botmux 3.14.0 → 3.16.0

package/dist/dashboard/terminal-front-proxy.d.ts

@@ -0,0 +1,55 @@
+import { type IncomingHttpHeaders, type IncomingMessage, type OutgoingHttpHeaders, type ServerResponse } from 'node:http';
+import type { Duplex } from 'node:stream';
+import { TERMINAL_VIEW_FORWARD_HEADER } from '../core/terminal-control-grant.js';
+import type { TerminalControlManager, TerminalDashboardActor } from './terminal-control.js';
+export declare const TERMINAL_CONTROL_HEADER = "x-botmux-terminal-control";
+export { TERMINAL_VIEW_FORWARD_HEADER };
+/** Covers daemon wake-up (up to 10s) plus a bounded worker handshake. Cleared
+ * as soon as response/upgrade headers arrive, so live streams stay unbounded. */
+export declare const TERMINAL_UPSTREAM_RESPONSE_TIMEOUT_MS = 30000;
+/**
+ * P1-2：upgrade 请求收到非 101 回应 = 一次拒绝，不是长连接。清掉唯一那道计时器
+ * 之后，一个不结束 body 的上游能把上游 socket 与浏览器 socket 一起挂死，没有任
+ * 何东西会回收它们。所以这条路保留总时限 + idle 时限（只有 idle 时限时，每 N 秒
+ * 滴一个字节就能永久续命），并给拒绝体加一个上限——预览那一跳早就有了。
+ */
+export declare const TERMINAL_UPGRADE_REJECTION_TIMEOUT_MS = 15000;
+export declare const TERMINAL_UPGRADE_REJECTION_IDLE_TIMEOUT_MS = 10000;
+export declare const MAX_TERMINAL_UPGRADE_REJECTION_BYTES: number;
+export interface TerminalFrontProxyOptions {
+    resolvePort(sessionId: string): number | undefined;
+    resolveActor(req: IncomingMessage): TerminalDashboardActor | null;
+    control: TerminalControlManager;
+    /** P1-5: resolve which auth session a bound `?viewToken=` read capability
+     * belongs to (null for anything that is not a valid bound capability for
+     * this session). Lets the proxy refuse revoked capabilities and index the
+     * bridged socket for logout-time closing. */
+    viewCapabilityAuthSession?(sessionId: string, viewToken: string): string | null;
+    /** P1-5: liveness of the auth session behind a bound capability. `false`
+     * means logout/expiry already revoked it — the request is refused even
+     * though the worker's stateless check would still accept the signature. */
+    isAuthSessionLive?(authSessionId: string): boolean;
+    /** P1-5: countersign an accepted view capability for the loopback hop. Only
+     * emitted after liveness passed, so the header IS the statement "the
+     * component holding the revocation state let this one through". Without it
+     * the worker refuses the capability, which is what makes a raw view URL
+     * aimed at the worker port or the daemon's own `/s/` proxy fail closed. */
+    viewCapabilityForwardProof?(viewToken: string): string | undefined;
+}
+export declare function parseTerminalFrontPath(pathname: string): {
+    sessionId: string;
+} | null;
+/**
+ * Authenticated Dashboard requests are converted to one signed loopback grant.
+ * Client-supplied cookies/role/grant headers are removed first. Token/viewToken
+ * query capabilities remain supported for legacy direct links and are handled
+ * independently by the worker.
