dsh-relay-phone 0.16.0 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-relay-phone",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Remote-control your local DeepSeek Harness from a phone through your own zero-knowledge relay: phone-first page, QR pairing, end-to-end encryption, approvals, full desktop UI fallback.",
   "type": "module",
   "main": "src/index.js",

package/src/boot-source.js

@@ -239,6 +239,12 @@ export function buildBootSource(id, gate) {
   // because it never named where it was going. The plaintext is now
   //   0x02 | u32 headerLen | JSON {m,t,c} | body
   // and the host refuses a request whose outer method/target disagree.
+  function bytesToBase64(bytes) {
+    var text = ''
+    for (var i = 0; i < bytes.length; i++) text += String.fromCharCode(bytes[i])
+    return btoa(text)
+  }
+
   var BOUND = 0x02
   function sealBound(method, target, contentType, bytes) {
     var enc = new TextEncoder()
@@ -373,7 +379,16 @@ export function buildBootSource(id, gate) {
       return bodyPromise.then(function (body) {
         var isRead = options.method === 'GET' || options.method === 'HEAD'
         if (body === null && isRead) {
-          // GET/HEAD: there is no body, so only the response is sealed.
+          // GET/HEAD: there is no body, so only the response is sealed - but the
+          // request still has to prove it came from this page. Without the proof
+          // header the relay could mint a GET of its own and make the host run it
+          // with the host cookie.
+          headers.set('x-relay-bind', bytesToBase64(sealBound(
+            options.method || 'GET',
+            absolute.pathname + absolute.search,
+            '',
+            new Uint8Array(8).fill(0),
+          )))
           return origFetch(finalUrl, Object.assign({}, options, { headers: headers }))
             .then(maybeUnwrap)
         }

package/src/crypto.js

@@ -13,6 +13,7 @@
 import nacl from 'tweetnacl'
 import crypto from 'node:crypto'
 import fs from 'node:fs'
+import path from 'node:path'
 
 const sha256 = (...parts) => {
   const hash = crypto.createHash('sha256')
@@ -50,9 +51,45 @@ export class CryptoBox {
     // entry falls out only after REPLAY_MEMORY newer envelopes), which for a
     // personal relay is days of traffic.
     this.openedNonces = new Set()
+    // A ticketed session survives a restart, so the replay memory must too: a
+    // relay that recorded a write before the restart could otherwise replay it
+    // afterwards. Written atomically and only when something new was opened.
+    this.noncePath = options.noncePath ?? null
+    this.nonceDirty = false
+    this.#loadNonces()
+    if (this.noncePath) {
+      this.nonceTimer = setInterval(() => this.flushNonces(), 5000)
+      this.nonceTimer.unref?.()
+    }
     this.#loadSessions()
   }
 
+  #loadNonces() {
+    if (!this.noncePath) return
+    try {
+      const raw = JSON.parse(fs.readFileSync(this.noncePath, 'utf8'))
+      if (!Array.isArray(raw?.nonces)) return
+      for (const hex of raw.nonces.slice(-REPLAY_MEMORY)) {
+        if (typeof hex === 'string' && /^[0-9a-f]{48}$/.test(hex)) this.openedNonces.add(hex)
+      }
+    } catch {
+      // Missing or corrupt file starts empty: the cost is the pre-restart window.
+    }
+  }
+
+  flushNonces() {
+    if (!this.noncePath || !this.nonceDirty) return
+    this.nonceDirty = false
+    const tmp = `${this.noncePath}.tmp`
+    try {
+      fs.mkdirSync(path.dirname(this.noncePath), { recursive: true, mode: 0o700 })
+      fs.writeFileSync(tmp, JSON.stringify({ nonces: [...this.openedNonces] }), { mode: 0o600 })
+      fs.renameSync(tmp, this.noncePath)
+    } catch {
+      // Losing this write only widens the window by one flush interval.
+    }
+  }
+
   /**
    * False when this nonce has been opened before, i.e. the ciphertext is a copy.
    * Bounded memory: oldest entries are dropped first, so a long-running process
@@ -62,6 +99,7 @@ export class CryptoBox {
     const id = nonce.toString('hex')
     if (this.openedNonces.has(id)) return false
     this.openedNonces.add(id)
+    this.nonceDirty = true
     if (this.openedNonces.size > REPLAY_MEMORY) {
       const excess = this.openedNonces.size - REPLAY_MEMORY
       let dropped = 0

