dsh-relay-phone 0.18.2 → 0.18.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-relay-phone",
-  "version": "0.18.2",
+  "version": "0.18.4",
   "description": "Remote-control your local DeepSeek Harness from a phone through your own zero-knowledge relay: phone-first page, QR pairing, end-to-end encryption, approvals, full desktop UI fallback.",
   "type": "module",
   "main": "src/index.js",

package/src/boot-source.js

@@ -472,32 +472,44 @@ export function buildBootSource(id, gate) {
         try { userHandlers[i](ev) } catch (e) { console.error(e) }
       }
     }
-    function deliverSealed(b64) {
+    // Binary is a real message kind here: the client sets binaryType="arraybuffer"
+    // and the account avatar arrives that way. Decoding those bytes as text both
+    // corrupts them and makes the host reject the frame, which is what killed the
+    // mux when the account panel opened.
+    function deliverSealed(b64, isBinary) {
       var bin = atob(b64)
       var bytes = new Uint8Array(bin.length)
       for (var i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i)
       var plain = openEnvelope(bytes)
       if (!plain) return
+      if (isBinary) {
+        var copy = new Uint8Array(plain.length)
+        copy.set(plain)
+        return deliverRaw(copy.buffer)
+      }
       deliverRaw(new TextDecoder().decode(plain))
     }
     target.addEventListener('message', function (ev) {
       if (typeof ev.data !== 'string') return deliverRaw(ev.data)
       try {
         var parsed = JSON.parse(ev.data)
-        if (parsed && typeof parsed.__relay === 'string') return deliverSealed(parsed.__relay)
+        if (parsed && typeof parsed.__relay === 'string') {
+          return deliverSealed(parsed.__relay, parsed.__bin === 1)
+        }
       } catch (e) {}
       deliverRaw(ev.data)
     })
 
     var origSend = target.send.bind(target)
     target.send = function (data) {
-      var bytes = typeof data === 'string'
-        ? new TextEncoder().encode(data)
-        : new Uint8Array(data)
+      var isBinary = typeof data !== 'string'
+      var bytes = isBinary ? new Uint8Array(data) : new TextEncoder().encode(data)
       var sealed = sealEnvelope(bytes)
       var bin = ''
       for (var i = 0; i < sealed.length; i++) bin += String.fromCharCode(sealed[i])
-      origSend(JSON.stringify({ __relay: btoa(bin) }))
+      var wrapped = { __relay: btoa(bin) }
+      if (isBinary) wrapped.__bin = 1
+      origSend(JSON.stringify(wrapped))
     }
     Object.defineProperty(target, 'onmessage', {
       get: function () { return userListener },

package/src/pump.js

@@ -1100,10 +1100,12 @@ export class PumpManager {
       let out
       if (isDataFrame(frame.opcode)) {
         let plain = null
+        let binary = false
         try {
           const json = JSON.parse(frame.payload.toString('utf8'))
           if (json && typeof json.__relay === 'string') {
             plain = this.cryptoBox.open(this.cryptoBox.envelopeKey, Buffer.from(json.__relay, 'base64'))
+            binary = json.__bin === 1
           }
         } catch {}
         if (!plain) {
@@ -1117,10 +1119,10 @@ export class PumpManager {
           }
           plain = frame.payload
         }
-        // DSH 0.2's API gateway closes a binary frame with 1003 ("text
-        // messages required"). The boot patch always sends JSON text, so
-        // re-frame the decrypted payload as text upstream.
-        out = buildFrame(OPCODES.OP_TEXT, plain, { mask: true })
+        // Text stays text (the JSON protocol requires it) and binary stays binary:
+        // an ArrayBuffer payload forwarded as text is rejected by the host, and a
+        // text payload forwarded as binary is invisible to it.
+        out = buildFrame(binary ? OPCODES.OP_BINARY : OPCODES.OP_TEXT, plain, { mask: true })
       } else {
         out = buildFrame(frame.opcode, frame.payload, { mask: true, fin: frame.fin })
       }
@@ -1149,7 +1151,13 @@ export class PumpManager {
           : frame.payload
         stream.wsFragment = null
         const sealed = this.cryptoBox.seal(this.cryptoBox.envelopeKey, payload)
-        const json = Buffer.from(JSON.stringify({ __relay: sealed.toString('base64') }))
+        // Carry the message kind across the seal. The client sets
+        // binaryType="arraybuffer" and the account avatar arrives as binary;
+        // decoding it as text corrupts the bytes and the app then breaks the
+        // connection.
+        const wrapped = { __relay: sealed.toString('base64') }
+        if (frame.opcode === OPCODES.OP_BINARY) wrapped.__bin = 1
+        const json = Buffer.from(JSON.stringify(wrapped))
         this.client?.sendStream(sid, buildFrame(OPCODES.OP_TEXT, json, { mask: false }))
         continue
       }

package/src/relay-client.js

@@ -167,13 +167,13 @@ export class RelayClient extends EventTarget {
         let msg
         try { msg = JSON.parse(data.toString()) } catch { return }
         if (msg.t === 'challenge') {
-          // The relay stores only sha256(key) for a tenant key, so a tenant proof
-          // is keyed by that hash; the legacy admin --key is keyed by the key
-          // itself. Older relays do not send `mode` and only ever meant the admin
-          // derivation, so that stays the fallback.
+          // A tenant proof is keyed by a hash of the relay key (the relay never
+          // stores the key itself); the legacy admin --key is keyed by the key.
+          // Version 2 domain-separates the secret from the key id, and an older
+          // relay sends no `v`, so the v1 derivation stays the fallback.
           const key = String(this.relayKey)
           const secret = msg.mode === 'tenant'
-            ? crypto.createHash('sha256').update(key).digest('hex')
+            ? crypto.createHash('sha256').update(msg.v >= 2 ? `dsh-relay:hmac:v2:${key}` : key).digest('hex')
             : key
           const proof = crypto.createHmac('sha256', secret)
             .update(`${msg.nonce}|${this.identity.id}`).digest('hex')