catch { return false; } + return u.protocol === "https:" && !u.username && !u.password; +} + +const onOculus = (raw) => { try { return underDomain(new URL(raw).hostname, ["oculus.com"]); } catch { return false; } }; + +// A cheap first look, so a signed-out or app value is never sent anywhere; the server's +// check_token (ui/frame_meta.py) has the final word. +function looksLikeUserToken(v) { + return typeof v === "string" && /^(?:OC|FRL)[A-Za-z0-9+/=_-]{18,4093}$/.test(v) + && !/^OC\d{15}$/.test(v) && /[a-z]/.test(v); +} + +const fingerprint = (v) => crypto.createHash("sha256").update(v).digest("hex"); + +// Anything token-shaped out of a message, in case a server error ever carried one. +function scrub(text, token) { + let s = String(text == null ? "" : text); + if (token) s = s.split(token).join(""); + return s.replace(/(?:OC|FRL)[A-Za-z0-9+/=_%|:-]{8,}/g, "").slice(0, 600); +} + +// deps: { BrowserWindow, session, shell, parent() -> BrowserWindow|null, timeout, +// connect(token, attempt) -> Promise<{status, data}> (the server's connect action), +// cancel(attempt) -> Promise (the server's cancel-signin: never save that attempt) } +function createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent = () => null, timeout = TIMEOUT }) { + let active = null; // { win, promise, finish } + const pending = new Set(); // cancels still to reach the server, from flows already finished + let signingOut = null; // the sign-out under way; no sign-in starts while it runs + const SIGNING_OUT = "Frame Control is signing out of Meta; try again in a moment."; + + const openOutside = (target) => { + if (/^https?:\/\//i.test(String(target))) shell.openExternal(String(target)); + }; + + function signIn() { + if (signingOut) return Promise.resolve({ ok: false, error: SIGNING_OUT }); + if (active) { active.win.focus(); return active.promise; } + const ses = session.fromPartition(PARTITION); + ses.setPermissionRequestHandler((_wc, _permission, callback) => callback(false)); + ses.setPermissionCheckHandler(() => false); + // Electron adds its own name and the app's to the user agent; send a plain Chrome one. + if (ses.getUserAgent && ses.setUserAgent) { + ses.setUserAgent(ses.getUserAgent().replace(/\s(?:Electron|frame-control|Frame Control)\/\S+/g, "")); + } + const p = parent(); + const win = new BrowserWindow({ + width: 520, height: 760, title: "Sign in with Meta – Frame Control", autoHideMenuBar: true, + ...(p ? { parent: p } : {}), + webPreferences: { partition: PARTITION, contextIsolation: true, nodeIntegration: false, sandbox: true, + nodeIntegrationInSubFrames: false, webviewTag: false, safeDialogs: true, devTools: false }, + }); + const wc = win.webContents; + + let resolve; + const promise = new Promise((r) => { resolve = r; }); + let done = false, busy = false, again = false, lastError = null, blocked = null; + const tried = new Set(); // fingerprints of values already sent, so each goes once + // The server refuses to save a connect from an attempt this window gave up on. + const attemptId = crypto.randomUUID(); + + const onCookie = (_e, cookie, _cause, removed) => { + if (!removed && cookie && cookie.name === COOKIE && underDomain(cookie.domain, ["oculus.com"])) attempt(); + }; + const timer = setTimeout(() => finish({ ok: false, error: "Sign-in timed out after 10 minutes. Try again." }), timeout); + if (timer.unref) timer.unref(); + + // Stops cookie intake first, then the window (destroy: a page's beforeunload can't + // keep it open), and answers the page. Unless it connected, and if it sent a token, it + // then has the server drop this attempt: only once the connect under way has settled, + // so the server always sees the cancel after the connect (and deletes the token if + // that connect saved it). The returned promise settles when that is done. + let finished = null; + let inflight = null; // the last connect sent + function finish(result) { + if (done) return finished || Promise.resolve(); // destroy() below re-enters through "closed" + done = true; + ses.cookies.removeListener("changed", onCookie); + clearTimeout(timer); + if (active && active.win === win) active = null; + if (!win.isDestroyed()) win.destroy(); + resolve(result); + if (result.ok || !inflight) return (finished = Promise.resolve()); // nothing sent: nothing to cancel + finished = Promise.resolve(inflight).catch(() => {}).then(() => cancel(attemptId)).catch(() => {}); + pending.add(finished); + finished.then(() => pending.delete(finished)); + return finished; + } + + async function attempt() { + if (done) return; + if (busy) { again = true; return; } + busy = true; + try { + do { + again = false; + // Only this window's own session, and only Meta's Oculus cookie. + const cookies = await ses.cookies.get({ name: COOKIE }); + const c = cookies.find((k) => underDomain(k.domain, ["oculus.com"]) && looksLikeUserToken(k.value)); + if (!c || done) continue; + const key = fingerprint(c.value); + if (tried.has(key)) continue; + tried.add(key); + let r; + try { + inflight = connect(c.value, attemptId); + r = await inflight; + } catch { + lastError = "Frame Control's local server didn't answer."; + continue; + } + if (done) return; + const d = (r && r.data) || {}; + if (r && r.status === 200 && d.connected) { + finish({ ok: true, connected: true, user: d.user && d.user.name ? { name: scrub(d.user.name, c.value).slice(0, 80) } : null, + message: scrub(d.message || "Connected your Meta account (Experimental)", c.value) }); + return; + } + lastError = scrub(d.error || `HTTP ${r && r.status}`, c.value); + } while (again && !done); + } catch { + // The session went away (the window closed); nothing to do. + } finally { + busy = false; + } + } + + // Navigation stays on Meta's login sites. A link elsewhere opens in the system + // browser; a redirect elsewhere is just stopped (it may carry sign-in data). + // Every frame: the window itself stays on the list; frames inside it may load any + // HTTPS page (captchas), and one going anywhere else is just stopped. + wc.on("will-navigate", (e, target) => { if (!allowedUrl(target)) { e.preventDefault(); openOutside(target); } }); + // A stopped page change in the window itself says where it went (the host only), so + // closing the stuck window explains why instead of "closed before you signed in". + const stopped = (to) => { + let host = ""; + try { host = new URL(String(to)).hostname; } catch { /* not an address */ } + blocked = `Meta's sign-in went to ${scrub(host || "an address", null).slice(0, 80)}, which Frame Control doesn't allow.`; + }; + wc.on("will-frame-navigate", (e) => { + if (e.isMainFrame ? allowedUrl(e.url) : allowedSubframeUrl(e.url)) return; + e.preventDefault(); + if (e.isMainFrame) stopped(e.url); + }); + // Redirects fire for frames too: the same rule per frame (details on the event in + // current Electron, positional arguments in older ones; unknown counts as the window). + wc.on("will-redirect", (e, target, _inPlace, isMainFrame) => { + const to = e && e.url !== undefined ? e.url : target; + const main = e && e.isMainFrame !== undefined ? e.isMainFrame : isMainFrame !== false; + if (main ? allowedUrl(to) : allowedSubframeUrl(to)) return; + e.preventDefault(); + if (main) stopped(to); + }); + // A page's beforeunload never keeps the window open. + wc.on("will-prevent-unload", (e) => e.preventDefault()); + wc.setWindowOpenHandler(({ url: target }) => { + if (allowedUrl(target)) wc.loadURL(target).catch(() => {}); + else openOutside(target); + return { action: "deny" }; + }); + // Signed in: the cookie changes, or the window lands back on Meta's store site. + ses.cookies.on("changed", onCookie); + wc.on("did-navigate", (_e, target) => { blocked = null; if (onOculus(target)) attempt(); }); // it recovered + wc.on("did-navigate-in-page", (_e, target) => { if (onOculus(target)) attempt(); }); + win.on("closed", () => finish({ ok: false, cancelled: true, + error: lastError ? `The sign-in window closed before Frame Control could connect. ${lastError}` + : blocked ? `The sign-in window was closed before you signed in. ${blocked}` + : "The sign-in window was closed before you signed in." })); + + active = { win, promise, finish }; + wc.loadURL(LOGIN_URL).catch(() => {}); + return promise; + } + + // Signs out of Meta in Frame Control: stops any sign-in under way (and has the server +// refuse to save it), destroys the window, then clears everything + // the sign-in session stored (cookies, storage, cache), so the next sign-in starts fresh. + // One at a time (a second call joins the first), and no sign-in can start meanwhile. + // It goes round until no window is open and no connect or cancel is left, so nothing + // started before it can set a token after it (or after the Disconnect that follows). + function signOut() { + if (!signingOut) { + signingOut = (async () => { + for (;;) { + if (active) { + const { win, finish } = active; + await finish({ ok: false, cancelled: true, error: "Signed out of Meta in Frame Control." }); + // Clear only once nothing can write to the session again. + if (!win.isDestroyed()) throw new Error("The Sign in with Meta window didn't close; try again."); + } else if (pending.size) { + // A connect under way settles and is cancelled before the caller (Disconnect) + // deletes the account, so it can't be saved afterwards. + await Promise.all([...pending]); + } else { + break; + } + } + const ses = session.fromPartition(PARTITION); + await ses.clearStorageData(); + await ses.clearCache(); + if (ses.clearAuthCache) await ses.clearAuthCache(); + return true; + })().finally(() => { signingOut = null; }); + } + return signingOut; + } + + return { signIn, signOut, isOpen: () => !!active, isSigningOut: () => !!signingOut }; +} + +module.exports = { createMetaSignIn, allowedUrl, allowedSubframeUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE, ALLOWED }; diff --git a/app/package-lock.json b/app/package-lock.json index 264b1dd..8467e4a 100644 --- a/app/package-lock.json +++ b/app/package-lock.json @@ -1,12 +1,12 @@ { "name": "frame-control", - "version": "0.4.0", + "version": "0.4.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "frame-control", - "version": "0.4.0", + "version": "0.4.7", "license": "MIT", "devDependencies": { "electron": "^44.4.5", diff --git a/app/package.json b/app/package.json index f59e889..93e695c 100644 --- a/app/package.json +++ b/app/package.json @@ -1,7 +1,7 @@ { "name": "frame-control", "productName": "Frame Control", - "version": "0.4.0", + "version": "0.4.7", "description": "Desktop app for managing a Valve Steam Frame over SSH", "private": true, "main": "main.js", @@ -29,6 +29,7 @@ ] } ], + "afterPack": "build/check-resources.js", "directories": { "output": "dist", "buildResources": "build" @@ -38,6 +39,7 @@ "preload.js", "install-link.js", "updater.js", + "meta-signin.js", "package.json", "build/icon.png" ], @@ -49,6 +51,7 @@ "*.py", "*.html", "*.js", + "*.css", "telemetry.json" ] }, @@ -81,7 +84,7 @@ "to": "frame/openxr-compat", "filter": [ "XrApiLayer_FRAME_compat.json", - "prebuilt/**/*.so" + "prebuilt/**/*.so.gz" ] }, { diff --git a/app/preload.js b/app/preload.js index 8ab5b8f..740d94b 100644 --- a/app/preload.js +++ b/app/preload.js @@ -2,17 +2,20 @@ // to the Frame needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells // the page where a dropped file or folder lives, so a folder can be sideloaded // as a title without zipping it (the local server reads it from there). -// It can open Set Up Connection when the headset can't be reached, and keeps the -// Frame menu's list of headsets up to date. +// It can put a screenshot on the clipboard as an image, open Set Up Connection when +// the headset can't be reached, and keeps the Frame menu's list of headsets up to date. // It also receives frame-control://install links (docs/web-install.md): only // what the link asked for, never an install; the page asks the user first. -// And it passes update state both ways: see app/updater.js. +// And it passes update state both ways: see app/updater.js. It opens the Sign in +// with Meta window and signs out of it (app/meta-signin.js). const { contextBridge, ipcRenderer, webUtils } = require("electron"); contextBridge.exposeInMainWorld("frameApp", { notify: (message, request) => ipcRenderer.invoke("comfort:notify", message, request), readClipboard: () => ipcRenderer.invoke("clipboard:read"), + writeImage: (bytes) => ipcRenderer.invoke("clipboard:writeImage", bytes), setUpConnection: () => ipcRenderer.invoke("connection:setup"), + restartServer: () => ipcRenderer.invoke("server:restart"), // the "couldn't start" page's Try Again // The Frame menu's headset switcher: the page tells it the headsets, and hears picks. devicesChanged: (list) => ipcRenderer.send("devices:changed", list), onUseDevice: (cb) => { @@ -37,6 +40,12 @@ contextBridge.exposeInMainWorld("frameApp", { ipcRenderer.removeAllListeners("report:open"); ipcRenderer.on("report:open", () => cb()); }, + // Sign in with Meta (app/meta-signin.js): Meta's login page in its own window. The + // answer is the server's (connected, display name), never the token. + meta: { + signIn: (acknowledged) => ipcRenderer.invoke("meta:signin", acknowledged === true), + signOut: () => ipcRenderer.invoke("meta:signout"), + }, onInstallLink: (cb) => { ipcRenderer.removeAllListeners("install-link"); ipcRenderer.on("install-link", (_e, req) => cb({ kind: req.kind, target: req.target })); diff --git a/app/test/meta-signin.test.js b/app/test/meta-signin.test.js new file mode 100644 index 0000000..5873667 --- /dev/null +++ b/app/test/meta-signin.test.js @@ -0,0 +1,578 @@ +// Run: node --test app/test/ +// "Sign in with Meta" (app/meta-signin.js) with fake Electron windows, sessions and cookies. +const nodeTest = require("node:test"); +// A broken flow can leave a sign-in waiting forever; fail it instead of hanging. +const test = (name, fn) => nodeTest(name, { timeout: 5000 }, fn); +const assert = require("node:assert"); +const { EventEmitter } = require("node:events"); +const { createMetaSignIn, allowedUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE } = require("../meta-signin"); + +const TOKEN = "OCAbcdefghijklmnopQRSTUVwxyz0123456789abcdEFGH"; +const OTHER = "OCzyxwvutsrqponmlkJIHGFEDcba9876543210zyxwVUTS"; + +class FakeCookies extends EventEmitter { + constructor() { super(); this.store = []; this.reads = 0; } + async get(filter) { + this.reads++; + return this.store.filter((c) => !filter.name || c.name === filter.name); + } + set(cookie) { // as the page would: store it, then tell listeners + this.store = this.store.filter((c) => !(c.name === cookie.name && c.domain === cookie.domain)).concat(cookie); + this.emit("changed", {}, cookie, "explicit", false); + } +} + +class FakeSession { + constructor(name, log) { this.name = name; this.log = log; this.cookies = new FakeCookies(); this.cleared = []; this.permission = null; } + setPermissionRequestHandler(fn) { this.permission = fn; } + setPermissionCheckHandler(fn) { this.permissionCheck = fn; } + getUserAgent() { return "Mozilla/5.0 Chrome/140.0 frame-control/0.4.4 Electron/44.4.5 Safari/537.36"; } + setUserAgent(ua) { this.ua = ua; } + async clearStorageData(opts) { this.log.push("clear"); this.cleared.push(["storage", opts]); } + async clearCache() { this.cleared.push(["cache"]); } + async clearAuthCache() { this.cleared.push(["auth"]); } +} + +function fakes({ timeout } = {}) { + const log = []; // the order things happened in + const sessions = new Map(); + const defaultSession = new FakeSession("default", log); + const session = { + defaultSession, + fromPartition(name) { + if (!sessions.has(name)) sessions.set(name, new FakeSession(name, log)); + return sessions.get(name); + }, + }; + const windows = []; + class BrowserWindow extends EventEmitter { + constructor(opts) { + super(); + this.opts = opts; + this.destroyed = false; + this.veto = false; // a page whose beforeunload keeps the window open on close() + this.focused = 0; + const wc = new EventEmitter(); + wc.loaded = []; + wc.loadURL = async (u) => { wc.loaded.push(u); }; + wc.setWindowOpenHandler = (fn) => { wc.openHandler = fn; }; + // Deliberately a different session: the code must read the partition's, not guess. + wc.session = defaultSession; + this.webContents = wc; + windows.push(this); + } + isDestroyed() { return this.destroyed; } + focus() { this.focused++; } + close() { if (this.destroyed || this.veto) return; this.destroy(); } + destroy() { if (this.destroyed) return; this.destroyed = true; log.push("destroyed"); this.emit("closed"); } + } + const opened = []; + const shell = { openExternal: (u) => { opened.push(u); } }; + const calls = [], attempts = [], cancels = []; + let answer = () => ({ status: 200, data: { connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" } }); + const connect = async (token, attempt) => { calls.push(token); attempts.push(attempt); log.push("connect"); return answer(token); }; + const cancel = async (attempt) => { + cancels.push(attempt); + log.push(`cancel (cookie listeners: ${session.fromPartition(PARTITION).cookies.listenerCount("changed")})`); + }; + const flow = createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent: () => null, ...(timeout ? { timeout } : {}) }); + return { flow, session, sessions, windows, opened, calls, attempts, cancels, log, setAnswer: (fn) => { answer = fn; }, + meta: () => session.fromPartition(PARTITION) }; +} + +const tick = () => new Promise((r) => setImmediate(r)); +async function settle() { for (let i = 0; i < 10; i++) await tick(); } + +function navigate(wc, event, target) { + let prevented = false; + wc.emit(event, { preventDefault: () => { prevented = true; } }, target); + return prevented; +} + +test("only plain HTTPS addresses on Meta's login sites are allowed", () => { + for (const ok of ["https://secure.oculus.com", "https://secure.oculus.com/my/profile", "https://auth.meta.com/login/", + "https://www.meta.com/", "https://www.facebook.com/login.php", "https://oculus.com:443/", + "https://www.instagram.com/accounts/login/"]) { + assert.ok(allowedUrl(ok), ok); + } + for (const bad of ["http://secure.oculus.com/", "https://oculus.com.evil.example/", "https://evil-oculus.com/", + "https://notmeta.com/", "https://example.com/", "javascript:alert(1)", "file:///etc/passwd", + "https://secure.oculus.com:8443/", "https://user:pw@secure.oculus.com/", "https://evil.example/?u=https://www.meta.com", + "data:text/html,hi", "not a url"]) { + assert.ok(!allowedUrl(bad), bad); + } +}); + +test("the window is isolated: its own partition, no preload, no Node, sandboxed, on Meta's login page", async () => { + const f = fakes(); + f.flow.signIn(); + const [w] = f.windows; + const wp = w.opts.webPreferences; + assert.strictEqual(wp.partition, PARTITION); + assert.strictEqual(PARTITION, "persist:meta-signin"); + assert.strictEqual(wp.contextIsolation, true); + assert.strictEqual(wp.nodeIntegration, false); + assert.strictEqual(wp.sandbox, true); + assert.strictEqual(wp.preload, undefined); + assert.strictEqual(wp.devTools, false); + assert.deepStrictEqual(w.webContents.loaded, [LOGIN_URL]); + assert.strictEqual(LOGIN_URL, "https://secure.oculus.com"); + // Permission prompts (camera, notifications...) are refused. + let granted = null; + f.meta().permission(null, "media", (v) => { granted = v; }); + assert.strictEqual(granted, false); + assert.strictEqual(f.meta().permissionCheck(null, "notifications", "https://secure.oculus.com"), false); + assert.ok(!/Electron|frame-control/.test(f.meta().ua)); + w.close(); +}); + +test("navigation stays on Meta's sites; other links open in the system browser", async () => { + const f = fakes(); + f.flow.signIn(); + const wc = f.windows[0].webContents; + assert.strictEqual(navigate(wc, "will-navigate", "https://auth.meta.com/login/"), false); + assert.strictEqual(navigate(wc, "will-navigate", "https://www.facebook.com/login.php"), false); + assert.strictEqual(navigate(wc, "will-navigate", "https://example.com/help"), true); + assert.deepStrictEqual(f.opened, ["https://example.com/help"]); + // A redirect elsewhere is stopped and not opened anywhere (it may carry sign-in data). + assert.strictEqual(navigate(wc, "will-redirect", "https://evil.example/cb?x=1"), true); + assert.strictEqual(navigate(wc, "will-redirect", "https://auth.meta.com/next"), false); + assert.deepStrictEqual(f.opened, ["https://example.com/help"]); + // New windows: never created. Meta's own load in this window; others go outside; non-web schemes nowhere. + assert.deepStrictEqual(wc.openHandler({ url: "https://www.meta.com/legal/terms/" }), { action: "deny" }); + assert.deepStrictEqual(wc.openHandler({ url: "https://example.org/" }), { action: "deny" }); + assert.deepStrictEqual(wc.openHandler({ url: "file:///etc/passwd" }), { action: "deny" }); + await settle(); + assert.deepStrictEqual(wc.loaded, [LOGIN_URL, "https://www.meta.com/legal/terms/"]); + assert.deepStrictEqual(f.opened, ["https://example.com/help", "https://example.org/"]); + f.windows[0].close(); +}); + +test("the cookie is read only from the sign-in partition, only for Meta's Oculus domain", async () => { + const f = fakes(); + // The same cookie elsewhere: the default session and another partition. Never read. + f.session.defaultSession.cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + f.session.fromPartition("persist:other").cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + const done = f.flow.signIn(); + const w = f.windows[0]; + // A cookie with the right name on another site, and a signed-out value: ignored. + f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: OTHER }); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: "OC123456789012345" }); + w.webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile"); + await settle(); + assert.deepStrictEqual(f.calls, []); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + const r = await done; + assert.deepStrictEqual(f.calls, [TOKEN]); + assert.strictEqual(r.ok, true); + assert.strictEqual(f.session.defaultSession.cookies.reads, 0); + assert.strictEqual(f.session.fromPartition("persist:other").cookies.reads, 0); + assert.ok(f.sessions.get(PARTITION).cookies.reads > 0); +}); + +test("landing on the logged-in page picks up a cookie set earlier", async () => { + const f = fakes(); + const done = f.flow.signIn(); + f.meta().cookies.store.push({ name: COOKIE, domain: "secure.oculus.com", value: TOKEN }); // no change event + f.windows[0].webContents.emit("did-navigate", {}, "https://auth.meta.com/login/"); // not Meta's store site yet + await settle(); + assert.deepStrictEqual(f.calls, []); + f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile"); + assert.strictEqual((await done).ok, true); + assert.deepStrictEqual(f.calls, [TOKEN]); +}); + +test("after a connect the window closes, and the page gets the answer, never the token", async () => { + const f = fakes(); + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + const r = await done; + assert.ok(f.windows[0].isDestroyed()); + assert.ok(!f.flow.isOpen()); + assert.deepStrictEqual(r, { ok: true, connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" }); + assert.ok(!JSON.stringify(r).includes(TOKEN)); + // The cookie listener is gone: a later change sends nothing. + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + await settle(); + assert.deepStrictEqual(f.calls, [TOKEN]); +}); + +test("a token the server refuses keeps the window open, is sent once, and the next one connects", async () => { + const f = fakes(); + f.setAnswer((t) => t === TOKEN ? { status: 400, data: { error: "Meta didn't accept this token." } } + : { status: 200, data: { connected: true, user: null } }); + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile"); // same value again + await settle(); + assert.deepStrictEqual(f.calls, [TOKEN]); + assert.ok(!f.windows[0].isDestroyed()); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + const r = await done; + assert.deepStrictEqual(f.calls, [TOKEN, OTHER]); + assert.strictEqual(r.ok, true); + assert.strictEqual(r.user, null); +}); + +test("the token is never logged, and an error that echoed it is scrubbed", async () => { + const seen = []; + const names = ["log", "info", "warn", "error", "debug", "trace"]; + const saved = Object.fromEntries(names.map((n) => [n, console[n]])); + const writes = [process.stdout.write, process.stderr.write]; + for (const n of names) console[n] = (...a) => { seen.push(a.map(String).join(" ")); }; + process.stdout.write = (c, ...rest) => { seen.push(String(c)); return writes[0].call(process.stdout, c, ...rest); }; + process.stderr.write = (c, ...rest) => { seen.push(String(c)); return writes[1].call(process.stderr, c, ...rest); }; + let r; + try { + const f = fakes(); + f.setAnswer((t) => ({ status: 500, data: { error: `RuntimeError: bad ${t} and ${t.slice(0, 12)}` } })); + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + f.windows[0].close(); // the user gives up + r = await done; + } finally { + for (const n of names) console[n] = saved[n]; + [process.stdout.write, process.stderr.write] = writes; + } + assert.strictEqual(r.ok, false); + assert.strictEqual(r.cancelled, true); + assert.ok(!r.error.includes(TOKEN) && !r.error.includes(TOKEN.slice(0, 12)), r.error); + assert.match(r.error, //); + assert.ok(!seen.some((s) => s.includes(TOKEN.slice(0, 12))), "token in output"); + assert.strictEqual(scrub(`x FRL${"a".repeat(30)} y`), "x y"); +}); + +test("closing the window before signing in reports it, and a second click reuses the open window", async () => { + const f = fakes(); + const a = f.flow.signIn(); + const b = f.flow.signIn(); + assert.strictEqual(a, b); + assert.strictEqual(f.windows.length, 1); + assert.strictEqual(f.windows[0].focused, 1); + f.windows[0].close(); + const r = await a; + assert.deepStrictEqual(r, { ok: false, cancelled: true, error: "The sign-in window was closed before you signed in." }); + assert.deepStrictEqual(f.calls, []); +}); + +test("disconnect's sign-out closes the window and clears only the sign-in partition", async () => { + const f = fakes(); + f.session.fromPartition("persist:other"); + const pending = f.flow.signIn(); + await f.flow.signOut(); + const r = await pending; + assert.strictEqual(r.ok, false); + assert.ok(f.windows[0].isDestroyed()); + assert.deepStrictEqual(f.meta().cleared, [["storage", undefined], ["cache"], ["auth"]]); + assert.deepStrictEqual(f.session.defaultSession.cleared, []); + assert.deepStrictEqual(f.session.fromPartition("persist:other").cleared, []); + // The next sign-in starts with a new window. + f.flow.signIn(); + assert.strictEqual(f.windows.length, 2); + f.windows[1].close(); +}); + +test("the first look at a cookie value matches the server's token rules", () => { + assert.ok(looksLikeUserToken(TOKEN)); + assert.ok(looksLikeUserToken("FRL" + "aB3".repeat(10))); + for (const bad of [undefined, "", "OC123456789012345", "OC|123|abc", "OCabc%2Fdef" + "x".repeat(20), "OCshort", + "XY" + "a".repeat(30), "OC" + "A".repeat(30)]) { + assert.ok(!looksLikeUserToken(bad), String(bad)); + } +}); + +function frameNav(wc, url, isMainFrame) { + let prevented = false; + wc.emit("will-frame-navigate", { url, isMainFrame, preventDefault: () => { prevented = true; } }); + return prevented; +} + +test("the window stays on Meta's sites; frames inside it may load any HTTPS page, nothing else", async () => { + const f = fakes(); + f.flow.signIn(); + const wc = f.windows[0].webContents; + // Frames: captcha and CDN frames from other sites load; other schemes are stopped. + for (const ok of ["https://client-api.arkoselabs.com/fc/gc/", "https://newassets.hcaptcha.com/captcha/v1/x", + "https://www.google.com/recaptcha/api2/anchor", "https://static.xx.fbcdn.net/x", + "https://www.facebook.com/plugin", "about:blank", "about:srcdoc"]) { + assert.strictEqual(frameNav(wc, ok, false), false, ok); + } + for (const bad of ["http://www.facebook.com/plugin", "data:text/html,", "blob:https://evil.example/1", + "javascript:alert(1)", "file:///etc/passwd", "ftp://example.com/", "https://u:p@evil.example/", + "chrome://settings", "not a url"]) { + assert.strictEqual(frameNav(wc, bad, false), true, bad); + } + // The window itself: Meta's sites only. + assert.strictEqual(frameNav(wc, "about:blank", true), true); + assert.strictEqual(frameNav(wc, "https://evil.example/", true), true); + assert.strictEqual(frameNav(wc, "https://client-api.arkoselabs.com/", true), true); + assert.strictEqual(frameNav(wc, "https://auth.meta.com/login/", true), false); + assert.deepStrictEqual(f.opened, []); // stopped, never opened outside + f.windows[0].destroy(); +}); + +function redirect(wc, url, isMainFrame, style) { + let prevented = false; + const e = { preventDefault: () => { prevented = true; } }; + if (style === "details") wc.emit("will-redirect", Object.assign(e, { url, isMainFrame })); + else wc.emit("will-redirect", e, url, false, isMainFrame); + return prevented; +} + +test("redirects follow the same rule per frame", async () => { + const f = fakes(); + f.flow.signIn(); + const wc = f.windows[0].webContents; + for (const style of ["details", "positional"]) { + // A captcha frame redirected within HTTPS loads; a frame redirected to data: or http: doesn't. + assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", false, style), false, style); + assert.strictEqual(redirect(wc, "https://newassets.hcaptcha.com/x", false, style), false, style); + assert.strictEqual(redirect(wc, "data:text/html,x", false, style), true, style); + assert.strictEqual(redirect(wc, "http://www.facebook.com/x", false, style), true, style); + assert.strictEqual(redirect(wc, "javascript:alert(1)", false, style), true, style); + // The window: Meta's sites only. + assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", true, style), true, style); + assert.strictEqual(redirect(wc, "https://auth.meta.com/next", true, style), false, style); + } + // Without frame information it is treated as the window. + assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/", undefined, "positional"), true); + assert.deepStrictEqual(f.opened, []); + f.windows[0].destroy(); +}); + +test("a redirect the window stops is named when the window is closed", async () => { + const f = fakes(); + const p = f.flow.signIn(); + const wc = f.windows[0].webContents; + assert.strictEqual(redirect(wc, "https://www.instagram.com/x?next=1", true, "details"), false); // Meta's login goes here + assert.strictEqual(redirect(wc, "https://login.evil.example/cb?code=SECRET", true, "details"), true); + f.windows[0].close(); + const r = await p; + assert.strictEqual(r.ok, false); + assert.match(r.error, /went to login\.evil\.example, which Frame Control doesn't allow/); + assert.doesNotMatch(r.error, /SECRET|code=/); +}); + +test("a stopped redirect is forgotten once the window loads a page again", async () => { + const f = fakes(); + const p = f.flow.signIn(); + const wc = f.windows[0].webContents; + assert.strictEqual(redirect(wc, "https://login.evil.example/cb", true, "details"), true); + wc.emit("did-navigate", {}, "https://auth.meta.com/login/"); // the user carried on + f.windows[0].close(); + assert.deepStrictEqual(await p, { ok: false, cancelled: true, error: "The sign-in window was closed before you signed in." }); +}); + +test("a page's beforeunload can't keep the window open", async () => { + const f = fakes(); + const done = f.flow.signIn(); + const w = f.windows[0]; + let prevented = false; + w.webContents.emit("will-prevent-unload", { preventDefault: () => { prevented = true; } }); + assert.ok(prevented); + // Even if close() would be vetoed, finishing destroys the window. + w.veto = true; + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + assert.strictEqual((await done).ok, true); + assert.ok(w.isDestroyed()); +}); + +test("closing during a connect: the cancel goes to the server only after that connect settles", async () => { + for (const outcome of ["saved", "refused", "failed"]) { + const f = fakes(); + let release, fail; + f.setAnswer(() => new Promise((r, j) => { release = r; fail = j; })); + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + assert.deepStrictEqual(f.calls, [TOKEN]); + f.windows[0].close(); // the user gives up while the server and Meta are answering + const r = await done; // the page hears at once + assert.strictEqual(r.ok, false); + await settle(); + assert.deepStrictEqual(f.cancels, [], outcome); // not before the connect has settled + if (outcome === "saved") release({ status: 200, data: { connected: true } }); + else if (outcome === "refused") release({ status: 400, data: { error: "no" } }); + else fail(new Error("socket hang up")); + await settle(); + // The same attempt id the connect carried, after it settled and after cookie intake stopped. + assert.deepStrictEqual(f.cancels, [f.attempts[0]], outcome); + assert.match(f.cancels[0], /^[A-Za-z0-9-]{8,64}$/); + assert.deepStrictEqual(f.log, ["connect", "destroyed", "cancel (cookie listeners: 0)"], outcome); + assert.deepStrictEqual(f.calls, [TOKEN]); + } +}); + +test("closing before any connect needs no cancel", async () => { + const f = fakes(); + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: TOKEN }); // nothing usable + await settle(); + f.windows[0].close(); + assert.strictEqual((await done).ok, false); + await f.flow.signOut(); + await settle(); + assert.deepStrictEqual(f.calls, []); + assert.deepStrictEqual(f.cancels, []); +}); + +test("a timeout during a connect cancels after it settles", async () => { + const f = fakes({ timeout: 50 }); + let release; + f.setAnswer(() => new Promise((r) => { release = r; })); // Meta is slow + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + const r = await done; + assert.match(r.error, /timed out/); + assert.ok(f.windows[0].isDestroyed()); + assert.deepStrictEqual(f.cancels, []); + release({ status: 400, data: { error: "no" } }); + await settle(); + assert.deepStrictEqual(f.cancels, [f.attempts[0]]); +}); + +test("disconnect during a connect waits for it, cancels it, then clears, before the page deletes the account", async () => { + const f = fakes(); + let release; + f.setAnswer(() => new Promise((r) => { release = r; })); + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + f.log.length = 0; + let signedOut = false; + const out = f.flow.signOut().then(() => { signedOut = true; }); // the page's Disconnect, step one + assert.strictEqual((await done).ok, false); + await settle(); + assert.strictEqual(signedOut, false); // still waiting for the connect + assert.deepStrictEqual(f.cancels, []); + release({ status: 200, data: { connected: true } }); // it saved, just now + await out; + // Only now would the page post its disconnect: the cancel (which deletes what that + // connect saved) has reached the server, and the session is cleared. + assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]); + assert.deepStrictEqual(f.cancels, [f.attempts[0]]); +}); + +test("a later disconnect still waits for a closed window's connect", async () => { + const f = fakes(); + let release; + f.setAnswer(() => new Promise((r) => { release = r; })); + const done = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + f.windows[0].close(); + await done; + let signedOut = false; + const out = f.flow.signOut().then(() => { signedOut = true; }); + await settle(); + assert.strictEqual(signedOut, false); + release({ status: 400, data: { error: "no" } }); + await out; + assert.deepStrictEqual(f.cancels, [f.attempts[0]]); +}); + +test("nothing sent means nothing to cancel; sign-out destroys the window, cancels, then clears", async () => { + const f = fakes(); + // Nothing sent: closing cancels nothing. + const a = f.flow.signIn(); + f.windows[0].close(); + await a; + assert.deepStrictEqual(f.cancels, []); + // Something sent, then signed out: the attempt is cancelled before the session is cleared. + f.setAnswer(() => ({ status: 400, data: { error: "Meta didn't accept this token." } })); + const b = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + f.windows[1].veto = true; // and its page tries to stay open + f.log.length = 0; + await f.flow.signOut(); + assert.strictEqual((await b).ok, false); + assert.ok(f.windows[1].isDestroyed()); + assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]); + assert.deepStrictEqual(f.cancels, [f.attempts[0]]); + // After sign-out a new cookie in the partition sends nothing. + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + await settle(); + assert.deepStrictEqual(f.calls, [TOKEN]); +}); + +test("each sign-in has its own attempt id", async () => { + const f = fakes(); + f.setAnswer(() => ({ status: 400, data: { error: "no" } })); + const a = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + f.windows[0].close(); + await a; + const b = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + await settle(); + f.windows[1].close(); + await b; + await settle(); + assert.strictEqual(f.attempts.length, 2); + assert.notStrictEqual(f.attempts[0], f.attempts[1]); + assert.deepStrictEqual(f.cancels, f.attempts); +}); + +test("no sign-in can start while a sign-out waits on an earlier connect", async () => { + const f = fakes(); + let release; + f.setAnswer(() => new Promise((r) => { release = r; })); + const first = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + const out = f.flow.signOut(); // Disconnect pressed while that connect is under way + assert.strictEqual((await first).ok, false); + assert.ok(f.flow.isSigningOut()); + // The page answered, so the user tries again at once: refused, no window, nothing sent. + const second = await f.flow.signIn(); + assert.deepStrictEqual(second, { ok: false, error: "Frame Control is signing out of Meta; try again in a moment." }); + assert.strictEqual(f.windows.length, 1); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + await settle(); + assert.deepStrictEqual(f.calls, [TOKEN]); + // A second sign-out joins the first. + assert.strictEqual(f.flow.signOut(), out); + release({ status: 200, data: { connected: true } }); + await out; + assert.deepStrictEqual(f.cancels, [f.attempts[0]]); + assert.strictEqual(f.meta().cleared.filter(([k]) => k === "storage").length, 1); + assert.ok(!f.flow.isSigningOut()); + // Once it is done, signing in works again. + f.setAnswer(() => ({ status: 200, data: { connected: true } })); + const third = f.flow.signIn(); + assert.strictEqual(f.windows.length, 2); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + assert.strictEqual((await third).ok, true); +}); + +test("sign-out goes round until no window and no connect or cancel is left", async () => { + const f = fakes(); + let releaseA; + f.setAnswer(() => new Promise((r) => { releaseA = r; })); + const a = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN }); + await settle(); + f.windows[0].close(); // window A closed; its cancel waits on its connect + await a; + // Window B is open, with its own connect under way, when sign-out starts. + let releaseB; + f.setAnswer(() => new Promise((r) => { releaseB = r; })); + const b = f.flow.signIn(); + f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER }); + await settle(); + let finished = false; + const out = f.flow.signOut().then(() => { finished = true; }); + await b; + releaseB({ status: 400, data: { error: "no" } }); + await settle(); + assert.strictEqual(finished, false); // A's connect is still under way + releaseA({ status: 200, data: { connected: true } }); + await out; + assert.deepStrictEqual([...f.cancels].sort(), [...f.attempts].sort()); + assert.strictEqual(f.attempts.length, 2); + assert.strictEqual(f.log[f.log.length - 1], "clear"); +}); diff --git a/app/test/updater.test.js b/app/test/updater.test.js index 4bf9594..2ae00af 100644 --- a/app/test/updater.test.js +++ b/app/test/updater.test.js @@ -51,6 +51,27 @@ test("update.json assets always download from this repository's release", () => assert.throws(() => require("../updater").fromManifest({ version: "nope", assets: [] })); }); +test("the release page is this repository's tag page, never a draft's untagged-... link", () => { + const { fromManifest, fromApi } = require("../updater"); + const tagPage = "https://github.com/saphid/frame-control/releases/tag/v0.4.0"; + const page = (p) => fromManifest({ version: "0.4.0", assets: [], page: p }).page; + assert.strictEqual(page(tagPage), tagPage); + // 0.4.0's real update.json: the draft's address, a 404 once published. + assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/untagged-c6ddfed7f75d67db2e99"), tagPage); + assert.strictEqual(page(undefined), tagPage); + assert.strictEqual(page("https://evil.example/releases/tag/v0.4.0"), tagPage); + assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/v0.4.0?x=1"), tagPage); + // Paths that normalize to another repository. + assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/..\\..\\..\\..\\other-owner\\other-repo"), + tagPage); + assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/%2e%2e/%2e%2e/%2e%2e/%2e%2e/other-owner/other-repo"), + tagPage); + assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/v0.3.9"), tagPage); // only its own tag + assert.strictEqual(fromApi({ tag_name: "../../x", assets: [] }).page, "https://github.com/saphid/frame-control/releases"); + assert.strictEqual(fromApi({ tag_name: "v0.4.0", assets: [], + html_url: "https://github.com/saphid/frame-control/releases/tag/untagged-x" }).page, tagPage); +}); + test("prepare refuses a release that isn't newer (no downgrades)", async () => { const { prepare } = require("../updater"); const release = { version: "0.3.1", assets: [] }; diff --git a/app/updater.js b/app/updater.js index 85caab5..e6ccbc9 100644 --- a/app/updater.js +++ b/app/updater.js @@ -106,12 +106,24 @@ async function getJson(url, headers) { return JSON.parse(body); } +// The release page the banner links to. update.json for 0.4.0 carried the draft's +// address (releases/tag/untagged-...), which is dead once the release is published, +// and a page from the manifest could also be steered elsewhere (e.g. tag/..\..\other/repo +// normalizes to another repository) before shell.openExternal. So the given page is +// ignored: the link is always this repository's tag page, built from a valid version. +function releasePage(version) { + const v = parseVersion(version); + if (!v) return RELEASES; + return `${RELEASES}/tag/v${v.nums.join(".")}${v.pre ? "-" + v.pre : ""}`; +} + // update.json and the API's release both become { version, notes, page, assets }. function fromManifest(m) { if (!parseVersion(m.version) || !Array.isArray(m.assets)) throw new Error("update.json is malformed"); - const base = `https://github.com/${REPO}/releases/download/v${String(m.version).replace(/^v/i, "")}/`; - return { version: String(m.version).replace(/^v/i, ""), notes: String(m.notes || "").slice(0, 4000), - page: m.page || RELEASES, + const version = String(m.version).replace(/^v/i, ""); + const base = `https://github.com/${REPO}/releases/download/v${version}/`; + return { version, notes: String(m.notes || "").slice(0, 4000), + page: releasePage(version), // Assets always come from this repository's release, whatever the manifest says. assets: m.assets.map((a) => ({ name: String(a.name), url: base + encodeURIComponent(String(a.name)), size: a.size, digest: a.digest || null })) }; @@ -119,8 +131,9 @@ function fromManifest(m) { function fromApi(r) { if (r.draft || r.prerelease) throw new Error("GitHub returned an unpublished release"); - return { version: String(r.tag_name || "").replace(/^v/i, ""), notes: String(r.body || "").slice(0, 4000), - page: r.html_url || RELEASES, + const version = String(r.tag_name || "").replace(/^v/i, ""); + return { version, notes: String(r.body || "").slice(0, 4000), + page: releasePage(version), assets: (r.assets || []).map((a) => ({ name: a.name, url: a.browser_download_url, size: a.size, digest: a.digest || null })) }; } diff --git a/docs/apks.md b/docs/apks.md index 4a841d4..458bcb5 100644 --- a/docs/apks.md +++ b/docs/apks.md @@ -39,6 +39,12 @@ section below), instead of going into Lepton Development: run at once alongside Lepton Development, each in its own container (`lepton-steamlaunch-`, ADB on 5556, 5557, …). +Split APKs (a base plus `split_*.apk` files) install as one app: +`python3 ui/frame_android.py install base.apk split1.apk …`. Lepton runs one +APK, so splits that add native libraries or assets are merged into the base +and re-signed; density and language splits are refused. See +[quest-import.md](quest-import.md#split-apks). Not yet tried on a real Frame. + Verified with AntennaPod and Tabletop Tools: installed in about 7 s, launched from the shortcut, stopped, and relaunched with their data intact. ADB and Lepton Development aren't involved. diff --git a/docs/devices.md b/docs/devices.md index 4cfd823..6d4bf50 100644 --- a/docs/devices.md +++ b/docs/devices.md @@ -115,7 +115,9 @@ connection is an SSH ControlMaster that every command shares; when it dies (the headset slept or left the network) the connector notices and starts again. On Windows, where OpenSSH can't share a connection, the same handshake runs once and each command then connects on its own; a command that can't reach the -headset makes the connector start again. +headset makes the connector start again. There ssh's stderr goes to a file that +the connector reads as it grows, not a pipe: Windows' OpenSSH can block writing +to a redirected pipe. Once connected, every `ssh`, `scp` and `rsync` the app runs gets `-o HostName=
