dsh-remote-control-plugin 0.4.0 → 0.4.1

package/INSTALL.md

@@ -4,12 +4,12 @@ Published as `dsh-remote-control-plugin`. Self-contained: no dependencies, no bu
 
 ## Install
 
-Web GUI: **Plugins → Add plugin**, enter `dsh-remote-control-plugin@0.4.0`, keep the official npm
+Web GUI: **Plugins → Add plugin**, enter `dsh-remote-control-plugin@0.4.1`, keep the official npm
 registry selected, then **Install** and **Enable now**. Restart DSH.
 
 From a chat (Standard or Creator preset — PTC disables `tool-plugin-manager`):
 
-> Install the DSH plugin bundle `dsh-remote-control-plugin@0.4.0` with plugin_manager.
+> Install the DSH plugin bundle `dsh-remote-control-plugin@0.4.1` with plugin_manager.
 
 ## Connect two machines
 
@@ -27,7 +27,7 @@ Same-LAN machines need no relay. No reachable machine? Run
 - Approvals live in `$DSH_HOME/remote-control-peers.json`; delete it to revoke.
 - Relay and control API share one port (default `57330`).
 - Peer traffic is signed but not encrypted; use a private network or TLS in front.
-- 0.4.0 fixes: ordered transcript chunks, hosted relay persistence, stale
+- 0.4.1 fixes: ordered transcript chunks, hosted relay persistence, stale
   relay peer pruning, relay fallback when a direct LAN route is blocked, a client
   module id that matches the package name, and a Devices config row for the
   remote session's model, permission preset, and plan mode. It also adds peer

package/README.md

@@ -15,19 +15,29 @@ Both drive `ctx.sessionController` in-process, so neither depends on the GUI's b
 
 ## How device trust works
 
-1. Each Host announces itself on UDP `discoveryPort` with its device id, display name, and
-   account id (when signed in).
-2. To control a peer, this Host sends `POST /peer/hello`. The **target** shows a pending
-   request in its own Devices panel; nothing is granted until a person there presses **Allow**.
-3. On approval the target issues a random per-peer secret. Every later call is signed
-   `HMAC-SHA256(secret, deviceId + method + path + timestamp + body)`, valid for 5 minutes of
-   clock skew.
-4. Approvals persist in `$DSH_HOME/remote-control-peers.json`. Deleting that file revokes
-   every device.
+1. Each Host generates a device identity once: an Ed25519 signing key and an X25519 agreement
+   key, stored as a credential-store record (a `0600` file only as a fallback). The fingerprint
+   is derived from the public key.
+2. Hosts announce themselves on UDP `discoveryPort` with device id, display name, and account id
+   (when signed in).
+3. To control a peer, this Host sends `POST /peer/hello` carrying its public key, fingerprint,
+   agreement key and a signed ephemeral key. The **target** shows a pending request in its own
+   Devices panel; nothing is granted until a person there presses **Allow** and the six-digit
+   short authentication string (SAS, derived from both fingerprints and the invite nonce) matches
+   on both screens.
+4. On approval the peer keys are pinned. Later calls carry an **Ed25519 signature** over method,
+   path, timestamp and a fresh nonce, with a five-minute skew window and a replay cache. The
+   legacy shared-secret HMAC is retired as soon as a key is pinned, because the approval response
+   that carried that secret crossed the relay in plaintext.
+5. Each approval records its scope list (`sessions:list`, `transcript:read`, `prompt:send`,
+   `stop`, `config:read`, `config:write`, `files:write`), the fingerprint, the agreement key and
+   the relay used. Scope edits and **Revoke** take effect immediately; revoking also drops the
+   cached keys.
+6. Approvals persist as credential-store grants; deleting the record revokes every device.
 
 There is deliberately no "same account implies trust" shortcut: two devices holding grants for
-the same account share no secret, so account id alone cannot authenticate a peer. The panel
-shows the account id of each candidate and flags a different account, but a person approves.
+the same account share no secret, so account id alone cannot authenticate a peer. The panel shows
+the account id of each candidate and flags a different account, but a person approves.
 
