@johnhenry/wsh 0.27.1 → 0.29.0

package/src/server/relay.mjs

@@ -12,15 +12,22 @@
  * Nothing is open by default: `canRegister` and `canConnect` both default to
  * "no". `from_fingerprint` is always the sender's own authenticated key, set
  * here and never taken from a payload; only the spec's `forwardable` message
- * types cross a bridge. One bridge per peer at a time, and it lasts as long as
+ * types cross a bridge.
+ *
+ * By default there is one operator per peer, and the bridge lasts as long as
  * both connections: when either ends the hub closes the other, so no
  * half-bridged state (and no processes belonging to a departed operator)
- * outlives it.
+ * outlives it. With `maxOperatorsPerPeer` > 1 a peer that states
+ * `relay-multi-operator` in its ReverseAccept may be bridged to several
+ * operators at once (#89): it addresses each reply with
+ * `RelayForward.to_fingerprint`, and is told with a `ReverseClose` when one
+ * operator leaves (instead of being closed). A peer that never stated it is
+ * still held to one operator, and still closed when its operator leaves.
  */
 
 import { cborEncode, cborDecode } from '../cbor.mjs';
 import { fingerprint as fingerprintOf, importPublicKeyRaw, verifyPeerRecord } from '../auth.mjs';
-import { MSG, isRelayForwardable, relayForward, reversePeers, reverseReject } from '../messages.gen.mjs';
+import { MSG, isRelayForwardable, relayForward, reversePeers, reverseReject, reverseClose } from '../messages.gen.mjs';
 
 export const DEFAULT_MAX_PEERS = 1024;
 export const DEFAULT_CONNECT_TIMEOUT_MS = 8000;
@@ -32,7 +39,16 @@ const MAX_FEATURE_LENGTH = 128;
 const SHORT_PREFIX_MIN = 8;
 
 /** `ReverseReject.reason` for a peer that already has an operator (or a request awaiting its answer). */
+/** `ReverseAccept.features` entry by which a peer says it serves several operators (addresses replies, understands `ReverseClose`). */
+export const MULTI_OPERATOR_FEATURE = 'relay-multi-operator';
+/** `ReverseReject.reason` for a peer that is answering another operator's request right now. */
+export const BUSY_ANSWERING = 'busy: this peer is answering another operator\'s request (retry in a moment)';
+
 export const BUSY_PEER = 'busy: this peer already has an operator (the relay bridges one operator per peer at a time; retry when it leaves)';
+/** `ReverseReject.reason` for a multi-operator peer already at the relay's operator cap. */
+export function busyPeerFull(max) {
+  return `busy: this peer already has its maximum of ${max} operators (retry when one leaves)`;
+}
 /** `ReverseReject.reason` for an operator that already has a bridge, or a request in flight. */
 export const BUSY_OPERATOR = 'busy: you already have a bridge or a pending connect on this relay (one at a time)';
 
@@ -50,21 +66,28 @@ const isStr = (v, max) => typeof v === 'string' && v.length <= max;
 export class RelayHub {
   /** @type {Map<string, { handle: RelayHandle, meta: object }>} */
   #peers = new Map();
-  /** @type {Map<RelayHandle, RelayHandle>} */
-  #pairs = new Map();
+  /** operator -> the peer it is bridged to (an operator has one bridge). @type {Map<RelayHandle, RelayHandle>} */
+  #operatorPeer = new Map();
+  /** peer -> its bridged operators, by the operator's fingerprint. @type {Map<RelayHandle, Map<string, RelayHandle>>} */
+  #peerOperators = new Map();
+  /** peers that stated `relay-multi-operator` in their last ReverseAccept. @type {WeakSet<RelayHandle>} */
+  #multiPeers = new WeakSet();
   /** target handle -> { operator, timer } while a ReverseConnect awaits its answer */
   #pending = new Map();
   /** fingerprint -> the highest record seq ever accepted (survives disconnects, bounded). */
   #lastSeq = new Map();
 