-o HostKeyAlias=frame-control- @@ -132,10 +134,57 @@ lease that moved) would look like a new host there. The app keeps one known_host file per headset instead, so saving or forgetting one headset's key never touches another's: a different device answering at one of its addresses is refused, and the pill says so. A headset's first connection trusts -the key it shows, as Set Up Connection does. After reinstalling SteamOS the -headset has a new key; **Forget identity** (Devices tab → **Advanced**, with the -SSH alias, user and port) lets the next -connection save the new one. +the key it shows, as Set Up Connection does: while a headset has never had an +identity here, every ssh command gets `StrictHostKeyChecking=accept-new` (the +first contact saves it, whichever command makes it), and from then on +`StrictHostKeyChecking=yes`. `accept-new` never replaces a saved key, so it +can't hide a change. The saved key's fingerprint is also recorded in +`devices.json` (`identity`), along with a flag that never clears +(`identity_established`), as soon as ssh saves the key: even if the login is then +refused. A headset counts as having had an identity if the flag is set, a +fingerprint is recorded, its pin file exists at all, or a connection to it ever +worked (older files get the flag from that when loaded, so editing or removing +the address that worked doesn't undo it); then +a pin file that's deleted, empty, unreadable or not parseable **fails closed** +(*Checking the headset's identity* fails, "missing or can't be read") rather than +trusting whatever answers, and only **Check its key…** saves a key again. It +says when the key it reads matches the recorded fingerprint. + +**When the key changes** (SteamOS reinstalled or reset, a new headset at the +same address, or a different device answering there), nothing is accepted by +itself. The connection fails at *Checking the headset's identity*; the banner +and the headset on the Devices tab say so, with **Check the new key…** (also +**Check its key…** on the Devices tab at any time). That reads the key the +headset shows now, and nothing more: ssh writes it to a throwaway known_hosts +file during the key exchange, before any login, and is stopped as soon as it +has. Every other kind of contact is ruled out on the command line, ahead of +anything `~/.ssh/config` says: no authentication of any kind, no agent +(`IdentityAgent=none`, `ForwardAgent=no`), no X11 or port forwarding, no local +or remote command (`-N`), no terminal, and `-F none`. Through a ProxyJump host +it builds that hop itself, as a ProxyCommand whose ssh forwards nothing and runs +no local command (ProxyJump's own ssh would take `ForwardAgent` and +`LocalCommand` from `~/.ssh/config`); it still logs in to the jump host as +configured. Every word of that ProxyCommand is quoted for the shell that runs it +(and `%` doubled for ssh's own tokens), the forward is `[%h]:%p` so an IPv6 +headset works, and an IPv6 jump host is passed bare with its port. Through a ProxyCommand from `~/.ssh/config`, or several jump hosts, +it refuses, since those can't be made safe from here: add an address it can +reach directly, or compare the key by hand. It shows the key's SHA256 fingerprint next to +the saved one, with the command that prints it on the headset +(`ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub`, in Konsole on its desktop). +**This is my headset: trust its new key** then saves exactly that key, replacing +the old one, and reconnects. The server keeps the key it showed for 10 minutes +and saves it only if the page sends back the same fingerprint, and only while +the headset's port, user and that address are unchanged; it never saves whatever +answers next. The API's old `forget-identity`, which deleted the pin so that the +next contact saved any key unseen, is refused. Set Up Connection can't fix a changed key: it checks your +own `known_hosts`, not the headset's file. + +**When the headset refuses this computer's key** (`Permission denied +(publickey,…)`), the connection stops at *Logging in*, and the banner and the +Devices tab offer **Set Up Connection…**, which pairs this computer again. + +Neither is reported as a fault: the diagnostics report each kind at most once +a session ([privacy.md](privacy.md)). ## One server at a time @@ -156,7 +205,7 @@ All under the usual `/api/` guards (loopback `Host`, `X-Frame-UI` header). | `GET /api/devices` | Headsets, the current network, known networks, the next free alias | | `GET /api/devices/tailscale?id=` | Tailscale peers, likely headsets first | | `GET /api/devices/mdns?id=` | Headsets found on this network | -| `POST /api/devices` | `{"action": ...}`: `use`, `update` (name, user, port), `remove`, `address-add`, `address-update`, `address-remove`, `address-move`, `test`, `forget-identity`, `name-network`, `setup` (alias, optional host), `retry` | +| `POST /api/devices` | `{"action": ...}`: `use`, `update` (name, user, port), `remove`, `address-add`, `address-update`, `address-remove`, `address-move`, `test`, `identity-scan` (read the key the headset shows: `scan` with `type`, `fingerprint`, `host`, `saved`, `recorded`, `matches`, `recorded_match`), `identity-trust` (`fingerprint`: save the key `identity-scan` showed), `forget-identity` (refused: use the two before), `name-network`, `setup` (alias, optional host), `retry` | Every host, alias and user is checked against strict patterns before it's stored, because they end up in ssh arguments and `~/.ssh/config`; nothing goes @@ -173,7 +222,7 @@ share the format later (it still connects to one host; see ```json {"version": 1, "active": "f67f8b7e", "devices": [{"id": "f67f8b7e", "name": "Steam Frame", "alias": "frame", "user": "steamos", "port": 22, - "identity_files": ["~/.ssh/id_ed25519_frame"], + "identity_files": ["~/.ssh/id_ed25519_frame"], "identity": ["SHA256:…"], "identity_established": true, "addresses": [{"host": "frame.local", "kind": "mdns", "label": "", "networks": ["n-e0998baa61"], "last_ok": 1790593550.4, "last_rtt_ms": 0.9}]}], "networks": {"n-e0998baa61": {"name": "Home Wi-Fi", "ssid": null, "gateway": "192.168.1.1", diff --git a/docs/frame-control.md b/docs/frame-control.md index 4c10fe9..f714e6f 100644 --- a/docs/frame-control.md +++ b/docs/frame-control.md @@ -17,16 +17,18 @@ python3 ui/server.py # anywhere: then open http://127.0.0.1:47810 ## Features -The window has five tabs: **Home** (what the headset's doing and what you'd do +The window has six tabs: **Home** (what the headset's doing and what you'd do next, the headset view, screenshots, family and comfort, the keyboard and trackpad, and VR performance, folded away), **Games** (installed games, sideloaded titles, getting games), **Android** (apps, the catalogue, display settings, reports), **Tools** (in the headset: your computer's windows, the media player and the panel switcher; then sending files and text, Flatpaks, remote and -power) and **Devices** (your headsets and their addresses). Keys 1–5 switch -between them. The gear in the header (key 6) opens **Settings**: privacy and -updates, library artwork and the assistant. The battery chip opens the headset's -details: storage, memory, temperature, Wi-Fi, uptime and SteamOS build. Files can be dropped anywhere in the window. A +power), **Devices** (your headsets and their addresses), and **Control** (the +searchable Control Center, metrics, supported settings and headset guidance). +Keys 1–6 switch between them. The gear in the header (key 7) opens **Settings**: +privacy and updates, library artwork and the assistant. The battery chip opens +the headset's details: storage, memory, temperature, Wi-Fi, uptime and SteamOS +build. Files can be dropped anywhere in the window. A connection pill in the header always shows which headset and whether it's connected, and how (Tailscale, or the network's name). Click it to add, edit or reorder the headset's addresses, or to see each step of connecting. When the Frame can't be @@ -93,8 +95,68 @@ counts them while they run. name your networks, and switch headsets. See [devices.md](devices.md). - **One-click tools**: SSH or SFTP in a terminal window, Steam Link, and remote desktop (Windows App on macOS, Remote Desktop on Windows, Remmina or FreeRDP on - Linux). Sleep, restart and shut down open a terminal window because SteamOS - asks for the sudo password over SSH. + Linux). Remote desktop first checks that the Frame's xrdp answers on port + 3389 (Developer Mode turns it on). On Windows it opens a connection file for + user `steamos`, because `mstsc /v:` alone offers your Windows account, which + xrdp turns away. Accept the warning about the Frame's own certificate, then + sign in with the Developer Mode password. Sleep, restart and + shut down open a terminal window because SteamOS asks for the sudo password + over SSH. + +## Control Center + +Open **Control** or `#control` to search controls, status and help. Categories +cover device/audio, VR/comfort, apps/files, connection/remote and Frame Control +preferences. Search is local: it matches labels, descriptions and familiar terms +such as “DPI”, “microphone”, “recenter” and “keep awake”. Queries are not sent to +Steam, app catalogues, analytics or models. Choosing a workflow link opens its +existing screen; it does not install, cast, open a helper or change a setting. +Home, Games, Android, Tools and Devices retain their existing features. + +The overview and detail cards use the shared `/api/status` sample: charge and +power, user/system storage, memory, Wi-Fi, IP, OS/build, uptime, detected services +and VR timings. Values refresh with the normal 30-second poll. A failed status +request, lost connection, headset switch or sample received more than 90 seconds +ago clears current readings and disables audio writes. The client receipt time +and failed-read state are retained through page startup and UI redraws. Only a +new successful status read clears a failure; reusing the retained sample does not. +The headset timestamp is shown without assuming +its clock matches this computer. Missing sensors show **Unavailable**; +they are not converted to zero. Compositor FPS is separate from application FPS; +GPU time is render time, not GPU utilisation. The temperature is the hottest +readable sensor. Thermal trip warnings use per-zone kernel hot/critical limits, +not a guessed universal temperature threshold. + +**Audio** controls the default output sink through the existing `/api/volume` +endpoint. Moving its slider prepares a value; **Apply volume** sends it. **Mute** +and **Unmute** send explicit mute states. The UI captures the selected headset, +blocks duplicate/pending actions, and requests status after command acknowledgment +for readback, draining an earlier poll first. Mute preserves an unapplied volume +draft; switching headsets discards it. It reports +unconfirmed or differing output separately from confirmed state. API validation +rejects invalid types, out-of-range levels and invalid mute states before SSH. + +Other settings link to the existing forms and their validation, progress, +confirmations and reset behavior: per-instance Android resolution/density/text, +comfort sessions and alerts, media layouts, Mac streaming quality, privacy, +sources and artwork. Android display links reveal **On your Frame** before +scrolling to the form. Mac streaming remains searchable on all platforms, with +its action shown only when the server is on macOS. + +Hardware guidance is deliberately separate from controls. Microphone/routing, +brightness, refresh selection, optics, controllers, Bluetooth, passthrough, +tracking-origin changes, saved spatial layouts, firmware updates and recovery +have no verified remote setting here. Use the headset's own controls or the +documented manual procedures. Movement comfort remains per-game; automatic +sleep is in Steam Settings → Power → Sleep after inactivity. Keep-awake and +Android data backup/restore remain script/MCP capabilities, not new UI switches. + +**Verification:** the Control Center's JavaScript runs under Node with mocked +API and DOM boundaries; the server tests mock SSH and reject invalid values +before any device command. Packaging tests cover the shared CSS/JS in desktop +and iPhone bundles. These checks establish wiring, search, navigation, offline, +error and device-switch behavior; they do not establish wearer experience, +physical settings persistence or a new hardware capability. ## How it works diff --git a/docs/img/control-center/desktop.png b/docs/img/control-center/desktop.png new file mode 100644 index 0000000..7f1bfed Binary files /dev/null and b/docs/img/control-center/desktop.png differ diff --git a/docs/img/control-center/phone.png b/docs/img/control-center/phone.png new file mode 100644 index 0000000..586d577 Binary files /dev/null and b/docs/img/control-center/phone.png differ diff --git a/docs/meta-library.md b/docs/meta-library.md new file mode 100644 index 0000000..561d660 --- /dev/null +++ b/docs/meta-library.md @@ -0,0 +1,371 @@ +# My Meta library (Experimental) + +Install Quest games your Meta account owns straight from Meta, test whether +they run on the Steam Frame, and add the result to the shared compatibility +reports. It is off until you connect, and it lives in **Android → My Meta +library**. + +**Read this first.** My Meta library uses Meta's undocumented internal API +with your own Meta access token, as the open-source tools QAVS, DownQuest and +BSManager do. It may stop working whenever Meta changes things, and using it +may be against Meta's terms. Your account is your responsibility. Frame +Control is unofficial and not made or endorsed by Meta or Valve. + +What it will and won't do: + +- It lists and downloads only games your account owns (its active + entitlements). It never downloads anything else. +- It installs games as Meta ships them. There is **no licence-check bypass**: + no patching, no stub libraries, no OVRPort or FramePort. A game that + enforces Meta's licence check may quit or hang on the Frame, because that + check needs Meta's services, which the Frame doesn't have. +- Game files go only to a cache folder on your computer and then to your + Frame. They are deleted from the cache after each install, and never + uploaded or shared. Reports carry results only (below), never files or your + token. + +## Your token + +Frame Control never reads your browser's cookies. There are two ways to give +it your token. + +**Sign in with Meta** (desktop app only; a plain browser doesn't show it). +Tick **I understand…**, then choose **Sign in with Meta…**. Meta's own login +page (`https://secure.oculus.com`, the address BSManager's "Log in with Meta" +opens) appears in a Frame Control window. Sign in there as usual. When Meta's +site sets its access token cookie (`oc_ac_at`), Frame Control takes it from +that window, connects with it exactly as if you had pasted it (below), and +closes the window. The window: + +- has its own storage (the Electron session `persist:meta-signin`), separate + from Frame Control's main window and from every browser on your computer; + the cookie is read only from there, and only for `oculus.com`; +- runs Meta's page sandboxed, with no access to Frame Control (no preload, no + Node, context isolation on, no developer tools) and every permission request + or check (camera, notifications…) refused; +- only goes to `https://` pages on `oculus.com`, `meta.com`, `facebook.com` and + `instagram.com` (and their subdomains; Meta's login passes through Instagram). + A link anywhere else opens in your system browser; a redirect anywhere else + is stopped, and closing the window then says where it went. Pop-ups on those sites open in the same + window. Frames inside the page may load any `https://` page (Meta's login + can embed captcha and CDN frames from other sites, such as Arkose Labs, + hCaptcha, reCAPTCHA or fbcdn) or an empty frame (`about:blank`, + `about:srcdoc`); a frame going to any other scheme (`http:`, `data:`, + `blob:`, `javascript:`, `file:`…) is just stopped. Redirects follow the same + rule for the frame they happen in. Frames can't reach the + token: the cookie is read by Frame Control's main process, and the window + has no IPC; +- sends a cookie value on only if it looks like a user token (`OC` or `FRL`, + mixed case, no `%`, `|` or `:`), and each value once. If the server refuses + it, the window stays open; close it to see why; +- gives up after 10 minutes, as BSManager does; +- when it is closed, times out or is signed out of, stops reading cookies + first, then is destroyed (a page's "leave this page?" can't keep it open), + and, if it had sent a token, tells the server to drop that sign-in: each + sign-in has a random attempt id. The cancel is sent only once the connect + under way has finished (saved, refused or failed), so the server always + gets it after the connect; with nothing sent, there is nothing to cancel. + The server lists an attempt only while its + connect is being checked: cancelled then, it isn't saved; cancelled just + after its token was saved (even before the connect has finished tidying + up), that token is deleted (as a disconnect). A cancel + never removes an account a later sign-in or a pasted token saved, and one + for an unknown attempt changes nothing. + +The page never sees the token: the desktop app hands it straight to the local +server's connect path and tells the page only the answer (connected, and your +Meta display name). It isn't logged anywhere. + +The window keeps you signed in to Meta (in `persist:meta-signin` only) until +you **Disconnect**, which also signs out of Meta in Frame Control: it clears +that window's cookies, storage and cache, so the next sign-in starts fresh. +**Sign out of Meta in Frame Control** next to the sign-in button does just +that part, for a sign-in that didn't connect. + +**Paste a token.** You copy your own token and paste it in. The two ways +BSManager's guide describes +([How to obtain your Oculus Token](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token)): + +1. **From the Meta website.** Sign in at `https://secure.oculus.com`. Open the + browser's developer tools, then **Application** (Chrome, Edge) or + **Storage** (Firefox) → **Cookies** → `https://secure.oculus.com`. Copy the + value of `oc_ac_at`. It starts with `OC`. +2. **From the Meta Quest PC app** (Windows). Press **Ctrl+Shift+I**, open + **Network**, press **Ctrl+R**, type `graph` in the filter, open the first + request, and copy the access token from its **Payload**. It starts with + `FRL`. + +Treat it like a password: anyone with it can act as your Meta account. Signing +out of the Meta website or app usually ends it; then connect again with a new +one. + +Frame Control refuses values that can't be a user token before sending them +anywhere: anything not starting with `OC` or `FRL`, URL-encoded copies (with +`%`), app tokens (with `|` or `:`), cut-off values (under 20 characters), and +anything with characters other than letters, digits and `+ / = - _` (the +base64 and URL-safe base64 sets), or with no lower-case letter (real tokens are +mixed case). The public tools only describe tokens made +of letters and digits; if a real token needs another character, it has to be +added in one place (`TOKEN_CHARS` in `ui/frame_meta.py`), which also makes +the redaction look for it. + +## Using it + +1. Tick **I understand…**, then either choose **Sign in with Meta…** (desktop + app) or paste your token and choose **Connect**. Frame Control asks Meta + "who am I" with it (a read-only query); only a token Meta accepts is kept. +2. Your Quest games are listed with their version, size, game data, and the + community verdict from the compatibility database when there is one. +3. **Install** downloads the game and installs it on the Frame, as [Import + from my Quest](quest-import.md) does. A game with OBB game data then needs + a second **Install** while you have it open on the Frame: Frame Control + downloads the data, copies it in and closes the game. +4. **Install and test** does the same, then starts the game itself (twice if + it has game data to add: once to add it, once for the test), watches it for + about 30 seconds, and records what happened. **Test again** repeats only + the test. +5. Choose **Install** on as many games as you like: they wait in the + **Install queue** and install one after another, with Quest imports and + Android store installs. **Remove** takes one out before it starts. +6. **Disconnect** deletes the token from your computer and, in the desktop + app, signs out of Meta in Frame Control (clears the sign-in window's + storage). Games already on the Frame stay. + +From a terminal (the token is read from standard input, never an argument): + +```sh +python3 ui/frame_meta.py connect --token-stdin # paste the token, press Enter +python3 ui/frame_meta.py status +python3 ui/frame_meta.py list [--refresh] # owned Quest games, with community verdicts +python3 ui/frame_meta.py download APP_ID # into the local install cache (a later download clears it after 6 hours) +python3 ui/frame_meta.py install APP_ID [--test] [--allow-downgrade] +python3 ui/frame_meta.py test com.example.game [--wait 30] [--no-report] +python3 ui/frame_meta.py disconnect +``` + +The local API: `GET /api/meta` (connected or not, never the token), +`GET /api/meta?library=1[&refresh=1]` (the games), and `POST /api/meta` with +`{"action": "connect", "token": "...", "acknowledged": true}`, +`{"action": "disconnect"}`, `{"action": "cancel-signin", "attempt": "..."}`, `{"action": "install", "app": "APP_ID", "test": false, +"allowDowngrade": false}` or `{"action": "test", "package": "..."}`. Install and +test return a background job (`/api/job`); an install waits its turn in the +install queue (`/api/queue`, see [Import from my Quest](quest-import.md#using-it)). Sign in with Meta uses the same +`connect` action: the desktop app's main process (`app/meta-signin.js`) posts +it with the cookie's value and an `"attempt"` id (8 to 64 letters, digits or +`-`) once the page's acknowledgement box is ticked. A connect whose attempt +was cancelled while it was checked answers 409 and saves nothing; +`cancel-signin` for an attempt whose token is the saved account deletes it. + +## What an install does + +1. Checks the game is in your library (by its Meta app id), and that there's + room on this computer for the APK, a patched copy of it and the game data. +2. Downloads the APK from Meta's download server, within the size Meta + declared (and at most 2 GB), checking its SHA-256 if Meta gives one, and + that it is an APK of the package and version Meta said. +3. Runs Import from my Quest's checks. Refused: 32-bit-only builds (no + `arm64-v8a`), and apps that need an Android newer than Lepton's (API 30). + Installed with a warning: games that use Meta's licence check + (`libovrplatformloader.so`), and VrApi-only games ("may not run"). +4. Installs it with `frame_android.install` (VR detection, the launcher fix, + the OpenXR compatibility layer, artwork, a Steam library entry). An older + copy never silently replaces a newer one on the Frame unless you tick + **Allow replacing a newer version**. +5. Game data: the app's OBB (saved as Meta names it when that is a standard + `main|patch...obb` name, otherwise as + `main...obb`) and any *required* asset files with + standard OBB names, at most 8 GB each. One install downloads at most 16 GB + in all, APK included, counted as the bytes arrive (so files whose size Meta + doesn't give count too); a file that goes past it is stopped and removed. + The data is copied into the + running game by the same two-step helper Import from my Quest uses. Other + asset files (DLC packs, `.pak` files a game fetches through Meta's + Platform SDK) aren't downloaded; the result lists them. +6. Deletes everything it downloaded, whether the install worked or not. + Downloads left by a crash are removed after six hours. + +## The test, and the report + +The test starts the game, waits for its Lepton instance, then looks every 10 +seconds for 30 seconds: is the game's process alive, and what does its Android +log (main, system and crash buffers) say. It recognises: + +| In the log | Cause given | +|---|---| +| "entitlement check failed", "not entitled", `ovr_Entitlement…` or `IsUserEntitledToApplication` reporting a failure (a call that passes doesn't count) | Meta's licence check failed | +| Platform SDK initialisation errors | Meta's Platform SDK couldn't start | +| `Failed to launch SystemActivities`, "device not supported" | The game checks it is on a Meta Quest | +| `vrapi_… was called before…`, VrApi load errors | Legacy VrApi | +| `XR_ERROR_EXTENSION_NOT_PRESENT` (with the extension's name) | An OpenXR feature the Frame lacks | +| `XR_ERROR_API_VERSION_UNSUPPORTED`, runtime/initialisation failures | OpenXR version or session problems | +| `VK_ERROR_DEVICE_LOST`, `zink`, `libgallium_dri.so`, `GL_INVALID_…`, shader failures | Graphics driver errors | +| `ClipboardManager` | Lepton's missing clipboard service | +| `NoSuchMethodError`, `UnsatisfiedLinkError`, `dlopen failed` | Android or library features Lepton lacks | +| `FATAL EXCEPTION`, `Fatal signal`, `SIGSEGV` | A crash | +| `ANR in …`, "Input dispatching timed out" | Not responding | +| `XR_SESSION_STATE_SYNCHRONIZED/VISIBLE/FOCUSED`, `xrEndFrame` | The VR scene started | + +The outcome is one of **runs** or **runs with issues** (its VR scene +started), **quits** (closed by itself), **crashes**, **hangs** (Android +reported it not responding; Frame Control then closes it, and says so if it +couldn't), **didn't start** (its instance never came up), or **no clear +result**: it stayed open but its log never showed its VR scene starting. That +can be a game still loading, or one stuck after a failed check; Frame Control +can't tell, so it doesn't record it. A game already open is closed first, so +the test starts clean; if it can't be closed, nothing is tested. If the Frame +fails while the test reads the game or its log, the test says only that it +couldn't read the log: a failed command's output can be the game's log, so it +is never shown. Signatures look at the first 4 KB of each log line and are +bounded, so a huge or hostile log can't make the test slow. They +are written for Frame Control from the research in [vr-apks.md](vr-apks.md); +they are not copied from other tools. + +The result goes through the same path as **Test** and **Report** +(`frame_catalog.add_report`): `via` probe, source `meta-store`, the result +(`runs`, `crashes` or `instance_failed`, the values the database accepts), and +notes with the outcome, the cause, the names of the matched signals and the +version code, all fixed texts. Nothing else: no token, account name, file or +log text. The page may show a short name from the log next to the cause (an +OpenXR extension, a library, an exception class or a signal), taken from the +log line after the token is removed from it, and left out unless it looks like +a real name (64 characters at most, no long mixed letter-and-digit runs); +reports never carry it. It is always kept on this +computer; it reaches the shared database only if **Share compatibility +results** is on in Privacy settings, as for every report. The panel offers to +turn that on. + +## Your token and privacy + +- Kept in `meta-account.json` in Frame Control's per-user data folder + (`~/Library/Application Support/Frame Control` on macOS, + `%APPDATA%\Frame Control` on Windows, `~/.local/share/frame-control` on + Linux), written owner-only (0600) through a temporary file. Never on the + Frame. +- Sent only to `graph.oculus.com` (in the POST body) and + `securecdn.oculus.com` (in the download address, which is how that server + takes it), over HTTPS. A download that redirects elsewhere (Meta's CDN) is + followed only to a plain HTTPS address on port 443 that doesn't carry the + token in any form, anywhere (host, path, query or fragment; literal, + recased, percent-encoded, or 8+ characters of it), nor an `access_token` + parameter. That is checked before any lookup or connection, and a redirect + that fails it is refused. API answers that redirect are refused. +- Every connection goes to an address checked to be public (an allow-list: + no private, local, shared, reserved, multicast, NAT64, 6to4 or Teredo + addresses), and to exactly that address, with TLS checked for the host + name, so a second DNS answer can't swap in another. System proxy settings + aren't used. This is the same design as the itch.io purchases branch. +- Never in logs, error messages, API answers, the page or reports: every + message is cleaned first, matching the token (or any start of it of 8+ + characters) in any letter case, with each character written literally or + percent-encoded once or twice (%XX, %25XX) in either case, and any other + token-shaped value, before it is shortened. +- Disconnect deletes the file and the library Frame Control holds in memory, + and stops a download under way. A connect still being checked when you + disconnect is not saved. In the desktop app, before the token is deleted, it + also stops any sign-in under way, destroys the sign-in window, waits for a + connect still under way to finish and cancels its attempt (deleting its + token if it was just saved), and only then clears the `persist:meta-signin` session + (cookies, storage, cache); no other session is touched. Sign in with Meta + stays off from the moment you press Disconnect until the token is deleted, + and the app refuses a sign-in while it is signing out. +- With Sign in with Meta, a second copy of your Meta sign-in lives in that + session's storage, in Electron's per-user data folder (`Partitions/meta-signin`), + until you disconnect or sign out of Meta in Frame Control. + +## Where the protocol comes from + +Frame Control's code is its own (MIT). These public sources describe the +protocol; Frame Control takes only facts from them (addresses, query ids, +field names), not code. QAVS and BSManager are GPL-3.0; OculusGraphQLApiLib, +DownQuest and Oculus-downgrader state no licence. + +| Fact | Source | +|---|---| +| GraphQL at `https://graph.oculus.com/graphql`, POST, form fields `access_token`, `doc_id`, `variables`; `OAuthException` / code 190 for a bad token | [OculusGraphQLApiLib `GraphQLClient.cs`](https://github.com/ComputerElite/OculusGraphQLApiLib/blob/866081e2/OculusGraphQLApiLib/GraphQL/GraphQLClient.cs), [DownQuest `DownQuest.js`](https://github.com/ptrpaws/DownQuest/blob/50f5d558/DownQuest.js) | +| "Who am I": `doc_id` 4149322231793299, `data.viewer.user {id, alias}` | OculusGraphQLApiLib `GraphQLClient.cs` and `Results/User.cs` | +| Owned apps: `doc_id` 4850747515044496, `data.viewer.user.active_entitlements.nodes[].item` | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/Entitlement.cs`, `Results/Application.cs`; used by [QAVS `GameDownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/GameDownloadManager.cs) | +| One binary: `doc_id` 4734929166632773 with `binaryID`; fields `package_name`, `version`, `version_code`, `size`, `obb_binary`, `asset_files` (`file_name`, `size`, `is_required`) | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/OculusBinary.cs`, `Results/AssetFile.cs` | +| Downloads: `https://securecdn.oculus.com/binaries/download/?id=&access_token=`, the same for the APK, `obb_binary` and asset files; QAVS takes the OBB and required asset files | OculusGraphQLApiLib `Game/GameDownloader.cs`, [QAVS `DownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/DownloadManager.cs), DownQuest `DownQuest.js` | +| Token checks (`OC`/`FRL`, no `%`, `|`, `:`, not `OC` + 15 digits) | OculusGraphQLApiLib `GraphQL/TokenTools.cs`, [BSManager `oculus.helpers.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/shared/helpers/oculus.helpers.ts) | +| How users get a token (`oc_ac_at` cookie, or the PC app's `FRL` token) | [BSManager wiki](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token) | +| Sign in with Meta: open `https://secure.oculus.com` in an app window, and once it reaches `https://secure.oculus.com/my/profile` read the `oc_ac_at` cookie from that window's session (checked on `did-navigate`, `did-navigate-in-page`, `did-stop-loading`); 10-minute timeout | [BSManager `bs-oculus-downloader.service.