 ## Across networks (relay)
 
@@ -52,10 +62,32 @@ Host it on a VPS, NAS, or any always-on machine, put it behind TLS or a VPN, and
 `http://host:8787 <workspace key>` into every device.
 
 Either way the workspace key never leaves the devices: the relay only receives its SHA-256 as a
-group id. It forwards opaque `/peer/*` calls that stay signed end to end, so a compromised relay
-can drop or delay traffic but cannot forge a control command. Group membership alone grants
-nothing — the target still requires the one-time approval before any session call is accepted.
-Treat the relay as private: whoever holds the group id can join the group and *request* access.
+group id. It forwards opaque `/peer/*` calls, and after pairing every message is sealed end to
+end, so a compromised relay sees ciphertext and can only drop or delay traffic. Group membership
+alone grants nothing — the target still requires the one-time approval before any session call is
+accepted. Treat the relay as private: whoever holds the group id can join the group and *request*
+access.
+
+### Encryption
+
+Paired devices agree a session key with X25519 (ephemeral mixed with static when both sides
+completed the pairing handshake) → HKDF-SHA256 → ChaCha20-Poly1305. The relay envelope seals every
+message; on a direct LAN lane the request body and reply are sealed with a separate per-transport
+key, and transcript frames with another. Plaintext exists only during bootstrap: the `hello`
+request and the approval response that carries the peer's public keys.
+
+A peer that pinned an identity but has no agreement key is **refused** over the relay
+(`plaintext-refused`) rather than silently downgraded; `allowPlaintextFallback: true` opts out.
+Peers approved before identity keys existed keep the legacy HMAC path until they are re-approved.
+
+### Lane ladder
+
+Calls are attempted in order, each with its own budget: punched P2P (`p2pTimeoutMs`) → direct LAN
+(`directTimeoutMs`) → relay. A blocked direct lane is parked per peer for `routeBlockMs` and then
+retried as soon as fresh discovery evidence arrives. Latency-sensitive reads (`sessions`, session
+config) race the relay against the direct lane so only the first call after a network change pays
+a penalty; writes stay strictly ordered so a prompt can never run twice. `/state` reports `lane`,
+`transport`, `timing` and `blocked` per peer.
 