-  constructor({ canRegister, canConnect, maxPeers = DEFAULT_MAX_PEERS, connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS, log = () => {} } = {}) {
-    for (const [name, fn] of [['canRegister', canRegister], ['canConnect', canConnect]]) {
+  constructor({ canRegister, canConnect, maxPeers = DEFAULT_MAX_PEERS, maxOperatorsPerPeer = 1, connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS, onUnreachable, log = () => {} } = {}) {
+    for (const [name, fn] of [['canRegister', canRegister], ['canConnect', canConnect], ['onUnreachable', onUnreachable]]) {
       if (fn !== undefined && typeof fn !== 'function') throw new TypeError(`createWshServer: relay.${name} must be a function`);
     }
+    if (!Number.isSafeInteger(maxOperatorsPerPeer) || maxOperatorsPerPeer < 1) throw new TypeError('createWshServer: relay.maxOperatorsPerPeer must be a positive integer');
+    this.maxOperatorsPerPeer = maxOperatorsPerPeer;
     this.canRegister = canRegister ?? (() => false);
     this.canConnect = canConnect ?? (() => false);
     this.maxPeers = maxPeers;
     this.connectTimeoutMs = connectTimeoutMs;
+    this.onUnreachable = onUnreachable;
     this.log = log;
   }
 
@@ -187,20 +210,33 @@ export class RelayHub {
   async connect(operator, msg) {
     const reject = (reason) => operator.send(reverseReject({ targetFingerprint: String(msg.target_fingerprint ?? ''), username: msg.username ?? '', reason }));
     const target = this.#find(msg.target_fingerprint);
+    if (!target && this.onUnreachable) {
+      // Tell the host application nobody is registered under that name (it may know another way to reach them, e.g. a
+      // push notification). Fire and forget: it never changes the answer, and a throw is logged, not propagated.
+      try {
+        Promise.resolve(this.onUnreachable({ username: operator.username, fingerprint: operator.fingerprint }, String(msg.target_fingerprint ?? ''), { username: msg.username }))
+          .catch((e) => this.log(`relay onUnreachable threw: ${e.message}`));
+      } catch (e) { this.log(`relay onUnreachable threw: ${e.message}`); }
+    }
     // Unknown, unreachable-by-policy and self look the same to the caller.
     if (!target || target.handle === operator
       || !(await this.#allowed(this.canConnect, { username: operator.username, fingerprint: operator.fingerprint }, {
         fingerprint: target.meta.fingerprint, username: target.meta.username, capabilities: target.meta.capabilities,
       }))) return reject('no such peer');
     if (this.#peers.get(target.meta.fingerprint) !== target) return reject('no such peer');
-    // One bridge per peer, and one per operator: a RelayForward names its sender but not its recipient, so a
-    // peer's reply could not be addressed to one of several operators (see the README's relay section).
-    if (this.#pairs.has(target.handle) || this.#pending.has(target.handle)) {
-      return reject(BUSY_PEER);
-    }
-    if (this.#pairs.has(operator) || [...this.#pending.values()].some((p) => p.operator === operator)) {
+    // One bridge per operator. A peer serves one operator unless the relay allows more AND the peer said it can
+    // address them (RelayForward.to_fingerprint) and be told when one leaves (ReverseClose); it also answers one
+    // request at a time, since a ReverseAccept does not name the operator it answers.
+    if (this.bridged(operator) || [...this.#pending.values()].some((p) => p.operator === operator)) {
       return reject(BUSY_OPERATOR);
     }
+    if (this.#pending.has(target.handle)) return reject(this.maxOperatorsPerPeer > 1 ? BUSY_ANSWERING : BUSY_PEER);
+    const serving = this.#peerOperators.get(target.handle);
+    if (serving?.size) {
+      if (this.maxOperatorsPerPeer < 2 || !this.#multiPeers.has(target.handle)) return reject(BUSY_PEER);
+      if (serving.has(operator.fingerprint)) return reject(BUSY_OPERATOR);
+      if (serving.size >= this.maxOperatorsPerPeer) return reject(busyPeerFull(this.maxOperatorsPerPeer));
+    }
     const timer = setTimeout(() => {
       if (this.#pending.get(target.handle)?.operator !== operator) return;
       this.#pending.delete(target.handle);
@@ -232,26 +268,39 @@ export class RelayHub {
     }
     p.operator.send(answer);
     if (msg.type === MSG.REVERSE_ACCEPT) {
-      this.#pairs.set(p.operator, peer);
-      this.#pairs.set(peer, p.operator);
+      if (Array.isArray(answer.features) && answer.features.includes(MULTI_OPERATOR_FEATURE)) this.#multiPeers.add(peer);
+      else this.#multiPeers.delete(peer);
+      this.#operatorPeer.set(p.operator, peer);
+      let ops = this.#peerOperators.get(peer);
+      if (!ops) this.#peerOperators.set(peer, ops = new Map());
+      ops.set(p.operator.fingerprint, p.operator);
       this.log(`relay: bridged ${p.operator.fingerprint.slice(0, 12)} <-> ${peer.fingerprint.slice(0, 12)}`);
     }
   }
 
