yilsem/aiturk-hermes-ide
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

feat(aiturk): phone link for AITURK Mobil (1.0.0-beta.15)

Browse Source 
Settings gets a Phone link window: when enabled, the IDE main process runs a
small TLS proxy on the local network (self-signed certificate, pinned by its
fingerprint) in front of the loopback backend and pairs a phone by QR code
or an 8-character code. Each phone gets its own revocable token; the backend
session token never leaves the computer. The root page, terminal sockets and
secret or settings-changing endpoints are not reachable from a phone. The
old WebRTC pairing window is replaced.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8ppceaR5s6cvMnm7uGRnf
This commit is contained in:
yilsemandClaude Opus 5.5 committed 2026-10-04 06:02:02 +03:00
1 parent 25d8c18c10
commit 03d3803dfc
16 files changed
+3351 -275
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

apps/desktop/electron/mobile-host.mjs
+34 -146
View File
@@ -1,157 +1,45 @@
// "Telefon bağlantısı" window: a thin IPC shell around the controller built in
// electron/mobile-lan-proxy.ts (createMobileLink). The controller lives in the
// main process for the whole app run — closing this window only cancels a
// pairing in progress; paired phones stay connected.
import { join } from 'node:path'
import { hostname } from 'node:os'
import { BrowserWindow, ipcMain, safeStorage, shell } from 'electron'
import { MobileVault, LiveTokenIssuer } from './mobile-secrets.mjs'
import { DeliveryJournal, MobileGatewayClient } from './mobile-adapter.mjs'
import { AccountClient } from '../../mobile/src/transport.mjs'
import { normalizeFingerprint, parsePhoneIdentity, assertRemoteIdentity } from '../../mobile/src/peer-identity.mjs'
import { BrowserWindow, ipcMain } from 'electron'
export function createMobileWindow({ directory, assets, resolveBackend, show = true }) {
const vault = new MobileVault(join(directory, 'mobile'), safeStorage)
const journal = new DeliveryJournal(join(directory, 'mobile', 'deliveries'))
const issuer = new LiveTokenIssuer(vault)
const clients = new Map()
const window = new BrowserWindow({ width: 560, height: 800, show, title: 'AITURK Mobil bağlantısı',
const CODED = /^aiturk-mobile:[a-z_]+$/
export function createMobileWindow({ assets, link, show = true }) {
const window = new BrowserWindow({ width: 560, height: 800, show, title: 'AITURK · Telefon bağlantısı',
webPreferences: { preload: join(assets, 'mobile-preload.cjs'), contextIsolation: true,
nodeIntegration: false, sandbox: true, backgroundThrottling: false } })
nodeIntegration: false, sandbox: true } })
window.setMenu(null)
window.webContents.setWindowOpenHandler(() => ({ action: 'deny' }))
window.webContents.on('will-navigate', event => event.preventDefault())
const api = async () => new AccountClient(await vault.load())
const call = async (path, body, method) => (await api()).call(path, body, method)
const send = frame => { if (!window.isDestroyed()) window.webContents.send('aiturk-mobile-event', frame) }
const handler = async (event, action, params = {}) => {
if (event.sender !== window.webContents || event.senderFrame !== window.webContents.mainFrame) throw new Error('Geçersiz mobil pencere.')
if (action === 'setup') {
const secrets = await vault.load()
return { paired: Boolean(secrets.deviceId), hasAccount: Boolean(secrets.accountToken), hasGoogle: Boolean(secrets.googleKey),
deviceId: secrets.deviceId, localFingerprint: secrets.localFingerprint }
}
if (action === 'identity.save') {
const previous = await vault.load(), fingerprint = normalizeFingerprint(params.fingerprint)
if (!previous.deviceId || previous.deviceId !== params.deviceId ||
(previous.localFingerprint && previous.localFingerprint !== fingerprint))
throw new Error('Cihaz kimliği sessizce değiştirilemez. Yeniden eşleştirin.')
await vault.save({ ...previous, localFingerprint: fingerprint })
return { saved: true }
}
if (action === 'account.save') {
if (typeof params.token !== 'string' || params.token.length < 12 || params.token.length > 512) throw new Error('AITURK hesap anahtarı geçersiz.')
if (clients.size) throw new Error('Hesap değiştirmeden önce mobil bağlantıyı kapatın.')
