ciphermesh 2.9.0 → 2.11.0

package/src/shared/PluginManager.js

@@ -9,16 +9,39 @@ export function pluginDir() {
   return join(homedir(), '.ciphermesh', 'plugins');
 }
 
+/**
+ * Loads plugins, but only the ones the user has said yes to.
+ *
+ * A plugin is arbitrary JavaScript running inside the chat process, with the
+ * same reach as the client itself. That has always been documented, but until
+ * now any `.js` file appearing in the directory simply ran — which meant the
+ * warning protected nobody who had not already read it, and anything that could
+ * write one file to `~/.ciphermesh/plugins` had code execution.
+ *
+ * Approval is recorded **per file name**, not per plugin name, and that is
+ * forced rather than chosen: a plugin's own `name` is inside the module, and
+ * reading it means importing the module, and importing it is already running
+ * it. The check has to happen on something knowable from the directory listing.
+ *
+ * This is not a sandbox and is not presented as one. An approved plugin can do
+ * everything the client can do. What it buys is that the decision is now made
+ * by a person, once, per file — instead of by whatever put the file there.
+ */
 export class PluginManager {
-  #plugins; // Map<name, module>
-  #commands; // Map<cmdName, handler>
+  #plugins = new Map(); // name -> module
+  #commands = new Map(); // '/cmd' -> { handler, pluginName }
+  #pending = []; // files found but never approved
+  #failed = []; // files approved that would not load
 
-  constructor() {
-    this.#plugins = new Map();
-    this.#commands = new Map();
-  }
+  /**
+   * @param {string} dir
+   * @param {string[]} allowed file names the user has approved, with or
+   *   without the `.js` — `['roll']` and `['roll.js']` both mean the same file.
+   */
+  async loadAll(dir = pluginDir(), allowed = []) {
+    this.#pending = [];
+    this.#failed = [];
 
-  async loadAll(dir = pluginDir()) {
     if (!existsSync(dir)) {
       mkdirSync(dir, { recursive: true });
       return;
@@ -31,33 +54,69 @@ export class PluginManager {
       return;
     }
 
-    const jsFiles = files.filter((f) => f.endsWith('.js'));
-
-    for (const file of jsFiles) {
-      try {
-        const filePath = join(dir, file);
-        const fileUrl = pathToFileURL(filePath).href;
-        const mod = await import(fileUrl);
-        const plugin = mod.default || mod;
-
-        if (!plugin.name || !plugin.commands) {
-          continue;
-        }
-
-        this.#plugins.set(plugin.name, plugin);
-
-        for (const [cmdName, handler] of Object.entries(plugin.commands)) {
-          const normalized = cmdName.startsWith('/')
-            ? cmdName.toLowerCase()
-            : `/${cmdName.toLowerCase()}`;
-          this.#commands.set(normalized, { handler, pluginName: plugin.name });
-        }
-      } catch {
-        // Skip broken plugins silently
+    const approved = new Set(
+      (Array.isArray(allowed) ? allowed : [])
+        .filter((entry) => typeof entry === 'string')
+        .map((entry) => normalizeFileName(entry)),
+    );
+
+    for (const file of files.filter((f) => f.endsWith('.js'))) {
+      if (!approved.has(normalizeFileName(file))) {
+        this.#pending.push(file);
+        continue; // NOT imported: importing is running.
+      }
+      // Sequential on purpose: plugins load once at startup, and a predictable
+      // order means a command defined by two of them resolves the same way
+      // every run.
+      const loaded = await this.#load(dir, file);
+      if (!loaded) {
+        this.#failed.push(file);
       }
     }
   }
 
+  /** Load one already-approved file. @returns {boolean} */
+  async #load(dir, file) {
+    try {
+      const fileUrl = pathToFileURL(join(dir, file)).href;
+      const mod = await import(fileUrl);
+      const plugin = mod.default || mod;
+
+      if (!plugin.name || !plugin.commands) {
+        return false;
+      }
+
+      this.#plugins.set(plugin.name, plugin);
+
+      for (const [cmdName, handler] of Object.entries(plugin.commands)) {
+        const normalized = cmdName.startsWith('/')
+          ? cmdName.toLowerCase()
+          : `/${cmdName.toLowerCase()}`;
+        this.#commands.set(normalized, { handler, pluginName: plugin.name });
+      }
+      return true;
+    } catch {
+      return false; // a broken plugin must never stop the client starting
+    }
+  }
+
+  /**
+   * Approve and load a file that was sitting in the directory unapproved.
+   * The caller persists the name; this only affects the running session.
+   */
+  async approve(file, dir = pluginDir()) {
+    const target = this.#pending.find((f) => normalizeFileName(f) === normalizeFileName(file));
+    if (!target) {
+      return false;
+    }
+    const loaded = await this.#load(dir, target);
+    this.#pending = this.#pending.filter((f) => f !== target);
+    if (!loaded) {
+      this.#failed.push(target);
+    }
+    return loaded;
+  }
+
   getCommandNames() {
     return [...this.#commands.keys()];
   }
@@ -66,6 +125,16 @@ export class PluginManager {
     return [...this.#plugins.keys()];
   }
 
