@xopcai/xopc 0.0.269 → 0.0.272

package/dist/src/storage/sqlite/session-identity-sql.js

@@ -0,0 +1,18 @@
+import { SESSION_SOURCE_CHANNELS } from "../../../packages/gateway-contract/src/session-identity.js";
+//#region src/storage/sqlite/session-identity-sql.ts
+const custom = (key) => `json_extract(CASE WHEN json_valid(s.custom_data_json) THEN s.custom_data_json ELSE '{}' END, '$.${key}')`;
+const channel = "LOWER(TRIM(s.source_channel))";
+const SESSION_SOURCE_SQL = `(CASE
+  WHEN s.session_type = 'heartbeat' THEN 'system'
+  WHEN ${custom("origin")} = 'automation' OR ${custom("triggerSource")} = 'automation' OR s.session_type = 'cron' THEN 'automation'
+  WHEN ${custom("createdSurface")} = 'browser_extension' THEN 'browser'
+  ${Object.entries(SESSION_SOURCE_CHANNELS).map(([name, aliases]) => `WHEN ${channel} IN (${aliases.map((alias) => `'${alias}'`).join(",")}) THEN '${name}'`).join("\n  ")}
+  ELSE 'other' END)`;
+const SESSION_PURPOSE_SQL = `(CASE
+  WHEN ${SESSION_SOURCE_SQL} = 'system' THEN 'system'
+  WHEN s.session_type = 'workflow-subagent' THEN 'subagent'
+  WHEN s.session_type = 'workflow-run' THEN 'workflow'
+  WHEN ${SESSION_SOURCE_SQL} = 'automation' THEN 'automation'
+  ELSE 'chat' END)`;
+//#endregion
+export { SESSION_PURPOSE_SQL, SESSION_SOURCE_SQL };

