@lornatang/dsh-frontgate 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.2 - 2026-11-12
+
+- Persist session revocations on sign-out, reject alternate token encodings,
+  and close WebSockets on sign-out, expiry, or shutdown.
+- Bound per-peer connections and incomplete logins; cancel disconnected clients
+  and time out stalled upstream HTTP responses without cutting off active streams.
+- Verify HTTPS harness certificates, refresh stale harness cookies after a 401,
+  and return an HTTP error for oversized chunked login forms.
+- Document Docker port mapping and add security, browser and proxy regression tests.
+
 ## 0.1.1 - 2026-11-12
 
 - Publish as `@lornatang/dsh-frontgate`; install with `dsh plugin` using the

package/README.md

@@ -61,6 +61,11 @@ its port must differ from the harness port.
 | `publicOrigin` | empty | External origin when a reverse proxy terminates HTTPS. |
 | `trustProxy` | `false` | Use client IPs supplied by a trusted proxy. |
 | `exchangeTimeoutMs` | `5000` | Harness token exchange timeout in milliseconds. |
+| `maxConnectionsPerPeer` | `64` | Simultaneous TCP connections per peer; `0` disables this limit. |
+| `maxPendingLoginsPerIp` | `4` | Incomplete login forms allowed per client IP. |
+| `upstreamHeaderTimeoutMs` | `60000` | Upstream response-header deadline, including queue time; `0` disables. |
+| `upstreamIdleTimeoutMs` | `300000` | Upstream response idle deadline; `0` disables. |
+| `upstreamCaFile` / `upstreamServerName` | empty | CA file and optional TLS hostname for a private HTTPS harness. |
 | `title` | `DeepSeek Harness` | Login page title. |
 
 Password precedence is configured hash, configured password,
@@ -73,13 +78,24 @@ correct passwords, until it expires; clients behind the same NAT may share it.
 For Docker, set `listenHost: '0.0.0.0'` and publish the gate port, for example:
 
 ```yaml
+# ~/.dsh/profiles/web/cordis.patch.yml
+- id: frontgate
+  config:
+    listenHost: '0.0.0.0'
+    listenPort: 30010
+```
+
+```yaml
+# Docker Compose
 ports:
-  - '30190:3090'
+  - '30190:30010'
 ```
 
-Then open `http://<host-ip>:30190`. Keep the harness itself on loopback so it
-cannot bypass the gate. HTTP exposes passwords and cookies; use a trusted LAN,
-VPN, or HTTPS.
+Restart DSH after editing its profile, then open `http://<host-ip>:30190`. The
+container port in the mapping must equal `listenPort`; the external port can
+be different. Leave `publicOrigin` empty and `trustProxy` disabled for direct
+HTTP access. Keep the harness itself on loopback so it cannot bypass the gate.
+HTTP exposes passwords and cookies; use a trusted LAN, VPN, or HTTPS.
 
 Use a dedicated hostname or IP for the gate. Browser cookies are shared by
 all ports on the same hostname or IP, so an untrusted service on another port
@@ -91,6 +107,15 @@ any non-default port (Nginx: `proxy_set_header Host $http_host;`). Restrict
 direct access to the gate listener to the proxy. If `trustProxy` is enabled,
 the proxy must replace client-supplied `X-Forwarded-For` with the real client
 IP (Nginx: `proxy_set_header X-Forwarded-For $remote_addr;`).
+`maxConnectionsPerPeer` counts the TCP peer, so proxied connections share the
+proxy's limit. Adjust the limit for expected traffic and apply per-client limits
+at the proxy when appropriate.
+
+HTTPS harness certificates and hostnames are verified. For a private CA, set
+`upstreamCaFile` to its PEM file; if the harness origin is an IP but its
+certificate names a DNS host, also set `upstreamServerName` to that host.
+For a stream that may be silent for more than five minutes, raise or disable
+`upstreamIdleTimeoutMs`.
 
 ## Troubleshooting
 
@@ -98,7 +123,8 @@ IP (Nginx: `proxy_set_header X-Forwarded-For $remote_addr;`).
   reused. Set `password` and remove `passwordHash` to change it; this signs out
   existing sessions.
 - **Cannot connect:** Check `listenHost`, the gate's startup log and the Docker
-  port mapping. To sign out, visit `/__gate/logout`.
+  port mapping. The gate port must match the container side of the mapping.
+  To sign out, visit `/__gate/logout`.
 - **Origin or host check fails:** Verify `publicOrigin` and the proxy's `Host`.
 - **State file error:** Restore a trusted backup and ensure the file is owned
   by the DSH user with mode `0600`. If no backup exists, stop DSH and move the
@@ -106,7 +132,9 @@ IP (Nginx: `proxy_set_header X-Forwarded-For $remote_addr;`).
 