   /** Is `handle` one end of a bridge? */
   bridged(handle) {
-    return this.#pairs.has(handle);
+    return this.#operatorPeer.has(handle) || (this.#peerOperators.get(handle)?.size ?? 0) > 0;
+  }
+
+  /** Fingerprints of the operators bridged to the peer with this fingerprint. */
+  operatorsOf(peerFingerprint) {
+    const peer = this.#peers.get(peerFingerprint)?.handle;
+    return peer ? [...(this.#peerOperators.get(peer)?.keys() ?? [])] : [];
   }
 
   /**
    * Carry a message across `handle`'s bridge. A plain forwardable message is
    * wrapped; a `RelayForward` the client wrote itself is unwrapped, its inner
    * checked, and re-wrapped -- either way `from_fingerprint` is the sender's
-   * authenticated key. Returns false when there is no bridge.
+   * authenticated key. A peer serving several operators names the recipient
+   * with `to_fingerprint` (never set on what is delivered); with one operator
+   * it may leave it out. Returns false when there is no bridge.
    */
   forward(handle, msg) {
-    const partner = this.#pairs.get(handle);
-    if (!partner) return false;
+    const partner = this.#recipient(handle, msg);
+    if (partner === undefined) return false;
+    if (partner === null) return true; // bridged, but the message could not be addressed: dropped (and logged)
     let inner;
     if (msg.type === MSG.RELAY_FORWARD) {
       if (!(msg.inner instanceof Uint8Array) || msg.inner.byteLength > MAX_FORWARD_BYTES) { this.log('relay: dropped an oversized or malformed RelayForward'); return true; }
@@ -270,6 +319,27 @@ export class RelayHub {
     return true;
   }
 
+  /**
+   * Who `msg` from `handle` goes to: the partner handle; `undefined` if `handle` has no bridge (the caller
+   * treats the message as an ordinary one); `null` if it has one but the recipient cannot be determined.
+   */
+  #recipient(handle, msg) {
+    const peer = this.#operatorPeer.get(handle);
+    if (peer) return peer; // an operator has exactly one bridge
+    const operators = this.#peerOperators.get(handle);
+    if (!operators || operators.size === 0) return undefined;
+    const to = msg.type === MSG.RELAY_FORWARD ? msg.to_fingerprint : undefined;
+    if (to !== undefined) {
+      const operator = typeof to === 'string' ? operators.get(to) : undefined;
+      if (operator) return operator;
+      this.log(`relay: dropped a forward from ${handle.fingerprint.slice(0, 12)} addressed to ${typeof to === 'string' ? to.slice(0, 12) : '?'}, which is not one of its operators`);
+      return null;
+    }
+    if (operators.size === 1) return operators.values().next().value;
+    this.log(`relay: dropped an unaddressed forward from ${handle.fingerprint.slice(0, 12)}, which serves ${operators.size} operators (to_fingerprint is required)`);
+    return null;
+  }
+
   /** A connection ended: forget it, and end the bridge it was part of. */
   drop(handle) {
     const entry = this.#peers.get(handle.fingerprint);
@@ -279,11 +349,28 @@ export class RelayHub {
     for (const [target, pend] of this.#pending) {
       if (pend.operator === handle) { clearTimeout(pend.timer); this.#pending.delete(target); }
     }
-    const partner = this.#pairs.get(handle);
-    if (partner) {
-      this.#pairs.delete(handle);
-      this.#pairs.delete(partner);
-      partner.close();
+    // An operator leaving.
+    const peer = this.#operatorPeer.get(handle);
+    if (peer) {
+      this.#operatorPeer.delete(handle);
+      const operators = this.#peerOperators.get(peer);
+      operators?.delete(handle.fingerprint);
+      if (this.maxOperatorsPerPeer > 1 && this.#multiPeers.has(peer)) {
+        // The peer serves others too (or may serve more): tell it which operator left instead of closing it.
+        peer.send(reverseClose({ targetFingerprint: handle.fingerprint, reason: 'operator left' }));
+      } else {
+        this.#peerOperators.delete(peer);
+        peer.close();
+      }
+    }
+    // A peer leaving: every operator bridged to it goes with it.
+    const operators = this.#peerOperators.get(handle);
+    if (operators) {
+      this.#peerOperators.delete(handle);
+      for (const operator of operators.values()) {
+        this.#operatorPeer.delete(operator);
+        operator.close();
+      }
     }
   }
 
