dsh-cherry-bridge 0.1.11 → 0.2.0

package/src/httpApi.ts

@@ -9,6 +9,7 @@ import { CONTRACT_DIFFERENCES, buildDiagnostics, readScopeSegment } from './diag
 import type { DiagnosticsError, DiagnosticsStats, SubscriptionStat } from './diagnostics.js'
 import type { ScopeDoc, ToolScopeState } from './toolScope.js'
 import type { RefreshSummary } from './toolScopeHost.js'
+import { failureText } from './text.js'
 
 /**
  * The plugin's same-origin HTTP face (spec §3.7): device management REST plus
@@ -114,6 +115,10 @@ export interface DeviceSummary {
   enabled: boolean
   hosts: string[]
   port: number
+  /** The scheme each host is dialed with (issue #126); see `DeviceRecord`. */
+  security: Record<string, 'ws' | 'wss'>
+  /** The port each host is dialed with (issue #135); see `DeviceRecord`. */
+  ports: Record<string, number>
 }
 
 /** The `device-state` SSE payload. */
@@ -432,6 +437,9 @@ function writeQuarantineRefusal(res: HttpResponseLike, route: RouteContext, erro
   try {
     route.deps.onArchiveQuarantined?.(error)
   } catch (reportError) {
+    // LOCAL observer catch (issue #161 audit): the diagnostics ring is ours, so
+    // no peer text can reach this error — the object print (with its stack) is
+    // deliberate.
     console.warn('[cherry-remote] reporting the quarantined archive failed', reportError)
   }
   writeJson(res, 503, {
@@ -538,9 +546,20 @@ interface DevicePatch {
 }
 
 /**
- * Validates a PATCH body. `hosts` is WHOLE-REPLACE by contract, and `port` is
- * shared by every host (spec §3.2) — there is no per-host port and no merge
- * semantics to get wrong.
+ * Validates a PATCH body. `hosts` is WHOLE-REPLACE by contract.
+ *
+ * The map semantics this face owes (the record's per-host maps are DERIVED,
+ * never patched directly — there is no `ports` field in this body):
+ *
+ *  - neither `hosts` nor `port` patched → the maps are unchanged;
+ *  - `hosts` replaced → a host that stays keeps ITS OWN scheme and port, a new
+ *    host gets `ws` and the record-level port;
+ *  - a CHANGED `port` (with or without `hosts`) → EVERY final host is
+ *    re-pointed to it. The face has one port field, so leaving per-host
+ *    entries would make the edit inert for every listed host that already had
+ *    one. Sending the CURRENT value is a no-op for the maps — the settings page
+ *    sends both fields on every save, and a mixed-port record must not be
+ *    flattened by a save that did not change the port.
  */
 function parsePatch(body: Record<string, unknown>): DevicePatch {
   const patch: DevicePatch = {}
@@ -573,6 +592,12 @@ function parsePatch(body: Record<string, unknown>): DevicePatch {
       if (typeof entry !== 'string') throw new PatchError('hosts entries must be strings')
       return normalizeHost(entry)
     })
+    // Checked AFTER normalization: `[::1]` and `::1` collapse to one host. The
+    // scheme/port maps are keyed by host, so a duplicate has no single entry
+    // and silently last-wins — an ambiguous record, not an edit.
+    if (new Set(patch.hosts).size !== patch.hosts.length) {
+      throw new PatchError('hosts must not contain duplicates')
+    }
   }
 
