dsh-remote 0.4.0: edge auth – slaves log in to an auth proxy in front of the master

- lib/edge-auth.mjs: basic / bearer / oauth2 client_credentials (Authentik M2M) /
  custom headers (Cloudflare Access), proxy session cookie jar, retry with fresh
  token, clear edge-refusal vs DSH-refusal errors
- link + enroll go through the edge; master.edgeAuth stored at pair time,
  secrets as DSH credential refs only; config edgeAuth override
- /dsh-remote/edge-auth: show/change/probe; Settings UI section + pair form
- pair.mjs / install-mac.sh: --edge … flags, secrets prompted via /dev/tty
- tests: fake Authentik-like proxy for all modes + WebSocket through the edge

deploy/install-mac.sh

@@ -13,10 +13,14 @@
 #   --port PORT      local DSH port (default 3081)
 #   --accept LIST    comma list of secrets to accept from the master (default OMNI_API_KEY,FORGE_CREDENTIALS)
 #   --no-service     don't install the LaunchAgent (run `dsh web` yourself)
+#   --edge MODE …    the master sits behind an auth proxy: basic|bearer|oauth2|headers, with
+#                    --edge-user, --edge-token-url, --edge-client-id, --edge-client-secret,
+#                    --edge-header "Name: value" (secrets are prompted for, never in argv)
 # Re-running is safe: it updates Node/DSH/dsh-remote and keeps the existing pairing.
 set -euo pipefail
 
 MASTER="" CODE="" NAME="" PORT=3081 ACCEPT="OMNI_API_KEY,FORGE_CREDENTIALS" SERVICE=1
+EDGE_ARGS=()
 NODE_MAJOR=22
 REPO_TGZ="https://git.rizzy.dev/DSH-Plugins/dsh-remote/archive/main.tar.gz"
 while [ $# -gt 0 ]; do
@@ -27,7 +31,9 @@ while [ $# -gt 0 ]; do
     --port) PORT="$2"; shift 2 ;;
     --accept) ACCEPT="$2"; shift 2 ;;
     --no-service) SERVICE=0; shift ;;
-    -h|--help) sed -n '2,17p' "$0" 2>/dev/null || true; exit 0 ;;
+    --edge|--edge-user|--edge-token-url|--edge-client-id|--edge-scope|--edge-header) EDGE_ARGS+=("$1" "$2"); shift 2 ;;
+    --edge-client-secret) EDGE_ARGS+=("$1"); shift ;;
+    -h|--help) sed -n '2,19p' "$0" 2>/dev/null || true; exit 0 ;;
     *) echo "unknown option: $1" >&2; exit 2 ;;
   esac
 done
@@ -100,7 +106,7 @@ if [ -f "$STATE" ] && grep -q '"deviceId"' "$STATE"; then
 else
   [ -n "$CODE" ] || die "--code is required for the first pairing (master → Settings → Remote devices → Create pairing code)"
   say "Pairing with $MASTER as \"$NAME\""
-  node "$PLUGIN_DIR/deploy/pair.mjs" --master "$MASTER" --code "$CODE" --name "$NAME" --state "$STATE"
+  node "$PLUGIN_DIR/deploy/pair.mjs" --master "$MASTER" --code "$CODE" --name "$NAME" --state "$STATE" ${EDGE_ARGS[@]+"${EDGE_ARGS[@]}"}
 fi
 
 # 7. LaunchAgent: dsh web on 127.0.0.1:$PORT, at login, restarted on exit.