@dshn/agent 0.3.1 → 0.3.3

package/lib/index.js

@@ -4624,7 +4624,15 @@ var SHIM_BODY = String.raw`
   let resolveReady
   const ready = new Promise((r) => { resolveReady = r })
   const hexToBytes = (hx) => { const a = new Uint8Array(hx.length / 2); for (let i = 0; i < a.length; i++) a[i] = parseInt(hx.substr(i * 2, 2), 16); return a }
-  const isApi = (url) => { try { const u = new URL(url, location.href); return u.origin === location.origin && u.pathname.startsWith('/api') } catch { return false } }
+  // Same host as the page, over http(s) OR ws(s). A wss: URL has the origin
+  // "wss://host", which never equals the page's "https://host", so comparing
+  // origins would leave every event socket undecrypted.
+  const isApi = (url) => {
+    try {
+      const u = new URL(url, location.href)
+      return u.host === location.host && /^(https?|wss?):$/.test(u.protocol) && u.pathname.startsWith('/api')
+    } catch { return false }
+  }
 
   async function deriveKey(password, saltHex) {
     const base = await crypto.subtle.importKey('raw', enc.encode(password), 'PBKDF2', false, ['deriveKey'])
@@ -4704,7 +4712,9 @@ var SHIM_BODY = String.raw`
               : data instanceof Blob ? new Uint8Array(await data.arrayBuffer())
               : new Uint8Array(await new Blob([data]).arrayBuffer())
             const opened = await openBytes(key, raw)
-            data = opened[0] === 0 ? new TextDecoder().decode(opened.subarray(1)) : opened.subarray(1).buffer
+            // slice, not subarray: subarray(1).buffer is the WHOLE decrypted
+            // buffer, type byte included, and would hand the app one extra byte.
+            data = opened[0] === 0 ? new TextDecoder().decode(opened.subarray(1)) : opened.slice(1).buffer
           } catch { return } // drop messages we can't decrypt
         }
       }
@@ -4838,6 +4848,13 @@ function e2eBootstrapTag(info) {
   const json = JSON.stringify({ salt: info.salt, device: info.device }).replace(/</g, "\\u003c");
   return `<script>(function (__dshnInfo) {${SHIM_BODY}})(${json})</script>`;
 }
+function credentialManifestLinks(html) {
+  return html.replace(/<link\b[^>]*>/gi, (tag) => {
+    if (!/\brel\s*=\s*["']?manifest\b/i.test(tag) || /\bcrossorigin\b/i.test(tag))
+      return tag;
+    return tag.replace(/\s*\/?>$/, (end) => ` crossorigin="use-credentials"${end.trim() === "/>" ? " />" : ">"}`);
+  });
+}
 function injectE2EBootstrap(html, info) {
   const tag = e2eBootstrapTag(info);
   const head = /<head(\s[^>]*)?>/i.exec(html);
@@ -5615,16 +5632,17 @@ var AgentTunnel = class {
       return;
     }
     const wantsDocument = method === "GET" && headers.some(([k, v]) => k.toLowerCase() === "accept" && v.includes("text/html"));
-    const injectBootstrap = this.e2eKey !== null && wantsDocument;
-    if (injectBootstrap)
+    if (wantsDocument)
       outHeaders["accept-encoding"] = "identity";
     const req = http.request({ host: this.config.localHost, port: this.localPort(), method, path, headers: outHeaders }, (res) => {
       const contentType = String(res.headers["content-type"] ?? "");
-      if (injectBootstrap && this.e2eKey !== null && res.statusCode === 200 && /^text\/html\b/i.test(contentType)) {
+      if (wantsDocument && res.statusCode === 200 && /^text\/html\b/i.test(contentType)) {
         const chunks = [];
         res.on("data", (c) => chunks.push(c));
         res.on("end", () => {
-          const html = injectE2EBootstrap(Buffer.concat(chunks).toString("utf8"), { salt: this.e2eSalt, device: this.deviceId });
+          let html = credentialManifestLinks(Buffer.concat(chunks).toString("utf8"));
+          if (this.e2eKey !== null)
+            html = injectE2EBootstrap(html, { salt: this.e2eSalt, device: this.deviceId });
           const body = Buffer.from(html, "utf8");
           const resHeaders = filterHeaders(headerListFromRaw(res.rawHeaders), /* @__PURE__ */ new Set([...HOP_BY_HOP, "content-length", "content-encoding"]));
           resHeaders.push(["content-length", String(body.length)]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dshn/agent",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Forward a local dsh web service to the public internet over ds.hn (bundled).",
   "keywords": [
     "dsh",