lunel-cli 0.1.87 → 0.1.89

package/dist/index.js

@@ -931,7 +931,13 @@ async function handleGitDiscard(payload) {
 }
 function emitAppEvent(msg) {
     if (activeV2Transport) {
-        void activeV2Transport.sendMessage(msg).catch((error) => {
+        if (!activeV2Transport.isSecure()) {
+            if (DEBUG_MODE) {
+                console.error("[transport:v2] dropped event before secure session:", `${msg.ns}.${msg.action}`);
+            }
+            return;
+        }
+        void activeV2Transport.sendEvent(msg).catch((error) => {
             if (DEBUG_MODE)
                 console.error("[transport:v2] failed to send event:", error instanceof Error ? error.message : String(error));
         });
@@ -2551,11 +2557,15 @@ async function connectWebSocketV2() {
     if (!currentSessionPassword) {
         throw new Error("missing password for websocket connect");
     }
+    if (!currentSessionCode) {
+        throw new Error("missing session code for secure transport");
+    }
     console.log(`Connecting to gateway ${gatewayUrl}...`);
     activeGatewayUrl = gatewayUrl;
     const transport = new V2SessionTransport({
         gatewayUrl,
         password: currentSessionPassword,
+        sessionCode: currentSessionCode,
         role: "cli",
         debugLog: DEBUG_MODE ? debugLog : undefined,
         handlers: {
@@ -2564,7 +2574,6 @@ async function connectWebSocketV2() {
                     return;
                 if (message.type === "peer_connected") {
                     console.log("App connected!\n");
-                    startPortSync();
                     return;
                 }
                 if (message.type === "peer_disconnected") {
@@ -2593,6 +2602,9 @@ async function connectWebSocketV2() {
             onProtocolResponse: async () => {
                 // CLI does not currently await app responses outside request/reply routing.
             },
+            onProtocolEvent: async (message) => {
+                await processMessage(message);
+            },
             onClose: (reason) => {
                 if (shuttingDown)
                     return;
@@ -2609,6 +2621,7 @@ async function connectWebSocketV2() {
     });
     activeV2Transport = transport;
     await transport.connect();
+    startPortSync();
     console.log("Connected to gateway (single secure session).\n");
 }
 async function handleConnectionDrop(reason) {

package/dist/transport/protocol.d.ts

@@ -17,12 +17,18 @@ export interface Response {
         message: string;
     };
 }
+export interface EventMessage {
+    v: 1;
+    id: string;
+    ns: string;
+    action: string;
+    payload: Record<string, unknown>;
+}
 export interface SystemMessage {
-    type: "connected" | "peer_connected" | "peer_disconnected" | "error" | "app_disconnected" | "close_connection" | "e2ee_hello" | "e2ee_secure_ready";
+    type: "connected" | "peer_connected" | "peer_disconnected" | "error" | "app_disconnected" | "close_connection";
     role?: string;
     channel?: string;
     peer?: string;
-    pubkey?: string;
     reconnectDeadline?: number;
     reason?: string;
     payload?: Record<string, unknown>;
@@ -35,11 +41,26 @@ export type V2HandshakeFrame = {
     t: "lunel_v2";
     kind: "server_hello";
     pubkey: string;
-    header: string;
 } | {
     t: "lunel_v2";
-    kind: "client_ready";
-    header: string;
+    kind: "client_key";
+    nonce: string;
+    box: string;
+    auth: string;
+} | {
+    t: "lunel_v2";
+    kind: "server_ready";
+    auth: string;
+};
+export type EncryptedProtocolEnvelope = {
+    kind: "request";
+    message: Message;
+} | {
+    kind: "response";
+    message: Response;
+} | {
+    kind: "event";
+    message: EventMessage;
 };
 export declare const V2_BINARY_MAGIC_0 = 76;
 export declare const V2_BINARY_MAGIC_1 = 50;
@@ -47,6 +68,7 @@ export declare const V2_FRAME_ENCRYPTED_MESSAGE = 1;
 export declare function isProtocolRequest(value: unknown): value is Message;
 export declare function isProtocolResponse(value: unknown): value is Response;
 export declare function isV2HandshakeFrame(value: unknown): value is V2HandshakeFrame;
+export declare function isEncryptedProtocolEnvelope(value: unknown): value is EncryptedProtocolEnvelope;
 export declare function encodeV2EncryptedFrame(payload: Uint8Array): Uint8Array;
 export declare function decodeV2BinaryFrame(data: Uint8Array): {
     type: number;

