peer-term 1.2.10 → 1.2.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peer-term",
-  "version": "1.2.10",
+  "version": "1.2.12",
   "license": "MIT",
   "description": "Share your terminal instantly using a 6-digit code. Encrypted. No config.",
   "keywords": [

package/src/index.js

@@ -368,25 +368,54 @@ class Session {
 
   async _completeKeyExchange(clientPublicKeyBase64) {
     if (!this.keyPair || !this.hostPublicKeyBase64) return;
+    if (typeof clientPublicKeyBase64 !== 'string' || clientPublicKeyBase64.length === 0) {
+      this._rejectProtocolMessage('Invalid key-exchange public key');
+      return;
+    }
 
-    this.logDebug('Deriving shared secret...');
-    this.clientPublicKeyBase64 = clientPublicKeyBase64;
+    try {
+      this.logDebug('Deriving shared secret...');
+      this.clientPublicKeyBase64 = clientPublicKeyBase64;
+
+      const peerPublicKey = await importPublicKey(clientPublicKeyBase64);
+      this.sharedKey = await deriveSharedKey(this.keyPair.privateKey, peerPublicKey);
+
+      if (this.secureMode) {
+        this.securityFingerprint = await fingerprintPublicKeys(
+          this.code,
+          this.hostPublicKeyBase64,
+          this.clientPublicKeyBase64
+        );
+        this.fingerprintAuthorized = false;
+        this._printFingerprintAuthorization();
+      } else {
+        this.fingerprintAuthorized = true;
+        await this._activateSecureSession();
+      }
+    } catch (err) {
+      this._rejectProtocolMessage(`Invalid key exchange: ${err.message}`);
+    }
+  }
 
-    const peerPublicKey = await importPublicKey(clientPublicKeyBase64);
-    this.sharedKey = await deriveSharedKey(this.keyPair.privateKey, peerPublicKey);
+  _rejectProtocolMessage(reason) {
+    this.log(`Protocol error: ${reason}`);
+    this.isClientConnected = false;
+    this.awaitingRejoin = false;
+    this.sharedKey = null;
+    this.keyPair = null;
+    this.hostPublicKeyBase64 = null;
+    this.clientPublicKeyBase64 = null;
+    this.securityFingerprint = null;
+    this.fingerprintAuthorized = false;
+    this.stopHeartbeat();
+    this._cleanupWebRTC();
+    this.destroy();
+  }
 
-    if (this.secureMode) {
-      this.securityFingerprint = await fingerprintPublicKeys(
-        this.code,
-        this.hostPublicKeyBase64,
-        this.clientPublicKeyBase64
-      );
-      this.fingerprintAuthorized = false;
-      this._printFingerprintAuthorization();
-    } else {
-      this.fingerprintAuthorized = true;
-      await this._activateSecureSession();
-    }
+  _handleMessageError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    this.log(`Protocol handler error: ${message}`);
+    this.destroy();
   }
 
   _printFingerprintAuthorization() {
@@ -481,6 +510,7 @@ class Session {
       });
 
       this.ws.on('message', async (raw) => {
+        try {
         let msg;
         try {
           msg = JSON.parse(raw.toString());
@@ -488,6 +518,10 @@ class Session {
           this.log('Invalid message from relay');
           return;
         }
+        if (!msg || typeof msg.type !== 'string') {
+          this._rejectProtocolMessage('Malformed relay message');
+          return;
+        }
 
         switch (msg.type) {
           case 'code': {
@@ -614,6 +648,9 @@ class Session {
             break;
           }
         }
+        } catch (err) {
+          this._handleMessageError(err);
+        }
       });
 
       this.ws.on('close', () => {
@@ -648,13 +685,10 @@ class Session {
     try {
       const resizeJson = JSON.stringify({ type: 'resize', cols, rows });
       const payload = await encrypt(this.sharedKey, resizeJson);
-      // Phase 4: Route through DataChannel if active, else relay
-      if (this.useDataChannel && this.webrtc && this.webrtc.isActive()) {
-        // Send resize as a tagged message so client can distinguish
-        this.webrtc.send(JSON.stringify({ _meta: 'resize', payload }));
-      } else if (this.ws && this.ws.readyState === WebSocket.OPEN) {
-        this.ws.send(JSON.stringify({ type: 'data', payload, meta: 'resize' }));
-      }
+      this._sendEncryptedToClient(payload, {
+        directPayload: JSON.stringify({ _meta: 'resize', payload }),
+        meta: 'resize',
+      });
     } catch {}
   }
 
