@hellolynk-ai/openclaw-channel 0.2.105 → 0.2.106
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/clients/core/hellolynk-client-core.mjs +64 -14
- package/clients/core/hellolynk-neutral-host-assembly.mjs +5 -18
- package/clients/core/hellolynk-neutral-host-process.mjs +1 -1
- package/clients/core/hellolynk-platform-credential-store.mjs +32 -0
- package/hellolynk-client-pack-manifest.json +19 -19
- package/hellolynk-client-pack-pin.json +1 -1
- package/integrations/openclaw-channel/package.json +1 -1
- package/package.json +1 -1
- package/runtime/core/hellolynk-client-core.mjs +64 -14
- package/runtime/core/hellolynk-neutral-host-assembly.mjs +5 -18
- package/runtime/core/hellolynk-neutral-host-process.mjs +1 -1
- package/runtime/core/hellolynk-platform-credential-store.mjs +32 -0
- package/runtime/neutral-host-release-manifest.json +4 -4
- package/runtime/neutral-host-release-pin.json +1 -1
|
@@ -1,9 +1,11 @@
|
|
|
1
|
+
import { createHash } from "node:crypto";
|
|
1
2
|
import runtimeSafety from "./hellolynk-runtime-safety.cjs";
|
|
2
3
|
const DEFAULT_TIMEOUT_MS = 10_000;
|
|
3
4
|
const MAX_JSON_RESPONSE_BYTES = 256 * 1024;
|
|
4
5
|
const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
|
|
5
6
|
const DEVICE_RUNTIME_TTL_MS = 20 * 60 * 1000;
|
|
6
7
|
const DEVICE_RUNTIME_RECOVERY_WINDOW_MS = 120_000;
|
|
8
|
+
const DEVICE_CREDENTIAL_RECHECK_MS = 60 * 60_000;
|
|
7
9
|
const DEVICE_RUNTIME_SCOPES = Object.freeze([
|
|
8
10
|
"relay.text.receive",
|
|
9
11
|
"relay.text.send",
|
|
@@ -567,6 +569,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
567
569
|
const issue = options.issue || issueDeviceRuntimeSession;
|
|
568
570
|
const now = options.now || (() => Date.now());
|
|
569
571
|
const sessionStore = options.sessionStore || null;
|
|
572
|
+
const credentialRejections = sessionStore?.credentialRejections;
|
|
570
573
|
const sessionKey = options.sessionKey == null ? null : String(options.sessionKey);
|
|
571
574
|
if (sessionStore && (
|
|
572
575
|
!sessionKey ||
|
|
@@ -580,6 +583,8 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
580
583
|
5 * 60 * 1000,
|
|
581
584
|
);
|
|
582
585
|
let current = null;
|
|
586
|
+
let rejectedCredential = null;
|
|
587
|
+
let localIssueTail = Promise.resolve();
|
|
583
588
|
|
|
584
589
|
const routeMatches = (session, input) => {
|
|
585
590
|
const expectedValues = [
|
|
@@ -652,22 +657,67 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
652
657
|
return proof;
|
|
653
658
|
};
|
|
654
659
|
|
|
660
|
+
const issueSession = async (input, previousSession) => {
|
|
661
|
+
const request = { ...input, previousSession };
|
|
662
|
+
if (options.loadDeviceCredential) request.deviceCredential = await options.loadDeviceCredential();
|
|
663
|
+
const fingerprint = request.deviceCredential && request.baseUrl
|
|
664
|
+
? createHash("sha256").update(JSON.stringify([
|
|
665
|
+
normalizeHelloLynkBaseUrl(request.baseUrl, { allowLoopbackHttp: request.allowLoopbackHttp === true }),
|
|
666
|
+
request.deviceCredential,
|
|
667
|
+
])).digest("hex")
|
|
668
|
+
: null;
|
|
669
|
+
// The production caller holds the existing session lock, including across
|
|
670
|
+
// Host processes. An authority denial may drain the current Host.
|
|
671
|
+
if (fingerprint) {
|
|
672
|
+
const isCoolingDown = (rejection) => {
|
|
673
|
+
if (rejection?.fingerprint !== fingerprint) return false;
|
|
674
|
+
const age = now() - rejection.rejectedAtMs;
|
|
675
|
+
return age >= 0 && age < DEVICE_CREDENTIAL_RECHECK_MS;
|
|
676
|
+
};
|
|
677
|
+
// A generic denial may clear after a server-side repair, without a new
|
|
678
|
+
// credential. The lock permits one recheck once the cooldown ends.
