peer-term 1.3.5 → 1.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peer-term",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "license": "MIT",
   "description": "Share your terminal instantly using a 6-digit code. Encrypted. No config.",
   "repository": {

package/src/index.js

@@ -90,8 +90,7 @@ if (argv.verbose) {
 
 // ─── Configuration ───────────────────────────────────────────────────────────
 const DEFAULT_RELAYS = [
-  'wss://peer-term-relay.onrender.com',
-  'wss://peer-term-relay-production-9b7a.up.railway.app'
+  'wss://relay.dhananjaybalekar.in'
 ];
 const RELAY_URLS = argv.relay 
   ? argv.relay.split(',').map(s => s.trim()) 
@@ -613,6 +612,10 @@ class Session {
               try {
                 const parsedMsg = JSON.parse(plaintext);
                 if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                  if (this.readOnly) {
+                    this._sendFileError(parsedMsg.id, 'File uploads are disabled in read-only mode');
+                    return;
+                  }
                   this._handleFileMessage(parsedMsg);
                   return;
                 }
@@ -846,6 +849,12 @@ class Session {
    * All file messages arrive over the DataChannel only.
    */
   _handleFileMessage(msg) {
+    // Defense-in-depth: reject all file operations in read-only sessions
+    if (this.readOnly) {
+      this._sendFileError(msg.id, 'File uploads are disabled in read-only mode');
+      return;
+    }
+
     switch (msg.type) {
       case 'file-start': {
         // Validate required fields
@@ -1370,6 +1379,10 @@ class Session {
             try {
               const parsedMsg = JSON.parse(plaintext);
               if (parsedMsg && typeof parsedMsg.type === 'string' && parsedMsg.type.startsWith('file-')) {
+                if (this.readOnly) {
+                  this._sendFileError(parsedMsg.id, 'File uploads are disabled in read-only mode');
+                  return;
+                }
                 this._handleFileMessage(parsedMsg);
                 return;
               }
@@ -1527,6 +1540,10 @@ class Session {
         try {
           const msg = JSON.parse(plaintext);
           if (msg && typeof msg.type === 'string' && msg.type.startsWith('file-')) {
+            if (this.readOnly) {
+              this._sendFileError(msg.id, 'File uploads are disabled in read-only mode');
+              return;
+            }
             this._handleFileMessage(msg);
             return;
           }