 ## Configuration
 
@@ -78,6 +110,13 @@ Defaults work on a LAN. Override the row in `$DSH_HOME/profiles/<profile>/cordis
     cookieDays: 30
     defaultCwd: ''
     tls: { certFile: '', keyFile: '' }
+    directTimeoutMs: 1000        # budget for one direct LAN call before fallback
+    streamConnectTimeoutMs: 2500 # budget for direct stream headers before fallback
+    p2pTimeoutMs: 800            # budget for the punched lane per call
+    routeBlockMs: 60000          # how long a failed lane stays parked
+    punchPort: 57332             # UDP lane; also needs an inbound UDP firewall rule
+    stunHost: stun.l.google.com  # or false to skip public mapping discovery
+    allowPlaintextFallback: false # refuse rather than downgrade a pinned peer
 ```
 
 The browser page and the peer API share the listener. When `host` is a wildcard, any IP literal
@@ -88,10 +127,20 @@ come from loopback.
 ## Threat model / limits
 
 - Approval is manual on purpose. A peer on the LAN can prompt for access; it cannot grant it.
+  Compare the six-digit SAS on both screens, and check the fingerprint when in doubt.
 - Prompts sent from a peer run with this Host's tools and permissions. Approve devices you
-  control.
-- Peer transport is plain HTTP. The peer secret crosses the LAN once, at approval time. Use a
-  private network or VPN, or set `tls` and front the port with a proxy.
+  control, and narrow scopes afterwards if a device only needs to read sessions.
+- Transport is encrypted: sealed bodies/replies and transcript frames on a direct lane, an AEAD
+  envelope over the relay. The relay sees ids, timing and ciphertext.
+- Legacy fallback: a peer approved before identity keys existed has no pinned key and still uses
+  the shared-secret HMAC in plaintext; a peer with a pinned identity but no agreement key is
+  refused over the relay unless `allowPlaintextFallback: true`. Re-approve to upgrade both.
+- Forward secrecy is per session: ephemeral keys live in memory and are re-established by the
+  startup re-handshake, so a restart briefly degrades to static-static agreement.
+- The construction is IK-shaped but **not Noise**: no protocol-name hash, no full handshake
+  transcript.
+- Uploads are capped at 25 MB per file and 100 MB per session, with a MIME allowlist; bytes only
+  enter the Host attachment store, never a caller-supplied path.
 - The pairing code protects the browser page only; it is printed at activation and stored in
   `$DSH_HOME/remote-control.json`.
 - Approvals that arrive while no Devices panel is open stay pending for up to 10 minutes.

package/client.js

@@ -515,6 +515,18 @@ window.__ModuleLoader__.load({
         refresh()
       }, [refresh])
 
+      const revoke = useCallback(async (deviceId) => {
+        setBusy(deviceId)
+        try {
+          await api('/remote-control/api/revoke', { deviceId })
+          setOpenPeer(null)
+        } catch (failure) {
+          setError(failure.message)
+        }
+        setBusy(null)
+        refresh()
+      }, [refresh])
+
       const open = useCallback(async (peer) => {
         setOpenPeer(peer)
         setSessions(null)
@@ -730,6 +742,32 @@ window.__ModuleLoader__.load({
                   ),
                   peer.approved
                     ? h('span', { style: { ...S.chip, ...S.chipOk } }, 'Trusted')
+                    : null,
+                  peer.approved
+                    ? h('span', {
+                      style: { ...S.chip, ...(peer.forwardSecrecy ? S.chipOk : S.chipWarn) },
+                      title: peer.forwardSecrecy ? 'Ephemeral channel established' : 'Only static agreement (restart or re-approve to refresh)',
+                    }, peer.forwardSecrecy ? 'E2E' : 'static')
+                    : null,
+                  peer.approved && peer.fingerprint
+                    ? h('span', { style: S.meta, title: `fingerprint ${peer.fingerprint}` }, String(peer.fingerprint).slice(0, 8))
+                    : null,
+                  peer.approved && Array.isArray(peer.scopes)
+                    ? h('span', { style: S.meta, title: peer.scopes.join(', ') }, `${peer.scopes.length} scopes`)
+                    : null,
+                  peer.approved && peer.needsReapproval
+                    ? h('span', {