|
|
679
|
+
if (isCoolingDown(rejectedCredential)
|
|
680
|
+
|| isCoolingDown(await credentialRejections?.load(sessionKey).catch(() => null))) {
|
|
681
|
+
throw new HelloLynkClientError("device_credential_invalid", { httpStatus: 401 });
|
|
682
|
+
}
|
|
683
|
+
}
|
|
684
|
+
let session;
|
|
685
|
+
try {
|
|
686
|
+
session = reusable(await issue(request), input);
|
|
687
|
+
} catch (error) {
|
|
688
|
+
if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
|
|
689
|
+
rejectedCredential = { fingerprint, rejectedAtMs: now() };
|
|
690
|
+
// Preserve the authority denial even if local storage is unavailable.
|
|
691
|
+
await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
|
|
692
|
+
}
|
|
693
|
+
throw error;
|
|
694
|
+
}
|
|
695
|
+
if (session && fingerprint) {
|
|
696
|
+
rejectedCredential = null;
|
|
697
|
+
await credentialRejections?.remove(sessionKey).catch(() => {});
|
|
698
|
+
}
|
|
699
|
+
return session;
|
|
700
|
+
};
|
|
701
|
+
|
|
655
702
|
return {
|
|
656
703
|
async get(input) {
|
|
657
704
|
if (!sessionStore) {
|
|
658
|
-
|
|
659
|
-
|
|
660
|
-
|
|
661
|
-
|
|
662
|
-
|
|
663
|
-
|
|
664
|
-
|
|
665
|
-
|
|
666
|
-
|
|
667
|
-
|
|
668
|
-
|
|
669
|
-
|
|
670
|
-
|
|
705
|
+
const result = localIssueTail.then(async () => {
|
|
706
|
+
if (
|
|
707
|
+
current && current.expiresAtMs - now() > minimumRemainingMs
|
|
708
|
+
&& routeMatches(current, input)
|
|
709
|
+
&& scopesMatch(current, input)
|
|
710
|
+
&& (input?.expectedAgentId == null || input.expectedAgentId === current.agentId)
|
|
711
|
+
&& (input?.expectedPrincipalId == null || input.expectedPrincipalId === current.principalId)
|
|
712
|
+
) return current;
|
|
713
|
+
const reusableCurrent = reusable(current, input);
|
|
714
|
+
if (reusableCurrent) return reusableCurrent;
|
|
715
|
+
current = await issueSession(input, recoveryProof(current, input));
|
|
716
|
+
if (!current) throw new HelloLynkClientError("invalid_runtime_session_handle");
|
|
717
|
+
return current;
|
|
718
|
+
});
|
|
719
|
+
localIssueTail = result.catch(() => {});
|
|
720
|
+
return result;
|
|
671
721
|
}
|
|
672
722
|
const inMemory = reusable(current, input);
|
|
673
723
|
if (inMemory) return inMemory;
|
|
@@ -678,7 +728,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
678
728
|
current = persisted;
|
|
679
729
|
return current;
|
|
680
730
|
}
|
|
681
|
-
const issued =
|
|
731
|
+
const issued = await issueSession(input, persisted);
|
|
682
732
|
if (!issued) throw new HelloLynkClientError("invalid_runtime_session_handle");
|
|
683
733
|
await sessionStore.save(sessionKey, issued);
|
|
684
734
|
current = issued;
|
|
@@ -7,7 +7,6 @@ import path from "node:path";
|
|
|
7
7
|
|
|
8
8
|
import {
|
|
9
9
|
createDeviceRuntimeSessionManager,
|
|
10
|
-
issueDeviceRuntimeSession,
|
|
11
10
|
normalizeHelloLynkBaseUrl,
|
|
12
11
|
} from "./hellolynk-client-core.mjs";
|
|
13
12
|
import { readClientProfile } from "./hellolynk-client-profile.mjs";
|
|
@@ -243,31 +242,19 @@ export async function startHelloLynkNeutralHostAssembly(options = {}, dependenci
|
|
|
243
242
|
const manager = (dependencies.createRuntimeSessionManager || createDeviceRuntimeSessionManager)({
|
|
244
243
|
sessionStore: credentialStore.runtimeSessions,
|
|
245
244
|
sessionKey,
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
try {
|
|
249
|
-
return await (dependencies.issueRuntimeSession || issueDeviceRuntimeSession)({
|
|
250
|
-
baseUrl: profile.baseUrl,
|
|
251
|
-
allowLoopbackHttp: profile.allowLoopbackHttp,
|
|
252
|
-
deviceCredential,
|
|
253
|
-
expectedPrincipalId: profile.principalId,
|
|
254
|
-
expectedAgentId: profile.agentId,
|
|
255
|
-
expectedDelegateId: profile.delegateId,
|
|
256
|
-
expectedHostId: profile.hostId,
|
|
257
|
-
expectedAuthorizationVersion: profile.authorizationVersion,
|
|
258
|
-
previousSession,
|
|
259
|
-
fetchImpl: dependencies.fetchImpl,
|
|
260
|
-
});
|
|
261
|
-
} finally { deviceCredential = null; }
|
|
262
|
-
},
|
|
245
|
+
loadDeviceCredential: () => credentialStore.load(profile.profileId),
|
|
246
|
+
issue: dependencies.issueRuntimeSession,
|
|
263
247
|
});
|
|
264
248
|
const sessionProvider = Object.freeze({
|
|
265
249
|
get: () => manager.get({
|
|
250
|
+
baseUrl: profile.baseUrl,
|
|
251
|
+
allowLoopbackHttp: profile.allowLoopbackHttp,
|
|
266
252
|
expectedPrincipalId: profile.principalId,
|
|
267
253
|
expectedAgentId: profile.agentId,
|
|
268
254
|
expectedDelegateId: profile.delegateId,
|
|
269
255
|
expectedHostId: profile.hostId,
|
|
270
256
|
expectedAuthorizationVersion: profile.authorizationVersion,
|
|
257
|
+
fetchImpl: dependencies.fetchImpl,
|
|
271
258
|
}),
|
|
272
259
|
clear: (error) => manager.clear(error),
|
|
273
260
|
status: () => manager.status(),
|
|
@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
|
|
|
34
34
|
export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
|
|
35
35
|
// Raised with every release batch, together with the six client versions. A Host reports it
|
|
36
36
|
// in its health; the higher release stays and the lower one makes room.
