dsh-relay-phone 0.12.2 → 0.13.0

package/README.md

@@ -30,8 +30,7 @@ dsh plugin --profile web add link:./packages/plugin
 Restart `dsh web` afterwards (the plugin is host-side code). Configure it from the sidebar's **Phone Entry** card → **Open console**; in the desktop app that navigates inside the window, so the port does not matter. Through the relay only the phone page and the documents/assets it loads are plaintext; every
 other request must carry a sealed envelope or it is refused with 403. A relay that could forward
 plaintext `/api/*` with the host cookie attached would be able to act as you, which would make the
-end-to-end encryption decorative. Replaying the full desktop UI over the relay is opt-in:
-`{ "allowDesktopPlaintext": true }` in the plugin config.
+end-to-end encryption decorative. The desktop UI works under that policy, because the injected boot patch seals its `fetch`/XHR/WebSocket traffic (a WebSocket handshake carries no data; its frames must open). `{ "allowDesktopPlaintext": true }` remains for clients that bypass the patch.
 
 The panel is deliberately **desktop-only**: it prints the pairing link, which carries the device key, so requests that arrive through the relay are refused.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-relay-phone",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "Remote-control your local DeepSeek Harness from a phone through your own zero-knowledge relay: phone-first page, QR pairing, end-to-end encryption, approvals, full desktop UI fallback.",
   "type": "module",
   "main": "src/index.js",

package/src/boot-source.js

@@ -197,13 +197,31 @@ export function buildBootSource(id, gate) {
   var envKey = nacl.hash(new Uint8Array([].concat(Array.prototype.slice.call(psk),
       Array.prototype.slice.call(new TextEncoder().encode('envelope'))))).slice(0, 32)
 
+  // Replay defence on this side too: the relay could re-submit an old *response*
+  // (a stale approval result, a stale session list). Remember the nonces we have
+  // opened and refuse a repeat; bounded so a long session cannot grow forever.
+  var seenNonces = typeof Set === 'function' ? new Set() : null
+  var SEEN_LIMIT = 20000
+
   function openEnvelope(bytes) {
     try {
       if (bytes.length < 24 + 16) return null
       var nonce = bytes.slice(0, 24)
       var box = bytes.slice(24)
       var opened = nacl.secretbox.open(box, nonce, envKey)
-      return opened ? new Uint8Array(opened) : null
+      if (!opened) return null
+      if (seenNonces) {
+        var id = ''
+        for (var i = 0; i < 24; i++) id += (nonce[i] < 16 ? '0' : '') + nonce[i].toString(16)
+        if (seenNonces.has(id)) return null
+        seenNonces.add(id)
+        if (seenNonces.size > SEEN_LIMIT) {
+          var excess = seenNonces.size - SEEN_LIMIT
+          var it = seenNonces.values()
+          for (var d = 0; d < excess; d++) seenNonces.delete(it.next().value)
+        }
+      }
+      return new Uint8Array(opened)
     } catch (e) { return null }
   }
   function sealEnvelope(bytes) {

package/src/crypto.js

@@ -20,6 +20,10 @@ const sha256 = (...parts) => {
   return new Uint8Array(hash.digest())
 }
 
+// How many opened envelopes to remember for replay detection. 50k * ~70 B
+// is a few megabytes, and on a personal relay it covers weeks of traffic.
+const REPLAY_MEMORY = 50_000
+
 export class CryptoBox {
   constructor(identity, options = {}) {
     this.psk = Buffer.from(identity.psk, 'hex') // 32 bytes
@@ -39,9 +43,36 @@ export class CryptoBox {
     // page was reloaded). Persist the table beside identity.json so a restart
     // keeps phones paired.
     this.sessionsPath = options.sessionsPath ?? null
+    // Replay defence. Every envelope carries a fresh random nonce, so seeing the
+    // same nonce twice means the ciphertext was captured and re-submitted by
+    // someone who cannot forge one — the relay is exactly that someone. Remember
+    // what has been opened and refuse a repeat; the set is bounded by count (an
+    // entry falls out only after REPLAY_MEMORY newer envelopes), which for a
+    // personal relay is days of traffic.
+    this.openedNonces = new Set()
     this.#loadSessions()
   }
 