package/dist/transport/protocol.js

@@ -28,9 +28,24 @@ export function isV2HandshakeFrame(value) {
     if (frame.kind === "client_hello")
         return typeof frame.pubkey === "string";
     if (frame.kind === "server_hello")
-        return typeof frame.pubkey === "string" && typeof frame.header === "string";
-    if (frame.kind === "client_ready")
-        return typeof frame.header === "string";
+        return typeof frame.pubkey === "string";
+    if (frame.kind === "client_key") {
+        return typeof frame.nonce === "string" && typeof frame.box === "string" && typeof frame.auth === "string";
+    }
+    if (frame.kind === "server_ready")
+        return typeof frame.auth === "string";
+    return false;
+}
+export function isEncryptedProtocolEnvelope(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const envelope = value;
+    if (envelope.kind === "request")
+        return isProtocolRequest(envelope.message);
+    if (envelope.kind === "response")
+        return isProtocolResponse(envelope.message);
+    if (envelope.kind === "event")
+        return isProtocolRequest(envelope.message);
     return false;
 }
 export function encodeV2EncryptedFrame(payload) {

package/dist/transport/v2.d.ts

@@ -1,13 +1,15 @@
-import type { Message, Response, SystemMessage } from "./protocol.js";
+import type { EventMessage, Message, Response, SystemMessage } from "./protocol.js";
 export interface V2TransportHandlers {
     onSystemMessage: (message: SystemMessage) => Promise<void> | void;
     onProtocolRequest: (message: Message) => Promise<Response>;
     onProtocolResponse?: (message: Response) => Promise<void> | void;
+    onProtocolEvent?: (message: EventMessage) => Promise<void> | void;
     onClose: (reason: string) => void;
 }
 export interface V2TransportOptions {
     gatewayUrl: string;
     password: string;
+    sessionCode: string;
     role: "cli" | "app";
     handlers: V2TransportHandlers;
     debugLog?: (message: string, ...args: unknown[]) => void;
@@ -18,9 +20,8 @@ export declare class V2SessionTransport {
     private closed;
     private state;
     private keyPair;
+    private remotePublicKey;
     private sessionKeys;
-    private pushState;
-    private pullState;
     private secureReadyResolve;
     private secureReadyReject;
     private secureReadyPromise;
@@ -28,12 +29,15 @@ export declare class V2SessionTransport {
     connect(): Promise<void>;
     sendMessage(message: Message): Promise<void>;
     sendResponse(response: Response): Promise<void>;
+    sendEvent(message: EventMessage): Promise<void>;
     close(): void;
+    isSecure(): boolean;
     private handleMessage;
     private maybeStartHandshake;
     private handleHandshakeFrame;
-    private encryptMessage;
+    private encryptEnvelope;
     private ensureKeyPair;
+    private computeHandshakeAuth;
     private sendJsonFrame;
     private sendBinaryFrame;
     private markSecure;