package/dist/src/storage/sqlite/session-repository.js

@@ -5,6 +5,7 @@ import { buildGlobalSessionStats, metadataToSessionInsert, sessionRowToMetadata
 import { cancelConnectionObjective } from "./connection-wait-repository.js";
 import { notifyUserContextChange } from "../../user-context/changes.js";
 import { validateSessionId } from "../../session/session-id.js";
+import { SESSION_PURPOSE_SQL, SESSION_SOURCE_SQL } from "./session-identity-sql.js";
 import { buildFts5SearchQuery } from "./fts.js";
 import { randomUUID } from "node:crypto";
 //#region src/storage/sqlite/session-repository.ts
@@ -81,7 +82,7 @@ function listSessionMetadata(query = {}) {
 	if (query.sessionTypes?.length) {
 		conditions.push(`s.session_type IN (${query.sessionTypes.map(() => "?").join(", ")})`);
 		params.push(...query.sessionTypes);
-	} else if (!query.includeHidden) {
+	} else if (!query.includeHidden && !query.purposes?.length && !query.activity && !query.sources?.length) {
 		conditions.push(`s.session_type = ?`);
 		params.push("chat");
 	}
@@ -90,6 +91,21 @@ function listSessionMetadata(query = {}) {
 		conditions.push(`s.status IN (${statuses.map(() => "?").join(", ")})`);
 		params.push(...statuses);
 	}
+	if (query.excludeArchived) conditions.push(`s.status != 'archived'`);
+	if (query.sources?.length) {
+		conditions.push(`${SESSION_SOURCE_SQL} IN (${query.sources.map(() => "?").join(",")})`);
+		params.push(...query.sources);
+	}
+	if (query.purposes?.length) {
+		conditions.push(`${SESSION_PURPOSE_SQL} IN (${query.purposes.map(() => "?").join(",")})`);
+		params.push(...query.purposes);
+	}
+	if (query.activity === "automatic") conditions.push(`${SESSION_SOURCE_SQL} IN ('automation', 'system')`);
+	if (query.activity === "manual") conditions.push(`${SESSION_PURPOSE_SQL} = 'chat' AND ${SESSION_SOURCE_SQL} NOT IN ('automation', 'system')`);
+	if (query.agentId) {
+		conditions.push("s.agent_id = ?");
+		params.push(query.agentId);
+	}
 	if (query.projectId) {
 		conditions.push(`s.project_id = ?`);
 		params.push(query.projectId);
@@ -126,29 +142,17 @@ function listSessionMetadata(query = {}) {
 		conditions.push(`s.tags_json LIKE ?`);
 		params.push(`%"${tag}"%`);
 	}
-	let searchKeys = null;
 	if (query.search?.trim()) {
 		const rawSearch = query.search.trim();
-		const ftsQuery = buildFts5SearchQuery(rawSearch);
-		const ftsRows = db.prepare(`SELECT DISTINCT session_key FROM transcript_fts WHERE transcript_fts MATCH ? LIMIT 500`).all(ftsQuery);
-		const ftsKeys = new Set(ftsRows.map((r) => r.session_key));
 		const like = `%${rawSearch.toLowerCase()}%`;
-		const metaRows = db.prepare(`SELECT session_key FROM sessions
-         WHERE LOWER(session_key) LIKE ?
-            OR LOWER(COALESCE(name, '')) LIKE ?
-            OR LOWER(source_channel) LIKE ?
-            OR LOWER(source_chat_id) LIKE ?
-            OR LOWER(tags_json) LIKE ?`).all(like, like, like, like, like);
-		searchKeys = [...new Set([...ftsKeys, ...metaRows.map((r) => r.session_key)])];
-		if (searchKeys.length === 0) return {
-			items: [],
-			total: 0,
-			limit: query.limit ?? 50,
-			offset: query.offset ?? 0,
-			hasMore: false
-		};
-		conditions.push(`s.session_key IN (${searchKeys.map(() => "?").join(", ")})`);
-		params.push(...searchKeys);
+		conditions.push(`(s.session_key IN (
+      SELECT session_key FROM transcript_fts WHERE transcript_fts MATCH ?
+    ) OR LOWER(s.session_key) LIKE ?
+      OR LOWER(COALESCE(s.name, '')) LIKE ?
+      OR LOWER(s.source_channel) LIKE ?
+      OR LOWER(s.source_chat_id) LIKE ?
+      OR LOWER(s.tags_json) LIKE ?)`);
+		params.push(buildFts5SearchQuery(rawSearch), like, like, like, like, like);
 	}
 	const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
 	const sortColumn = sessionSortColumn(query.sortBy);
@@ -158,7 +162,7 @@ function listSessionMetadata(query = {}) {
 	const offset = query.offset ?? 0;
 	return {
 		items: db.prepare(`SELECT ${SESSION_COLUMNS} ${SESSION_FROM_JOIN} ${where}
-       ORDER BY ${sortColumn} ${sortOrder}
+       ORDER BY ${sortColumn} ${sortOrder}, s.session_key ASC
        LIMIT ? OFFSET ?`).all(...params, limit, offset).map((row) => sessionRowToMetadata(row.session_key, row)),
 		total,
 		limit,

package/dist/src/tasks/home-query-service.js

@@ -336,7 +336,7 @@ var HomeQueryService = class {
 				detail: item.insight.summary,
 				reason: item.insight.disposition === "request_approval" ? "approval_required" : item.insight.attentionKind === "decision" ? "decision_needed" : "insight_available",
 				urgency: item.insight.urgency === "critical" || item.insight.urgency === "high" ? "now" : "soon",
-				href: `/?judgment=${encodeURIComponent(item.id)}`,
+				href: `/assistant-work?item=${encodeURIComponent(item.id)}`,
 				updatedAt: Date.parse(item.updatedAt),
 				judgment: {
 					inboxItemId: item.id,