+ */
+export declare function terminalForwardHeaders(headers: IncomingHttpHeaders, grant: string | undefined, options?: {
+    stripBrowserCredentials?: boolean;
+}): OutgoingHttpHeaders;
+export declare function createTerminalFrontProxy(options: TerminalFrontProxyOptions): {
+    handleHttp(req: IncomingMessage, res: ServerResponse, url: URL): boolean;
+    handleUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer): boolean;
+};
+//# sourceMappingURL=terminal-front-proxy.d.ts.map

package/dist/dashboard/terminal-front-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-front-proxy.d.ts","sourceRoot":"","sources":["../../src/dashboard/terminal-front-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EACV,sBAAsB,EACtB,sBAAsB,EAEvB,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,CAAC;AACxC;iFACiF;AACjF,eAAO,MAAM,qCAAqC,QAAS,CAAC;AAC5D;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,QAAS,CAAC;AAC5D,eAAO,MAAM,0CAA0C,QAAS,CAAC;AACjE,eAAO,MAAM,oCAAoC,QAAY,CAAC;AAE9D,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACnD,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAClE,OAAO,EAAE,sBAAsB,CAAC;IAChC;;;iDAG6C;IAC7C,yBAAyB,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAChF;;+EAE2E;IAC3E,iBAAiB,CAAC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD;;;;+EAI2E;IAC3E,0BAA0B,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACpE;AAQD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKrF;AAaD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GAClD,mBAAmB,CAgBrB;AA6DD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG;IAC5E,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC;IACzE,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5E,CAwRA"}

package/dist/dashboard/terminal-front-proxy.js

@@ -0,0 +1,397 @@
+import { requestLiteralLoopback } from '../core/loopback-target.js';
+import { TERMINAL_VIEW_FORWARD_HEADER } from '../core/terminal-control-grant.js';
+export const TERMINAL_CONTROL_HEADER = 'x-botmux-terminal-control';
+export { TERMINAL_VIEW_FORWARD_HEADER };
+/** Covers daemon wake-up (up to 10s) plus a bounded worker handshake. Cleared
+ * as soon as response/upgrade headers arrive, so live streams stay unbounded. */
+export const TERMINAL_UPSTREAM_RESPONSE_TIMEOUT_MS = 30_000;
+/**
+ * P1-2：upgrade 请求收到非 101 回应 = 一次拒绝，不是长连接。清掉唯一那道计时器
+ * 之后，一个不结束 body 的上游能把上游 socket 与浏览器 socket 一起挂死，没有任
+ * 何东西会回收它们。所以这条路保留总时限 + idle 时限（只有 idle 时限时，每 N 秒
+ * 滴一个字节就能永久续命），并给拒绝体加一个上限——预览那一跳早就有了。
+ */
+export const TERMINAL_UPGRADE_REJECTION_TIMEOUT_MS = 15_000;
+export const TERMINAL_UPGRADE_REJECTION_IDLE_TIMEOUT_MS = 10_000;
+export const MAX_TERMINAL_UPGRADE_REJECTION_BYTES = 64 * 1024;
+function safeDecodeSessionId(raw) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(raw);
+    }
+    catch {
+        return undefined;
+    }
+    return decoded && decoded.length <= 512 && !/[\\/\0]/.test(decoded) ? decoded : undefined;
+}
+export function parseTerminalFrontPath(pathname) {
+    if (!pathname.startsWith('/s/'))
+        return null;
+    const raw = pathname.slice(3).split('/')[0];
+    const sessionId = safeDecodeSessionId(raw);
+    return sessionId ? { sessionId } : null;
+}
+function sensitiveBrowserHeader(name) {
+    const lower = name.toLowerCase();
+    return lower === 'cookie'
+        || lower === 'authorization'
+        || lower === 'proxy-authorization'
+        || lower === 'referer'
+        || lower === 'forwarded'
+        || lower.startsWith('x-forwarded-')
+        || lower.startsWith('x-botmux-');
+}
+/**
+ * Authenticated Dashboard requests are converted to one signed loopback grant.
+ * Client-supplied cookies/role/grant headers are removed first. Token/viewToken
+ * query capabilities remain supported for legacy direct links and are handled
+ * independently by the worker.
+ */
+export function terminalForwardHeaders(headers, grant, options = {}) {
+    if (!grant && !options.stripBrowserCredentials) {
+        // Legacy query capabilities and platform headers retain their historical
+        // behavior, but an unauthenticated browser may never supply/replay the new
+        // internal grant header itself.
+        const forwarded = { ...headers };
+        delete forwarded[TERMINAL_CONTROL_HEADER];
+        return forwarded;
+    }
+    const forwarded = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined || sensitiveBrowserHeader(name))
+            continue;
+        forwarded[name] = value;
+    }
+    if (grant)
+        forwarded[TERMINAL_CONTROL_HEADER] = grant;
+    return forwarded;
+}
+function plainError(res, status, message) {
+    res.writeHead(status, {
+        'content-type': 'text/plain; charset=utf-8',
+        'cache-control': 'no-store',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(message);
+}
+function socketError(socket, status, message) {
+    if (socket.destroyed)
+        return;
+    const body = message;
+    const reason = status === 403 ? 'Forbidden'
+        : status === 404 ? 'Not Found'
+            : status === 409 ? 'Conflict'
+                : 'Bad Gateway';
+    socket.end([
+        `HTTP/1.1 ${status} ${reason}`,
+        'content-type: text/plain; charset=utf-8',
+        'cache-control: no-store',
+        'connection: close',
+        `content-length: ${Buffer.byteLength(body)}`,
+        '',
+        body,
+    ].join('\r\n'));
+}
+/**
+ * P1-4: the auth session this bridge belongs to, or `undefined` when the
+ * request is authorized by something other than a dashboard authentication.