   const port = body['port']
@@ -1053,6 +1078,8 @@ function listDevices(res: HttpResponseLike, route: RouteContext): void {
     enabled: device.enabled,
     hosts: [...device.hosts],
     port: device.port,
+    security: { ...device.security },
+    ports: { ...device.ports },
   }))
   writeJson(res, 200, devices)
 }
@@ -1255,11 +1282,13 @@ function deviceById(deps: CherryHttpDeps, deviceId: string): DeviceRecord {
   const found = deps.store.list().find((device) => device.deviceId === deviceId)
   if (found !== undefined) return found
   return {
-    schemaVersion: 2,
+    schemaVersion: 4,
     deviceId,
     displayName: '',
     hosts: [],
     port: 0,
+    security: {},
+    ports: {},
     desktopIdentity: '',
     grants: [],
     enabled: false,
@@ -1360,13 +1389,36 @@ async function patchDevice(
   const previousEnabled = existing.enabled
   const previousHosts = existing.hosts
   const previousPort = existing.port
+  const previousSecurity = existing.security
+  const previousPorts = existing.ports
+  // The per-host port map is DERIVED from the patch, never patched directly
+  // (there is no `ports` field in the body):
+  //  - no address field → unchanged;
+  //  - `hosts` replaced → a staying host keeps its own port, a new host gets the
+  //    record-level `port`;
+  //  - a CHANGED `port` (with or without `hosts`) → EVERY final host is
+  //    re-pointed; one port field on this face, so leaving per-host entries
+  //    would make the edit inert. Sending the CURRENT value is a no-op for the
+  //    map (see `parsePatch`), because the settings page sends both fields on
+  //    every save.
+  const nextPorts =
+    patch.port !== undefined && patch.port !== previousPort
+      ? portsFor(patch.hosts ?? previousHosts, {}, patch.port)
+      : patch.hosts === undefined
+        ? previousPorts
+        : portsFor(patch.hosts, previousPorts, previousPort)
   const next: DeviceRecord = {
     ...existing,
     ...(patch.displayName === undefined ? {} : { displayName: patch.displayName }),
     ...(patch.enabled === undefined ? {} : { enabled: patch.enabled }),
-    // hosts is WHOLE-REPLACE: the patch wins outright, never merges.
-    ...(patch.hosts === undefined ? {} : { hosts: patch.hosts }),
+    // hosts is WHOLE-REPLACE: the patch wins outright, never merges. The
+    // scheme map is keyed by host, so replacing the host list drops the
+    // entries for hosts that are gone and defaults the new ones to `ws` —
+    // keeping the OLD schemes indexed by the NEW list would be a stale
+    // pairing of host to scheme (issue #126).
+    ...(patch.hosts === undefined ? {} : { hosts: patch.hosts, security: securityFor(patch.hosts, previousSecurity) }),
     ...(patch.port === undefined ? {} : { port: patch.port }),
+    ports: nextPorts,
   }
 
   try {
@@ -1389,7 +1441,8 @@ async function patchDevice(
   // `connect()` to rebuild from the record we just wrote.
   const addressChanged =
     (patch.hosts !== undefined && !sameHosts(patch.hosts, previousHosts)) ||
-    (patch.port !== undefined && patch.port !== previousPort)
+    (patch.port !== undefined && patch.port !== previousPort) ||
+    !sameSecurity(next.security, previousSecurity)
   const enabledChanged = patch.enabled !== undefined && patch.enabled !== previousEnabled
 
   if (addressChanged) {
@@ -1409,6 +1462,11 @@ async function patchDevice(
     try {
       track(route.deps.connect(deviceId).connect(), warnConnect(deviceId))
     } catch (error) {
+      // LOCAL: only the synchronous construction failure lands here
+      // (`connectionFor` cannot find the record, or the identity failed to
+      // load). The DIAL's rejection carries peer text and is rendered by
+      // `warnConnect` below; this arm keeps the object print and its stack
+      // (issue #161's boundary).
       console.warn(`[cherry-remote] device ${deviceId} reconnect failed`, error)
     }
   }
@@ -1428,12 +1486,23 @@ async function patchDevice(
     enabled: next.enabled,
     hosts: [...next.hosts],
     port: next.port,
+    security: { ...next.security },
+    ports: { ...next.ports },
   })
 }
 
