herdr-remote 0.2.8 → 0.2.10

package/dist/tui.mjs

@@ -76,7 +76,10 @@ var require_config = __commonJS({
         publicUrl: "",
         // Operator-run relay, e.g. wss://herdr.example.com (mode "remote" only).
         remoteUrl: "",
-        maxPayloadBytes: 1024 * 1024,
+        // Kept in step with the relay package's own default: the CLI starts a
+        // relay of its own, and a smaller ceiling here would reject an upload the
+        // hosted relay accepts.
+        maxPayloadBytes: 5 * 1024 * 1024,
         maxClientsPerHost: 16,
         maxHosts: 1024,
         maxPendingHandshakes: 1024,
@@ -4012,7 +4015,7 @@ function About({ ctx }) {
         children: updateLabel
       }
     ) }),
-    /* @__PURE__ */ jsx10(Row, { label: t("about.version"), children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: "0.2.8" }) }),
+    /* @__PURE__ */ jsx10(Row, { label: t("about.version"), children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: "0.2.10" }) }),
     /* @__PURE__ */ jsx10(Row, { label: t("about.configPath"), children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: (0, import_config.configPath)() }) }),
     /* @__PURE__ */ jsx10(Row, { label: t("about.statePath"), children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: (0, import_config.stateDir)() }) }),
     /* @__PURE__ */ jsx10(Box9, { marginTop: 1, children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: t("about.docs") }) }),

package/herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "herdr.remote.web"
 name = "Herdr Remote Web"
-version = "0.2.8"
+version = "0.2.10"
 min_herdr_version = "0.9.0"
 description = "Browser access to Herdr workspaces via local or self-hosted relay"
 platforms = ["linux", "macos"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herdr-remote",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Browser access to Herdr workspaces: plugin, host connector, and configuration TUI",
   "license": "MIT",
   "repository": {

package/src/config.js

@@ -62,7 +62,10 @@ const DEFAULTS = {
     publicUrl: '',
     // Operator-run relay, e.g. wss://herdr.example.com (mode "remote" only).
     remoteUrl: '',
-    maxPayloadBytes: 1024 * 1024,
+    // Kept in step with the relay package's own default: the CLI starts a
+    // relay of its own, and a smaller ceiling here would reject an upload the
+    // hosted relay accepts.
+    maxPayloadBytes: 5 * 1024 * 1024,
     maxClientsPerHost: 16,
     maxHosts: 1024,
     maxPendingHandshakes: 1024,

package/src/host-connector.js

@@ -12,9 +12,16 @@ const { PtySession } = require('./pty-session');
 const { resolveHerdrCommand, verifyHerdrCommand, herdrNotFoundMessage } = require('./herdr-command');
 // The wire format lives in the relay package so both ends of the protocol are
 // generated from one definition.
-const { packStreamFrame, unpackStreamFrame, PROTOCOL_VERSION } = require('herdr-remote-relay/protocol');
+const {
+  packStreamFrame,
+  unpackStreamFrame,
+  packStreamFrameV2,
+  FRAME_TYPE_OUTPUT,
+  PROTOCOL_VERSION,
+} = require('herdr-remote-relay/protocol');
 const { resolveHostPalette } = require('./terminal-palette');
 const { EXIT_REPLACED, EXIT_AUTH_FAILED } = require('./exit-codes');
+const { savePastedFile, cleanPastedDir } = require('./pasted-files');
 
 function randomId(prefix) {
   return `${prefix}-${crypto.randomBytes(9).toString('base64url')}`;
@@ -76,6 +83,8 @@ class HostConnector {
       : resolveHostPalette();
     this.ws = null;
     this.sessions = new Map();
+    this.streamIndexToId = new Map();
+    this.PtySession = options.PtySession || PtySession;
     this.fastFailures = 0;
     this.reconnectTimer = null;
     this.heartbeatTimer = null;
@@ -89,6 +98,7 @@ class HostConnector {
       || process.env.HERDR_REMOTE_HOST_LOCK
       || path.join(stateDir(), 'host-connector.lock');
     this.lockFd = null;
+    try { cleanPastedDir(); } catch {}
   }
 