+ *
+ * An explicit `?token=` / `?viewToken=` query capability that did NOT resolve
+ * to a bound view capability is deliberately excluded: P1-6 made that token the
+ * SOLE authorization basis, so the opener's ambient authentication must not
+ * decide its fate in either direction. Everything else — a bound view
+ * capability, an injected read grant, an injected write grant (leased or the
+ * platform owner's fixed one) — lives and dies with its auth session.
+ */
+function bridgeAuthSession(prepared) {
+    return prepared.readAuthSessionId
+        ?? (prepared.proxyGrant ? prepared.actor?.authSessionId : undefined);
+}
+export function createTerminalFrontProxy(options) {
+    const prepare = (req, url) => {
+        const parsed = parseTerminalFrontPath(url.pathname);
+        if (!parsed)
+            return null;
+        const port = options.resolvePort(parsed.sessionId);
+        const actor = options.resolveActor(req);
+        // An explicit `?token=` / `?viewToken=` query capability — no matter who
+        // carries it, platform/H5 actors included — is the SOLE authorization basis
+        // for the request (P1-6). No internal grant is injected next to it: a
+        // platform teammate/guest opening a correct write link used to receive a
+        // read grant that silently outranked the token at the worker, turning the
+        // explicitly issued 「操作链接」 read-only. Ambient Cookie / X-Botmux-Role
+        // headers are stripped for the same reason in the other direction: a wrong
+        // token must not become writable by borrowing the opener's owner ambient.
+        const hasExplicitQueryCapability = url.searchParams.has('token')
+            || url.searchParams.has('viewToken');
+        // P1-5: a bound view capability names the auth session it was minted for.
+        // Refuse it once that authentication ended (logout/expiry) — the worker's
+        // stateless signature/expiry check alone would still accept it.
+        let readAuthSessionId;
+        let viewForwardProof;
+        if (hasExplicitQueryCapability) {
+            const viewToken = url.searchParams.get('viewToken');
+            const boundAuthSession = viewToken
+                ? options.viewCapabilityAuthSession?.(parsed.sessionId, viewToken) ?? null
+                : null;
+            if (boundAuthSession && viewToken) {
+                if (options.isAuthSessionLive?.(boundAuthSession) === false) {
+                    return { ...parsed, port, revoked: true };
+                }
+                readAuthSessionId = boundAuthSession;
+                // Countersign only what this proxy just validated as live. The proof is
+                // bound to the exact capability string, so it can neither be moved onto
+                // a different grant nor be replayed by a browser that never sees it.
+                viewForwardProof = options.viewCapabilityForwardProof?.(viewToken);
+            }
+        }
+        const proxyGrant = actor && !hasExplicitQueryCapability
+            ? options.control.grantForProxy(actor, parsed.sessionId)
+            : undefined;
+        if (actor && proxyGrant?.scope === 'read')
+            readAuthSessionId = actor.authSessionId;
+        const headers = terminalForwardHeaders(req.headers, proxyGrant?.token, {
+            // Validate the explicit capability at the worker, but do not also send
+            // the legacy management cookie: a garbage `?token=` must not become a
+            // writable request merely because its opener is the owner Dashboard.
+            stripBrowserCredentials: hasExplicitQueryCapability,
+        });
+        // Set AFTER the header build, which drops every client-supplied `x-botmux-*`
+        // on this path: a browser can never smuggle its own forward proof through.