package/dist/src/tasks/index.js

@@ -3,18 +3,18 @@ import { TaskRunRepository } from "./task-run-repository.js";
 import { TaskRepository } from "./task-repository.js";
 import { TaskConversationConflictError, TaskConversationRepository } from "./task-conversation-repository.js";
 import { TaskReadModelProjector } from "./task-read-model-projector.js";
-import { resolveExecutionContext } from "./execution-context.js";
-import { AttentionGovernor } from "./attention-governor.js";
-import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "./home-query-service.js";
 import { TaskContextRepository } from "./task-context-repository.js";
 import { TaskDependencyError, TaskDependencyService } from "./task-dependency-service.js";
 import { TaskApplicationService } from "./task-application-service.js";
+import { ProjectMonitoringService, decideProactiveDisposition, isInQuietHours, nextQuietHoursEnd, proactiveDispositionReason } from "./project-monitoring-service.js";
+import { resolveExecutionContext } from "./execution-context.js";
+import { AttentionGovernor } from "./attention-governor.js";
+import { HomeQueryService, buildHomeWorkbench, decisionFromTask } from "./home-query-service.js";
 import { TaskWorkflowCoordinator } from "./task-workflow-coordinator.js";
 import { defineTaskContract } from "./task-contract-definition.js";
 import { ModelTaskContractPlanner, parseTaskContractResponse } from "./task-contract-planner.js";
 import { assembleTaskContext, buildTaskExecutionDirective, getTaskContextManifest, getTaskExecutionBrief } from "./task-context-assembler.js";
 import { TaskRunCoordinator } from "./task-run-coordinator.js";
-import { ProjectMonitoringService, decideProactiveDisposition, isInQuietHours, nextQuietHoursEnd, proactiveDispositionReason } from "./project-monitoring-service.js";
 import { ProjectOperatingViewService, summarizeProjectOperatingView } from "./project-operating-view-service.js";
 import { TaskValueMetricsService } from "./task-value-metrics-service.js";
 import { TaskHandoffService } from "./task-handoff-service.js";

package/dist/src/tui/tui-startup-resources.js

@@ -5,9 +5,9 @@ import { resolveBootstrapFilesSync } from "../agent/bootstrap/bootstrap-files.js
 import { createSkillConfigManager, isSkillEnabled } from "../agent/skills/config.js";
 import { loadSkills } from "../agent/skills/index.js";
 import { createWorkflowCatalog } from "../agent/workflow/catalog.js";
+import { listConnectorInstances } from "../connectors/instances.js";
 import { getWorkspacePath } from "../config/workspace-path-helpers.js";
 import "../config/index.js";
-import { listConnectorInstances } from "../connectors/instances.js";
 import { basename } from "node:path";
 //#region src/tui/tui-startup-resources.ts
 init_paths();

package/dist/src/tunnel/auth-policy.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedGatewayAuth } from '../gateway/auth.js';
+/** A public FRP ingress cannot trust local sockets or proxy identity headers. */
+export declare function requireTunnelGatewayToken(auth: ResolvedGatewayAuth): string;

package/dist/src/tunnel/auth-policy.js

@@ -0,0 +1,8 @@
+//#region src/tunnel/auth-policy.ts
+/** A public FRP ingress cannot trust local sockets or proxy identity headers. */
+function requireTunnelGatewayToken(auth) {
+	if (auth.mode !== "token" || !auth.token?.trim()) throw new Error("Public remote access requires gateway token authentication.");
+	return auth.token;
+}
+//#endregion
+export { requireTunnelGatewayToken };

package/dist/src/tunnel/broker-client.d.ts

@@ -4,9 +4,13 @@ export type BrokerRegisterInput = {
     registrationSecret: string;
     gatewayVersion: string;
     platform: string;
-    gatewayTokenHash: string;
+    recoveryToken?: string;
     preferredSubdomain?: string;
 };
+export declare class TunnelBrokerError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
 export declare class TunnelBrokerClient {
     private readonly baseUrl;
     constructor(baseUrl: string);
@@ -14,19 +18,5 @@ export declare class TunnelBrokerClient {
     register(input: BrokerRegisterInput): Promise<TunnelRegistration>;
     heartbeat(tunnelId: string, tunnelToken: string): Promise<void>;
     deregister(tunnelId: string, tunnelToken: string): Promise<void>;
-    setDnsChallenge(input: {
-        tunnelId: string;
-        tunnelToken: string;
-        subdomain: string;
-        txtValue: string;
-    }): Promise<{
-        recordId: string;
-        fqdn: string;
-    }>;
-    cleanupDnsChallenge(input: {
-        tunnelId: string;
-        tunnelToken: string;
-        recordId: string;
-    }): Promise<void>;
 }
 export declare function resolveBrokerApiBase(brokerUrl: string): string;