   acquireLock() {
@@ -168,6 +178,8 @@ class HostConnector {
     this.ws = ws;
     ws.isAlive = true;
     ws.on('open', () => {
+      // Disable Nagle's algorithm to prevent small frames from stalling ~40ms when delayed ACK is active.
+      try { ws._socket?.setNoDelay(true); } catch {}
       ws.isAlive = true;
       this.ready = false;
       this.authFailure = false;
@@ -181,7 +193,7 @@ class HostConnector {
         platform: process.platform,
         arch: process.arch,
         terminalPalette: this.terminalPalette || null,
-        capabilities: ['host_handoff', 'idle_heartbeat'],
+        capabilities: ['host_handoff', 'idle_heartbeat', 'binary_frame_v2'],
       });
       // The relay sends host_ready with the current browser count. No business
       // heartbeat is started until that message says somebody is watching.
@@ -244,7 +256,10 @@ class HostConnector {
         process.stderr.write(`herdr-remote host connector: invalid relay frame: ${error.message}\n`);
         return;
       }
-      if (frame.type === 'input') this.sessions.get(frame.streamId)?.pty.write(frame.payload);
+      if (frame.type === 'input') {
+        const streamId = frame.version === 2 ? this.streamIndexToId.get(frame.streamIndex) : frame.streamId;
+        if (streamId) this.sessions.get(streamId)?.pty.write(frame.payload);
+      }
       return;
     }
     let message;
@@ -280,6 +295,7 @@ class HostConnector {
     if (message.type === 'session_start') this.startSession(message);
     else if (message.type === 'session_stop') this.stopSession(message.clientId || message.streamId);
     else if (message.type === 'resize') this.resizeSession(message);
+    else if (message.type === 'paste_file') this.handlePasteFile(message);
   }
 
   /**
@@ -309,6 +325,7 @@ class HostConnector {
     const streamId = typeof message.streamId === 'string' ? message.streamId : message.clientId;
     if (!streamId) return;
     this.stopSession(streamId);
+    const streamIndex = typeof message.streamIndex === 'number' ? message.streamIndex : null;
     const missingHerdr = this.ensureHerdrCommand();
     if (missingHerdr) {
       process.stderr.write(`herdr-remote host connector: ${missingHerdr}\n`);
@@ -320,7 +337,7 @@ class HostConnector {
       sendJson(this.ws, { type: 'error', clientId: streamId, code: 'herdr_socket_unavailable', message: socketInfo.reason });
       return;
     }
-    const pty = new PtySession({
+    const pty = new this.PtySession({
       command: this.herdrCommand,
       args: this.herdrArgs,
       cwd: this.cwd,
@@ -328,34 +345,75 @@ class HostConnector {
     });
     const session = {
       id: streamId,
+      streamIndex,
       pty,
       cols: Number(message.cols) || PtySession.DEFAULT_COLS,
       rows: Number(message.rows) || PtySession.DEFAULT_ROWS,
       createdAt: new Date().toISOString(),
       startedAtMs: Date.now(),
       clientId: streamId,
+      pendingOutput: [],
+      flushImmediate: null,
+    };
+    const flushOutput = () => {
+      if (session.flushImmediate) {
+        clearImmediate(session.flushImmediate);
+        session.flushImmediate = null;
+      }
+      if (session.pendingOutput.length === 0) return;
+      const chunks = session.pendingOutput;
+      session.pendingOutput = [];
+      if (this.ws?.readyState === WebSocket.OPEN) {
+        const payload = Buffer.concat(chunks);
+        const frame = typeof session.streamIndex === 'number'
+          ? packStreamFrameV2(FRAME_TYPE_OUTPUT, session.streamIndex, payload)
+          : packStreamFrame('output', streamId, payload);
+        this.ws.send(frame);
+      }
     };
     try {
       pty.start({
         cols: session.cols,
         rows: session.rows,
         onData: (data) => {
-          const payload = Buffer.from(data, 'utf8');
-          if (this.ws?.readyState === WebSocket.OPEN) this.ws.send(packStreamFrame('output', streamId, payload));
+          const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data, 'utf8');
+          if (chunk.length === 0) return;
+          session.pendingOutput.push(chunk);
+          if (!session.flushImmediate) {
+            // Coalesce burst output from the same tick into a single frame to reduce
+            // packet overhead without introducing timer latency.
+            session.flushImmediate = setImmediate(flushOutput);
+          }
         },
         onExit: ({ exitCode }) => {
           if (this.sessions.get(streamId) !== session) return;
           this.sessions.delete(streamId);
+          if (typeof session.streamIndex === 'number') {
+            this.streamIndexToId.delete(session.streamIndex);
+          }
+          if (session.flushImmediate) {
+            clearImmediate(session.flushImmediate);
+            session.flushImmediate = null;
+          }
+          session.pendingOutput = [];
           this.reportSessionExit(session, exitCode);
           this.sendHeartbeat();
         },
       });
     } catch (error) {
+      if (session.flushImmediate) {
+        clearImmediate(session.flushImmediate);
+        session.flushImmediate = null;
+      }
+      session.pendingOutput = [];
       sendJson(this.ws, { type: 'error', clientId: streamId, code: 'pty_start_failed', message: error.message });
       pty.kill();
       return;
     }
     this.sessions.set(streamId, session);
+    if (typeof streamIndex === 'number') {
+      this.streamIndexToId.set(streamIndex, streamId);
+    }
     sendJson(this.ws, { type: 'session_ready', clientId: streamId });
     this.sendHeartbeat();
   }
@@ -390,6 +448,14 @@ class HostConnector {
     const session = this.sessions.get(streamId);
     if (!session) return;
     this.sessions.delete(streamId);
+    if (typeof session.streamIndex === 'number') {
+      this.streamIndexToId.delete(session.streamIndex);
+    }
+    if (session.flushImmediate) {
+      clearImmediate(session.flushImmediate);
+      session.flushImmediate = null;
+    }
+    session.pendingOutput = [];
     session.pty.kill();
     this.sendHeartbeat();
   }
@@ -419,9 +485,39 @@ class HostConnector {
     session.pty.resize(session.cols, session.rows);
   }
 