+        if (viewForwardProof)
+            headers[TERMINAL_VIEW_FORWARD_HEADER] = viewForwardProof;
+        return { ...parsed, port, revoked: false, actor, proxyGrant, readAuthSessionId, headers };
+    };
+    const handleHttp = (req, res, url) => {
+        if (!(url.pathname === '/s' || url.pathname.startsWith('/s/')))
+            return false;
+        const prepared = prepare(req, url);
+        if (!prepared?.port) {
+            plainError(res, 404, 'session terminal not available');
+            return true;
+        }
+        if (prepared.revoked) {
+            plainError(res, 403, 'view capability revoked');
+            return true;
+        }
+        const upstream = requestLiteralLoopback({ host: '127.0.0.1', port: prepared.port }, {
+            method: req.method,
+            path: req.url,
+            headers: prepared.headers,
+        }, up => {
+            upstream.setTimeout(0);
+            res.writeHead(up.statusCode ?? 502, up.headers);
+            // P1-2：浏览器提前断开时把上游一起收掉。`up.pipe(res)` 在 dest 关闭时只做
+            // unpipe，不会 destroy source；headers 一到又把 30s 的前置超时拆掉了，于是
+            // 这条上游没有任何东西会回收——终端这一跳同样有长响应（日志/流式输出）。
+            // `ClientRequest.destroy()` 可重入；响应已自然写完的情况不必多此一举。
+            res.on('close', () => { if (!res.writableEnded)
+                upstream.destroy(); });
+            up.pipe(res);
+        });
+        upstream.setTimeout(TERMINAL_UPSTREAM_RESPONSE_TIMEOUT_MS, () => upstream.destroy());
+        upstream.on('error', () => {
+            if (!res.headersSent)
+                plainError(res, 502, 'terminal proxy error');
+            else
+                res.end();
+        });
+        req.on('aborted', () => upstream.destroy());
+        req.pipe(upstream);
+        return true;
+    };
+    const handleUpgrade = (req, clientSocket, head) => {
+        let url;
+        try {
+            url = new URL(req.url ?? '/', 'http://localhost');
+        }
+        catch {
+            return false;
+        }
+        if (!(url.pathname === '/s' || url.pathname.startsWith('/s/')))
+            return false;
+        // Install this synchronously for every claimed upgrade path. Browser
+        // disconnects can race DNS/connect/401/404/502 handling; an EventEmitter
+        // `error` without a listener would otherwise terminate the Dashboard.
+        let upstreamRequest;
+        let bridgedSocket;
+        clientSocket.on('error', () => {
+            upstreamRequest?.destroy();
+            bridgedSocket?.destroy();
+            if (!clientSocket.destroyed)
+                clientSocket.destroy();
+        });
+        const prepared = prepare(req, url);
+        if (!prepared?.port) {
+            socketError(clientSocket, 404, 'session terminal not available');
+            return true;
+        }
+        if (prepared.revoked) {
+            socketError(clientSocket, 403, 'view capability revoked');
+            return true;
+        }
+        let responded = false;
+        const upstream = requestLiteralLoopback({ host: '127.0.0.1', port: prepared.port }, {
+            method: req.method,
+            path: req.url,
+            headers: prepared.headers,
+        });
+        upstreamRequest = upstream;
+        upstream.setTimeout(TERMINAL_UPSTREAM_RESPONSE_TIMEOUT_MS, () => upstream.destroy());
+        upstream.on('upgrade', (upRes, upstreamSocket, upstreamHead) => {
+            responded = true;
+            bridgedSocket = upstreamSocket;
+            upstream.setTimeout(0);
+            upstreamSocket.setTimeout(0);
+            // P1-4: the liveness check in `prepare` is a snapshot taken BEFORE the
+            // dial. Between it and this upstream 101 sits a real worker handshake
+            // (the response timeout alone allows 30s of daemon wake-up), and a
+            // logout / expiry / rotation / unbind landing inside that window revokes
+            // nothing here: the socket exists only as a local variable, so the
+            // revocation sweep walks the authSession→socket index and finds it
+            // absent. Registering it afterwards would file a live bridge under an
+            // already-dead auth session, where no future revocation reaches it
+            // either — it would survive until the worker's own read-capability
+            // expiry, up to ten more minutes.
+            //
+            // Re-check here, in the same synchronous tick that registers the socket.
+            // Revocation always deletes the session from the liveness authority
+            // BEFORE it sweeps the index (see DashboardSessionStore.endHash and
+            // dashboard.ts's endDashboardAuthSession), so the two possible orders are
+            // now: we register first and the sweep closes us, or the sweep already
+            // ran and this check refuses. There is no third order that leaks.
+            const authSessionId = bridgeAuthSession(prepared);
+            if (authSessionId !== undefined && options.isAuthSessionLive?.(authSessionId) === false) {
+                // Nothing is relayed: no 101, no registration, and the upstream socket
+                // dies so the worker does not keep a half-open bridge either.
+                upstreamSocket.destroy();
+                socketError(clientSocket, 403, 'authentication ended');
+                return;
+            }
+            let leaseMarker;
+            if (prepared.actor && prepared.proxyGrant?.scope === 'write' && prepared.proxyGrant.leaseMarker) {
+                const registered = options.control.registerWritableSocket(prepared.actor, prepared.sessionId, clientSocket, prepared.proxyGrant.leaseMarker);
+                leaseMarker = registered.leaseMarker;
+                if (!registered.registered) {
+                    // The worker may have accepted a grant that was valid when the dial
+                    // began but was released/expired/replaced during its async handshake.
+                    // Never relay that 101: revoke the matching old lease (if any) and
+                    // make the browser reconnect through the now-read-only path.