 function warnConnect(deviceId: string): (error: unknown) => void {
   return (error: unknown) => {
-    console.warn(`[cherry-remote] device ${deviceId} lifecycle change failed`, error)
+    // ONE bounded STRING (issue #161). This is the arm that receives the
+    // lifecycle rejection. The common case is `AllHostsUnreachableError`, whose
+    // message embeds the last per-host error as `last: <message>` — a `ws` /
+    // channel failure, or an RPC refusal's peer message (capped at 512 by the
+    // failure schema). The terminal arms add only local wrappers (`identity
+    // mismatch`, `protocol version incompatible`, `authenticate rejected
+    // (<reason>)` — an enum). The old form handed the error OBJECT to the
+    // console. Ceiling: `[cherry-remote] device ` (23) + deviceId +
+    // ` lifecycle change failed: ` (26) + LOG_TEXT_MAX (240).
+    console.warn(`[cherry-remote] device ${deviceId} lifecycle change failed: ${failureText(error)}`)
   }
 }
 
@@ -1442,6 +1511,56 @@ function sameHosts(a: readonly string[], b: readonly string[]): boolean {
   return a.length === b.length && a.every((host, index) => host === b[index])
 }
 
+/**
+ * The scheme map for a WHOLE-REPLACE host list (issue #126): each named host
+ * keeps the scheme it was dialed with, a host the list just gained defaults to
+ * `ws`, and hosts the list dropped leave no entry behind. An edit is an
+ * address edit, not a scheme edit — re-typing the same host must not silently
+ * demote a TLS-proxied desktop to a plain dial.
+ */
+function securityFor(
+  hosts: readonly string[],
+  previous: Record<string, 'ws' | 'wss'>,
+): Record<string, 'ws' | 'wss'> {
+  // `Object.hasOwn`, never `previous[host] ?? 'ws'`: a host named `constructor`
+  // (or `__proto__`/`toString`) would otherwise inherit a FUNCTION from
+  // Object.prototype and poison the map the store then rejects.
+  return Object.fromEntries(
+    hosts.map((host) => [host, Object.hasOwn(previous, host) ? previous[host] : 'ws']),
+  )
+}
+
+/**
+ * The port map for a host list (issue #135): each named host keeps the port it
+ * was dialed with, a host the list just gained defaults to `fallback` (the
+ * record-level port), and hosts the list dropped leave no entry behind.
+ *
+ * `previous` is empty when the caller is re-pointing EVERY host (a CHANGED
+ * `port` patch): there is no remembered entry to keep, by design — one port
+ * field on this face must move the whole list. Same `Object.hasOwn` rule as
+ * `securityFor`: an inherited function is not a remembered port.
+ */
+function portsFor(
+  hosts: readonly string[],
+  previous: Record<string, number>,
+  fallback: number,
+): Record<string, number> {
+  return Object.fromEntries(
+    hosts.map((host) => [host, Object.hasOwn(previous, host) ? previous[host] : fallback]),
+  )
+}
+
+/** Order-insensitive comparison for two scheme maps. */
+function sameSecurity(
+  a: Record<string, 'ws' | 'wss'>,
+  b: Record<string, 'ws' | 'wss'>,
+): boolean {
+  const keys = Object.keys(a)
+  if (keys.length !== Object.keys(b).length) return false
+  return keys.every((key) => a[key] === b[key])
+}
+
+
 /** Drops the pooled connection, closing any live socket first. */
 function evict(route: RouteContext, deviceId: string): void {
   try {
@@ -1555,6 +1674,8 @@ async function startPairing(req: HttpRequestLike, res: HttpResponseLike, route:
         try {
           route.deps.onArchiveQuarantined?.(error)
         } catch (reportError) {
+          // LOCAL observer catch (issue #161 audit): same ring as the PATCH
+          // route's, no peer text — the object print is deliberate.
           console.warn('[cherry-remote] reporting the quarantined archive failed', reportError)
         }
         // The shared instruction VERBATIM, with only the two contextual paths