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/main/services/bs-version-download/bs-oculus-downloader.service.ts) (`getUserTokenFromMetaAuth`) | + +**Assumed, not seen in those sources:** that the entitlement and binary +answers carry the fields above in the shapes the libraries' models describe +(the stored queries are opaque); that the list isn't paginated (none of the +tools page it); that `ANDROID_6DOF` marks Quest apps; where downloads redirect +to (the tools let their HTTP client follow redirects; Frame Control follows +up to five, to any public HTTPS host, and refuses one carrying the token); and +a `sha256` +field (none was seen, so in practice only sizes are checked). The log +signatures for the test are inferred from the compatibility research, not +from a real Frame. + +## Evidence and limits + +**Verified locally** with a fake Meta and a fake Frame (`tests/test_meta.py`): +token checks; storage owner-only through a temporary file; redaction (the +stored token recased and percent-encoded in either case, starts of it, other +token-shaped values, and redaction before cutting); HTTPS-only URLs; the +public-address allow-list, resolving once and connecting only to a checked +address within one deadline; redirects off Meta's hosts refused when they +carry the token anywhere, before any lookup; the token never sent to the +CDN; GraphQL redirects refused; disconnect beating a connect in flight and +stopping a download; library parsing (Quest apps only, nothing expired or +inactive, details from the binary query); downloads with an OBB; size, length +and checksum limits and the whole-install budget with nothing left behind; +refusing apps not in the +library; the handoff to Import from my Quest's checks, install and data step; +the licence-check warning instead of a refusal; test outcomes from log +fixtures (a passing licence check isn't a failure; no VR scene is no clear +result, not recorded); closing before a test and saying when a close failed; +reports carrying only fixed texts, no token, log text or file names. The +real TLS connection code is the same as the itch.io branch's and is exercised +here only with a fake connection. + +**Sign in with Meta, verified locally** with fake Electron windows, sessions +and cookies (`app/test/meta-signin.test.js`): the window's options (its own +partition, sandbox, context isolation, no Node, no preload) and Meta's login +address, no developer tools; permission requests and checks refused; the +navigation allow-list (links elsewhere open in the system browser, redirects +elsewhere are stopped, pop-ups never become windows); frames allowed any +HTTPS page but no other scheme, the window itself only Meta's sites; a +page's beforeunload not keeping the window open; the cookie read only from +`persist:meta-signin` and only for `oculus.com`, even when the default +session and another partition hold one; signed-out values ignored; a value +sent once, a refused one keeping the window open; the window closing after a +connect, with the page getting the answer and never the token; nothing +logged, and a server error that echoed the token scrubbed; closing the window +or signing out ending the wait; closing, timing out or signing out during a +connect cancelling that attempt (with its own id) after cookie intake stops +and only after that connect settles (saved, refused or failed), and no cancel +when nothing was sent; sign-out (Disconnect's first step) waiting for a +connect under way, even from a window closed earlier, before it finishes; +sign-out destroying the window before clearing only that partition; no +sign-in starting while a sign-out runs (it is refused: "try again in a +moment"), a second sign-out joining the first, and a sign-out waiting for +every window and connect started before it. The +frame redirects held to the frame rule, the window's to Meta's sites. The +server side (`tests/test_meta.py`): an attempt cancelled while Meta is +answering not saved, even after 300 other cancels; a cancel just after the +save deleting that token; a cancel never removing a later sign-in's or a +pasted token's account; unknown attempts changing nothing; no attempt left +listed after a connect, refused or not; attempt ids checked. + +**Differences from BSManager:** BSManager uses its app's default session (and +clears only `.oculus.com` cookies afterwards); Frame Control uses a session of +its own and clears all of it on disconnect. BSManager waits for +`/my/profile`; Frame Control also reacts to the cookie changing, and to any +`oculus.com` page, and lets the server decide whether the value is a +working token. + +**Not verified:** Sign in with Meta against Meta's real login page (no real +Meta account was used, and nothing was sent to Meta): whether Meta's login +still goes only through `oculus.com`, `meta.com` and `facebook.com`, whether +it uses pop-ups (they open in the same window here, which would break a +pop-up that reports back to its opener), whether `oc_ac_at` is still set on +`oculus.com` after login, and whether Meta accepts the window (Frame Control +removes Electron's name from the user agent as a precaution). A real Meta token and Meta's real answers (none was +available; nothing was sent to Meta), real downloads and their redirects, +real Quest games installed or tested on a real Frame, and whether the log +signatures match what real games print in Lepton. diff --git a/docs/privacy.md b/docs/privacy.md index 141f76d..af26741 100644 --- a/docs/privacy.md +++ b/docs/privacy.md @@ -33,23 +33,46 @@ computer, exactly as they were sent. yours. - Every event includes the app version, OS name (macOS, Windows or Linux), CPU architecture and Python version. +- `app_installed`, `app_updated` and `app_opened` carry `country`: a + two-letter code such as `DE`, worked out on your computer from its time zone + setting (`Europe/Berlin` becomes `DE`), so we can see roughly where Frame + Control is used without knowing your address. The time zone itself isn't + sent, and a setting that isn't a country's zone (such as UTC) sends nothing. + Copies that showed the first-run notice before it mentioned this (before + 0.4.6) show it again, and don't send a country until it has been seen. +- `frame_connected` carries `headset_id`: the first 16 hex digits of a + SHA-256 hash of the headset's `/etc/machine-id`, worked out on the headset, + so the machine-id itself never leaves it. It is the same for one headset on + every computer, which lets us count headsets rather than installs; it can't + be turned back into the machine-id or a serial number. `headsets_saved` is how + many headsets this copy of Frame Control has set up. ## Usage events | Event | When | Properties besides the common ones | |---|---|---| -| `app_installed` | First run | | -| `app_updated` | First run of a new version | `from_version` | -| `app_opened` | At most once a day | | -| `frame_connected` | The first time a SteamOS build is seen | `steamos_build`, `steamos_version` | +| `app_installed` | First run | `country` | +| `app_updated` | First run of a new version | `from_version`, `country` | +| `app_opened` | At most once a day | `country` | +| `frame_connected` | The first time a SteamOS build is seen on each headset | `steamos_build`, `steamos_version`, `headset_id`, `headsets_saved` | | `tab_viewed` | The first click on each tab in a session | `tab` | -| `install_finished` | Any install finishes, working or not | `kind` (apk, flatpak, steam, title, web), `ok`, `seconds`, `error_category`, `installer_code`, and see below | +| `install_finished` | Any install finishes, working or not | `kind` (apk, flatpak, steam, title, web), `ok`, `seconds`, `error_category` (only when `ok` is false), `installer_code`, `xr_layer_missing`, and see below | | `update_offered`, `update_started`, `update_failed` | The update banner | `to_version`, `error_category` | `install_finished` never includes a file name, path or error message. An -error becomes one category from a fixed list (for example `apk_wrong_abi` or -`frame_unreachable`), plus Android's own `INSTALL_FAILED_…` code when there -is one. It names what was installed only when that's already public: +error becomes one category from this fixed list, plus Android's own +`INSTALL_FAILED_…` code (`installer_code`) when there is one: +`android_installer`, `apk_needs_newer_android`, `apk_wrong_abi`, +`layer_missing`, `apk_repack_failed`, `tool_missing`, `apk_unreadable`, +`cant_run_on_frame`, `steam_shortcut`, `steam_not_running`, +`steam_not_responding`, `steam_js_error`, `artwork_failed`, `copy_timeout`, +`frame_not_set_up`, `frame_auth`, `frame_unreachable`, `frame_disk_full`, +`copy_failed`, `download_failed`, `flatpak`, `cancelled`, `lepton`, +`internal_error` (a mistake in Frame Control's own code) or `other`. A VR +APK that installed without Frame Control's OpenXR compatibility layer, +because this copy of the app is missing it, carries `xr_layer_missing: true`; +otherwise that field is left out. It names what was installed only when +that's already public: - F-Droid catalogue apps: `package`. Never the version, since a local build can reuse a catalogue app's package name @@ -67,13 +90,21 @@ SteamOS and Lepton builds. Before sending: - the notes, app name and version are scrubbed like error messages (see below) -- the APK's source is kept only if it's `F-Droid` or the public host name of - a download link (`https://example.com/…`). File names, user names, +- the APK's source is kept only if it's `F-Droid`, `meta-store` (a test + from [My Meta library](meta-library.md)) or the public host name of a + download link (`https://example.com/…`). File names, user names, passwords, ports, paths, IP addresses and local host names are dropped When you turn this on, reports you made earlier on this computer are shared too. +My Meta library (Experimental) keeps your Meta access token in +`meta-account.json` in this data folder, owner-only, and sends it only to +Meta's API and download hosts. It is never in analytics, reports, error +details or logs; its test reports carry the package, version, version code, +title, result and the reason, nothing from your account. See +[meta-library.md](meta-library.md#your-token-and-privacy). + The maintainer's `python3 ui/frame_compat_db.py sync` copies these events into the compatibility database, marked `via=community…`. It takes at most 30 per reporter per day. @@ -93,7 +124,11 @@ scrubbed: names, passwords, ports, paths and queries are dropped - `token=`, `key=`, `password=` and similar values are replaced -The same error is sent at most once every 10 minutes. +The same error is sent at most once every 10 minutes. When ssh reports that +it couldn't reach the Frame (asleep, away, or not set up yet), or that ssh and +the Frame refused each other's keys (a changed host key, or this computer's +key not accepted), that is sent at most once per kind each time Frame Control +runs. ## Report a problem @@ -103,9 +138,18 @@ privately to Frame Control's PostHog project as a `problem_report` event, the same way as the analytics above, so only the maintainer can read it and nothing is published. It works whatever the analytics settings are, because the person sends it deliberately. The report has the kind, title and text you -wrote, how to reach you if you gave it, a short reference shown after sending, -and the diagnostics below. It has its own random id, so it isn't linked to -your analytics events. +wrote, a short reference shown after sending, and the diagnostics below. Your +email address goes with it only if you tick **The maintainer may contact me +with follow-up questions** (the report then carries `contact_followup: true`); +it's filled in from **Contact email** below when you've agreed there. It has its own random id, so it isn't linked to +your analytics events. With that box ticked, the address also becomes your +**Contact email** below with follow-up questions ticked, so you remove it there +like any other. If it's a different address from the one saved there, it +replaces it, and update notices stop until you turn them on again (they were +agreed for the old address); the form says so before you send. The report then also +carries this copy's contact id and change number (`contact_id`, `contact_rev`, +see below), so removing or changing the address later takes back the +follow-up permission given with the report too. With **Include diagnostics** ticked (the default), the report adds: @@ -113,10 +157,56 @@ With **Include diagnostics** ticked (the default), the report adds: - the OS, its release and CPU, and the Python version - the Frame's SteamOS build, if it has connected since the app started - which analytics levels are on +- a short connection summary, so "the app can't find the headset" can be + diagnosed. It is made of fixed words and counts only; no text from an + error message or from ssh, and no name you chose, goes in it: + - the connector's state (idle, connecting, connected or failed), the stage + it failed at (network, find, ssh, identity or login), the attempt number + and why it started (such as "Starting up" or "Trying again") + - how many headsets are saved; whether the active one's ssh alias is the + default `frame` or a custom one (a custom alias itself is never named); + whether it's saved or a bare ssh alias; and its number of addresses + - for the current error and the last failure: the stage and an error + category (the same fixed names as error details, such as + `frame_unreachable`, `frame_not_set_up`, `frame_auth` or `other`), and + how long ago the last failure was. The category is decided when the + failure happens + - for each address tried, only its kind (`.local`, `ipv4`, `ipv6`, + `ipv6 link-local`, `tailscale`, `hostname`, `alias` for one read from + `~/.ssh/config`, and what a name resolved to, such as + `.local->ipv6 link-local`) and how the try went (answered, unresolved, + timeout, refused, unreachable, sshfailed). Never the address itself + - when connected, the kind of address used and its round trip in ms + - whether this computer has a network gateway, and whether Tailscale is on, + off or not installed + - which kind of `ssh` the app runs (Windows OpenSSH in System32, OpenSSH in + Program Files, Git for Windows, MSYS2/Cygwin, Homebrew or /usr/local, + Nix, the system one, or "other"), never its path; its version, rebuilt + from the numbers in the banner `ssh -V` prints (such as + `OpenSSH for Windows 9.5p1, LibreSSL 3.8.2`; anything that isn't a + plain OpenSSH banner is reported as `unknown`); and the kinds of any + other `ssh` on the PATH. + This is looked up once in the background after the app starts, so a + report sent straight away may say "still being checked" + - whether `~/.ssh/config` exists, whether it has Set Up Connection's + managed block for the active alias, how many managed blocks it has, and + whether a hand-written `Host` line also names the alias (yes or no; the + alias isn't named) **Also include recent activity and the server log** is off by default, because those lines can name files and apps. When ticked, it adds the newest -Activity lines and server log lines, without the request lines. +Activity lines and server log lines, without the request lines. The server +log has a line for each failed connection attempt: its stage, the message +shown on the connection pill, ssh's last line about it, and the address kinds +above. That free text is scrubbed when the line is written: the addresses, ssh alias +and display name of the headset being tried (whole, whatever their case), and +then any name ssh gives after "hostname", "host" or "to", become ``; a Windows home folder's +whole name (spaces and apostrophes included) becomes ``, and ssh's +whole `user@host:` field (spaces, `DOMAIN\user` and full domain names +included) becomes `@:`; then the scrubbing below. A host name ssh mentions +in some other wording can still get through, so check the log lines in **Show +exactly what's included** before sending. A failure that repeats on every +retry is written at most once every 5 minutes. Everything is scrubbed like error details and limited to what fits in the report. Environment details are kept first, then the newest lines. **Show @@ -128,11 +218,67 @@ The maintainer reads reports on the Frame Control dashboard in PostHog, or with `python3 ui/frame_report.py inbox [days]`, which uses the same personal API key as `frame_compat_db.py sync`. +## Contact email (optional) + +Frame Control never needs an email address. If you'd like to leave one, there +are two separate choices, both off until you tick them: + +| Choice | What it's for | +|---|---| +| **Email me about Frame Control updates** | Occasional notices about new releases and updates | +| **The maintainer may contact me with follow-up questions** | Questions about problem reports you send, mostly | + +You're asked once, in a bar at the top of the page, after the Frame has +connected for the first time, and never in the same visit as the first-run +privacy notice. **No thanks** hides it for good, and it isn't +shown again even if you ignore it. **Contact email** in **Privacy & updates** +is where you add, change or remove the address and either choice at any time. + +**What's sent, and where.** The address and the two choices go privately to +Frame Control's PostHog project, the same place as problem reports, as a +`contact_consent` event with `email`, `updates`, `followup`, `action` (`set` +or `withdraw`) and the common properties above. Only the maintainer can read +that project, and nothing in it is published or shared. It's sent only when +you save, or when you send a problem report with follow-up questions ticked, +whatever the analytics settings are, because you chose to. With a report, the +address and choices are saved before the report is sent and stay saved if it +fails; like any change, they're sent as soon as PostHog can be reached. It +carries its own random contact id, not the analytics id, so it isn't linked +to your usage events, and a `rev` number that goes up with each change, so +the newest choice always wins. Like everything else sent, it's listed under +**Show what's been sent**. On this computer the address and choices are kept in +`contact/contact.json` in Frame Control's data folder. An address is only +kept with at least one choice ticked. + +**Removing it.** **Remove my email** (or clearing the address and saving) +deletes it from this computer, including from the **Show what's been sent** +log (in earlier contact events and problem reports), and sends a `withdraw` +event with no address in it. The maintainer's list only uses the newest event from each copy, so from +then on the address isn't listed for either choice. Unticking one choice +works the same way for that choice. This also covers problem reports you sent +from this copy with follow-up questions ticked: if your newest choice since the +report (by change number, not the clock) no longer agrees to follow-up +questions at that address, the maintainer's inbox shows the permission as +withdrawn and leaves the address out. If you're offline, the change waits on +this computer and is sent when PostHog can be reached. The earlier event +stays in PostHog until its data retention removes it; to have it deleted +sooner, ask the maintainer (for example in a problem report). + +Nothing sends email yet: this only records who agreed to what. The +maintainer lists the addresses with +`python3 ui/frame_report.py contacts [updates|followup]`, which uses the same +personal API key as `inbox`. + ## Turning it all off Untick the boxes, or set `DO_NOT_TRACK=1` or `FRAME_CONTROL_TELEMETRY=0` in the environment that starts Frame Control. A copy run from a source checkout -never sends anything unless `FRAME_CONTROL_TELEMETRY=1` is set. +never sends analytics unless `FRAME_CONTROL_TELEMETRY=1` is set. + +These switches cover the analytics above. A problem report or a contact email +is sent only because you pressed its Send or Save button, so those still go +when you choose to send them (a contact change saved while offline is sent +by itself once PostHog can be reached); if you don't, nothing is sent. ## Update checks diff --git a/docs/quest-import.md b/docs/quest-import.md new file mode 100644 index 0000000..a67421b --- /dev/null +++ b/docs/quest-import.md @@ -0,0 +1,219 @@ +# Import from my Quest + +Move games you own from your own Meta Quest onto the Steam Frame. Plug the +Quest into your computer by USB; Frame Control copies the game off it with +adb, checks it can run in Lepton, and installs it on the Frame like any other +APK, with its own Lepton instance and Steam library entry +([apks.md](apks.md), [vr-apks.md](vr-apks.md)). + +There is no licence-check bypass, and there won't be. A game that uses Meta's +licence check installs with a warning: on the Frame that check can't reach +Meta, so the game may quit, hang, or run without online features. See +[What won't run](#what-wont-run-and-why) below. To install games you own +straight from Meta instead, without a Quest, see [My Meta library +(Experimental)](meta-library.md). + +## Before you start: developer mode on the Quest + +adb only reaches a Quest with developer mode on: + +1. Make a free Meta developer organisation at + [developers.meta.com](https://developers.meta.com/horizon/) on a **verified** + Meta account (Meta asks for a phone number or payment card to verify). +2. In the Meta Horizon phone app, open the headset's settings and switch + **Developer Mode** on. Restart the Quest. +3. Plug the Quest into the computer that runs Frame Control with a USB cable + that carries data (some charging cables don't). +4. Put the headset on. Accept **Allow USB debugging**, and tick **Always allow + from this computer**. + +Frame Control uses the adb it already uses for the Frame (an adb you +installed, else the one it bundles). On Linux, adb also needs permission to +open the Quest: add a udev rule for Meta's USB vendor id `2833`, for example +`SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0660", GROUP="plugdev"`, and +be in that group. Then unplug and replug. + +The Frame's own adb connections (Frame Control's SSH tunnels to Lepton, +`127.0.0.1:`) are never touched. Only a device that reports itself as +Oculus or Meta, or a Quest model, counts as a Quest. + +## Using it + +In the app: **Android → On your Frame → Import from my Quest**. Choose **Look +for my Quest**, then **Import** next to a game. Tick **Also copy each game's +files in Android/data** to bring the game's external files too (some games +keep saves there). Progress shows in the panel; the result and any reason it +stopped appear in the message log. + +You can choose **Import** on several games at once: they wait in the **Install +queue** (above the Quest panel) and import one after another, together with +installs from the Android store and My Meta library. **Remove** takes a game +out of the queue before it starts. Each queued import runs on the headset that +was selected when you queued it; if you switch headsets first, it stops with a +message instead. + +A game with game data (an OBB folder, or Android/data when ticked) takes two +imports, because Android can only take that data while the game's Lepton +instance is running, and there is no way to start the instance without the +game. Frame Control never starts the game itself: + +1. **Import** installs the game and says it has data to add. +2. Start the game from the Steam library and leave it on its first screen. +3. **Import** again. Frame Control sees the game open with the same version, + copies the data in, and closes the game. Start it again to play. + +A game that quits straight away without its data can't take it this way. + +From a terminal: + +```sh +python3 ui/frame_quest.py devices # what adb sees, and which is the Quest +python3 ui/frame_quest.py list # apps on the Quest: split or not, OBB and data sizes +python3 ui/frame_quest.py import com.example.game # copy one to the Frame +python3 ui/frame_quest.py import com.example.game --data --serial 1WMHH000XXXXXX +``` + +The API is `GET /api/quest` (the Quest, or guidance when there isn't one, and +its apps) and `POST /api/quest` with +`{"action": "import", "package": "...", "serial": "...", "data": false}`, +which returns a background job (`/api/job`) with a stage and percentage. The +job waits in the install queue first (`"queued": true`, stage `Queued: N +installs before it`). `GET /api/queue` lists the running install and those +waiting; `POST /api/queue` with `{"action": "remove", "job": "..."}` removes a +waiting one (409 once it has started). + +## What an import does + +1. Finds the Quest (`adb devices -l`, then `ro.product.manufacturer` and + `ro.product.model`). If none is ready it says why: nothing connected, not + authorised yet (the **Allow USB debugging** prompt), no USB permission + (Linux), offline, another Android device, or several Quests. +2. Lists third-party apps (`pm list packages -3`), each with `pm path` (one + line is a single APK, several a split APK) and the size of + `/sdcard/Android/obb/` and `/sdcard/Android/data/`. + Labels aren't shown before import: reading them means copying the APK. +3. Checks there is room on the computer (the APKs, a merged and a patched copy + of them counted uncompressed, the OBB folder and the Android/data folder + once, since that is streamed to the Frame), then copies the APK and its splits + into a per-user cache folder (`Frame Control/quest-import` under the + system's cache folder). +4. **Checks the APK before anything else is copied**, refusing: + - 32-bit-only builds (native code but no `arm64-v8a`); + - apps that need an Android newer than Lepton's (API 30); + - split APKs Frame Control can't merge (below). + Installed with a warning: + - games that use Meta's licence check (Meta's Platform SDK, + `libovrplatformloader.so`, in the base or any split): "uses Meta's + licence check; it may quit, hang, or run without online features on the + Frame. Frame Control won't remove the check." Linking the SDK doesn't + mean a game enforces the check: Meta's store requirement for it + (VRC.Quest.Security.1) has only been *Recommended* since 2021, and what + a game does when the check fails is up to the game; + - VrApi-only builds (`libvrapi.so`, no OpenXR loader), flagged as for any + APK: the Frame has no VrApi, so they may not run. +5. If the game isn't open on the Frame: installs it through the normal APK + install (`frame_android.install`: VR detection, the launcher fix, the + OpenXR compatibility layer, artwork), and says whether it has game data + to add. An older Quest copy never replaces a newer version on the Frame + (compared by version code, which installs now record; for installs made + before that, it is read from the installed APK on the Frame) unless you + tick **Allow replacing a newer version** (`--allow-downgrade`, + `"allowDowngrade": true`). If the installed version can't be read at all, + that permission is needed too. +6. If the game is open on the Frame (the second import): refuses unless + Frame Control's install record is for this package, in this package's own + instance, at the Quest's exact version code (an open game is never + replaced), otherwise copies the OBB folder (and `Android/data` if ticked) + from the Quest, waits for Android to have finished booting, copies standard + `main|patch...obb` files with the existing OBB helper + (checked by SHA-256 inside Android, [sidequest.md](sidequest.md#obb-files)) + once Android's own `dumpsys package` in that instance shows the same + package at the same version code, + streams the `Android/data` files in as a tar written straight into the SSH + transfer, then closes the game so its next start reads them, and checks + its instance has stopped; if it hasn't, or the check itself fails (a + failed `podman ps` never reads as "stopped"), the result says so. The game + is closed whatever happens during the copy, including a local read error + or Ctrl-C, and a failed close is reported without hiding the original + error. Everything + from the second check of the install record (after the pulls, which can + be long) to closing the game holds the same lock as installs and removals. + Other files in the OBB folder are listed as not copied. +7. Deletes the cache folder, whether the import worked or not. A folder left + by a crash is removed by a later import after six hours. + +Only one import runs at a time. If copying game data fails, the game is +closed and the message says so; start it and import again. + +### Split APKs + +Lepton runs one APK per instance, so the shared install path now merges a +split APK into one (`frame_android.install(base, splits=[...])`, or +`python3 ui/frame_android.py install base.apk split1.apk ...`). Merging copies +each split's native libraries and assets into the base, drops the base +manifest's `isSplitRequired` flag, and re-signs with Frame Control's key, as +the launcher fix already does. Only splits that hold nothing but +`lib//*.so`, `assets/` and their own signature, manifest and an empty +resource table are merged. Refused, with the reason, before anything reaches +the Frame: splits with resources (screen density or language), code +(`classes*.dex`), any other file, a manifest that declares components or +libraries (``, ``...), feature splits, and splits of +another package. The merged files are held in memory while the APK is +repacked and signed (as for every patched APK), so a merge adds at most +512 MB per file and 1 GB in all. Each file is read from its raw bytes and +checked against both of its ZIP headers: the local header must name the same +file with the same method, sizes and checksum as the central directory (or a +data descriptor must carry them; ZIP64 sizes are understood), the data must +end before the next entry, a stored file must be exactly its declared size, a +compressed one must end exactly at the end of its data with nothing after it, +and its checksum must match. So a forged header can't truncate a file or fill +memory. A resource table counts as empty only +if it defines nothing at all (styles and other complex entries included). A merged, re-signed APK can't update a +copy signed by the publisher. + +## What won't run, and why + +- **Games that enforce their Meta store licence.** Many store games link + Meta's Platform SDK (`libovrplatformloader.so`), for the licence check and + for user ids, achievements, multiplayer, cloud saves or DLC. On the Frame the + SDK can't reach Meta's services, which only exist on Meta headsets. A game + that enforces the check then quits or hangs; one that doesn't may run + without its online features. Frame Control can't tell which from the APK, so + it installs these with a warning and **won't remove or work around the + check**, and doesn't bundle, call or link to any tool that does. If yours + quits, ask the developer for a build without the check, or get the game from + Steam or itch.io. Most SideQuest, itch.io and open-source games don't link + the SDK. +- **32-bit games** (Quest 1 era): the Frame runs 64-bit ARM only. Refused. +- **VrApi-only games**: the Frame has OpenXR, not Meta's older VrApi. They + install with a warning, but may not run. +- **Anything else that needs Meta**: avatars, Quest-only device checks, + passthrough and other `XR_FB_*` features SteamVR lacks + ([vr-apks.md](vr-apks.md#what-steamvrs-android-runtime-supports-verified)). +- **Private app data** (`/data/data/`) can't be read over adb without + root, so only saves in `Android/data` come across. + +What usually works: OpenXR games without Meta's licence check, for example +open-source and itch.io builds you sideloaded onto the Quest. + +Only import games you own, for your own use. + +## Evidence and limits + +**Verified locally** with a fake adb (`tests/fakeadb.py`, `tests/test_quest.py`): +device detection (Quest, the Frame's tunnel, the Frame over USB, other +Android devices, unauthorised, no permissions, offline, none, several), +package listing and split detection, the refusals and the licence-check warning, the order of copies +(APK checked before the OBB is copied), the two-step install then data copy +(the game is never started by Frame Control, never replaced while open, and +closed after its data is copied), split merging and signing, the split +refusals and size limits (including a forged zip bomb), the space estimate, +and cache clean-up after success and failure. + +**Not verified:** a real Quest (none was available), Quest system apps in +`pm list packages -3`, real split APKs from the Meta Store, OBB and +`Android/data` writes into a running Lepton instance on a real Frame +(the OBB helper itself is also unverified there), whether games stay open +without their OBB long enough for the second import, and the Linux udev rule. +Large games are copied into memory while being merged or patched, as every +patched APK already is. diff --git a/docs/releasing.md b/docs/releasing.md index 7db5e3a..c4ce8e1 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -24,13 +24,20 @@ count. So a build reaches people only when you publish it, after testing it. 4. Publish: ```sh + scripts/publish-release.sh --dry-run v0.4.0 # checks and shows update.json, changes nothing scripts/publish-release.sh v0.4.0 ``` - The script checks that all eight installers are attached, each with the - SHA-256 digest GitHub records. It attaches `update.json` (the version, the - notes and each installer's digest), then publishes the release and marks it - latest. From then on, running copies see the update. They check about 8 + The script checks that the tag is on GitHub and that all eight installers + are attached, each with the SHA-256 digest GitHub records. It attaches + `update.json` (the version, the notes, the release page and each + installer's digest), then publishes the release and marks it latest. It + uses only the REST API: `gh release view` can't find a draft whose + `tag_name` still reads `untagged-…`, and GraphQL is often rate-limited. + Such a draft is found by its exact title (`Frame Control 0.4.0`, or that + followed by `: subtitle`) and tied to the tag when it's published. The release page in `update.json` is always + `releases/tag/`, because a draft's own address (`releases/tag/untagged-…`) + stops working once it's published. From then on, running copies see the update. They check about 8 seconds after starting, then every 6 hours, and anyone can use **Check for Updates…** (the app menu on macOS, the Help menu elsewhere). diff --git a/docs/streaming.md b/docs/streaming.md index 773e698..05a95c6 100644 --- a/docs/streaming.md +++ b/docs/streaming.md @@ -25,6 +25,20 @@ The confidence labels are the same as in [ssh.md](ssh.md). documents it. Use Windows App (RDP) when you want a proper Linux desktop on the Mac with keyboard, mouse, and clipboard. +**Verified 2026-09-30** (Frame BUILD_ID 20260925.6191901, Windows 11 25H2, +Remote Desktop Connection): signing in to xrdp as `steamos` with the Developer +Mode password opens a Plasma (X11) desktop within about 6 seconds. + +- xrdp has no NLA, so the client shows a certificate warning (xrdp's own + `www.xrdp.org` certificate) and then xrdp's own login box. Frame Control + fills in `steamos` there on Windows, Remmina and FreeRDP. +- The desktop is a separate login session (Xorg on display `:10`), not the + headset's view. It uses about 1.3 GB of the Frame's memory. +- Closing the client leaves the session running, and the next login + reconnects to it. To end it over SSH, find it with `loginctl list-sessions` + and run `loginctl terminate-session `. That doesn't touch the headset's + gamescope or SteamVR session. + ## B. Show the Mac's desktop inside the Frame The Frame's VR streaming uses **SteamVR** on the host. Linux hosts had @@ -247,6 +261,16 @@ How (**verified 2026-09-29**, SteamOS 0.4.1, build 20260925.6191901): -window_id -i :` works on gamescope's redirected windows, while grabbing the root gives black. It streams as H.264 like the headset view (about 30 fps at 720p). +- **When no panel is found**, `frame_touch.py panels` says why (`"why"`), and the + Desktop view shows that instead of a bare "no app panel": X tools missing, + gamescope listing windows that aren't X11 windows on any display, the desktop + running but not listed, or nothing open. It reads gamescope's properties from + `:0` first (one `xprop` call) and probes the other displays, 2 s each, only if `:0` + has none. A whole run stops after 12 s, inside the server's 20 s, and says the headset + was too slow. Added for + [#73](https://github.com/saphid/frame-control/issues/73) (SteamOS 0.4.5, desktop + open but not found). The likely cause there was the page itself: a second + `loadPanels` (the panel switcher's) replaced the Desktop view's, fixed in #84. - Tested from the iPhone app (Simulator): a tap on the Desktop view focused a text box in the panel and the text field typed into it; a trackpad move went exactly (+40, +25). diff --git a/docs/testing.md b/docs/testing.md index 82a1826..7234cd7 100644 --- a/docs/testing.md +++ b/docs/testing.md @@ -15,6 +15,29 @@ A fourth, a SteamOS VM, may come later ([issue #6](https://github.com/saphid/ste python3 -m unittest discover -s tests ``` +The Control Center is covered by `tests/test_control_center.py` and its Node +behavior suite `tests/control_center.cjs` (also run by unittest discovery). +They exercise production search, metrics, navigation and action handlers with +mocked API/DOM boundaries: volume Apply/mute/readback, offline and failed reads, +stale samples, selected-headset capture, duplicate actions and validation before +SSH. Integration regressions run the production shared refresh, Home renderer, +host callback and Control Center bootstrap: a pre-command status request must be +drained before audio readback starts, and delayed startup retains sample receipt +age, failed-read state and early host capabilities. The actual Flatpak install +redraw cannot revive a failed sample; a new successful poll restores metrics and +audio after either redraw or delayed mount. Draft regressions cover a pending headset +switch and mute followed by Apply. Static asset HTTP tests and desktop/iPhone bundle checks catch missing CSS +or JavaScript. A focused run is: + +```sh +python3 -m unittest discover -s tests -p test_control_center.py -v +node --test tests/control_center.cjs +node --check ui/control-center.js +``` + +Responsive layout, actual browser rendering and keyboard/touch behavior still +need browser verification. No Control Center test connects to a real headset. + About 120 tests, a few seconds, on Python 3.9 and newer. GitHub Actions runs them on macOS, Windows and Linux. They don't pick up `tests/e2e`. diff --git a/docs/vr-apks.md b/docs/vr-apks.md index 38ba7ff..240bb91 100644 --- a/docs/vr-apks.md +++ b/docs/vr-apks.md @@ -214,9 +214,16 @@ source-search endpoint remain unverified (the public install seam is tested). - **Meta entitlement.** Apps that call the Oculus Platform SDK (`libovrplatformloader.so`) to check the Quest store licence need Meta's - services. Frame Control won't work around that. + services. Frame Control won't work around that: no patching, no stub + libraries, no OVRPort or FramePort. Linking the SDK doesn't mean an app + enforces the check (Meta's VRC.Quest.Security.1 has only been + *Recommended* since 2021, and a failed check does nothing by itself; the app + decides), so [Import from my Quest](quest-import.md) and [My Meta + library](meta-library.md) install these with a warning: they may quit, + hang, or run without online features. - **VrApi-era apps** (`libvrapi.so`, before OpenXR) need an API translator, - not a patch. + not a patch. They install with a warning that they may not run: some + OpenXR games ship `libvrapi.so` without depending on it. ## Frame Control does this for you @@ -249,6 +256,10 @@ the app wants 1.1 and enables the extensions that became 1.1 core; maps and keeps the current refresh rate when SteamVR refuses a requested one. `meta.json` records `"patched": ["openxr-compat"]`. Skip it with `install … --no-xr-compat`. Its decisions go to logcat under `FrameXrCompat`. +If this copy of Frame Control is missing the layer's library (an incomplete +install, or a file removed after installing), VR apps install without it and +the install message says so; OpenXR 1.0 apps still run. Release builds fail +to package without it (`app/build/check-resources.js`). Verified on the headset (2026-09-28): diff --git a/frame/openxr-compat/README.md b/frame/openxr-compat/README.md index 5978979..2dba589 100644 --- a/frame/openxr-compat/README.md +++ b/frame/openxr-compat/README.md @@ -190,8 +190,11 @@ ctest --test-dir frame/openxr-compat/build-host --output-on-failure The script produces arm64-v8a / android-24, C++17, `-O2`, static libc++, hidden internal symbols, stripped output, and `-Wl,-z,max-page-size=16384`. -The committed prebuilt is `prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so`. -Its SHA-256 is recorded below with the APK checks. +The committed prebuilt is `prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz`, +gzipped (`gzip -9 -n`) so the Windows installer carries it intact: electron-builder's +7-Zip compresses a bare arm64 ELF with its ARM64 filter, which the installer's +extractor skips. Frame Control decompresses it when injecting the layer. The +SHA-256 of the uncompressed library is recorded below with the APK checks. [Host test output](evidence/ctest.txt): two tests passed, covering pure logic and the actual layer with a fake next layer and host-only log/JNI shims. diff --git a/frame/openxr-compat/build.sh b/frame/openxr-compat/build.sh index 3b08089..ed3232b 100755 --- a/frame/openxr-compat/build.sh +++ b/frame/openxr-compat/build.sh @@ -8,5 +8,8 @@ cmake -S "$here" -B "$here/build-android" -G Ninja \ -DANDROID_STL=c++_static -DCMAKE_BUILD_TYPE=Release cmake --build "$here/build-android" mkdir -p "$here/prebuilt/arm64-v8a" -cp "$here/build-android/libXrApiLayer_FRAME_compat.so" "$here/prebuilt/arm64-v8a/" -shasum -a 256 "$here/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so" +# Committed and shipped gzipped: electron-builder's 7-Zip applies its ARM64 +# branch filter to a bare arm64 ELF, which the Windows installer's extractor +# can't decode, so the installed app silently lacked the library. +shasum -a 256 "$here/build-android/libXrApiLayer_FRAME_compat.so" +gzip -9 -n -c "$here/build-android/libXrApiLayer_FRAME_compat.so" > "$here/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz" diff --git a/frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so b/frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so deleted file mode 100755 index 608cdd1..0000000 Binary files a/frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so and /dev/null differ diff --git a/frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz b/frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz new file mode 100644 index 0000000..fef87a7 Binary files /dev/null and b/frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz differ diff --git a/ios/scripts/make_frame_bundle.py b/ios/scripts/make_frame_bundle.py index ef487a5..fdbb4d5 100644 --- a/ios/scripts/make_frame_bundle.py +++ b/ios/scripts/make_frame_bundle.py @@ -18,7 +18,7 @@ import tarfile from pathlib import Path ROOT = Path(__file__).resolve().parents[2] -PATTERNS = ["ui/*.py", "ui/*.html", "ui/local-bin/*", "scripts/*.sh", "frame/android/*.sh", "frame/android/*.py", +PATTERNS = ["ui/*.py", "ui/*.html", "ui/*.js", "ui/*.css", "ui/local-bin/*", "scripts/*.sh", "frame/android/*.sh", "frame/android/*.py", "frame/devkit-utils/**/*", "apk-catalog/*.py", "apk-catalog/pins.json", "apk-catalog/site/apps.js", "frame/kdeconnect/packages.json", "frame/kdeconnect/NOTICE.md", "frame/kdeconnect/LICENSES/*/*", "frame/kdeconnect/packages/*.pkg.tar.zst", "LICENSE", "THIRD_PARTY_NOTICES.md"] diff --git a/scripts/publish-release.sh b/scripts/publish-release.sh index 82b5c10..9101c45 100755 --- a/scripts/publish-release.sh +++ b/scripts/publish-release.sh @@ -3,23 +3,65 @@ # (docs/releasing.md). Checks every installer is attached with a SHA-256 # digest first, since the app's updater refuses assets without one, then # attaches update.json, the manifest the updater reads. -# Usage: scripts/publish-release.sh v0.4.0 +# Usage: scripts/publish-release.sh [--dry-run] v0.4.0 +# +# Everything goes through the REST API (gh api), not `gh release view/edit`: +# those look a draft up by its tag, and a draft can show tag_name +# "untagged-..." until it's published, so they report "release not found" +# (and GraphQL is often rate-limited). A draft's html_url is an untagged-... +# link that dies on publishing, so update.json's page is built from the tag. set -eu -tag="${1:?usage: $0 vX.Y.Z}" +dry="" +[ "${1:-}" = "--dry-run" ] && { dry=1; shift; } +tag="${1:?usage: $0 [--dry-run] vX.Y.Z}" repo=saphid/frame-control expected="Frame-Control-mac-arm64.dmg Frame-Control-mac-arm64.zip Frame-Control-Setup-x64.exe Frame-Control-win-x64.zip Frame-Control-linux-x86_64.AppImage Frame-Control-linux-arm64.AppImage Frame-Control-linux-amd64.deb Frame-Control-linux-arm64.deb" +page="https://github.com/$repo/releases/tag/$tag" -info=$(gh release view "$tag" -R "$repo" --json isDraft,isPrerelease,assets) version=$(sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' "$(dirname "$0")/../app/package.json") [ "v$version" = "$tag" ] || echo "note: app/package.json here says $version (the release was built from the tag)" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT + +# Publishing sets tag_name; if the tag didn't exist GitHub would create it on +# the default branch, which isn't what was built and tested. +gh api "repos/$repo/git/ref/tags/$tag" >/dev/null 2>&1 \ + || { echo "tag $tag isn't on GitHub; push it first (git push origin $tag)" >&2; exit 1; } + +# Every release, drafts included, one JSON object per line. +gh api --paginate "repos/$repo/releases?per_page=100" --jq '.