+                    options.control.disconnect(prepared.actor, prepared.sessionId, prepared.proxyGrant.leaseMarker);
+                    upstreamSocket.destroy();
+                    socketError(clientSocket, 409, 'terminal control expired');
+                    return;
+                }
+            }
+            // P1-5: index the stream under its auth session so logout/expiry closes
+            // it now rather than at the worker's grant-expiry timer. A leased write
+            // bridge is already carried by its lease's own socket set; everything
+            // else (bound view capability, injected read grant, and the platform
+            // owner's fixed write grant, which has no lease behind it) is indexed
+            // here — otherwise the liveness re-check above would only have moved the
+            // leak one tick later instead of closing it.
+            const deregisterBridgeSocket = authSessionId !== undefined && !leaseMarker
+                ? options.control.registerReadSocket(authSessionId, clientSocket)
+                : undefined;
+            const lines = [`HTTP/1.1 ${upRes.statusCode ?? 101} ${upRes.statusMessage ?? 'Switching Protocols'}`];
+            const raw = upRes.rawHeaders;
+            for (let i = 0; i + 1 < raw.length; i += 2)
+                lines.push(`${raw[i]}: ${raw[i + 1]}`);
+            lines.push('', '');
+            clientSocket.write(lines.join('\r\n'));
+            if (upstreamHead.length)
+                clientSocket.write(upstreamHead);
+            if (head.length)
+                upstreamSocket.write(head);
+            let disconnected = false;
+            const releaseOnDisconnect = () => {
+                if (disconnected)
+                    return;
+                disconnected = true;
+                deregisterBridgeSocket?.();
+                if (prepared.actor && leaseMarker) {
+                    options.control.disconnect(prepared.actor, prepared.sessionId, leaseMarker);
+                }
+            };
+            upstreamSocket.pipe(clientSocket);
+            clientSocket.pipe(upstreamSocket);
+            const cleanup = () => {
+                releaseOnDisconnect();
+                upstreamSocket.destroy();
+                clientSocket.destroy();
+            };
+            upstreamSocket.on('error', cleanup);
+            upstreamSocket.on('close', () => { releaseOnDisconnect(); clientSocket.destroy(); });
+            clientSocket.on('close', () => { releaseOnDisconnect(); upstreamSocket.destroy(); });
+        });
+        upstream.on('response', upRes => {
+            responded = true;
+            // P1-2：拒绝体必须在限期内读完，且有上限（见常量注释）。
+            let settled = false;
+            let totalTimer;
+            const disarm = () => {
+                settled = true;
+                if (totalTimer)
+                    clearTimeout(totalTimer);
+                totalTimer = undefined;
+            };
+            const abandon = () => {
+                if (settled)
+                    return;
+                disarm();
+                upRes.destroy();
+                upstream.destroy();
+                clientSocket.destroy();
+            };
+            upstream.setTimeout(TERMINAL_UPGRADE_REJECTION_IDLE_TIMEOUT_MS, abandon);
+            totalTimer = setTimeout(abandon, TERMINAL_UPGRADE_REJECTION_TIMEOUT_MS);
+            totalTimer.unref?.();
+            // 客户端先走时也要回收上游。升级请求的 socket 被 http server 摘掉 data 监听
+            // 后是暂停态，且 http server 建的 socket 是 allowHalfOpen——不 `resume()` 就
+            // 收不到 FIN，收到了也不会自动关。升级已被拒，客户端 FIN 即视为它走了。
+            clientSocket.on('close', abandon);
+            clientSocket.on('end', abandon);
+            clientSocket.resume();
+            const lines = [`HTTP/1.1 ${upRes.statusCode ?? 502} ${upRes.statusMessage ?? 'Bad Gateway'}`, 'connection: close'];
+            const raw = upRes.rawHeaders;
+            for (let i = 0; i + 1 < raw.length; i += 2) {
+                const name = raw[i].toLowerCase();
+                if (name === 'transfer-encoding' || name === 'content-length' || name === 'connection')
+                    continue;
+                lines.push(`${raw[i]}: ${raw[i + 1]}`);
+            }
+            lines.push('', '');
+            clientSocket.write(lines.join('\r\n'));
+            let bodyBytes = 0;
+            upRes.on('data', chunk => {
+                if (settled)
+                    return;
+                const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                bodyBytes += buffer.byteLength;
+                if (bodyBytes > MAX_TERMINAL_UPGRADE_REJECTION_BYTES) {
+                    abandon();
+                    return;
+                }
+                clientSocket.write(buffer);
+            });
+            upRes.on('end', () => {
+                if (settled)
+                    return;
+                disarm();
+                upstream.setTimeout(0);
+                clientSocket.end();
+            });
+            upRes.on('error', () => { disarm(); clientSocket.destroy(); });
+        });
+        upstream.on('error', () => {
+            if (!responded)
+                socketError(clientSocket, 502, 'terminal proxy error');