package/src/index.ts

@@ -3,7 +3,7 @@ import { join } from 'node:path'
 import { DeviceStore } from './deviceStore.js'
 import { loadOrCreateIdentity } from './identity.js'
 import { DeviceConnection } from './connection.js'
-import type { DeviceState } from './connection.js'
+import type { DeviceState, WsDialOptions } from './connection.js'
 import { DEFAULT_PER_SESSION_CACHE_BYTES, DEFAULT_RATE_BUDGET_PER_SECOND } from './defaults.js'
 import { pairWithPayload } from './pairing.js'
 import { SessionSubscriptions } from './subscriptions.js'
@@ -21,6 +21,7 @@ import type {
 } from './httpApi.js'
 import type { DiagnosticsError } from './diagnostics.js'
 import { truncateErrorMessage } from './diagnostics.js'
+import { boundedJoin, failureText } from './text.js'
 
 export const name = 'cherry-remote'
 
@@ -97,11 +98,25 @@ export interface CherryBridgeConfig {
    * (not a protocol value). Omitted uses {@link DEFAULT_PER_SESSION_CACHE_BYTES}.
    */
   perSessionCacheBytes?: number
+  /**
+   * FLAT `tls.connect` options for every `wss` dial (issue #133): the operator's
+   * TLS trust for a desktop behind a private CA or a self-signed TLS front.
+   * `ws` forwards this bag straight to Node's TLS layer, so `{ ca: <pem> }` and
+   * `{ rejectUnauthorized: false }` belong at the TOP level — the `{ tls: {…} }`
+   * shape (`https`' wrapper) is not recognised by `ws` and is refused here.
+   * Applied to BOTH dial sites: the steady-state pool and pairing.
+   *
+   * NEVER persisted in the record, never logged, never reported: a `ca` is PEM
+   * CONTENT, and trust is a grant the operator makes, not a fact the desktop
+   * asserts about itself.
+   */
+  wsTls?: WsDialOptions
 }
 
 /**
- * The two config values that reach constructor arguments, with their defaults
- * applied.
+ * The plugin-config values that reach constructor arguments, resolved once: the
+ * two numeric budgets with their defaults applied, and the validated TLS trust
+ * bag (see {@link dialOptions}).
  *
  * Resolved ONCE per `apply` and threaded explicitly, rather than re-read at each
  * construction site: a config surface that can change between two constructions
@@ -110,6 +125,7 @@ export interface CherryBridgeConfig {
 export interface ResolvedBridgeConfig {
   rateBudgetPerSecond: number
   perSessionCacheBytes: number
+  wsTls: WsDialOptions | undefined
 }
 
 /**
@@ -130,11 +146,12 @@ export {
   DEFAULT_RATE_BUDGET_PER_SECOND,
 } from './defaults.js'
 
-/** Applies the documented fallbacks to the plugin config's numeric keys. */
+/** Applies the documented fallbacks and validates the plugin config's keys. */
 export function resolveBridgeConfig(config: CherryBridgeConfig = {}): ResolvedBridgeConfig {
   return {
     rateBudgetPerSecond: positive('rateBudgetPerSecond', config.rateBudgetPerSecond, DEFAULT_RATE_BUDGET_PER_SECOND),
     perSessionCacheBytes: positive('perSessionCacheBytes', config.perSessionCacheBytes, DEFAULT_PER_SESSION_CACHE_BYTES),
+    wsTls: dialOptions(config.wsTls),
   }
 }
 
@@ -164,6 +181,104 @@ function positive(key: string, value: unknown, fallback: number): number {
   return value
 }
 