@@ -746,14 +780,41 @@ class Session {
     const payload = await encrypt(sharedKey, data);
     if (this.destroyed || sharedKey !== this.sharedKey) return;
 
-    // Phase 4: Route through DataChannel if active, else relay
-    if (this.useDataChannel && this.webrtc && this.webrtc.isActive()) {
-      this.webrtc.send(payload);
-    } else if (this.ws && this.ws.readyState === WebSocket.OPEN) {
-      // Backpressure: drop chunk if relay can't keep up (1.25 MB buffer limit)
-      if (this.ws.bufferedAmount < 1.25 * 1024 * 1024) {
-        this.ws.send(JSON.stringify({ type: 'data', payload }));
+    this._sendEncryptedToClient(payload, { enforceBackpressure: true });
+  }
+
+  _sendEncryptedToClient(payload, options = {}) {
+    const directPayload = options.directPayload || payload;
+
+    if (this.useDataChannel) {
+      if (this.webrtc && this.webrtc.isActive()) {
+        let sentDirect = false;
+        try {
+          sentDirect = this.webrtc.send(directPayload);
+        } catch {}
+
+        if (sentDirect) return true;
       }
+
+      this.useDataChannel = false;
+      this.log('DataChannel send failed — falling back to relay');
+    }
+
+    return this._sendViaRelay(payload, options);
+  }
+
+  _sendViaRelay(payload, { meta, enforceBackpressure = false } = {}) {
+    if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return false;
+    if (enforceBackpressure && this.ws.bufferedAmount >= 1.25 * 1024 * 1024) return false;
+
+    const msg = { type: 'data', payload };
+    if (meta) msg.meta = meta;
+
+    try {
+      this.ws.send(JSON.stringify(msg));
+      return true;
+    } catch {
+      return false;
     }
   }
 
@@ -886,12 +947,17 @@ class Session {
         });
 
         newWs.on('message', async (raw) => {
+          try {
           let msg;
           try {
             msg = JSON.parse(raw.toString());
           } catch {
             return;
           }
+          if (!msg || typeof msg.type !== 'string') {
+            this._rejectProtocolMessage('Malformed relay message');
+            return;
+          }
 
           if (msg.type === 'rejoined') {
             // Success — replace the old ws with this new one
@@ -911,6 +977,9 @@ class Session {
             this.destroy();
             try { newWs.close(); } catch {}
           }
+          } catch (err) {
+            this._handleMessageError(err);
+          }
         });
 
         newWs.on('error', () => {
@@ -946,6 +1015,7 @@ class Session {
    */
   _attachWsHandlers(newWs) {
     newWs.on('message', async (raw) => {
+      try {
       let msg;
       try {
         msg = JSON.parse(raw.toString());
@@ -953,6 +1023,10 @@ class Session {
         this.log('Invalid message from relay');
         return;
       }
+      if (!msg || typeof msg.type !== 'string') {
+        this._rejectProtocolMessage('Malformed relay message');
+        return;
+      }
 
       switch (msg.type) {
         case 'client-connected': {
@@ -1060,6 +1134,9 @@ class Session {
           break;
         }
       }
+      } catch (err) {
+        this._handleMessageError(err);
+      }
     });
 
     newWs.on('close', () => {
@@ -1390,7 +1467,6 @@ process.on('uncaughtException', (err) => {
 process.on('unhandledRejection', (reason) => {
   const err = reason instanceof Error ? reason : new Error(String(reason));
   logger.error(`Unhandled rejection: ${err.message}`, err);
-  process.exit(1);
 });
 
 // ─── Run ─────────────────────────────────────────────────────────────────────