 The state file is `~/.dsh/profiles/<name>/data/dsh-frontgate.json`. Keep it and
 its parent directories accessible only to trusted users. On Windows, use ACLs
-to restrict access.
+to restrict access. Sign-out revocations persist across restarts; each profile
+must have only one running gate instance. Expired revocations are removed on
+sign-out, and a full or unwritable revocation store makes sign-out fail safely.
 
 ## Development
 

package/lib/index.js

@@ -19,7 +19,13 @@ var DEFAULTS = {
   trustProxy: false,
   maxAttempts: 5,
   lockMinutes: 5,
-  exchangeTimeoutMs: 5e3
+  exchangeTimeoutMs: 5e3,
+  maxConnectionsPerPeer: 64,
+  maxPendingLoginsPerIp: 4,
+  upstreamHeaderTimeoutMs: 6e4,
+  upstreamIdleTimeoutMs: 3e5,
+  upstreamCaFile: "",
+  upstreamServerName: ""
 };
 var Config = z.object({
   listenHost: z.string().default(DEFAULTS.listenHost),
@@ -34,7 +40,13 @@ var Config = z.object({
   trustProxy: z.boolean().default(DEFAULTS.trustProxy),
   maxAttempts: z.natural().min(1).max(50).default(DEFAULTS.maxAttempts),
   lockMinutes: z.natural().min(1).max(1440).default(DEFAULTS.lockMinutes),
-  exchangeTimeoutMs: z.natural().min(100).max(6e4).default(DEFAULTS.exchangeTimeoutMs)
+  exchangeTimeoutMs: z.natural().min(100).max(6e4).default(DEFAULTS.exchangeTimeoutMs),
+  maxConnectionsPerPeer: z.natural().max(1024).default(DEFAULTS.maxConnectionsPerPeer),
+  maxPendingLoginsPerIp: z.natural().min(1).max(128).default(DEFAULTS.maxPendingLoginsPerIp),
+  upstreamHeaderTimeoutMs: z.natural().max(36e5).default(DEFAULTS.upstreamHeaderTimeoutMs),
+  upstreamIdleTimeoutMs: z.natural().max(36e5).default(DEFAULTS.upstreamIdleTimeoutMs),
+  upstreamCaFile: z.string().default(DEFAULTS.upstreamCaFile),
+  upstreamServerName: z.string().default(DEFAULTS.upstreamServerName)
 });
 