const previous = await vault.load()
if (previous.accountToken && previous.accountToken !== params.token) throw new Error('Hesabı değiştirmek için önce mevcut cihazı iptal edin ve bağlantı penceresini yeniden açın.')
await vault.save({ ...previous, accountToken: params.token })
return { saved: true }
}
if (action === 'account.login.start') {
const previous = await vault.load()
if (previous.accountToken || clients.size) throw new Error('Kayıtlı hesap var. Önce mevcut cihazı iptal edin.')
const login = await new AccountClient({}).call('/v1/aiturk/mobile-auth/start', {})
if (!/^https:\/\/turkservis\.online\/account\/aiturk\/mobile-login\/[0-9a-f-]{36}$/.test(login.verificationUri)) throw new Error('Geçersiz giriş adresi.')
await vault.save({ ...previous, pendingLogin: login })
await shell.openExternal(login.verificationUri)
return { code: login.userCode }
}
if (action === 'account.login.check') {
const previous = await vault.load()
if (previous.accountToken || clients.size) throw new Error('Mevcut hesap veya bağlantı sessizce değiştirilemez.')
if (!previous.pendingLogin) throw new Error('Önce giriş başlatın.')
const result = await new AccountClient({ accountToken: previous.pendingLogin.deviceCode }).call('/v1/aiturk/mobile-auth/poll', {})
if (result.state !== 'approved') return { approved: false }
delete previous.pendingLogin
await vault.save({ ...previous, accountToken: result.accountToken })
return { approved: true }
}
if (action === 'account.logout') {
const previous = await vault.load(), token = previous.accountToken || previous.pendingLogin?.deviceCode
if (token?.startsWith('tsml_')) await new AccountClient({ accountToken: token }).call('/v1/aiturk/mobile-auth/logout', {})
for (const [id, entry] of clients) { entry.client.close(); send({ channelId: id, close: true }) }
clients.clear(); await vault.save({})
return { cleared: true }
}
if (action === 'desktop.pair') {
const result = await call('/v1/aiturk/pairings', { display_name: hostname(), platform: 'windows-x64' })
await vault.save({ ...await vault.load(), deviceId: result.device_id, deviceToken: result.device_token,
pairingId: result.pairing_id })
await shell.openExternal('https://turkservis.online' + result.verification_uri)
return { code: result.user_code, expiresAt: result.expires_at }
}
if (action === 'phone.approve') {
if (!/^[0-9a-f-]{36}$/.test(params.pairingId) || !/^[A-Z2-9]{8}$/.test(params.code)) throw new Error('Telefondaki eşleştirme bilgileri geçersiz.')
const identity = parsePhoneIdentity(params.identity, params.pairingId)
const previous = await vault.load(), existing = previous.phoneFingerprints?.[identity.deviceId]
if (existing && existing !== identity.fingerprint) throw new Error('Kayıtlı telefon kimliği değiştirilemez. Cihazı iptal edip yeniden eşleştirin.')
const result = await call(`/v1/aiturk/pairings/${params.pairingId}/approve`, { user_code: params.code })
if (result.device_id !== identity.deviceId || result.status !== 'approved') throw new Error('Onaylanan telefon kimlik belgesiyle eşleşmiyor; bağlantı açılmadı.')
const current = await vault.load()
if (current.deviceId !== previous.deviceId || current.accountToken !== previous.accountToken) throw new Error('Onay sırasında hesap değişti; yeniden eşleştirin.')
await vault.save({ ...current, phoneFingerprints: { ...current.phoneFingerprints, [identity.deviceId]: identity.fingerprint } })
return result
}
if (action === 'devices') return call('/v1/aiturk/mobile/devices')
if (action === 'invite.create') return call('/v1/aiturk/mobile/invites', {})
if (action === 'invite.check') return call('/v1/aiturk/mobile/invites')
if (action === 'device.revoke') {
if (!/^[0-9a-f-]{36}$/.test(params.deviceId) || !Number.isInteger(params.version)) throw new Error('Geçersiz cihaz.')