|
|
37
|
-
export const HELLOLYNK_HOST_RELEASE_ORDINAL =
|
|
37
|
+
export const HELLOLYNK_HOST_RELEASE_ORDINAL = 17;
|
|
38
38
|
|
|
39
39
|
const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
|
|
40
40
|
const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;
|
|
@@ -297,6 +297,36 @@ export async function secureWindowsClientReleaseTree(clientRoot, releaseId, opti
|
|
|
297
297
|
});
|
|
298
298
|
}
|
|
299
299
|
|
|
300
|
+
// Accessed under the same cross-process lock as the corresponding session.
|
|
301
|
+
function createCredentialRejectionStore(root) {
|
|
302
|
+
const fileFor = (profile) => join(root, `runtime-session-rejection-${assertCredentialProfileId(profile)}.json`);
|
|
303
|
+
const isRejection = (value) => typeof value?.fingerprint === "string" && /^[a-f0-9]{64}$/.test(value.fingerprint)
|
|
304
|
+
&& Number.isSafeInteger(value.rejectedAtMs) && value.rejectedAtMs >= 0;
|
|
305
|
+
return {
|
|
306
|
+
async load(profile) {
|
|
307
|
+
let value;
|
|
308
|
+
try { value = JSON.parse(await readFile(fileFor(profile), "utf8")); }
|
|
309
|
+
catch (error) { if (error?.code === "ENOENT" || error instanceof SyntaxError) return null; throw error; }
|
|
310
|
+
return isRejection(value) ? value : null;
|
|
311
|
+
},
|
|
312
|
+
async save(profile, rejection) {
|
|
313
|
+
if (!isRejection(rejection)) throw new HelloLynkCredentialStoreError("invalid_credential_rejection");
|
|
314
|
+
const { fingerprint, rejectedAtMs } = rejection;
|
|
315
|
+
const file = fileFor(profile);
|
|
316
|
+
const temporary = `${file}.${randomBytes(12).toString("hex")}.tmp`;
|
|
317
|
+
try {
|
|
318
|
+
await writeFile(temporary, `${JSON.stringify({ fingerprint, rejectedAtMs })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
|
|
319
|
+
await rename(temporary, file);
|
|
320
|
+
} finally {
|
|
321
|
+
await rm(temporary, { force: true }).catch(() => {});
|
|
322
|
+
}
|
|
323
|
+
},
|
|
324
|
+
async remove(profile) {
|
|
325
|
+
await rm(fileFor(profile), { force: true });
|
|
326
|
+
},
|
|
327
|
+
};
|
|
328
|
+
}
|
|
329
|
+
|
|
300
330
|
export function createPlatformCredentialStore(options = {}) {
|
|
301
331
|
const platform = options.platform || process.platform;
|
|
302
332
|
const run = options.runHelper || runCredentialHelper;
|
|
@@ -370,6 +400,7 @@ export function createPlatformCredentialStore(options = {}) {
|
|
|
370
400
|
await invoke("Remove", assertCredentialProfileId(profile), "");
|
|
371
401
|
},
|
|
372
402
|
runtimeSessions: {
|
|
403
|
+
credentialRejections: createCredentialRejectionStore(runtimeStoreRoot),
|
|
373
404
|
async save(profile, session) {
|
|
374
405
|
const body = JSON.stringify({ schemaVersion: 1, ...assertRuntimeSession(session) });
|
|
375
406
|
await invoke("StoreRuntimeSession", assertCredentialProfileId(profile), body);
|
|
@@ -504,6 +535,7 @@ export function createPlatformCredentialStore(options = {}) {
|
|
|
504
535
|
},
|
|
505
536
|
async remove(profile) { await entry(root, "device", profile, "remove"); },
|
|
506
537
|
runtimeSessions: {
|
|
538
|
+
credentialRejections: createCredentialRejectionStore(root),
|
|
507
539
|
async save(profile, session) { await entry(root, "session", profile, "save", assertRuntimeSession(session)); },
|
|
508
540
|
async load(profile) {
|
|
509
541
|
const value = await entry(root, "session", profile, "load");
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"contract": "hellolynk-client-npm-pack-manifest-v1",
|
|
3
3
|
"client": "openclaw",
|
|
4
4
|
"packageName": "@hellolynk-ai/openclaw-channel",
|
|
5
|
-
"version": "0.2.