package/src/files.js

@@ -8,6 +8,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { auditLog } from './identity.js'
+import { isLocalRequest } from './local-request.js'
 
 const MIME = {
   '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif',
@@ -23,6 +24,17 @@ export function registerFiles(ctx) {
     kind: 'exact',
     path: '/relay-bridge/files',
     handler: (req, res) => {
+      // This handler will read any absolute path the caller names, so who the
+      // caller is decides everything. Loopback peer plus loopback Host: a proxy
+      // forwarding to 127.0.0.1, or a rebound domain, is refused.
+      if (req.headers['x-dsh-relay'] || !isLocalRequest({
+        remoteAddress: req.socket?.remoteAddress,
+        host: req.headers.host,
+      })) {
+        res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })
+        res.end('dsh-relay: the file shuttle answers on localhost only.\n')
+        return
+      }
       const url = new URL(req.url ?? '/', 'http://x')
       const raw = url.searchParams.get('p') ?? ''
       if (!raw || raw.includes('\0')) {

package/src/index.js

@@ -56,7 +56,11 @@ export default class RelayBridgeService extends Service {
     this.config = this.mergeConfig(config, stored)
 
     this.identity = loadOrCreateIdentity()
-    this.cryptoBox = new CryptoBox(this.identity, { sessionsPath: path.join(identityDir(), 'sessions.json') })
+    this.cryptoBox = new CryptoBox(this.identity, {
+      sessionsPath: path.join(identityDir(), 'sessions.json'),
+      // Replay memory has to outlive the process, because a ticket does.
+      noncePath: path.join(identityDir(), 'seen-nonces.json'),
+    })
     this.pairing = new PairingService(this.cryptoBox, this.identity)
     this.pump = null
     this.client = null
@@ -193,7 +197,10 @@ export default class RelayBridgeService extends Service {
     this.identity = createIdentity()
     saveIdentity(this.identity)
     auditLog(`identity rotated -> ${this.identity.id} (all paired devices revoked)`)
-    this.cryptoBox = new CryptoBox(this.identity, { sessionsPath: path.join(identityDir(), 'sessions.json') })
+    this.cryptoBox = new CryptoBox(this.identity, {
+      sessionsPath: path.join(identityDir(), 'sessions.json'),
+      noncePath: path.join(identityDir(), 'seen-nonces.json'),
+    })
     this.cryptoBox.resetSessions() // rotation revokes every paired device
     this.pairing = new PairingService(this.cryptoBox, this.identity)
     this.mobile.cryptoBox = this.cryptoBox

package/src/local-request.js

@@ -0,0 +1,31 @@
+// "Is this request from the desktop itself?"
+//
+// The management panel and the local file shuttles are desktop tools: they hand
+// out the pairing link (which embeds the device PSK) and let the caller read
+// files. Both are registered on DSH's own web server, so whatever binds that
+// server decides who can reach them - a LAN exposure, a reverse proxy, or a
+// browser at another origin all end up looking like ordinary requests.
+//
+// Two independent facts must hold: the TCP peer must be loopback, and the Host
+// header must be a loopback name. The second one is what defeats DNS rebinding -
+// `evil.example` resolving to 127.0.0.1 arrives with `Host: evil.example`, which
+// is not a name the desktop would ever use.
+
+const LOOPBACK_ADDRESSES = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])
+const LOOPBACK_HOST = /^(?:localhost|127\.0\.0\.1|\[::1\])(?::\d{1,5})?$/i
+
+export function isLoopbackAddress(address) {
+  const value = String(address ?? '')
+  if (LOOPBACK_ADDRESSES.has(value)) return true
+  // 127.0.0.0/8 is all loopback; a resolved name may present any of it.
+  return /^127(?:\.\d{1,3}){3}$/.test(value)
+}
+
+export function isLoopbackHost(host) {
+  return LOOPBACK_HOST.test(String(host ?? ''))
+}
+
+/** Loopback peer AND loopback Host: the desktop, not a proxy or a rebound name. */
+export function isLocalRequest({ remoteAddress, host } = {}) {
+  return isLoopbackAddress(remoteAddress) && isLoopbackHost(host)
+}