package/dist/transport/v2.js

@@ -1,6 +1,8 @@
 import { WebSocket } from "ws";
 import { createRequire } from "module";
-import { V2_FRAME_ENCRYPTED_MESSAGE, buildSessionV2WsUrl, decodeV2BinaryFrame, encodeV2EncryptedFrame, isProtocolRequest, isProtocolResponse, isV2HandshakeFrame, } from "./protocol.js";
+import { V2_FRAME_ENCRYPTED_MESSAGE, buildSessionV2WsUrl, decodeV2BinaryFrame, encodeV2EncryptedFrame, isEncryptedProtocolEnvelope, isV2HandshakeFrame, } from "./protocol.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
 const require = createRequire(import.meta.url);
 const sodium = require("libsodium-wrappers");
 function toUint8Array(data) {
@@ -10,15 +12,20 @@ function toUint8Array(data) {
         return new Uint8Array(Buffer.concat(data.map((chunk) => Buffer.from(chunk))));
     return new Uint8Array(data);
 }
+function encodeUtf8(value) {
+    return encoder.encode(value);
+}
+function decodeUtf8(value) {
+    return decoder.decode(value);
+}
 export class V2SessionTransport {
     options;
     ws = null;
     closed = false;
     state = "idle";
     keyPair = null;
+    remotePublicKey = null;
     sessionKeys = null;
-    pushState = null;
-    pullState = null;
     secureReadyResolve = null;
     secureReadyReject = null;
     secureReadyPromise = null;
@@ -86,11 +93,15 @@ export class V2SessionTransport {
         await this.secureReadyPromise;
     }
     async sendMessage(message) {
-        const ciphertext = await this.encryptMessage(message);
+        const ciphertext = this.encryptEnvelope({ kind: "request", message });
         this.sendBinaryFrame(ciphertext);
     }
     async sendResponse(response) {
-        const ciphertext = await this.encryptMessage(response);
+        const ciphertext = this.encryptEnvelope({ kind: "response", message: response });
+        this.sendBinaryFrame(ciphertext);
+    }
+    async sendEvent(message) {
+        const ciphertext = this.encryptEnvelope({ kind: "event", message });
         this.sendBinaryFrame(ciphertext);
     }
     close() {
@@ -103,6 +114,9 @@ export class V2SessionTransport {
         }
         this.ws = null;
     }
+    isSecure() {
+        return this.state === "secure";
+    }
     async handleMessage(data, isBinary) {
         if (!isBinary) {
             const text = typeof data === "string" ? data : Buffer.from(data).toString("utf-8");
@@ -118,19 +132,9 @@ export class V2SessionTransport {
                 await this.handleHandshakeFrame(raw);
                 return;
             }
-            if (this.state !== "secure") {
-                throw new Error("received plaintext app message before secure transport");
-            }
-            if (isProtocolResponse(raw)) {
-                await this.options.handlers.onProtocolResponse?.(raw);
-                return;
-            }
-            if (isProtocolRequest(raw)) {
-                const response = await this.options.handlers.onProtocolRequest(raw);
-                await this.sendResponse(response);
-                return;
-            }
-            return;
+            throw new Error(this.state === "secure"
+                ? "received plaintext app message after secure transport"
+                : "received plaintext app message before secure transport");
         }
         const bytes = toUint8Array(data);
         const frame = decodeV2BinaryFrame(bytes);
@@ -140,24 +144,33 @@ export class V2SessionTransport {
         if (frame.type !== V2_FRAME_ENCRYPTED_MESSAGE) {
             throw new Error(`unsupported v2 frame type ${frame.type}`);
         }
-        if (this.state !== "secure" || !this.pullState) {
+        if (this.state !== "secure" || !this.sessionKeys) {
             throw new Error("received encrypted frame before secure transport");
         }
-        const pulled = sodium.crypto_secretstream_xchacha20poly1305_pull(this.pullState, frame.payload);
-        if (!pulled.message) {
-            throw new Error("failed to decrypt v2 frame");
+        if (frame.payload.length < sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES) {
+            throw new Error("encrypted frame missing nonce");
+        }
+        const nonce = frame.payload.subarray(0, sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+        const ciphertext = frame.payload.subarray(sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+        const plaintext = sodium.crypto_aead_xchacha20poly1305_ietf_decrypt(null, ciphertext, null, nonce, this.sessionKeys.rx);
+        const parsed = JSON.parse(decodeUtf8(plaintext));
+        if (!isEncryptedProtocolEnvelope(parsed)) {
+            throw new Error("invalid decrypted protocol envelope");
         }
-        const parsed = JSON.parse(sodium.to_string(pulled.message));
-        if (isProtocolResponse(parsed)) {
-            await this.options.handlers.onProtocolResponse?.(parsed);
+        if (parsed.kind === "response") {
+            await this.options.handlers.onProtocolResponse?.(parsed.message);