+  handlePasteFile(message) {
+    const streamId = message.clientId || message.streamId;
+    try {
+      const savedPath = savePastedFile({
+        mime: message.mime,
+        dataBase64: message.dataBase64,
+      });
+      sendJson(this.ws, {
+        type: 'paste_file_ready',
+        clientId: streamId,
+        path: savedPath,
+      });
+    } catch (error) {
+      sendJson(this.ws, {
+        type: 'error',
+        clientId: streamId,
+        code: 'paste_file_write_failed',
+        message: error.message || 'Failed to save pasted file',
+      });
+    }
+  }
+
   destroySessions() {
-    for (const session of this.sessions.values()) session.pty.kill();
+    for (const session of this.sessions.values()) {
+      if (session.flushImmediate) {
+        clearImmediate(session.flushImmediate);
+        session.flushImmediate = null;
+      }
+      session.pendingOutput = [];
+      session.pty.kill();
+    }
     this.sessions.clear();
+    this.streamIndexToId.clear();
   }
 
   sendHeartbeat(force = false) {

package/src/pasted-files.js

@@ -0,0 +1,176 @@
+'use strict';
+
+/**
+ * Secure file storage and validation for pasted clipboard images.
+ *
+ * Security requirements:
+ * 1. Pinned directory: writes strictly to path.join(stateDir(), 'pasted') (directory mode 0o700).
+ * 2. Unpredictable filename: generated via crypto.randomUUID(), never using client-provided strings.
+ * 3. Whitelisted extension: derived exclusively from verified MIME type.
+ * 4. Host-side size check: re-validated to enforce <= 3 MB independently of relay checks.
+ * 5. Magic bytes sniffing: inspects raw binary headers (PNG, JPEG, GIF, WebP) to prevent file-type spoofing.
+ * 6. File mode: files are created with mode 0o600.
+ * 7. Automatic pruning: caps at 20 files and 50 MB (oldest deleted first), removes >24h stale files at startup.
+ */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const { stateDir } = require('./config');
+const { ensureDir } = require('./state');
+
+const MAX_PASTE_BYTES = 3 * 1024 * 1024; // 3 MB raw payload
+const MAX_SAVED_FILES = 20;
+const MAX_TOTAL_BYTES = 50 * 1024 * 1024; // 50 MB
+const MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
+
+const MIME_CONFIG = {
+  'image/png': {
+    ext: '.png',
+    check: (buf) =>
+      buf.length >= 8 &&
+      buf[0] === 0x89 &&
+      buf[1] === 0x50 &&
+      buf[2] === 0x4e &&
+      buf[3] === 0x47,
+  },
+  'image/jpeg': {
+    ext: '.jpg',
+    check: (buf) =>
+      buf.length >= 3 &&
+      buf[0] === 0xff &&
+      buf[1] === 0xd8 &&
+      buf[2] === 0xff,
+  },
+  'image/webp': {
+    ext: '.webp',
+    check: (buf) =>
+      buf.length >= 12 &&
+      buf[0] === 0x52 &&
+      buf[1] === 0x49 &&
+      buf[2] === 0x46 &&
+      buf[3] === 0x46 && // 'RIFF'
+      buf[8] === 0x57 &&
+      buf[9] === 0x45 &&
+      buf[10] === 0x42 &&
+      buf[11] === 0x50, // 'WEBP'
+  },
+  'image/gif': {
+    ext: '.gif',
+    check: (buf) =>
+      buf.length >= 6 &&
