@getpaseo/relay 0.6.1 → 0.7.0-beta.1

package/dist/encrypted-channel.d.ts

@@ -75,6 +75,8 @@ export declare class EncryptedChannel {
     outboundWireByteLength(data: string | ArrayBuffer): number;
     private flushPendingSends;
     private handleDaemonRehello;
+    private sendReadyForRetry;
+    private rejectKeyRotation;
     close(code?: number, reason?: string): void;
     isOpen(): boolean;
     onTransitionToOpen(cb: () => void): void;

package/dist/encrypted-channel.js

@@ -46,7 +46,7 @@ function buildInvalidHelloError(rawText, parsed) {
 }
 const HANDSHAKE_RETRY_MS = 1000;
 const MAX_PENDING_SENDS = 200;
-const REHANDSHAKE_KEY_MISMATCH_CLOSE_CODE = 1008;
+const REHANDSHAKE_REJECTION_CODE = 1008;
 const ENCRYPTED_PAYLOAD_OVERHEAD_BYTES = 40;
 export function base64EncryptedWireByteLength(plaintextBytes) {
     return 4 * Math.ceil((plaintextBytes + ENCRYPTED_PAYLOAD_OVERHEAD_BYTES) / 3);
@@ -383,24 +383,22 @@ export class EncryptedChannel {
         if (!this.options.daemonKeyPair)
             return;
         const clientPublicKey = importPublicKey(message.key);
-        const nextSharedKey = deriveSharedKey(this.options.daemonKeyPair.secretKey, clientPublicKey);
-        // If it's the same client key (handshake retry), re-send
-        // "ready" but do not re-key. Re-keying here would desync
-        // the channel and cause decrypt failures.
-        if (keysEqual(nextSharedKey, this.sharedKey)) {
-            await this.transport.send(JSON.stringify({
-                type: "e2ee_ready",
-                ...(this.options.binaryCiphertext
-                    ? { capabilities: { binaryCiphertext: true } }
-                    : {}),
-            }));
-            return;
-        }
-        // A different key on an already-open encrypted channel is not an
-        // authenticated reconnect. Close and require a fresh transport instead of
-        // allowing the relay to switch this channel to an attacker-chosen key.
+        const retryKey = deriveSharedKey(this.options.daemonKeyPair.secretKey, clientPublicKey);
+        if (!keysEqual(retryKey, this.sharedKey))
+            return this.rejectKeyRotation();
+        await this.sendReadyForRetry();
+    }
+    async sendReadyForRetry() {
+        await this.transport.send(JSON.stringify({
+            type: "e2ee_ready",
+            ...(this.options.binaryCiphertext
+                ? { capabilities: { binaryCiphertext: true } }
+                : {}),
+        }));
+    }
+    rejectKeyRotation() {
         this.state = "closed";
-        this.transport.close(REHANDSHAKE_KEY_MISMATCH_CLOSE_CODE, REHANDSHAKE_KEY_MISMATCH_CLOSE_REASON);
+        this.transport.close(REHANDSHAKE_REJECTION_CODE, REHANDSHAKE_KEY_MISMATCH_CLOSE_REASON);
     }
     close(code = 1000, reason = "Normal closure") {
         this.state = "closed";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/relay",
-  "version": "0.6.1",
+  "version": "0.7.0-beta.1",
   "description": "Paseo relay for bridging daemon and client connections",
   "files": [
     "dist",