[]' > "$tmp/releases" +# The release whose tag_name is the tag; failing that, the one untagged-... draft +# titled "Frame Control X.Y.Z" (release.yml's title), optionally ": subtitle". +python3 - "$tag" "$tmp/releases" > "$tmp/release.json" <<'EOF' +import json, re, sys +tag, path = sys.argv[1], sys.argv[2] +rels = [json.loads(line) for line in open(path) if line.strip()] +hits = [r for r in rels if r.get("tag_name") == tag] +if not hits: + # Exactly this version: "Frame Control 0.4.0", or that followed by ": ". + # Never "Frame Control 0.4.0-rc.1" or "0.4.00", and only drafts with no real tag. + title = re.compile(r"Frame Control " + re.escape(tag.lstrip("v")) + r"(: .*)?", re.S) + hits = [r for r in rels if r.get("draft") and str(r.get("tag_name") or "").startswith("untagged-") + and title.fullmatch(r.get("name") or "")] +if len(hits) != 1: + why = "no release" if not hits else "%d releases (ids %s)" % (len(hits), ", ".join(str(r["id"]) for r in hits)) + sys.exit("found %s for %s; expected one draft" % (why, tag)) +r = hits[0] +if not r.get("draft"): + print("note: %s is already published; refreshing update.json and marking it latest" % tag, file=sys.stderr) +json.dump(r, sys.stdout) +EOF +id=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["id"])' "$tmp/release.json") +echo "release $id ($(python3 -c 'import json,sys; r=json.load(open(sys.argv[1])); print(("draft" if r["draft"] else "published") + ", tag_name " + str(r["tag_name"]))' "$tmp/release.json"))" + missing="" for name in $expected; do - digest=$(printf '%s' "$info" | python3 -c 'import json,sys -d=json.load(sys.stdin); n=sys.argv[1] -print(next((a.get("digest") or "" for a in d["assets"] if a["name"]==n), "absent"))' "$name") + digest=$(python3 -c 'import json,sys +d=json.load(open(sys.argv[1])); n=sys.argv[2] +print(next((a.get("digest") or "" for a in d["assets"] if a["name"]==n), "absent"))' "$tmp/release.json" "$name") case "$digest" in sha256:*) echo "ok $name" ;; absent) echo "MISSING $name"; missing=1 ;; @@ -30,16 +72,32 @@ done # update.json: what running copies read (app/updater.js), from github.com's # latest/download link rather than the rate-limited REST API. -tmp=$(mktemp -d) -trap 'rm -rf "$tmp"' EXIT -gh release view "$tag" -R "$repo" --json tagName,url,body,assets | python3 -c 'import json,sys -d=json.load(sys.stdin) -names=set(sys.argv[1].split()) -print(json.dumps({"version": d["tagName"].lstrip("v"), "page": d["url"], "notes": d["body"][:4000], +python3 - "$tmp/release.json" "$tag" "$page" "$expected" > "$tmp/update.json" <<'EOF' +import json, sys +d = json.load(open(sys.argv[1])) +tag, page, names = sys.argv[2], sys.argv[3], set(sys.argv[4].split()) +print(json.dumps({"version": tag.lstrip("v"), "page": page, "notes": (d.get("body") or "")[:4000], "assets": [{"name": a["name"], "size": a["size"], "digest": a["digest"]} - for a in d["assets"] if a["name"] in names]}, indent=1))' "$expected" > "$tmp/update.json" -gh release upload "$tag" -R "$repo" "$tmp/update.json" --clobber + for a in d["assets"] if a["name"] in names]}, indent=1)) +EOF +old=$(python3 -c 'import json,sys +d=json.load(open(sys.argv[1])) +print(" ".join(str(a["id"]) for a in d["assets"] if a["name"]=="update.json"))' "$tmp/release.json") + +if [ -n "$dry" ]; then + echo "dry run: would replace update.json (old asset ids: ${old:-none}) with:" + cat "$tmp/update.json" + echo "dry run: would PATCH release $id: tag_name=$tag draft=false prerelease=false make_latest=true" + exit 0 +fi + +for asset in $old; do + gh api -X DELETE "repos/$repo/releases/assets/$asset" >/dev/null +done +gh api -X POST "https://uploads.github.com/repos/$repo/releases/$id/assets?name=update.json" \ + -H "Content-Type: application/json" --input "$tmp/update.json" >/dev/null echo "ok update.json" -gh release edit "$tag" -R "$repo" --draft=false --prerelease=false --latest -echo "published $tag; running copies will offer it at their next check" +gh api -X PATCH "repos/$repo/releases/$id" -f tag_name="$tag" -F draft=false -F prerelease=false \ + -f make_latest=true --jq '"published " + .tag_name + " at " + .html_url' +echo "running copies will offer $tag at their next check" diff --git a/scripts/timezones.py b/scripts/timezones.py new file mode 100644 index 0000000..e11a9ab --- /dev/null +++ b/scripts/timezones.py @@ -0,0 +1,77 @@ +#!/usr/bin/env python3 +"""Regenerate ui/frame_timezones.py, the time zone -> country table usage statistics use. + +From the IANA tz database's zone.tab (each zone's country) and tzdata.zi (the old +names that link to them), as installed on macOS and most Linux systems. It prints the +old names left out because their zone is shared by several countries: check any new +one, and add it to OLD_SPELLINGS if it's just an old spelling of a zone.tab zone. + +Run: python3 scripts/timezones.py [/usr/share/zoneinfo] +""" +import sys +from pathlib import Path + +src = Path(sys.argv[1] if len(sys.argv) > 1 else '/usr/share/zoneinfo') +country = {} +for line in (src / 'zone.tab').read_text().splitlines(): + if line and not line.startswith('#'): + cc, _, zone = line.split('\t')[:3] + country[zone] = cc +links = {} +for line in (src / 'tzdata.zi').read_text().splitlines(): + if line.startswith('L '): + _, target, alias = line.split() + links[alias] = target +def resolve(z): + for _ in range(5): + z = links.get(z, z) + return z + + +# An old name links to a zone with the same clocks, which can be in another country +# (Africa/Asmera, Eritrea, links to Africa/Nairobi), so it only gets a country when every +# zone.tab zone sharing that target is in one country. +countries_of = {} +for zone, cc in country.items(): + countries_of.setdefault(resolve(zone), set()).add(cc) +# Clock rules rather than places (EET links to Athens, WET to Lisbon): no country. +GENERIC = {'CET', 'EET', 'MET', 'WET', 'EST', 'MST', 'HST', 'CST6CDT', 'EST5EDT', 'MST7MDT', 'PST8PDT'} +# Places that have left zone.tab, so their target's group looks like another country's. +PLACES = {'Pacific/Johnston': 'UM'} +dropped = [] +for alias in links: + if alias in country or alias in GENERIC or alias.startswith('Etc/'): + continue + if alias in PLACES: + country[alias] = PLACES[alias] + continue + ccs = countries_of.get(resolve(alias), set()) + if len(ccs) == 1: + country[alias] = next(iter(ccs)) + else: + dropped.append(alias) +# Old names for a place in a zone.tab zone whose target is shared, checked by hand. +OLD_SPELLINGS = { + 'Africa/Asmera': 'Africa/Asmara', 'Africa/Timbuktu': 'Africa/Bamako', 'America/Coral_Harbour': 'America/Atikokan', + 'America/Montreal': 'America/Toronto', 'America/Nipigon': 'America/Toronto', 'America/Thunder_Bay': 'America/Toronto', + 'Canada/Eastern': 'America/Toronto', 'America/Virgin': 'America/St_Thomas', 'Antarctica/South_Pole': 'Antarctica/McMurdo', + 'Asia/Rangoon': 'Asia/Yangon', 'Atlantic/Jan_Mayen': 'Arctic/Longyearbyen', 'Europe/Belfast': 'Europe/London', + 'GB': 'Europe/London', 'GB-Eire': 'Europe/London', 'Iceland': 'Atlantic/Reykjavik', 'NZ': 'Pacific/Auckland', + 'Pacific/Samoa': 'Pacific/Pago_Pago', 'US/Samoa': 'Pacific/Pago_Pago', 'Singapore': 'Asia/Singapore', + 'US/Arizona': 'America/Phoenix', 'Pacific/Truk': 'Pacific/Chuuk', 'Pacific/Ponape': 'Pacific/Pohnpei', + 'Pacific/Yap': 'Pacific/Chuuk'} +for alias, zone in OLD_SPELLINGS.items(): + if alias in links and zone in country: + country[alias] = country[zone] + dropped.remove(alias) +version = (src / '+VERSION').read_text().strip() if (src / '+VERSION').exists() else 'unknown' +rows = ''.join(f' {z!r}: {c!r},\n' for z, c in sorted(country.items())) +out = Path(__file__).resolve().parent.parent / 'ui' / 'frame_timezones.py' +out.write_text(f'''"""Time zone name -> two-letter country, from the IANA tz database {version} (zone.tab, and +the old names in tzdata.zi that link to its zones). Generated by scripts/timezones.py. +Zones that aren't in one country, such as UTC, aren't here.""" +COUNTRY = {{ +{rows}}} +''') +print(f'{len(country)} zones, tz {version} -> {out}') +print('no country (shared by several):', ' '.join(sorted(dropped)) or 'none') diff --git a/tests/apk_fixtures.py b/tests/apk_fixtures.py new file mode 100644 index 0000000..20cf7bf --- /dev/null +++ b/tests/apk_fixtures.py @@ -0,0 +1,87 @@ +"""Small APKs built in memory (binary manifest plus resource table), for test_frame_apk +and the end-to-end tests. Deliberately doesn't import sandbox: tests/e2e runs in a +throwaway container and keeps its real home, which sandbox would move.""" +import io +import os +import struct +import sys +import zipfile + +sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'ui')) +import frame_apk # noqa: E402 + + +def pool(strings, utf8=False): + """A ResStringPool chunk.""" + data, offsets = b'', [] + for s in strings: + offsets.append(len(data)) + if utf8: + b = s.encode() + data += bytes([len(s), len(b)]) + b + b'\0' + else: + data += struct.pack('. + + package_raw=False drops the package's raw string (as some repackers do); + foreign_label adds a non-android `label` attribute after android:label. + """ + strings = ['label', 'icon', 'versionName', 'minSdkVersion', 'package', 'manifest', 'uses-sdk', + 'application', package, 'junk', 'label', 'versionCode'] # the second 'label' has no android id + resmap = struct.pack('<4I', 0x01010001, 0x01010002, 0x0101021c, 0x0101020c) + resmap = struct.pack(' ({time:Date.now()/1000, hostname:'Test Frame', battery:{percent:99,status:'Discharging',watts:0,tempC:33,health:'Good'}, + power:{type:'C PD [PD_PPS]',watts:18}, disk:{home:{total:256*1073741824,free:128*1073741824}}, + memory:{total:16*1073741824,available:6*1073741824}, wifi:{ssid:'Test LAN',signal:80}, + performance:{compositorFps:90,appFps:45,frameMs:11.11,gpuMs:3,cpuPercent:12,gpuMHz:600}, + volume:{level:.4,muted:false}, os:{version:'0.4.1',build:'test-build'},services:{steamvr:true}, thermalAlerts:[],games:[],flatpaks:[]}); +function fixture() { + const elements = new Map(); + function element(id) { + if (!elements.has(id)) elements.set(id, {id,hidden:false,disabled:false,textContent:'',innerHTML:'',value:'',dataset:{}, + classList:{toggle(){}},querySelectorAll(){return [];},setAttribute(key,value){this[key]=value;},addEventListener(key,callback){this[key]=callback;},focus(){this.focused=true;}}); + return elements.get(id); + } + const cards = cc.catalog.map(item=>{const e=element(item.id);e.dataset.ccCard=item.id;return e;}); + const buttons = cc.categories.map(([id])=>{const e=element('category-'+id);e.dataset.ccCategory=id;e.querySelector=()=>element('count-'+id);return e;}); + const metrics = Object.keys(cc.metrics(null)).map(id=>{const e=element('metric-'+id);e.dataset.ccMetric=id;return e;}); + const page = element('controlCenter'); + page.querySelectorAll = selector => selector === '[data-cc-category]' ? buttons : selector === '[data-cc-metric]' ? metrics : selector === '[data-cc-mac-link]' ? [element('macLink')] : []; + page.querySelector = selector => selector === '[href="#connection"]' ? element('connectionLink') : cards.find(e=>selector === `[data-cc-card="${e.dataset.ccCard}"]`); + return {document:{getElementById:element},element,cards,buttons}; +} +function mounted(options = {}) { + const f = fixture(), calls = []; + let context = {online:true,generation:1,device:'frame-a'}, refreshes = 0, opened = 0; + const ui = cc.mount({document:f.document,platform:'darwin',api:async(...args)=>{calls.push(args);return {message:'Volume updated'};}, + refresh:async()=>{refreshes++;},getContext:()=>context,openConnection:()=>opened++,...options}); + return {...f,ui,calls,get context(){return context;},set context(v){context=v;},get refreshes(){return refreshes;},get opened(){return opened;}}; +} +const pageSource = fs.readFileSync(require.resolve('../ui/index.html'),'utf8'); +const deferred = () => { let resolve, reject; const promise=new Promise((ok,bad)=>{resolve=ok;reject=bad;});return {promise,resolve,reject}; }; +const flush = async () => { for(let i=0;i<12;i++)await Promise.resolve(); }; +// Execute the actual shared refresh/deduplication, host callback and mount +// bootstrap, including the real Home-to-Control status handoff. Only unrelated +// rendering helpers, timers and transport are stubbed. +function sharedPage({productionApi=false} = {}) { + const f=fixture(), requests=[], writes=[], host=deferred(), job=deferred(); + const context={document:f.document,FrameControlCenter:cc,window:{frameApp:{setUpConnection(){}}}, + Date,setInterval,clearInterval,setTimeout:()=>1,clearTimeout(){},$:f.element,QUICK:[],installing:new Set(), + battery(){},setVolume(){},gb:String,dur:String,esc:String,meter(){},toast(){}, + runJob(title,id){context.installing.add(id);return job.promise;}, + api:(path,body,device)=>{ + if(path==='/api/host')return host.promise; + if(path==='/api/status'){const request=deferred();requests.push(request);return request.promise;} + writes.push({path,body,device});return Promise.resolve({message:'Volume updated'}); + },renderPerformance(){},setConn(){},setOnline(ok){vm.runInContext(`online = ${ok}`,context);},log(){},failed(){}, + watchConnection(){context.watched=true;}}; + vm.createContext(context); + const stateDeclaration=pageSource.match(/let state = null[^\n]*/)[0]; + vm.runInContext(stateDeclaration+'\nlet online = true, devGen = 1; const HOST = {computer:"computer"}; window.connDevice="frame-a";',context); + const refreshStart=pageSource.indexOf('let refreshing = null'),refreshEnd=pageSource.indexOf('// ---- our VR HUD',refreshStart); + const renderStart=pageSource.indexOf('function render(s) {'),renderEnd=pageSource.indexOf('// ---- view ----',renderStart); + vm.runInContext(pageSource.slice(renderStart,renderEnd)+pageSource.slice(refreshStart,refreshEnd),context); + if(productionApi) { + // Keep api/onConnection/setOnline intact: defer fetch itself, not api(), so + // rejection classification and the real switch/reset notifications run. + context.fetch=(path,opts)=>{ + if(path==='/api/host')return host.promise.then(data=>({ok:true,status:200,json:async()=>data})); + const request=deferred();request.path=path;request.opts=opts;requests.push(request);return request.promise; + }; + Object.assign(context,{renderPill(){},renderConnDlg(){},renderBanner(){},viaText(){},netLabel(){}, + resetShots(){},closeDevPop(){},loadDevices(){},renderDevices(){},renderTests(){},reloadAll(){},checkContactPrompt(){}}); + vm.runInContext(`const UI_KEY = 'test-only'; + const link = {s:null,device:'frame-a',phase:'connected',rev:0,net:null}; + const disp = {}, gm = {seq:0}, cat = {}, wi = {}; + let viewGen = 0, lastImg = null, lastShot = null, androidApps = [], titlesSeq = 0, page = 'control';`,context); + const apiStart=pageSource.indexOf('const HEADSET_FREE ='),apiEnd=pageSource.indexOf('// What a panel shows',apiStart); + const onlineStart=pageSource.indexOf('function setOnline('),onlineEnd=pageSource.indexOf('function reloadAll()',onlineStart); + const connectionStart=pageSource.indexOf('function onConnection('),connectionEnd=pageSource.indexOf('// Read the event stream',connectionStart); + vm.runInContext(pageSource.slice(apiStart,apiEnd)+pageSource.slice(onlineStart,onlineEnd)+pageSource.slice(connectionStart,connectionEnd),context); + } + const installStart=pageSource.indexOf('function installFlatpak(id) {'),installEnd=pageSource.indexOf('$("fpInstall").onclick',installStart); + vm.runInContext(pageSource.slice(installStart,installEnd),context); + const hostStart=pageSource.lastIndexOf('api("/api/host").then(h =>'),hostEnd=pageSource.indexOf('',hostStart); + vm.runInContext(pageSource.slice(hostStart,hostEnd),context); + const bootstrapStart=pageSource.indexOf('window.frameControlCenter = FrameControlCenter.mount('),bootstrapEnd=pageSource.indexOf('',bootstrapStart); + return {...f,context,requests,writes,host,refresh:()=>vm.runInContext('refresh()',context), + switchHeadset:()=>vm.runInContext('onConnection({now:Date.now()/1000,phase:"connected",devices_rev:0,device:{id:"frame-b",name:"Second Frame"}})',context), + installFlatpak:()=>vm.runInContext('installFlatpak("test.app")',context), + mount(){vm.runInContext(pageSource.slice(bootstrapStart,bootstrapEnd),context);return context.window.frameControlCenter;}}; +} +const response = data => ({ok:true,status:200,json:async()=>data}); +for(const rejection of ['transport','body'])for(const delayedMount of [false,true]) { + test(`production ${rejection} rejection from A preserves B ${delayedMount ? 'before delayed mount' : 'after mount'}`, async t => { + const f=sharedPage({productionApi:true}); + if(!delayedMount){const ui=f.mount();t.after(()=>ui.destroy());} + const old=f.refresh(),body=deferred(); + assert.equal(f.requests[0].path,'/api/status'); + if(rejection==='body') { + f.requests[0].resolve({ok:true,status:200,json:()=>body.promise});await flush(); + } + f.switchHeadset(); + assert.equal(f.requests.length,2,'real connected B callback starts its own status fetch'); + const next=sample();next.hostname='Second Frame';next.battery.percent=20;next.volume.level=.2; + f.requests[1].resolve(response(next));await flush(); + const receipt=vm.runInContext('stateReceivedAt',f.context); + assert.equal(vm.runInContext('stateRead.valid && online && devGen === 2',f.context),true); + if(!delayedMount)assert.equal(f.element('metric-battery').textContent,'20%'); + (rejection==='body' ? body : f.requests[0]).reject(Error('Old A request failed'));await old; + assert.equal(vm.runInContext('stateRead.valid',f.context),true,'A must not invalidate B'); + assert.equal(vm.runInContext('stateRead.error',f.context),null); + assert.equal(vm.runInContext('stateReceivedAt',f.context),receipt); + if(delayedMount){const ui=f.mount();t.after(()=>ui.destroy());} + const assertB=()=>{ + assert.equal(f.element('ccDeviceName').textContent,'Second Frame'); + assert.equal(f.element('metric-battery').textContent,'20%'); + assert.equal(f.element('ccVolume').value,20); + for(const id of ['ccVolume','ccApplyVolume','ccMute'])assert.equal(f.element(id).disabled,false); + assert.doesNotMatch(f.element('ccSampleState').textContent,/No live sample|local server|Old A/); + }; + assertB();vm.runInContext('render(state)',f.context);assertB(); + assert.equal(f.requests.length,2,'preservation and redraw need no recovery poll'); + // An ordinary failure on B must still invalidate the current sample. + const failed=f.refresh(); + if(rejection==='body')f.requests[2].resolve({ok:true,status:200,json:async()=>{throw Error('B body failed');}}); + else f.requests[2].reject(Error('B transport failed')); + await failed; + assert.equal(vm.runInContext('stateRead.valid',f.context),false); + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + for(const id of ['ccVolume','ccApplyVolume','ccMute'])assert.equal(f.element(id).disabled,true); + assert.equal(f.element('ccStatusLabel').textContent,'No live sample'); + }); +} +test('production headset-free API keeps transport errors and responses across a switch', async t => { + for(const failure of [false,true]) { + const f=sharedPage({productionApi:true}),ui=f.mount();t.after(()=>ui.destroy()); + const pending=vm.runInContext('api("/api/devices")',f.context); + const result=pending.then(value=>({value}),error=>({error})); + f.switchHeadset();f.requests[1].resolve(response(sample()));await flush(); + if(failure)f.requests[0].reject(Error('Device list transport failed')); + else f.requests[0].resolve(response({devices:['frame-b']})); + const settled=await result; + if(failure){assert.equal(settled.error.stale,undefined);assert.match(settled.error.message,/local server isn't running/);} + else assert.deepEqual(settled.value,{devices:['frame-b']}); + assert.equal(vm.runInContext('stateRead.valid',f.context),true); + } +}); +test('search finds settings by aliases, all words, category and guidance', () => { + const find = (q,category='all')=>cc.catalog.filter(item=>cc.matches(item,q,category)).map(item=>item.id); + assert.ok(find('DPI').includes('display')); + assert.ok(find('sleep inactivity').includes('power')); + assert.ok(find('MOTION SICKNESS').includes('playspace')); + assert.ok(find('font','apps').includes('display')); + assert.deepEqual(find('font','vr'),[]); + assert.deepEqual(find(''),[]); + assert.ok(find(' ').length > 20); +}); +test('metrics use real fields, preserve zero, and distinguish unavailable values', () => { + const m = cc.metrics(sample()); + assert.equal(m.battery,'99%'); + assert.equal(m.power,'0 W'); + assert.match(m.batteryDetail,/not charging/); + assert.equal(m.fps,'90'); assert.equal(m.appFps,'45'); + assert.equal(m.storage,'128 GiB'); assert.equal(m.memory,'10 GiB'); + assert.equal(m.thermal,'No hot / critical trip reported'); + assert.equal(cc.metrics(null).fps,'Unavailable'); + assert.equal(cc.metrics({performance:{appFps:null,gpuMHz:0,cpuPercent:0}}).appFps,'Unavailable'); + assert.equal(cc.metrics({performance:{cpuPercent:0}}).cpu,'0%'); + assert.equal(cc.metrics({battery:{percent:0,status:'Discharging'}}).battery,'0%'); + assert.match(cc.metrics({thermalAlerts:[{zone:'battery',tempC:45,limitC:44}]}).thermal,/battery 45 °C ≥ 44 °C/); +}); +test('audio controller validates before any API call and rejects offline or expired readings', async () => { + let context={online:true,fresh:true,sample:sample(),device:'frame-a',generation:1},calls=[]; + const controller=cc.createController({api:async(...args)=>{calls.push(args);return {};},getContext:()=>context}); + for (const change of [{level:-.1},{level:1.1},{level:NaN},{level:Infinity},{level:'0.5'},{level:null},{muted:'false'},{unknown:true},{}]) { + await assert.rejects(controller.audio(change),/valid mute state/); + } + context.online=false;await assert.rejects(controller.audio({level:.5}),/Connect and refresh/); + context.online=true;context.fresh=false;await assert.rejects(controller.audio({muted:true}),/Connect and refresh/); + assert.equal(calls.length,0); +}); +test('audio uses the captured device, prevents duplicate writes, and ignores switched-headset success', async () => { + let context={online:true,fresh:true,sample:sample(),device:'frame-a',generation:1},complete,calls=[]; + const controller=cc.createController({api:(...args)=>{calls.push(args);return new Promise(r=>complete=r);},getContext:()=>context}); + const pending=controller.audio({level:.7}); + await assert.rejects(controller.audio({muted:true}),/still in progress/); + assert.deepEqual(calls,[['/api/volume',{level:.7},'frame-a']]); + context={...context,device:'frame-b',generation:2};complete({message:'Done'}); + assert.equal(await pending,null);assert.equal(controller.busy,false); +}); +test('controller surfaces real API errors and allows a deliberate retry', async () => { + let calls=0; + const controller=cc.createController({api:async()=>{if(++calls===1)throw Error('SSH connection lost');return {message:'Done'};}, + getContext:()=>({online:true,fresh:true,sample:sample(),device:'frame-a',generation:1})}); + await assert.rejects(controller.audio({muted:true}),/SSH connection lost/); + assert.equal(controller.busy,false); + assert.deepEqual(await controller.audio({muted:true}),{message:'Done'}); +}); +test('mounted controls only write on Apply or Mute, show readback, and reset on switch', async t => { + const f=mounted();t.after(()=>f.ui.destroy()); + assert.equal(f.element('ccApplyVolume').disabled,true); + f.ui.status(sample()); + assert.equal(f.element('ccApplyVolume').disabled,false); + assert.equal(f.element('ccVolume').value,40); + f.element('ccVolume').value='65';f.element('ccVolume').oninput(); + assert.equal(f.calls.length,0); + assert.equal(f.element('ccVolumeValue').textContent,'65%'); + f.ui.status(sample()); // a poll must not overwrite an unapplied value + assert.equal(f.element('ccVolume').value,'65'); + await f.element('ccApplyVolume').onclick(); + assert.deepEqual(f.calls,[['/api/volume',{level:.65},'frame-a']]); + assert.equal(f.refreshes,1); + await f.element('ccMute').onclick(); + assert.deepEqual(f.calls[1],['/api/volume',{muted:true},'frame-a']); + f.context={online:null,generation:2,device:'frame-b'};f.ui.reset(); + assert.equal(f.element('ccApplyVolume').disabled,true); + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + assert.equal(f.element('ccAudioResult').textContent,''); +}); +test('offline/errors clear live readings, disable audio and keep companion navigation usable', async t => { + const f=mounted();t.after(()=>f.ui.destroy());f.ui.status(sample()); + f.context.online=false;f.ui.connection(false); + assert.equal(f.element('metric-fps').textContent,'Unavailable'); + assert.equal(f.element('ccVolume').disabled,true); + await f.element('ccMute').onclick(); + assert.equal(f.calls.length,0); + assert.match(f.element('ccAudioResult').textContent,/Connect and refresh/); + assert.equal(f.cards.find(c=>c.dataset.ccCard==='privacy').hidden,false); + f.ui.unavailable(Error('Local server is unavailable')); + assert.match(f.element('ccSampleState').textContent,/Local server is unavailable/); + f.context.online=true;f.ui.status(sample()); + assert.equal(f.element('ccVolume').disabled,false); +}); +test('mounted audio failure is visible and never reports success', async t => { + const f=mounted({api:async()=>{throw Error('Permission denied');}});t.after(()=>f.ui.destroy());f.ui.status(sample()); + await f.element('ccApplyVolume').onclick(); + assert.match(f.element('ccAudioResult').textContent,/Couldn’t apply audio: Permission denied/); + assert.equal(f.element('ccApplyVolume').disabled,false); + assert.equal(f.refreshes,0); +}); +test('audio confirmation depends on fresh readback rather than command acknowledgment', async t => { + let expected=.65, mode='confirmed'; + const f=mounted({refresh:async()=>{ + if(mode==='offline')return f.ui.unavailable(Error('Headset unreachable')); + const reading=sample();reading.volume.level=mode==='different' ? .64 : expected;f.ui.status(reading); + }});t.after(()=>f.ui.destroy());f.ui.status(sample()); + f.element('ccVolume').value='65';await f.element('ccApplyVolume').onclick(); + assert.match(f.element('ccAudioResult').textContent,/Confirmed: 65%, unmuted/); + mode='different';f.element('ccVolume').value='65';await f.element('ccApplyVolume').onclick(); + assert.match(f.element('ccAudioResult').textContent,/reported output differs: 64%/); + mode='offline';await f.element('ccApplyVolume').onclick(); + assert.match(f.element('ccAudioResult').textContent,/command sent; current output could not be confirmed/); + assert.equal(f.element('ccApplyVolume').disabled,true); +}); +test('pending audio never overwrites the new headset with old success or error', async t => { + let complete; + const f=mounted({api:()=>new Promise(resolve=>{complete=resolve;})});t.after(()=>f.ui.destroy());f.ui.status(sample()); + const pending=f.element('ccMute').onclick(); + assert.equal(f.element('ccApplyVolume').disabled,true); + f.context={online:true,generation:2,device:'frame-b'};f.ui.reset(); + const newSample=sample();newSample.hostname='Second Frame';newSample.volume.muted=true;f.ui.status(newSample); + complete({message:'Old headset muted'});await pending; + assert.equal(f.element('ccDeviceName').textContent,'Second Frame'); + assert.equal(f.element('ccAudioResult').textContent,''); + assert.equal(f.refreshes,0); + assert.equal(f.element('ccMute').textContent,'Unmute'); + f.ui.unavailable({stale:true,message:'Switched headsets'}); + assert.equal(f.element('metric-battery').textContent,'99%'); + assert.equal(f.element('ccMute').disabled,false); +}); +test('pending old-headset volume cannot become a draft on the new headset', async t => { + for(const failure of [false,true]) { + const request=deferred(),f=mounted({api:()=>request.promise});t.after(()=>f.ui.destroy()); + f.ui.status(sample());f.element('ccVolume').value='65';f.element('ccVolume').oninput(); + const pending=f.element('ccApplyVolume').onclick(); + f.context={online:true,generation:2,device:'frame-b'};f.ui.reset(); + const next=sample();next.volume.level=.2;f.ui.status(next); + assert.equal(f.element('ccApplyVolume').disabled,true); + if(failure)request.reject(Error('Old headset failed'));else request.resolve({message:'Done'}); + await pending; + assert.equal(f.element('ccVolume').value,20); + assert.equal(f.element('ccVolumeValue').textContent,'20%'); + assert.equal(f.element('ccAudioReadback').textContent,'Reported 20% · unmuted'); + assert.equal(f.element('ccApplyVolume').disabled,false); + assert.equal(f.element('ccAudioResult').textContent,''); + } +}); +test('production host response works before and after mounting with the actual bridge shape', async t => { + for(const early of [true,false]) { + const f=sharedPage();let ui; + if(!early){ui=f.mount();t.after(()=>ui.destroy());assert.equal(f.element('macLink').hidden,true);} + f.host.resolve({os:'macOS',mobile:false});await flush(); + if(early){ui=f.mount();t.after(()=>ui.destroy());} + assert.equal(f.context.watched,true); + assert.equal(f.element('macLink').hidden,false); + f.element('ccSearch').value='mac';f.element('ccSearch').input(); + assert.equal(f.element('macLink').hidden,false); + ui.host({os:'SteamOS',mobile:true});assert.equal(f.element('macLink').hidden,true); + } +}); +test('production shared refresh drains a pre-command request then samples after acknowledgment', async t => { + const f=sharedPage(),ui=f.mount();t.after(()=>ui.destroy());ui.status(sample()); + const prior=f.refresh();assert.equal(f.requests.length,1); + assert.equal(f.refresh(),prior); // the ordinary poll/manual deduplication still holds + f.element('ccVolume').value='65';f.element('ccVolume').oninput(); + const command=f.element('ccApplyVolume').onclick();await flush(); + assert.equal(f.writes.length,1);assert.equal(f.requests.length,1); + f.requests[0].resolve(sample());await prior;await flush(); + assert.equal(f.requests.length,2,'readback must issue a real post-command status request'); + assert.doesNotMatch(f.element('ccAudioResult').textContent,/Confirmed|reported output differs/); + assert.equal(f.element('ccApplyVolume').disabled,true); + const after=sample();after.volume.level=.65;f.requests[1].resolve(after);await command; + assert.match(f.element('ccAudioResult').textContent,/Confirmed: 65%, unmuted/); + assert.equal(f.element('ccApplyVolume').disabled,false); +}); +test('production audio readback survives an old poll failure and treats its own failed read as unconfirmed', async t => { + for(const failedReadback of [false,true]) { + const f=sharedPage(),ui=f.mount();t.after(()=>ui.destroy());ui.status(sample()); + const prior=f.refresh();f.element('ccVolume').value='65';f.element('ccVolume').oninput(); + const command=f.element('ccApplyVolume').onclick();await flush(); + f.requests[0].reject(Error('Pre-command poll failed'));await prior;await flush(); + assert.equal(f.requests.length,2); + assert.equal(f.element('ccApplyVolume').disabled,true); + if(failedReadback)f.requests[1].reject(Error('Readback unavailable')); + else {const after=sample();after.volume.level=.64;f.requests[1].resolve(after);} + await command; + assert.match(f.element('ccAudioResult').textContent,failedReadback ? /command sent; current output could not be confirmed/ : /reported output differs: 64%/); + assert.equal(f.element('ccApplyVolume').disabled,failedReadback); + } +}); +test('production Flatpak redraw cannot revive a failed status; only a fresh successful poll recovers', async t => { + const f=sharedPage(),ui=f.mount();t.after(()=>ui.destroy()); + const first=f.refresh(),reading=sample();f.requests[0].resolve(reading);await first; + const receipt=vm.runInContext('stateReceivedAt',f.context); + assert.equal(f.element('ccApplyVolume').disabled,false); + const failed=f.refresh();f.requests[1].reject(Error('Synthetic status parsing error'));await failed; + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + assert.equal(f.element('ccApplyVolume').disabled,true); + f.installFlatpak(); // actual production render(state), with job held pending + assert.equal(f.requests.length,2,'redraw must not start a replacement reading'); + assert.equal(vm.runInContext('stateReceivedAt',f.context),receipt); + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + assert.equal(f.element('ccStatusLabel').textContent,'No live sample'); + assert.match(f.element('ccSampleState').textContent,/Synthetic status parsing error/); + for(const id of ['ccVolume','ccApplyVolume','ccMute'])assert.equal(f.element(id).disabled,true); + const fresh=f.refresh(); + assert.equal(f.element('ccApplyVolume').disabled,true,'starting a poll does not clear failure'); + const next=sample();next.battery.percent=98;next.volume.level=.2; + f.requests[2].resolve(next);await fresh; + assert.equal(f.element('metric-battery').textContent,'98%'); + assert.equal(f.element('ccVolume').value,20); + assert.equal(f.element('ccApplyVolume').disabled,false); + assert.doesNotMatch(f.element('ccSampleState').textContent,/Synthetic status parsing error/); +}); +test('delayed production bootstrap retains failed-read state and fresh-poll recovery', async t => { + for(const priorSuccess of [true,false]) { + const f=sharedPage(); + if(priorSuccess){const first=f.refresh();f.requests[0].resolve(sample());await first;} + const failed=f.refresh();f.requests.at(-1).reject(Error('Status failed before mount'));await failed; + const calls=f.requests.length,ui=f.mount();t.after(()=>ui.destroy()); + assert.equal(f.requests.length,calls); + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + assert.equal(f.element('ccStatusLabel').textContent,'No live sample'); + assert.match(f.element('ccSampleState').textContent,/Status failed before mount/); + for(const id of ['ccVolume','ccApplyVolume','ccMute'])assert.equal(f.element(id).disabled,true); + const fresh=f.refresh();assert.equal(f.element('ccApplyVolume').disabled,true); + f.requests.at(-1).resolve(sample());await fresh; + assert.equal(f.element('metric-battery').textContent,'99%'); + assert.equal(f.element('ccApplyVolume').disabled,false); + assert.doesNotMatch(f.element('ccSampleState').textContent,/Status failed before mount/); + } +}); +test('same-object replay preserves invalidation and receipt age after a failed reading', t => { + const f=mounted();t.after(()=>f.ui.destroy());const reading=sample(); + f.ui.status(reading);f.ui.unavailable(Error('Status failure')); + f.ui.status(reading,Date.now()+1000); + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + assert.equal(f.element('ccApplyVolume').disabled,true); + assert.match(f.element('ccSampleState').textContent,/Status failure/); + f.ui.status(sample());assert.equal(f.element('ccApplyVolume').disabled,false); +}); +test('delayed production bootstrap preserves client receipt age despite headset clock skew', async t => { + const original=Date.now;let now=1000000;Date.now=()=>now;t.after(()=>{Date.now=original;}); + const f=sharedPage(),prior=f.refresh();const reading=sample();reading.time-=3600; + f.requests[0].resolve(reading);await prior; + now+=91000;const ui=f.mount();t.after(()=>ui.destroy()); + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + assert.equal(f.element('ccApplyVolume').disabled,true); + assert.match(f.element('ccSampleState').textContent,/expired/); + const fresh=f.refresh();f.requests[1].resolve(sample());await fresh; + assert.equal(f.element('ccApplyVolume').disabled,false); + assert.equal(f.element('metric-battery').textContent,'99%'); +}); +test('sample replay cannot renew receipt age; fresh receipts tolerate missing or skewed headset time', t => { + const original=Date.now;let now=1000000;Date.now=()=>now;t.after(()=>{Date.now=original;}); + const f=mounted();t.after(()=>f.ui.destroy());const reading=sample();f.ui.status(reading); + now+=91000;f.ui.status(reading); + assert.equal(f.element('ccApplyVolume').disabled,true); + assert.equal(f.element('metric-battery').textContent,'Unavailable'); + for(const time of [undefined,null,'invalid',NaN,Infinity,now/1000-3600,now/1000+3600]) { + f.ui.status({...sample(),time}); + assert.equal(f.element('ccApplyVolume').disabled,false); + assert.doesNotMatch(f.element('ccSampleState').textContent,/Invalid Date/); + } + for(const receipt of [null,NaN,Infinity,now+1000,now-91000]) { + f.ui.status(sample(),receipt);assert.equal(f.element('ccApplyVolume').disabled,true); + } +}); +test('mute-only readback preserves an unapplied volume until Apply sends it', async t => { + let reading=sample();const f=mounted({api:async(path,change,device)=>{ + f.calls.push([path,change,device]);reading={...reading,volume:{...reading.volume,...change}};return {message:'Done'}; + },refresh:async()=>f.ui.status({...reading})});t.after(()=>f.ui.destroy());f.ui.status(reading); + f.element('ccVolume').value='65';f.element('ccVolume').oninput(); + await f.element('ccMute').onclick(); + assert.deepEqual(f.calls[0],['/api/volume',{muted:true},'frame-a']); + assert.equal(f.element('ccVolume').value,'65');assert.equal(f.element('ccVolumeValue').textContent,'65%'); + assert.match(f.element('ccAudioReadback').textContent,/Reported 40% · muted/); + assert.match(f.element('ccAudioResult').textContent,/Confirmed: 40%, muted/); + await f.element('ccApplyVolume').onclick(); + assert.deepEqual(f.calls[1],['/api/volume',{level:.65},'frame-a']); + assert.equal(f.element('ccVolume').value,65); + assert.match(f.element('ccAudioResult').textContent,/Confirmed: 65%, muted/); +}); +test('live samples expire even when the status poll is paused', t => { + const original=Date.now;let now=100000;Date.now=()=>now;t.after(()=>{Date.now=original;}); + const f=mounted();t.after(()=>f.ui.destroy());f.ui.status(sample()); + now+=91000; + // A connection update must also re-check freshness before enabling a control. + f.ui.connection(true); + assert.equal(f.element('ccApplyVolume').disabled,true); +}); +test('mounted filters show empty state, counts, reset and host-dependent features', t => { + const f=mounted();t.after(()=>f.ui.destroy()); + f.element('ccSearch').value='dpi';f.element('ccSearch').input(); + assert.equal(f.cards.find(c=>c.dataset.ccCard==='display').hidden,false); + assert.equal(f.element('ccResultCount').textContent,'1 section'); + f.element('ccSearch').value='nothing-matches-this';f.element('ccSearch').input(); + assert.equal(f.element('ccEmpty').hidden,false); + f.element('ccResetFilter').onclick();assert.equal(f.element('ccEmpty').hidden,true); + f.ui.host({os:'Windows'});assert.equal(f.element('macLink').hidden,true); + assert.equal(f.cards.find(c=>c.dataset.ccCard==='mac').hidden,false); + f.ui.host({os:'macOS'});assert.equal(f.element('macLink').hidden,false); + f.ui.host({os:'SteamOS',mobile:true});assert.equal(f.element('macLink').hidden,true); + f.element('connectionLink').onclick({preventDefault(){}});assert.equal(f.opened,1); +}); +test('every linked workflow selects its real page and section, preserving shortcuts', () => { + const html=fs.readFileSync(require.resolve('../ui/index.html'),'utf8'); + const start=html.indexOf('const PAGES ='),end=html.indexOf('window.addEventListener("hashchange", showPage);',start); + const ids=new Set([...html.matchAll(/\bid="([^"]+)"/g)].map(m=>m[1])); + let activePage,scrolled; + const nodes=['home','games','android','tools','devices','control','settings'].map(page=>({dataset:{page},classList:{toggle(key,on){if(on)activePage=page;}}})); + const sections=new Map(); + const context={location:{hash:'#control'},document:{querySelectorAll:s=>s==='.page'?nodes:[],title:''}, + window:{scrollTo(){}},$:id=>{ + if(!ids.has(id))return null; + if(!sections.has(id))sections.set(id,{hidden:false,classList:{toggle(){}},scrollIntoView(){scrolled=id;}}); + return sections.get(id); + },live:false,toggleLive(){},scrollToY(){},loadMacView(){},loadPanelSwitcher(){}}; + const androidStart=html.indexOf('function showAndroidTab('); + const androidEnd=html.indexOf("document.querySelectorAll('[data-store-tab]').forEach(button => button.onclick",androidStart); + vm.createContext(context);vm.runInContext(html.slice(androidStart,androidEnd)+html.slice(start,end)+'\n'+html.match(/^PAGES\.push\([^\n]+/m)[0],context); + vm.runInContext('showPage()',context);assert.equal(activePage,'control'); + const expected={view:'home',shots:'home',vrTools:'home',comfort:'home',pad:'home',library:'games',getgames:'games',sideloaded:'games',android:'android',display:'android',androidLibrary:'android',appStore:'android', + power:'tools',transfer:'tools',media:'tools',apps:'tools',artworkSettings:'settings',privacy:'settings',panels:'tools',macview:'tools',devices:'devices'}; + for(const item of cc.catalog) for(const [href] of item.links||[]) { + if(!href.startsWith('#')||href==='#connection')continue; + const id=href.slice(1);assert.ok(ids.has(id)||['android','devices'].includes(id),href); + context.location.hash=href;scrolled=null;vm.runInContext('showPage()',context); + assert.equal(activePage,expected[id],href); + if(!