             return;
         }
-        if (isProtocolRequest(parsed)) {
-            const response = await this.options.handlers.onProtocolRequest(parsed);
+        if (parsed.kind === "event") {
+            await this.options.handlers.onProtocolEvent?.(parsed.message);
+            return;
+        }
+        if (parsed.kind === "request") {
+            const response = await this.options.handlers.onProtocolRequest(parsed.message);
             await this.sendResponse(response);
             return;
         }
-        throw new Error("invalid decrypted protocol message");
+        throw new Error("invalid decrypted protocol envelope");
     }
     async maybeStartHandshake() {
         if (this.state === "secure" || this.state === "handshaking")
@@ -179,72 +192,115 @@ export class V2SessionTransport {
             if (this.options.role !== "cli") {
                 throw new Error("unexpected client_hello on app transport");
             }
-            const clientPublicKey = sodium.from_base64(frame.pubkey, sodium.base64_variants.URLSAFE_NO_PADDING);
+            this.remotePublicKey = sodium.from_base64(frame.pubkey, sodium.base64_variants.URLSAFE_NO_PADDING);
             const keyPair = this.ensureKeyPair();
-            const keys = sodium.crypto_kx_server_session_keys(keyPair.publicKey, keyPair.privateKey, clientPublicKey);
-            this.sessionKeys = { rx: keys.sharedRx, tx: keys.sharedTx };
-            const pushInit = sodium.crypto_secretstream_xchacha20poly1305_init_push(keys.sharedTx);
-            this.pushState = pushInit.state;
-            const response = {
+            this.sendJsonFrame({
                 t: "lunel_v2",
                 kind: "server_hello",
                 pubkey: sodium.to_base64(keyPair.publicKey, sodium.base64_variants.URLSAFE_NO_PADDING),
-                header: sodium.to_base64(pushInit.header, sodium.base64_variants.URLSAFE_NO_PADDING),
-            };
-            this.sendJsonFrame(response);
+            });
             return;
         }
         if (frame.kind === "server_hello") {
             if (this.options.role !== "app") {
                 throw new Error("unexpected server_hello on cli transport");
             }
-            const serverPublicKey = sodium.from_base64(frame.pubkey, sodium.base64_variants.URLSAFE_NO_PADDING);
-            const serverHeader = sodium.from_base64(frame.header, sodium.base64_variants.URLSAFE_NO_PADDING);
+            this.remotePublicKey = sodium.from_base64(frame.pubkey, sodium.base64_variants.URLSAFE_NO_PADDING);
             const keyPair = this.ensureKeyPair();
-            const keys = sodium.crypto_kx_client_session_keys(keyPair.publicKey, keyPair.privateKey, serverPublicKey);
-            this.sessionKeys = { rx: keys.sharedRx, tx: keys.sharedTx };
-            this.pullState = sodium.crypto_secretstream_xchacha20poly1305_init_pull(serverHeader, keys.sharedRx);
-            const pushInit = sodium.crypto_secretstream_xchacha20poly1305_init_push(keys.sharedTx);
-            this.pushState = pushInit.state;
-            const ready = {
+            const c2sKey = sodium.crypto_aead_xchacha20poly1305_ietf_keygen();
+            const s2cKey = sodium.crypto_aead_xchacha20poly1305_ietf_keygen();
+            const nonce = sodium.randombytes_buf(sodium.crypto_box_NONCEBYTES);
+            const payload = {
+                c2s: sodium.to_base64(c2sKey, sodium.base64_variants.URLSAFE_NO_PADDING),
+                s2c: sodium.to_base64(s2cKey, sodium.base64_variants.URLSAFE_NO_PADDING),
+            };
+            const boxed = sodium.crypto_box_easy(encodeUtf8(JSON.stringify(payload)), nonce, this.remotePublicKey, keyPair.privateKey);
+            const auth = this.computeHandshakeAuth("client_key", "app", sodium.to_base64(keyPair.publicKey, sodium.base64_variants.URLSAFE_NO_PADDING), nonce, boxed);
+            this.sessionKeys = { rx: s2cKey, tx: c2sKey };
+            this.sendJsonFrame({
                 t: "lunel_v2",
-                kind: "client_ready",
-                header: sodium.to_base64(pushInit.header, sodium.base64_variants.URLSAFE_NO_PADDING),
+                kind: "client_key",
+                nonce: sodium.to_base64(nonce, sodium.base64_variants.URLSAFE_NO_PADDING),
+                box: sodium.to_base64(boxed, sodium.base64_variants.URLSAFE_NO_PADDING),
+                auth,
+            });
+            return;
+        }
+        if (frame.kind === "client_key") {
+            if (this.options.role !== "cli") {
+                throw new Error("unexpected client_key on app transport");
+            }
+            if (!this.remotePublicKey) {
+                throw new Error("missing client public key before client_key");
+            }
+            const keyPair = this.ensureKeyPair();
+            const nonce = sodium.from_base64(frame.nonce, sodium.base64_variants.URLSAFE_NO_PADDING);