 // src/auth.ts
@@ -133,6 +145,7 @@ function verifyToken(secret, pv, token) {
   if (parts.length !== 6) return false;
   const [version, iat, exp, nonce, tokenPv, mac] = parts;
   if (version !== TOKEN_VERSION || tokenPv !== pv) return false;
+  if (!/^[A-Za-z0-9_-]{22}$/.test(nonce) || !/^[A-Za-z0-9_-]{43}$/.test(mac)) return false;
   const now = Math.floor(Date.now() / 1e3);
   const issued = Number(iat);
   const expires = Number(exp);
@@ -146,7 +159,7 @@ function verifyToken(secret, pv, token) {
   } catch {
     return false;
   }
-  return got.length === want.length && timingSafeEqual(got, want);
+  return got.length === want.length && got.toString("base64url") === mac && timingSafeEqual(got, want);
 }
 function sessionCookie(value, seconds, useTls) {
   const attrs = [COOKIE + "=" + value, "Path=/", "HttpOnly", "SameSite=Lax", "Max-Age=" + seconds];
@@ -270,13 +283,14 @@ function readForm(req) {
     };
     const timer = setTimeout(() => {
       fail(new Error("timeout"));
-      req.destroy();
+      req.resume();
     }, FORM_TIMEOUT);
     req.on("data", (chunk) => {
+      if (settled) return;
       size += chunk.length;
       if (size > MAX_FORM) {
         fail(new Error("too large"));
-        req.destroy();
+        req.resume();
         return;
       }
       chunks.push(chunk);
@@ -337,12 +351,24 @@ function sendUpstreamError(res) {
   text(res, 502, "dsh-frontgate: upstream unreachable\n");
 }
 function createProxy(options) {
-  const { targetOrigin, publicProto, trustProxy, exchangeTimeoutMs, authenticatedUrl, log } = options;
+  const {
+    targetOrigin,
+    publicProto,
+    trustProxy,
+    exchangeTimeoutMs,
+    upstreamHeaderTimeoutMs,
+    upstreamIdleTimeoutMs,
+    upstreamCa,
+    upstreamServerName,
+    authenticatedUrl,
+    log
+  } = options;
   const target = new URL(targetOrigin);
   const secureUpstream = target.protocol === "https:";
   const transport = secureUpstream ? https : http;
   const AgentClass = secureUpstream ? https.Agent : http.Agent;
   const upstreamAgent = new AgentClass({ keepAlive: true, maxSockets: 128, keepAliveMsecs: 1e3 });
+  const tlsOptions = secureUpstream ? { ...upstreamCa ? { ca: upstreamCa } : {}, ...upstreamServerName ? { servername: upstreamServerName } : {} } : {};
   const exchanges = /* @__PURE__ */ new Set();
   function exchangeHarnessCookie() {
     const url = new URL(authenticatedUrl(targetOrigin + "/"));
@@ -362,7 +388,7 @@ function createProxy(options) {
         path: url.pathname + url.search,
         method: "GET",
         headers: { host: target.host, accept: "text/html" },
-        ...secureUpstream ? { rejectUnauthorized: false } : {}
+        ...tlsOptions
       }, (res) => {
         res.resume();
         const lines = res.headers["set-cookie"] || [];
@@ -378,6 +404,9 @@ function createProxy(options) {
   }
   let harnessCache = { value: "", at: 0 };
   let harnessInflight = null;
+  function invalidateHarnessCookie(cookie) {
+    if (harnessCache.value === cookie) harnessCache = { value: "", at: 0 };
+  }
   function harnessCookie() {
     if (harnessCache.value && Date.now() - harnessCache.at < HARNESS_COOKIE_TTL) return Promise.resolve(harnessCache.value);
     if (harnessInflight) return harnessInflight;
@@ -411,6 +440,15 @@ function createProxy(options) {
   }
   function forward(req, res, cookie) {
     const started = Date.now();
+    let headerTimer;
+    let idleTimer;
+    let timedOut = false;
+    const clearTimers = () => {
+      if (headerTimer) clearTimeout(headerTimer);
+      if (idleTimer) clearTimeout(idleTimer);
+      headerTimer = void 0;
+      idleTimer = void 0;
+    };
     const proxyReq = transport.request({
       agent: upstreamAgent,
       host: connectHost(target.hostname),
@@ -418,8 +456,14 @@ function createProxy(options) {
       method: req.method,
       path: req.url,
       headers: upstreamHeaders(req, cookie),
-      ...secureUpstream ? { rejectUnauthorized: false } : {}
+      ...tlsOptions
     }, (proxyRes) => {
+      if (headerTimer) clearTimeout(headerTimer);
+      headerTimer = void 0;
+      if (res.destroyed) {
+        proxyRes.destroy();
+        return;
+      }
       const headers = {};
       for (const [key, value] of Object.entries(proxyRes.headers)) {
         if (!RESPONSE_DROP.has(key)) headers[key] = value;
@@ -427,19 +471,51 @@ function createProxy(options) {
       const location = proxyRes.headers["location"];
       if (location !== void 0) headers.location = rewriteLocation(location);
       const status = proxyRes.statusCode || 502;
+      if (status === 401) invalidateHarnessCookie(cookie);
       res.writeHead(status, headers);
+      const armIdle = () => {
+        if (idleTimer) clearTimeout(idleTimer);