+            else
+                clientSocket.destroy();
+        });
+        upstream.end();
+        return true;
+    };
+    return { handleHttp, handleUpgrade };
+}
+//# sourceMappingURL=terminal-front-proxy.js.map

package/dist/dashboard/terminal-front-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-front-proxy.js","sourceRoot":"","sources":["../../src/dashboard/terminal-front-proxy.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAOjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,CAAC;AACxC;iFACiF;AACjF,MAAM,CAAC,MAAM,qCAAqC,GAAG,MAAM,CAAC;AAC5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,MAAM,CAAC;AAC5D,MAAM,CAAC,MAAM,0CAA0C,GAAG,MAAM,CAAC;AACjE,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAuB9D,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACtE,OAAO,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,KAAK,KAAK,QAAQ;WACpB,KAAK,KAAK,eAAe;WACzB,KAAK,KAAK,qBAAqB;WAC/B,KAAK,KAAK,SAAS;WACnB,KAAK,KAAK,WAAW;WACrB,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;WAChC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA4B,EAC5B,KAAyB,EACzB,UAAiD,EAAE;IAEnD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC/C,yEAAyE;QACzE,2EAA2E;QAC3E,gCAAgC;QAChC,MAAM,SAAS,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS,IAAI,sBAAsB,CAAC,IAAI,CAAC;YAAE,SAAS;QAClE,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK;QAAE,SAAS,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IACtE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,2BAA2B;QAC3C,eAAe,EAAE,UAAU;QAC3B,iBAAiB,EAAE,aAAa;KACjC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IAClE,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW;QACzC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW;YAC9B,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU;gBAC7B,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,CAAC,GAAG,CAAC;QACT,YAAY,MAAM,IAAI,MAAM,EAAE;QAC9B,yCAAyC;QACzC,yBAAyB;QACzB,mBAAmB;QACnB,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;QAC5C,EAAE;QACF,IAAI;KACL,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAClB,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CACxB,QAA8D;IAE9D,OAAO,QAAQ,CAAC,iBAAiB;WAC5B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IAIzE,MAAM,OAAO,GAAG,CAAC,GAAoB,EAAE,GAAQ,EAAkC,EAAE;QACjF,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACxC,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,0BAA0B,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;eAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,0EAA0E;QAC1E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,iBAAqC,CAAC;QAC1C,IAAI,gBAAoC,CAAC;QACzC,IAAI,0BAA0B,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,gBAAgB,GAAG,SAAS;gBAChC,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,IAAI;gBAC1E,CAAC,CAAC,IAAI,CAAC;YACT,IAAI,gBAAgB,IAAI,SAAS,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,gBAAgB,CAAC,KAAK,KAAK,EAAE,CAAC;oBAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC5C,CAAC;gBACD,iBAAiB,GAAG,gBAAgB,CAAC;gBACrC,wEAAwE;gBACxE,wEAAwE;gBACxE,qEAAqE;gBACrE,gBAAgB,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC,SAAS,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,0BAA0B;YACrD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC;YACxD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,KAAK,IAAI,UAAU,EAAE,KAAK,KAAK,MAAM;YAAE,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAAC;QACnF,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,uBAAuB,EAAE,0BAA0B;SACpD,CAAC,CAAC;QACH,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,gBAAgB;YAAE,OAAO,CAAC,4BAA4B,CAAC,GAAG,gBAAgB,CAAC;QAC/E,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;IAC5F,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAW,EAAE;QAClF,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;YAClF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,GAAG;YACb,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,EAAE,EAAE,CAAC,EAAE;YACN,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YAChD,mDAAmD;YACnD,wDAAwD;YACxD,uCAAuC;YACvC,kDAAkD;YAClD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,UAAU,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;;gBAC9D,GAAG,CAAC,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAE,YAAoB,EAAE,IAAY,EAAW,EAAE;QAC1F,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YAAC,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAClF,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7E,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,eAAsE,CAAC;QAC3E,IAAI,aAAiC,CAAC;QACtC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC5B,eAAe,EAAE,OAAO,EAAE,CAAC;YAC3B,aAAa,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,YAAY,CAAC,SAAS;gBAAE,YAAY,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;YAClF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,GAAG;YACb,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,eAAe,GAAG,QAAQ,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE;YAC7D,SAAS,GAAG,IAAI,CAAC;YACjB,aAAa,GAAG,cAAc,CAAC;YAC/B,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACvB,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAE7B,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,yEAAyE;YACzE,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,kCAAkC;YAClC,EAAE;YACF,yEAAyE;YACzE,oEAAoE;YACpE,oEAAoE;YACpE,0EAA0E;YAC1E,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,aAAa,CAAC,KAAK,KAAK,EAAE,CAAC;gBACxF,uEAAuE;gBACvE,8DAA8D;gBAC9D,cAAc,CAAC,OAAO,EAAE,CAAC;gBACzB,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,IAAI,WAA+B,CAAC;YACpC,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,KAAK,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;gBAChG,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,CACvD,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,SAAS,EAClB,YAAY,EACZ,QAAQ,CAAC,UAAU,CAAC,WAAW,CAChC,CAAC;gBACF,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;gBACrC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;oBAC3B,oEAAoE;oBACpE,sEAAsE;oBACtE,mEAAmE;oBACnE,6DAA6D;oBAC7D,OAAO,CAAC,OAAO,CAAC,UAAU,CACxB,QAAQ,CAAC,KAAK,EACd,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,UAAU,CAAC,WAAW,CAChC,CAAC;oBACF,cAAc,CAAC,OAAO,EAAE,CAAC;oBACzB,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,yEAAyE;YACzE,6CAA6C;YAC7C,MAAM,sBAAsB,GAAG,aAAa,KAAK,SAAS,IAAI,CAAC,WAAW;gBACxE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC;gBACjE,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,qBAAqB,EAAE,CAAC,CAAC;YACtG,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;YAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACnF,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,IAAI,YAAY,CAAC,MAAM;gBAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM;gBAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,MAAM,mBAAmB,GAAG,GAAG,EAAE;gBAC/B,IAAI,YAAY;oBAAE,OAAO;gBACzB,YAAY,GAAG,IAAI,CAAC;gBACpB,sBAAsB,EAAE,EAAE,CAAC;gBAC3B,IAAI,QAAQ,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;oBAClC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC,CAAC;YAEF,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAClC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,mBAAmB,EAAE,CAAC;gBACtB,cAAc,CAAC,OAAO,EAAE,CAAC;gBACzB,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC,CAAC;YACF,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrF,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE;YAC9B,SAAS,GAAG,IAAI,CAAC;YACjB,gCAAgC;YAChC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,UAAqD,CAAC;YAC1D,MAAM,MAAM,GAAG,GAAS,EAAE;gBACxB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,UAAU;oBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;gBACzC,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,EAAE,CAAC;gBACT,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,YAAY,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;YACzE,UAAU,GAAG,UAAU,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;YACxE,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;YACrB,qDAAqD;YACrD,gEAAgE;YAChE,0CAA0C;YAC1C,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChC,YAAY,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,EAAE,EAAE,mBAAmB,CAAC,CAAC;YACnH,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;YAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,YAAY;oBAAE,SAAS;gBACjG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBACvB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnE,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC;gBAC/B,IAAI,SAAS,GAAG,oCAAoC,EAAE,CAAC;oBACrD,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACnB,IAAI,OAAO;oBAAE,OAAO;gBACpB,MAAM,EAAE,CAAC;gBACT,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACvB,YAAY,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,SAAS;gBAAE,WAAW,CAAC,YAAY,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;;gBAClE,YAAY,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AACvC,CAAC"}

package/dist/dashboard/terminal-view-capability.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Short-lived read capability for the `/api/sessions/:id/view-link` URL.
+ *
+ * The link used to embed the worker's STABLE view token — an irrevocable
+ * bearer capability: an H5 viewer who fetched it once could keep reading the
+ * terminal long after logout/expiry, and a worker restart re-derived the same
+ * value. The view-link URL now carries a signed read grant instead, bound to
+ * sessionId + authSessionId + expiresAt.
+ *
+ * That alone was still bypassable (P1-5, second round): the returned URL kept
+ * the DAEMON/WORKER origin, so a copied raw URL — or a direct dial to the
+ * worker port / the daemon's own network-bound `/s/` reverse proxy — reached a
+ * stateless verifier that knew nothing about logout. Central revocation was
+ * decoration on a road nobody had to drive. Two changes close it, and the
+ * capability now names both of them in its own claims:
+ *
+ *   • CENTRAL-ONLY CONSUMPTION. `centralViewLinkPath` returns a same-origin
+ *     path on the central dashboard (`/s/<id>/?viewToken=…`) — the daemon /
+ *     worker origin never leaves this process. The capability is minted with
+ *     `audience: 'central'`, and the front proxy countersigns each accepted
+ *     capability with a forward proof the browser cannot compute. The worker
+ *     demands both, so a raw URL pointed at any other entry point fails closed
+ *     even though its signature and expiry are perfectly valid.