['android','devices'].includes(id))assert.equal(scrolled,id,href); + if(id==='display'||id==='androidLibrary') { assert.equal(sections.get('androidLibrary').hidden,false);assert.equal(sections.get('appStore').hidden,true); } + if(id==='appStore') { assert.equal(sections.get('appStore').hidden,false);assert.equal(sections.get('androidLibrary').hidden,true); } + } + assert.equal(vm.runInContext('PAGES[4]',context),'devices'); + assert.equal(vm.runInContext('PAGES[5]',context),'control'); + assert.equal(vm.runInContext('PAGES[6]',context),'settings'); +}); diff --git a/tests/e2e/harness.py b/tests/e2e/harness.py index 1328f96..af7a295 100644 --- a/tests/e2e/harness.py +++ b/tests/e2e/harness.py @@ -10,6 +10,7 @@ import atexit import http.client import json import os +import shutil import socket import subprocess import sys @@ -22,7 +23,22 @@ from pathlib import Path ROOT = Path(__file__).resolve().parents[2] sys.path[:0] = [str(ROOT / 'ui'), str(ROOT / 'tests'), str(ROOT / 'tests' / 'smoke')] -ENABLED = os.environ.get('FRAME_E2E') == '1' +# Only inside the compose `host` container (FRAME_E2E_CONTAINER from compose.yaml, plus +# the container runtime's marker file): these tests drive ui/server.py with the real +# home, ~/.ssh and cache, which is only safe in a throwaway container. +REQUESTED = os.environ.get('FRAME_E2E') == '1' +IN_CONTAINER = os.environ.get('FRAME_E2E_CONTAINER') == '1' and ( + os.path.exists('/.dockerenv') or os.path.exists('/run/.containerenv')) +ENABLED = REQUESTED and IN_CONTAINER +if ENABLED: + # What tests/sandbox.py does, minus moving HOME: the container's real ~/.ssh is what + # points `ssh frame` at the fake Frame, and OpenSSH reads ~/.ssh from the password + # database, not $HOME. (These tests used to get this through test_frame_apk.) + _data = tempfile.mkdtemp(prefix='frame-control-e2e-') + atexit.register(shutil.rmtree, _data, ignore_errors=True) + os.environ['FRAME_CONTROL_DATA_DIR'] = _data + os.environ['FRAME_CONTROL_TELEMETRY'] = '0' + os.environ['FRAME_COMPAT_DB_URL'] = 'http://127.0.0.1:9' CTL = os.environ.get('FAKEFRAME_CTL', 'http://fakeframe:9999').rstrip('/') FAKE_HOST = os.environ.get('FAKEFRAME_HOST', 'fakeframe') HOME = '/home/steamos' @@ -30,9 +46,14 @@ SERVER_LOG = os.path.join(tempfile.gettempdir(), 'fakeframe-e2e-server.log') def require(): - """Call at module level: skips the module unless the fake Frame is up.""" - if not ENABLED: - raise unittest.SkipTest('needs the fake Frame: run scripts/e2e.sh (sets FRAME_E2E=1)') + """Skips (the module, at module level; the class, in setUpClass) unless this is + scripts/e2e.sh's container with the fake Frame up.""" + if ENABLED: + return + if REQUESTED: + raise unittest.SkipTest('FRAME_E2E=1 outside the e2e container: these tests use the real home, ~/.ssh ' + 'and app cache, so they only run in scripts/e2e.sh\'s throwaway container') + raise unittest.SkipTest('needs the fake Frame: run scripts/e2e.sh (sets FRAME_E2E=1)') # ---- the fake Frame's control port -------------------------------------------- @@ -97,6 +118,7 @@ class Server: @classmethod def start(cls): + require() # never a server on this computer's real data if cls.proc and cls.proc.poll() is None: return with socket.socket() as s: @@ -193,6 +215,7 @@ class FrameTestCase(unittest.TestCase): @classmethod def setUpClass(cls): + require() Server.start() def setUp(self): diff --git a/tests/e2e/test_agents.py b/tests/e2e/test_agents.py index f02f338..10aa218 100644 --- a/tests/e2e/test_agents.py +++ b/tests/e2e/test_agents.py @@ -6,6 +6,8 @@ import sys import harness from harness import api, ok, finished, ssh +harness.require() + sys.path.insert(0, str(harness.ROOT / 'ui')) import frame_mcp diff --git a/tests/e2e/test_android.py b/tests/e2e/test_android.py index 2b40489..d2f0cdd 100644 --- a/tests/e2e/test_android.py +++ b/tests/e2e/test_android.py @@ -5,7 +5,7 @@ import unittest import harness from harness import HOME, exists, ok, state, upload, wait_for -from test_frame_apk import apk, manifest, resources +from apk_fixtures import apk, manifest, resources harness.require() diff --git a/tests/fakeadb.py b/tests/fakeadb.py new file mode 100644 index 0000000..395fbf1 --- /dev/null +++ b/tests/fakeadb.py @@ -0,0 +1,100 @@ +#!/usr/bin/env python3 +"""A stand-in for Android's adb, for tests/test_quest.py: just enough of `devices -l`, +`shell`, and `pull` for frame_quest.py, run as a real subprocess. + +$FAKEADB_STATE is a JSON file: + devices [{"serial", "state", "extra" (the rest of the `devices -l` line), "props" {getprop name: value}}] + root a folder standing in for each device's file system (remote /x/y is root/x/y) + packages {package: [APK paths, as `pm path` prints them]} + fail_pull a remote path whose pull fails +Every call is appended to $FAKEADB_LOG as a JSON line. Shell commands are the simple +`; `-separated ones frame_quest sends, each answered here: no real shell runs. +""" +import json +import os +import shutil +import sys + +args = sys.argv[1:] +with open(os.environ['FAKEADB_LOG'], 'a') as f: + f.write(json.dumps(args) + '\n') +with open(os.environ['FAKEADB_STATE']) as f: + state = json.load(f) +root = state.get('root', '') +serial = None +if args[:1] == ['-s']: + serial, args = args[1], args[2:] + + +def fail(message, code=1): + sys.stderr.write(message + '\n') + sys.exit(code) + + +def local(remote): + return os.path.join(root, remote.lstrip('/')) + + +def size_kb(path): + total = 0 + for dirpath, _, files in os.walk(path): + total += sum(os.path.getsize(os.path.join(dirpath, n)) for n in files) + return max(4, total // 1024) + + +if args == ['devices', '-l']: + print('List of devices attached') + for d in state.get('devices', []): + print(f"{d['serial']:<22} {d['state']} {d.get('extra', '')}".rstrip()) + sys.exit(0) + +device = next((d for d in state.get('devices', []) if d['serial'] == serial), None) +if serial is None or device is None: + fail(f"adb: device '{serial}' not found") +if device['state'] == 'unauthorized': + fail('adb: device unauthorized.\nThis adb server\'s $ADB_VENDOR_KEYS is not set') +if device['state'] != 'device': + fail(f"adb: device {device['state']}") + +if args[:1] == ['shell']: + out = [] + for command in ' '.join(args[1:]).split('; '): + command = command.replace(' 2>/dev/null', '').strip() + words = command.split() + if not words or command == 'true': + continue + if words[0] == 'getprop': + out.append(device.get('props', {}).get(words[1], '')) + elif words[0] == 'echo': + out.append(' '.join(words[1:])) + elif command == 'pm list packages -3': + out += ['package:' + p for p in state.get('packages', {})] + elif words[:2] == ['pm', 'path']: + out += ['package:' + p for p in state.get('packages', {}).get(words[2], [])] + elif words[:2] == ['du', '-sk']: + if os.path.isdir(local(words[2])): + out.append(f'{size_kb(local(words[2]))}\t{words[2]}') + elif words[:3] == ['stat', '-c', '%s']: + out += [str(os.path.getsize(local(p.strip("'")))) for p in words[3:]] + else: + fail(f'/system/bin/sh: {words[0]}: inaccessible or not found', 127) + print('\n'.join(out)) + sys.exit(0) + +if args[:1] == ['pull'] and len(args) == 3: + remote, dest = args[1], args[2] + if remote == state.get('fail_pull'): + fail(f"adb: error: failed to copy '{remote}' to '{dest}': remote Connection reset") + src = local(remote) + if not os.path.exists(src): + fail(f"adb: error: failed to stat remote object '{remote}': No such file or directory") + if os.path.isdir(dest): + dest = os.path.join(dest, os.path.basename(remote.rstrip('/'))) + if os.path.isdir(src): + shutil.copytree(src, dest) + else: + shutil.copyfile(src, dest) + print(f'{remote}: 1 file pulled.') + sys.exit(0) + +fail('adb: unknown command ' + ' '.join(args)) diff --git a/tests/fakeframe/compose.yaml b/tests/fakeframe/compose.yaml index 089321c..d0e492b 100644 --- a/tests/fakeframe/compose.yaml +++ b/tests/fakeframe/compose.yaml @@ -43,6 +43,7 @@ services: FAKEFRAME_CTL: http://fakeframe:9999 FAKEFRAME_HOST: fakeframe FRAME_E2E: "1" + FRAME_E2E_CONTAINER: "1" # tests/e2e/harness.py refuses to run anywhere else healthcheck: test: ["CMD", "test", "-f", "/home/tester/.ready"] interval: 1s diff --git a/tests/fakegh/gh b/tests/fakegh/gh new file mode 100755 index 0000000..ec76aff --- /dev/null +++ b/tests/fakegh/gh @@ -0,0 +1,87 @@ +#!/usr/bin/env python3 +"""A stand-in for the GitHub CLI's `gh api`, for tests/test_publish_release.py and +tests/test_release_workflow.py. Serves the releases in $FAKEGH_RELEASES (a JSON list, +drafts included) and the tags in $FAKEGH_TAGS (space-separated); an upload's body is +written to $FAKEGH_UPLOAD. Every call is appended to $FAKEGH_LOG as a JSON line. +Anything else fails, so the script under test can't fall back to `gh release ...` +(GraphQL) unnoticed. POST .../releases (release.yml's draft step) answers as release +$FAKEGH_NEW_ID (default 9001) without adding it to the listing, like GitHub's list +lagging a fresh draft. With jq installed, --jq filters a response the way gh does +(raw strings, compact JSON).""" +import json +import os +import shutil +import subprocess +import sys + +args = sys.argv[1:] +with open(os.environ["FAKEGH_LOG"], "a") as f: + f.write(json.dumps(args) + "\n") +if not args or args[0] != "api": + sys.exit("fakegh: only `gh api` is supported: %r" % args) + +method, endpoint, fields, inp, jq, i = "GET", None, {}, None, None, 1 +while i < len(args): + a = args[i] + if a == "-X": + method = args[i + 1]; i += 2 + elif a in ("-f", "-F"): + k, _, v = args[i + 1].partition("="); fields[k] = v; i += 2 + elif a == "--input": + inp = args[i + 1]; i += 2 + elif a == "--jq": + jq = args[i + 1]; i += 2 + elif a == "-H": + i += 2 + elif a.startswith("-"): + i += 1 + elif endpoint is None: + endpoint = a; i += 1 + else: + sys.exit("fakegh: unexpected argument %r" % a) + +releases = json.load(open(os.environ["FAKEGH_RELEASES"])) +repo = "repos/saphid/frame-control/" + + +def answer(response, fallback): + """Print response through --jq when jq is here, else the fixed fallback text.""" + if jq and shutil.which("jq"): + out = subprocess.run(["jq", "-r", "-c", jq], input=json.dumps(response), + stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True) + sys.stdout.write(out.stdout) + if out.returncode: + sys.exit("fakegh: jq failed: " + out.stderr) + else: + print(fallback) + + +if method == "GET" and endpoint.startswith(repo + "git/ref/tags/"): + tag = endpoint.rsplit("/", 1)[1] + if tag not in os.environ.get("FAKEGH_TAGS", "").split(): + sys.exit("gh: Not Found (HTTP 404)") + print(json.dumps({"ref": "refs/tags/" + tag})) +elif method == "GET" and endpoint.startswith(repo + "releases?"): + # The fallback is what --jq '.[]' prints. + answer(releases, "\n".join(json.dumps(r) for r in releases)) +elif method == "POST" and endpoint == repo + "releases": + new = {"id": int(os.environ.get("FAKEGH_NEW_ID", "9001")), "tag_name": fields.get("tag_name"), + "name": fields.get("name"), "draft": fields.get("draft") == "true", + "body": fields.get("body"), "assets": [], + "html_url": "https://github.com/saphid/frame-control/releases/tag/untagged-be29e900f7855d794136"} + answer(new, json.dumps(new)) +elif method == "DELETE" and endpoint.startswith(repo + "releases/assets/"): + pass +elif method == "POST" and endpoint.startswith("https://uploads.github.com/" + repo + "releases/"): + with open(inp) as src, open(os.environ["FAKEGH_UPLOAD"], "w") as dst: + dst.write(src.read()) + print("{}") +elif method == "PATCH" and endpoint.startswith(repo + "releases/"): + rid = endpoint[len(repo + "releases/"):] + if not rid.isdigit(): # what GitHub said to v0.4.2's PATCH of releases/ (an empty id) + sys.exit("gh: Not Found (HTTP 404)") + page = "https://github.com/saphid/frame-control/releases/tag/%s" % fields.get("tag_name") + answer({"id": int(rid), "tag_name": fields.get("tag_name"), "html_url": page}, + "published %s at %s" % (fields.get("tag_name"), page)) +else: + sys.exit("fakegh: unhandled %s %s" % (method, endpoint)) diff --git a/tests/fakessh/ssh b/tests/fakessh/ssh index 45b2b17..c197e1f 100755 --- a/tests/fakessh/ssh +++ b/tests/fakessh/ssh @@ -3,10 +3,20 @@ each step of a connection, and plays a ControlMaster. What each HostName does comes from $FAKESSH_HOSTS (JSON: host -> "ok", "wrong" (a different host key), "denied" or "slow" (hangs after connecting); -every call is appended to $FAKESSH_LOG as a JSON line. POSIX only.""" +every call is appended to $FAKESSH_LOG as a JSON line. POSIX only. + +With $FAKESSH_PINS set, host keys are checked as OpenSSH does against UserKnownHostsFile under +HostKeyAlias: "wrong" is then just a different key from the others' (a reinstalled headset), +StrictHostKeyChecking=yes refuses a key not saved, accept-new saves a first one, and a saved key +that differs is refused. "evil" is a device with its own key that lets anyone in without +authentication ("none") and asks for the agent: it records in $FAKESSH_DIR what it got +(agent-forwarded, command-ran). Like ssh, the first value of an option counts.""" +import base64 +import hashlib import json import os import signal +import subprocess import sys import time @@ -17,12 +27,12 @@ hosts = json.loads(os.environ.get("FAKESSH_HOSTS", "{}")) opts = {} i = 0 while i < len(args) and args[i].startswith("-"): - if args[i] in ("-o", "-O", "-p", "-l"): + if args[i] in ("-o", "-O", "-p", "-l", "-F", "-W"): key = args[i] val = args[i + 1] if key == "-o": k, _, v = val.partition("=") - opts[k.lower()] = v + opts.setdefault(k.lower(), v) else: opts[key] = val i += 2 @@ -30,6 +40,12 @@ while i < len(args) and args[i].startswith("-"): opts[args[i]] = True i += 1 alias = args[i] if i < len(args) else "" +command = args[i + 1:] +if opts.get("-F") != "none": + # $FAKESSH_CONFIG: what ~/.ssh/config says (JSON, lower-case option -> value), below the + # command line's options, as ssh has it; `-F none` reads no config. + for k, v in json.loads(os.environ.get("FAKESSH_CONFIG", "{}")).items(): + opts.setdefault(k, v) host = opts.get("hostname", alias).replace("%%", "%") marker = os.path.join(os.environ["FAKESSH_DIR"], "master-" + host.replace("/", "_")) say = lambda s: (sys.stderr.write(s + "\n"), sys.stderr.flush()) @@ -44,6 +60,23 @@ if opts.get("-O") == "exit": os.unlink(marker) sys.exit(0) +if "-W" in opts: # a jump host's ssh, forwarding to the headset: the call is logged, that's all + sys.exit(0) +if opts.get("proxycommand", "none") != "none": + # As OpenSSH: expand %-tokens, then `$SHELL -c "exec "` (here /bin/sh). + line, out, n = opts["proxycommand"], "", 0 + while n < len(line): + if line[n] == "%" and n + 1 < len(line): + out += {"%": "%", "h": host, "p": opts.get("port", "22"), "r": opts.get("user", "")}.get( + line[n + 1], line[n:n + 2]) + n += 2 + else: + out += line[n] + n += 1 + if subprocess.run(["/bin/sh", "-c", "exec " + out], stdin=subprocess.DEVNULL, + stdout=subprocess.DEVNULL).returncode: + say("kex_exchange_identification: Connection closed by remote host") + sys.exit(255) what = hosts.get(host) if what is None: say(f"ssh: Could not resolve hostname {host}: nodename nor servname provided, or not known") @@ -53,6 +86,66 @@ say("debug1: Connection established.") if what == "slow": time.sleep(30) say(f"debug1: Authenticating to {host}:22 as '{opts.get('user', 'tester')}'") +if os.environ.get("FAKESSH_PINS") and "hostkeyalias" in opts and "userknownhostsfile" in opts: + name, path = opts["hostkeyalias"], os.path.expanduser(opts["userknownhostsfile"]) + blob = base64.b64encode(b"fake-" + {"wrong": b"other", "evil": b"evil"}.get(what, b"headset") + b"-key").decode() + fp = base64.b64encode(hashlib.sha256(base64.b64decode(blob)).digest()).decode().rstrip("=") + say(f"debug1: Server host key: ssh-ed25519 SHA256:{fp}") + try: + saved = [ln.split() for ln in open(path, errors="replace").read().splitlines() if ln.strip()] + except OSError: + saved = [] + saved = [f[2] for f in saved if len(f) >= 3 and name in f[0].split(",")] + strict = opts.get("stricthostkeychecking", "ask") + if saved and blob not in saved: + say("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@") + say("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @") + say("Host key verification failed.") + sys.exit(255) + if not saved and strict != "accept-new": + say(f"No ED25519 host key is known for {name} and you have requested strict checking.") + say("Host key verification failed.") + sys.exit(255) + if not saved: + try: + with open(path, "a") as f: + f.write(f"{name} ssh-ed25519 {blob}\n") + say(f"Warning: Permanently added '{name}' (ED25519) to the list of known hosts.") + except OSError: # ssh doesn't create the folder: it goes on, saving nothing + say(f"Failed to add the host to the list of known hosts ({path}).") + else: + say(f"debug1: Host '{name}' is known and matches the ED25519 host key.") + say("debug1: Next authentication method: publickey") + if what == "evil": + say(f'Authenticated to {host} ([127.0.0.1]:22) using "none".') + got = os.path.join(os.environ["FAKESSH_DIR"], "evil-") + if opts.get("forwardagent", "no") != "no" and opts.get("identityagent", "") != "none": + open(got + "agent-forwarded", "w").close() + if "-N" not in opts and (command or opts.get("remotecommand", "none") != "none"): + open(got + "command-ran", "w").close() + sys.exit(0) + time.sleep(30) # -N: holds the session open + sys.exit(0) + if opts.get("preferredauthentications") == "none": + say(f"tester@{host}: Permission denied (publickey,password).") + sys.exit(255) + if what == "denied": + say(f"tester@{host}: Permission denied (publickey).") + sys.exit(255) + what = "ok" + say(f'Authenticated to {host} ([127.0.0.1]:22) using "publickey".') + if opts.get("controlmaster") != "yes": + sys.exit(0) + open(marker, "w").close() + def bye(*_): + if os.path.exists(marker): + os.unlink(marker) + sys.exit(0) + signal.signal(signal.SIGTERM, bye) + while True: + time.sleep(0.2) + if not os.path.exists(marker): + sys.exit(0) say("debug1: Server host key: ssh-ed25519 SHA256:fakefakefakefakefakefakefakefakefakefakefak") if what == "wrong": say("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@") diff --git a/tests/page/desk_panels.mjs b/tests/page/desk_panels.mjs new file mode 100644 index 0000000..5ddf353 --- /dev/null +++ b/tests/page/desk_panels.mjs @@ -0,0 +1,82 @@ +// The live view's Desktop panel list (#73), run in node against the real functions from +// ui/index.html with a fake server: the headset's reason when it lists no panels, a failed +// listing shown (first time too) rather than "Finding…", and recovery after it. +import { readFileSync } from "fs"; +const src = readFileSync(new URL("../../ui/index.html", import.meta.url), "utf8"); +const grab = name => { + const m = src.match(new RegExp(`(?:\\nconst ${name} = [^\\n]*\\n)|((?:async )?function ${name}\\([\\s\\S]*?\\n}\\n)`)); + if (!m) throw new Error("not found: " + name); + return m[0]; +}; +// The page's scripts share one global scope, so a second loadPanels would silently replace +// the Desktop view's (what broke #73 until #84): the one grabbed here must be the only one. +for (const name of ["loadPanels", "noPanelWhy", "deskPanel", "ctrlTarget"]) { + const count = (src.match(new RegExp(`\\n(?:async )?function ${name}\\(`, "g")) || []).length; + if (count !== 1) { console.log(`FAIL ${name} is defined ${count} times`); process.exit(1); } +} +const code = ["desk", "panelKey", "noPanelWhy", "deskPanel", "loadPanels", "ctrlTarget"].map(grab).join(""); +const fail = msg => { console.log("FAIL " + msg); process.exit(1); }; + +function page(answer) { + const calls = [], logged = []; + const env = { + view: "flat", live: false, ctrlMode: () => "abs", renderPanelPick: () => {}, toggleLive: () => {}, ctrlShow: () => {}, + log: (m) => logged.push(m), + api: async (path, body) => { calls.push([path, body]); return answer(); }, + }; + const fns = new Function(...Object.keys(env), `${code} + return { desk, noPanelWhy, loadPanels, ctrlTarget };`)(...Object.values(env)); + return { ...fns, calls, logged }; +} + +// The Desktop view asks for the headset's panels with a plain GET (no switcher action). +{ + const p = page(() => ({ panels: [], focus: null, why: "The headset's desktop is running, but SteamOS isn't listing it as a panel." })); + if (p.ctrlTarget().why !== "Finding the headset's panels…") fail("before loading: " + p.ctrlTarget().why); + await p.loadPanels(); + if (!(p.calls.length === 1 && p.calls[0][0] === "/api/panels" && p.calls[0][1] === undefined)) + fail("request " + JSON.stringify(p.calls)); + if (!p.desk.loaded) fail("not marked loaded"); + if (!p.noPanelWhy().startsWith("The headset's desktop is running")) fail("why for capture: " + p.noPanelWhy()); + if (!p.ctrlTarget().why.startsWith("The headset's desktop is running")) fail("why for control: " + p.ctrlTarget().why); +} +// An older headset script without "why": the generic advice. +{ + const p = page(() => ({ panels: [], focus: null })); + await p.loadPanels(); + if (!p.noPanelWhy().startsWith("No app panel is open in the headset. Open the desktop")) fail("generic: " + p.noPanelWhy()); +} +// The first listing fails: Control and Capture say so (logged once), then recover. +{ + let broken = true; + const p = page(() => { + if (broken) throw new Error("Timed out talking to frame"); + return { panels: [{ window: 7, display: ":0", name: "Desktop" }], focus: 7, focus_display: ":0" }; + }); + await p.loadPanels(); await p.loadPanels(); + const why = p.ctrlTarget().why; + if (why !== "Couldn't list the headset's panels: Timed out talking to frame") fail("initial failure in Control: " + why); + if (p.noPanelWhy() !== why) fail("initial failure in Capture: " + p.noPanelWhy()); + if (p.logged.length !== 1) fail("logged " + p.logged.length + " times"); + broken = false; + await p.loadPanels(); + if (p.desk.error) fail("error kept after recovery"); + const t = p.ctrlTarget(); + if (!t.why || t.why.includes("Couldn't list")) fail("after recovery: " + JSON.stringify(t)); + if (p.desk.panels.length !== 1) fail("panels after recovery"); +} +// Waiting for the Frame: shown in Control, not logged every poll. An answer about the +// previous headset (stale) is ignored. +{ + let err; + const p = page(() => { throw err; }); + err = Object.assign(new Error("Can't reach the Frame"), { offline: true }); + await p.loadPanels(); await p.loadPanels(); + if (p.logged.length) fail("offline logged: " + p.logged); + if (p.ctrlTarget().why !== "Couldn't list the headset's panels: Can't reach the Frame") fail("offline: " + p.ctrlTarget().why); + const q = page(() => { throw Object.assign(new Error("old headset"), { offline: true, stale: true }); }); + await q.loadPanels(); + if (q.logged.length || q.desk.error) fail("stale answer used: " + q.desk.error); + if (q.ctrlTarget().why !== "Finding the headset's panels…") fail("stale: " + q.ctrlTarget().why); +} +console.log("ok"); diff --git a/tests/page/meta_rows.mjs b/tests/page/meta_rows.mjs new file mode 100644 index 0000000..b83b43e --- /dev/null +++ b/tests/page/meta_rows.mjs @@ -0,0 +1,43 @@ +// The Meta library's rows, run in node against the real functions from ui/index.html. +// Found in a live test with a real account (2026-10-14): sizes were cut off behind the +// package name, a required data file Frame Control can't place was not mentioned, and +// apps and environments were counted as "games". +import { readFileSync } from "fs"; +const src = readFileSync(new URL("../../ui/index.html", import.meta.url), "utf8"); +const lines = src.split("\n"); +const fail = msg => { console.log("FAIL " + msg); process.exit(1); }; + +function grab(name) { + const start = lines.findIndex(l => new RegExp(`^(?:(?:async )?function ${name}\\(|const ${name} = )`).test(l)); + if (start < 0) fail(`no top-level ${name} in index.html`); + let depth = 0; + for (let i = start; i < lines.length; i++) { + for (const c of lines[i]) depth += c === "{" ? 1 : c === "}" ? -1 : 0; + if (depth <= 0) return lines.slice(start, i + 1).join("\n") + "\n"; + } + fail(`unbalanced ${name}`); +} +const els = { metaCount: { textContent: "" }, metaApps: { innerHTML: "" } }; +const metaLib = { connected: true, results: new Map(), apps: [ + { id: "1", title: "The Climb", package: "com.crytek.climb", version: "666.0", version_code: 666, size: 30639455, + data_files: 0, skipped_files: ["main.com.crytek.climb.obb"] }, + { id: "2", title: "Beat Saber", package: "com.beatgames.beatsaber", problem: "Meta's API said HTTP 500", skipped_files: [] }, +] }; +const render = new Function("$", "metaLib", "androidApps", "installing", "queued", + grab("esc") + grab("questSize") + "const META_VERDICT = {};\n" + grab("renderMetaApps") + "renderMetaApps();"); +render(id => els[id], metaLib, [], new Set(["meta:1"]), new Set(["meta:1"])); +const html = els.metaApps.innerHTML; +if (els.metaCount.textContent !== "2 apps") fail("count: " + els.metaCount.textContent); +const climb = html.split('class="item"')[1]; +if (!/
29 MB · v666\.0 \(666\) · com\.crytek\.climb]*>Meta's API said HTTP 500Queued<\/span>/.test(climb) || !/data-meta-install="1" disabled/.test(climb)) fail("queued not shown: " + climb); +if (/Queued|disabled/.test(saber)) fail("queued on the wrong row: " + saber); +metaLib.apps = metaLib.apps.slice(0, 1); +render(id => els[id], metaLib, [], new Set(), new Set()); +if (els.metaCount.textContent !== "1 app") fail("singular count: " + els.metaCount.textContent); +console.log("ok"); diff --git a/tests/page/store_detail.mjs b/tests/page/store_detail.mjs new file mode 100644 index 0000000..bf740b3 --- /dev/null +++ b/tests/page/store_detail.mjs @@ -0,0 +1,109 @@ +// The Android store's app page, run in node against the real functions from ui/index.html. +// Issue #68: clicking an app opened an empty dialog (a bare horizontal line), because the +// Devices page's renderDetail replaced the store's. The store's is renderAppDetail now. +// (tests/test_server.py PageScripts checks no top-level name is declared twice.) +import { readFileSync } from "fs"; +const src = readFileSync(new URL("../../ui/index.html", import.meta.url), "utf8"); +const lines = src.split("\n"); +const fail = msg => { console.log("FAIL " + msg); process.exit(1); }; + +// A top-level declaration, from its first line to where its braces balance. +function grab(name) { + const start = lines.findIndex(l => new RegExp(`^(?:(?:async )?function ${name}\\(|const ${name} = )`).test(l)); + if (start < 0) fail(`no top-level ${name} in index.html`); + let depth = 0; + for (let i = start; i < lines.length; i++) { + for (const c of lines[i]) depth += c === "{" ? 1 : c === "}" ? -1 : 0; + if (depth <= 0) return lines.slice(start, i + 1).join("\n") + "\n"; + } + fail(`unbalanced ${name}`); +} +const names = ["esc", "storeName", "storeHue", "storeInitial", "storeText", "storeOpenSource", "sourcePage", "storeImage", + "GLYPH_VR", "GLYPH_APP", "RUNS", "storeRuns", "storeKind", "storeArt", "storeIcon", "sourceMark", "currentOffer", "detailBadges", "renderAppDetail", "renderAppDetailBody", + "updateInstall", "openStoreApp", "loadOfferDetails", "installStoreApp"]; +const code = names.map(grab).join(""); + +// A fake page: elements by id. The install panel's elements exist only while +// #detailBody holds the real app page, as in the browser. +function page(api = async () => ({})) { + const els = { appDetail: { open: false, scrollTop: 0, showModal() { this.open = true; } } }; + const inPage = id => ["detailInstall", "detailInstallNote", "detailProgress", "detailOffers"].includes(id); + const $ = id => inPage(id) && !(els.detailBody?.innerHTML || "").includes(`id="${id}"`) ? null + : (els[id] ||= { innerHTML: "", textContent: "", hidden: false, value: 0, removeAttribute() {}, querySelectorAll: () => [] }); + const sourceState = { apps: [], detail: null, detailRequest: 0, jobs: new Map() }; + const document = { activeElement: null, querySelector: () => null }; + const console = { error() {} }; + const calls = []; + const fns = new Function("$", "sourceState", "document", "console", "api", "runJob", "loadAndroid", "act", "window", code + "; return { renderAppDetail, openStoreApp };")( + $, sourceState, document, console, (...a) => { calls.push(a); return api(...a); }, + async (title, key, work) => work(), () => {}, async (title, work) => work(), + { open() { fail("an in-app installation opened an external page"); } }); + return { els, sourceState, calls, ...fns }; +} + +const offer = { source: "fdroid", id: "org.example.brush", source_name: "F-Droid", name: "Open Brush", summary: "Paint in VR", + description: "Paint in 3D.", version: "2.1", version_code: 21, package: "org.example.brush", + artwork: { icon: "/source-image/abc", screenshots: [] }, downloadable: true, verdict: { tone: "works", label: "Works" } }; + +// An app from the catalogue: its page renders, with its name, install and sources. +{ + const p = page(); + p.sourceState.detail = { app: { name: "Open Brush", offers: [{ ...offer }] }, choice: 0 }; + if (p.renderAppDetail() !== true) fail("a good listing reported a render failure"); + const html = p.els.detailBody.innerHTML; + if (!html.includes('id="detailTitle">Open Brush<')) fail("app page has no title: " + html.slice(0, 200)); + if (!html.includes('id="detailInstall"') || !html.includes("Get it from")) fail("app page has no install panel"); + if (html.includes('role="alert"')) fail("a good listing showed the error state"); +} + +// A listing that can't render (no offer to show) gets a clear message, not an empty dialog. +{ + const p = page(); + p.sourceState.detail = { app: { name: "Broken ", offers: [] }, choice: 0 }; + if (p.renderAppDetail() !== false) fail("a broken listing reported success"); + const html = p.els.detailBody.innerHTML; + if (!html.includes('role="alert"') || !html.includes("We couldn't show Broken <App>")) fail("no error state: " + html); + if (!html.includes('data-close="appDetail"')) fail("error state has no way to close"); +} + +// Opening a listing that can't render: the error stays up, no details request, nothing thrown. +{ + const p = page(async () => { throw new Error("offline"); }); + p.sourceState.apps = [{ name: "Broken", offers: [] }]; + await p.openStoreApp(0, true); + if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes('role="alert"')) fail("broken listing didn't open with the error"); + if (p.calls.length) fail("asked for details of a listing that couldn't render"); +} + +// Opening a good listing: the dialog opens with its page, and fresher details fill it in. +{ + const p = page(async () => ({ description: "Fresh description." })); + p.sourceState.apps = [{ name: "Open Brush", offers: [{ ...offer }] }]; + await p.openStoreApp(0); + if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes("Fresh description.")) fail("details didn't fill in the page"); + if (!String(p.calls[0]?.[0]).startsWith("/api/sources/details?")) fail("no details request: " + JSON.stringify(p.calls)); +} + +// A good listing whose details request fails keeps its page, with a note. +{ + const p = page(async () => { throw new Error("offline"); }); + p.sourceState.apps = [{ name: "Open Brush", offers: [{ ...offer }] }]; + await p.openStoreApp(0); + if (!p.els.detailBody.innerHTML.includes('id="detailTitle">Open Brush<')) fail("page lost after a failed details request"); + if (!p.els.detailInstallNote.textContent.includes("couldn't be refreshed")) fail("no note after a failed details request"); +} +// The featured Install starts a new or failed job, while a job already running or +// installed opens its details without another install or a launch command. +for (const [job, expected] of [[null, 1], [{ done: false }, 0], + [{ done: true, result: { package: offer.package } }, 0], [{ done: true, error: "offline" }, 1]]) { + const p = page(async path => path === "/api/sources/install" ? { package: offer.package } : {}); + p.sourceState.apps = [{ name: "Open Brush", offers: [{ ...offer }] }]; + if (job) p.sourceState.jobs.set(`${offer.source}:${offer.id}`, job); + await p.openStoreApp(0, true); + if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes('id="detailInstall"')) fail("hero installation didn't open details"); + const installs = p.calls.filter(([path]) => path === "/api/sources/install"); + if (installs.length !== expected) fail(`expected ${expected} installation requests, got ${installs.length}`); + if (installs.some(([, body]) => body.source !== offer.source || body.id !== offer.id)) fail("installed a different offer"); + if (p.calls.some(([path]) => path === "/api/android")) fail("hero Install launched an already installed app"); +} +console.log("ok"); diff --git a/tests/sandbox.py b/tests/sandbox.py index 5d2a3f0..dd30577 100644 --- a/tests/sandbox.py +++ b/tests/sandbox.py @@ -1,12 +1,20 @@ """Imported first by every test module: nothing a test does reaches this person's -app data, their telemetry, or the shared compatibility database. +app data, their ~/.ssh, their telemetry, or the shared compatibility database. Must run before any ui module is imported, since those read these at import time. +The variables are set in os.environ, so servers and scripts the tests start +inherit them too (they pass {**os.environ, ...}). """ import atexit import os import shutil import tempfile +from pathlib import Path + +# The environment and real ~/.ssh from before the changes below: test_sandbox +# reruns tests from that environment and checks ~/.ssh is left alone. +ORIGINAL_ENV = dict(os.environ) +REAL_SSH_DIR = Path.home() / ".ssh" _dir = tempfile.mkdtemp(prefix="frame-control-tests-") atexit.register(shutil.rmtree, _dir, ignore_errors=True) @@ -14,3 +22,25 @@ os.environ["FRAME_CONTROL_DATA_DIR"] = _dir os.environ["FRAME_CONTROL_TELEMETRY"] = "0" # A maintainer's machine holds the database key; send anything that slips through nowhere. os.environ["FRAME_COMPAT_DB_URL"] = "http://127.0.0.1:9" + +# A throwaway home, so Path.home() / "~" land here: ~/.ssh (config, host-key pins, +# its lock file) and the other per-user folders some modules use. A server started +# without FRAME_CONTROL_SSH_DIR used to import the real ~/.ssh/config and seed a pin +# into the real ~/.ssh/frame-control-hosts on every run. +# +# tests/e2e must not import this (directly or through a test_* module): they run in +# a throwaway container whose real ~/.ssh points `ssh frame` at the fake Frame, and +# OpenSSH finds ~/.ssh from the password database, not $HOME. Shared helpers they +# need live in sandbox-free modules such as apk_fixtures.py. +HOME = os.path.join(_dir, "home") +SSH_DIR = os.path.join(HOME, ".ssh") +os.makedirs(SSH_DIR, mode=0o700) +os.environ["HOME"] = HOME +os.environ["USERPROFILE"] = HOME # Path.home() on Windows +os.environ["FRAME_CONTROL_SSH_DIR"] = SSH_DIR # frame_devices.ssh_dir(), frame_connect.SSH_DIR +# The per-user folders that don't follow HOME when these are set: frame_host.cache_dir() +# (servers warm indexes there and sweep its staging folders) and data_dir()'s fallbacks. +for _name, _sub in (("LOCALAPPDATA", "AppData/Local"), ("APPDATA", "AppData/Roaming"), + ("XDG_CACHE_HOME", ".cache"), ("XDG_DATA_HOME", ".local/share"), + ("XDG_STATE_HOME", ".local/state"), ("XDG_CONFIG_HOME", ".config")): + os.environ[_name] = os.path.join(HOME, *_sub.split("/")) diff --git a/tests/test_agent.py b/tests/test_agent.py index 931eccb..83d0b2c 100644 --- a/tests/test_agent.py +++ b/tests/test_agent.py @@ -1,4 +1,5 @@ """MCP protocol, exact-action approvals and explicit assistant data sharing.""" +import sandbox # noqa: F401 (first: keeps tests off real data and services) import io import json import os diff --git a/tests/test_apk_artwork.py b/tests/test_apk_artwork.py index b036f90..e863afe 100644 --- a/tests/test_apk_artwork.py +++ b/tests/test_apk_artwork.py @@ -1,3 +1,4 @@ +import sandbox # noqa: F401 (first: keeps tests off real data and services) import http.client import json from pathlib import Path diff --git a/tests/test_apk_more_sources.py b/tests/test_apk_more_sources.py index f1879b9..f1f3cf7 100644 --- a/tests/test_apk_more_sources.py +++ b/tests/test_apk_more_sources.py @@ -1,3 +1,4 @@ +import sandbox # noqa: F401 (first: keeps tests off real data and services) import hashlib, io, json, os, sys, tempfile, time, unittest, urllib.error, urllib.request, zipfile from pathlib import Path from unittest.mock import patch diff --git a/tests/test_apk_search.py b/tests/test_apk_search.py index 20cd57e..6b4e3ed 100644 --- a/tests/test_apk_search.py +++ b/tests/test_apk_search.py @@ -1,3 +1,4 @@ +import sandbox # noqa: F401 (first: keeps tests off real data and services) import http.client import json from pathlib import Path diff --git a/tests/test_comfort.py b/tests/test_comfort.py index 0b3af36..d2e0e93 100644 --- a/tests/test_comfort.py +++ b/tests/test_comfort.py @@ -1,4 +1,5 @@ """Fake-Frame session clock/actions plus real helper serialization and sensor probes.""" +import sandbox # noqa: F401 (first: keeps tests off real data and services) import os import shutil import json @@ -255,3 +256,47 @@ class SensorTests(unittest.TestCase): self.assertIsNone(status.activity_level()) with patch.object(status, 'run', return_value='[{"operation":"status","activity_level":3}]'): self.assertEqual(status.activity_level(), 3) + + +class DesktopBundleTests(unittest.TestCase): + """server.comfort runs the copy cached on the headset; the sources go only when it's missing.""" + + @unittest.skipUnless(os.name == "posix", "checks POSIX permissions") + def test_sources_are_sent_once_per_version(self): + import server + with tempfile.TemporaryDirectory() as tmp: + here, home = Path(tmp) / 'ui', Path(tmp) / 'frame' + here.mkdir() + home.mkdir() + for name in server.COMFORT_FILES: + (here / name).write_text('# ' + name + '\n') + (here / 'frame_comfort.py').write_text('import json, sys\nprint(json.dumps({"active": False, "got": sys.argv[1]}))\n') + sent = [] + + def ssh(remote, *, stdin, timeout): # the headset: the script run under its own home + sent.append(stdin) + return subprocess.run([sys.executable, '-'], input=stdin, capture_output=True, text=True, check=True, + env={**os.environ, 'HOME': str(home)}).stdout + + with patch.object(server, 'HERE', here), patch.object(server, 'ssh', side_effect=ssh): + first = server.comfort({'action': 'status'}) + self.assertEqual(json.loads(first['got']), {'action': 'status'}) + self.assertEqual(len(sent), 2) # the check, then the sources + self.assertNotIn('# frame_steam.py', sent[0]) + self.assertIn('# frame_steam.py', sent[1]) + self.assertEqual(server.comfort({'action': 'status'}), first) + self.assertEqual(len(sent), 3) + self.assertNotIn('# frame_steam.py', sent[2]) + cached, = (home / '.cache/frame-control/comfort').iterdir() + self.assertEqual(sorted(p.name for p in cached.iterdir()), sorted(server.COMFORT_FILES)) + self.assertEqual(cached.stat().st_mode & 0o777, 0o700) + self.assertTrue(all(p.stat().st_mode & 0o777 == 0o600 for p in cached.iterdir())) + # A copy cut short is completed; a changed helper is a new version. + (cached / 'frame_status.py').unlink() + server.comfort({'action': 'status'}) + self.assertEqual(len(sent), 5) + self.assertTrue((cached / 'frame_status.py').exists()) + (here / 'frame_steam.py').write_text('# frame_steam.py, changed\n') + server.comfort({'action': 'status'}) + self.assertEqual(len(sent), 7) + self.assertEqual(len(list((home / '.cache/frame-control/comfort').iterdir())), 2) diff --git a/tests/test_comfort_ui.py b/tests/test_comfort_ui.py index 4ed21e9..5d4b8e7 100644 --- a/tests/test_comfort_ui.py +++ b/tests/test_comfort_ui.py @@ -1,4 +1,5 @@ """Run the actual shared page's comfort renderer against a minimal DOM/bridge.""" +import sandbox # noqa: F401 (first: keeps tests off real data and services) import pathlib import shutil import subprocess @@ -100,3 +101,32 @@ assert.equal($('sessionMinutes').value, '50'); // later polls leave it alone ''' result = subprocess.run(['node', '-e', setup + code + checks], capture_output=True, text=True) self.assertEqual(result.returncode, 0, result.stderr) + + def test_poll_waits_while_the_frame_is_unreachable(self): + page = (ROOT / 'ui/index.html').read_text(encoding='utf-8') + start = page.index('async function pollComfort()') + code = page[start:page.index('$("comfortForm").onsubmit', start)] + js = r''' +const assert = require('node:assert/strict'); +const el = {textContent: 'Checking session…'}; +const $ = () => el; +let online = false, comfortBusy = false, calls = 0, timers = 0; +const api = async () => { calls++; return {}; }; +const renderComfort = () => {}; +const setTimeout = () => { timers++; }; +''' + code + r''' +(async () => { + await pollComfort(); + assert.equal(calls, 0); // no ssh attempt while the status check can't reach the Frame + assert.match(el.textContent, /when the Frame is connected/); + assert.equal(timers, 1); // still scheduled, to resume when it's back + online = true; + await pollComfort(); + assert.equal(calls, 1); + online = null; // a status check that failed for another reason: keep polling + await pollComfort(); + assert.equal(calls, 2); +})().catch(e => { console.error(e); process.exitCode = 1; }); +''' + result = subprocess.run(['node', '-e', js], capture_output=True, text=True) + self.assertEqual(result.returncode, 0, result.stderr) diff --git a/tests/test_contact.py b/tests/test_contact.py new file mode 100644 index 0000000..882a596 --- /dev/null +++ b/tests/test_contact.py @@ -0,0 +1,412 @@ +"""A contact email (ui/frame_contact.py): kept only with a matching choice, sent privately, +withdrawn when removed, never lost offline, and the one-time prompt stays dismissed. + +Run: python3 -m unittest discover -s tests +""" +import sandbox # noqa: F401 (first: keeps tests off real data and services) +import sys +import threading +import time +import unittest +from pathlib import Path +from unittest import mock + +ROOT = Path(__file__).resolve().parent.parent +sys.path.insert(0, str(ROOT / "ui")) +sys.path.insert(0, str(Path(__file__).resolve().parent)) + +import frame_compat_db as db # noqa: E402 +import frame_contact as fc # noqa: E402 +import frame_report as fr # noqa: E402 +import frame_telemetry as tm # noqa: E402 +from test_telemetry import Base, ReportProblem # noqa: E402 + +REPORT = {"title": "RDP not working", "message": "It never connects on Windows."