+                      style: { ...S.chip, ...S.chipBad },
+                      title: 'This approval has no agreement key; approve again to enable encryption',
+                    }, 'Re-approve')
+                    : null,
+                  peer.approved
+                    ? h('button', {
+                      type: 'button',
+                      style: S.button,
+                      disabled: busy === peer.deviceId,
+                      onClick: (event) => { event.stopPropagation(); revoke(peer.deviceId) },
+                    }, 'Revoke')
                     : peer.connecting
                       ? h('span', { style: { ...S.chip, ...S.chipWarn } }, 'Waiting')
                       : h('button', {

package/host/fabric.js

@@ -432,6 +432,8 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
       approved: approvals.has(message.deviceId) || Boolean(existing?.approved),
       secret: approvals.get(message.deviceId)?.secret ?? existing?.secret,
     })
+    // Fresh discovery evidence: retry the direct lane on the next call.
+    routeBlocks.delete(message.deviceId)
   }
 
   function reap() {
@@ -891,49 +893,186 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
    * One signed call to a peer over whichever transport reaches it: the relay
    * when the peer was discovered there, direct HTTP for a LAN peer.
    */
-  async function peerCall(peer, method, pathname, body, secret) {
-    const approval = approvals.get(peer.deviceId)
-    const datagramLimit = 64 * 1024
+  const routeBlocks = new Map() // deviceId -> { lanUntil, p2pUntil, lastError }
+
+  function laneBlocked(deviceId, lane) {
+    const entry = routeBlocks.get(deviceId)
+    if (!entry) return false
+    return (lane === 'lan' ? entry.lanUntil : entry.p2pUntil) > Date.now()
+  }
+
+  function markLaneBlocked(deviceId, lane, reason) {
+    let entry = routeBlocks.get(deviceId)
+    if (!entry) { entry = { lanUntil: 0, p2pUntil: 0 }; routeBlocks.set(deviceId, entry) }
+    const holdMs = config.routeBlockMs ?? 60_000
+    if (lane === 'lan') entry.lanUntil = Date.now() + holdMs
+    else entry.p2pUntil = Date.now() + holdMs
+    entry.lastError = String(reason ?? 'unreachable')
+    log.warn(`[remote-control] ${lane} route to ${deviceId} parked for ${holdMs}ms: ${entry.lastError}`)
+  }
+
+  function markLaneHealthy(deviceId, lane) {
+    const entry = routeBlocks.get(deviceId)
+    if (!entry) return
+    if (lane === 'lan') entry.lanUntil = 0
+    else entry.p2pUntil = 0
+  }
+
+  function withTimeout(promise, ms) {
+    return new Promise((resolve) => {
+      const timer = setTimeout(() => resolve(undefined), ms)
+      timer.unref?.()
+      promise.then(
+        (value) => { clearTimeout(timer); resolve(value) },
+        () => { clearTimeout(timer); resolve(undefined) },
+      )
+    })
+  }
+
+  /** Resolve with the first non-undefined value; undefined when all fail. */
+  function firstSuccess(promises) {
+    return new Promise((resolve) => {
+      let pending = promises.length
+      let settled = false
+      for (const promise of promises) {
+        promise.then(
+          (value) => {
+            if (settled) return
+            if (value) { settled = true; resolve(value); return }
+            pending -= 1
+            if (pending === 0) resolve(undefined)
+          },
+          () => {
+            if (settled) return
+            pending -= 1
+            if (pending === 0) resolve(undefined)
+          },
+        )
+      }
+    })
+  }
+
+  async function peerCall(peer, method, pathname, body, secret, options = {}) {
+    const deviceId = peer.deviceId
+    const approval = approvals.get(deviceId)
     const bodySize = body === undefined ? 0 : JSON.stringify(body).length
-    if (p2pNode && approval?.punch && bodySize <= datagramLimit) {
-      const auth = authHeaders(peer.deviceId, method, pathname) ?? {}
-      const result = await p2pNode.request(
+    const started = Date.now()
+    const relayAvailable = Boolean(relay)
+    const directParked = laneBlocked(deviceId, 'lan')
+    const p2pParked = laneBlocked(deviceId, 'p2p')
+
+    const finish = (result, lane) => {
+      const elapsed = Date.now() - started
+      peer.lastTransport = lane