@@ -291,7 +378,8 @@ export class RelayHub {
   closeAll() {
     for (const p of this.#pending.values()) clearTimeout(p.timer);
     this.#pending.clear();
-    this.#pairs.clear();
+    this.#operatorPeer.clear();
+    this.#peerOperators.clear();
     this.#peers.clear();
   }
 }

package/src/server/reverse-host.mjs

@@ -7,11 +7,18 @@
  * The relay has already authenticated the operator (its key), so the bridged
  * connection is pre-authenticated; what a relay-asserted identity is worth is
  * yours to decide in `accept`, which defaults to refusing everyone.
+ *
+ * One operator at a time by default. With `maxOperators` > 1 (and a relay
+ * configured with `relay.maxOperatorsPerPeer`) several operators are served at
+ * once, each with its own connection state -- channels, processes, files -- and
+ * when one leaves only what belongs to it is cleaned up (wsh #89).
  */
 
 import { WshClient } from '../client.mjs';
 import { exportPublicKeyRaw, fingerprint } from '../auth.mjs';
 import { reverseAccept, reverseReject } from '../messages.gen.mjs';
+import { MULTI_OPERATOR_FEATURE } from './relay.mjs';
+import { E2E_SIGN_FEATURE } from '../e2e-exchange.mjs';
 import { buildBackends } from './backends.mjs';
 import { createConnectionFactory, hostFeatures } from './connection.mjs';
 
@@ -32,18 +39,37 @@ const BACKOFF_MAX_MS = 30_000;
  * @param {boolean} [options.reconnect=true] - Dial again (with backoff) after the relay connection ends. A relay ends it when a bridge does.
  * @param {object} [options.connect] - Extra options for the relay connection (`expectHostKey`, `knownHosts`, ...).
  * @param {string} [options.peerType='host']
+ * @param {false | { sign?: boolean | 'auto', hybrid?: boolean }} [options.e2e] - End-to-end encryption for the bridged operator (wsh #90).
+ *   On by default: this host answers an operator's `KeyExchange` (for a session it has opened), then seals that
+ *   session's output and opens its input as `EncryptedFrame`s the relay cannot read, and ignores plaintext input for it.
+ *   `sign` signs the reply with `keyPair` so the operator can authenticate this host
+ *   (`initiateE2E(..., { verifyPeer })`). Default `'auto'`: sign when the relay says (`e2e-sign` in its ServerHello) it
+ *   carries a signed `KeyExchange` -- a relay that predates the `signature` field (a Rust relay built before it)
+ *   would drop the connection on one. `true` signs regardless; `false` never does. `hybrid` (default true) offers
+ *   X25519+ML-KEM-768 when asked.
+ *   `false` turns the layer off: no `e2e` feature, `KeyExchange` unanswered.
+ * @param {number} [options.maxOperators=1] - Operators served at once. Above 1 this host states `relay-multi-operator`
+ *   (it addresses each reply to its operator and handles `ReverseClose`), so it needs `reportFeatures` and a relay with
+ *   `relay.maxOperatorsPerPeer` above 1 (which says so in its ServerHello); against any other relay it serves one
+ *   operator, as before. Each operator is passed through `accept` on its own identity.
  * @param {boolean} [options.reportFeatures=true] - State this host's features in `ReverseAccept.features`, so the operator's
  *   feature gates follow this host rather than the relay. Turn off only for a relay (a Rust `wsh-server` older than the field)
  *   that rejects a `ReverseAccept` carrying it.
  * @param {(line: string) => void} [options.onLog]
  */
 export function createReverseHost({
-  url, username, keyPair, accept, exec, pty, fs, mcp, reconnect = true, connect = {}, peerType = 'host', reportFeatures = true, onLog = () => {},
+  url, username, keyPair, accept, exec, pty, fs, mcp, reconnect = true, connect = {}, peerType = 'host', reportFeatures = true, maxOperators = 1, e2e = {}, onLog = () => {},
 } = {}) {
   if (!url) throw new TypeError('createReverseHost: url is required');
   if (!username) throw new TypeError('createReverseHost: username is required');
   if (!keyPair) throw new TypeError('createReverseHost: keyPair is required (the relay keys peers by fingerprint)');
   if (accept !== undefined && typeof accept !== 'function') throw new TypeError('createReverseHost: accept must be a function');
+  if (!Number.isSafeInteger(maxOperators) || maxOperators < 1) throw new TypeError('createReverseHost: maxOperators must be a positive integer');
+  if (maxOperators > 1 && !reportFeatures) throw new TypeError('createReverseHost: maxOperators > 1 needs reportFeatures (the relay learns "relay-multi-operator" from ReverseAccept.features)');
+  if (e2e !== false && (e2e === null || typeof e2e !== 'object')) throw new TypeError('createReverseHost: e2e must be false or an options object');
+  const multi = maxOperators > 1;
+  if (e2e !== false && e2e.sign !== undefined && e2e.sign !== 'auto' && typeof e2e.sign !== 'boolean') throw new TypeError("createReverseHost: e2e.sign must be true, false or 'auto'");
+  const e2eSign = e2e === false ? false : (e2e.sign ?? 'auto');
 