+/** The keys {@link WsDialOptions} carries; anything else is a config mistake. */
+const WS_TLS_KEYS: ReadonlySet<string> = new Set(['rejectUnauthorized', 'ca'])
+
+/** The shape a non-object config value arrived as, for a value-free warning. */
+function shapeOf(value: unknown): string {
+  if (value === null) return 'null'
+  if (Array.isArray(value)) return 'array'
+  return typeof value
+}
+
+/**
+ * One `ca` entry: PEM CONTENT for a string, non-empty bytes for a Buffer.
+ *
+ * A string is the certificate TEXT itself, NEVER a file path: `tls.connect`
+ * would happily read whatever path it is handed, so accepting `'/etc/ssl/ca.pem'`
+ * would load bytes the operator never inspected. The header check is a SHAPE
+ * check only — whether the PEM parses beyond `-----BEGIN` is Node's business,
+ * and an unparseable body fails the handshake loudly, which is the honest
+ * verdict. Buffers keep the non-empty test with no header requirement: DER and
+ * programmatically built PEM bytes are legitimate `ca` values.
+ */
+function certificateEntry(value: unknown): boolean {
+  if (typeof value === 'string') return value.trimStart().startsWith('-----BEGIN')
+  if (Buffer.isBuffer(value)) return value.length > 0
+  return false
+}
+
+/**
+ * A configured TLS trust bag, or `undefined` when absent/unusable.
+ *
+ * ABSENT is the documented default (Node's trust store) and says nothing —
+ * exactly like {@link positive}. A key that is PRESENT but unusable is a
+ * deployment mistake that silently changes which peers are reachable, so it is
+ * warned about by name rather than swallowed — but NEVER by value: a `ca` is
+ * PEM CONTENT, and a certificate must not reach a log.
+ *
+ * FAIL CLOSED, WHOLE OBJECT. One unknown or malformed entry discards the WHOLE
+ * bag rather than forwarding the parts that happen to look right. Trust must be
+ * applied AS WRITTEN: a partially applied bag would reach some peers and not
+ * others with nothing telling the operator which half took effect, and their
+ * `ca` intention would be silently replaced by Node's default store. The
+ * fallback is "no override" — the same state as absent.
+ */
+function dialOptions(value: unknown): WsDialOptions | undefined {
+  if (value === undefined) return undefined
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    console.warn(
+      `[cherry-remote] config "wsTls" must be a plain object of flat tls.connect options ` +
+        `(got ${shapeOf(value)}); ignoring it`,
+    )
+    return undefined
+  }
+  const record = value as Record<string, unknown>
+  const unknownKeys = Object.keys(record).filter((key) => !WS_TLS_KEYS.has(key))
+  if (unknownKeys.length > 0) {
+    // The `{ tls: {…} }` wrapper is the common mistake (`https`' shape, which
+    // `ws` ignores), so naming the offending keys points straight at it.
+    console.warn(
+      `[cherry-remote] config "wsTls" carries unsupported key(s) ${unknownKeys.join(', ')}; ` +
+        'only flat rejectUnauthorized / ca are accepted — ignoring the whole object',
+    )
+    return undefined
+  }
+
+  const rejectUnauthorized = record['rejectUnauthorized']
+  if (rejectUnauthorized !== undefined && typeof rejectUnauthorized !== 'boolean') {
+    // FIELD only — a config value never enters the message.
+    console.warn(
+      '[cherry-remote] config "wsTls.rejectUnauthorized" must be a boolean; ignoring the whole object',
+    )
+    return undefined
+  }
+
+  const ca = record['ca']
+  if (ca !== undefined) {
+    const usable = Array.isArray(ca)
+      ? ca.length > 0 && ca.every((entry) => certificateEntry(entry))
+      : certificateEntry(ca)
+    if (!usable) {
+      // FIELD only — never the value: a `ca` is certificate text.
+      console.warn(
+        '[cherry-remote] config "wsTls.ca" must be PEM CONTENT (the certificate text itself, ' +
+          'not a file path) — a "-----BEGIN" string, a non-empty Buffer, or a non-empty array ' +
+          'of those; ignoring the whole object',
+      )
+      return undefined
+    }
+  }
+
+  // `{}` (or an explicit `undefined` value) is the documented default written
+  // out: no override, and no warning.
+  if (rejectUnauthorized === undefined && ca === undefined) return undefined
+  return {
+    ...(rejectUnauthorized === undefined ? {} : { rejectUnauthorized }),
+    ...(ca === undefined ? {} : { ca: ca as WsDialOptions['ca'] }),
+  }
+}
+
 /** The context slice `apply` touches beyond the HTTP face's own services. */
 export interface CherryBridgeContext extends CherryHttpContext, CherryToolsContext {
   effect?(callback: () => () => void): unknown
@@ -213,6 +328,13 @@ interface AssemblyState {
    */
   rateBudgetPerSecond: number
   perSessionCacheBytes: number
+  /**
+   * The current apply's TLS trust bag (issue #133), handed to BOTH dial sites —
+   * the pooled connection and pairing's temporary channel. Held on the state for
+   * the same reason as the two numeric values: a re-apply must move both faces
+   * onto the new config. `undefined` = Node's default trust store.
+   */
+  wsTls: WsDialOptions | undefined
   readonly connections: Map<string, DeviceConnection>
   /**
    * One subscription layer per device, sharing nothing with its siblings: the
@@ -275,6 +397,7 @@ const state: AssemblyState = {
   identityError: undefined,
   rateBudgetPerSecond: DEFAULT_RATE_BUDGET_PER_SECOND,
   perSessionCacheBytes: DEFAULT_PER_SESSION_CACHE_BYTES,
+  wsTls: undefined,
   connections: new Map(),
   subscriptions: new Map(),
   deviceStateListeners: new Set(),
@@ -363,6 +486,9 @@ function connectionFor(deviceId: string): DeviceConnection {
     identity: requireIdentity(),
     record,
     rateBudgetPerSecond: state.rateBudgetPerSecond,
+    // Spread-if-present, never `wsOptions: undefined`: the option is optional,
+    // and an absent key is the honest "no override" (Node's trust store).
+    ...(state.wsTls === undefined ? {} : { wsOptions: state.wsTls }),
   })
   state.connectionsBuilt += 1
   connection.onState((deviceState: DeviceState) => {
@@ -393,7 +519,18 @@ function connectionFor(deviceId: string): DeviceConnection {
     try {
       subsFor(deviceId).handleNotification(method, params)
     } catch (error) {
-      console.warn(`[cherry-remote] notification "${method}" for ${deviceId} failed`, error)
+      // ONE bounded STRING (issue #161): the old form passed the error OBJECT,
+      // so the console printed the error's name/message/stack with nothing
+      // bounding it. The layer's handler throws for no schema-valid
+      // notification today, but THIS try also calls `subsFor(deviceId)` →
+      // `connectionFor()`, which does throw today (`no device …` when the
+      // record was removed mid-race) — and a future handler throw must not hand
+      // the console an object either. Ceiling: `[cherry-remote] notification "`
+      // (30) + the notification schema's `method` cap (128) + `" for ` (6) +
+      // deviceId + ` failed: ` (9) + LOG_TEXT_MAX (240).
+      console.warn(
+        `[cherry-remote] notification "${method}" for ${deviceId} failed: ${failureText(error)}`,
+      )
     }
   })
   state.connections.set(deviceId, connection)
@@ -526,6 +663,31 @@ function subsFor(deviceId: string): SessionSubscriptions {
   return created
 }
 