+        if (!upstreamIdleTimeoutMs) return;
+        idleTimer = setTimeout(() => {
+          if (proxyRes.isPaused() || res.writableNeedDrain) {
+            armIdle();
+            return;
+          }
+          timedOut = true;
+          proxyRes.destroy(new Error("upstream response idle timeout"));
+        }, upstreamIdleTimeoutMs);
+      };
+      proxyRes.on("data", armIdle);
+      proxyRes.once("end", clearTimers);
+      res.on("drain", armIdle);
+      armIdle();
       proxyRes.pipe(res);
-      proxyRes.on("error", () => res.destroy());
+      proxyRes.on("error", () => {
+        clearTimers();
+        res.destroy();
+      });
       const elapsed = Date.now() - started;
       if (status >= 400 || elapsed > 1e3) {
         log.info(req.method + " " + String(req.url || "/").split("?")[0] + " " + status + " " + elapsed + "ms");
       }
     });
+    if (upstreamHeaderTimeoutMs) {
+      headerTimer = setTimeout(() => {
+        timedOut = true;
+        proxyReq.destroy(new Error("upstream response headers timeout"));
+      }, upstreamHeaderTimeoutMs);
+    }
     proxyReq.on("error", (err) => {
+      clearTimers();
+      if (res.destroyed) return;
       log.warn("upstream error: " + err.message);
+      if (timedOut && !res.headersSent) return text(res, 504, "dsh-frontgate: upstream timeout\n");
       sendUpstreamError(res);
     });
-    res.on("close", () => proxyReq.destroy());
+    res.on("close", () => {
+      clearTimers();
+      proxyReq.destroy();
+    });
     req.pipe(proxyReq);
   }
   function forwardUpgrade(req, socket, head, cookie) {
@@ -462,7 +538,7 @@ function createProxy(options) {
     lines.push("X-Forwarded-Host: " + String(req.headers.host || ""));
     lines.push("", "");
     const payload = lines.join("\r\n");
-    const backend = secureUpstream ? tls.connect({ host, port, rejectUnauthorized: false }) : net.connect(port, host);
+    const backend = secureUpstream ? tls.connect({ host, port, ...tlsOptions }) : net.connect(port, host);
     let closed = false;
     const teardown = (message) => {
       if (closed) return;
@@ -473,6 +549,19 @@ function createProxy(options) {
     };
     const start = () => {
       backend.setTimeout(0);
+      let statusLine = "";
+      let statusRead = false;
+      backend.on("data", (chunk) => {
+        if (statusRead) return;
+        statusLine += chunk.toString("latin1", 0, Math.max(0, 256 - statusLine.length));
+        const end = statusLine.indexOf("\r\n");
+        if (end !== -1 || statusLine.length >= 256) {
+          statusRead = true;
+          if (/^HTTP\/1\.[01] 401(?:\s|$)/.test(statusLine.slice(0, end === -1 ? void 0 : end))) {
+            invalidateHarnessCookie(cookie);
+          }
+        }
+      });
       backend.write(payload);
       if (head && head.length) backend.write(head);
       backend.pipe(socket);
@@ -537,10 +626,11 @@ function loginPage(title, next, error) {
 var MAX_TRACKED_CLIENTS = 1024;
 var CHECK_CONCURRENCY = 2;
 function createHandler(options) {
-  const { runtime, harnessCookie, forward, log } = options;
-  const { title, passwordHash, secret, pv, sessionSeconds, maxAttempts, lockMs, trustProxy, useTls, publicOrigin, secureCookie } = runtime;
+  const { runtime, harnessCookie, validSession, revokeSession, forward, log } = options;
+  const { title, passwordHash, secret, pv, sessionSeconds, maxAttempts, maxPendingLoginsPerIp, lockMs, trustProxy, useTls, publicOrigin, secureCookie } = runtime;
   const failures = /* @__PURE__ */ new Map();
   const clientsInFlight = /* @__PURE__ */ new Set();
+  const pendingForms = /* @__PURE__ */ new Map();
   let checksInFlight = 0;
   function lockRemaining(ip) {
     const entry = failures.get(ip);
@@ -567,26 +657,45 @@ function createHandler(options) {
   }
   function sessionOf(req) {
     const token = cookieValue(req.headers.cookie, COOKIE);
-    return Boolean(token) && verifyToken(secret, pv, token);
+    return Boolean(token) && validSession(token);
   }
   async function handleLogin(req, res, search) {
     const next = safeNext(new URLSearchParams(search).get("next") || "/");
     if (req.method === "POST") {
-      if (!sameOrigin(req, publicOrigin, useTls)) return html(res, 403, loginPage(title, next, "Origin check failed."));
+      if (!sameOrigin(req, publicOrigin, useTls)) {
+        req.resume();
+        res.setHeader("connection", "close");
+        return html(res, 403, loginPage(title, next, "Origin check failed."));
+      }
       const declared = Number(req.headers["content-length"] || 0);
-      if (declared > MAX_FORM) return text(res, 413, "request body too large\n");
+      if (declared > MAX_FORM) {
+        req.resume();
+        return text(res, 413, "request body too large\n", { connection: "close" });