+  /**
+   * False when this nonce has been opened before, i.e. the ciphertext is a copy.
+   * Bounded memory: oldest entries are dropped first, so a long-running process
+   * cannot grow without limit.
+   */
+  acceptNonce(nonce) {
+    const id = nonce.toString('hex')
+    if (this.openedNonces.has(id)) return false
+    this.openedNonces.add(id)
+    if (this.openedNonces.size > REPLAY_MEMORY) {
+      const excess = this.openedNonces.size - REPLAY_MEMORY
+      let dropped = 0
+      for (const old of this.openedNonces) {
+        this.openedNonces.delete(old)
+        if (++dropped >= excess) break
+      }
+    }
+    return true
+  }
+
   #loadSessions() {
     if (!this.sessionsPath) return
     try {
@@ -160,7 +191,12 @@ export class CryptoBox {
     const nonce = sealed.subarray(0, nacl.secretbox.nonceLength)
     const box = sealed.subarray(nacl.secretbox.nonceLength)
     const opened = nacl.secretbox.open(box, nonce, key)
-    return opened ? Buffer.from(opened) : null
+    if (!opened) return null
+    // A valid envelope that has been seen before is a replay: the relay recorded
+    // it and sent it again. Refusing it here covers every unseal path — HTTP
+    // bodies, the mobile RPC and websocket frames all come through `open`.
+    if (!this.acceptNonce(nonce)) return null
+    return Buffer.from(opened)
   }
 
   // -- shell signatures (Ed25519 over boot.js) --------------------------------

package/src/mobile/assets/app.js

@@ -115,11 +115,29 @@
     return out
   }
 
+  // The relay could re-submit an old response (stale approval result, stale
+  // session list). Refuse a nonce we have already opened; bounded for a phone.
+  var seenNonces = typeof Set === 'function' ? new Set() : null
+  var SEEN_LIMIT = 20000
+
   function openEnvelope(bytes) {
     try {
       if (bytes.length < 24 + 16) return null
-      var opened = nacl.secretbox.open(bytes.slice(24), bytes.slice(0, 24), envKey)
-      return opened ? new Uint8Array(opened) : null
+      var nonce = bytes.slice(0, 24)
+      var opened = nacl.secretbox.open(bytes.slice(24), nonce, envKey)
+      if (!opened) return null
+      if (seenNonces) {
+        var id = ''
+        for (var i = 0; i < 24; i++) id += (nonce[i] < 16 ? '0' : '') + nonce[i].toString(16)
+        if (seenNonces.has(id)) return null
+        seenNonces.add(id)
+        if (seenNonces.size > SEEN_LIMIT) {
+          var excess = seenNonces.size - SEEN_LIMIT
+          var it = seenNonces.values()
+          for (var d = 0; d < excess; d++) seenNonces.delete(it.next().value)
+        }
+      }
+      return new Uint8Array(opened)
     } catch (error) {
       return null
     }

package/src/pump.js

@@ -56,6 +56,8 @@ const PLAINTEXT_DOCUMENT = new RegExp(
   '/favicon\\.ico|' +
   '/assets/[A-Za-z0-9._@/-]+|' + // built UI bundles
   '/plugins/[A-Za-z0-9._@/%-]*|' + // client bundle entry (/plugins/??pkg/file.js)
+  // "open in app" menu icons: plain <img> loads, no extension, no session data
+  '/open-in-app/icon/[A-Za-z0-9._-]+|' +
   '/[^?]*\\.(?:js|mjs|css|map|json|png|jpe?g|gif|svg|webp|avif|ico|woff2?|ttf|otf)' +
   ')$',
 )