   const backends = buildBackends({ exec, pty, fs, mcp });
   const expose = { shell: !!backends.pty, exec: !!backends.execRunner, fs: !!backends.files, tools: !!backends.mcp };
@@ -51,14 +77,27 @@ export function createReverseHost({
   const shellBackend = backends.pty ? 'pty' : 'exec-only';
   // What this host can do over a bridge, for the operator's feature gates (`ReverseAccept.features`).
   // `reportFeatures: false` leaves them out (a Rust peer or relay older than the field rejects a ReverseAccept that has it).
-  const bridgeFeatures = hostFeatures({ mcp: backends.mcp, files: backends.files }, { dataStreams: false });
+  /** What this host does with end-to-end encryption on a given relay connection (null = off). */
+  const e2eFor = (c) => (e2e === false ? null : {
+    signKey: e2eSign === true || (e2eSign === 'auto' && c.hasFeature(E2E_SIGN_FEATURE)) ? keyPair.privateKey : null,
+    hybrid: e2e.hybrid !== false,
+  });
+  /** Features for `ReverseAccept` on this relay connection. */
+  const bridgeFeatures = (c, e2eConfig, manyOperators) => [
+    ...hostFeatures({ mcp: backends.mcp, files: backends.files, e2e: e2eConfig }, { dataStreams: false }),
+    ...(manyOperators ? [MULTI_OPERATOR_FEATURE] : []),
+  ];
   const factory = createConnectionFactory({
     authorize: async () => false, methods: { pubkey: false, password: null }, hostKey: null, rateLimit: null,
     execRunner: backends.execRunner, execOptions: backends.execOptions, pty: backends.pty, files: backends.files, mcp: backends.mcp,
-    sessions: null, relay: null, bindTimeoutMs: 3000, log: (l) => onLog(`[reverse] ${l}`),
+    sessions: null, relay: null, e2e: null, bindTimeoutMs: 3000, log: (l) => onLog(`[reverse] ${l}`),
   });
 
   let client = null;
+  /** The live connection's bridges (operator fingerprint -> connection), for `operators`. */
+  let operatorsNow = new Map();
+  /** Ends every bridge of the live connection (the client's own `disconnect()` does not call its `onClose`). */
+  let endAllBridges = () => {};
   let myFingerprint = null;
   let closed = false;
   let timer = null;
@@ -66,40 +105,63 @@ export function createReverseHost({
 
   async function dial() {
     const c = new WshClient();
-    let bridge = null;
-    let operator = null;
+    /** operator fingerprint -> that operator's connection (its own channels, processes, files). */
+    const bridges = new Map();
+    // Several operators only on a relay that says it can route to them; anywhere else, one, and bare messages.
+    const manyOperators = () => multi && c.hasFeature(MULTI_OPERATOR_FEATURE);
+    const operatorLimit = () => (manyOperators() ? maxOperators : 1);
+    /** Operators whose `accept` is still running: they count towards the cap. */
+    const reserved = new Set();
+    operatorsNow = bridges;
 