+      }
       const ip = clientIp(req, trustProxy);
       const wait = lockRemaining(ip);
       if (wait > 0) {
         req.resume();
-        return text(res, 429, "too many attempts\n", { "retry-after": String(Math.ceil(wait / 1e3)) });
+        return text(res, 429, "too many attempts\n", { "retry-after": String(Math.ceil(wait / 1e3)), connection: "close" });
       }
+      const pending = pendingForms.get(ip) ?? 0;
+      if (pending >= maxPendingLoginsPerIp) {
+        req.resume();
+        return text(res, 429, "too many pending logins\n", { "retry-after": "1", connection: "close" });
+      }
+      pendingForms.set(ip, pending + 1);
       let form;
       try {
         form = await readForm(req);
       } catch (err) {
-        if (err.message === "too large") return text(res, 413, "request body too large\n");
-        return text(res, 400, "bad request\n");
+        if (res.destroyed) return;
+        if (err.message === "too large") return text(res, 413, "request body too large\n", { connection: "close" });
+        if (err.message === "timeout") return text(res, 408, "request timeout\n", { connection: "close" });
+        return text(res, 400, "bad request\n", { connection: "close" });
+      } finally {
+        const count = pendingForms.get(ip) ?? 1;
+        if (count <= 1) pendingForms.delete(ip);
+        else pendingForms.set(ip, count - 1);
       }
       const remaining = lockRemaining(ip);
       if (remaining > 0) return text(res, 429, "too many attempts\n", { "retry-after": String(Math.ceil(remaining / 1e3)) });
@@ -629,16 +738,27 @@ function createHandler(options) {
     if (path === "/__gate/login") return handleLogin(req, res, search);
     if (path === "/__gate/logout") {
       if (!sameOrigin(req, publicOrigin, useTls)) return text(res, 403, "forbidden\n");
+      const token2 = cookieValue(req.headers.cookie, COOKIE);
+      if (token2 && validSession(token2)) {
+        try {
+          revokeSession(token2);
+        } catch (err) {
+          log.warn("could not revoke session: " + err.message);
+          return text(res, 503, "could not sign out; retry later\n");
+        }
+      }
       res.setHeader("set-cookie", clearCookie(secureCookie));
       return redirect(res, "/__gate/login");
     }
     if (path.startsWith("/__gate/")) return text(res, 404, "not found\n");
-    if (!sessionOf(req)) {
+    const token = cookieValue(req.headers.cookie, COOKIE);
+    const unauthorized = () => {
       if (path === "/api" || path.startsWith("/api/")) {
         return json(res, 401, { error: "unauthorized", login: "/__gate/login" });
       }
       return redirect(res, "/__gate/login?next=" + encodeURIComponent(raw));
-    }
+    };
+    if (!token || !validSession(token)) return unauthorized();
     if (!sameOrigin(req, publicOrigin, useTls)) {
       log.warn("cross-origin request blocked: " + String(req.method) + " " + path);
       if (path === "/api" || path.startsWith("/api/")) return json(res, 403, { error: "forbidden" });
@@ -648,9 +768,12 @@ function createHandler(options) {
     try {
       cookie = await harnessCookie();
     } catch (err) {
+      if (res.destroyed) return;
       log.warn("harness cookie exchange failed: " + err.message);
       return json(res, 503, { error: "harness_unavailable" });
     }
+    if (req.aborted || res.destroyed || !res.writable) return;
+    if (!validSession(token)) return unauthorized();
     forward(req, res, cookie);
   };
 }
@@ -660,6 +783,7 @@ import { chmodSync, closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFi
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+var MAX_REVOKED_SESSIONS = 1e4;
 function readState(path, mustExist = false) {
   let data;
   try {
@@ -675,6 +799,9 @@ function readState(path, mustExist = false) {
     if (!validPasswordHash(state.passwordHash) || typeof state.secret !== "string" || state.secret.length < 64) {
       throw new Error("invalid credentials");
     }
+    if (state.revokedSessions !== void 0 && (!Array.isArray(state.revokedSessions) || state.revokedSessions.length > MAX_REVOKED_SESSIONS || state.revokedSessions.some((entry) => !entry || typeof entry !== "object" || typeof entry.digest !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(entry.digest) || !Number.isSafeInteger(entry.expires) || entry.expires <= 0))) {
+      throw new Error("invalid revoked sessions");
+    }
     return state;
   } catch (err) {
     throw new Error("dsh-frontgate: invalid state file " + path + "; restore it from a backup before restarting", { cause: err });
@@ -738,6 +865,46 @@ function hashFor(plain, state) {
   return state.passwordHash && verifyPasswordSync(plain, state.passwordHash) ? state.passwordHash : hashPassword(plain);
 }
 
