socketduct 0.1.15

package/.dockerignore

@@ -0,0 +1,11 @@
+/node_modules
+/npm-debug.log
+/.git
+/.github
+/.env
+.env*
+!.env.example
+coverage
+dist
+.tmp
+*.log

package/.env.example

@@ -0,0 +1,131 @@
+# Copy this file to .env on the remote gateway and fill the values.
+# Keep .env private. Do not commit real tokens.
+
+# Required for production gateway deployment. Replace the placeholder with the
+# lowercase 64-character digest published for the intended GHCR image. Tags,
+# including latest, branch names, and commit SHAs, are rejected.
+SOCKETDUCT_IMAGE=ghcr.io/kaspernj/socketduct@sha256:<64-lowercase-hex>
+
+SOCKETDUCT_MODE=relay
+SOCKETDUCT_RELAY_HOST=0.0.0.0
+SOCKETDUCT_RELAY_PORT=3100
+# Protocol v3 multiplexes many virtual streams per physical transport. Keep 2
+# during rollback, then change both relay and clients together.
+SOCKETDUCT_PROTOCOL_VERSION=3
+# Host address published by Docker Compose. The safe default is loopback;
+# set this explicitly to a private interface address when remote edges need it.
+SOCKETDUCT_PUBLISH_HOST=127.0.0.1
+SOCKETDUCT_RESUME_WINDOW_MS=30000
+# Emit secret-free JSON runtime counters at this interval. Set 0 to disable.
+SOCKETDUCT_STATUS_INTERVAL_MS=30000
+
+# Optional bounded persistent JSONL logs. Bind mount this directory from host
+# storage in Docker. Files are isolated by role/PID; defaults are 10 MiB and 5
+# retained files including the active file. Existing stdout/stderr is preserved.
+# Host directory mounted by the checked-in production Compose files. Create it
+# for uid/gid 1000 before deployment. Logging stays disabled unless the
+# container-side SOCKETDUCT_LOG_DIRECTORY is also set.
+# SOCKETDUCT_LOG_HOST_DIRECTORY=/srv/socketduct/logs
+# SOCKETDUCT_LOG_DIRECTORY=/var/log/socketduct
+# SOCKETDUCT_LOG_MAX_FILE_BYTES=10485760
+# SOCKETDUCT_LOG_MAX_FILES=5
+
+# Per-session hard byte limit for target-to-client data buffered while the
+# edge tunnel is detached. When the limit is exceeded the relay terminates
+# the target connection and the edge receives a terminal protocol error.
+# Default (when omitted): 1048576 (1 MiB).
+# SOCKETDUCT_MAX_TARGET_BUFFER_BYTES=1048576
+
+# Process-wide byte limit for target-to-client buffered data across all
+# sessions combined. When this aggregate limit is exceeded the relay
+# terminates the session whose target data just crossed the limit and the
+# edge receives a terminal protocol error.
+# Default (when omitted): 16777216 (16 MiB).
+# SOCKETDUCT_MAX_TOTAL_BUFFER_BYTES=16777216
+
+# Initial target connection retry starts at this delay and doubles until the
+# maximum. Retry exists only before session.created; established operations are
+# never replayed against a replacement target. Defaults: 250 and 5000.
+# SOCKETDUCT_INITIAL_TARGET_RETRY_DELAY_MS=250
+# SOCKETDUCT_INITIAL_TARGET_RETRY_MAX_DELAY_MS=5000
+
+# Milliseconds to wait for authentication after a TCP/TLS connection is
+# established. If no session.create or session.resume arrives within this
+# window, the relay closes the connection with a HANDSHAKE_TIMEOUT error.
+# Default (when omitted): 10000 (10 seconds).
+# SOCKETDUCT_HANDSHAKE_TIMEOUT_MS=10000
+
+# Per-connection input byte budget before the first authenticated session
+# frame. If a connection sends more raw bytes than this limit before
+# completing authentication, the relay terminates the connection.
+# Default (when omitted): 65536 (64 KiB).
+# SOCKETDUCT_MAX_INPUT_BYTES_PER_CONNECTION=65536
+