|
|
5
|
+
"version": "0.2.106",
|
|
6
6
|
"workbench": {
|
|
7
7
|
"path": "runtime/workbench/hellolynk-workbench-build.json",
|
|
8
8
|
"contract": "hellolynk-shared-workbench-build-v1",
|
|
@@ -32,8 +32,8 @@
|
|
|
32
32
|
},
|
|
33
33
|
{
|
|
34
34
|
"path": "clients/core/hellolynk-client-core.mjs",
|
|
35
|
-
"bytes":
|
|
36
|
-
"sha256": "
|
|
35
|
+
"bytes": 35808,
|
|
36
|
+
"sha256": "dbab0f067c1a7f02c43b2696e1f5972288acd4f93a18684bf3cc120edff5cf94"
|
|
37
37
|
},
|
|
38
38
|
{
|
|
39
39
|
"path": "clients/core/hellolynk-client-profile.mjs",
|
|
@@ -217,8 +217,8 @@
|
|
|
217
217
|
},
|
|
218
218
|
{
|
|
219
219
|
"path": "clients/core/hellolynk-neutral-host-assembly.mjs",
|
|
220
|
-
"bytes":
|
|
221
|
-
"sha256": "
|
|
220
|
+
"bytes": 46294,
|
|
221
|
+
"sha256": "287ad6e077c8da05799b970ffa6607d8c7a0ab54a4837de51516e6af0ef6695b"
|
|
222
222
|
},
|
|
223
223
|
{
|
|
224
224
|
"path": "clients/core/hellolynk-neutral-host-installation-store.mjs",
|
|
@@ -233,7 +233,7 @@
|
|
|
233
233
|
{
|
|
234
234
|
"path": "clients/core/hellolynk-neutral-host-process.mjs",
|
|
235
235
|
"bytes": 225161,
|
|
236
|
-
"sha256": "
|
|
236
|
+
"sha256": "ad6809633f49f7316acf6ce5b8f71a13d7ba20d3b62a2700664421ba671b5369"
|
|
237
237
|
},
|
|
238
238
|
{
|
|
239
239
|
"path": "clients/core/hellolynk-neutral-host-store-adapters.mjs",
|
|
@@ -247,8 +247,8 @@
|
|
|
247
247
|
},
|
|
248
248
|
{
|
|
249
249
|
"path": "clients/core/hellolynk-platform-credential-store.mjs",
|
|
250
|
-
"bytes":
|
|
251
|
-
"sha256": "
|
|
250
|
+
"bytes": 40123,
|
|
251
|
+
"sha256": "4b4b27cd86f4816e5e6ec4914816a335cdea5c4b4ffb2091775c061a9676a69c"
|
|
252
252
|
},
|
|
253
253
|
{
|
|
254
254
|
"path": "clients/core/hellolynk-relay-client-cli.mjs",
|
|
@@ -333,7 +333,7 @@
|
|
|
333
333
|
{
|
|
334
334
|
"path": "integrations/openclaw-channel/package.json",
|
|
335
335
|
"bytes": 2158,
|
|
336
|
-
"sha256": "
|
|
336
|
+
"sha256": "516ea70d0af9d5c8cdf95d5f381098fe9ba1fcc8d7f08eb3bda219d822f2e493"
|
|
337
337
|
},
|
|
338
338
|
{
|
|
339
339
|
"path": "integrations/openclaw-channel/setup-entry.mjs",
|
|
@@ -408,7 +408,7 @@
|
|
|
408
408
|
{
|
|
409
409
|
"path": "package.json",
|
|
410
410
|
"bytes": 1985,
|
|
411
|
-
"sha256": "
|
|
411
|
+
"sha256": "93c472a120cd144287057b5611541b798e359cba0727073b68598b53acc75713"
|
|
412
412
|
},
|
|
413
413
|
{
|
|
414
414
|
"path": "README.md",
|
|
@@ -432,8 +432,8 @@
|
|
|
432
432
|
},
|
|
433
433
|
{
|
|
434
434
|
"path": "runtime/core/hellolynk-client-core.mjs",
|
|
435
|
-
"bytes":
|
|
436
|
-
"sha256": "
|
|
435
|
+
"bytes": 35808,
|
|
436
|
+
"sha256": "dbab0f067c1a7f02c43b2696e1f5972288acd4f93a18684bf3cc120edff5cf94"
|
|
437
437
|
},
|
|
438
438
|
{
|
|
439
439
|
"path": "runtime/core/hellolynk-client-profile.mjs",
|
|
@@ -617,8 +617,8 @@
|
|
|
617
617
|
},
|
|
618
618
|
{
|
|
619
619
|
"path": "runtime/core/hellolynk-neutral-host-assembly.mjs",
|
|
620
|
-
"bytes":
|
|
621
|
-
"sha256": "
|
|
620
|
+
"bytes": 46294,
|
|
621
|
+
"sha256": "287ad6e077c8da05799b970ffa6607d8c7a0ab54a4837de51516e6af0ef6695b"
|
|
622
622
|
},
|
|
623
623
|
{
|
|
624
624
|
"path": "runtime/core/hellolynk-neutral-host-installation-store.mjs",
|
|
@@ -633,7 +633,7 @@
|
|
|
633
633
|
{
|
|
634
634
|
"path": "runtime/core/hellolynk-neutral-host-process.mjs",
|
|
635
635
|
"bytes": 225161,
|
|
636
|
-
"sha256": "
|
|
636
|
+
"sha256": "ad6809633f49f7316acf6ce5b8f71a13d7ba20d3b62a2700664421ba671b5369"
|
|
637
637
|
},
|
|
638
638
|
{
|
|
639
639
|
"path": "runtime/core/hellolynk-neutral-host-store-adapters.mjs",
|
|
@@ -647,8 +647,8 @@
|
|
|
647
647
|
},
|
|
648
648
|
{
|
|
649