+ *   • WORKER GENERATION PINNING. The capability carries the worker's per-boot
+ *     generation (derived one-way from the boot view token the daemon already
+ *     reports). A worker restart re-randomizes it, so grants issued to a dead
+ *     boot die with it instead of surviving on the shared `.dashboard-secret`.
+ *
+ * Revocation therefore has two independent fences: the front proxy refuses a
+ * capability whose auth session ended (and closes its bridged sockets), and the
+ * worker refuses one that did not come through that proxy or that outlived the
+ * boot it was minted for.
+ *
+ * The TTL doubles as the periodic reconnect boundary for read sockets, so it
+ * is deliberately longer than the old 60s per-request read grants (which now
+ * share this constant) but still short enough that a copied URL dies quickly.
+ */
+export declare const TERMINAL_VIEW_CAPABILITY_TTL_MS: number;
+export interface TerminalViewCapabilityIdentity {
+    userId: string;
+    authSessionId: string;
+    /** Authentication expiry of the requesting identity; the minted capability
+     *  never outlives it. */
+    expiresAt: number;
+}
+/** Mint the short-lived, identity-bound read capability for one session.
+ *  `workerGeneration` pins the capability to the worker boot it was minted
+ *  against — see `upstreamWorkerViewGeneration`. */
+export declare function mintTerminalViewCapability(secret: string, sessionId: string, identity: TerminalViewCapabilityIdentity, workerGeneration: string, now?: number): {
+    token: string;
+    expiresAt: number;
+} | null;
+/**
+ * Read the worker boot generation out of the daemon-built view-link URL.
+ *
+ * That upstream URL still carries the worker's per-boot card token in
+ * `?viewToken=` — the one value that identifies the live worker generation and
+ * that this process must never pass through to a browser. We convert it to a
+ * one-way generation id here and drop the token itself.
+ *
+ * Fails closed (null) on a malformed URL, a non-http(s) scheme, a missing
+ * token, or an upstream that already handed us a signed grant: without a
+ * generation the caller must return an error rather than mint an unpinned
+ * capability.
+ */
+export declare function upstreamWorkerViewGeneration(secret: string, upstreamUrl: unknown): string | null;
+/**
+ * Build the browser-facing view link: a CENTRAL-ORIGIN RELATIVE path, never an
+ * absolute URL. The daemon's terminal-proxy port and the worker port are both
+ * reachable on the network and neither knows anything about auth-session
+ * liveness, so publishing either origin is the whole bypass — a relative path
+ * cannot name them, and cannot be repointed by a poisoned `Host` header the way
+ * a server-rebuilt absolute URL could.
+ *
+ * The path shape matches the front proxy's `/s/<sessionId>` route, which is
+ * also what the daemon's proxy and the worker accept after the loopback hops.
+ */
+export declare function centralViewLinkPath(sessionId: string, token: string): string | null;
+/**
+ * Resolve which auth session a bound `?viewToken=` capability belongs to, or
+ * null when the value is not a valid bound read capability for this session.
+ * Used by the front proxy to (a) refuse capabilities whose auth session was
+ * already revoked and (b) index the bridged socket for logout-time closing.
+ *
+ * A grant without `audience: 'central'` is an internal loopback credential that
+ * was never meant to travel in a URL; it resolves to null so the proxy neither
+ * blesses it nor countersigns it.
+ */
+export declare function terminalViewCapabilityAuthSession(secret: string, sessionId: string, viewToken: string | null | undefined, now?: number): string | null;
+/**
+ * Countersign one accepted view capability for the loopback hop. Only the front
+ * proxy calls this, and only after the capability's auth session was confirmed
+ * live — the proof is what tells the worker "this request came through the
+ * component that holds the revocation state".
+ */
+export declare function terminalViewForwardProof(secret: string, viewToken: string): string | undefined;
+//# sourceMappingURL=terminal-view-capability.d.ts.map

package/dist/dashboard/terminal-view-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-view-capability.d.ts","sourceRoot":"","sources":["../../src/dashboard/terminal-view-capability.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB;6BACyB;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;oDAEoD;AACpD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,8BAA8B,EACxC,gBAAgB,EAAE,MAAM,EACxB,GAAG,SAAa,GACf;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuB7C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMhG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,GAAG,SAAa,GACf,MAAM,GAAG,IAAI,CAMf;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9F"}