+      peer.lastTiming = { lane, ms: elapsed, at: Date.now() }
+      log.info(`[remote-control] ${method} ${pathname} ${deviceId} via ${lane} in ${elapsed}ms`)
+      return result
+    }
+
+    const viaRelayLane = () => relayCall(peer, method, pathname, body, secret)
+
+    const viaP2p = async () => {
+      if (!p2pNode || !approval?.punch || bodySize > 64 * 1024 || laneBlocked(deviceId, 'p2p')) return undefined
+      const auth = authHeaders(deviceId, method, pathname) ?? {}
+      const result = await withTimeout(p2pNode.request(
         { address: approval.punch.address, port: approval.punch.port },
-        peer.deviceId,
+        deviceId,
         {
           method,
           path: pathname,
           headers: { ...auth, accept: 'application/json', 'content-type': 'application/json' },
           bodyText: body === undefined ? '' : JSON.stringify(body),
         },
+      ), config.p2pTimeoutMs ?? 800)
+      if (!result?.ok) {
+        markLaneBlocked(deviceId, 'p2p', result?.error ?? 'p2p-timeout')
+        return undefined
+      }
+      markLaneHealthy(deviceId, 'p2p')
+      let json = {}
+      try { json = result.message.bodyText ? JSON.parse(result.message.bodyText) : {} } catch { json = {} }
+      return { ok: result.message.status >= 200 && result.message.status < 300, status: result.message.status, json }
+    }
+
+    const viaDirect = async () => {
+      const auth = authHeaders(deviceId, method, pathname)
+      const pair = lanCipherFor(deviceId)
+      const lane = pair
+        ? { seal: (value) => pair.seal(value), open: (packet) => pair.open(packet).toString('utf8') }
+        : undefined
+      const result = await callRaw(
+        peer, method, pathname, body, secret, self().deviceId, auth, lane,
+        config.directTimeoutMs ?? 1000,
       )
-      if (result.ok) {
-        peer.lastTransport = 'p2p'
-        let json = {}
-        try { json = result.message.bodyText ? JSON.parse(result.message.bodyText) : {} } catch { json = {} }
-        return { ok: result.message.status >= 200 && result.message.status < 300, status: result.message.status, json }
+      if (!result.error) {
+        markLaneHealthy(deviceId, 'lan')
+        return result
       }
-      // A failed datagram path falls through to LAN and then the relay.
+      markLaneBlocked(deviceId, 'lan', result.error)
+      return result
     }
-    if (peer.proto !== 'relay') {
-      const auth = authHeaders(peer.deviceId, method, pathname)
-      const pair = lanCipherFor(peer.deviceId)
+
+    // Happy-eyeballs for idempotent reads: the relay and the direct lane start
+    // together and the first answer wins. Never used for writes, so a prompt
+    // can still execute exactly once.
+    if (options.race && relayAvailable && peer.proto !== 'relay' && !directParked && !p2pParked) {
+      const auth = authHeaders(deviceId, method, pathname)
+      const pair = lanCipherFor(deviceId)
       const lane = pair
         ? { seal: (value) => pair.seal(value), open: (packet) => pair.open(packet).toString('utf8') }
         : undefined
-      const direct = await callRaw(peer, method, pathname, body, secret, self().deviceId, auth, lane)
-      if (!direct.error) {
-        peer.lastTransport = 'lan'
-        return direct
+      const directPromise = callRaw(
+        peer, method, pathname, body, secret, self().deviceId, auth, lane,
+        config.directTimeoutMs ?? 1000,
+      ).then((result) => {
+        if (result.error) { markLaneBlocked(deviceId, 'lan', result.error); return undefined }
+        markLaneHealthy(deviceId, 'lan')
+        return { lane: 'lan', result }
+      }, () => undefined)
+      const relayPromise = relayCall(peer, method, pathname, body, secret)
+        .then((result) => ((result.ok || result.status !== 503) ? { lane: 'relay', result } : undefined), () => undefined)
+      const winner = await firstSuccess([directPromise, relayPromise])
+      if (winner) return finish(winner.result, winner.lane)
+    }
+
+    // Relay-first once a direct lane is known blocked: only the first call pays
+    // the discovery penalty. A fresh announce clears the block again.
+    if (relayAvailable && peer.proto !== 'relay' && (directParked || p2pParked)) {
+      const relayed = await viaRelayLane()