649
|
"path": "runtime/core/hellolynk-platform-credential-store.mjs",
|
|
650
|
-
"bytes":
|
|
651
|
-
"sha256": "
|
|
650
|
+
"bytes": 40123,
|
|
651
|
+
"sha256": "4b4b27cd86f4816e5e6ec4914816a335cdea5c4b4ffb2091775c061a9676a69c"
|
|
652
652
|
},
|
|
653
653
|
{
|
|
654
654
|
"path": "runtime/core/hellolynk-relay-client-cli.mjs",
|
|
@@ -693,12 +693,12 @@
|
|
|
693
693
|
{
|
|
694
694
|
"path": "runtime/neutral-host-release-manifest.json",
|
|
695
695
|
"bytes": 11517,
|
|
696
|
-
"sha256": "
|
|
696
|
+
"sha256": "637e033793b581d98805b622a0e35e1c28a4c4e58a4aa0476933067a502ac228"
|
|
697
697
|
},
|
|
698
698
|
{
|
|
699
699
|
"path": "runtime/neutral-host-release-pin.json",
|
|
700
700
|
"bytes": 146,
|
|
701
|
-
"sha256": "
|
|
701
|
+
"sha256": "78650bbb4c7d74f8f099b7804b286b57c2566c6c2cabd04a3aa7c350b112a2d8"
|
|
702
702
|
},
|
|
703
703
|
{
|
|
704
704
|
"path": "runtime/platform/windows/configure-agent.ps1",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hellolynk-ai/openclaw-channel",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.106",
|
|
4
4
|
"description": "HelloLynk Messaging for OpenClaw: open conversations and let your AI message other people's AI assistants.",
|
|
5
5
|
"homepage": "https://hellolynk.com",
|
|
6
6
|
"repository": {
|
|
@@ -1,9 +1,11 @@
|
|
|
1
|
+
import { createHash } from "node:crypto";
|
|
1
2
|
import runtimeSafety from "./hellolynk-runtime-safety.cjs";
|
|
2
3
|
const DEFAULT_TIMEOUT_MS = 10_000;
|
|
3
4
|
const MAX_JSON_RESPONSE_BYTES = 256 * 1024;
|
|
4
5
|
const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
|
|
5
6
|
const DEVICE_RUNTIME_TTL_MS = 20 * 60 * 1000;
|
|
6
7
|
const DEVICE_RUNTIME_RECOVERY_WINDOW_MS = 120_000;
|
|
8
|
+
const DEVICE_CREDENTIAL_RECHECK_MS = 60 * 60_000;
|
|
7
9
|
const DEVICE_RUNTIME_SCOPES = Object.freeze([
|
|
8
10
|
"relay.text.receive",
|
|
9
11
|
"relay.text.send",
|
|
@@ -567,6 +569,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
567
569
|
const issue = options.issue || issueDeviceRuntimeSession;
|
|
568
570
|
const now = options.now || (() => Date.now());
|
|
569
571
|
const sessionStore = options.sessionStore || null;
|
|
572
|
+
const credentialRejections = sessionStore?.credentialRejections;
|
|
570
573
|
const sessionKey = options.sessionKey == null ? null : String(options.sessionKey);
|
|
571
574
|
if (sessionStore && (
|
|
572
575
|
!sessionKey ||
|
|
@@ -580,6 +583,8 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
580
583
|
5 * 60 * 1000,
|
|
581
584
|
);
|
|
582
585
|
let current = null;
|
|
586
|
+
let rejectedCredential = null;
|
|
587
|
+
let localIssueTail = Promise.resolve();
|
|
583
588
|
|
|
584
589
|
const routeMatches = (session, input) => {
|
|
585
590
|
const expectedValues = [
|
|
@@ -652,22 +657,67 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
652
657
|
return proof;
|
|
653
658
|
};
|
|
654
659
|
|
|
660
|
+
const issueSession = async (input, previousSession) => {
|
|
661
|
+
const request = { ...input, previousSession };
|
|
662
|
+
if (options.loadDeviceCredential) request.deviceCredential = await options.loadDeviceCredential();
|
|
663
|
+
const fingerprint = request.deviceCredential && request.baseUrl
|
|
664
|
+
? createHash("sha256").update(JSON.stringify([
|
|
665
|
+
normalizeHelloLynkBaseUrl(request.baseUrl, { allowLoopbackHttp: request.allowLoopbackHttp === true }),
|
|
666
|
+
request.deviceCredential,
|
|
667
|
+
])).digest("hex")
|
|
668
|
+
: null;
|
|
669
|
+
// The production caller holds the existing session lock, including across
|
|
670
|
+
// Host processes. An authority denial may drain the current Host.