+# Comma-separated username:token entries. Generate a token with:
+#   openssl rand -base64 48 | tr '+/' '-_' | tr -d '=\n'
+# The placeholder below is intentionally rejected by the runtime.
+SOCKETDUCT_AUTH_TOKENS=tensorbuzz-edge:replace-with-generated-token
+
+# Comma-separated host:port entries the authenticated edge may request.
+# For Docker-host gateway mode, enable the docker-host Compose profile and
+# keep this value pointed at the private shim service; it is not published
+# on the host network.
+SOCKETDUCT_TARGET_ALLOWLIST=docker-socket-shim:2375
+
+# --- TLS (atomic pair; both must be set or neither) ---
+# Path to PEM-encoded certificate file for the relay listener.
+# SOCKETDUCT_TLS_CERT_FILE=/certs/relay.crt
+# Path to PEM-encoded private key file for the relay listener.
+# SOCKETDUCT_TLS_KEY_FILE=/certs/relay.key
+
+# --- Optional mTLS ---
+# Path to PEM-encoded client CA certificate file.
+# When set, the relay requires clients to present a valid certificate.
+# SOCKETDUCT_TLS_CLIENT_CA_FILE=/certs/client-ca.crt
+
+# --- Insecure public opt-out ---
+# Set to 1 or true only when you intentionally bind to a non-loopback
+# address without TLS. Only accepts 1 or true.
+# SOCKETDUCT_ALLOW_INSECURE_PUBLIC=1
+
+# --- stream.data compression ---
+# Whether the relay negotiates compression of tunnelled stream data.
+# "auto" (default) offers zstd when the Node runtime supports it (Node >= 22.15;
+# older runtimes silently fall back to raw framing). "off" disables it entirely,
+# so every tunnel uses the raw legacy format. Unknown values are rejected.
+# Control, session and auth frames are never compressed.
+# SOCKETDUCT_COMPRESSION=auto
+
+# Payloads smaller than this are sent raw, because compressing them costs more
+# CPU than it saves bytes. Default 256.
+# SOCKETDUCT_MIN_COMPRESS_BYTES=256
+
+# Hard cap on the decompressed size of a single stream.data frame. A frame that
+# advertises more than this is rejected as a protocol violation. Default 16 MiB.
+# SOCKETDUCT_MAX_DECOMPRESSED_BYTES=16777216
+
+# Hard cap on the decompressed/compressed expansion ratio of a single frame,
+# bounding decompression-bomb amplification. Raise this only if a legitimate,
+# highly repetitive payload is being rejected. Default 1000.
+# SOCKETDUCT_MAX_EXPANSION_RATIO=1000
+
+# --- Native reverse gateway roles ---
+# Server3 hub: change SOCKETDUCT_MODE to reverse-hub, keep the TLS server pair
+# above, and bind every stable gateway ID to its credential username.
+# SOCKETDUCT_REVERSE_GATEWAY_BINDINGS=o2:home-o2,zyxel:home-zyxel,starlink:home-starlink
+# Authorize exact client username, gateway ID, and home-local target tuples.
+# SOCKETDUCT_REVERSE_ROUTES=tensorbuzz:o2:docker-server:2375,tensorbuzz:zyxel:docker-server:2375,tensorbuzz:starlink:docker-server:2375
+
+# Home member: change SOCKETDUCT_MODE to reverse-gateway. Run one process in
+# each router-pinned namespace and use distinct stable identity/credential data.
+# SOCKETDUCT_REVERSE_GATEWAY_ID=o2
+# SOCKETDUCT_REVERSE_CONNECTION_ID=home_o2_gateway_01
+# SOCKETDUCT_REVERSE_HUB_HOST=server3.example.net
+# SOCKETDUCT_REVERSE_HUB_PORT=3100
+# SOCKETDUCT_REVERSE_TOKEN=<secret-manager-value>
+# SOCKETDUCT_REVERSE_HUB_CA_FILE=/certs/hub-ca.crt
+# SOCKETDUCT_REVERSE_HUB_SERVERNAME=server3.example.net
+# Optional outbound mTLS atomic pair:
+# SOCKETDUCT_REVERSE_HUB_CLIENT_CERT_FILE=/certs/gateway.crt
+# SOCKETDUCT_REVERSE_HUB_CLIENT_KEY_FILE=/certs/gateway.key
+# Keep SOCKETDUCT_TARGET_ALLOWLIST=docker-server:2375 and do not publish it.