+      if (relayed.ok || relayed.status !== 503) return finish(relayed, 'relay')
+      const fallback = await viaDirect()
+      if (!fallback.error) return finish(fallback, 'lan')
+      return finish(relayed, 'relay')
+    }
+
+    const datagram = await viaP2p()
+    if (datagram) return finish(datagram, 'p2p')
+    if (peer.proto !== 'relay') {
+      const direct = await viaDirect()
+      if (!direct.error) return finish(direct, 'lan')
+      if (relayAvailable) {
+        const relayed = await viaRelayLane()
+        if (relayed.ok || relayed.status !== 503) return finish(relayed, 'relay')
       }
-      const viaRelay = await relayCall(peer, method, pathname, body, secret)
-      return viaRelay.ok || viaRelay.status !== 503 ? viaRelay : direct
+      return finish(direct, 'lan')
     }
-    return relayCall(peer, method, pathname, body, secret)
+    return finish(await viaRelayLane(), 'relay')
   }
 
   async function relayCall(peer, method, pathname, body, secret) {
     if (!relay) return { ok: false, status: 503, json: { error: 'relay-offline' } }
+    // A peer that pinned an identity key but has no agreement key would send
+    // plaintext through the relay: that is a silent downgrade, so refuse it
+    // unless the operator opted in explicitly.
+    const approvalForCrypto = approvals.get(peer.deviceId)
+    if (approvalForCrypto?.publicKey && !approvalForCrypto?.agreementKey && config.allowPlaintextFallback !== true) {
+      log.warn(`[remote-control] refusing plaintext relay call to ${peer.deviceId}: no agreement key`)
+      return {
+        ok: false,
+        status: 403,
+        json: { error: 'plaintext-refused', message: 'This peer pinned an identity but no encryption key; approve it again to enable encryption.' },
+      }
+    }
     peer.lastTransport = 'relay'
     const callerId = self().deviceId
     const timestamp = String(Date.now())
@@ -963,13 +1102,13 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
     return { ok: reply.status >= 200 && reply.status < 300, status: reply.status, json: parsed }
   }
 
-  async function callPeer(deviceId, method, pathname, body) {
+  async function callPeer(deviceId, method, pathname, body, options) {
     syncRelayPeers()
     const peer = peers.get(deviceId)
     if (!peer) return { ok: false, status: 404, json: { error: 'unknown-peer' } }
     const approval = approvals.get(deviceId)
     if (!approval) return { ok: false, status: 403, json: { error: 'not-approved' } }
-    return peerCall(peer, method, pathname, body, approval.secret)
+    return peerCall(peer, method, pathname, body, approval.secret, options)
   }
 
   /** Relay one peer's SSE transcript to a local response (Devices panel). */
@@ -984,7 +1123,24 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
     const target = `/peer/stream?sessionId=${encodeURIComponent(sessionId)}`
     const timestamp = String(Date.now())
     const callerId = self().deviceId
-    if (config.p2pStreams !== false && p2pNode && approval.punch) {
+    const started = Date.now()
+    // A parked direct route goes straight to the relay: the stream must never
+    // hang waiting for headers a blocked LAN will not deliver.
+    if (relay && peer.proto !== 'relay' && laneBlocked(deviceId, 'lan')) {
+      relay.stream(peer.deviceId, {
+        path: target,
+        headers: {
+          accept: 'text/event-stream',
+          'x-dsh-peer-id': callerId,
+          'x-dsh-peer-ts': timestamp,
+          'x-dsh-peer-sig': sign(approval.secret, callerId, 'GET', target, timestamp, ''),
+          ...(authHeaders(deviceId, 'GET', target) ?? {}),
+        },
+      }, res)
+      peer.lastTiming = { lane: 'relay', ms: 0, at: Date.now(), reason: 'direct-parked' }
+      return
+    }
+    if (config.p2pStreams !== false && p2pNode && approval.punch && !laneBlocked(deviceId, 'p2p')) {
       const auth = authHeaders(deviceId, 'GET', target) ?? {}
       res.writeHead(200, {
         'content-type': 'text/event-stream; charset=utf-8',
@@ -1002,6 +1158,7 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
         },
       )
       if (!handle.ok) {
+        markLaneBlocked(deviceId, 'p2p', 'stream-open-failed')
         try { res.destroy() } catch { /* ignore */ }