package/src/pairing.js

@@ -119,7 +119,14 @@ export class PairingService {
 
     if (path === '/__relay/diag' && method === 'POST') {
       const payload = parseJson(bodyBuffer) ?? {}
-      auditLog(`diag ua=${String(payload.ua ?? '').slice(0, 120)} gate=${payload.gate} cookie=${payload.cookie} note=${String(payload.note ?? '').slice(0, 80)}`)
+      // Caller-supplied free text used to be written to the audit log verbatim:
+      // a newline in it forges log lines, and a 120-char UA string is enough to
+      // smuggle anything. Only shapes we expect survive.
+      const printable = (value, max) => String(value ?? '')
+        .replace(/[^\x20-\x7e]/g, '?')
+        .slice(0, max)
+      const note = /^[a-z0-9-]{0,32}$/.test(String(payload.note ?? '')) ? String(payload.note) : 'other'
+      auditLog(`diag ua=${printable(payload.ua, 60)} gate=${payload.gate === true} cookie=${payload.cookie === true} note=${note}`)
       return json({ ok: true })
     }
 

package/src/panel.js

@@ -7,6 +7,7 @@ import crypto from 'node:crypto'
 import QRCode from 'qrcode'
 import { identityDir } from './identity.js'
 import { COOKIE_NAME, TICKET_TTL_SECONDS } from './pairing.js'
+import { isLocalRequest } from './local-request.js'
 import fs from 'node:fs'
 import path from 'node:path'
 
@@ -98,6 +99,11 @@ export async function registerPanel(ctx, service) {
         res.end('dsh-relay: the management panel is desktop-only. Open it on 127.0.0.1.\n')
         return
       }
+      if (!isLocalRequest({ remoteAddress: req.socket?.remoteAddress, host: req.headers.host })) {
+        res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })
+        res.end('dsh-relay: the management panel answers on localhost only.\n')
+        return
+      }
       // Same ticket policy as /relay-bridge/api: a local page load mints one so
       // its write actions authenticate.
       if (!service.pairing.sessionForHeaders(req.headers)) {
@@ -131,6 +137,11 @@ export async function registerPanel(ctx, service) {
       if (req.headers['x-dsh-relay']) {
         return reply(403, { ok: false, error: 'desktop-only' })
       }
+      // Loopback peer *and* loopback Host: a proxy that forwards to loopback, or
+      // a rebound domain pointing at 127.0.0.1, must not read the PSK link.
+      if (!isLocalRequest({ remoteAddress: req.socket?.remoteAddress, host: req.headers.host })) {
+        return reply(403, { ok: false, error: 'localhost only' })
+      }
 
       // Pairing-ticket gate. Requests arriving through the relay already
       // carry a valid ticket (the pump refuses ticketless traffic), so this

package/src/pump.js

@@ -342,6 +342,18 @@ export class PumpManager {
       return
     }
     stream.info = info
+    // The path in the request line is raw, and the upstream may normalize it:
+    // `/assets/../api/private` matches the asset allowlist as a string but lands
+    // on a private API once DSH resolves the dots. Refuse anything whose
+    // canonical form differs from what was sent, so the string we allow is the
+    // string DSH routes.
+    const canonical = canonicalPath(info.path)
+    if (canonical === null || canonical !== info.path) {
+      auditLog(`relayed request with a non-canonical path refused (${info.path.slice(0, 120)})`)
+      this.respondInline(sid, 400, 'Bad Request')
+      this.closeStream(sid)
+      return
+    }
     // The phone's own connection can carry further requests after this one:
     // that is what saves a TLS handshake per asset on a mobile link.
     // DSH_RELAY_NO_KEEPALIVE=1 restores the old one-request-per-connection
@@ -391,6 +403,10 @@ export class PumpManager {
       stream.phase = 'local-body'
       stream.reqLength = Number(info.headers.get('content-length') ?? '0')
       stream.buffer = this.splitBody(stream, rest, stream.reqLength)
+      // A gate holder could otherwise open a pairing request, never send the body
+      // and sit on the device's slot forever: this is the same bounded wait the
+      // sealed path uses.
+      this.armIdle(sid, stream)
       this.maybeFinishLocal(sid, stream)
       return
     }
@@ -737,9 +753,58 @@ export class PumpManager {
     this.forwardSealed(sid, stream, plain)
   }
 