const result = await call(`/v1/aiturk/devices/${params.deviceId}/revoke`, { expected_version: params.version })
for (const [id, entry] of clients) if (entry.phoneId === params.deviceId || result.self_revoked) {
entry.client.close(); clients.delete(id); send({ channelId: id, close: true })
}
if (result.self_revoked) await vault.save({})
return result
}
if (action === 'inbox') {
const data = await call('/v1/aiturk/mobile/channels'), secrets = await vault.load()
return { ...data, channels: data.channels.map(offer => {
const fingerprint = secrets.phoneFingerprints?.[offer.phone_id]
assertRemoteIdentity(offer.sdp, fingerprint)
return { ...offer, trustedPhoneFingerprint: fingerprint }
}) }
}
if (action === 'ice') return call('/v1/aiturk/mobile/ice')
if (action === 'channel.answer') {
const inbox = await call('/v1/aiturk/mobile/channels')
const offer = inbox.channels.find(row => row.id === params.channelId)
if (!offer || clients.has(offer.id) || clients.size >= 4) throw new Error('Bağlantı isteği artık geçerli değil.')
assertRemoteIdentity(offer.sdp, (await vault.load()).phoneFingerprints?.[offer.phone_id])
const authorize = () => call(`/v1/aiturk/mobile/channels/${offer.id}/heartbeat`, {})
const client = new MobileGatewayClient(resolveBackend, frame => send({ channelId: offer.id, frame }),
{ deviceId: offer.phone_id, journal, authorize })
await call(`/v1/aiturk/mobile/channels/${offer.id}/answer`, { sdp: params.sdp })
clients.set(offer.id, { client, phoneId: offer.phone_id, authorize })
return { accepted: true }
}
if (action === 'channel.heartbeat') {
const entry = clients.get(params.channelId)
if (!entry) throw new Error('Bağlantı yok.')
return entry.authorize()
}
if (action === 'channel.close') {
clients.get(params.channelId)?.client.close(); clients.delete(params.channelId)
return { closed: true }
}
if (action === 'channel.request') {
const entry = clients.get(params.channelId)
if (!entry) throw new Error('Bağlantı yok.')
await entry.authorize()
const message = params.message
if (!message || JSON.stringify(message).length > 65000) throw new Error('İstek boyutu geçersiz.')
if (message.action === 'google.key.save') {
const key = message.params?.key
if (typeof key !== 'string' || !/^[A-Za-z0-9_-]{20,256}$/.test(key)) throw new Error('Google anahtarı biçimi geçersiz.')
await vault.save({ ...await vault.load(), googleKey: key })
return { saved: true }
}
if (message.action === 'google.key.delete') {
const secrets = await vault.load(); delete secrets.googleKey; await vault.save(secrets); return { deleted: true }
}
if (message.action === 'voice.token') return issuer.issue(entry.phoneId)
return entry.client.handle(message)
}
throw new Error('Desteklenmeyen mobil işlem.')
const actions = {
state: () => link.state(),
enable: () => link.enable(),
disable: () => link.disable(),
'pair.begin': () => link.pairBegin(),
'pair.cancel': () => link.pairCancel(),
devices: () => link.devices(),
'device.revoke': params => link.deviceRevoke(params?.deviceId),
'firewall.retry': () => link.firewallRetry(),
'firewall.remove': () => link.firewallRemove(),
}
const handler = async (event, action, params) => {
if (event.sender !== window.webContents || event.senderFrame !== window.webContents.mainFrame) throw new Error('aiturk-mobile:forbidden')
if (typeof action !== 'string' || !Object.hasOwn(actions, action)) throw new Error('aiturk-mobile:unsupported')
try { return await actions[action](params) } catch (error) {
// Only fixed codes cross to the renderer; never upstream error text.
throw new Error(CODED.test(error?.message) ? error.message : 'aiturk-mobile:failed')
}
}
const unsubscribe = link.onEvent(event => { if (!window.isDestroyed()) window.webContents.send('aiturk-mobile-event', event) })
ipcMain.handle('aiturk-mobile', handler)
window.on('closed', () => { for (const entry of clients.values()) entry.client.close(); clients.clear(); ipcMain.removeHandler('aiturk-mobile') })
window.on('closed', () => {
unsubscribe(); ipcMain.removeHandler('aiturk-mobile')
// The code on screen is gone with the window; do not leave pairing open behind it.
void link.pairCancel().catch(() => {})
})
void window.loadFile(join(assets, 'mobile-host.html'))
return window
}