+// src/sessions.ts
+import { createHash as createHash2 } from "node:crypto";
+var sessionDigest = (token) => createHash2("sha256").update(token).digest("base64url");
+function createSessionStore(path, state, pv, onRevoke) {
+  const secret = state.secret;
+  const passwordHash = state.passwordHash;
+  let revoked = new Map((state.revokedSessions ?? []).map(({ digest, expires }) => [digest, expires]));
+  const valid = (token) => {
+    if (!verifyToken(secret, pv, token)) return false;
+    const digest = sessionDigest(token);
+    const expires = revoked.get(digest);
+    if (expires === void 0) return true;
+    if (expires * 1e3 > Date.now()) return false;
+    revoked.delete(digest);
+    return true;
+  };
+  const revoke = (token) => {
+    if (!valid(token)) return false;
+    if (!tightenState(path)) throw new Error("state file is missing");
+    const latest = readState(path, true);
+    if (latest.secret !== secret || latest.passwordHash !== passwordHash) {
+      throw new Error("state changed; restart the gate before signing out");
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const next = /* @__PURE__ */ new Map();
+    for (const entry of latest.revokedSessions ?? []) if (entry.expires > now) next.set(entry.digest, entry.expires);
+    for (const [digest2, expires] of revoked) if (expires > now) next.set(digest2, expires);
+    const digest = sessionDigest(token);
+    if (next.size > MAX_REVOKED_SESSIONS || !next.has(digest) && next.size >= MAX_REVOKED_SESSIONS) {
+      throw new Error("revocation store is full");
+    }
+    next.set(digest, Number(token.split(".")[2]));
+    writeState(path, { ...latest, revokedSessions: [...next].map(([digest2, expires]) => ({ digest: digest2, expires })) });
+    revoked = next;
+    onRevoke(digest);
+    return true;
+  };
+  return { valid, revoke };
+}
+
 // src/index.ts
 var name = "dsh-frontgate";
 var inject = ["webServer", "connection"];
@@ -750,6 +917,10 @@ function apply(ctx, config = {}) {
   const maxAttempts = intOr(cfg.maxAttempts, DEFAULTS.maxAttempts, 1, 50);
   const lockMs = intOr(cfg.lockMinutes, DEFAULTS.lockMinutes, 1, 1440) * 6e4;
   const exchangeTimeoutMs = intOr(cfg.exchangeTimeoutMs, DEFAULTS.exchangeTimeoutMs, 100, 6e4);
+  const maxConnectionsPerPeer = intOr(cfg.maxConnectionsPerPeer, DEFAULTS.maxConnectionsPerPeer, 0, 1024);
+  const maxPendingLoginsPerIp = intOr(cfg.maxPendingLoginsPerIp, DEFAULTS.maxPendingLoginsPerIp, 1, 128);
+  const upstreamHeaderTimeoutMs = intOr(cfg.upstreamHeaderTimeoutMs, DEFAULTS.upstreamHeaderTimeoutMs, 0, 36e5);
+  const upstreamIdleTimeoutMs = intOr(cfg.upstreamIdleTimeoutMs, DEFAULTS.upstreamIdleTimeoutMs, 0, 36e5);
   const useTls = Boolean(cfg.tlsCertFile || cfg.tlsKeyFile);
   if (useTls && !(cfg.tlsCertFile && cfg.tlsKeyFile)) {
     throw new Error("dsh-frontgate: tlsCertFile and tlsKeyFile must be set together");
@@ -783,10 +954,17 @@ function apply(ctx, config = {}) {
     generatedPassword = randomPassword();
     passwordHash = hashPassword(generatedPassword);
   }
-  const secret = typeof state.secret === "string" && state.secret.length >= 64 ? state.secret : randomBytes3(32).toString("hex");
+  const passwordChanged = stateExists && state.passwordHash !== passwordHash;
+  const secret = !passwordChanged && typeof state.secret === "string" && state.secret.length >= 64 ? state.secret : randomBytes3(32).toString("hex");
   const pv = passwordVersion(passwordHash);
+  const persistedState = {
+    passwordHash,
+    secret,
+    createdAt: state.createdAt || (/* @__PURE__ */ new Date()).toISOString(),
+    revokedSessions: passwordChanged ? [] : state.revokedSessions ?? []
+  };
   if (state.passwordHash !== passwordHash || state.secret !== secret) {
-    writeState(statePath, { passwordHash, secret, createdAt: state.createdAt || (/* @__PURE__ */ new Date()).toISOString() });
+    writeState(statePath, persistedState);
   }
   if (generatedPassword) {
     logger.info("no password configured - generated a random one and saved its hash to " + statePath);
@@ -798,11 +976,19 @@ function apply(ctx, config = {}) {
   if (listenPort !== 0 && listenPort === Number(target.port)) {
     throw new Error("dsh-frontgate: listenPort " + listenPort + " collides with the harness listener " + targetOrigin);
   }
+  const upgrades = /* @__PURE__ */ new Map();
+  const sessions = createSessionStore(statePath, persistedState, pv, (digest) => {
+    for (const [socket, entry] of upgrades) if (entry.digest === digest) socket.destroy();
+  });
   const proxy = createProxy({
     targetOrigin,
     publicProto,
     trustProxy: Boolean(cfg.trustProxy),
     exchangeTimeoutMs,
+    upstreamHeaderTimeoutMs,
+    upstreamIdleTimeoutMs,
+    upstreamCa: cfg.upstreamCaFile ? readFileSync2(String(cfg.upstreamCaFile)) : void 0,
+    upstreamServerName: String(cfg.upstreamServerName || ""),
     authenticatedUrl: (baseUrl) => ctx.connection.authenticatedUrl(baseUrl),