package/dist/src/tunnel/broker-client.js

@@ -1,8 +1,31 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { createTunnelRegistrationProof } from "./registration-proof.js";
+import { z } from "zod";
 //#region src/tunnel/broker-client.ts
 init_logger();
 const log = createLogger("TunnelBroker");
+var TunnelBrokerError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+const registrationResponseSchema = z.object({
+	tunnelId: z.string().regex(/^[a-zA-Z0-9_-]{1,128}$/),
+	tunnelToken: z.string().min(1).max(256),
+	subdomain: z.string().regex(/^[a-z0-9]{4,16}$/),
+	publicUrl: z.url(),
+	frpc: z.object({
+		serverAddr: z.string().min(1).max(253),
+		serverPort: z.number().int().min(1).max(65535),
+		authToken: z.string().min(1).max(256),
+		proxyName: z.string().regex(/^[a-zA-Z0-9_-]{1,128}$/),
+		subdomain: z.string().regex(/^[a-z0-9]{4,16}$/)
+	}),
+	expiresAt: z.iso.datetime(),
+	heartbeatIntervalMs: z.number().int().min(5e3).max(6e4)
+});
 var TunnelBrokerClient = class {
 	constructor(baseUrl) {
 		this.baseUrl = baseUrl;
@@ -13,39 +36,40 @@ var TunnelBrokerClient = class {
 	async register(input) {
 		const url = this.apiUrl("/tunnels/register");
 		const res = await fetch(url, {
+			redirect: "error",
+			signal: AbortSignal.timeout(15e3),
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
 				"X-Registration-Secret": input.registrationSecret
 			},
-			body: JSON.stringify({
-				gatewayVersion: input.gatewayVersion,
-				platform: input.platform,
-				gatewayTokenHash: input.gatewayTokenHash,
-				preferredSubdomain: input.preferredSubdomain
-			})
+			body: JSON.stringify(createTunnelRegistrationProof(input))
 		});
 		if (!res.ok) {
-			const body = await res.text().catch(() => "");
 			log.error({
 				status: res.status,
-				url,
-				bodyPreview: body.slice(0, 200)
+				url
 			}, "Tunnel register failed");
-			throw new Error(`Tunnel register failed: ${res.status} ${res.statusText}`);
+			throw new TunnelBrokerError(res.status, `Tunnel register failed: ${res.status}`);
 		}
-		return await res.json();
+		const registration = registrationResponseSchema.parse(await res.json());
+		if (new URL(registration.publicUrl).protocol !== "https:") throw new Error("Tunnel requires HTTPS");
+		return registration;
 	}
 	async heartbeat(tunnelId, tunnelToken) {
 		const res = await fetch(this.apiUrl(`/tunnels/${encodeURIComponent(tunnelId)}/heartbeat`), {
+			redirect: "error",
+			signal: AbortSignal.timeout(15e3),
 			method: "POST",
 			headers: { "X-Tunnel-Token": tunnelToken }
 		});
-		if (res.status === 401 || res.status === 410) throw new Error(`Tunnel heartbeat rejected: ${res.status}`);
+		if (res.status === 401 || res.status === 403 || res.status === 410) throw new TunnelBrokerError(res.status, `Tunnel heartbeat rejected: ${res.status}`);
 		if (!res.ok) throw new Error(`Tunnel heartbeat failed: ${res.status}`);
 	}
 	async deregister(tunnelId, tunnelToken) {
 		const res = await fetch(this.apiUrl(`/tunnels/${encodeURIComponent(tunnelId)}`), {
+			redirect: "error",
+			signal: AbortSignal.timeout(15e3),
 			method: "DELETE",
 			headers: { "X-Tunnel-Token": tunnelToken }
 		});
@@ -54,42 +78,6 @@ var TunnelBrokerClient = class {
 			status: res.status
 		}, "Tunnel deregister returned non-OK");
 	}
-	async setDnsChallenge(input) {
-		const res = await fetch(this.apiUrl("/dns/challenge"), {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				"X-Tunnel-Token": input.tunnelToken
-			},
-			body: JSON.stringify({
-				tunnelId: input.tunnelId,
-				subdomain: input.subdomain,
-				txtValue: input.txtValue
-			})
-		});
-		if (!res.ok) {
-			const body = await res.text().catch(() => "");
-			throw new Error(`Broker DNS challenge failed: ${res.status} ${body.slice(0, 200)}`);
-		}
-		return await res.json();
-	}
-	async cleanupDnsChallenge(input) {
-		const res = await fetch(this.apiUrl("/dns/cleanup"), {
-			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				"X-Tunnel-Token": input.tunnelToken
-			},
-			body: JSON.stringify({
-				tunnelId: input.tunnelId,
-				recordId: input.recordId
-			})
-		});
-		if (!res.ok && res.status !== 404) log.warn({
-			recordId: input.recordId,
-			status: res.status
-		}, "Broker DNS cleanup returned non-OK");
-	}
 };
 function resolveBrokerApiBase(brokerUrl) {
 	const trimmed = brokerUrl.replace(/\/+$/, "");
@@ -97,4 +85,4 @@ function resolveBrokerApiBase(brokerUrl) {
 	return `${trimmed}/api`;
 }
 //#endregion
-export { TunnelBrokerClient, resolveBrokerApiBase };
+export { TunnelBrokerClient, TunnelBrokerError, resolveBrokerApiBase };