         return
       }
@@ -1013,6 +1170,11 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
         json(res, 503, { error: 'relay-offline' })
         return
       }
+      if (approval.publicKey && !approval.agreementKey && config.allowPlaintextFallback !== true) {
+        log.warn(`[remote-control] refusing plaintext relay stream to ${deviceId}: no agreement key`)
+        json(res, 403, { error: 'plaintext-refused' })
+        return
+      }
       relay.stream(peer.deviceId, {
         path: target,
         headers: {
@@ -1042,6 +1204,10 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
       method: 'GET',
       headers: streamHeaders,
     }, (response) => {
+      responded = true
+      clearTimeout(connectTimer)
+      markLaneHealthy(deviceId, 'lan')
+      peer.lastTiming = { lane: 'lan', ms: Date.now() - started, at: Date.now() }
       res.writeHead(response.statusCode ?? 502, {
         'content-type': response.headers['content-type'] || 'text/event-stream; charset=utf-8',
         'cache-control': 'no-store, no-transform',
@@ -1079,16 +1245,26 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
       })
       response.on('end', () => { try { res.end() } catch { /* ignore */ } })
     })
-    upstream.on('error', () => {
+    let responded = false
+    const connectTimer = setTimeout(() => {
+      if (!responded) upstream.destroy(new Error('stream-connect-timeout'))
+    }, config.streamConnectTimeoutMs ?? 2500)
+    connectTimer.unref?.()
+    upstream.on('error', (error) => {
+      clearTimeout(connectTimer)
       // Same fallback as peerCall: a blocked LAN route may still reach the
       // peer through the outbound relay.
+      if (!responded) markLaneBlocked(deviceId, 'lan', error?.message || 'stream-failed')
       if (relay && !res.headersSent) {
         relay.stream(peer.deviceId, { path: target, headers: streamHeaders }, res)
         return
       }
       try { json(res, 502, { error: 'peer-unreachable' }) } catch { /* ignore */ }
     })
-    res.on('close', () => { try { upstream.destroy() } catch { /* ignore */ } })
+    res.on('close', () => {
+      clearTimeout(connectTimer)
+      try { upstream.destroy() } catch { /* ignore */ }
+    })
     upstream.end()
   }
 
@@ -1103,6 +1279,30 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
     handlePeer,
     rehandshake: rehandshakePeer,
     attemptPunch: punchPeer,
+    // Diagnostics used by the latency tests and by the Devices panel tooling.
+    simulateAnnounce(deviceId, address, port) {
+      onAnnounce(
+        { kind: ANNOUNCE_KIND, deviceId, deviceName: `simulated-${deviceId}`, userId: null, port, proto: 'http' },
+        { address },
+      )
+    },
+    setPeerAddress(deviceId, address, port) {
+      const peer = peers.get(deviceId)
+      if (!peer) return false
+      peer.address = address
+      if (Number.isInteger(port)) peer.port = port
+      return true
+    },
+    routeState(deviceId) {
+      const entry = routeBlocks.get(deviceId)
+      return entry ? { ...entry } : null
+    },
+    debugSetApproval(deviceId, patch) {
+      const approval = approvals.get(deviceId)
+      if (!approval) return false
+      approvals.set(deviceId, { ...approval, ...patch })
+      return true
+    },
     async clearPunch(peerDeviceId) {
       const approval = approvals.get(peerDeviceId)
       if (!approval) return { ok: false, error: 'unknown-peer' }
@@ -1158,6 +1358,9 @@ export function createFabric({ log, config, self, sessions, stateFile, store, up
           forwardSecrecy: Boolean(approvals.get(peer.deviceId)?.peerEphemeral && ephemerals.has(peer.deviceId)),
           lane: selectLane({ sameLan: peer.proto !== 'relay', punched: Boolean(approvals.get(peer.deviceId)?.punch), relayAvailable: Boolean(relay) }),
           transport: peer.lastTransport ?? (peer.proto === 'relay' ? 'relay' : 'lan'),
+          timing: peer.lastTiming ?? null,
+          blocked: { lan: laneBlocked(peer.deviceId, 'lan'), p2p: laneBlocked(peer.deviceId, 'p2p') },
+          needsReapproval: Boolean(approvals.get(peer.deviceId)?.publicKey && !approvals.get(peer.deviceId)?.agreementKey),
           punch: approvals.get(peer.deviceId)?.punch ?? null,