     log: logger
   });
@@ -814,6 +1000,7 @@ function apply(ctx, config = {}) {
       pv,
       sessionSeconds,
       maxAttempts,
+      maxPendingLoginsPerIp,
       lockMs,
       trustProxy: Boolean(cfg.trustProxy),
       useTls,
@@ -821,6 +1008,8 @@ function apply(ctx, config = {}) {
       secureCookie: publicProto === "https"
     },
     harnessCookie: proxy.harnessCookie,
+    validSession: sessions.valid,
+    revokeSession: sessions.revoke,
     forward: proxy.forward,
     log: logger
   });
@@ -835,10 +1024,45 @@ function apply(ctx, config = {}) {
   const serverOptions = { connectionsCheckingInterval: 5e3, headersTimeout: 1e4, requestTimeout: 3e4 };
   const server = tlsOptions ? https2.createServer({ ...tlsOptions, ...serverOptions }, requestListener) : http2.createServer(serverOptions, requestListener);
   server.maxConnections = 1024;
+  const peers = /* @__PURE__ */ new Map();
+  if (maxConnectionsPerPeer > 0) server.on("connection", (socket) => {
+    const peer = String(socket.remoteAddress || "unknown").replace(/^::ffff:/, "");
+    const count = peers.get(peer) ?? 0;
+    if (count >= maxConnectionsPerPeer) {
+      socket.destroy();
+      return;
+    }
+    peers.set(peer, count + 1);
+    socket.once("close", () => {
+      const remaining = (peers.get(peer) ?? 1) - 1;
+      if (remaining <= 0) peers.delete(peer);
+      else peers.set(peer, remaining);
+    });
+  });
+  let shuttingDown = false;
+  function trackUpgrade(socket, token) {
+    const expiresAt = Number(token.split(".")[2]) * 1e3;
+    const entry = { digest: sessionDigest(token) };
+    upgrades.set(socket, entry);
+    const arm = () => {
+      const remaining = expiresAt - Date.now();
+      if (remaining <= 0) {
+        socket.destroy();
+        return;
+      }
+      entry.timer = setTimeout(arm, Math.min(remaining, 2147483647));
+    };
+    arm();
+    socket.once("close", () => {
+      if (entry.timer) clearTimeout(entry.timer);
+      upgrades.delete(socket);
+    });
+  }
   server.on("upgrade", (req, socket, head) => {
     socket.on("error", () => socket.destroy());
     try {
-      if (!sessionOf(req)) {
+      const token = cookieValue(req.headers.cookie, COOKIE);
+      if (!token || !sessions.valid(token)) {
         socket.end("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
         return;
       }
@@ -847,7 +1071,35 @@ function apply(ctx, config = {}) {
         socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
         return;
       }
-      proxy.harnessCookie().then((cookie) => proxy.forwardUpgrade(req, socket, head, cookie)).catch((err) => {
+      trackUpgrade(socket, token);
+      const chunks = head.length ? [head] : [];
+      let pendingBytes = head.length;
+      const onEarlyData = (chunk) => {
+        pendingBytes += chunk.length;
+        if (pendingBytes > 65536) {
+          socket.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      };
+      const onEarlyEnd = () => {
+        socket.destroy();
+      };
+      socket.on("data", onEarlyData);
+      socket.once("end", onEarlyEnd);
+      if (pendingBytes > 65536) {
+        socket.destroy();
+        return;
+      }
+      socket.resume();
+      proxy.harnessCookie().then((cookie) => {
+        if (shuttingDown || socket.destroyed || !sessions.valid(token)) return;
+        socket.pause();
+        socket.off("data", onEarlyData);
+        socket.off("end", onEarlyEnd);
+        proxy.forwardUpgrade(req, socket, Buffer.concat(chunks, pendingBytes), cookie);
+      }).catch((err) => {
+        if (socket.destroyed) return;
         logger.warn("websocket blocked: " + err.message);
         socket.end("HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n");
       });
@@ -861,11 +1113,9 @@ function apply(ctx, config = {}) {
     socket.destroy();
   });
   server.on("error", (err) => logger.warn("listener error: " + err.message));
-  function sessionOf(req) {
-    const token = cookieValue(req.headers.cookie, COOKIE);
-    return Boolean(token) && verifyToken(secret, pv, token);
-  }
   const shutdown = () => {
+    shuttingDown = true;
+    for (const socket of upgrades.keys()) socket.destroy();
     proxy.destroy();
     const withConnections = server;
     if (typeof withConnections.closeAllConnections === "function") withConnections.closeAllConnections();
@@ -888,7 +1138,7 @@ function apply(ctx, config = {}) {
           logger.warn("use a dedicated hostname or IP: browser cookies are shared across ports");
         }
         if (cfg.trustProxy) {
-          logger.warn("trustProxy is enabled; restrict access to this listener to trusted proxies");
+          logger.warn("trustProxy is enabled; restrict access to this listener to trusted proxies; TCP peer limits apply to the proxy");
         }
         const bound = ctx.webServer.config?.host;
         if (typeof bound === "string" && !isLoopbackHost(bound)) {