package/dist/src/tunnel/frpc-binary.d.ts

@@ -1,14 +1,16 @@
 import { type FrpcReleasePlatform } from './frpc-extract.js';
+import { FRPC_VERSION } from './frpc-release.js';
 import type { FrpcDownloadProgress } from './tunnel-types.js';
-export declare const FRPC_VERSION = "0.62.1";
+export { FRPC_VERSION };
 export type { FrpcDownloadProgress };
 export type EnsureFrpcBinaryOptions = {
     onProgress?: (progress: FrpcDownloadProgress) => void;
+    platform?: FrpcReleasePlatform;
+    arch?: string;
 };
-export declare function buildFrpcReleaseBasename(frpPlatform: FrpcReleasePlatform, arch: string, version?: string): string;
-export declare function frpcDownloadUrlsForTarget(frpPlatform: FrpcReleasePlatform, arch: string, version?: string): string[];
-/** Set after a successful tunnel start so subprocesses can resolve the same binary. */
-export declare function publishFrpcPathForProcess(binPath: string): void;
-/** Clear runtime frpc path when the tunnel stops (no bundled Electron binary). */
+export declare function buildFrpcReleaseBasename(platform: FrpcReleasePlatform, arch: string, version?: string): string;
+export declare function frpcDownloadUrlsForTarget(platform: FrpcReleasePlatform, arch: string, version?: string): string[];
+export declare function verifyFrpcDigest(path: string, expected: string): Promise<void>;
+export declare function publishFrpcPathForProcess(path: string): void;
 export declare function clearFrpcPathForProcess(): void;
 export declare function ensureFrpcBinary(opts?: EnsureFrpcBinaryOptions): Promise<string>;

