@kangentic/protocol 0.11.0 → 0.11.1

package/dist/index.cjs

@@ -5833,14 +5833,34 @@ function parseCapabilityRequestPayload(verb, payload) {
 
 // src/pairing/relay-address.ts
 var MAX_RELAY_ADDRESS_LENGTH = 512;
-var LOOPBACK_WS_PREFIXES = ["ws://localhost", "ws://127.0.0.1", "ws://[::1]"];
+var LOOPBACK_WS_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var PLAINTEXT_SCHEME = "ws://";
+function hostWithoutPort(authority) {
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) return null;
+    const afterLiteral = authority.slice(closingBracket + 1);
+    if (afterLiteral !== "" && !/^:[0-9]+$/.test(afterLiteral)) return null;
+    return authority.slice(0, closingBracket + 1);
+  }
+  const portSeparator = authority.lastIndexOf(":");
+  if (portSeparator === -1) return authority;
+  const port = authority.slice(portSeparator + 1);
+  return /^[0-9]+$/.test(port) ? authority.slice(0, portSeparator) : authority;
+}
+function plaintextRelayHost(relayAddress) {
+  if (!relayAddress.startsWith(PLAINTEXT_SCHEME)) return null;
+  const afterScheme = relayAddress.slice(PLAINTEXT_SCHEME.length);
+  const authorityEnd = afterScheme.search(/[/?#]/);
+  const authority = authorityEnd === -1 ? afterScheme : afterScheme.slice(0, authorityEnd);
+  if (authority.includes("@")) return null;
+  const host = hostWithoutPort(authority);
+  return host === null ? null : host.toLowerCase();
+}
 function isSecureRelayAddress(relayAddress) {
   if (relayAddress.startsWith("wss://")) return true;
-  return LOOPBACK_WS_PREFIXES.some((prefix) => {
-    if (!relayAddress.startsWith(prefix)) return false;
-    const boundaryChar = relayAddress.charAt(prefix.length);
-    return boundaryChar === "" || boundaryChar === ":" || boundaryChar === "/" || boundaryChar === "?" || boundaryChar === "#";
-  });
+  const host = plaintextRelayHost(relayAddress);
+  return host !== null && LOOPBACK_WS_HOSTS.includes(host);
 }
 
 // src/pairing/qr.ts

package/dist/index.mjs

@@ -5716,14 +5716,34 @@ function parseCapabilityRequestPayload(verb, payload) {
 
 // src/pairing/relay-address.ts
 var MAX_RELAY_ADDRESS_LENGTH = 512;
-var LOOPBACK_WS_PREFIXES = ["ws://localhost", "ws://127.0.0.1", "ws://[::1]"];
+var LOOPBACK_WS_HOSTS = ["localhost", "127.0.0.1", "[::1]"];
+var PLAINTEXT_SCHEME = "ws://";
+function hostWithoutPort(authority) {
+  if (authority.startsWith("[")) {
+    const closingBracket = authority.indexOf("]");
+    if (closingBracket === -1) return null;
+    const afterLiteral = authority.slice(closingBracket + 1);
+    if (afterLiteral !== "" && !/^:[0-9]+$/.test(afterLiteral)) return null;
+    return authority.slice(0, closingBracket + 1);
+  }
+  const portSeparator = authority.lastIndexOf(":");
+  if (portSeparator === -1) return authority;
+  const port = authority.slice(portSeparator + 1);
+  return /^[0-9]+$/.test(port) ? authority.slice(0, portSeparator) : authority;
+}
+function plaintextRelayHost(relayAddress) {
+  if (!relayAddress.startsWith(PLAINTEXT_SCHEME)) return null;
+  const afterScheme = relayAddress.slice(PLAINTEXT_SCHEME.length);
+  const authorityEnd = afterScheme.search(/[/?#]/);
+  const authority = authorityEnd === -1 ? afterScheme : afterScheme.slice(0, authorityEnd);
+  if (authority.includes("@")) return null;
+  const host = hostWithoutPort(authority);
+  return host === null ? null : host.toLowerCase();
+}
 function isSecureRelayAddress(relayAddress) {
   if (relayAddress.startsWith("wss://")) return true;
-  return LOOPBACK_WS_PREFIXES.some((prefix) => {
-    if (!relayAddress.startsWith(prefix)) return false;
-    const boundaryChar = relayAddress.charAt(prefix.length);
-    return boundaryChar === "" || boundaryChar === ":" || boundaryChar === "/" || boundaryChar === "?" || boundaryChar === "#";
-  });
+  const host = plaintextRelayHost(relayAddress);
+  return host !== null && LOOPBACK_WS_HOSTS.includes(host);
 }
 
 // src/pairing/qr.ts

package/dist/pairing/relay-address.d.ts

@@ -1,6 +1,7 @@
 /**
- * Relay address rules shared, byte-for-byte, with the mobile app's
- * src/pairing/qr.ts. This module imports nothing on purpose: it is
+ * Relay address rules, mirrored by the mobile app's src/pairing/qr.ts (which
+ * hardened these rules first; this module now matches it). This module
+ * imports nothing on purpose: it is
  * deep-imported by the desktop's src/shared/relay.ts, which the RENDERER
  * bundles, and pulling in the rest of this package (crypto/primitives ->
  * @noble/*) would drag Noise crypto into that bundle for no reason. Keep it
@@ -10,9 +11,14 @@ export declare const MAX_RELAY_ADDRESS_LENGTH = 512;
 /**
  * True if the phone's pairing QR scanner will accept this relay address.
  * wss:// is always secure; ws:// is accepted only for loopback, since the
- * pairing token doubles as the Noise PSK and is dialed verbatim as
- * `?slot=`. Prefix-based (not hostname-based) with an explicit boundary
- * check, so `ws://localhost.evil.com` - a hostname that merely starts with
- * the string "localhost" - is rejected rather than treated as loopback.
+ * pairing token doubles as the Noise PSK and is dialed verbatim as `?slot=`.
+ *
+ * Parses the AUTHORITY rather than prefix-matching. Prefix matching accepted
+ * `ws://127.0.0.1:8080@evil.test`: everything before an '@' is userinfo, so
+ * that address dials evil.test while looking like loopback, putting the PSK
+ * on the wire in cleartext to an attacker-chosen host - and the pairing then
+ * persists that host to the trust anchor for every later session. Authority
+ * parsing also subsumes the old boundary check, since `localhost.evil.com`
+ * is simply a different host.
  */
 export declare function isSecureRelayAddress(relayAddress: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kangentic/protocol",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Kangentic mobile bridge wire protocol: framing, Noise-based pairing and session handshakes, signed device roster, and capability verbs shared between desktop and mobile.",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",