peer-term 1.2.6 → 1.2.8

package/README.md

@@ -14,7 +14,7 @@ This will start a terminal sharing session and give you a 6-digit code.
 
 Share this code with your peer. They can view your terminal by going to https://peer-term-relay-production-9b7a.up.railway.app or https://peer-term-relay.onrender.com and entering the code.
 
-When the viewer connects, both sides will show a short security fingerprint. Compare it over a trusted channel. If it matches, authorize the session in the host CLI:
+If you started the session with `--secure`, both sides will show a short security fingerprint. Compare it over a trusted channel. If it matches, authorize the session in the host CLI:
 
 ```bash
 a <code>
@@ -41,6 +41,7 @@ peer-term                              # starts at home directory
 peer-term --path ~/projects            # starts at ~/projects
 peer-term --path .                     # starts in current directory
 peer-term --readonly                   # view-only session
+peer-term --secure                     # require fingerprint verification
 peer-term --expiry 10m                 # custom expiry time
 peer-term --relay wss://custom         # use a custom relay server
 peer-term --verbose                    # enable debug logging
@@ -49,7 +50,7 @@ peer-term --verbose                    # enable debug logging
 ## Features
 
 - **No Config**: Works instantly. No port forwarding or firewall configuration needed.
-- **End-to-End Encrypted**: Terminal data is encrypted locally using AES-256-GCM with ECDH P-256 key exchange and an out-of-band fingerprint check. The relay never sees plaintext after the fingerprint is verified and authorized.
+- **End-to-End Encrypted**: Terminal data is encrypted locally using AES-256-GCM with ECDH P-256 key exchange. The relay never sees plaintext. A `--secure` flag enables an out-of-band fingerprint check for strict MITM protection.
 - **WebRTC P2P**: Creates a direct Peer-to-Peer connection on the same LAN for zero-latency, relay-free sessions.
 - **Read-Only Mode**: Guests can view your terminal but cannot type commands.
 - **Custom Start Path**: Set the starting directory with `--path`.
@@ -61,6 +62,6 @@ peer-term --verbose                    # enable debug logging
 1. **Host** registers a session on the relay and gets a 6-digit code
 2. **Client** opens the web UI and enters the code
 3. Both sides perform an **ECDH key exchange** to derive a shared AES-256-GCM secret
-4. Both sides compare a short fingerprint, then the host authorizes the verified session with `a <code>`
+4. If `--secure` is used, both sides compare a short fingerprint, then the host authorizes the verified session with `a <code>`
 5. All terminal I/O is encrypted end-to-end — the relay only forwards opaque blobs
 6. If both peers are on the same LAN, a **WebRTC DataChannel** is established to bypass the relay entirely

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peer-term",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "license": "MIT",
   "description": "Share your terminal instantly using a 6-digit code. Encrypted. No config.",
   "keywords": [

package/src/index.js

@@ -61,7 +61,7 @@ try {
 // ─── CLI Argument Parsing ────────────────────────────────────────────────────
 
 const argv = minimist(process.argv.slice(2), {
-  boolean: ['readonly', 'verbose', 'help', 'version'],
+  boolean: ['readonly', 'verbose', 'help', 'version', 'secure'],
   string: ['expiry', 'rejoin', 'relay', 'path'],
   alias: { h: 'help', v: 'version', V: 'verbose' },
 });
@@ -308,6 +308,7 @@ class Session {
     this.readOnly = readOnly;
     this.startPath = startPath;
     this.onDestroy = onDestroy;
+    this.secureMode = argv.secure || false;
 
     this.ws = null;
     this.code = null;
@@ -357,7 +358,11 @@ class Session {
     this.fingerprintAuthorized = false;
     this.stopHeartbeat();
     this._cleanupWebRTC();
-    this.ws.send(JSON.stringify({ type: 'key-exchange', publicKey: this.hostPublicKeyBase64 }));
+    this.ws.send(JSON.stringify({ 
+      type: 'key-exchange', 
+      publicKey: this.hostPublicKeyBase64,
+      secureMode: this.secureMode 
+    }));
   }
 
   async _completeKeyExchange(clientPublicKeyBase64) {
@@ -368,14 +373,19 @@ class Session {
 
     const peerPublicKey = await importPublicKey(clientPublicKeyBase64);
     this.sharedKey = await deriveSharedKey(this.keyPair.privateKey, peerPublicKey);
-    this.securityFingerprint = await fingerprintPublicKeys(
-      this.code,
-      this.hostPublicKeyBase64,
-      this.clientPublicKeyBase64
-    );
-    this.fingerprintAuthorized = false;
 
-    this._printFingerprintAuthorization();
+    if (this.secureMode) {
+      this.securityFingerprint = await fingerprintPublicKeys(
+        this.code,
+        this.hostPublicKeyBase64,
+        this.clientPublicKeyBase64
+      );
+      this.fingerprintAuthorized = false;
+      this._printFingerprintAuthorization();
+    } else {
+      this.fingerprintAuthorized = true;
+      await this._activateSecureSession();
+    }
   }
 
   _printFingerprintAuthorization() {
@@ -486,7 +496,7 @@ class Session {
               code: this.code,
               expiry: formatDuration(this.expiryMs),
               rejoinWindow: formatDuration(this.rejoinMs),
-              mode: this.readOnly ? 'Read-Only' : 'Read-Write',
+              mode: (this.readOnly ? 'Read-Only' : 'Read-Write') + (this.secureMode ? ' (Secure)' : ''),
               shell: this.shell,
               startPath: this.startPath,
               shareUrl: url.replace(/^wss:\/\//i, 'https://').replace(/^ws:\/\//i, 'http://')
@@ -505,6 +515,11 @@ class Session {
             this.isClientConnected = true;
             this.missedPings = 0;
 
+            if (this.useDataChannel && this.webrtc && this.webrtc.isActive()) {
+              this.startHeartbeat();
+              break;
+            }
+
             await this._beginKeyExchange();
             break;
           }

package/src/ui.js

@@ -101,6 +101,7 @@ Options:
   --expiry <time>     Session expiry time (e.g. 5m, 30s, 1h)  [default: 5m]
   --rejoin <time>     Reconnection window (e.g. 5m, 1h, 6h)   [default: 2m]
   --readonly          Share in view-only mode
+  --secure            Enable fingerprint verification for MITM protection
   --path <dir>        Starting directory for the terminal session  [default: home]
   --relay <url>       Custom relay server URL
   --verbose           Enable debug logging
@@ -112,6 +113,7 @@ Examples:
   peer-term --expiry 10m           Custom expiry
   peer-term --rejoin 30m           Custom reconnection window
   peer-term --readonly             View-only session
+  peer-term --secure               Require fingerprint verification
   peer-term --path ~/projects      Start in ~/projects
   peer-term --verbose              Debug logs
   peer-term --relay wss://custom   Use custom relay server