package/dist/src/tunnel/frpc-binary.js

@@ -2,127 +2,115 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { init_paths, resolveBinDir } from "../config/paths.js";
 import { extractFrpcFromReleaseArchive, frpcReleaseArchiveExtension, nodePlatformForFrpTarget } from "./frpc-extract.js";
-import { tmpdir } from "node:os";
+import { FRPC_RELEASES, FRPC_VERSION } from "./frpc-release.js";
 import { join } from "node:path";
-import { chmodSync, createWriteStream, existsSync, mkdirSync, rmSync } from "node:fs";
-import { randomBytes } from "node:crypto";
+import { chmodSync, createReadStream, createWriteStream, existsSync, mkdirSync, mkdtempSync, renameSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { pipeline } from "node:stream/promises";
-import { Readable } from "node:stream";
+import { Readable, Transform } from "node:stream";
 //#region src/tunnel/frpc-binary.ts
 init_paths();
 init_logger();
 const log = createLogger("TunnelFrpc");
-const FRPC_VERSION = "0.62.1";
-const PLATFORM_MAP = {
-	darwin: "darwin",
-	linux: "linux",
-	win32: "windows"
-};
-const ARCH_MAP = {
-	x64: "amd64",
-	arm64: "arm64",
-	ia32: "386"
-};
-function buildFrpcReleaseBasename(frpPlatform, arch, version = FRPC_VERSION) {
-	return `frp_${version}_${frpPlatform}_${arch}`;
+const MAX_ARCHIVE_BYTES = 64 * 1024 * 1024;
+function buildFrpcReleaseBasename(platform, arch, version = FRPC_VERSION) {
+	return `frp_${version}_${platform}_${arch}`;
 }
-function frpcDownloadUrlsForTarget(frpPlatform, arch, version = FRPC_VERSION) {
-	const folder = buildFrpcReleaseBasename(frpPlatform, arch, version);
-	const ext = frpcReleaseArchiveExtension(frpPlatform);
-	return [
-		`https://frp.xopc.ai/bin/${folder}${ext}`,
-		`https://github.com/fatedier/frp/releases/download/v${version}/${folder}${ext}`,
-		`https://ghfast.top/https://github.com/fatedier/frp/releases/download/v${version}/${folder}${ext}`
-	];
+function frpcDownloadUrlsForTarget(platform, arch, version = FRPC_VERSION) {
+	const archive = buildFrpcReleaseBasename(platform, arch, version) + frpcReleaseArchiveExtension(platform);
+	return [`https://frp.xopc.ai/bin/${archive}`, `https://github.com/fatedier/frp/releases/download/v${version}/${archive}`];
 }
-function frpcPlatformArch() {
-	const platform = PLATFORM_MAP[process.platform] ?? process.platform;
-	const arch = ARCH_MAP[process.arch] ?? process.arch;
-	return {
-		platform,
-		arch,
-		folder: buildFrpcReleaseBasename(platform, arch)
-	};
+async function verifyFrpcDigest(path, expected) {
+	const hash = createHash("sha256");
+	await pipeline(createReadStream(path), hash);
+	if (hash.digest("hex") !== expected) throw new Error("COMPONENT_VERIFY_FAILED: frpc checksum mismatch");
 }
-function frpcDownloadUrls() {
-	const { platform, arch } = frpcPlatformArch();
-	return frpcDownloadUrlsForTarget(platform, arch);
-}
-async function downloadToFile(url, destPath, onProgress) {
-	const res = await fetch(url);
-	if (!res.ok || !res.body) throw new Error(`Download failed: ${res.status} ${url}`);
-	const contentLength = res.headers.get("content-length");
-	const totalBytes = contentLength && Number.isFinite(Number(contentLength)) ? Number(contentLength) : null;
+async function downloadToFile(url, path, onProgress) {
+	const response = await fetch(url, { signal: AbortSignal.timeout(6e4) });
+	if (!response.ok || !response.body) throw new Error(`frpc download failed: ${response.status}`);
+	const length = Number(response.headers.get("content-length"));
+	const totalBytes = length > 0 ? length : null;
+	if (totalBytes && totalBytes > MAX_ARCHIVE_BYTES) {
+		await response.body.cancel();
+		throw new Error("frpc archive exceeds size limit");
+	}
 	let bytesReceived = 0;
-	const report = () => {
+	const bounded = new Transform({ transform(chunk, _encoding, callback) {
+		bytesReceived += chunk.length;
+		if (bytesReceived > MAX_ARCHIVE_BYTES) return callback(/* @__PURE__ */ new Error("frpc archive exceeds size limit"));
 		onProgress?.({
 			phase: "downloading",
 			url,
 			bytesReceived,
 			totalBytes,
-			percent: totalBytes && totalBytes > 0 ? Math.min(100, Math.round(bytesReceived / totalBytes * 100)) : null
+			percent: totalBytes ? Math.min(100, Math.round(bytesReceived / totalBytes * 100)) : null
 		});
-	};
-	report();
-	const nodeStream = Readable.fromWeb(res.body);
-	nodeStream.on("data", (chunk) => {
-		bytesReceived += typeof chunk === "string" ? Buffer.byteLength(chunk) : chunk.length;
-		report();
-	});