+  /**
+   * A sealed read has no body to bind, so the client proves it instead: a small
+   * sealed `{m,t}` envelope in `x-relay-bind`. Without it the relay could mint a
+   * GET of its own and make the host run it with the host cookie. Opening the
+   * proof also puts its nonce in the replay cache, so a captured header cannot
+   * be reused.
+   */
+  verifyReadProof(sid, stream) {
+    const info = stream.info
+    const header = info.headers.get('x-relay-bind')
+    if (!header) {
+      auditLog(`sealed read without a proof refused (${info.method} ${info.path})`)
+      this.respondInline(sid, 400, 'Bad Request', 'dsh-relay-phone: sealed reads need a proof header\n')
+      this.closeStream(sid)
+      return false
+    }
+    let sealed
+    try {
+      sealed = Buffer.from(String(header), 'base64')
+    } catch {
+      sealed = null
+    }
+    const proof = sealed && sealed.length >= SEALED_BODY_MIN
+      ? this.cryptoBox.open(this.cryptoBox.envelopeKey, sealed)
+      : null
+    if (!proof) {
+      auditLog(`sealed read with an unopenable proof refused (${info.path})`)
+      this.respondInline(sid, 400, 'Bad Request')
+      this.closeStream(sid)
+      return false
+    }
+    const { bound } = this.unwrapBound(proof)
+    if (!bound) {
+      auditLog(`sealed read with an unbound proof refused (${info.path})`)
+      this.respondInline(sid, 400, 'Bad Request')
+      this.closeStream(sid)
+      return false
+    }
+    const mismatch = this.boundMismatch(bound, info)
+    if (mismatch) {
+      auditLog(`sealed read proof mismatch: ${mismatch}`)
+      this.respondInline(sid, 400, 'Bad Request', 'dsh-relay-phone: sealed request was re-routed\n')
+      this.closeStream(sid)
+      return false
+    }
+    return true
+  }
+
   /** Send an opened (or bodyless) sealed request upstream and seal the response. */
   forwardSealed(sid, stream, plain, { responseOnly = false } = {}) {
     const info = stream.info
+    if (responseOnly && !this.verifyReadProof(sid, stream)) return
     const { body, bound } = this.unwrapBound(plain)
     if (bound) {
       const mismatch = this.boundMismatch(bound, info)
@@ -1279,6 +1344,30 @@ function rewriteAssetUrls(html, relay) {
  * @param query - raw query text, without the leading `?`.
  * @returns the gate value ('' when absent) and the remaining raw query.
  */
+/**
+ * Canonical form of a request path, or null when it cannot be one.
+ *
+ * Dot segments, encoded separators and backslashes are refused outright rather
+ * than resolved: the plugin decides what may pass on this string, and DSH
+ * decides what to route on its own normalization - those two must be the same.
+ */
+export function canonicalPath(rawPath) {
+  if (typeof rawPath !== 'string' || rawPath === '') return null
+  if (!rawPath.startsWith('/')) return null
+  let decoded
+  try { decoded = decodeURIComponent(rawPath) } catch { return null }
+  if (decoded.includes('\\') || decoded.includes('\0')) return null
+  if (decoded.includes('%')) return null // an encoded % is a second round of decoding
+  const trailingSlash = decoded.endsWith('/') && decoded !== '/'
+  const parts = []
+  for (const segment of decoded.split('/')) {
+    if (segment === '' || segment === '.') continue
+    if (segment === '..') return null
+    parts.push(segment)
+  }
+  return `/${parts.join('/')}${trailingSlash ? '/' : ''}`
+}
+
 export function stripGateParam(query) {
   const gate = new URLSearchParams(query).get('g') ?? ''
   const cleanQuery = query