+      buf[0] === 0x47 &&
+      buf[1] === 0x49 &&
+      buf[2] === 0x46 &&
+      buf[3] === 0x38, // 'GIF8'
+  },
+};
+
+function getPastedDir() {
+  const dir = path.join(stateDir(), 'pasted');
+  ensureDir(dir);
+  return dir;
+}
+
+/**
+ * Prunes the pasted directory:
+ * - Removes files older than maxAgeMs (default 24 hours).
+ * - Caps total file count (default 20) and total disk footprint (default 50 MB),
+ *   deleting oldest files first.
+ */
+function cleanPastedDir({
+  dir = getPastedDir(),
+  maxFiles = MAX_SAVED_FILES,
+  maxBytes = MAX_TOTAL_BYTES,
+  maxAgeMs = MAX_AGE_MS,
+  now = Date.now(),
+} = {}) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+
+  const fileInfos = [];
+
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const fullPath = path.join(dir, entry.name);
+    try {
+      const stat = fs.statSync(fullPath);
+      if (now - stat.mtimeMs > maxAgeMs) {
+        try { fs.unlinkSync(fullPath); } catch {}
+        continue;
+      }
+      fileInfos.push({ path: fullPath, size: stat.size, mtimeMs: stat.mtimeMs });
+    } catch {}
+  }
+
+  // Sort oldest first
+  fileInfos.sort((a, b) => a.mtimeMs - b.mtimeMs);
+
+  let totalSize = fileInfos.reduce((sum, f) => sum + f.size, 0);
+
+  while (fileInfos.length > maxFiles || totalSize > maxBytes) {
+    const oldest = fileInfos.shift();
+    if (!oldest) break;
+    try {
+      fs.unlinkSync(oldest.path);
+      totalSize -= oldest.size;
+    } catch {}
+  }
+}
+
+/**
+ * Validates base64 data, checks payload limits, sniffs magic bytes against declared MIME,
+ * writes to state storage with mode 0o600, and returns the absolute local path.
+ */
+function savePastedFile({ mime, dataBase64, dir = getPastedDir() }) {
+  if (typeof mime !== 'string' || !Object.hasOwn(MIME_CONFIG, mime)) {
+    throw new Error(`unsupported MIME type: ${mime}`);
+  }
+  if (typeof dataBase64 !== 'string') {
+    throw new Error('missing or invalid dataBase64 payload');
+  }
+
+  const buf = Buffer.from(dataBase64, 'base64');
+  if (buf.length > MAX_PASTE_BYTES) {
+    throw new Error(`file size (${buf.length} bytes) exceeds maximum limit of 3 MB`);
+  }
+  if (buf.length === 0) {
+    throw new Error('file payload is empty');
+  }
+
+  const config = MIME_CONFIG[mime];
+  if (!config.check(buf)) {
+    throw new Error(`file magic bytes do not match declared MIME type ${mime}`);
+  }
+
+  // Prune before writing new file
+  cleanPastedDir({ dir });
+
+  const fileName = `${crypto.randomUUID()}${config.ext}`;
+  const filePath = path.join(dir, fileName);
+
+  fs.writeFileSync(filePath, buf, { mode: 0o600, flag: 'wx' });
+  try {
+    fs.chmodSync(filePath, 0o600);
+  } catch {}
+
+  // Prune again after writing to strictly observe count/size ceiling
+  cleanPastedDir({ dir });
+
+  return filePath;
+}
+
+module.exports = {
+  MAX_PASTE_BYTES,
+  MAX_SAVED_FILES,
+  MAX_TOTAL_BYTES,
+  MAX_AGE_MS,
+  MIME_CONFIG,
+  getPastedDir,
+  cleanPastedDir,
+  savePastedFile,
+};