           candidates: Array.isArray(approvals.get(peer.deviceId)?.candidates) ? approvals.get(peer.deviceId).candidates.length : 0,
           punchPort: peer.punchPort ?? 0,
@@ -1191,7 +1394,7 @@ function sign(secret, deviceId, method, pathname, timestamp, body) {
     .digest('hex')
 }
 
-function callRaw(peer, method, pathname, body, secret, callerId, extraHeaders, lane) {
+function callRaw(peer, method, pathname, body, secret, callerId, extraHeaders, lane, timeoutMs = 15000) {
   return new Promise((resolve) => {
     let text = body === undefined ? '' : JSON.stringify(body)
     if (lane && body !== undefined) {
@@ -1219,7 +1422,7 @@ function callRaw(peer, method, pathname, body, secret, callerId, extraHeaders, l
       path: pathname,
       method,
       headers,
-      timeout: 15000,
+      timeout: timeoutMs,
     }, (res) => {
       let data = ''
       res.on('data', (chunk) => { data += chunk })

package/host/uploads.js

@@ -30,6 +30,7 @@ export function createUploadManager({ getAttachments, limits = {}, log = console
     sessionQuotaBytes: limits.sessionQuotaBytes ?? 100 * 1024 * 1024,
     ttlMs: limits.ttlMs ?? 10 * 60 * 1000,
     allowedTypes: new Set(limits.allowedTypes ?? DEFAULT_TYPES),
+    reaperMs: limits.reaperMs ?? 60_000,
   }
 
   const uploads = new Map()
@@ -40,7 +41,7 @@ export function createUploadManager({ getAttachments, limits = {}, log = console
     for (const [uploadId, upload] of uploads) {
       if (now - upload.at > config.ttlMs) uploads.delete(uploadId)
     }
-  }, 60_000)
+  }, config.reaperMs)
   reaper.unref?.()
 
   const fail = (status, error, message) => ({ status, error, message })

package/index.js

@@ -563,7 +563,7 @@ export function apply(ctx, rawConfig) {
       const operation = match[2]
       if (operation === 'session-config' && req.method === 'GET') {
         const sessionId = String(url.searchParams.get('sessionId') || '')
-        const reply = await fabric.callPeer(deviceId, 'GET', `/peer/session/config?sessionId=${encodeURIComponent(sessionId)}`)
+        const reply = await fabric.callPeer(deviceId, 'GET', `/peer/session/config?sessionId=${encodeURIComponent(sessionId)}`, undefined, { race: true })
         return json(res, reply.status ?? (reply.ok ? 200 : 502), reply.json ?? { error: reply.error })
       }
       if (operation === 'session-config' && req.method === 'POST') {
@@ -572,7 +572,7 @@ export function apply(ctx, rawConfig) {
         return json(res, reply.status ?? (reply.ok ? 200 : 502), reply.json ?? { error: reply.error })
       }
       if (operation === 'sessions' && req.method === 'GET') {
-        const reply = await fabric.callPeer(deviceId, 'GET', '/peer/sessions')
+        const reply = await fabric.callPeer(deviceId, 'GET', '/peer/sessions', undefined, { race: true })
         return json(res, reply.status ?? (reply.ok ? 200 : 502), reply.json ?? { error: reply.error })
       }
       if (operation === 'stream' && req.method === 'GET') {
@@ -1019,6 +1019,11 @@ function normalizeConfig(raw = {}) {
     stunHost: raw?.stunHost === false ? false : (typeof raw?.stunHost === 'string' ? raw.stunHost : 'stun.l.google.com'),
     stunPort: Number.isInteger(raw?.stunPort) ? raw.stunPort : 19302,
     stunTimeoutMs: Number.isInteger(raw?.stunTimeoutMs) ? raw.stunTimeoutMs : 1500,
+    directTimeoutMs: Number.isInteger(raw?.directTimeoutMs) ? raw.directTimeoutMs : 1000,
+    streamConnectTimeoutMs: Number.isInteger(raw?.streamConnectTimeoutMs) ? raw.streamConnectTimeoutMs : 2500,
+    p2pTimeoutMs: Number.isInteger(raw?.p2pTimeoutMs) ? raw.p2pTimeoutMs : 800,
+    routeBlockMs: Number.isInteger(raw?.routeBlockMs) ? raw.routeBlockMs : 60_000,
+    allowPlaintextFallback: raw?.allowPlaintextFallback === true,
     deviceName: typeof raw?.deviceName === 'string' && raw.deviceName.trim() ? raw.deviceName.trim() : os.hostname(),
     tls: raw?.tls && typeof raw.tls === 'object' ? { certFile: raw.tls.certFile, keyFile: raw.tls.keyFile } : null,
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-control-plugin",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "description": "Remote control for DSH: a Devices panel that discovers other DSH desktops signed into the same account, pairs with them once, and drives their sessions.",
   "exports": {