} + + +class Contact(Base): + """Base's temp telemetry state, ReportProblem's PostHog stand-in, and a temp contact file.""" + serve = ReportProblem.serve + + def setUp(self): + super().setUp() + self.addCleanup(fc._removed.clear) + for name, value in (("STATE", tm.STATE / "contact"), ("FILE", tm.STATE / "contact" / "contact.json")): + p = mock.patch.object(fc, name, value) + p.start() + self.addCleanup(p.stop) + self.got = self.serve() + + def events(self): + return [body["batch"][0] for _, body in self.got] + + def offline(self): + return mock.patch.object(tm, "post", side_effect=tm.SendError("couldn't reach PostHog")) + + # ---- storage and consent flags + + def test_nothing_is_kept_or_sent_until_chosen(self): + s = fc.state() + self.assertEqual((s["email"], s["updates"], s["followup"], s["waiting"]), ("", False, False, False)) + self.assertFalse(fc.FILE.exists()) + self.assertEqual(self.got, []) + + def test_an_address_needs_a_choice_and_a_real_address(self): + with self.assertRaisesRegex(ValueError, "tick"): + fc.save({"email": "me@example.com"}) + with self.assertRaisesRegex(ValueError, "email address"): + fc.save({"email": "not an address", "updates": True}) + self.assertEqual(fc.load()["email"], "") + self.assertEqual(self.got, []) + + def test_only_a_real_true_counts_as_consent(self): + for wrong in ("false", "true", 1, 0, [], {}): + with self.assertRaisesRegex(ValueError, "true or false"): + fc.save({"email": "me@example.com", "updates": wrong, "followup": True}) + with self.assertRaisesRegex(ValueError, "true or false"): + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": wrong}) + self.assertEqual((fc.load()["email"], self.got), ("", [])) + fc.save({"email": "me@example.com", "updates": True}) # left out is no + self.assertEqual((fc.load()["updates"], fc.load()["followup"]), (True, False)) + + def test_each_choice_is_sent_privately_on_its_own(self): + fc.save({"email": " me@example.com ", "updates": True}) + fc.save({"email": "me@example.com", "updates": False, "followup": True}) + first, second = self.events() + self.assertEqual(first["event"], "contact_consent") + self.assertEqual({k: first["properties"][k] for k in ("email", "updates", "followup", "action")}, + {"email": "me@example.com", "updates": True, "followup": False, "action": "set"}) + self.assertEqual((second["properties"]["updates"], second["properties"]["followup"]), (False, True)) + self.assertEqual(first["distinct_id"], second["distinct_id"]) # one contact id, newest wins + self.assertNotEqual(first["distinct_id"], tm.settings()["id"]) # not the analytics id + self.assertEqual((first["properties"]["$process_person_profile"], first["properties"]["$geoip_disable"]), + (False, True)) + self.assertEqual([e["event"] for e in tm._read_lines(tm.SENT)], ["contact_consent"] * 2) + + def test_sent_whatever_the_analytics_settings(self): + tm.update_settings({"usage": False}) + fc.save({"email": "me@example.com", "followup": True}) + self.assertEqual(len(self.got), 1) + + def test_saving_the_same_choice_again_sends_nothing(self): + fc.save({"email": "me@example.com", "updates": True}) + fc.save({"email": "me@example.com", "updates": True}) + self.assertEqual(len(self.got), 1) + + # ---- withdrawal + + def test_removing_the_address_sends_a_withdrawal_without_it(self): + fc.save({"email": "me@example.com", "updates": True, "followup": True}) + s = fc.save({"email": "", "updates": True, "followup": True}) + self.assertEqual((s["email"], s["updates"], s["followup"]), ("", False, False)) + withdrawal = self.events()[-1]["properties"] + self.assertEqual((withdrawal["action"], withdrawal["email"], withdrawal["updates"], withdrawal["followup"]), + ("withdraw", "", False, False)) + self.assertNotIn("me@example.com", fc.FILE.read_text()) + + def test_an_address_still_waiting_is_withdrawn_too(self): + with self.offline(): + fc.save({"email": "me@example.com", "updates": True}) # may already be on its way + with mock.patch.object(tm, "post") as post: + fc.save({"email": ""}) + self.assertEqual([c.args[0][0]["properties"]["action"] for c in post.call_args_list], ["withdraw"]) + self.assertFalse(fc.state()["waiting"]) + + def test_offline_the_newest_choice_waits_and_a_withdrawal_is_never_lost(self): + fc.save({"email": "me@example.com", "updates": True}) + with self.offline(): + s = fc.save({"email": ""}) + self.assertTrue(s["waiting"]) + self.assertFalse(fc._send_pending()) + self.assertEqual(fc.load()["pending"]["properties"]["action"], "withdraw") + self.assertTrue(fc._send_pending()) + self.assertFalse(fc.state()["waiting"]) + self.assertEqual([e["properties"]["action"] for e in self.events()], ["set", "withdraw"]) + + def test_removing_the_address_wipes_it_from_the_sent_log_too(self): + fc.save({"email": "me@example.com", "followup": True}) + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True}) + self.assertIn("me@example.com", tm.SENT.read_text()) + fc.save({"email": ""}) + self.assertNotIn("me@example.com", tm.SENT.read_text()) + self.assertEqual([e["properties"].get("action") for e in tm._read_lines(tm.SENT) + if e["event"] == "contact_consent"], ["set", "withdraw"]) + + def test_each_change_has_a_higher_rev_so_the_newest_wins_whatever_the_clock(self): + fc.save({"email": "me@example.com", "updates": True}) + fc.save({"email": "new@example.com", "updates": True}) + fc.save({"email": ""}) + self.assertEqual([e["properties"]["rev"] for e in self.events()], [1, 2, 3]) + + def test_a_withdrawal_during_a_send_goes_after_it(self): + started, release, order = threading.Event(), threading.Event(), [] + real = tm.post + + def slow(batch, timeout=20): + order.append(batch[0]["properties"]["action"]) + if len(order) == 1: + started.set() + release.wait(5) + real(batch, timeout) + + with mock.patch.object(tm, "post", side_effect=slow): + t = threading.Thread(target=fc.save, args=({"email": "me@example.com", "updates": True},)) + t.start() + self.assertTrue(started.wait(5)) + w = threading.Thread(target=fc.save, args=({"email": ""},)) + w.start() + for _ in range(500): # the withdrawal is saved while the first send is still out + if fc.load()["rev"] == 2: + break + time.sleep(0.01) + self.assertEqual(fc.load()["pending"]["properties"]["action"], "withdraw") + release.set() + t.join(5) + w.join(5) + self.assertEqual(order, ["set", "withdraw"]) + self.assertEqual([e["properties"]["action"] for e in self.events()], ["set", "withdraw"]) + self.assertFalse(fc.state()["waiting"]) + self.assertNotIn("me@example.com", tm.SENT.read_text()) + + def test_a_report_still_sending_when_its_address_is_removed_is_logged_without_it(self): + fc.save({"email": "me@example.com", "followup": True}) + real = tm.post + + def remove_meanwhile(batch, timeout=20): + real(batch, timeout) + fc.save({"email": ""}) # removed while the report is on its way, before it's logged + + with mock.patch.object(tm, "post", side_effect=remove_meanwhile): + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True}) + self.assertNotIn("me@example.com", tm.SENT.read_text()) + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True}) + self.assertIn("me@example.com", tm.SENT.read_text()) # sent again after removal: logged as sent + + def test_only_reports_started_before_the_removal_are_redacted_even_within_a_second(self): + fc._removed["me@example.com"] = 1790000000.3 + event = lambda: {"timestamp": "2026-09-21T12:53:20Z", "properties": {"contact": "me@example.com"}} + before, after = event(), event() # the same whole second as the removal + fc.redact_removed(before, 1790000000.1) + fc.redact_removed(after, 1790000000.6) + self.assertEqual((before["properties"]["contact"], after["properties"]["contact"]), + ("", "me@example.com")) + + def test_saving_during_a_slow_send_returns_at_once(self): + busy = fc._send_lock + busy.acquire() + try: + s = fc.save({"email": "me@example.com", "updates": True}) + finally: + busy.release() + self.assertTrue(s["waiting"]) # left for the send under way (or the retry) to take + self.assertEqual(self.got, []) + self.assertTrue(fc._send_pending()) + self.assertEqual(len(self.got), 1) + + def test_a_change_saved_as_a_send_finishes_is_not_left_behind(self): + real = fc._send_lock + + class Lock: # a Save lands after the sender found nothing waiting, before it lets go + saved = False + + def acquire(self, blocking=True): + return real.acquire(blocking) + + def release(self): + if not Lock.saved: + Lock.saved = True + s = threading.Thread(target=fc.save, args=({"email": "me@example.com", "updates": True},)) + s.start() + s.join(5) + assert not s.is_alive() # the change is saved while the sender still holds the lock + real.release() + + with mock.patch.object(fc, "_send_lock", Lock()): + self.assertTrue(fc._send_pending()) + self.assertEqual([e["properties"]["email"] for e in self.events()], ["me@example.com"]) + self.assertFalse(fc.state()["waiting"]) + + # ---- the one-time prompt + + def test_the_prompt_waits_for_a_working_setup_then_stays_dismissed(self): + self.assertFalse(fc.state()["showPrompt"]) # a new install: the Frame hasn't connected yet + tm.frame_seen("20260901.1", "3.8") + self.assertTrue(fc.state()["showPrompt"]) + fc.prompt({"prompt": "dismissed"}) + fc.prompt({"prompt": "shown"}) # a later session can't bring it back + self.assertEqual(fc.load()["prompt"], "dismissed") + self.assertFalse(fc.state()["showPrompt"]) + self.assertEqual(self.got, []) # No thanks sends nothing + with self.assertRaises(ValueError): + fc.prompt({"prompt": "reset"}) + + def test_the_prompt_is_shown_once_and_saving_answers_it(self): + tm.frame_seen("20260901.1", "3.8") + fc.prompt({"prompt": "shown"}) + self.assertFalse(fc.state()["showPrompt"]) + fc.save({"email": "me@example.com", "followup": True, "fromPrompt": True}) + self.assertEqual(fc.load()["prompt"], "answered") + + # ---- reports and the maintainer's list + + def reports(self): + return [e["properties"] for e in self.events() if e["event"] == "problem_report"] + + def test_a_report_carries_the_address_only_with_follow_up_consent(self): + fr.send({**REPORT, "contact": "me@example.com"}) + self.assertFalse(fc.FILE.exists()) # no follow-up: nothing kept, nothing linked + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True}) + without, with_ = self.reports() + self.assertEqual((without["contact"], without["contact_followup"], without["contact_id"]), ("", False, "")) + self.assertEqual((with_["contact"], with_["contact_followup"]), ("me@example.com", True)) + self.assertEqual((with_["contact_id"], with_["contact_rev"]), (fc.load()["id"], fc.load()["rev"])) + self.assertNotEqual(with_["contact_id"], tm.settings()["id"]) # not the analytics id + with self.assertRaisesRegex(ValueError, "email address"): + fr.send({**REPORT, "contact": "discord:me", "contactFollowup": True}) + + def test_follow_up_given_with_a_report_is_kept_and_removed_in_settings(self): + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True}) + s = fc.state() + self.assertEqual((s["email"], s["updates"], s["followup"]), ("me@example.com", False, True)) + consent = [e for e in self.events() if e["event"] == "contact_consent"] + self.assertEqual([(e["properties"]["action"], e["properties"]["rev"]) for e in consent], [("set", 1)]) + self.assertEqual(consent[0]["distinct_id"], self.reports()[0]["contact_id"]) + fr.send({**REPORT, "contact": "ME@example.com", "contactFollowup": True}) # already agreed + self.assertEqual(len([e for e in self.events() if e["event"] == "contact_consent"]), 1) + self.assertEqual(self.reports()[1]["contact_rev"], 1) + fc.save({"email": ""}) # Remove my email + last = self.events()[-1] + self.assertEqual((last["properties"]["action"], last["properties"]["email"], last["properties"]["rev"]), + ("withdraw", "", 2)) + logged = [e["properties"].get("contact") for e in tm._read_lines(tm.SENT) if e["event"] == "problem_report"] + self.assertEqual(logged, ["", ""]) + + def test_a_report_to_another_address_replaces_it_with_follow_up_only(self): + """Update notices were agreed for the old address, not the new one (the form says so).""" + fc.save({"email": "old@example.com", "updates": True}) + fr.send({**REPORT, "contact": "new@example.com", "contactFollowup": True}) + s = fc.state() + self.assertEqual((s["email"], s["updates"], s["followup"]), ("new@example.com", False, True)) + self.assertEqual(self.reports()[0]["contact_rev"], 2) + fc.save({"email": "new@example.com", "updates": True, "followup": False}) + fr.send({**REPORT, "contact": "NEW@example.com", "contactFollowup": True}) # same address: kept + s = fc.state() + self.assertEqual((s["email"], s["updates"], s["followup"]), ("new@example.com", True, True)) + + def test_a_removal_while_the_report_saves_its_address_still_counts(self): + """Removed while the report's own consent is on its way: the report keeps that consent's + rev (so the removal is newer) and is logged without the address.""" + post, removed = tm.post, [] + + def slow_post(events, **kw): + post(events, **kw) + if not removed and events[0]["event"] == "contact_consent": + removed.append(fc.save({"email": ""})) # Remove my email, mid-send + with mock.patch.object(tm, "post", side_effect=slow_post): + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True}) + report = self.reports()[0] + self.assertEqual((report["contact_rev"], fc.load()["rev"], fc.state()["email"]), (1, 2, "")) + consents = [[e["distinct_id"], e["properties"]["email"], e["properties"]["followup"], e["properties"]["rev"]] + for e in self.events() if e["event"] == "contact_consent"] + row = self.report_row(cid=report["contact_id"], rev=report["contact_rev"]) + fr.mark_withdrawn([row], consents) + self.assertEqual(row[10], "withdrawn") + logged = [e["properties"]["contact"] for e in tm._read_lines(tm.SENT) if e["event"] == "problem_report"] + self.assertEqual(logged, [""]) + + def report_row(self, contact="me@example.com", followup=True, cid="copy", rev=1): + return ["2026-09-10T10:00:00Z", "AB12CD34", "bug", "RDP", "It never connects.", contact, + "0.4.0", "Windows", "", "", followup, cid, rev] + + def test_a_later_change_takes_back_a_reports_follow_up_permission(self): + reports = [self.report_row(), # removed later + self.report_row(cid="other"), # another copy, still agrees + self.report_row(rev=3), # sent after the removal + self.report_row(cid="moved"), # address changed later + self.report_row(cid="news-only"), # follow-up unticked later + self.report_row(contact="Me@Example.com", cid="case"), # same address, any case + self.report_row(cid="", followup=True), # no contact id: left alone + self.report_row(cid="bad", rev="x")] # malformed rev: treated as 0 + consents = [["copy", "me@example.com", True, 1], ["copy", "", False, 2], + ["other", "me@example.com", True, 1], ["other", "me@example.com", True, 2], + ["moved", "new@example.com", True, 2], ["news-only", "me@example.com", False, 2], + ["case", "me@example.com", True, 2], ["bad", "", False, 1], ["short"], ["x", "", False, "?"]] + fr.mark_withdrawn(reports, consents) + self.assertEqual([r[10] for r in reports], + ["withdrawn", True, True, "withdrawn", "withdrawn", True, True, "withdrawn"]) + + def test_the_change_number_decides_not_the_clock(self): + """The clock went back between the report and the removal: the removal still counts.""" + fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True}) + with mock.patch.object(fc.time, "gmtime", return_value=time.gmtime(0)): + fc.save({"email": ""}) + report = self.reports()[0] + row = self.report_row(cid=report["contact_id"], rev=report["contact_rev"]) + consents = [[e["distinct_id"], e["properties"]["email"], e["properties"]["followup"], e["properties"]["rev"]] + for e in self.events() if e["event"] == "contact_consent"] + self.assertEqual(self.events()[-1]["timestamp"], "1970-01-01T00:00:00Z") + fr.mark_withdrawn([row], consents) + self.assertEqual(row[10], "withdrawn") + + def test_the_inbox_shows_withdrawn_follow_up_without_the_address(self): + reports = [self.report_row(), ["short"]] + consents = [["copy", "", False, 2]] + with mock.patch.object(db, "_posthog_query", side_effect=[{"results": reports}, {"results": consents}]) as q, \ + mock.patch.object(sys, "argv", ["frame_report.py", "inbox", "30"]), \ + mock.patch("builtins.print") as out: + fr.main() + self.assertIn("properties.contact_rev", q.call_args_list[0].args[0]) + self.assertIn("event = 'contact_consent'", q.call_args_list[1].args[0]) + printed = " ".join(str(c.args[0]) for c in out.call_args_list if c.args) + self.assertIn("follow-up permission since withdrawn", printed) + self.assertNotIn("me@example.com", printed) + with mock.patch.object(db, "_posthog_query", return_value={"results": [self.report_row(followup=False)]}) as q: + fr.inbox() + self.assertEqual(q.call_count, 1) # nothing to reconcile, no second query + + def test_contacts_lists_the_newest_choice_per_copy_by_consent(self): + rows = [["a", "both@example.com", True, "true", "2026-09-01T10:00:00Z"], + ["b", "news@example.com", "true", False, "2026-09-02T10:00:00Z"], + ["c", "", False, False, "2026-09-03T10:00:00Z"], # withdrawn + ["d", "not-an-address", True, True, "2026-09-03T10:00:00Z"], ["short"]] + with mock.patch.object(db, "_posthog_query", return_value={"results": rows}) as q: + found = fr.contacts() + self.assertIn("argMax(properties.email, tuple(ifNull(toInt(properties.rev), 0), timestamp))", + q.call_args.args[0]) + self.assertEqual(found, {"updates": [("both@example.com", "2026-09-01"), ("news@example.com", "2026-09-02")], + "followup": [("both@example.com", "2026-09-01")]}) + with mock.patch.object(fr, "contacts", return_value=found), \ + mock.patch.object(sys, "argv", ["frame_report.py", "contacts", "followup"]), \ + mock.patch("builtins.print") as out: + fr.main() + printed = " ".join(str(c.args[0]) for c in out.call_args_list if c.args) + self.assertIn("both@example.com", printed) + self.assertNotIn("news@example.com", printed) + + def test_the_page_can_reach_it(self): + import server + self.assertIs(server.POST["/api/contact"], fc.save) + self.assertIs(server.POST["/api/contact/prompt"], fc.prompt) + + def test_saving_is_not_headset_work(self): + """A slow send mustn't hold up switching headsets, nor be refused after a switch.""" + import io + import server + seen = [] + for path in ("/api/contact", "/api/contact/prompt"): + h = server.Handler.__new__(server.Handler) + body = b'{"prompt": "shown"}' if path.endswith("prompt") else b'{"email": "me@example.com", "updates": true}' + h.path, h.rfile = path, io.BytesIO(body) + h.headers = {"Content-Length": str(len(body)), "X-Frame-Device": "a-headset-switched-away-from"} + h.local_request = lambda: True + h.send_json = lambda obj, status=200: seen.append((status, server._work[0])) + with mock.patch.object(fc, "_send_pending", side_effect=lambda block=True: seen.append(("send", server._work[0]))): + h.do_POST() + self.assertEqual(seen, [("send", 0), (200, 0), (200, 0)]) + + +# Run these once, in test_telemetry, not again through the import above. +del Base, ReportProblem + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_control_center.py b/tests/test_control_center.py new file mode 100644 index 0000000..5fdf433 --- /dev/null +++ b/tests/test_control_center.py @@ -0,0 +1,75 @@ +"""Control Center API guards and shared-page behavior, without a real headset.""" +import sandbox # noqa: F401 (first: isolates app state, SSH and telemetry) +import importlib.util +import json +from pathlib import Path +import shutil +import subprocess +import sys +import unittest +from unittest import mock + +ROOT = Path(__file__).resolve().parents[1] +sys.path.insert(0, str(ROOT / 'ui')) +import server +import frame_status + + +class AudioValidation(unittest.TestCase): + def test_invalid_values_do_not_touch_device_even_with_valid_mute(self): + invalid = [{}, {'level': None}, {'level': True}, {'level': '0.5'}, {'level': []}, + {'level': float('nan')}, {'level': float('inf')}, {'level': -1}, {'level': 2}, + {'muted': 'false'}, {'muted': 1}, {'muted': None}, {'action': 'mute'}, + {'level': -1, 'muted': True}, {'level': .5, 'muted': 'yes'}] + for body in invalid: + with self.subTest(body=body), mock.patch.object(server, 'ssh') as ssh: + with self.assertRaises(server.Failure) as raised: + server.set_volume(body) + self.assertEqual(raised.exception.status, 400) + ssh.assert_not_called() + + def test_supported_actions_use_wpctl_with_exact_values(self): + for body, commands in [({'level': 0}, ['wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.00']), + ({'level': 1}, ['wpctl set-volume @DEFAULT_AUDIO_SINK@ 1.00']), + ({'muted': False}, ['wpctl set-mute @DEFAULT_AUDIO_SINK@ 0']), + ({'level': .65, 'muted': True}, ['wpctl set-mute @DEFAULT_AUDIO_SINK@ 1', + 'wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.65'])]: + with self.subTest(body=body), mock.patch.object(server, 'ssh', return_value='') as ssh: + self.assertEqual(server.set_volume(body)['message'], 'Volume updated') + self.assertEqual([c.args[0] for c in ssh.call_args_list], commands) + + def test_device_error_propagates_without_claiming_success(self): + with mock.patch.object(server, 'ssh', side_effect=server.Failure('Headset offline')): + with self.assertRaisesRegex(server.Failure, 'Headset offline'): + server.set_volume({'level': .5}) + + +class Coverage(unittest.TestCase): + @unittest.skipUnless(shutil.which('node'), 'Node exercises production page JS') + def test_control_center_behavior(self): + result = subprocess.run(['node', '--test', str(ROOT / 'tests/control_center.cjs')], + capture_output=True, text=True) + self.assertEqual(result.returncode, 0, result.stdout + result.stderr) + + def test_shared_assets_ship_to_iphone_and_desktop(self): + spec = importlib.util.spec_from_file_location('frame_bundle_cc', ROOT / 'ios/scripts/make_frame_bundle.py') + bundle = importlib.util.module_from_spec(spec) + spec.loader.exec_module(bundle) + files = set(bundle.files()) + for name in ('control-center.js', 'control-center.css', 'artwork-settings.js'): + self.assertIn(ROOT / 'ui' / name, files) + config = json.loads((ROOT / 'app/package.json').read_text()) + ui = next(item for item in config['build']['extraResources'] if item['from'] == '../ui') + self.assertIn('*.js', ui['filter']) + self.assertIn('*.css', ui['filter']) + + def test_status_exposes_kernel_thermal_trips_without_guessing_thresholds(self): + # Run the real aggregator with every external probe stubbed. + names = ('read', 'process_names', 'performance', 'os_release', 'battery', 'power_source', + 'disk', 'memory', 'max_temp', 'wifi', 'ip_addr', 'volume', 'port_listening', 'games', 'flatpaks') + with mock.patch.multiple(frame_status, **{name: mock.DEFAULT for name in names}) as probes, \ + mock.patch.object(frame_status, 'thermal_alerts', return_value=[{'zone':'battery','tempC':45,'limitC':44}]): + probes['read'].return_value = '120 0' + probes['process_names'].return_value = set() + result = frame_status.status() + self.assertEqual(result['thermalAlerts'], [{'zone':'battery','tempC':45,'limitC':44}]) diff --git a/tests/test_devices.py b/tests/test_devices.py index dde3bea..1705dc5 100644 --- a/tests/test_devices.py +++ b/tests/test_devices.py @@ -17,6 +17,7 @@ ROOT = Path(__file__).resolve().parent.parent sys.path.insert(0, str(ROOT / "ui")) import frame_devices as fd # noqa: E402 +import frame_host # noqa: E402 CONFIG = """Host lxso1 HostName 192.168.1.109 @@ -263,6 +264,30 @@ class Pins(Base): self.assertFalse(fd.pinned("d1")) self.assertFalse(fd.forget_pin("d1")) + def test_a_trusted_key_replaces_the_saved_one_and_fingerprints_match_ssh_keygen(self): + key = self.dir / "hostkey" + frame_host.run_ssh(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", str(key)], capture_output=True, + stdin=subprocess.DEVNULL, check=True, timeout=20) + kind, blob = key.with_suffix(".pub").read_text().split()[:2] + want = frame_host.run_ssh(["ssh-keygen", "-l", "-E", "sha256", "-f", str(key.with_suffix(".pub"))], + capture_output=True, text=True, stdin=subprocess.DEVNULL, timeout=10).stdout.split()[1] + self.assertEqual(fd.fingerprint(blob), want) + self.assertIsNone(fd.fingerprint("not base64!")) + (self.ssh / "known_hosts").write_text(f"frame.local {KEY}\n") + fd.seed_pin("d1", ["frame.local"]) + old = fd.pinned_keys("d1") + fd.pin_key("d1", kind, blob) + self.assertEqual(fd.known_hosts("d1").read_text(), f"frame-control-d1 {kind} {blob}\n") # old key gone + self.assertEqual(fd.pinned_keys("d1"), [(kind, want)]) + self.assertNotEqual(old, fd.pinned_keys("d1")) + self.assertTrue(fd.pinned("d1")) + for bad in (("ssh-ed25519\nHost *", blob), ("ssh-ed25519", "AAAA AAAA"), ("evil", blob)): + with self.assertRaises(fd.DeviceError): + fd.pin_key("d1", *bad) + # Only plain entries for this headset's alias count. + self.assertIsNone(fd.key_entry(f"frame-control-d2 {kind} {blob}", "frame-control-d1")) + self.assertIsNone(fd.key_entry(f"# frame-control-d1 {kind} {blob}", "frame-control-d1")) + def test_each_headset_has_its_own_file(self): (self.ssh / "known_hosts").write_text(f"a.local {KEY}\nb.local {KEY}\n") fd.seed_pin("da", ["a.local"]) @@ -274,7 +299,8 @@ class Pins(Base): def test_hashed_and_non_default_port_entries(self): kh = self.ssh / "known_hosts" kh.write_text(f"[frame.local]:2222 {KEY}\n") - subprocess.run(["ssh-keygen", "-H", "-f", str(kh)], capture_output=True, check=True) + frame_host.run_ssh(["ssh-keygen", "-H", "-f", str(kh)], capture_output=True, + stdin=subprocess.DEVNULL, check=True, timeout=10) self.assertFalse(fd.seed_pin("d3", ["frame.local"])) # port 22: not that entry self.assertTrue(fd.seed_pin("d3", ["frame.local"], port=2222)) self.assertIn(f"frame-control-d3 {KEY}", fd.known_hosts("d3").read_text()) @@ -283,7 +309,8 @@ class Pins(Base): target = fd.known_hosts("d4") target.parent.mkdir(parents=True, exist_ok=True) target.write_text(f"frame-control-d4 {KEY}\n") - subprocess.run(["ssh-keygen", "-H", "-f", str(target)], capture_output=True, check=True) + frame_host.run_ssh(["ssh-keygen", "-H", "-f", str(target)], capture_output=True, + stdin=subprocess.DEVNULL, check=True, timeout=10) self.assertNotIn("frame-control-d4", target.read_text()) self.assertTrue(fd.pinned("d4")) self.assertTrue(fd.forget_pin("d4")) diff --git a/tests/test_fdroid_sources.py b/tests/test_fdroid_sources.py index 4285721..6ec0b2b 100644 --- a/tests/test_fdroid_sources.py +++ b/tests/test_fdroid_sources.py @@ -1,4 +1,5 @@ """Offline authenticated repository fixtures; no tests contact a server.""" +import sandbox # noqa: F401 (first: keeps tests off real data and services) import io import json import os @@ -256,6 +257,36 @@ class Repositories(unittest.TestCase): self.assertEqual(result['icon'], URL + 'icons/legacy.1.png') self.assertEqual(result['images']['screenshots'], [URL + 'org.example.app/fr/sevenInchScreenshots/tablet.png']) + def test_per_abi_builds_offer_and_download_the_arm64_one(self): + import hashlib + + def build(code, name, abis): + self.files[name] = name.encode() + return {'manifest': {'versionName': '391', 'versionCode': code, 'usesSdk': {'minSdkVersion': 28}, + 'nativecode': abis}, + 'file': {'name': '/' + name, 'sha256': hashlib.sha256(name.encode()).hexdigest(), 'size': code}, + 'added': 0} + # One APK per ABI under different codes (the x86_64 one highest, as F-Droid often does), + # plus a universal and an arm64-only build sharing a code. + builds = [build(3911, 'app-armeabi-v7a.apk', ['armeabi-v7a']), build(3914, 'app-x86_64.apk', ['x86_64']), + build(3913, 'app-x86.apk', ['x86']), + build(3912, 'app-universal.apk', ['arm64-v8a', 'armeabi-v7a', 'x86_64']), + build(3912, 'app-arm64-v8a.apk', ['arm64-v8a'])] + raw = self.root / 'splits.json' + raw.write_text(json.dumps({'packages': {'com.futo.platformplayer': { + 'metadata': {'name': {'en-US': 'Grayjay'}}, + 'versions': {str(i): b for i, b in enumerate(builds)}}}})) + source = {'id': 'test', 'url': URL} + app = fdroid._reduce(raw, source)['com.futo.platformplayer'] + self.assertEqual([v['name'] for v in app['versions']], ['/app-arm64-v8a.apk', '/app-universal.apk']) + self.assertEqual((app['version_code'], app['abis']), (3912, ['arm64-v8a'])) + with patch.object(fdroid, 'details', return_value=app): + for code in (None, 3912): + fdroid.download(source, 'com.futo.platformplayer', version_code=code) + self.assertTrue(self.fetch_mock.call_args[0][0].endswith('/app-arm64-v8a.apk')) + with self.assertRaises(SourceError): # the x86_64 build is never offered + fdroid.download(source, 'com.futo.platformplayer', version_code=3914) + def test_v2_legacy_screenshot_keys_and_limit(self): meta = {'phoneScreenshots': {'fr': [{'name': '/phone/' + str(i) + '.png'} for i in range(8)]}, 'sevenInchScreenshots': {'en-US': [{'name': '/tablet.png'}]}} diff --git a/tests/test_frame_android_data.py b/tests/test_frame_android_data.py index 175762c..251e04b 100644 --- a/tests/test_frame_android_data.py +++ b/tests/test_frame_android_data.py @@ -1,3 +1,4 @@ +import sandbox # noqa: F401 (first: keeps tests off real data and services) import io import json import os @@ -63,7 +64,7 @@ class ObbTests(unittest.TestCase): with self.assertRaisesRegex(android.FrameError, 'start this app'): data.install_obb(PKG, [path]) stream.assert_not_called() - with patch.object(subprocess, 'run', return_value=subprocess.CompletedProcess([], 1, b'', b'bad hash')): + with patch.object(data.frame_host, 'run_ssh', return_value=subprocess.CompletedProcess([], 1, b'', b'bad hash')): with self.assertRaisesRegex(android.FrameError, 'bad hash'): data._stream('command') diff --git a/tests/test_frame_android_library.py b/tests/test_frame_android_library.py index cdf51c0..014696b 100644 --- a/tests/test_frame_android_library.py +++ b/tests/test_frame_android_library.py @@ -1,4 +1,5 @@ """Offline artwork, Steam API and launcher supervision regressions.""" +import sandbox # noqa: F401 (first: keeps tests off real data and services) import importlib.util import json import os @@ -263,11 +264,14 @@ class ArtworkTests(unittest.TestCase): def test_steamgriddb_uses_the_bounded_fetch_without_redirects(self): import frame_steamgriddb as sgdb from apk_sources import _images + deadline = time.monotonic() + 5 with patch.object(_images, 'get', return_value=b'{"success": true, "data": [1]}') as get: - self.assertEqual(sgdb._get('/search/x', 'secret', time.monotonic() + 5), [1]) + self.assertEqual(sgdb._get('/search/x', 'secret', deadline), [1]) self.assertEqual(get.call_args.kwargs['redirects'], 0) self.assertEqual(get.call_args.args[1]['Authorization'], 'Bearer secret') - self.assertLessEqual(get.call_args.kwargs['deadline'] - time.monotonic(), 5) + # The caller's deadline is passed on, never extended. (Comparing against a fresh + # time.monotonic() flaked on Windows, whose clock ticks coarsely.) + self.assertLessEqual(get.call_args.kwargs['deadline'], deadline) def test_supplied_jpeg(self): data = (FIXTURES / 'icon.jpg').read_bytes() @@ -419,6 +423,19 @@ class InstallTests(unittest.TestCase): self.assertIn(('remove', '3346865537'), [c.args for c in api.call_args_list]) self.assertTrue(any(c.args[0] == 'rm -rf Applications/Android/org.test.vr' for c in ssh.call_args_list)) + def test_failed_update_removes_partial_apk_and_keeps_the_app(self): + with patch.object(android.frame_artwork, 'prepare', return_value=(self.images, [])), \ + patch.object(android, 'read_meta', return_value=dict(self.existing)), \ + patch.object(android, '_copy', side_effect=android.FrameError('copying x.apk to the Frame timed out')), \ + patch.object(android, 'ssh', return_value='') as ssh, \ + patch.object(android, 'shortcut_tool') as api: + with self.assertRaisesRegex(android.FrameError, 'timed out'): + android._install('x.apk', self.info, 'org.test.vr', False, None, None) + commands = [c.args[0] for c in ssh.call_args_list] + self.assertIn('rm -f Applications/Android/org.test.vr/app.apk.part', commands) + self.assertFalse(any(c.startswith('rm -rf') for c in commands)) + api.assert_not_called() + def test_remove_keeps_data_when_requested_and_survives_steam_failure(self): with patch.object(android, '_meta_or_fail', side_effect=lambda pkg: dict(self.existing)), \ patch.object(android, 'stop'), \ @@ -482,6 +499,49 @@ class InstallTests(unittest.TestCase): self.assertIn('podman stop -t 5 lepton-steamlaunch-2800000001', ssh.call_args.args[0]) +class CopyAndSshTests(unittest.TestCase): + """The commands behind an install fail as FrameErrors with readable words, and a large APK + gets the time it needs.""" + + def fake(self, stderr, code=1, stdout=b''): + """frame_host.run_ssh running a stand-in that writes these bytes, with the caller's options.""" + script = (f'import sys; sys.stdout.buffer.write({stdout!r}); sys.stderr.buffer.write({stderr!r}); ' + f'sys.exit({code})') + return lambda argv, **kwargs: subprocess.run([sys.executable, '-c', script], **kwargs) + + def test_large_apk_copy_timeout_grows_with_its_size(self): + seen = {} + with tempfile.NamedTemporaryFile(suffix='.apk') as f, \ + patch.object(android.frame_host, 'run_ssh', side_effect=lambda argv, **kw: seen.update(kw)), \ + patch.object(android.os.path, 'getsize', return_value=2 * 1024 ** 3): + android._copy(f.name, 'Applications/Android/x/app.apk.part') + # 2 GB at the slowest rate allowed: 4096 s, not the old fixed 600 (300 MB at 4 Mbit/s). + self.assertGreaterEqual(seen['timeout'], 2 * 1024 ** 3 / (512 * 1024)) + with tempfile.NamedTemporaryFile(suffix='.apk') as f, \ + patch.object(android.frame_host, 'run_ssh', side_effect=lambda argv, **kw: seen.update(kw)): + android._copy(f.name, 'x/launch.sh', timeout=120) + self.assertEqual(seen['timeout'], 120) # a small file keeps the least time given + + def test_copy_failure_in_another_encoding_is_a_frame_error(self): + # A message from a Windows code page, or a file name, isn't UTF-8. + with tempfile.NamedTemporaryFile(suffix='.apk') as f, \ + patch.object(android.shutil, 'which', return_value=None), \ + patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'scp: Verbindung \x81ber\xff\n')): + with self.assertRaisesRegex(android.FrameError, r'\Acopying .* to the Frame failed: scp: Verbindung'): + android._copy(f.name, 'x/app.apk.part') + + def test_ssh_failure_messages_are_text(self): + with patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'mv: \xff cannot move\n')): + with self.assertRaisesRegex(android.FrameError, r'\Amv: .