session-peer 0.1.0-preview.0 → 0.1.0

package/dist/protocol.d.ts

@@ -0,0 +1,9 @@
+export declare const VERSION = "0.1.0";
+export declare const VERSION_LINE = "session-peer 0.1.0 (typescript)";
+export declare function host(value: string): string;
+export declare function reply(value: string): {
+    to: string;
+    host?: string;
+    home?: string;
+};
+export declare function envelope(text: string, noFrom: boolean, address?: string): string;

package/dist/protocol.js

@@ -1,6 +1,6 @@
 import { Refusal } from './discovery.js';
 import { uuid } from './writer.js';
-export const VERSION = '0.1.0-preview.0';
+export const VERSION = '0.1.0';
 export const VERSION_LINE = `session-peer ${VERSION} (typescript)`;
 export function host(value) {
     if (value.length > 255 || !/^(?:[A-Za-z0-9_][A-Za-z0-9_.-]*@)?[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(value))

package/dist/send.d.ts

@@ -0,0 +1,10 @@
+export type SendOptions = {
+    to: string;
+    home?: string;
+    codexBin?: string;
+    message: string;
+    dryRun?: boolean;
+};
+export declare function checkMessage(text: string, codex?: boolean): void;
+export declare function postSocket(path: string, text: string): Promise<void>;
+export declare function send(options: SendOptions): Promise<Record<string, unknown>>;

package/dist/send.js

@@ -2,6 +2,7 @@ import { createConnection } from 'node:net';
 import { canonical, claude, Refusal } from './discovery.js';
 import { executable, run, UnknownOutcome } from './process.js';
 import { resolveWriter, uuid } from './writer.js';
+import { postWindowsPipe } from './windows.js';
 export function checkMessage(text, codex = false) {
     if (!text.trim() || text.includes('\0') || [...text].length > 1_000_000 ||
         (codex && Buffer.byteLength(text, 'utf8') > 32768))
@@ -83,6 +84,9 @@ export async function send(options) {
     const rechecked = select();
     if (row.pid !== rechecked.pid || row.socket !== rechecked.socket)
         throw new Refusal('target_changed', 1);
-    await postSocket(String(row.socket), options.message);
+    if (process.platform === 'win32')
+        await postWindowsPipe(String(row.socket), Number(row.pid), options.message);
+    else
+        await postSocket(String(row.socket), options.message);
     return result;
 }

package/dist/windows.d.ts

@@ -0,0 +1,9 @@
+export type WindowsProcess = {
+    pid: number;
+    uid: string;
+    command: string;
+    start: string;
+};
+export declare function inspectWindows(mode: 'identity' | 'openers', value: string): WindowsProcess[];
+export declare function windowsProcessStart(pid: number): bigint | undefined;
+export declare function postWindowsPipe(pipe: string, pid: number, text: string): Promise<void>;