package/lib/types/config.d.ts

@@ -33,6 +33,18 @@ export interface Config {
     lockMinutes: number;
     /** Maximum time to exchange the harness launch token, in milliseconds. */
     exchangeTimeoutMs: number;
+    /** Maximum simultaneous TCP connections from one peer; 0 disables this limit. */
+    maxConnectionsPerPeer: number;
+    /** Maximum login forms being received from one client IP. */
+    maxPendingLoginsPerIp: number;
+    /** Deadline for upstream response headers, including time queued for a socket; 0 disables. */
+    upstreamHeaderTimeoutMs: number;
+    /** Maximum idle time after upstream response headers; 0 disables. */
+    upstreamIdleTimeoutMs: number;
+    /** Optional CA certificate for a private HTTPS harness. */
+    upstreamCaFile: string;
+    /** Optional TLS identity when connecting to an HTTPS harness by IP. */
+    upstreamServerName: string;
 }
 /** Defaults applied by the loader and by direct calls to apply(). */
 export declare const DEFAULTS: Config;

package/lib/types/gate.d.ts

@@ -15,6 +15,7 @@ export interface GateRuntime {
     pv: string;
     sessionSeconds: number;
     maxAttempts: number;
+    maxPendingLoginsPerIp: number;
     lockMs: number;
     trustProxy: boolean;
     useTls: boolean;
@@ -25,6 +26,8 @@ export interface GateRuntime {
 export interface GateOptions {
     runtime: GateRuntime;
     harnessCookie(): Promise<string>;
+    validSession(token: string): boolean;
+    revokeSession(token: string): boolean;
     forward(req: IncomingMessage, res: ServerResponse, cookie: string): void;
     log: LogSink;
 }

package/lib/types/proxy.d.ts

@@ -11,6 +11,10 @@ export interface ProxyOptions {
     trustProxy: boolean;
     /** Maximum time spent exchanging a launch token, including connection time. */
     exchangeTimeoutMs: number;
+    upstreamHeaderTimeoutMs: number;
+    upstreamIdleTimeoutMs: number;
+    upstreamCa?: Buffer;
+    upstreamServerName: string;
     /** Absolute entry URL with the harness launch token attached. */
     authenticatedUrl(baseUrl: string): string;
     log: LogSink;

package/lib/types/sessions.d.ts

@@ -0,0 +1,9 @@
+import type { State } from './state.ts';
+/** Store only a digest, never the bearer token itself. */
+export declare const sessionDigest: (token: string) => string;
+export interface SessionStore {
+    valid(token: string): boolean;
+    /** Persist revocation before reporting logout success. */
+    revoke(token: string): boolean;
+}
+export declare function createSessionStore(path: string, state: State, pv: string, onRevoke: (digest: string) => void): SessionStore;

package/lib/types/state.d.ts

@@ -1,8 +1,15 @@
+/** Bound persistent logout revocations; expired entries are pruned on logout. */
+export declare const MAX_REVOKED_SESSIONS = 10000;
+export interface RevokedSession {
+    digest: string;
+    expires: number;
+}
 /** Persisted state file contents. */
 export interface State {
     passwordHash?: string;
     secret?: string;
     createdAt?: string;
+    revokedSessions?: RevokedSession[];
 }
 /** Read existing state without replacing malformed or inaccessible credentials. */
 export declare function readState(path: string, mustExist?: boolean): State;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lornatang/dsh-frontgate",
-  "version": "0.1.1",
-  "description": "Password gate and reverse proxy for the DeepSeek Harness Web UI: scrypt login, signed session cookie, Host and Origin rewrite, launch-token exchange, WebSocket pass-through.",
+  "version": "0.1.2",
+  "description": "Password protection and reverse proxy for the DeepSeek Harness Web UI.",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",