|
|
671
|
+
if (fingerprint) {
|
|
672
|
+
const isCoolingDown = (rejection) => {
|
|
673
|
+
if (rejection?.fingerprint !== fingerprint) return false;
|
|
674
|
+
const age = now() - rejection.rejectedAtMs;
|
|
675
|
+
return age >= 0 && age < DEVICE_CREDENTIAL_RECHECK_MS;
|
|
676
|
+
};
|
|
677
|
+
// A generic denial may clear after a server-side repair, without a new
|
|
678
|
+
// credential. The lock permits one recheck once the cooldown ends.
|
|
679
|
+
if (isCoolingDown(rejectedCredential)
|
|
680
|
+
|| isCoolingDown(await credentialRejections?.load(sessionKey).catch(() => null))) {
|
|
681
|
+
throw new HelloLynkClientError("device_credential_invalid", { httpStatus: 401 });
|
|
682
|
+
}
|
|
683
|
+
}
|
|
684
|
+
let session;
|
|
685
|
+
try {
|
|
686
|
+
session = reusable(await issue(request), input);
|
|
687
|
+
} catch (error) {
|
|
688
|
+
if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
|
|
689
|
+
rejectedCredential = { fingerprint, rejectedAtMs: now() };
|
|
690
|
+
// Preserve the authority denial even if local storage is unavailable.
|
|
691
|
+
await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
|
|
692
|
+
}
|
|
693
|
+
throw error;
|
|
694
|
+
}
|
|
695
|
+
if (session && fingerprint) {
|
|
696
|
+
rejectedCredential = null;
|
|
697
|
+
await credentialRejections?.remove(sessionKey).catch(() => {});
|
|
698
|
+
}
|
|
699
|
+
return session;
|
|
700
|
+
};
|
|
701
|
+
|
|
655
702
|
return {
|
|
656
703
|
async get(input) {
|
|
657
704
|
if (!sessionStore) {
|
|
658
|
-
|
|
659
|
-
|
|
660
|
-
|
|
661
|
-
|
|
662
|
-
|
|
663
|
-
|
|
664
|
-
|
|
665
|
-
|
|
666
|
-
|
|
667
|
-
|
|
668
|
-
|
|
669
|
-
|
|
670
|
-
|
|
705
|
+
const result = localIssueTail.then(async () => {
|
|
706
|
+
if (
|
|
707
|
+
current && current.expiresAtMs - now() > minimumRemainingMs
|
|
708
|
+
&& routeMatches(current, input)
|
|
709
|
+
&& scopesMatch(current, input)
|
|
710
|
+
&& (input?.expectedAgentId == null || input.expectedAgentId === current.agentId)
|
|
711
|
+
&& (input?.expectedPrincipalId == null || input.expectedPrincipalId === current.principalId)
|
|
712
|
+
) return current;
|
|
713
|
+
const reusableCurrent = reusable(current, input);
|
|
714
|
+
if (reusableCurrent) return reusableCurrent;
|
|
715
|
+
current = await issueSession(input, recoveryProof(current, input));
|
|
716
|
+
if (!current) throw new HelloLynkClientError("invalid_runtime_session_handle");
|
|
717
|
+
return current;
|
|
718
|
+
});
|
|
719
|
+
localIssueTail = result.catch(() => {});
|
|
720
|
+
return result;
|
|
671
721
|
}
|
|
672
722
|
const inMemory = reusable(current, input);
|
|
673
723
|
if (inMemory) return inMemory;
|
|
@@ -678,7 +728,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
|
|
|
678
728
|
current = persisted;
|
|
679
729
|
return current;
|
|
680
730
|
}
|
|
681
|
-
const issued =
|
|
731
|
+
const issued = await issueSession(input, persisted);
|
|
682
732
|
if (!issued) throw new HelloLynkClientError("invalid_runtime_session_handle");
|
|
683
733
|