* cannot move\Z'): + android.ssh('mv a b') + with patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'cat: write error: No space left on device\n')): + with self.assertRaises(android.FrameError) as caught: + android.ssh('cat > x', input=b'\x89PNG') # bytes in, bytes out + self.assertEqual(str(caught.exception), 'cat: write error: No space left on device') + with patch.object(android.frame_host, 'run_ssh', side_effect=self.fake(b'', code=0, stdout=b'ok \xff\n')): + self.assertEqual(android.ssh('echo ok').strip(), 'ok �') + + class SteamAPITests(unittest.TestCase): def test_artwork_api_enums_and_safe_serialization(self): with patch.object(shortcuts, 'evaluate', return_value={'warnings': []}) as evaluate: diff --git a/tests/test_frame_apk.py b/tests/test_frame_apk.py index ebe7b0b..01d29c2 100644 --- a/tests/test_frame_apk.py +++ b/tests/test_frame_apk.py @@ -11,82 +11,7 @@ import zipfile sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'ui')) import frame_apk # noqa: E402 - - -def pool(strings, utf8=False): - """A ResStringPool chunk.""" - data, offsets = b'', [] - for s in strings: - offsets.append(len(data)) - if utf8: - b = s.encode() - data += bytes([len(s), len(b)]) + b + b'\0' - else: - data += struct.pack('. - - package_raw=False drops the package's raw string (as some repackers do); - foreign_label adds a non-android `label` attribute after android:label. - """ - strings = ['label', 'icon', 'versionName', 'minSdkVersion', 'package', 'manifest', 'uses-sdk', - 'application', package, 'junk', 'label', 'versionCode'] # the second 'label' has no android id - resmap = struct.pack('<4I', 0x01010001, 0x01010002, 0x0101021c, 0x0101020c) - resmap = struct.pack(' and you have + # requested strict checking." Every command said "yes" before anything was saved, so one + # that ran before the connector's handshake saved the key (or without it) failed. + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + r = self.command(d) + self.assertEqual(r.returncode, 0, r.stderr) # the first contact saves the key... + self.assertIn("Permanently added", r.stderr) + self.assertTrue(fd.pinned(d["id"])) + self.assertIn("StrictHostKeyChecking=yes", self.link.host_opts(d, "127.0.0.1")) # ...then it's checked + self.assertEqual(self.reg.get(d["id"])["identity"], [k[1] for k in fd.pinned_keys(d["id"])]) # and recorded + # The connector's first handshake, for another new headset. + self.reg.remove_device(d["id"]) + d = self.device("localhost") + self.link.connect(["start"]) + s = self.link.snapshot() + self.assertEqual(s["phase"], "connected", s["error"]) + self.assertTrue(fd.pinned(d["id"])) + self.assertTrue(self.reg.get(d["id"])["identity"]) + alias, opts = self.routes[-1] + self.assertIn("StrictHostKeyChecking=yes", opts) # every command after it checks strictly + self.assertNotIn("StrictHostKeyChecking=accept-new", opts) + + def lose_pin(self, device_id, how): + f = fd.known_hosts(device_id) + if how == "deleted": + f.unlink() + elif how == "empty": + f.write_text("") + elif how == "unreadable": + f.chmod(0) + self.addCleanup(lambda: f.exists() and f.chmod(0o600)) + elif how == "another alias": + f.write_text(f.read_text().replace(f"frame-control-{device_id}", "frame-control-someone-else")) + elif how == "not utf-8": + f.write_bytes(b"\xff\xfe" + f.read_bytes()) + + def test_a_lost_or_unusable_pin_fails_closed(self): + # Review pr85-review-r1: accept-new can't tell a new headset from one whose saved key + # went missing; real OpenSSH then trusted a replacement key. Once a headset had an + # identity, nothing is trusted again until the person checks it. + self.pins() + cases = ["deleted", "empty", "another alias", "not utf-8"] + if os.name == "posix" and os.geteuid() != 0: + cases.append("unreadable") # root reads anything + for n, how in enumerate(cases): + with self.subTest(how=how): + self.hosts({"localhost": "ok"}) + d = self.reg.add_device(f"frame-l{n}", port=self.port, hosts=[]) + self.reg.add_address(d["id"], "localhost", kind="lan") + self.link.override = None + self.reg.set_active(d["id"]) + self.link.connect(["switch"]) + self.assertEqual(self.link.snapshot()["phase"], "connected") + self.link.close_master() + d = self.reg.get(d["id"]) + self.lose_pin(d["id"], how) + self.hosts({"localhost": "wrong"}) # another device, or a reinstalled headset + r = self.command(d) + self.assertEqual(r.returncode, 255, r.stderr) + self.assertIn("Host key verification failed", r.stderr) + self.assertNotIn("Permanently added", r.stderr) + self.link.connect(["dropped"]) + s = self.link.snapshot() + self.assertEqual((s["phase"], s["error"]["stage"]), ("failed", "identity")) + self.assertEqual(s["error"]["hostkey"]["state"], "missing") + self.assertIn("missing or can't be read", s["error"]["message"]) + self.assertEqual(s["error"]["short"], "Saved SSH identity missing") + view = next(x for x in fl.devices_view(self.link)["devices"] if x["id"] == d["id"]) + self.assertTrue(view["identity_lost"]) + scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"] + self.assertFalse(scan["matches"] or scan["recorded_match"]) # not the key it had + self.hosts({"localhost": "ok"}) + scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"] + self.assertTrue(scan["recorded_match"]) # its own key, as recorded + self.assertFalse(scan["matches"]) # but not usable from the file: trusting restores it + fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"], + "fingerprint": scan["fingerprint"]}, None) + self.link.connect(["switch"]) + self.assertEqual(self.link.snapshot()["phase"], "connected", self.link.snapshot()["error"]) + self.link.close_master() + + def test_a_key_check_only_reads_the_key(self): + # Review pr85-review-r1: with ForwardAgent yes in ~/.ssh/config, a device that accepts + # "none" got the agent and ran a command before anyone trusted it. + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "evil"}) + os.environ["FAKESSH_CONFIG"] = json.dumps({"forwardagent": "yes", "remotecommand": "touch /tmp/x", + "permitlocalcommand": "yes", "requesttty": "force"}) + self.addCleanup(os.environ.pop, "FAKESSH_CONFIG", None) + for proxied in (False, True): + route = ("jump", "me@jumpy:2222") if proxied else (None, None) + with self.subTest(proxied=proxied), mock.patch.object(fl, "proxy_route", return_value=route): + t0 = time.monotonic() + scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"] + self.assertLess(time.monotonic() - t0, 10) # stopped once it had the key, not left open + self.assertTrue(scan["fingerprint"].startswith("SHA256:")) + self.assertEqual([p.name for p in self.dir.iterdir() if p.name.startswith("evil-")], []) + call = [c for c in self.calls() if "PreferredAuthentications=none" in c][-1] + self.assertEqual(call[call.index("-F") + 1], "none") # never ~/.ssh/config for the device + self.assertIn("-N", call) + hop = [c for c in call if c.startswith("ProxyCommand=")] + if proxied: + # Review pr85-review-r2: ProxyJump's own ssh inherits the config (ForwardAgent, + # LocalCommand); the scan builds the jump host's ssh itself, hardened. + self.assertEqual(len(hop), 1) + words = shlex.split(hop[0][len("ProxyCommand="):]) + self.assertEqual(words[-7:], ["-l", "me", "-p", "2222", "-W", "[%h]:%p", "jumpy"]) + for o in fl.Link.HOP_OPTS: + self.assertIn(o, words) + self.assertLess(call.index(hop[0]), call.index("HostKeyAlias=frame-control-" + d["id"])) + else: + self.assertEqual(hop, []) + for o in ("ForwardAgent=no", "IdentityAgent=none", "ClearAllForwardings=yes", "RemoteCommand=none", + "PermitLocalCommand=no", "RequestTTY=no", "PubkeyAuthentication=no"): + self.assertIn(o, call) + self.assertLess(call.index("StrictHostKeyChecking=accept-new"), call.index("HostKeyAlias=frame-control-" + + d["id"])) + self.assertFalse(fd.pinned(d["id"])) + self.assertEqual(sorted(p.name for p in fd.known_hosts(d["id"]).parent.iterdir()), []) # no scan files + + @unittest.skipIf(os.name != "posix", "the stand-in ssh runs ProxyCommand with /bin/sh") + def test_the_jump_hosts_command_line_is_quoted_whatever_the_names(self): + # Review pr85-review-r3: the hop's words went into the ProxyCommand line unquoted, so an + # ssh at /tmp/x/bin$(:>INJECTED)/ssh ran shell code; and an IPv6 jump host broke. + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + for n, name in enumerate(["with space", "bin$(touch INJECTED-0)", "back`touch INJECTED-1`tick", + "quote'it\"s", "per%cent %h %%", "semi;touch INJECTED-2"]): + with self.subTest(name=name): + bindir = self.dir / f"b{n}" / name + bindir.mkdir(parents=True) + (bindir / "ssh").symlink_to(FAKESSH / "ssh") + for spec, at in (("me@jumpy:2222", "jumpy"), ("[::1]:2200", "::1")): + before = len(self.calls()) + with mock.patch.dict(os.environ, {"PATH": f"{bindir}{os.pathsep}{os.environ['PATH']}"}), \ + mock.patch.object(fl, "proxy_route", return_value=("jump", spec)): + scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"] + self.assertTrue(scan["fingerprint"].startswith("SHA256:")) + hops = [c for c in self.calls()[before:] if "-W" in c] + self.assertEqual(len(hops), 1, self.calls()[before:]) + self.assertEqual(hops[0][-1], at) # the jump host, bare + self.assertEqual(hops[0][hops[0].index("-W") + 1], "[localhost]:%d" % self.port) + outer = [c for c in self.calls()[before:] if "PreferredAuthentications=none" in c][-1] + line = next(c for c in outer if c.startswith("ProxyCommand=")) + self.assertTrue(line[len("ProxyCommand="):].startswith(shlex.quote(str(bindir / "ssh") + .replace("%", "%%")))) + self.assertEqual([p.name for p in self.dir.rglob("INJECTED*")], []) + self.assertFalse(list(Path.cwd().glob("INJECTED*"))) + + def test_a_key_check_refuses_routes_it_cant_harden(self): + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + before = len(self.calls()) + for route in (("command", "nc %h %p"), ("jump", "a,b"), ("jump", "-oProxyCommand=x"), ("jump", "ssh://a"), + ("jump", "a b"), ("jump", "a%h"), ("jump", "jumpy:99999")): + with self.subTest(route=route), mock.patch.object(fl, "proxy_route", return_value=route): + with self.assertRaises(fd.DeviceError) as caught: + fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None) + self.assertIn("can't make safe", str(caught.exception)) + self.assertFalse(any("PreferredAuthentications=none" in c for c in self.calls()[before:])) + + def test_a_key_read_before_the_address_or_port_changed_isnt_trusted(self): + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + for change in ({"action": "update", "id": d["id"], "port": self.port + 1}, + {"action": "address-remove", "id": d["id"], "host": "localhost"}): + with self.subTest(change=change["action"]): + scan = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None)["scan"] + fl.devices_action(self.link, change, None) + with self.assertRaises(fd.DeviceError): + fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"], + "fingerprint": scan["fingerprint"]}, None) + self.assertFalse(fd.pinned(d["id"])) + self.reg.update_device(d["id"], port=self.port) + if not self.reg.get(d["id"])["addresses"]: + self.reg.add_address(d["id"], "localhost", kind="lan") + + def test_terminals_judge_identity_by_the_registry_not_a_frozen_route(self): + # Review pr85-review-r2: named_route used the device as routed (before its first key was + # recorded), so a Terminal window fell back to accept-new once the pin was deleted. + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + self.link.connect(["start"]) + self.assertEqual(self.link.snapshot()["phase"], "connected") + self.assertFalse(self.link.routed_device.get("identity")) # the frozen copy knows nothing of it + fd.known_hosts(d["id"]).unlink() + alias, opts = self.link.named_route() + self.assertIn("StrictHostKeyChecking=yes", opts) + self.assertNotIn("StrictHostKeyChecking=accept-new", opts) + self.hosts({"localhost": "wrong"}) + r = subprocess.run(["ssh", *opts, alias, "true"], capture_output=True, text=True, timeout=20) + self.assertEqual(r.returncode, 255, r.stderr) + self.assertFalse(fd.pinned(d["id"])) + + def test_a_key_saved_before_a_refused_login_is_kept_and_checked(self): + # Review pr85-review-r2: ssh saves the key during the key exchange; if the login is then + # refused, it was neither recorded nor protected, and the route stayed accept-new. + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "denied"}) + self.link.connect(["start"]) + s = self.link.snapshot() + self.assertEqual((s["phase"], s["error"]["stage"]), ("failed", "login")) + got = self.reg.get(d["id"]) + self.assertEqual(got["identity"], [f for _, f in fd.pinned_keys(d["id"])]) + self.assertTrue(got["identity_established"]) + if os.name == "posix": + self.assertEqual(fd.known_hosts(d["id"]).stat().st_mode & 0o777, 0o600) + self.assertIn("StrictHostKeyChecking=yes", self.routes[-1][1]) + fd.known_hosts(d["id"]).unlink() + self.hosts({"localhost": "wrong"}) + r = self.command(self.reg.get(d["id"])) + self.assertEqual(r.returncode, 255) + self.assertNotIn("Permanently added", r.stderr) + + def test_a_key_a_command_saved_tightens_the_route(self): + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "denied"}) + with self.link.route_lock: + self.link.routed_device = d + self.link.apply(d["alias"], self.link.host_opts(d, "127.0.0.1")) + opts = self.routes[-1][1] + self.assertIn("StrictHostKeyChecking=accept-new", opts) + r = subprocess.run(["ssh", *opts, d["alias"], "true"], capture_output=True, text=True, timeout=20) + self.assertIn("Permanently added", r.stderr) + self.assertEqual(r.returncode, 255) # saved the key, then refused the login + self.link.settle_pin() # what the connector's loop does every tick while accept-new is applied + self.assertIn("StrictHostKeyChecking=yes", self.routes[-1][1]) + self.assertNotIn("StrictHostKeyChecking=accept-new", self.routes[-1][1]) + self.assertTrue(self.reg.get(d["id"])["identity"]) + + def test_editing_the_address_that_worked_keeps_the_identity_history(self): + # Review pr85-review-r2: last_ok lives on the address, so editing or removing it made a + # headset whose pin was gone (and had no fingerprint recorded) new again. + path = self.dir / "legacy.json" + path.write_text(json.dumps({"version": 1, "active": "abcd1234", "networks": {}, "devices": [ + {"id": "abcd1234", "name": "Old", "alias": "frame-old", "user": "steamos", "port": 22, + "identity_files": [], "addresses": [{"host": "10.0.0.5", "kind": "lan", "label": "", + "networks": [], "last_ok": 1790000000.0, "last_rtt_ms": 3}]}]})) + reg = fd.Registry(path) + self.assertTrue(reg.get("abcd1234")["identity_established"]) # migrated from last_ok + reg.update_address("abcd1234", "10.0.0.5", new_host="10.0.0.6") + reg.remove_address("abcd1234", "10.0.0.6") + reg.add_address("abcd1234", "10.0.0.7") + d = fd.Registry(path).get("abcd1234") # saved, too + self.assertFalse(any(a.get("last_ok") for a in d["addresses"])) + self.assertTrue(fd.identity_established(d)) + self.assertEqual(self.link.strictness(d), "yes") + # A connection that works sets it as well, for a headset added since. + n = self.reg.add_device("frame-new", hosts=["10.0.0.8"]) + self.reg.record_success(n["id"], "10.0.0.8", None, 1) + self.reg.remove_address(n["id"], "10.0.0.8") + self.assertTrue(self.reg.get(n["id"])["identity_established"]) + + def test_ssh_last_words_arrive_even_when_the_reader_lags(self): + # Review pr85-review-r2: ssh's exit with nothing queued yet was taken as the end, and a + # late reader lost "Permission denied" ("ssh stopped"). + self.pins() + link = fl.Link(self.reg, env_alias=None, mux_base=["ssh", "-o", "BatchMode=yes"], control=None, + apply=lambda *a: None, explain=explain) + self.addCleanup(link.stop) + real = threading.Thread + + class Late(real): + def __init__(self, *a, target=None, **kw): + if target is not None and getattr(target, "__name__", "") == "tail": + inner = target + + def target(): + time.sleep(1) + inner() + super().__init__(*a, target=target, **kw) + self.device("localhost") + self.hosts({"localhost": "denied"}) + with mock.patch.object(fl.threading, "Thread", Late): + link.connect(["start"]) + s = link.snapshot() + self.assertEqual((s["error"]["stage"], s["error"].get("auth")), ("login", "denied"), s["error"]) + self.assertIn("SSH key", s["error"]["message"]) + + def test_forgetting_an_identity_is_refused(self): + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + self.link.connect(["start"]) + saved = fd.known_hosts(d["id"]).read_text() + with self.assertRaises(fd.DeviceError) as caught: + fl.devices_action(self.link, {"action": "forget-identity", "id": d["id"]}, None) + self.assertIn("identity-scan", str(caught.exception)) + self.assertEqual(fd.known_hosts(d["id"]).read_text(), saved) + + def test_without_a_shared_connection_ssh_writes_to_a_file_not_a_pipe(self): + # Windows: no ControlMaster, and its OpenSSH can block writing to a stderr pipe. + self.pins() + tmp = self.dir / "tmp" + tmp.mkdir() + link = fl.Link(self.reg, env_alias=None, mux_base=["ssh", "-o", "BatchMode=yes"], control=None, + apply=lambda *a: None, explain=explain) + self.addCleanup(link.stop) + real = subprocess.Popen + seen = [] + + def popen(argv, **kw): + if "-v" in argv: # the handshake (run_ssh calls go through Popen too) + seen.append(kw.get("stderr")) + return real(argv, **kw) + with mock.patch.object(tempfile, "tempdir", str(tmp)), mock.patch.object(fl.subprocess, "Popen", popen): + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + link.connect(["start"]) + s = link.snapshot() + self.assertEqual(s["phase"], "connected", s["error"]) + self.assertEqual([st["state"] for st in s["stages"]], ["done"] * 5) + self.assertIn("saved this headset's identity", next(st for st in s["stages"] if st["id"] == "identity")["detail"]) + self.reg.update_device(d["id"], user="nobody") + self.hosts({"localhost": "denied"}) + link.connect(["switch"]) + s = link.snapshot() + self.assertEqual((s["phase"], s["error"]["stage"], s["error"].get("auth")), ("failed", "login", "denied")) + self.assertTrue(seen and all(isinstance(x, int) for x in seen)) # a file descriptor, never PIPE + self.assertNotIn(subprocess.PIPE, seen) + for _ in range(50): # the reader removes its file once ssh has exited + if not list(tmp.iterdir()): + break + time.sleep(0.05) + self.assertEqual(list(tmp.iterdir()), []) + + def test_a_changed_key_is_shown_never_accepted_and_trusted_on_request(self): + # 0.4.2 on Linux and Windows: "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!", with + # "Run Set Up Connection again" as the advice, which can't replace the saved key. + self.pins() + d = self.device("localhost") + self.hosts({"localhost": "ok"}) + self.link.connect(["start"]) + self.assertEqual(self.link.snapshot()["phase"], "connected") + saved = fd.known_hosts(d["id"]).read_text() + old = fd.pinned_keys(d["id"]) + self.link.close_master() + self.hosts({"localhost": "wrong"}) # SteamOS reinstalled: a new host key + self.link.connect(["dropped"]) + s = self.link.snapshot() + self.assertEqual((s["phase"], s["error"]["stage"]), ("failed", "identity")) + shown = s["error"]["hostkey"] + self.assertEqual((shown["state"], shown["type"], shown["host"]), ("changed", "ssh-ed25519", "localhost")) + self.assertTrue(shown["fingerprint"].startswith("SHA256:")) + self.assertIn("Devices tab", s["error"]["message"]) + self.assertEqual(s["error"]["short"], "SSH identity changed") + self.assertEqual(fd.known_hosts(d["id"]).read_text(), saved) # never accepted on its own + r = self.command(d) + self.assertEqual(r.returncode, 255) + self.assertIn("REMOTE HOST IDENTIFICATION HAS CHANGED", r.stderr) # nor by any command + # Trusting needs the key read first, and exactly the fingerprint shown. + with self.assertRaises(fd.DeviceError): + fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"], + "fingerprint": shown["fingerprint"]}, None) + out = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None) + scan = out["scan"] + self.assertEqual(scan["fingerprint"], shown["fingerprint"]) + self.assertFalse(scan["matches"]) + self.assertEqual(scan["saved"], [{"type": t, "fingerprint": f} for t, f in old]) + self.assertEqual(fd.known_hosts(d["id"]).read_text(), saved) # reading it saves nothing + self.assertEqual(sorted(p.name for p in fd.known_hosts(d["id"]).parent.iterdir()), [d["id"]]) # no scan files + call = [c for c in self.calls() if "PreferredAuthentications=none" in c][-1] # no login offered + self.assertLess(call.index("StrictHostKeyChecking=accept-new"), call.index("StrictHostKeyChecking=yes")) + self.assertNotIn(f"UserKnownHostsFile={fd.known_hosts_opt(d['id'])}", + call[:call.index("StrictHostKeyChecking=yes")]) # a throwaway file, first + with self.assertRaises(fd.DeviceError): + fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"], "fingerprint": "SHA256:other"}, None) + self.link.scans[d["id"]]["at"] -= fl.SCAN_TTL + 1 + with self.assertRaises(fd.DeviceError): # shown too long ago + fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"], + "fingerprint": shown["fingerprint"]}, None) + fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None) + with mock.patch.object(self.link, "kick") as kick: + out = fl.devices_action(self.link, {"action": "identity-trust", "id": d["id"], + "fingerprint": shown["fingerprint"]}, None) + kick.assert_called_with("switch") + self.assertEqual(fd.pinned_keys(d["id"]), [("ssh-ed25519", shown["fingerprint"])]) # the old key is gone + self.assertEqual(next(x for x in out["devices"] if x["id"] == d["id"])["keys"], + [{"type": "ssh-ed25519", "fingerprint": shown["fingerprint"]}]) + self.link.connect(["switch"]) + self.assertEqual(self.link.snapshot()["phase"], "connected", self.link.snapshot()["error"]) + out = fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None) + self.assertTrue(out["scan"]["matches"]) + + def test_test_now_never_saves_a_key(self): + self.pins() + d = self.device("127.0.0.1") + self.hosts({"127.0.0.1": "ok"}) + self.link.test(d["id"]) + rows = self.link.snapshot()["tests"][d["id"]]["rows"] + self.assertEqual(rows[0]["ssh"], "unpinned") + self.assertFalse(fd.pinned(d["id"])) + + def test_reading_a_key_from_a_headset_that_doesnt_answer_says_why(self): + self.pins() + d = self.device("nothing.invalid") + with self.assertRaises(fd.DeviceError) as caught: + fl.devices_action(self.link, {"action": "identity-scan", "id": d["id"]}, None) + self.assertIn("Can't find the Frame", str(caught.exception)) + self.assertEqual([p.name for p in fd.known_hosts(d["id"]).parent.iterdir()], []) + def test_ssh_goes_to_the_ipv4_address_that_answered(self): self.device("localhost") self.hosts({"localhost": "ok"}) @@ -541,7 +981,7 @@ class Connecting(unittest.TestCase): {"action": "update", "id": d["id"], "port": 2222}, {"action": "address-remove", "id": d["id"], "host": "localhost"}, {"action": "address-update", "id": d["id"], "host": "localhost", "newHost": "127.0.0.1"}, - {"action": "forget-identity", "id": d["id"]}): + {"action": "identity-trust", "id": d["id"], "fingerprint": "SHA256:x"}): with self.assertRaises(fd.DeviceError, msg=body): fl.devices_action(self.link, body, open_setup=None, busy=lambda: 1) # Renaming, or changing another headset, is fine. @@ -640,6 +1080,260 @@ class Connecting(unittest.TestCase): (self.dir / "ssh" / "config").write_text("Host frame lab-*\n HostName 10.0.0.7\n") # someone's own `frame` self.assertEqual(fl.next_alias(self.link), "frame-2") + # ---- what a failure leaves for a problem report ---- + def stderr(self): + return quiet_log(self) + + def report(self): + import frame_report as fr + done = threading.Thread(target=lambda: None) + done.start() + done.join() + with mock.patch.object(fr, "link", self.link), \ + mock.patch.dict(fr._ssh, {"thread": done, "line": "SSH: system OpenSSH, OpenSSH 9.9p1, LibreSSL 3.3.6"}): + return fr.diagnostics() + + def test_each_failure_goes_to_the_server_log_scrubbed(self): + err = self.stderr() + self.device("steamdeck-jane.invalid", "localhost") + self.hosts({"localhost": "denied"}) + self.link.connect(["start"]) + line = err.getvalue() + self.assertIn("frame_link: login failed: The Frame didn't accept this computer's SSH key.", line) + self.assertIn("addresses: hostname unresolved; hostname->ipv4", line) + for leaked in ("steamdeck-jane", "127.0.0.1", "localhost"): + self.assertNotIn(leaked, line) + self.assertEqual(self.link.last_failure["stage"], "login") + + def test_reports_carry_a_connection_summary_in_fixed_words(self): + self.stderr() + self.device("steamdeck-jane.invalid", "frame-t.invalid") + (self.dir / "ssh" / "config").write_text( + f"{fd.begin_mark('frame-t')}\nHost frame-t\n HostName 192.168.1.50\n User steamos\n{fd.end_mark('frame-t')}\n" + "Host frame-t\n HostName 10.0.0.7\n") + self.link.connect(["start"]) + text = self.report() + self.assertIn("Connection: failed at find, attempt 1 (Starting up)", text) + self.assertIn("Headsets: 1 saved; active alias custom (saved, 2 address(es))", text) + self.assertIn("Error: find, frame_not_set_up", text) + self.assertRegex(text, r"Last failure: find, frame_not_set_up, 0 min \d+ s ago") + self.assertIn("Addresses tried: hostname unresolved; hostname unresolved", text) + self.assertIn("Network: gateway yes, Tailscale not installed", text) + self.assertIn("SSH: system OpenSSH, OpenSSH 9.9p1", text) + self.assertIn("~/.ssh/config: managed block for the active alias yes (1 managed in all); " + "hand-written Host for it yes", text) + # No free text from the error or ssh at all, and not the custom alias. + for leaked in ("steamdeck-jane", "Could not resolve", "Can't find", "192.168", "10.0.0.7", "steamos", + "frame-t", str(self.dir)): + self.assertNotIn(leaked, text) + + def test_a_failure_on_the_last_headset_leaves_nothing_of_it_after_switching(self): + self.stderr() + a = self.device("steamdeck-jane.invalid") + self.link.connect(["start"]) + b = self.reg.add_device("frame-2", port=self.port, hosts=[]) + self.reg.add_address(b["id"], "localhost", kind="lan") + self.hosts({"localhost": "ok"}) + self.reg.set_active(b["id"]) + self.link.connect(["switch"]) + self.assertEqual(self.link.snapshot()["phase"], "connected") + text = self.report() + self.assertIn("Connection: connected via hostname->ipv4", text) + self.assertRegex(text, r"Last failure: find, frame_not_set_up, ") + self.assertNotIn("steamdeck-jane", text) + self.assertNotEqual(a["id"], b["id"]) + + def test_the_headsets_alias_and_name_stay_out_of_the_log(self): + import frame_report as fr + err = self.stderr() + d = self.reg.add_device("jane-office.example.com", name="Jane Doe's work headset", hosts=[]) + self.reg.set_active(d["id"]) + self.link.connect(["start"]) + self.assertIn("find failed: The active headset has no addresses.", err.getvalue()) + # A message that names it anyway (any case) goes too, in the log and so in a report's log. + self.link.note_failure("ssh", "JANE-OFFICE.EXAMPLE.COM: jane doe's work headset stopped answering") + log = self.dir / "server.log" + log.write_text(err.getvalue()) + with mock.patch.dict(os.environ, {"FRAME_CONTROL_LOG": str(log)}): + with mock.patch.object(fr, "link", self.link), mock.patch.dict(fr._ssh, {"thread": None, "line": "SSH: x"}): + text = fr.diagnostics(include_logs=True) + self.assertIn("frame_link: ssh failed", text) + for leaked in ("jane", "Jane", "JANE"): + self.assertNotIn(leaked, err.getvalue()) + self.assertNotIn(leaked, text) + + +def quiet_log(test): + """Catch frame_link's log lines, starting with nothing remembered.""" + fl._logged.clear() + err = io.StringIO() + p = mock.patch.object(sys, "stderr", err) + p.start() + test.addCleanup(p.stop) + return err + + +class FailureLog(unittest.TestCase): + def test_the_same_failure_isnt_logged_every_retry(self): + err = quiet_log(self) + for _ in range(3): + fl.log_failure("find", "The Frame isn't answering.", "", [{"host": "frame.local", "state": "timeout"}]) + self.assertEqual(err.getvalue().count("frame_link:"), 1) + for v in fl._logged.values(): + v["at"] -= fl.LOG_REPEAT_EVERY + 1 + fl.log_failure("find", "The Frame isn't answering.", "", [{"host": "frame.local", "state": "timeout"}]) + self.assertIn("(and 2 more times)", err.getvalue()) + self.assertNotIn("frame.local", err.getvalue()) + + def test_interleaved_failures_are_throttled_too(self): + err = quiet_log(self) + for _ in range(4): + fl.log_failure("find", "The Frame isn't answering.") + fl.log_failure("login", "The Frame didn't accept this computer's SSH key.") + self.assertEqual(err.getvalue().count("frame_link:"), 2) + for i in range(fl.LOG_REMEMBER + 10): # many different failures: memory stays bounded + fl.log_failure("ssh", f"failure number {i}") + self.assertLessEqual(len(fl._logged), fl.LOG_REMEMBER) + + def test_hosts_ssh_names_go_known_or_not_and_whatever_the_case(self): + err = quiet_log(self) + fl.log_failure("ssh", "ssh stopped", "ssh: Could not resolve hostname bastion-jane: Name or service not known") + fl.log_failure("ssh", "ssh stopped", "channel 0: open failed: connect to host jane-office.example.com port 22") + fl.log_failure("ssh", "ssh stopped", "kex_exchange_identification: Connection reset by steamdeck-jane", + hosts=["STEAMDECK-JANE"]) + fl.log_failure("ssh", "Timed out talking to frame-jane", "") + out = err.getvalue() + self.assertIn("hostname ", out) + self.assertIn("connect to host port 22", out) + for leaked in ("bastion-jane", "jane-office", "steamdeck-jane", "frame-jane"): + self.assertNotIn(leaked, out) + + def test_headsets_named_like_sshs_words_dont_shield_the_real_host(self): + err = quiet_log(self) + for saved in ("host", "hostname", "to"): + fl.log_failure("ssh", "ssh stopped", "ssh: connect to host bastion-jane port 22: Connection refused", + hosts=[saved]) + fl.log_failure("ssh", "ssh stopped", "ssh: Could not resolve hostname jane-office.example.com: not known", + hosts=[saved]) + out = err.getvalue() + self.assertIn("connect to host port 22", out) + self.assertIn("hostname ", out) + for leaked in ("bastion-jane", "jane-office"): + self.assertNotIn(leaked, out) + self.assertEqual(fl.hide_hosts(" and frame", ["host", "frame"]), " and ") + + def test_whole_names_go_before_sshs_words_and_only_real_tokens_are_spared(self): + for name, said in (("Jane Doe's work headset", "Timed out talking to Jane Doe's work headset"), + ("Jane to Doe headset", "Jane to Doe headset stopped answering"), + ("", " stopped answering")): + out = fl.scrub_failure(said, [name]) + self.assertTrue(out.startswith("") or out == "Timed out talking to ", out) + for leaked in ("Jane", "Doe"): + self.assertNotIn(leaked, out) + self.assertEqual(fl.scrub_failure("Timed out talking to Jane Doe's work headset", ["Jane Doe's work headset"]), + "Timed out talking to ") + self.assertEqual(fl.hide_hosts("@: ", ["user", "host", "ip"]), "@: ") + + def test_windows_user_names_with_spaces_go_whole(self): + err = quiet_log(self) + with mock.patch.object(fl.frame_telemetry, "_user_names", return_value=set()): + fl.log_failure("ssh", r"Bad owner or permissions on C:\Users\Jane Doe/.ssh/config", "") + fl.log_failure("login", "The Frame didn't accept this computer's SSH key.", + "Jane Doe@frame: Permission denied (publickey).") + fl.log_failure("login", "refused", r"debug | ssh said: CORP\jane@frame's password: denied") + out = err.getvalue() + self.assertIn(r"C:\Users\/.ssh/config", out) + self.assertIn("@: Permission denied", out) + for leaked in ("Jane", "Doe", "jane", "CORP"): + self.assertNotIn(leaked, out) + + def test_whole_ssh_user_at_host_fields_and_home_folders_go(self): + import frame_telemetry as tm + with mock.patch.object(tm, "_user_names", return_value=set()): + self.assertEqual(tm.scrub(r"CORP\Jane Doe@jane-office.example.com: Permission denied (publickey)."), + "@: Permission denied (publickey).") + self.assertEqual(tm.scrub("jane@jane-office.example.com's password: "), "@'s password: ") + self.assertEqual(tm.scrub(r"Bad owner on C:\Users\O'Brien/.ssh/config"), r"Bad owner on C:\Users\/.ssh/config") + self.assertEqual(tm.scrub(r"c:\users\Zoë Smith.Jr\.ssh\config"), r"c:\users\\.ssh\config") + self.assertEqual(tm.scrub("/users/O'Brien/x and /HOME/jane doe/y"), "/users//x and /HOME//y") + self.assertEqual(tm.scrub("write to me@example.com today"), "write to today") + + +class ConnectionDiagnostics(unittest.TestCase): + def test_address_kinds_never_the_address(self): + self.assertEqual(fl.address_kind("frame.local", "fe80::1%eth0"), ".local->ipv6 link-local") + self.assertEqual(fl.address_kind("frame.local", "192.168.1.5"), ".local->ipv4") + self.assertEqual(fl.address_kind("frame.local"), ".local") + self.assertEqual(fl.address_kind("fe80::1%5"), "ipv6 link-local") + self.assertEqual(fl.address_kind("2001:db8::1"), "ipv6") + self.assertEqual(fl.address_kind("192.168.1.5", "192.168.1.5"), "ipv4") + self.assertEqual(fl.address_kind("100.101.102.103"), "tailscale") + self.assertEqual(fl.address_kind("frame.tail1234.ts.net", "100.101.102.103"), "tailscale") + self.assertEqual(fl.address_kind("steamdeck"), "hostname") + self.assertEqual(fl.probes_summary([{"host": "frame", "label": "from ~/.ssh/config", "state": "timeout"}]), + "alias hostname timeout") + + def test_hidden_hosts_leave_the_rest(self): + self.assertEqual(fl.hide_hosts("frame_link: Could not resolve hostname frame", ["frame"]), + "frame_link: Could not resolve hostname ") + self.assertEqual(fl.hide_hosts("ssh frame to frame.local", ["frame.local", "frame"], keep=("frame",)), + "ssh frame to ") + self.assertEqual(fl.hide_hosts("reset by SteamDeck", ["steamdeck"]), "reset by ") + self.assertEqual(fl.hide_operands("The headset took too long to answer."), "The headset took too long to answer.") + + def test_ssh_version_is_rebuilt_from_its_numbers(self): + import frame_report as fr + for said, want in (("OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2\n", "OpenSSH for Windows 9.5p1, LibreSSL 3.8.2"), + ("OpenSSH_9.9p1, LibreSSL 3.3.6\n", "OpenSSH 9.9p1, LibreSSL 3.3.6"), + ("OpenSSH_8.9p1 Ubuntu-3ubuntu0.10, OpenSSL 3.0.2 15 Mar 2022\n", "OpenSSH 8.9p1"), + ("OpenSSH_9.6p1, OpenSSL 3.0.13 30 Jan 2024\n", "OpenSSH 9.6p1, OpenSSL 3.0.13"), + ("OpenSSH_9.9p1-Jane-Doe-Laptop, LibreSSL 3.3.6\n", "unknown"), + ("OpenSSH_9.9p1, OpenSSL jane-laptop\n", "OpenSSH 9.9p1"), + (r"C:\Users\Jane\OpenSSH-portable\ssh.exe: not found", "unknown"), + ("", "unknown")): + with mock.patch.object(fr.frame_host, "run_ssh", return_value=subprocess.CompletedProcess([], 0, "", said)): + self.assertEqual(fr.ssh_version("ssh"), want, said) + + def test_only_the_default_alias_is_named(self): + import frame_report as fr + self.assertEqual(fr.alias_kind("frame"), 'default ("frame")') + self.assertEqual(fr.alias_kind("jane-office.example.com"), "custom") + + def test_a_slow_path_never_holds_up_a_report(self): + import frame_report as fr + release = threading.Event() + + def slow(): + release.wait(5) + return [] + with mock.patch.dict(fr._ssh, {"thread": None, "line": None}), mock.patch.object(fr, "_ssh_on_path", slow), \ + mock.patch.object(fr, "link", None), mock.patch.object(fr.shutil, "which", return_value="/usr/bin/ssh"), \ + mock.patch.object(fr.frame_host, "run_ssh", + return_value=subprocess.CompletedProcess([], 0, "", "OpenSSH_9.9p1, LibreSSL 3.3.6\n")): + t0 = time.monotonic() + self.assertIn("Connection: no connector", fr.diagnostics()) + self.assertIn("SSH: still being checked", fr.ssh_line()) + self.assertLess(time.monotonic() - t0, 2) + thread = fr._ssh["thread"] + release.set() + thread.join(5) + self.assertTrue(fr._ssh["line"].startswith("SSH: ")) + self.assertNotEqual(fr.ssh_line(), "SSH: still being checked") + + def test_ssh_kinds(self): + import frame_report as fr + for path, kind in ((r"C:\WINDOWS\System32\OpenSSH\ssh.exe", "Windows OpenSSH (System32)"), + (r"C:\Program Files\OpenSSH\ssh.exe", "OpenSSH in Program Files"), + (r"C:\Program Files\Git\usr\bin\ssh.exe", "Git for Windows"), + ("/usr/bin/ssh", "system OpenSSH"), ("/opt/homebrew/bin/ssh", "Homebrew or /usr/local"), + ("/home/jane/bin/ssh", "other"), (None, "not found")): + self.assertEqual(fr.ssh_path_kind(path), kind) + + def test_no_connector_says_so(self): + import frame_report as fr + with mock.patch.object(fr, "link", None): + self.assertIn("Connection: no connector", fr.diagnostics()) + @unittest.skipIf(os.name == "nt", "the stand-in ssh is a POSIX script") class ServerConnection(unittest.TestCase): diff --git a/tests/test_link_ui.py b/tests/test_link_ui.py new file mode 100644 index 0000000..2ea9ba1 --- /dev/null +++ b/tests/test_link_ui.py @@ -0,0 +1,137 @@ +"""The connection pill, the offline banner and the Devices tab's selection: the page's own +functions from ui/index.html, run in Node against a minimal DOM (#87).""" +import sandbox # noqa: F401 (first: keeps tests off real data and services) +import pathlib +import re +import shutil +import subprocess +import unittest + +ROOT = pathlib.Path(__file__).resolve().parents[1] +PAGE = (ROOT / "ui/index.html").read_text(encoding="utf-8") + + +def between(start, end): + return PAGE[PAGE.index(start):PAGE.index(end)] + + +SETUP = r''' +const assert = require('node:assert/strict'); +const elements = new Map(); +const $ = id => { + if (!elements.has(id)) elements.set(id, {id, textContent: '', innerHTML: '', title: '', hidden: true, value: ''}); + return elements.get(id); +}; +const esc = s => String(s).replace(/[&<>"']/g, c => ({'&': '&', '<': '<', '>': '>', '"': '"', "'": '''}[c])); +const serverNow = () => 1000; +const activeStage = s => (s.stages || []).find(x => x.state === 'active'); +const ago = () => 'a minute ago'; +const openTrust = () => {}; +const window = {}; +let online = false; +const link = {live: true, s: null}; +const dv = {list: [], sel: null, data: null, found: 'x', editing: 'y'}; +let rendered = 0; +const renderDevices = () => { rendered++; }; +let refuse = false; +const act = async (label, fn) => refuse ? undefined : fn(); +const api = async () => ({ok: true}); +const STAGES = [{id: 'find', label: 'Finding the headset', state: 'done'}, + {id: 'identity', label: "Checking the headset's identity", state: 'failed'}]; +const changed = {phase: 'failed', retry_at: 1012, device: {id: 'd1', name: 'Office Frame'}, network: {name: 'Home'}, + stages: STAGES, probes: [{host: 'frame.local', detail: 'SSH identity changed'}], + error: {stage: 'identity', short: 'SSH identity changed', hostkey: {state: 'changed'}, + message: 'This address answered with a different SSH identity from the one saved for Office Frame. ' + + 'If not, a different device may be answering here.'}}; +''' + + +@unittest.skipUnless(shutil.which("node"), "Node runs the page's own functions") +class LinkUI(unittest.TestCase): + def run_page(self, checks): + code = (between("function netLabel(s) {", "function renderConnDlg() {") + + between("async function useDevice(id) {", "async function devAction(") + + between("function deviceStatus(d) {", "function renderDevices() {")) + script = SETUP + code + "\n(async () => {\n" + checks + "\n})().catch(e => { console.error(e); process.exitCode = 1; });" + r = subprocess.run(["node", "-e", script], capture_output=True, text=True) + self.assertEqual(r.returncode, 0, r.stderr) + + def test_the_pill_keeps_the_failure_detail_in_its_tooltip(self): + # The connection redesign keeps the state and retry countdown in the pill, + # with the full failure explanation in its tooltip and details dialog. + self.run_page(r''' + link.s = changed; + renderPill(); + assert.match($('conn').innerHTML, /Office Frame<\/b>Offline · retrying in 12 s<\/span>/); + assert.ok($('conn').title.includes(changed.error.message)); + // Without a short reason: the stage that failed. + link.s = {...changed, retry_at: null, error: {stage: 'identity', message: 'Something.'}}; + renderPill(); + assert.match($('conn').innerHTML, /Offline<\/span>/); + assert.ok($('conn').title.includes('Something.')); +''') + + def test_the_banner_never_doubles_a_full_stop(self): + # "…may be answering here.." and "…(Developer Mode must be on).." (#87). + self.run_page(r''' + link.s = changed; + renderBanner(); + assert.equal($('offDetail').textContent, 'Office Frame on Home. Tried frame.local: SSH identity changed. Trying again in 12 s.'); + link.s = {...changed, probes: [ + {host: 'frame.local', detail: "The Frame didn't accept this computer's SSH key. Set Up Connection pairs this computer with it again (Developer Mode must be on)."}, + {host: '100.64.0.2', detail: 'No answer'}]}; + renderBanner(); + const text = $('offDetail').textContent; + assert.ok(!/\.\./.test(text), text); + assert.ok(text.includes("frame.local: the Frame didn't accept"), text); + assert.ok(text.includes('must be on); 100.64.0.2: no answer. Trying'), text); + assert.equal(asClause('SSH identity changed.'), 'SSH identity changed'); // abbreviations keep their case + assert.equal(asClause('Answered in 3 ms'), 'answered in 3 ms'); +''') + + def test_the_devices_list_keeps_the_whole_message_within_reach(self): + self.run_page(r''' + link.s = changed; + const [dot, text, full] = deviceStatus({active: true, addresses: []}); + assert.equal(dot, 'off'); + assert.equal(text, 'SSH identity changed'); + assert.equal(full, changed.error.message); // the row's tooltip +''') + + def test_using_a_headset_selects_it(self): + # After "Use this headset" on Office Frame, the last headset's details stayed on show. + self.run_page(r''' + dv.list = [{id: 'd0', name: 'Living Room Frame', active: true}, {id: 'd1', name: 'Office Frame', active: false}]; + dv.sel = 'd0'; + await useDevice('d1'); + assert.equal(dv.sel, 'd1'); + assert.equal(dv.found, null); + assert.equal(dv.editing, null); + assert.equal(rendered, 1); + // Refused (an install is running): the selection stays, and the header shows the one in use. + dv.list = [{id: 'd0', name: 'Living Room Frame', active: true}, {id: 'd2', name: 'Spare', active: false}]; + dv.sel = 'd0'; refuse = true; + await useDevice('d2'); + assert.equal(dv.sel, 'd0'); + assert.equal($('devSel').value, 'd0'); +''') + + +class HeaderLayout(unittest.TestCase): + def test_the_devices_tab_explanation_wraps(self): + # It was cut to one line with no way to read the rest. + self.assertIn(".dev-problem .s { white-space: normal; }", PAGE) + self.assertEqual(len(re.findall(r' + +
+

Import from my Quest

+
+
Plug your Quest into this computer by USB, put it on, then Look for my Quest.
+ + + +
+
Copies games you own from your own Quest (developer mode on) to the Frame. A game with + OBB data takes two imports: the first installs it; start it from the Steam library, then import again to + copy its data in. Frame Control never starts the game itself. Games that + use Meta's licence check install with a warning: on the Frame that check can't reach Meta, so they may quit, + hang, or run without online features. Frame Control won't remove that check. How it works
+
+
+

My Meta library

Experimental + +
+
Off. Nothing is sent to Meta until you connect.
+

Experimental. This uses Meta's undocumented internal API with your own Meta + access token. It may stop working whenever Meta changes things, and using it may be against Meta's terms; your + account is your responsibility. It only lists and downloads games your account owns, installs them as they are, + and never removes a licence check.

+
+ + +
+ +
+
How to get your token. + Sign in with Meta (desktop app) opens Meta's login page in its own Frame Control window and takes the token + from there; it never reads your browser. + Frame Control checks it with Meta, then keeps it in a private file on this computer (never on the Frame, and + never in reports). Disconnect deletes it.
+
+ + + +
+
Install downloads the game from Meta and installs it like Import from my Quest; a game with OBB + data takes a second Install while it is open. Install and test also starts it, adds its data, watches it for + about 30 seconds and records whether it ran; Test again does just the test. Results go to the compatibility + reports, shared only if you share compatibility results. How it works
+

Android display

Lepton
@@ -1206,8 +1339,9 @@

Privacy & updates

+ Installs, opens, version, operating system, country (from the time zone setting, to see roughly where it's used), tabs used, and whether installs on the Frame + worked (with an error category, never the message). F-Droid package names only. Each headset's SteamOS + build, a one-way hash of its machine ID (to count headsets, not just installs), and how many you've set up. @@ -1215,6 +1349,17 @@ Error messages and where in Frame Control they happened, with your home folder, user name, addresses and keys removed.