+  /** Files present but never approved, so the client can offer them. */
+  getPendingFiles() {
+    return [...this.#pending];
+  }
+
+  /** Approved files that would not load — otherwise this fails silently. */
+  getFailedFiles() {
+    return [...this.#failed];
+  }
+
   get pluginCount() {
     return this.#plugins.size;
   }
@@ -84,3 +153,7 @@ export class PluginManager {
     }
   }
 }
+
+function normalizeFileName(name) {
+  return name.toLowerCase().replace(/\.js$/, '').trim();
+}

package/src/shared/config.js

@@ -17,6 +17,10 @@ const ALLOWED = [
   'autoAway',
   'autoLock',
   'dnd',
+  // File names under ~/.ciphermesh/plugins the user has approved. A plugin is
+  // arbitrary code in the chat process, so nothing there runs until it appears
+  // here — see PluginManager.
+  'pluginsAllowed',
 ];
 
 export function configPath() {
@@ -40,6 +44,14 @@ export function parseConfig(raw) {
       out[k] = obj[k];
     }
   }
+  // The only key whose *shape* matters: a hand-edited string here would be
+  // iterated character by character, and "roll.js" would approve nothing while
+  // looking like it approved something.
+  if (out.pluginsAllowed !== undefined) {
+    out.pluginsAllowed = Array.isArray(out.pluginsAllowed)
+      ? out.pluginsAllowed.filter((entry) => typeof entry === 'string')
+      : [];
+  }
   return out;
 }
 

package/src/shared/constants.js

@@ -1,5 +1,40 @@
 export const PROTOCOL_VERSION = 2; // v2: sealed sender (encrypted_message carries `sealed`, no `from`)
 
+// ── Capability negotiation ─────────────────────────────────────
+// PROTOCOL_VERSION is an exact-equality gate, so it cannot express "newer, but
+// still able to talk to you". Capabilities fill that gap: a client lists what it
+// can do in JOIN, the relay hands the list on verbatim with the peer list, and a
+// feature turns on only when every member of the room advertises it. Absent or
+// empty means an older peer, which is the safe default rather than an error.
+export const CAP = {
+  // Group encryption on the relay path — one ciphertext for the whole room
+  // instead of one sealed envelope per peer. See
+  // docs/design/sender-keys-on-relay.md.
+  //
+  // From a client it means "I can *receive* a group message": I accept a sender
+  // key over the pairwise channel and can decrypt what that chain produces.
+  // From the relay it means "I can fan a room-addressed message out". Receive
+  // and fan-out land a release before anyone sends, so that by the time a sender
+  // exists, every advertised room can already read it.
+  SENDER_KEYS: 'sk1',
+};
+
+// What this client advertises. SENDER_KEYS is honest here: the receive path
+// exists. Nothing sends group messages yet.
+export const OWN_CAPABILITIES = [CAP.SENDER_KEYS];
+
+// What the relay advertises, in join_ack. A client cannot promise this on the
+// relay's behalf — the fan-out is the relay's job — so a sender has to check the
+// room *and* the hub it is sitting on before switching paths.
+export const SERVER_CAPABILITIES = [CAP.SENDER_KEYS];
+
+// Bounds. This list arrives from a public hub, so it is attacker-controlled.
+export const MAX_CAPABILITIES = 16;
+export const MAX_CAPABILITY_LENGTH = 24;
+
+// Ed25519 detached signature on a group message (src/crypto/SenderKey.js).
+export const SIGNATURE_SIZE = 64;
+
 // Network
 export const SERVER_PORT = 3600;
 export const HEARTBEAT_INTERVAL_MS = 30_000;
@@ -18,6 +53,21 @@ export const MAX_CONNECTIONS_PER_IP = 20; // per-source-IP socket cap
 export const JOIN_TIMEOUT_MS = 15_000; // drop sockets that never JOIN
 export const MESSAGE_RATE_LIMIT_PER_SECOND = 60; // per connection, ALL message types
 