package/dist/windows.js

@@ -0,0 +1,171 @@
+import { readdirSync, readFileSync, lstatSync } from 'node:fs';
+import { join } from 'node:path';
+import { createConnection } from 'node:net';
+import { spawnSync } from 'node:child_process';
+import { Refusal } from './discovery.js';
+import { UnknownOutcome } from './process.js';
+// Get-CimInstance and Restart Manager are Windows read-only APIs. The script
+// emits only PID, SID, executable basename and creation time. No arguments,
+// command line, message body, token or file contents are returned.
+const inspectScript = String.raw `
+$ErrorActionPreference = 'Stop'
+Add-Type -TypeDefinition @'
+using System;
+using System.Text;
+using System.Runtime.InteropServices;
+public static class Reader {
+  [StructLayout(LayoutKind.Sequential)] public struct Time { public uint Lo; public uint Hi; }
+  [StructLayout(LayoutKind.Sequential)] public struct Unique { public uint Pid; public Time Start; }
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct Info {
+    public Unique Process;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=256)] public string App;
+    [MarshalAs(UnmanagedType.ByValTStr, SizeConst=64)] public string Service;
+    public uint Kind; public uint Status; public uint Session;
+    [MarshalAs(UnmanagedType.Bool)] public bool Restartable;
+  }
+  [DllImport("Rstrtmgr.dll", CharSet=CharSet.Unicode)] public static extern int RmStartSession(out uint session, uint flags, StringBuilder key);
+  [DllImport("Rstrtmgr.dll", CharSet=CharSet.Unicode)] public static extern int RmRegisterResources(uint session, uint files, string[] paths, uint apps, IntPtr app, uint services, IntPtr svc);
+  [DllImport("Rstrtmgr.dll")] public static extern int RmGetList(uint session, out uint needed, ref uint count, [In,Out] Info[] info, ref uint reasons);
+  [DllImport("Rstrtmgr.dll")] public static extern int RmEndSession(uint session);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, uint pid);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetProcessTimes(IntPtr handle, out Time creation, out Time exit, out Time kernel, out Time user);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  public static ulong Start(uint pid) {
+    var handle = OpenProcess(0x1000, false, pid);
+    if (handle == IntPtr.Zero) throw new Exception("process_unavailable");
+    try {
+      Time created, exited, kernel, user;
+      if (!GetProcessTimes(handle, out created, out exited, out kernel, out user)) throw new Exception("process_unavailable");
+      return ((ulong)created.Hi << 32) | created.Lo;
+    } finally { CloseHandle(handle); }
+  }
+}
+'@
+function Identity([uint32]$identifier, [string]$expected = '') {
+  $item = Get-CimInstance Win32_Process -Filter "ProcessId = $identifier"
+  if (!$item) { throw 'process_unavailable' }
+  $start = [string][Reader]::Start($identifier)
+  if ($expected -and $start -ne $expected) { throw 'process_replaced' }
+  $owner = Invoke-CimMethod -InputObject $item -MethodName GetOwnerSid
+  if (!$owner.Sid) { throw 'owner_unavailable' }
+  return @{pid=[int]$identifier; uid=[string]$owner.Sid; command=[string]$item.Name; start=$start}
+}
+function Openers([string]$location) {
+  [uint32]$session = 0
+  $key = New-Object System.Text.StringBuilder 33
+  if ([Reader]::RmStartSession([ref]$session, 0, $key) -ne 0) { throw 'rm_start_failed' }
+  try {
+    $paths = [string[]]@($location)
+    if ([Reader]::RmRegisterResources($session, 1, $paths, 0, [IntPtr]::Zero, 0, [IntPtr]::Zero) -ne 0) { throw 'rm_register_failed' }
+    [uint32]$needed = 0; [uint32]$count = 128; [uint32]$reasons = 0
+    $rows = New-Object 'Reader+Info[]' 128
+    if ([Reader]::RmGetList($session, [ref]$needed, [ref]$count, $rows, [ref]$reasons) -ne 0 -or $count -gt 128) { throw 'rm_list_failed' }
+    $result = @()
+    for ($i=0; $i -lt $count; $i++) {
+      $ticks = ([uint64]$rows[$i].Process.Start.Hi -shl 32) -bor $rows[$i].Process.Start.Lo
+      $result += Identity $rows[$i].Process.Pid ([string]$ticks)
+    }
+    return ,$result
+  } finally { [void][Reader]::RmEndSession($session) }
+}
+`;