-	await pipeline(nodeStream, createWriteStream(destPath));
-	report();
+		callback(null, chunk);
+	} });
+	await pipeline(Readable.fromWeb(response.body), bounded, createWriteStream(path, { mode: 384 }));
 }
-/** Set after a successful tunnel start so subprocesses can resolve the same binary. */
-function publishFrpcPathForProcess(binPath) {
-	process.env.XOPC_FRPC_PATH = binPath;
+function publishFrpcPathForProcess(path) {
+	process.env.XOPC_FRPC_PATH = path;
 }
-/** Clear runtime frpc path when the tunnel stops (no bundled Electron binary). */
 function clearFrpcPathForProcess() {
 	delete process.env.XOPC_FRPC_PATH;
 }
-async function ensureFrpcBinary(opts) {
-	const onProgress = opts?.onProgress;
-	const binName = `frpc${process.platform === "win32" ? ".exe" : ""}`;
-	const fromEnv = process.env.XOPC_FRPC_PATH?.trim();
-	if (fromEnv && existsSync(fromEnv)) return fromEnv;
-	const cacheDir = resolveBinDir();
-	mkdirSync(cacheDir, { recursive: true });
+async function ensureFrpcBinary(opts = {}) {
+	const platform = opts.platform ?? (process.platform === "win32" ? "windows" : process.platform);
+	const arch = opts.arch ?? (process.arch === "x64" ? "amd64" : process.arch);
+	const target = `${platform}_${arch}`;
+	if (!Object.hasOwn(FRPC_RELEASES, target)) throw new Error(`Unsupported frpc target: ${target}`);
+	const release = FRPC_RELEASES[target];
+	const fromEnv = !opts.platform && !opts.arch ? process.env.XOPC_FRPC_PATH?.trim() : void 0;
+	if (fromEnv) {
+		await verifyFrpcDigest(fromEnv, release.binary);
+		return fromEnv;
+	}
+	const cacheDir = join(resolveBinDir(), "frpc", FRPC_VERSION, target);
+	mkdirSync(cacheDir, {
+		recursive: true,
+		mode: 448
+	});
+	chmodSync(cacheDir, 448);
+	const binName = platform === "windows" ? "frpc.exe" : "frpc";
 	const cachePath = join(cacheDir, binName);
-	if (existsSync(cachePath)) return cachePath;
-	const tmpBase = join(tmpdir(), `xopc-frpc-${randomBytes(6).toString("hex")}`);
-	mkdirSync(tmpBase, { recursive: true });
-	const { platform, arch, folder } = frpcPlatformArch();
-	const archivePath = join(tmpBase, `frpc${frpcReleaseArchiveExtension(platform)}`);
-	const urls = frpcDownloadUrls();
-	let lastErr;
+	if (existsSync(cachePath)) try {
+		await verifyFrpcDigest(cachePath, release.binary);
+		return cachePath;
+	} catch {
+		log.warn({ target }, "Discarding unverified frpc cache");
+	}
+	const temporary = mkdtempSync(join(cacheDir, ".download-"));
+	const archivePath = join(temporary, "release" + frpcReleaseArchiveExtension(platform));
+	const executablePath = join(temporary, binName);
+	let lastError;
 	try {
-		for (const url of urls) try {
-			log.info({ url }, "Downloading frpc");
-			await downloadToFile(url, archivePath, onProgress);
-			onProgress?.({
+		for (const url of frpcDownloadUrlsForTarget(platform, arch)) try {
+			await downloadToFile(url, archivePath, opts.onProgress);
+			await verifyFrpcDigest(archivePath, release.archive);
+			opts.onProgress?.({
 				phase: "extracting",
-				url,
-				bytesReceived: 0,
-				totalBytes: null,
-				percent: null
+				url
 			});
-			await extractFrpcFromReleaseArchive(archivePath, cachePath, folder, nodePlatformForFrpTarget(platform));
-			if (process.platform !== "win32") chmodSync(cachePath, 493);
+			await extractFrpcFromReleaseArchive(archivePath, executablePath, buildFrpcReleaseBasename(platform, arch), nodePlatformForFrpTarget(platform));
+			await verifyFrpcDigest(executablePath, release.binary);
+			if (platform !== "windows") chmodSync(executablePath, 448);
+			renameSync(executablePath, cachePath);
 			return cachePath;
-		} catch (err) {
-			lastErr = err;
+		} catch (error) {
+			lastError = error;
 			log.warn({
 				url,
-				err
-			}, "frpc download attempt failed");
+				err: error
+			}, "Verified frpc download failed");
 		}
 	} finally {
-		rmSync(tmpBase, {
+		rmSync(temporary, {
 			recursive: true,
 			force: true
 		});
 	}
-	throw new Error(`Failed to download frpc v${FRPC_VERSION} for ${platform}/${arch}: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+	throw new Error(`Failed to obtain verified frpc for ${target}`, { cause: lastError });
 }
 //#endregion
-export { FRPC_VERSION, buildFrpcReleaseBasename, clearFrpcPathForProcess, ensureFrpcBinary, frpcDownloadUrlsForTarget, publishFrpcPathForProcess };
+export { FRPC_VERSION, buildFrpcReleaseBasename, clearFrpcPathForProcess, ensureFrpcBinary, frpcDownloadUrlsForTarget, publishFrpcPathForProcess, verifyFrpcDigest };