+

Contact email (optional)

+
+ +
+ +
+
+
+
+
Sent privately to the Frame Control maintainer, never shared or published. + Updates are occasional release notices; follow-up questions are mainly about problem reports you send.
Show what's been sent
@@ -1344,9 +1489,12 @@ placeholder="e.g. Installing an APK stops at 'copying to the Frame'"> - + + + + Frame Control's version, your OS, the Frame's SteamOS build, and a connection summary in fixed words: how connecting went, the kinds of address tried, your ssh version and whether ~/.ssh/config has the headset's entry. No error text, no custom alias name, and never the addresses themselves.
Show exactly what's included
Loading…
@@ -1439,6 +1587,18 @@
+ +
+

Check the headset's new key

+
+
+ +
+ +
+
+
+ + diff --git a/ui/server.py b/ui/server.py index 7771b72..b321d46 100755 --- a/ui/server.py +++ b/ui/server.py @@ -45,16 +45,20 @@ import frame_agent # noqa: E402 import frame_assistant # noqa: E402 import frame_android # noqa: E402 from apk_sources import search as apk_search, SourceError # noqa: E402 +from apk_sources import fdroid as apk_fdroid # noqa: E402 import frame_apk_versions # noqa: E402 import frame_catalog # noqa: E402 import frame_devices # noqa: E402 import frame_steamgriddb import frame_comfort # noqa: E402 +import frame_contact # noqa: E402 import frame_host # noqa: E402 import frame_link # noqa: E402 import frame_macview # noqa: E402 import frame_media # noqa: E402 import frame_panels # noqa: E402 +import frame_quest # noqa: E402 +import frame_meta # noqa: E402 import frame_report # noqa: E402 import frame_store # noqa: E402 import frame_telemetry # noqa: E402 @@ -133,6 +137,7 @@ LINK = None # the connector (frame_link.Link); None on the Frame itself # install's clean-up) to the other headset. _work_lock = threading.Lock() _work = [0] +NOT_HEADSET_WORK = {"/api/devices", "/api/contact", "/api/contact/prompt", "/api/queue"} @contextlib.contextmanager @@ -208,9 +213,14 @@ UNREACHABLE = [ (re.compile(r"port \d+: Connection refused"), "The Frame refused the connection. Check Developer Mode is still on."), (re.compile(r"Permission denied \(publickey"), - "The Frame didn't accept this computer's SSH key. Run Set Up Connection again."), - (re.compile(r"Host key verification failed"), - "The Frame's SSH identity changed (after a reinstall, or a different device). Run Set Up Connection again."), + "The Frame didn't accept this computer's SSH key. Set Up Connection pairs this computer with it " + "again (Developer Mode must be on)."), + # Before "Host key verification failed", which ssh prints after each of these. + (re.compile(r"No \S+ host key is known for "), + "The Frame's SSH identity isn't saved yet. Reconnecting saves it; or check and trust it on the Devices tab."), + (re.compile(r"REMOTE HOST IDENTIFICATION HAS CHANGED|Host key verification failed"), + "The Frame's SSH identity has changed: after SteamOS was reinstalled or reset, or a different device " + "answering at its address. Check the new key on the Devices tab before trusting it."), (re.compile(r"kex_exchange_identification|Connection closed by .* port \d+|Connection reset by .* port \d+"), "The connection to the Frame dropped. Try again."), ] @@ -276,40 +286,120 @@ def backfill_art(apps=(), titles=()): return True -def start_job(label, work, progress=False): - """Run work() in the background. It returns a dict with a "message".""" +def _new_job_locked(label, **fields): now = time.time() - with _jobs_lock: - for j in [j for j, v in _jobs.items() if v["done"] and now - v["time"] > JOB_TTL]: - del _jobs[j] - job = secrets.token_hex(8) - _jobs[job] = {"label": label, "done": False, "error": None, "message": None, "result": None, "time": now} + for j in [j for j, v in _jobs.items() if v["done"] and now - v["time"] > JOB_TTL]: + del _jobs[j] + job = secrets.token_hex(8) + _jobs[job] = {"label": label, "done": False, "error": None, "message": None, "result": None, "time": now, **fields} + return job + +def _run_job(job, label, work, progress): def report(stage, percent=None): with _jobs_lock: _jobs[job].update(stage=stage, percent=percent) - def run(): - fields = {} - try: - result = work(report) if progress else work() - fields = {"message": result.get("message") or f"{label}: done", "result": result} - except (Failure, frame_android.FrameError) as e: - fields = {"error": unreachable(str(e)) or str(e)} - frame_telemetry.diagnostic(f"job {label.split()[0]}", e) - except SourceError as e: # already user-readable, and about a store, not the Frame - fields = {"error": str(e)} - except Exception as e: - fields = {"error": f"{type(e).__name__}: {e}"} - frame_telemetry.diagnostic(f"job {label.split()[0]}", e) - finally: - with _jobs_lock: - _jobs[job].update(fields, done=True, time=time.time()) + fields = {} + try: + result = work(report) if progress else work() + fields = {"message": result.get("message") or f"{label}: done", "result": result} + except (Failure, frame_android.FrameError) as e: + fields = {"error": unreachable(str(e)) or str(e)} + frame_telemetry.diagnostic(f"job {label.split()[0]}", e) + except SourceError as e: # already user-readable, and about a store, not the Frame + fields = {"error": str(e)} + except Exception as e: + fields = {"error": f"{type(e).__name__}: {e}"} + frame_telemetry.diagnostic(f"job {label.split()[0]}", e) + finally: + with _jobs_lock: + _jobs[job].update(fields, done=True, time=time.time()) - busy_thread(run).start() + +def start_job(label, work, progress=False): + """Run work() in the background. It returns a dict with a "message".""" + with _jobs_lock: + job = _new_job_locked(label) + busy_thread(_run_job, job, label, work, progress).start() return {"message": f"{label}…", "job": job} +# ---- The install queue: Android games and apps, one after another ---------- +# +# Installs from the Android store, Import from my Quest and My Meta library each copy +# a game into a Lepton instance, and each refuses to start while another is running. +# Queued, the page can line up several: one worker runs them in order, each as a +# normal job (/api/job) that reads "queued" until its turn. A queued install can be +# removed until it starts; each runs on the headset it was queued for, or not at all. + +_queue = [] # [job, label, work, progress, headset id], in order; the running one is not here +_queue_state = {"worker": False, "running": None} + + +def _restage_locked(): + ahead = 1 if _queue_state["running"] else 0 + for i, (job, *_) in enumerate(_queue): + n = ahead + i + _jobs[job]["stage"] = f"Queued: {n} install{'' if n == 1 else 's'} before it" if n else "Queued: next" + + +def queue_job(label, work, progress=False): + """Like start_job, but runs after every install queued before it.""" + device = LINK.active_device()["id"] if LINK else None + with _jobs_lock: + job = _new_job_locked(label, queued=True, stage=None, percent=None) + _queue.append([job, label, work, progress, device]) + _restage_locked() + ahead = len(_queue) - 1 + (1 if _queue_state["running"] else 0) + start, _queue_state["worker"] = not _queue_state["worker"], True + if start: + threading.Thread(target=_drain_queue, daemon=True).start() + return {"message": f"{label}: queued, {ahead} before it" if ahead else f"{label}…", "job": job, "queued": ahead} + + +def _drain_queue(): + while True: + with _jobs_lock: + if not _queue: + _queue_state.update(worker=False, running=None) + return + job, label, work, progress, device = _queue.pop(0) + _queue_state["running"] = job + _jobs[job].update(queued=False, stage=None) + _restage_locked() + + def guarded(*report, work=work, device=device): + with working(device): # refused if the app switched headsets since it was queued + return work(*report) + _run_job(job, label, guarded, progress) + + +def install_queue(): + """The running install and those waiting, in order.""" + with _jobs_lock: + ids = ([_queue_state["running"]] if _queue_state["running"] else []) + [q[0] for q in _queue] + return {"jobs": [{"job": j, "label": _jobs[j]["label"], "queued": bool(_jobs[j].get("queued")), + "stage": _jobs[j].get("stage"), "percent": _jobs[j].get("percent")} + for j in ids if j in _jobs]} + + +def queue_action(body): + """{"action": "remove", "job"}: take a waiting install out of the queue.""" + if body.get("action") != "remove": + raise Failure("unknown action", 400) + job = body.get("job") + with _jobs_lock: + for i, q in enumerate(_queue): + if q[0] == job: + del _queue[i] + _jobs[job].update(done=True, queued=False, cancelled=True, stage=None, time=time.time(), + error="Removed from the install queue") + _restage_locked() + return {"message": f"Removed {_jobs[job]['label']} from the install queue"} + raise Failure("that install isn't waiting in the queue (it may have started or finished)", 409) + + def job_status(query): with _jobs_lock: job = _jobs.get((parse_qs(query).get("id") or [""])[0]) @@ -332,20 +422,51 @@ def ssh(remote, *, stdin=None, timeout=30, text=True): # Never let ssh inherit our stdin: under the app it's the pipe held open for # --exit-on-eof, and Windows' ssh.exe waits on it forever. feed = {"input": stdin} if stdin is not None else {"stdin": subprocess.DEVNULL} - r = subprocess.run([*SSH, FRAME, remote], capture_output=True, **feed, - text=text, errors="replace" if text else None, timeout=timeout) + r = frame_host.run_ssh([*SSH, FRAME, remote], capture_output=True, **feed, + text=text, errors="replace" if text else None, timeout=timeout) except subprocess.TimeoutExpired: - raise Failure(f"Timed out talking to {FRAME}") + raise frame_host.link_failure(Failure(f"Timed out talking to {FRAME}")) if r.returncode != 0: err = (r.stderr or r.stdout) if text else (r.stderr or r.stdout).decode(errors="replace") + if r.returncode == 255 and repair_ssh_config(err): + return ssh(remote, stdin=stdin, timeout=timeout, text=text) if r.returncode == 255 and LINK and unreachable(err): LINK.lost(err, route_gen) # ssh itself failed: the connector reconnects failure = Failure(strip_ansi(err).strip() or f"ssh exited {r.returncode}") failure.stdout = r.stdout if text else r.stdout.decode(errors="replace") + # ssh never reached the Frame (see frame_telemetry.diagnostic): judged on ssh's stderr only, + # never on the command's output. + stderr = (r.stderr if text else (r.stderr or b"").decode(errors="replace")) or "" + if frame_host.ssh_link_failed(r.returncode, strip_ansi(stderr)): + frame_host.link_failure(failure) raise failure return r.stdout +_config_repaired = False + + +def repair_ssh_config(err): + """Windows' OpenSSH refused ~/.ssh/config for its ACL: give the file a private one, + once per run. -> True if it did, so the command is worth retrying.""" + global _config_repaired + if _config_repaired or not frame_host.WINDOWS or frame_host.BAD_PERMISSIONS not in err: + return False + # ssh doubles the backslashes: "C:\\Users\\me/.ssh/config" + named = re.sub(r"[\\/]+", "/", err.split(frame_host.BAD_PERMISSIONS, 1)[1].splitlines()[0].strip()) + config = frame_devices.ssh_config() + if not named.lower().endswith("/" + config.name.lower()): + return False # a key or another file: not ours to rewrite + _config_repaired = True + try: + if frame_devices.repair_permissions(config): + print(f"Gave {config} a private ACL: ssh refused it ({named})", file=sys.stderr) + return True + except OSError as e: + print(f"Couldn't repair {config}'s permissions: {e}", file=sys.stderr) + return False + + def strip_ansi(s): return re.sub(r"\x1b\[[0-9;?]*[A-Za-z]|\r", "", s) @@ -364,11 +485,38 @@ def status(_body): s = json.loads(ssh("python3 -", stdin=(HERE / "frame_status.py").read_text(), timeout=20)) osr = s.get("os") if isinstance(s, dict) else None if isinstance(osr, dict): - frame_telemetry.frame_seen(osr.get("build"), osr.get("version")) + # The headset's hash is for usage statistics only; the page and MCP clients don't get it. + frame_telemetry.frame_seen(osr.get("build"), osr.get("version"), osr.pop("headset", None), + len(LINK.reg.devices()) if LINK else None) frame_report.frame.update(build=osr.get("build"), version=osr.get("version")) return s +COMFORT_FILES = ("frame_comfort.py", "frame_status.py", "frame_steam.py") +COMFORT_MISSING = {"comfort": "missing"} # what COMFORT_RUN prints when the cached copy isn't complete +# Runs frame_comfort.py from ~/.cache/frame-control/comfort/, first writing any of +# `files` that aren't there (none: just check they all are). Private, and each file written +# whole or not at all, so a copy cut short is finished by the next call. +COMFORT_RUN = """import json, os, pathlib, subprocess, sys +os.umask(0o077) +files = %r +root = pathlib.Path.home() / '.cache/frame-control/comfort' / %r +if files: + root.mkdir(parents=True, exist_ok=True) +for name, source in files.items(): + path = root / name + if not path.exists(): + tmp = root / (name + '.' + str(os.getpid())) + tmp.write_text(source) + tmp.replace(path) +if not all((root / name).is_file() for name in %r): + print('{"comfort": "missing"}') + sys.exit() +r = subprocess.run([sys.executable, str(root / 'frame_comfort.py'), %r], capture_output=True, text=True) +print(r.stdout, end='') +""" + + def comfort(body): try: frame_comfort.validate(body) @@ -376,25 +524,14 @@ def comfort(body): raise Failure(str(e), 400) # Content-addressed, user-only helper bundle. Desktop and phone use the same # on-headset state/lock; no listener, service registration or third-party app. - import hashlib - files = {name: (HERE / name).read_text() for name in - ("frame_comfort.py", "frame_status.py", "frame_steam.py")} + # The page polls this every few seconds, so run the copy already on the headset and + # send the sources only when that version isn't there yet. + files = {name: (HERE / name).read_text() for name in COMFORT_FILES} version = hashlib.sha256(json.dumps(files, sort_keys=True).encode()).hexdigest()[:16] - script = """import json, os, pathlib, subprocess, sys -os.umask(0o077) -files = %r -root = pathlib.Path.home() / '.cache/frame-control/comfort' / %r -root.mkdir(parents=True, exist_ok=True) -for name, source in files.items(): - path = root / name - if not path.exists(): - tmp = root / (name + '.' + str(os.getpid())) - tmp.write_text(source) - tmp.replace(path) -r = subprocess.run([sys.executable, str(root / 'frame_comfort.py'), %r], capture_output=True, text=True) -print(r.stdout, end='') -""" % (files, version, json.dumps(body)) - out = json.loads(ssh("python3 -", stdin=script, timeout=65)) + out = json.loads(ssh("python3 -", stdin=COMFORT_RUN % ({}, version, COMFORT_FILES, json.dumps(body)), timeout=65)) + if out == COMFORT_MISSING: + out = json.loads(ssh("python3 -", stdin=COMFORT_RUN % (files, version, COMFORT_FILES, json.dumps(body)), + timeout=65)) if out.get("error") and "active" not in out: raise Failure(out["error"], 409) return out @@ -503,8 +640,8 @@ def save_shots(body): incoming = Path(tempfile.mkdtemp(prefix=".incoming-", dir=SHOTS_DIR)) try: try: - r = subprocess.run(["scp", "-p", *SSH[1:], *(f"{FRAME}:{p}" for p in todo), str(incoming)], - capture_output=True, stdin=subprocess.DEVNULL, text=True, timeout=300) + r = frame_host.run_ssh(["scp", "-p", *SSH[1:], *(f"{FRAME}:{p}" for p in todo), str(incoming)], + capture_output=True, stdin=subprocess.DEVNULL, text=True, timeout=300) except subprocess.TimeoutExpired: raise Failure("Copying screenshots timed out") if r.returncode != 0: @@ -644,9 +781,14 @@ def set_volume(body): # Validate everything before touching the headset. level = None if "level" in body: - level = float(body["level"]) - if not 0 <= level <= 1: + value = body["level"] + if type(value) not in (int, float) or not 0 <= value <= 1: raise Failure("level must be 0..1", 400) + level = float(value) + if not body or set(body) - {"level", "muted"}: + raise Failure("Provide level or muted", 400) + if "muted" in body and type(body["muted"]) is not bool: + raise Failure("muted must be true or false", 400) if "muted" in body: ssh(f"wpctl set-mute @DEFAULT_AUDIO_SINK@ {1 if body['muted'] else 0}") if level is not None: @@ -663,7 +805,7 @@ PASTE = r"""set -u text=$(cat; printf x); text=${text%x} pid=$(pgrep -u "$(id -u)" -x plasmashell | head -n 1) if [ -z "$pid" ]; then - echo "plasmashell is not running: open the desktop in the headset first." >&2 + echo "The headset's desktop isn't open (plasmashell is not running). Open the desktop in the headset, then try again." >&2 exit 2 fi bus=$(tr '\0' '\n' < "/proc/$pid/environ" | sed -n 's/^DBUS_SESSION_BUS_ADDRESS=//p') @@ -675,6 +817,7 @@ else exit 2 fi """ +DESKTOP_CLOSED = "plasmashell is not running" # what PASTE says when the headset's desktop isn't open # base64 keeps the script intact through every local shell's quoting rules. PASTE_CMD = 'bash -c "$(echo %s | base64 -d)"' % base64.b64encode(PASTE.encode()).decode() @@ -691,7 +834,13 @@ def clipboard(body): text = body.get("text") if not isinstance(text, str) or not text: raise Failure("nothing to send", 400) - return {"message": ssh(PASTE_CMD, stdin=text, timeout=30).strip()} + try: + return {"message": ssh(PASTE_CMD, stdin=text, timeout=30).strip()} + except Failure as e: + if DESKTOP_CLOSED in str(e): + # The headset's state, for the person to change, not a fault: a 409 isn't reported as one. + raise Failure(str(e), 409) from None + raise # ---- keyboard and pointer (KDE Connect on the Frame, see frame_input_agent.py) ---- @@ -1192,6 +1341,14 @@ def open_thing(body): SHOTS_DIR.mkdir(parents=True, exist_ok=True) frame_host.open_path(SHOTS_DIR) return {"message": f"Opened {SHOTS_DIR} in {frame_host.FILE_MANAGER}"} + if what == "shot": + saved = SHOTS_DIR / shot_path(body.get("id")).rsplit("/", 1)[-1] + if not saved.exists(): + raise Failure("That screenshot isn't saved on this computer yet", 404) + frame_host.reveal_path(saved) + return {"message": f"Showed {saved.name} in {frame_host.FILE_MANAGER}"} + except frame_host.Unreachable as e: + raise Failure(str(e), 400) # theirs to turn on; nothing failed here except frame_host.HostError as e: raise Failure(str(e), 500) raise Failure("unknown target", 400) @@ -1219,9 +1376,9 @@ def android(body): def work(): m = frame_apk_versions.install(pkg, url) if url else frame_catalog.install(pkg) - return {"message": f"Installed {m['label']}. It's in the Steam library; launching it opens its own panel.", - "app": m} - return start_job(f"Install {pkg}", work) + message = f"Installed {m['label']}. It's in the Steam library; launching it opens its own panel." + return {"message": f"{message} {frame_android.layer_note(m)}".strip(), "app": m} + return queue_job(f"Install {pkg}", work) if action == "refresh-art": if not pkg and not body.get("all"): raise Failure('choose a package or all apps', 400) @@ -1251,7 +1408,150 @@ def android(body): " and shared it" if frame_telemetry.enabled("compat") else " on this computer") return {"message": f"Saved your report for {name}{where}", "report": r} except frame_android.FrameError as e: - raise Failure(str(e)) + raise Failure(str(e)) from e # from e: keeps frame_host.link_failure's mark for diagnostics + raise Failure("unknown action", 400) + + +# ---- Import from my Quest (frame_quest.py, docs/quest-import.md) -------------- + +QUEST_ON_FRAME = "Import from my Quest runs on your computer, with the Quest plugged into it by USB." +QUEST_SERIAL = re.compile(r"^[A-Za-z0-9._:\[\]-]{1,128}$") + + +def quest_serial(value): + if value in (None, ""): + return None + if not isinstance(value, str) or not QUEST_SERIAL.match(value): + raise Failure("invalid Quest serial", 400) + return value + + +def quest_status(query): + """The Quest on this computer's USB (or what to do), and the apps on it.""" + if LOCAL: + return {"quest": None, "devices": [], "guidance": QUEST_ON_FRAME, "apps": []} + try: + return frame_quest.status(quest_serial((parse_qs(query).get("serial") or [None])[0])) + except frame_android.FrameError as e: + raise Failure(str(e)) from e + + +def quest(body): + """{"action": "import", "package", "serial"?, "data"?}: a background job with progress.""" + if LOCAL: + raise Failure(QUEST_ON_FRAME, 400) + if body.get("action") != "import": + raise Failure("unknown action", 400) + pkg = str(body.get("package", "")) + if not frame_android.PKG_RE.match(pkg): + raise Failure("invalid Android package id", 400) + serial, data, older = quest_serial(body.get("serial")), body.get("data", False), body.get("allowDowngrade", False) + if type(data) is not bool or type(older) is not bool: + raise Failure("data and allowDowngrade must be true or false", 400) + ensure_master() + return queue_job(f"Import {pkg} from Quest", + lambda report: frame_quest.import_game(pkg, serial, data=data, progress=report, + allow_downgrade=older), progress=True) + + +# ---- My Meta library, Experimental (frame_meta.py, docs/meta-library.md) ------ +# +# Never echoes the token: answers come from frame_meta.status() and _public(), and every +# error passes through frame_meta.redact(). + +META_APP_ID = re.compile(r"^[0-9]{1,25}$") + + +def _meta_failure(e): + if isinstance(e, frame_meta.SignInCancelled): + return Failure(frame_meta.redact(e, 600), 409) + status = 400 if isinstance(e, frame_meta.TokenRejected) or "token" in str(e).lower() else 502 + return Failure(frame_meta.redact(e, 600), status) + + +def meta_sharing(): + """Whether test results reach the shared compatibility database (Privacy settings).""" + blocked = frame_telemetry.blocked() + return {"shared": bool(frame_catalog.compat_db.shared() or frame_telemetry.enabled("compat")), + "blocked": blocked or None} + + +def meta_status(query): + """The connected account (never its token) and, with library=1, the Quest games it owns + with any community verdicts.""" + q = parse_qs(query) + out = dict(frame_meta.status(), sharing=meta_sharing()) + if out["connected"] and q.get("library") == ["1"]: + try: + apps = frame_meta.with_verdicts(frame_meta.library(refresh=q.get("refresh") == ["1"])) + out["apps"] = [frame_meta._public(a) for a in apps] + except frame_android.FrameError as e: + raise _meta_failure(e) from None + return out + + +def meta(body): + """{"action": "connect", "token", "acknowledged": true, "attempt"?} | {"action": "disconnect"} | + {"action": "cancel-signin", "attempt"} | + {"action": "install", "app", "test"?, "allowDowngrade"?} | {"action": "test", "package"}.""" + action = body.get("action") + try: + if action == "connect": + if body.get("acknowledged") is not True: + raise Failure("My Meta library is experimental: tick that you understand the warning first", 400) + if not isinstance(body.get("token"), str): + raise Failure("paste your Meta access token", 400) + attempt = body.get("attempt") + if attempt is not None and not (isinstance(attempt, str) and frame_meta.SIGNIN_ATTEMPT.fullmatch(attempt)): + raise Failure("invalid sign-in attempt id", 400) + return dict(frame_meta.connect(body["token"], attempt=attempt), sharing=meta_sharing(), + message="Connected your Meta account (Experimental)") + if action == "cancel-signin": + attempt = body.get("attempt") + if not (isinstance(attempt, str) and frame_meta.SIGNIN_ATTEMPT.fullmatch(attempt)): + raise Failure("invalid sign-in attempt id", 400) + return dict(frame_meta.cancel_signin(attempt), sharing=meta_sharing(), + message="Cancelled that Sign in with Meta; it won't be saved") + if action == "disconnect": + return dict(frame_meta.disconnect(), sharing=meta_sharing(), + message="Disconnected your Meta account; its token was deleted from this computer") + if action == "install": + app_id, test, older = str(body.get("app", "")), body.get("test", False), body.get("allowDowngrade", False) + if not META_APP_ID.match(app_id): + raise Failure("invalid Meta app id", 400) + if type(test) is not bool or type(older) is not bool: + raise Failure("test and allowDowngrade must be true or false", 400) + ensure_master() + + def work(report): + try: + return frame_meta.install(app_id, test=test, progress=report, allow_downgrade=older) + except frame_android.FrameError as e: + raise frame_meta.MetaError(frame_meta.redact(e, 1200)) from None + except Exception as e: # never let an unexpected error's text carry the token + raise frame_meta.MetaError(frame_meta.redact(f"{type(e).__name__}: {e}", 600)) from None + return queue_job(f"{'Install and test' if test else 'Install'} {app_id} from Meta", work, progress=True) + if action == "test": + pkg = str(body.get("package", "")) + if not frame_android.PKG_RE.match(pkg): + raise Failure("invalid Android package id", 400) + ensure_master() + + def test(): + # run_test's own errors are fixed texts; anything else could carry the game's + # log (an ssh error is its output), so it is never shown, not even redacted. + try: + return frame_meta.run_test(pkg) + except frame_meta.MetaError: + raise + except frame_android.FrameError: + raise frame_meta.MetaError(frame_meta.LOG_UNREADABLE) from None + except Exception as e: + raise frame_meta.MetaError(f"The test stopped unexpectedly ({type(e).__name__}); " + "try again.") from None + return start_job(f"Test {pkg}", test) + except frame_meta.MetaError as e: + raise _meta_failure(e) from None raise Failure("unknown action", 400) @@ -1268,8 +1568,12 @@ def apk_installed(info, meta, error, seconds): in_catalog = bool(pkg) and pkg in by_pkg # Package names only for catalogue apps, which are public; a private APK's name stays here. # No version: a local rebuild can share a catalogue app's package name but carry anything in its version. + # frame_android.install re-raises anything that isn't a FrameError, and whoever + # catches it (a job, a request) reports it with its traceback: once is enough. frame_telemetry.install_finished("apk", error is None, seconds, error, catalog=in_catalog, - package=pkg if in_catalog else None) + diagnose=error is None or isinstance(error, frame_android.FrameError), + package=pkg if in_catalog else None, + xr_layer_missing=True if (info or {}).get("xr_layer_missing") else None) if error is not None and pkg and frame_telemetry.categorize(error)[0] in APK_FAULTS: frame_catalog.add_report(pkg, info.get("version"), result="install_failed", notes=str(error)[:300], via="install", label=info.get("label")) @@ -1388,7 +1692,7 @@ def titles(body): try: m = getattr(frame_titles, action)(gid) except frame_android.FrameError as e: - raise Failure(str(e)) + raise Failure(str(e)) from e # from e: keeps frame_host.link_failure's mark for diagnostics return {"message": f"{'Launching' if action == 'launch' else 'Removed'} {m['id']}"} @@ -1808,8 +2112,12 @@ def _webinstall_run(plan, job): job["error"] = str(e) if isinstance(e, known) else f"{type(e).__name__}: {e}" job["phase"] = "error" # An APK that failed to install was counted by apk_installed. - if not isinstance(e, frame_webinstall.Cancelled) and not (stage == "install" and plan.get("kind") == "apk"): + apk_install = stage == "install" and plan.get("kind") == "apk" + if not isinstance(e, frame_webinstall.Cancelled) and not apk_install: frame_telemetry.install_finished("web", False, error=e, stage=stage, kind_detail=plan.get("kind")) + elif apk_install and not isinstance(e, known): + # Not a FrameError, so apk_installed left its diagnostic to whoever caught it: here. + frame_telemetry.diagnostic("web install", e) finally: with _web_lock: job.pop("_conn", None) @@ -1886,23 +2194,36 @@ def _pid_alive(pid): return True -def sweep_tmp(): - """Delete download and title staging folders left by a server killed mid-install. +def _tmp_places(): + """Where each kind of staging folder goes, and its name before the server's PID.""" + tmp = Path(tempfile.gettempdir()) + return [(tmp, WEB_TMP_PREFIX), (tmp, frame_titles.TMP_PREFIX), (tmp, frame_android.TMP_PREFIX), + (tmp, frame_agent.TMP_PREFIX), (frame_host.cache_dir("apk-sources"), apk_fdroid.TMP_PREFIX)] - Folders carry the server's PID, so only a dead server's are taken. + +def sweep_tmp(own=False): + """Delete staging folders (downloads, unzipped titles, patched APKs, staged files, + app-index downloads) left by a server that stopped mid-way. + + Folders carry the server's PID, so only a dead server's are taken; own=True (on + the way out, see main) takes this server's too. """ - for prefix in (WEB_TMP_PREFIX, frame_titles.TMP_PREFIX): - for d in Path(tempfile.gettempdir()).glob(f"{prefix}*"): - _sweep_one(prefix, d) + for folder, prefix in _tmp_places(): + try: + found = list(folder.glob(f"{prefix}*")) + except OSError: + continue + for d in found: + _sweep_one(prefix, d, own) -def _sweep_one(prefix, d): +def _sweep_one(prefix, d, own=False): m = re.fullmatch(re.escape(prefix) + r"(\d+)-.*", d.name) if not m: return pid = int(m[1]) try: - if pid != os.getpid() and not _pid_alive(pid) and d.is_dir(): + if (own if pid == os.getpid() else not _pid_alive(pid)) and d.is_dir(): shutil.rmtree(d, ignore_errors=True) except OSError: pass @@ -2103,7 +2424,7 @@ def source_install(body): raise SourceError('This source is disabled') except SourceError as e: raise Failure(str(e), 400) - return start_job('Install ' + entry, lambda report: apk_search.install(source, entry, version, report), progress=True) + return queue_job('Install ' + entry, lambda report: apk_search.install(source, entry, version, report), progress=True) def source_manage(body): @@ -2146,11 +2467,12 @@ POST = { "/api/agent/approval": agent_approval, "/api/assistant/chat": assistant_chat, "/api/input": remote_input, "/api/touch": remote_touch, "/api/settings/artwork": frame_steamgriddb.save_settings, - "/api/sources": source_manage, "/api/sources/install": source_install, "/api/android/display": android_display, "/api/android": android, "/api/titles": titles, "/api/launch": launch, "/api/steam": steam, "/api/volume": set_volume, "/api/clipboard": clipboard, + "/api/sources": source_manage, "/api/sources/install": source_install, "/api/android/display": android_display, "/api/android": android, "/api/quest": quest, "/api/meta": meta, "/api/queue": queue_action, "/api/titles": titles, "/api/launch": launch, "/api/steam": steam, "/api/volume": set_volume, "/api/clipboard": clipboard, "/api/flatpak": flatpak, "/api/open": open_thing, "/api/shots/save": save_shots, "/api/webinstall/check": webinstall_check, "/api/webinstall/start": webinstall_start, "/api/webinstall/cancel": webinstall_cancel, "/api/telemetry": frame_telemetry.update_settings, "/api/telemetry/event": frame_telemetry.page_event, + "/api/contact": frame_contact.save, "/api/contact/prompt": frame_contact.prompt, "/api/report/preview": report_preview, "/api/report": report_send, "/api/macview": macview_action, "/api/panels": panels_action, "/api/devices": lambda body: devices_post(body)} @@ -2204,6 +2526,10 @@ def connection_state(): # ---- HTTP ------------------------------------------------------------------ +# POST reads the page repeats on a timer, as (path, action). +POLLS = {("/api/comfort", "status")} + + def action_of(body): """The action a request asked for, for diagnostics: a short word, never user data.""" a = body.get("action") if isinstance(body, dict) else None @@ -2246,7 +2572,7 @@ def push_file(path, dest="Downloads/"): else: # Modern scp uses SFTP, so the remote path isn't parsed by a shell. cmd = ["scp", *SSH[1:], "-r", str(path), f"{FRAME}:{dest}"] - r = subprocess.run(cmd, capture_output=True, stdin=subprocess.DEVNULL, text=True, errors="replace", timeout=3600) + r = frame_host.run_ssh(cmd, capture_output=True, stdin=subprocess.DEVNULL, text=True, errors="replace", timeout=3600) except subprocess.TimeoutExpired: raise Failure(f"Copying {name} timed out") if r.returncode != 0: @@ -2254,6 +2580,11 @@ def push_file(path, dest="Downloads/"): return f"Sent {name} to ~/{dest}" +class ClientGone(Exception): + """The page went away (a reload, the app quitting) before its reply was written: + nobody to answer, and nothing went wrong here.""" + + class Handler(BaseHTTPRequestHandler): server_version = "FrameControl/1" timeout = 60 # per socket operation, so a stalled client can't hold a thread @@ -2286,8 +2617,11 @@ class Handler(BaseHTTPRequestHandler): # Nobody may frame the UI (clickjacking). self.send_header("X-Frame-Options", "DENY") self.send_header("Content-Security-Policy", "frame-ancestors 'none'") - self.end_headers() - self.wfile.write(data) + try: + self.end_headers() + self.wfile.write(data) + except ConnectionError as e: # Windows says ConnectionAbortedError, others BrokenPipeError + raise ClientGone() from e def send_json(self, obj, status=200): self.send_bytes(json.dumps(obj).encode(), "application/json", status) @@ -2310,6 +2644,10 @@ class Handler(BaseHTTPRequestHandler): self.send_json(frame_steamgriddb.settings()) elif path == "/artwork-settings.js": self.send_bytes((HERE / 'artwork-settings.js').read_bytes(), 'text/javascript; charset=utf-8') + elif path == "/control-center.js": + self.send_bytes((HERE / 'control-center.js').read_bytes(), 'text/javascript; charset=utf-8') + elif path == "/control-center.css": + self.send_bytes((HERE / 'control-center.css').read_bytes(), 'text/css; charset=utf-8') elif path == "/assistant": page = (HERE / "assistant.html").read_text().replace("__FRAME_KEY__", json.dumps(UI_KEY).replace("<", "\\u003c")) self.send_bytes(page.encode(), "text/html; charset=utf-8") @@ -2330,6 +2668,8 @@ class Handler(BaseHTTPRequestHandler): from apk_sources import _images try: self.send_bytes(*_images.image(path.rsplit("/", 1)[-1])) + except ClientGone: + raise except Exception: self.send_json({"error": "Artwork unavailable"}, 404) elif path == "/api/sources/details": @@ -2350,6 +2690,10 @@ class Handler(BaseHTTPRequestHandler): apps = frame_android.list_apps() backfill_art(apps=apps) self.send_json({"apps": apps}) + elif path == "/api/quest": + self.send_json(quest_status(url.query)) + elif path == "/api/meta": + self.send_json(meta_status(url.query)) elif path == "/api/titles": ensure_master() titles_list = frame_titles.list_titles() @@ -2367,6 +2711,8 @@ class Handler(BaseHTTPRequestHandler): self.send_json(_input.send([]) if parse_qs(url.query).get("start") == ["1"] else dict(_input.status)) elif path == "/api/job": self.send_json(job_status(url.query)) + elif path == "/api/queue": + self.send_json(install_queue()) elif path == "/api/android/displays": self.send_json(android_displays()) elif path == "/api/android/reports": @@ -2380,6 +2726,8 @@ class Handler(BaseHTTPRequestHandler): self.send_json(macview_state(parse_qs(url.query))) elif path == "/api/telemetry": self.send_json(frame_telemetry.state()) + elif path == "/api/contact": + self.send_json(frame_contact.state()) elif path == "/api/computer/state": self.send_json(json.loads(ssh("python3 -", stdin=(HERE / "frame_computer.py").read_text(), timeout=20))) elif path == "/api/status": @@ -2405,6 +2753,8 @@ class Handler(BaseHTTPRequestHandler): headers=[("X-Capture-Source", "gamescope")]) else: self.send_json({"error": "not found"}, 404) + except ClientGone: + raise except Failure as e: self.send_error_json(str(e), e.status, e.apk) except ValueError as e: @@ -2436,11 +2786,17 @@ class Handler(BaseHTTPRequestHandler): body = json.loads(self.rfile.read(length) or b"{}") if not isinstance(body, dict): raise Failure("request body must be a JSON object", 400) - with (contextlib.nullcontext() if path == "/api/devices" else working(meant)): + # Not headset work: switching headsets mustn't wait for (or refuse) these. + with (contextlib.nullcontext() if path in NOT_HEADSET_WORK else working(meant)): result = handler(body) self.send_json(result) + except ClientGone: + raise except Failure as e: - if e.status >= 500: + # A poll that couldn't reach the headset is the headset asleep or away, which the page + # already shows; like GET /api/status, not an error to report. + polled = (path, action_of(body)) in POLLS and frame_telemetry.link_failed(e) + if e.status >= 500 and not polled: frame_telemetry.diagnostic(f"POST {path} {action_of(body)}", e) self.send_error_json(str(e), e.status, e.apk) except (ValueError, TypeError) as e: @@ -2614,6 +2970,10 @@ class LoopbackServer(ThreadingHTTPServer): socketserver.TCPServer.server_bind(self) self.server_name, self.server_port = "127.0.0.1", self.server_address[1] + def handle_error(self, request, client_address): + if not isinstance(sys.exc_info()[1], ClientGone): + super().handle_error(request, client_address) + _ONE_SERVER = None @@ -2644,6 +3004,7 @@ def main(): sweep_tmp() threading.Thread(target=apk_search.warm, daemon=True).start() # big indexes download before the first search frame_telemetry.start() + frame_contact.start() global LINK, _ONE_SERVER if not LOCAL: if not PRIVATE: # a private server only uses the headsets (see one_server) @@ -2651,17 +3012,23 @@ def main(): LINK = frame_link.Link(frame_devices.Registry(), env_alias=FRAME if FRAME_FROM_ENV else None, mux_base=MUX_BASE, control=CONTROL, apply=route, explain=unreachable) LINK.work_lock, LINK.work = _work_lock, lambda: _work[0] + frame_report.link = LINK # its connection summary goes in every report's diagnostics + frame_report.start_ssh_check() # ...with which ssh this is, found once in the background LINK.start() if not frame_host.WINDOWS: signal.signal(signal.SIGTERM, lambda *_: (_ for _ in ()).throw(KeyboardInterrupt)) if args.exit_on_eof: def watch_stdin(): - sys.stdin.buffer.read() + # os.read, not sys.stdin.buffer.read: a buffered read holds stdin's lock, + # and if a signal stops the server first, Python aborts (SIGABRT) at exit + # when it can't take that lock back from this thread. + while os.read(0, 4096): + pass threading.Thread(target=httpd.shutdown, daemon=True).start() threading.Thread(target=watch_stdin, daemon=True).start() - # The real port, which --port 0 leaves to the system (the iPhone app reads it from here). - print(f"Frame Control on http://127.0.0.1:{httpd.server_address[1]} (alias: {FRAME}; Ctrl-C to stop)", flush=True) try: + # The real port, which --port 0 leaves to the system (the iPhone app reads it from here). + print(f"Frame Control on http://127.0.0.1:{httpd.server_address[1]} (alias: {FRAME}; Ctrl-C to stop)", flush=True) httpd.serve_forever() except KeyboardInterrupt: pass @@ -2679,6 +3046,22 @@ def main(): if proc.poll() is None: proc.terminate() _purge_titles(now=float("inf")) # unconfirmed title uploads + # Staging folders of work still running (a patched APK mid-copy, an index + # download): leaving below skips the cleanup their TemporaryDirectory would + # get at interpreter exit. sweep_tmp at the next start catches any missed. + sweep_tmp(own=True) + # Stopped as asked, and everything above is cleaned up. Leave now, without + # Python's interpreter teardown: daemon threads are still running (app index + # downloads, the stdin watcher, telemetry, the headset link, request handlers) + # and none can be stopped promptly. Tearing the interpreter down under them + # occasionally crashed the process (SIGSEGV, seen on Python 3.13 on Linux): + # OpenSSL's exit cleanup freed state those threads were using. That teardown + # also runs atexit handlers and weakref finalizers; nothing here registers + # atexit work, the only finalizers are TemporaryDirectory cleanups (swept + # above), and the OS frees the one-server lock with the process. + sys.stdout.flush() + sys.stderr.flush() + os._exit(0) if __name__ == "__main__":