@johnhenry/wsh 0.23.0 → 0.24.0

package/README.md

@@ -543,7 +543,7 @@ the host to find it:
 | Current stock client | `@johnhenry/wsh/server` (advertises `stream-announce`) | The client's transport announces the stream with an empty STREAM frame. **No primer is written.** |
 | Current stock client | Host without `stream-announce` (e.g. the Rust `wsh-server`, older vendored hosts) | The client writes a one-byte primer (`0x00`) on the new stream so the host sees it; that host strips it. `primer: false` disables this (then such a host never binds the stream and the output is lost). |
 | A client that primes anyway (older stock client, `primer` forced, other implementations) | `@johnhenry/wsh/server` | **The leading `0x00` is dropped:** if the first data on an exec stream is exactly one `0x00` byte it is discarded, never forwarded to the process's stdin. Only that first chunk is inspected; a later `0x00`, or a first chunk that is longer than one byte, is delivered untouched. The cost: a client whose genuine first stdin chunk is a lone NUL loses it. |
-| A client that neither announces nor primes | `@johnhenry/wsh/server` | The host waits `bindTimeoutMs` (default 3000) for the stream, then drops the output and logs it. |
+| A client that neither announces nor primes (a third-party QMux client; the stock client always does one or the other) | `@johnhenry/wsh/server` | The host waits `bindTimeoutMs` (default 3000) for the stream, then drops the output and logs it. This cannot be fixed host-side: nothing about the stream has been sent, so there is nothing to bind. Such a client must send `QMuxStream.announce()` (an empty STREAM frame) or any first write -- a zero-length `write()` now does the same. |
 
 ## Attach and Resume
 
@@ -659,6 +659,7 @@ so options the platform gains later need no change here.
 | `signChallenge()` | Build transcript + sign for auth handshake |
 | `signPeerRecord()` / `verifyPeerRecord()` | Sign / verify reverse-mode peer records |
 | `fingerprint()` | SHA-256 hex fingerprint of a public key |
+| `podId()` / `fingerprintToPodId()` / `podIdToFingerprint()` | The same SHA-256 as base64url, the BrowserMesh pod ID: `await podId(raw) === await derivePodId(cryptoKey)` (`@johnhenry/browsermesh-primitives`) for the same Ed25519 key, so one key carries both the wsh fingerprint and the mesh identity. The two converters are pure re-encodings between the two forms |
 | `parseCertificateHash()` | Decode a certificate digest from hex / base64 / bytes |
 | `normalizeWebTransportOptions()` | Build a `WebTransportOptions` dictionary from loose input |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johnhenry/wsh",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Web Shell \u2014 browser-native remote command execution over WebTransport and WebSocket with Ed25519 authentication",
   "type": "module",
   "main": "./src/index.mjs",
@@ -42,6 +42,7 @@
   "devDependencies": {
     "@fails-components/webtransport": "^1.6.4",
     "@fails-components/webtransport-transport-http3-quiche": "^1.6.4",
+    "@johnhenry/browsermesh-primitives": "^0.2.0",
     "typescript": "^7.0.0",
     "ws": "^8.21.0"
   },

package/src/auth.mjs

@@ -396,7 +396,8 @@ export async function fingerprint(publicKeyRaw) {
 
 /**
  * Compute the base64url-encoded SHA-256 pod ID of a raw public key.
- * This is the BrowserMesh identity format (43 chars).
+ * This is the BrowserMesh identity format (43 chars): for the same key it equals
+ * `@johnhenry/browsermesh-primitives`' `derivePodId(cryptoKey)` and `PodIdentity.podId`.
  * @param {Uint8Array} publicKeyRaw - 32-byte raw Ed25519 public key
  * @returns {Promise<string>} base64url-encoded pod ID
  */
@@ -411,6 +412,9 @@ export async function podId(publicKeyRaw) {
  * @returns {string} base64url pod ID
  */
 export function fingerprintToPodId(hexFingerprint) {
+  if (typeof hexFingerprint !== 'string' || !/^(?:[0-9a-fA-F]{2})+$/.test(hexFingerprint)) {
+    throw new TypeError('fingerprintToPodId: expected a hex fingerprint');
+  }
   const bytes = new Uint8Array(hexFingerprint.length / 2);
   for (let i = 0; i < bytes.length; i++) {
     bytes[i] = parseInt(hexFingerprint.slice(i * 2, i * 2 + 2), 16);

package/src/index.d.ts

@@ -1004,6 +1004,26 @@ export function verifyPeerRecord(publicKey: CryptoKey, signature: Uint8Array, re
  */
 export function fingerprint(publicKeyRaw: Uint8Array): Promise<string>;
 
+/**
+ * The BrowserMesh pod ID of a raw public key: base64url (no padding, 43
+ * characters) of the SHA-256 of the 32 raw key bytes. For the same key this
+ * equals `@johnhenry/browsermesh-primitives`' `derivePodId(cryptoKey)` /
+ * `PodIdentity.podId`, and is the same hash as `fingerprint()` in a different
+ * encoding (hex there, base64url here).
+ */
+export function podId(publicKeyRaw: Uint8Array): Promise<string>;
+
+/**
+ * Re-encode a hex `fingerprint()` as a pod ID (pure; no hashing).
+ * @throws TypeError if the argument is not an even-length hex string
+ */
+export function fingerprintToPodId(hexFingerprint: string): string;
+
+/**
+ * Re-encode a pod ID as the hex `fingerprint()` of the same key (pure; no hashing).
+ */
+export function podIdToFingerprint(podId: string): string;
+
 /**
  * Get the shortest unique prefix of a fingerprint within a set.
  */

package/src/index.mjs

@@ -49,6 +49,7 @@ export {
   sign, verify, buildTranscript, signChallenge, verifyChallenge,
   buildPeerRecordTranscript, signPeerRecord, verifyPeerRecord,
   fingerprint, shortFingerprint, generateNonce,
+  podId, fingerprintToPodId, podIdToFingerprint,
   parseSSHPublicKey, extractRawFromSSHWire, base64Decode,
 } from './auth.mjs';
 

package/src/qmux-connection.mjs

@@ -116,6 +116,12 @@ class QMuxStream {
     if (this.#sendState === SEND_STATE.DATA_SENT) {
       throw new Error(`Cannot write to stream ${this.id}: already closed (FIN sent)`);
     }
+    if (bytes.byteLength === 0) {
+      // Nothing to send, but a first write is still the caller saying "this
+      // stream exists": announce it (a no-op once anything has been sent).
+      this.announce();
+      return;
+    }
     this.#sendState = SEND_STATE.SEND;
 
     let offset = 0;