-    const endBridge = () => {
-      if (operator) c.untrustRelayPeer(operator);
-      bridge?.close();
-      bridge = null;
-      operator = null;
+    const endBridge = (fp) => {
+      const bridge = bridges.get(fp);
+      if (!bridge) return;
+      bridges.delete(fp);
+      c.untrustRelayPeer(fp);
+      bridge.close();
+      onLog(`[reverse] operator ${fp.slice(0, 12)} left (${bridges.size} still bridged)`);
     };
-    c.onRelayMessage = (msg) => bridge?.receiveMessage(msg);
+    const endAll = () => { for (const fp of [...bridges.keys()]) endBridge(fp); };
+    endAllBridges = endAll;
+    c.onRelayMessage = (msg, from) => bridges.get(from)?.receiveMessage(msg);
+    // The relay says one operator left; the others carry on (it sends this only to a host that stated multi-operator support).
+    c.onReverseClose = (m) => endBridge(String(m.target_fingerprint ?? ''));
     c.onReverseConnect = async (req) => {
       const from = req.from_fingerprint;
       const answer = (m) => c.sendRelayControl(m).catch(() => {});
       const refuse = (reason) => answer(reverseReject({ targetFingerprint: myFingerprint, username, reason }));
-      if (bridge || typeof from !== 'string' || !from) { await refuse('busy: this host is already serving an operator'); return; }
+      if (typeof from !== 'string' || !from) { await refuse('busy: this host is already serving an operator'); return; }
+      if (bridges.has(from) || reserved.has(from)) { await refuse('busy: you already have a bridge with this host'); return; }
+      if (bridges.size + reserved.size >= operatorLimit()) {
+        await refuse(manyOperators() ? `busy: this host is already serving its maximum of ${maxOperators} operators` : 'busy: this host is already serving an operator');
+        return;
+      }
+      reserved.add(from);
       let ok = false;
-      try { ok = (await accept?.({ fingerprint: from, username: String(req.username ?? '') })) === true; } catch (e) { onLog(`[reverse] accept threw: ${e.message}`); }
-      if (!ok || bridge) { await refuse('not accepted'); return; }
-      c.trustRelayPeer(from);
-      operator = from;
-      bridge = factory({
-        sendMessage: (m) => c.sendRelayControl(m),
-        authenticated: { username: String(req.username ?? 'operator'), fingerprint: from },
-        dataStreams: false,
-      });
-      onLog(`[reverse] bridged to ${from.slice(0, 12)}`);
-      await answer(reverseAccept({
-        targetFingerprint: myFingerprint, username, capabilities, peerType, shellBackend,
-        supportsAttach: false, supportsReplay: false, supportsEcho: false, supportsTermSync: false,
-        features: reportFeatures ? bridgeFeatures : undefined,
-      }));
+      try {
+        try { ok = (await accept?.({ fingerprint: from, username: String(req.username ?? '') })) === true; } catch (e) { onLog(`[reverse] accept threw: ${e.message}`); }
+        if (!ok || bridges.size >= operatorLimit()) { await refuse('not accepted'); return; }
+        c.trustRelayPeer(from);
+        const bridge = factory({
+          // With several operators every message names its recipient; with one the relay knows.
+          sendMessage: (m) => c.sendRelayControl(m, manyOperators() ? { to: from } : undefined),
+          authenticated: { username: String(req.username ?? 'operator'), fingerprint: from },
+          dataStreams: false,
+          e2e: e2eFor(c),
+        });
+        bridges.set(from, bridge);
+        onLog(`[reverse] bridged to ${from.slice(0, 12)}`);
+        await answer(reverseAccept({
+          targetFingerprint: myFingerprint, username, capabilities, peerType, shellBackend,
+          supportsAttach: false, supportsReplay: false, supportsEcho: false, supportsTermSync: false,
+          features: reportFeatures ? bridgeFeatures(c, e2eFor(c), manyOperators()) : undefined,
+        }));
+      } finally { reserved.delete(from); }
     };
     c.onClose = () => {
-      endBridge();
+      endAll();
+      if (operatorsNow === bridges) operatorsNow = new Map();
       if (client === c) client = null;
       if (closed || !reconnect) return;
       onLog(`[reverse] relay connection ended; redialling in ${backoff}ms`);
@@ -144,11 +206,14 @@ export function createReverseHost({
       clearTimeout(timer);
       const c = client;
       client = null;
+      endAllBridges(); // no operator's process may outlive the host
       await c?.disconnect().catch(() => {});
     },
     /** This host's fingerprint (what operators `reverseConnect()` to); `null` before `start()`. */
     get fingerprint() { return myFingerprint; },
     /** Is the relay connection up right now? */
     get connected() { return client !== null; },
+    /** Fingerprints of the operators bridged right now. */
+    get operators() { return [...operatorsNow.keys()]; },
   };
 }