+/**
+ * Bounds the link-recovery line's session-id list (issue #155).
+ *
+ * The number of ENTRIES is bounded only by the peer-advertised hello
+ * `subscriptions` — a number the peer chooses, not one this assembly can size —
+ * and a session id is the protocol's `opaqueId` (≤ 256 characters). The old
+ * `sessions.join(', ')` therefore emitted `entries × 258` characters into one
+ * info line: the protocol's own `remoteLimits.subscriptions` = 8 still allows
+ * ~2 KB, and a peer advertising more grows the line with no ceiling at all. The
+ * text is peer-controlled (the ids are echoed back from what the peer accepted
+ * as subscriptions), so it needs a LOCAL bound like every other such log.
+ *
+ * `RECOVERY_SESSIONS_MAX` = 320 is the joined ids' budget: eight normal
+ * 36-char UUIDs render as 8 × 36 + 7 × 2 = 302 characters, so the protocol's
+ * own subscription cap fits WHOLE — the bound bites only on a peer that
+ * advertises more room, or on a malformed over-long id.
+ * `RECOVERY_SESSION_ID_MAX` = 256 is that `opaqueId` cap, so a schema-valid id
+ * is never clipped; only a malformed one is. A list that stops early names the
+ * count (`(+K more)`) and rides ON TOP of the budget; entries are never dropped
+ * silently. The bound is on the LOG only — the loop still re-ensures every
+ * session.
+ */
+const RECOVERY_SESSIONS_MAX = 320
+const RECOVERY_SESSION_ID_MAX = 256
+
 /**
  * The reconnect recovery line (ruling 8): every session this device had
  * subscribed is re-ensured at its LAST cursor, so the peer replays only what
@@ -546,10 +708,16 @@ async function recoverSubscriptions(deviceId: string): Promise<void> {
   const sessions = subscriptions.activeSessions()
   // INFO (spec §5 「订阅建立与恢复」): the recovery line announces what it is
   // about to re-ensure, once per link recovery rather than once per session.
-  // Ids only — a session id is whitelisted, an event payload is not.
+  // Ids only — a session id is whitelisted, an event payload is not. The id
+  // list is bounded by {@link RECOVERY_SESSIONS_MAX} (issue #155); the
+  // `subscription(s)` count above it is the TRUE total, so a clipped list still
+  // says how many sessions are being recovered.
   if (sessions.length > 0) {
     console.info(
-      `[cherry-remote] recovering ${sessions.length} subscription(s) for ${deviceId}: ${sessions.join(', ')}`,
+      `[cherry-remote] recovering ${sessions.length} subscription(s) for ${deviceId}: ${boundedJoin(
+        sessions,
+        { max: RECOVERY_SESSIONS_MAX, itemMax: RECOVERY_SESSION_ID_MAX },
+      )}`,
     )
   }
 