package/dist/src/tunnel/frpc-config.d.ts

@@ -1,3 +1,4 @@
 import type { TunnelRegistration } from './tunnel-types.js';
 export declare function resolveFrpcConfigPath(tunnelId: string): string;
-export declare function writeFrpcConfig(registration: TunnelRegistration, localPort: number, localHost?: string, mode?: 'http' | 'https'): string;
+export declare function removeFrpcConfig(tunnelId: string): void;
+export declare function writeFrpcConfig(registration: TunnelRegistration, localPort: number, localHost?: string): string;

package/dist/src/tunnel/frpc-config.js

@@ -1,34 +1,51 @@
 import { resolveStateDir } from "../config/paths-state.js";
 import { init_paths } from "../config/paths.js";
 import { join } from "node:path";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { rootCertificates } from "node:tls";
 //#region src/tunnel/frpc-config.ts
 init_paths();
 function resolveFrpcConfigPath(tunnelId) {
+	if (!/^[a-zA-Z0-9_-]+$/.test(tunnelId)) throw new Error("Invalid tunnel id");
 	const tmpDir = join(resolveStateDir(), "tmp");
-	mkdirSync(tmpDir, { recursive: true });
+	mkdirSync(tmpDir, {
+		recursive: true,
+		mode: 448
+	});
+	chmodSync(tmpDir, 448);
 	return join(tmpDir, `frpc-${tunnelId}.toml`);
 }
-function writeFrpcConfig(registration, localPort, localHost = "127.0.0.1", mode = "http") {
+function removeFrpcConfig(tunnelId) {
+	rmSync(resolveFrpcConfigPath(tunnelId), { force: true });
+}
+function writeFrpcConfig(registration, localPort, localHost = "127.0.0.1") {
 	const configPath = resolveFrpcConfigPath(registration.tunnelId);
+	const caPath = join(resolveStateDir(), "tmp", "frp-trusted-roots.pem");
+	writeFileSync(caPath, rootCertificates.join("\n"), { mode: 384 });
 	const { frpc } = registration;
+	for (const port of [localPort, frpc.serverPort]) if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("Invalid tunnel port");
+	const quote = JSON.stringify;
 	writeFileSync(configPath, `# Auto-generated by xopc — do not edit
-serverAddr = "${frpc.serverAddr}"
+serverAddr = ${quote(frpc.serverAddr)}
 serverPort = ${frpc.serverPort}
-metadatas.token = "${frpc.authToken}"
-
+metadatas.token = ${quote(frpc.authToken)}
 loginFailExit = false
+transport.tls.enable = true
+transport.tls.serverName = ${quote(frpc.serverAddr)}
+transport.tls.trustedCaFile = ${quote(caPath)}
 transport.heartbeatInterval = 10
 transport.heartbeatTimeout = 30
 
 [[proxies]]
-name = "${frpc.proxyName}"
-type = "${mode}"
-localIP = "${localHost}"
+name = ${quote(frpc.proxyName)}
+type = "http"
+localIP = ${quote(localHost)}
 localPort = ${localPort}
-subdomain = "${registration.subdomain}"
-`, "utf8");
+subdomain = ${quote(frpc.subdomain)}
+hostHeaderRewrite = ${quote(new URL(registration.publicUrl).hostname)}
+`, { mode: 384 });
+	chmodSync(configPath, 384);
 	return configPath;
 }
 //#endregion
-export { resolveFrpcConfigPath, writeFrpcConfig };
+export { removeFrpcConfig, resolveFrpcConfigPath, writeFrpcConfig };