+// How fast one source may *open* connections, as opposed to how many it may
+// hold. The concurrency cap never trips against churn — connect, handshake,
+// disconnect, repeat — and every one of those attempts costs the relay an
+// X25519 and an ML-KEM-768 operation while costing the client almost nothing.
+export const CONNECTION_RATE_PER_MINUTE = 60;
+
+// Bytes per second per connection, sustained. The message limit counts
+// messages, and messages are padded into buckets, so a session at 60/s is a
+// multi-megabit stream: bytes are the resource that actually runs out.
+export const MAX_BYTES_PER_SECOND = 1_048_576;
+// Burst allowance, so a file transfer is not mistaken for an attack. Must stay
+// comfortably above MAX_PAYLOAD_SIZE — a burst smaller than one frame could
+// never be paid for, and the connection would wedge instead of throttling.
+export const MAX_BYTES_BURST = 4_194_304;
+
 // Crypto sizes (libsodium Curve25519 + XSalsa20-Poly1305)
 export const NONCE_SIZE = 24;
 export const PUBLIC_KEY_SIZE = 32;

package/src/shared/pluginCommand.js

@@ -0,0 +1,106 @@
+import { loadConfig, saveConfig } from './config.js';
+
+/**
+ * `/plugins` for both controllers.
+ *
+ * Written once and shared because the relay client and the P2P client had
+ * separate copies of it, and separate copies of a command drift — one gains a
+ * subcommand the other never hears about, and the two `/help` lists stop
+ * describing the same program.
+ *
+ * Returns lines rather than printing, so each controller renders them with its
+ * own UI and the logic stays testable without a terminal.
+ *
+ * @returns {Promise<Array<{kind: 'info'|'error'|'system', text: string}>>}
+ */
+export async function pluginsCommand(manager, args = []) {
+  if (!manager) {
+    // Same words as an empty directory. From where the user sits the situation
+    // is identical — there is nothing to run — and "not available" would send
+    // them looking for a fault that is not theirs.
+    return [{ kind: 'info', text: 'No plugins. Put .js files in ~/.ciphermesh/plugins/' }];
+  }
+
+  const [sub, target] = args;
+
+  if (sub && sub.toLowerCase() === 'allow') {
+    return approve(manager, target);
+  }
+
+  if (sub) {
+    return [{ kind: 'error', text: 'Usage: /plugins  or  /plugins allow <file>' }];
+  }
+
+  return status(manager);
+}
+
+function status(manager) {
+  const lines = [];
+  const loaded = manager.getPluginNames();
+  const pending = manager.getPendingFiles();
+  const failed = manager.getFailedFiles();
+
+  if (loaded.length > 0) {
+    lines.push({ kind: 'info', text: `Plugins loaded (${loaded.length}): ${loaded.join(', ')}` });
+    const cmds = manager.getCommandNames();
+    if (cmds.length > 0) {
+      lines.push({ kind: 'info', text: `Commands: ${cmds.join(', ')}` });
+    }
+  } else if (pending.length === 0) {
+    lines.push({ kind: 'info', text: 'No plugins. Put .js files in ~/.ciphermesh/plugins/' });
+  }
+
+  if (pending.length > 0) {
+    // Deliberately blunt. A plugin is not an extension in a browser sandbox: it
+    // is code in this process, next to the keys, and the person approving it
+    // should be told that in the same breath as being told how.
+    lines.push({
+      kind: 'error',
+      text: `Not running (${pending.length}): ${pending.join(', ')}`,
+    });
+    lines.push({
+      kind: 'info',
+      text: 'A plugin runs inside this process and can do anything the client can — including reading your keys in memory. Approve one only if you wrote it or read it.',
+    });
+    lines.push({
+      kind: 'info',
+      text: `Approve with /plugins allow ${pending[0].replace(/\.js$/, '')}`,
+    });
+  }
+
+  if (failed.length > 0) {
+    lines.push({
+      kind: 'error',
+      text: `Approved but would not load: ${failed.join(', ')}`,
+    });
+  }
+
+  return lines;
+}
+
+async function approve(manager, file) {
+  if (!file) {
+    return [{ kind: 'error', text: 'Usage: /plugins allow <file>' }];
+  }
+
+  const loaded = await manager.approve(file);
+  if (!loaded) {
+    return [
+      {
+        kind: 'error',
+        text: `No unapproved plugin called "${file}". Run /plugins to see what is there.`,
+      },
+    ];
+  }
+
+  // Persisted only after it actually loaded, so a broken file does not end up
+  // permanently on the approved list.
+  const config = loadConfig();
+  const allowed = new Set(config.pluginsAllowed || []);
+  allowed.add(file.replace(/\.js$/, ''));
+  saveConfig({ pluginsAllowed: [...allowed] });
+
+  return [
+    { kind: 'system', text: `${file} approved and loaded. It will load on its own from now on.` },
+  ];
+}