@@ -566,7 +734,15 @@ async function recoverSubscriptions(deviceId: string): Promise<void> {
           (cursor === undefined ? '' : ` at seq ${cursor.seq}`),
       )
     } catch (error) {
-      console.warn(`[cherry-remote] re-subscribing session ${sessionId} of ${deviceId} failed`, error)
+      // ONE bounded STRING (issue #161). The catch is peer-triggered:
+      // `ensure` subscribes over the live link, and its failure message is the
+      // peer's JSON-RPC `error.message` verbatim (up to the 512-char failure
+      // schema cap) or a transport message. The old form handed the error
+      // OBJECT to the console, which then printed the stack plus every own
+      // property unbounded.
+      console.warn(
+        `[cherry-remote] re-subscribing session ${sessionId} of ${deviceId} failed: ${failureText(error)}`,
+      )
     }
   }
 }
@@ -603,6 +779,11 @@ function assemblyDeps(): CherryHttpDeps & CherryToolsDeps {
         payload: request.payload,
         store: state.store,
         ...(request.name === undefined ? {} : { name: request.name }),
+        // The same operator TLS trust the steady-state dial uses (issue #133):
+        // a desktop behind a private CA must be pairABLE over `wss` as well as
+        // reconnectable. Read from the assembly state, never from `request`: a
+        // caller cannot supply trust.
+        ...(state.wsTls === undefined ? {} : { wsOptions: state.wsTls }),
         onVerificationCode: request.onVerificationCode,
         // Pair bridging (ruling 10): the call site's stages reach the assembly's
         // progress fan-out, which is what the SSE route consumes.
@@ -715,6 +896,7 @@ export function apply(ctx: CherryBridgeContext, config: CherryBridgeConfig = {})
   const bridgeConfig = resolveBridgeConfig(config)
   state.rateBudgetPerSecond = bridgeConfig.rateBudgetPerSecond
   state.perSessionCacheBytes = bridgeConfig.perSessionCacheBytes
+  state.wsTls = bridgeConfig.wsTls
   state.store = new DeviceStore(join(dataDir, 'devices.json'))
 
   // A re-apply is a fresh assembly: the previous run's error summaries and