replicas-engine 0.1.629 → 0.1.631

package/dist/src/index.js

@@ -798,7 +798,8 @@ var WORKSPACE_SIZES = ["small", "large"];
 var INVALID_WORKSPACE_SIZE_ERROR = `Invalid size: must be one of ${WORKSPACE_SIZES.join(", ")}`;
 
 // ../shared/src/egress.ts
-var EGRESS_CIPHER = "aes-256-gcm";
+var EGRESS_CIPHER = "2022-blake3-aes-256-gcm";
+var EGRESS_KEY_BYTES = 32;
 var EGRESS_SHADOWSOCKS_MODE = "tcp_and_udp";
 var EGRESS_SHADOWSOCKS_VERSION = "1.24.0";
 var EGRESS_SHADOWSOCKS_SHA256 = "0d84f5f350ec99396867d718f146fc3810975b2a7cd06192f158d96bdef460e7";
@@ -816,24 +817,44 @@ var EGRESS_DIRECT_ROUTES = [
   "169.254.0.0/16",
   "100.64.0.0/10"
 ];
+var EGRESS_NEW_CONN_RATE = 100;
+var EGRESS_NEW_CONN_BURST = 200;
+var EGRESS_UDP_RATE = 500;
+var EGRESS_UDP_BURST = 1e3;
+var EGRESS_OUT_CONN_RATE = 1e3;
+var EGRESS_OUT_CONN_BURST = 2e3;
 var EGRESS_SHELL_CONFIG = [
   `EGRESS_PORT_RANGE_START=${EGRESS_PORT_RANGE_START}`,
   `EGRESS_PORT_RANGE_END=${EGRESS_PORT_RANGE_END}`,
   `EGRESS_SHADOWSOCKS_VERSION=${EGRESS_SHADOWSOCKS_VERSION}`,
   `EGRESS_SHADOWSOCKS_SHA256=${EGRESS_SHADOWSOCKS_SHA256}`,
   `EGRESS_CIPHER=${EGRESS_CIPHER}`,
+  `EGRESS_KEY_BYTES=${EGRESS_KEY_BYTES}`,
   `EGRESS_MODE=${EGRESS_SHADOWSOCKS_MODE}`,
   `EGRESS_EXIT_IP_ENDPOINTS="${EGRESS_EXIT_IP_ENDPOINTS.join(" ")}"`,
-  `EGRESS_DIRECT_ROUTES="${EGRESS_DIRECT_ROUTES.join(" ")}"`
+  `EGRESS_DIRECT_ROUTES="${EGRESS_DIRECT_ROUTES.join(" ")}"`,
+  `EGRESS_NEW_CONN_RATE=${EGRESS_NEW_CONN_RATE}`,
+  `EGRESS_NEW_CONN_BURST=${EGRESS_NEW_CONN_BURST}`,
+  `EGRESS_UDP_RATE=${EGRESS_UDP_RATE}`,
+  `EGRESS_UDP_BURST=${EGRESS_UDP_BURST}`,
+  `EGRESS_OUT_CONN_RATE=${EGRESS_OUT_CONN_RATE}`,
+  `EGRESS_OUT_CONN_BURST=${EGRESS_OUT_CONN_BURST}`
 ].join("\n");
 var EGRESS_TUNNEL_SERVICE = "replicas-egress.service";
 var EGRESS_TUNNEL_INTERFACE = "rpxtun0";
 var EGRESS_DNS_SERVERS = ["1.1.1.1", "8.8.8.8"];
 var EGRESS_PATHS = {
-  CONFIG_DIR: "/etc/replicas/egress",
-  /** Root-only (0600). Holds the customer's proxy password — never baked into the image. */
-  CONFIG_FILE: "/etc/replicas/egress/config.json",
-  RESOLV_BACKUP: "/etc/replicas/egress/resolv.conf.orig",
+  /**
+   * Under /run, which is tmpfs. The key therefore never touches disk and cannot
+   * be carried into a filesystem snapshot or a paused sandbox's disk image. It
+   * does not survive a reboot either, which is correct: the monolith rewrites
+   * it on every resume, so a revoked credential cannot come back with the
+   * workspace.
+   */
+  CONFIG_DIR: "/run/replicas-egress",
+  CONFIG_FILE: "/run/replicas-egress/config.json",
+  /** Persistent: this records the workspace's original resolver so the tunnel can put it back, and must outlive a reboot. */
+  RESOLV_BACKUP: "/var/lib/replicas-egress-resolv.conf.orig",
   UNIT_FILE: `/etc/systemd/system/${EGRESS_TUNNEL_SERVICE}`,
   UP_SCRIPT: "/usr/local/lib/replicas-egress-up",
   DOWN_SCRIPT: "/usr/local/lib/replicas-egress-down"
@@ -11052,7 +11073,7 @@ var DEFAULT_CODEX_ARGS = [
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.629";
+var ENGINE_PACKAGE_VERSION = "0.1.631";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.629",
+  "version": "0.1.631",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",