+export function inspectWindows(mode, value) {
+    if (process.platform !== 'win32')
+        throw new Refusal('windows_inspection_unavailable', 1);
+    const encodedValue = Buffer.from(value, 'utf8').toString('base64');
+    const code = inspectScript + `
+$value = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedValue}'))
+try {
+  $result = if ('${mode}' -eq 'identity') { @(Identity ([uint32]$value)) } else { @(Openers $value) }
+  ConvertTo-Json -InputObject @($result) -Compress -Depth 4
+} catch { exit 1 }
+`;
+    const done = spawnSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command',
+        '$script = [Console]::In.ReadToEnd(); Invoke-Expression $script'], { input: code, encoding: 'utf8', timeout: 8000, maxBuffer: 65536, windowsHide: true });
+    if (done.status !== 0 || done.error)
+        throw new Refusal('windows_owner_inspection_failed', 1);
+    let rows;
+    try {
+        rows = JSON.parse(done.stdout);
+    }
+    catch {
+        throw new Refusal('windows_owner_inspection_failed', 1);
+    }
+    if (!Array.isArray(rows) || rows.length > 128 || rows.some(row => !row || !Number.isSafeInteger(row.pid) || row.pid <= 0 ||
+        typeof row.uid !== 'string' || !row.uid.startsWith('S-') ||
+        typeof row.command !== 'string' || !row.command ||
+        typeof row.start !== 'string' || !/^\d+$/.test(row.start))) {
+        throw new Refusal('windows_owner_inspection_failed', 1);
+    }
+    return rows;
+}
+export function windowsProcessStart(pid) {
+    try {
+        const rows = inspectWindows('identity', String(pid));
+        return rows.length === 1 ? BigInt(rows[0].start) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function authLine(pid) {
+    const directory = join(process.env.CLAUDE_CONFIG_DIR || process.env.ANTHROPIC_CONFIG_DIR ||
+        join(process.env.USERPROFILE || '', '.claude'), 'sessions');
+    let names;
+    try {
+        names = readdirSync(directory).filter(name => new RegExp(`^${pid}\\.[^.]+\\.key$`).test(name));
+    }
+    catch {
+        throw new Refusal('windows_inbox_auth_unavailable', 1);
+    }
+    if (names.length !== 1)
+        throw new Refusal('windows_inbox_auth_unavailable', 1);
+    const file = join(directory, names[0]);
+    try {
+        const entry = lstatSync(file);
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 16384)
+            throw new Error('invalid_key');
+        const value = JSON.parse(readFileSync(file, 'utf8'));
+        const token = value?.peerToken;
+        if (typeof token !== 'string' || !token.trim())
+            throw new Error('invalid_key');
+        return JSON.stringify({ type: 'auth', token }) + '\n';
+    }
+    catch {
+        throw new Refusal('windows_inbox_auth_unavailable', 1);
+    }
+}
+export async function postWindowsPipe(pipe, pid, text) {
+    if (!/^\\\\\.\\pipe\\[^\r\n]+$/i.test(pipe))
+        throw new Refusal('invalid_windows_pipe', 1);
+    const auth = authLine(pid);
+    const payload = auth + JSON.stringify({ type: 'user', message: { role: 'user', content: text } }) + '\n';
+    return new Promise((resolve, reject) => {
+        let connected = false, finished = false;
+        const socket = createConnection(pipe);
+        const timeout = setTimeout(() => finish(new Error('timeout')), 10000);
+        const finish = (error) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timeout);
+            socket.destroy();
+            if (error)
+                reject(connected ? new UnknownOutcome() : new Refusal('inbox_unreachable', 1));
+            else
+                resolve();
+        };
+        socket.once('error', error => finish(error));
+        socket.once('connect', () => {
+            connected = true;
+            socket.write(payload, error => {
+                if (error)
+                    return finish(error);
+                const drain = setTimeout(() => finish(), 2000);
+                socket.once('close', () => { clearTimeout(drain); finish(); });
+                socket.once('data', () => { clearTimeout(drain); finish(); });
+            });
+        });
+    });
+}