await sessionStore.save(sessionKey, issued);
|
|
684
734
|
current = issued;
|
|
@@ -7,7 +7,6 @@ import path from "node:path";
|
|
|
7
7
|
|
|
8
8
|
import {
|
|
9
9
|
createDeviceRuntimeSessionManager,
|
|
10
|
-
issueDeviceRuntimeSession,
|
|
11
10
|
normalizeHelloLynkBaseUrl,
|
|
12
11
|
} from "./hellolynk-client-core.mjs";
|
|
13
12
|
import { readClientProfile } from "./hellolynk-client-profile.mjs";
|
|
@@ -243,31 +242,19 @@ export async function startHelloLynkNeutralHostAssembly(options = {}, dependenci
|
|
|
243
242
|
const manager = (dependencies.createRuntimeSessionManager || createDeviceRuntimeSessionManager)({
|
|
244
243
|
sessionStore: credentialStore.runtimeSessions,
|
|
245
244
|
sessionKey,
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
try {
|
|
249
|
-
return await (dependencies.issueRuntimeSession || issueDeviceRuntimeSession)({
|
|
250
|
-
baseUrl: profile.baseUrl,
|
|
251
|
-
allowLoopbackHttp: profile.allowLoopbackHttp,
|
|
252
|
-
deviceCredential,
|
|
253
|
-
expectedPrincipalId: profile.principalId,
|
|
254
|
-
expectedAgentId: profile.agentId,
|
|
255
|
-
expectedDelegateId: profile.delegateId,
|
|
256
|
-
expectedHostId: profile.hostId,
|
|
257
|
-
expectedAuthorizationVersion: profile.authorizationVersion,
|
|
258
|
-
previousSession,
|
|
259
|
-
fetchImpl: dependencies.fetchImpl,
|
|
260
|
-
});
|
|
261
|
-
} finally { deviceCredential = null; }
|
|
262
|
-
},
|
|
245
|
+
loadDeviceCredential: () => credentialStore.load(profile.profileId),
|
|
246
|
+
issue: dependencies.issueRuntimeSession,
|
|
263
247
|
});
|
|
264
248
|
const sessionProvider = Object.freeze({
|
|
265
249
|
get: () => manager.get({
|
|
250
|
+
baseUrl: profile.baseUrl,
|
|
251
|
+
allowLoopbackHttp: profile.allowLoopbackHttp,
|
|
266
252
|
expectedPrincipalId: profile.principalId,
|
|
267
253
|
expectedAgentId: profile.agentId,
|
|
268
254
|
expectedDelegateId: profile.delegateId,
|
|
269
255
|
expectedHostId: profile.hostId,
|
|
270
256
|
expectedAuthorizationVersion: profile.authorizationVersion,
|
|
257
|
+
fetchImpl: dependencies.fetchImpl,
|
|
271
258
|
}),
|
|
272
259
|
clear: (error) => manager.clear(error),
|
|
273
260
|
status: () => manager.status(),
|
|
@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
|
|
|
34
34
|
export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
|
|
35
35
|
// Raised with every release batch, together with the six client versions. A Host reports it
|
|
36
36
|
// in its health; the higher release stays and the lower one makes room.
|
|
37
|
-
export const HELLOLYNK_HOST_RELEASE_ORDINAL =
|
|
37
|
+
export const HELLOLYNK_HOST_RELEASE_ORDINAL = 17;
|
|
38
38
|
|
|
39
39
|
const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
|
|
40
40
|
const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;
|
|
@@ -297,6 +297,36 @@ export async function secureWindowsClientReleaseTree(clientRoot, releaseId, opti
|
|
|
297
297
|
});
|
|
298
298
|
}
|
|
299
299
|
|
|
300
|
+
// Accessed under the same cross-process lock as the corresponding session.