+            const boxed = sodium.from_base64(frame.box, sodium.base64_variants.URLSAFE_NO_PADDING);
+            const expectedAuth = this.computeHandshakeAuth("client_key", "app", sodium.to_base64(this.remotePublicKey, sodium.base64_variants.URLSAFE_NO_PADDING), nonce, boxed);
+            if (frame.auth !== expectedAuth) {
+                throw new Error("client_key authentication failed");
+            }
+            const opened = sodium.crypto_box_open_easy(boxed, nonce, this.remotePublicKey, keyPair.privateKey);
+            const payload = JSON.parse(decodeUtf8(opened));
+            this.sessionKeys = {
+                rx: sodium.from_base64(payload.c2s, sodium.base64_variants.URLSAFE_NO_PADDING),
+                tx: sodium.from_base64(payload.s2c, sodium.base64_variants.URLSAFE_NO_PADDING),
             };
-            this.sendJsonFrame(ready);
+            this.sendJsonFrame({
+                t: "lunel_v2",
+                kind: "server_ready",
+                auth: this.computeHandshakeAuth("server_ready", "cli", sodium.to_base64(this.remotePublicKey, sodium.base64_variants.URLSAFE_NO_PADDING)),
+            });
             this.markSecure();
             return;
         }
-        if (frame.kind === "client_ready") {
-            if (this.options.role !== "cli") {
-                throw new Error("unexpected client_ready on app transport");
+        if (frame.kind === "server_ready") {
+            if (this.options.role !== "app") {
+                throw new Error("unexpected server_ready on cli transport");
             }
             if (!this.sessionKeys) {
-                throw new Error("missing session keys before client_ready");
+                throw new Error("missing session keys before server_ready");
+            }
+            const expectedAuth = this.computeHandshakeAuth("server_ready", "cli", sodium.to_base64(this.remotePublicKey, sodium.base64_variants.URLSAFE_NO_PADDING));
+            if (frame.auth !== expectedAuth) {
+                throw new Error("server_ready authentication failed");
             }
-            const clientHeader = sodium.from_base64(frame.header, sodium.base64_variants.URLSAFE_NO_PADDING);
-            this.pullState = sodium.crypto_secretstream_xchacha20poly1305_init_pull(clientHeader, this.sessionKeys.rx);
             this.markSecure();
         }
     }
-    async encryptMessage(message) {
-        await sodium.ready;
-        if (this.state !== "secure" || !this.pushState) {
+    encryptEnvelope(envelope) {
+        if (this.state !== "secure" || !this.sessionKeys) {
             throw new Error("secure transport is not active");
         }
-        const plaintext = sodium.from_string(JSON.stringify(message));
-        return sodium.crypto_secretstream_xchacha20poly1305_push(this.pushState, plaintext, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE);
+        const nonce = sodium.randombytes_buf(sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+        const ciphertext = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(encodeUtf8(JSON.stringify(envelope)), null, null, nonce, this.sessionKeys.tx);
+        const payload = new Uint8Array(nonce.length + ciphertext.length);
+        payload.set(nonce, 0);
+        payload.set(ciphertext, nonce.length);
+        return payload;
     }
     ensureKeyPair() {
         if (this.keyPair)
             return this.keyPair;
-        const pair = sodium.crypto_kx_keypair();
+        const pair = sodium.crypto_box_keypair();
         this.keyPair = {
             publicKey: pair.publicKey,
             privateKey: pair.privateKey,
         };
         return this.keyPair;
     }
+    computeHandshakeAuth(phase, senderRole, peerPubkeyB64, nonce, boxed) {
+        const authKey = sodium.crypto_generichash(sodium.crypto_auth_KEYBYTES, encodeUtf8(this.options.sessionCode), undefined);
+        const parts = [
+            phase,
+            senderRole,
+            peerPubkeyB64,
+            nonce ? sodium.to_base64(nonce, sodium.base64_variants.URLSAFE_NO_PADDING) : "",
+            boxed ? sodium.to_base64(boxed, sodium.base64_variants.URLSAFE_NO_PADDING) : "",
+        ];
+        const tag = sodium.crypto_auth(parts.join(":"), authKey);
+        return sodium.to_base64(tag, sodium.base64_variants.URLSAFE_NO_PADDING);
+    }
     sendJsonFrame(frame) {
         if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
             throw new Error("v2 transport is not connected");
@@ -256,7 +312,7 @@ export class V2SessionTransport {
             throw new Error("v2 transport is not connected");
         }
         const framed = encodeV2EncryptedFrame(ciphertext);
-        this.ws.send(Buffer.from(framed));
+        this.ws.send(framed);
     }
     markSecure() {
         this.state = "secure";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lunel-cli",
-  "version": "0.1.87",
+  "version": "0.1.89",
   "author": [
     {
       "name": "Soham Bharambe",