package/dist/writer.d.ts

@@ -0,0 +1,8 @@
+export declare const uuid: (value: string) => boolean;
+export declare function probeLock(path: string): Promise<'free' | 'held' | 'absent' | 'unknown'>;
+export declare function inspectWriter(home: string, id: string): Promise<{
+    activity: string;
+    identity: string;
+}>;
+export declare function homes(selected: string): string[];
+export declare function resolveWriter(selected: string, id: string): Promise<string>;

package/dist/writer.js

@@ -4,6 +4,7 @@ import { isAbsolute, join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { canonical, Refusal } from './discovery.js';
 import { executable, run } from './process.js';
+import { inspectWindows } from './windows.js';
 const missing = (error) => ['ENOENT', 'ENOTDIR'].includes(error.code ?? '');
 export const uuid = (value) => /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i.test(value);
 function snapshot(path) {
@@ -16,18 +17,30 @@ export async function probeLock(path) {
         const before = lstatSync(path);
         if (!before.isFile() || before.isSymbolicLink())
             return 'unknown';
-        const { flockSync } = await import('fs-ext-extra-prebuilt');
-        fd = openSync(path, constants.O_RDWR | constants.O_NOFOLLOW);
+        const locks = await import('fs-ext-extra-prebuilt');
+        fd = openSync(path, constants.O_RDWR | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW));
         const after = fstatSync(fd);
         if (before.dev !== after.dev || before.ino !== after.ino)
             return 'unknown';
-        try {
-            flockSync(fd, 'exnb');
+        if (process.platform === 'win32') {
+            try {
+                locks.lockFileExSync(fd, locks.constants.LOCKFILE_EXCLUSIVE_LOCK | locks.constants.LOCKFILE_FAIL_IMMEDIATELY, 0, 0, 0xffffffff, 0xffffffff);
+            }
+            catch (error) {
+                return ['EAGAIN', 'EACCES', 'EWOULDBLOCK'].includes(error.code ?? '') ||
+                    error.errno === 33 ? 'held' : 'unknown';
+            }
+            locks.unlockFileExSync(fd, 0, 0, 0xffffffff, 0xffffffff);
         }
-        catch (error) {
-            return ['EAGAIN', 'EACCES', 'EWOULDBLOCK'].includes(error.code ?? '') ? 'held' : 'unknown';
+        else {
+            try {
+                locks.flockSync(fd, 'exnb');
+            }
+            catch (error) {
+                return ['EAGAIN', 'EACCES', 'EWOULDBLOCK'].includes(error.code ?? '') ? 'held' : 'unknown';
+            }
+            locks.flockSync(fd, 'un');
         }
-        flockSync(fd, 'un');
         return 'free';
     }
     catch (error) {
@@ -43,6 +56,10 @@ async function sample(path) {
     if (state !== 'held')
         return { state, fingerprint: '', owners: [], valid: true };
     const fingerprint = snapshot(path);
+    if (process.platform === 'win32') {
+        const owners = inspectWindows('openers', path);
+        return { state, fingerprint, owners, valid: true };
+    }
     const listed = await run(executable('lsof'), ['-nP', '-F0pcu', '--', path]);
     const owners = [];
     let current;
@@ -76,9 +93,10 @@ export async function inspectWriter(home, id) {
     await delay(250);
     const after = await sample(path);
     const owner = after.owners[0];
+    const ownId = process.platform === 'win32' ? inspectWindows('identity', String(process.pid))[0]?.uid : process.getuid?.();
     if (!before.valid || !after.valid || before.state !== after.state || before.fingerprint !== after.fingerprint ||
         before.owners.length !== 1 || after.owners.length !== 1 || JSON.stringify(before.owners) !== JSON.stringify(after.owners) ||
-        !owner?.start || owner.uid !== process.getuid?.() || !/^codex(?:-|$)/i.test(owner.command ?? '')) {
+        !owner?.start || !ownId || owner.uid !== ownId || !/^codex(?:\.exe|-|$)/i.test(owner.command ?? '')) {
         throw new Refusal('active_writer_unverified', 1);
     }
     return { activity: 'live_writer', identity: JSON.stringify({ fingerprint: after.fingerprint, ...owner }) };

package/package.json

@@ -1,16 +1,20 @@
 {
   "name": "session-peer",
-  "version": "0.1.0-preview.0",
+  "version": "0.1.0",
   "private": false,
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public",
-    "tag": "preview"
+    "tag": "latest"
   },
   "repository": { "type": "git", "url": "git+https://github.com/abruption/session-peer-ts.git" },
-  "os": ["darwin", "linux"],
-  "description": "Python-free local and SSH client for Claude Code and Codex sessions (preview)",
+  "os": ["darwin", "linux", "win32"],
+  "description": "Python-free local and SSH client for Claude Code and Codex sessions",
   "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" }
+  },
   "license": "MIT",
   "engines": {
     "node": "^22.13.0 || ^24.0.0"
@@ -31,8 +35,10 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "npm run build && node --test test/*.test.mjs",
-    "test:package": "npm run build && node test/package-smoke.mjs"
+    "test": "npm run build && npm run test:types && node --experimental-strip-types --test test/*.test.ts",
+    "test:types": "tsc -p tsconfig.test.json",
+    "test:windows": "npm run build && npm run test:types && node --experimental-strip-types --test test/windows.test.ts",
+    "test:package": "npm run build && node --experimental-strip-types test/package-smoke.ts"
   },
   "devDependencies": {
     "@types/node": "22.13.10",