@sksoftofficial/ocduet 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sksoftofficial/ocduet",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Duet for opencode: pair your phone with a local opencode TUI. Type on mobile, see it live on both screens. LAN-first, QR pairing, zero config.",
   "type": "module",
   "bin": {

package/src/commands/relay.js

@@ -40,7 +40,9 @@ function registerOnce(url, desktopId, pubB64, sign, secret, certPem) {
   return new Promise((resolve, reject) => {
     const wsUrl = new URL("/desktop", url);
     wsUrl.protocol = wsUrl.protocol === "http:" ? "ws:" : "wss:";
-    const tlsOpts = certPem ? { ca: certPem } : { rejectUnauthorized: false };
+    // pinned cert = the identity itself; hostname/SAN matching would always
+    // fail for a bare-IP relayer with a self-signed cert
+    const tlsOpts = certPem ? { ca: certPem, checkServerIdentity: () => undefined } : { rejectUnauthorized: false };
     const ws = new WebSocket(wsUrl, { ...tlsOpts, handshakeTimeout: 10_000 });
     const fail = (why) => { try { ws.close(); } catch {} reject(new Error(why)); };
     const timer = setTimeout(() => fail("register timeout"), 12_000);

package/src/relay-client.js

@@ -33,7 +33,9 @@ export function readRelayConfig() {
 // auth still comes from the ed25519 register signature — the pin kills
 // silent MITM even without a domain.
 export function relayTlsOpts(cfg) {
-  return cfg?.certPem ? { ca: cfg.certPem } : { rejectUnauthorized: false };
+  // when pinned, the exact cert IS the identity — skip hostname/SAN matching,
+  // which can never pass for a bare-IP host anyway
+  return cfg?.certPem ? { ca: cfg.certPem, checkServerIdentity: () => undefined } : { rejectUnauthorized: false };
 }
 
 const state = { linked: false, connected: false, url: null, desktopId: null, since: null, lastError: null, reconnects: 0 };

package/src/relayer.js

@@ -75,11 +75,17 @@ function ensureCert() {
     return { cert: fs.readFileSync(certP), key: fs.readFileSync(keyP) };
   }
   fs.mkdirSync(relayerDir(), { recursive: true });
+  // cover every address the box might be reached on — desktops link by bare IP
+  const ips = [];
+  for (const addrs of Object.values(os.networkInterfaces())) {
+    for (const a of addrs || []) if (a.family === "IPv4" && !a.internal) ips.push(a.address);
+  }
+  const san = ["DNS:localhost", "IP:127.0.0.1", ...ips.map((ip) => `IP:${ip}`)];
   const out = spawnSync("openssl", [
     "req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:prime256v1",
     "-keyout", keyP, "-out", certP, "-days", "3650", "-nodes",
     "-subj", "/CN=ocduet-relayer",
-    "-addext", "subjectAltName=DNS:localhost,IP:127.0.0.1",
+    "-addext", `subjectAltName=${san.join(",")}`,
   ], { stdio: "ignore" });
   if (out.status !== 0) throw new Error("openssl cert generation failed — is openssl installed?");
   try { fs.chmodSync(keyP, 0o600); } catch {}