|
|
301
|
+
function createCredentialRejectionStore(root) {
|
|
302
|
+
const fileFor = (profile) => join(root, `runtime-session-rejection-${assertCredentialProfileId(profile)}.json`);
|
|
303
|
+
const isRejection = (value) => typeof value?.fingerprint === "string" && /^[a-f0-9]{64}$/.test(value.fingerprint)
|
|
304
|
+
&& Number.isSafeInteger(value.rejectedAtMs) && value.rejectedAtMs >= 0;
|
|
305
|
+
return {
|
|
306
|
+
async load(profile) {
|
|
307
|
+
let value;
|
|
308
|
+
try { value = JSON.parse(await readFile(fileFor(profile), "utf8")); }
|
|
309
|
+
catch (error) { if (error?.code === "ENOENT" || error instanceof SyntaxError) return null; throw error; }
|
|
310
|
+
return isRejection(value) ? value : null;
|
|
311
|
+
},
|
|
312
|
+
async save(profile, rejection) {
|
|
313
|
+
if (!isRejection(rejection)) throw new HelloLynkCredentialStoreError("invalid_credential_rejection");
|
|
314
|
+
const { fingerprint, rejectedAtMs } = rejection;
|
|
315
|
+
const file = fileFor(profile);
|
|
316
|
+
const temporary = `${file}.${randomBytes(12).toString("hex")}.tmp`;
|
|
317
|
+
try {
|
|
318
|
+
await writeFile(temporary, `${JSON.stringify({ fingerprint, rejectedAtMs })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
|
|
319
|
+
await rename(temporary, file);
|
|
320
|
+
} finally {
|
|
321
|
+
await rm(temporary, { force: true }).catch(() => {});
|
|
322
|
+
}
|
|
323
|
+
},
|
|
324
|
+
async remove(profile) {
|
|
325
|
+
await rm(fileFor(profile), { force: true });
|
|
326
|
+
},
|
|
327
|
+
};
|
|
328
|
+
}
|
|
329
|
+
|
|
300
330
|
export function createPlatformCredentialStore(options = {}) {
|
|
301
331
|
const platform = options.platform || process.platform;
|
|
302
332
|
const run = options.runHelper || runCredentialHelper;
|
|
@@ -370,6 +400,7 @@ export function createPlatformCredentialStore(options = {}) {
|
|
|
370
400
|
await invoke("Remove", assertCredentialProfileId(profile), "");
|
|
371
401
|
},
|
|
372
402
|
runtimeSessions: {
|
|
403
|
+
credentialRejections: createCredentialRejectionStore(runtimeStoreRoot),
|
|
373
404
|
async save(profile, session) {
|
|
374
405
|
const body = JSON.stringify({ schemaVersion: 1, ...assertRuntimeSession(session) });
|
|
375
406
|
await invoke("StoreRuntimeSession", assertCredentialProfileId(profile), body);
|
|
@@ -504,6 +535,7 @@ export function createPlatformCredentialStore(options = {}) {
|
|
|
504
535
|
},
|
|
505
536
|
async remove(profile) { await entry(root, "device", profile, "remove"); },
|
|
506
537
|
runtimeSessions: {
|
|
538
|
+
credentialRejections: createCredentialRejectionStore(root),
|
|
507
539
|
async save(profile, session) { await entry(root, "session", profile, "save", assertRuntimeSession(session)); },
|
|
508
540
|
async load(profile) {
|
|
509
541
|
const value = await entry(root, "session", profile, "load");
|
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
},
|
|
29
29
|
{
|
|
30
30
|
"path": "core/hellolynk-client-core.mjs",
|
|
31
|
-
"sha256": "
|
|
31
|
+
"sha256": "dbab0f067c1a7f02c43b2696e1f5972288acd4f93a18684bf3cc120edff5cf94"
|
|
32
32
|
},
|
|
33
33
|
{
|
|
34
34
|
"path": "core/hellolynk-client-profile.mjs",
|
|
@@ -180,7 +180,7 @@
|
|
|
180
180
|
},
|
|
181
181
|
{
|
|
182
182
|
"path": "core/hellolynk-neutral-host-assembly.mjs",
|
|
183
|
-
"sha256": "
|
|
183
|
+
"sha256": "287ad6e077c8da05799b970ffa6607d8c7a0ab54a4837de51516e6af0ef6695b"
|
|
184
184
|
},
|
|
185
185
|
{
|
|
186
186
|
"path": "core/hellolynk-neutral-host-installation-store.mjs",
|
|
@@ -192,7 +192,7 @@
|
|
|
192
192
|
},
|
|
193
193
|
{
|
|
194
194
|
"path": "core/hellolynk-neutral-host-process.mjs",
|
|
195
|
-
"sha256": "
|
|
195
|
+
"sha256": "ad6809633f49f7316acf6ce5b8f71a13d7ba20d3b62a2700664421ba671b5369"
|
|
196
196
|
},
|
|
197
197
|
{
|
|
198
198
|
"path": "core/hellolynk-neutral-host-store-adapters.mjs",
|
|
@@ -204,7 +204,7 @@
|
|
|
204
204
|
},
|
|
205
205
|
{
|
|
206
206
|
"path": "core/hellolynk-platform-credential-store.mjs",
|
|
207
|
-
"sha256": "
|
|
207
|
+
"sha256": "4b4b27cd86f4816e5e6ec4914816a335cdea5c4b4ffb2091775c061a9676a69c"
|
|
208
208
|
},
|
|
209
209
|
{
|
|
210
210
|
"path": "core/hellolynk-relay-client-cli.mjs",
|