package/AGENTS.md

@@ -0,0 +1,168 @@
+# AGENTS.md
+
+Guidance for coding agents working in this repository.
+
+## Project
+
+**Socketduct** is a resilient, authenticated tunnel/proxy written in Node.js.
+
+The goal is to let applications connect to a stable local/LAN endpoint while Socketduct handles unreliable upstream internet links. When the WAN drops for a few seconds, the app-facing socket should stay open where possible. Socketduct reconnects to the remote server, resumes the named session by identifier, replays buffered state/data, and continues the stream.
+
+Primary scenario:
+
+```text
+Application on stable LAN machine
+  -> Socketduct local proxy/edge on same LAN
+  -> unreliable internet
+  -> Socketduct relay/server
+  -> target service / internet
+```
+
+The application and the local Socketduct edge are assumed to be on a stable LAN. The unreliable portion is between the edge and the remote Socketduct relay.
+
+## Non-negotiable requirements
+
+- Use **Node.js**.
+- Use multiple CPU cores for connection/session work.
+- Require authentication before any session operation.
+- Support users with passwords or password-derived credentials.
+- Never behave as an unauthenticated open proxy.
+- Sessions have both:
+  - human-readable `name`
+  - stable opaque `identifier`
+- A client can create a new session or resume an existing session by `identifier`.
+- On connection loss, persist resumable session state to temporary spool files.
+- On resume, send/upload the relevant spool file/state to the server before continuing.
+- Favor explicit protocol docs and tests over clever implicit behavior.
+
+## Preferred architecture
+
+Use separate process roles:
+
+- **Control process**: config, auth store, lifecycle, worker supervision.
+- **Worker processes**: connection handling, session streams, replay/spooling.
+- **Optional admin/API process**: user management, health, metrics.
+
+For multi-core Node.js, prefer one of these, in order:
+
+1. `node:cluster` for distributing incoming TCP/proxy connections across CPU cores.
+2. `node:worker_threads` for CPU-heavy work, if any appears later.
+3. `node:child_process` only when isolation or external commands are needed.
+
+The initial server should probably use `node:cluster` because socket/concurrency work is mostly I/O-bound and cluster maps naturally to per-core workers.
+
+If looking for inspiration, inspect Velocious' HTTP server/client patterns, but do not assume Velocious is the right dependency. Socketduct should remain a small standalone networking tool unless there is a strong reason otherwise.
+
+## Security model
+
+- Auth happens before `session.create`, `session.resume`, or proxy connect.
+- Store passwords as Argon2id hashes if practical; otherwise bcrypt/scrypt with sane parameters.
+- Prefer session tokens after login instead of sending username/password on every reconnect.
+- Bind tokens to user + session identifier where possible.
+- Enforce per-user session ownership.
+- Add destination allowlists before exposing general proxying.
+- Default listen address should be local/LAN-safe, not public internet.
+- Never log raw passwords, session tokens, or target credentials.
+
+## Session model
+
+A session represents one resumable tunnel/proxy stream.
+
+Minimum fields:
+
+- `identifier`: opaque stable id, client-generated or server-generated.
+- `name`: human-friendly label.
+- `userId`: authenticated owner.
+- `state`: `creating`, `active`, `interrupted`, `resuming`, `closed`, `expired`.
+- `createdAt`, `updatedAt`, `lastSeenAt`.
+- `localSequence`: highest byte/chunk accepted from local app.
+- `remoteSequence`: highest byte/chunk acknowledged by remote relay.
+- `spoolPath`: path to temporary persisted resume data, if interrupted.
+
+## Spooling/resume behavior
+
+When a tunnel connection drops:
+
+1. Keep the app-facing socket open if buffer/time limits allow.
+2. Mark the session as `interrupted`.
+3. Persist unacknowledged stream chunks and metadata into a temp spool file.
+4. Attempt reconnect with exponential backoff.
+5. Authenticate or refresh the reconnect token.
+6. Resume by `identifier`.
+7. Send the spool metadata/data.
+8. Continue from the server-confirmed sequence position.
+
+Spool files should be bounded:
+
+- maximum bytes per session
+- maximum age
+- cleanup on successful close/expiry
+- crash recovery scan on process start
+
+## Protocol direction
+
+Prefer a framed protocol over raw ad-hoc JSON lines.
+
+Every frame should include:
+
+- protocol version
+- message type
+- session identifier where relevant
+- monotonically increasing sequence number where relevant
+- payload length
+- checksum or authentication tag if needed
+
+Initial message types:
+
+- `auth.login`
+- `auth.ok`
+- `auth.error`
+- `session.create`
+- `session.created`
+- `session.resume`
+- `session.resumed`
+- `stream.data`
+- `stream.ack`
+- `stream.pause`
+- `stream.resume`
+- `session.close`
+- `error`
+
+## Development style
+
+- Keep modules small and testable.
+- Write tests before or alongside protocol/session logic.
+- Keep stream replay logic deterministic and unit-tested.
+- Fail loudly on protocol violations.
+- Avoid silently dropping data unless the session has explicitly exceeded configured limits.
+- Prefer TypeScript if/when the implementation begins, but plain modern Node.js is acceptable if that keeps the first prototype simpler.
+
+## Suggested repository structure
+
+```text
+src/
+  cli/
+  config/
+  auth/
+  protocol/
+  sessions/
+  spool/
+  server/
+  edge/
+  workers/
+  proxy/
+test/
+  unit/
+  integration/
+docs/
+```
+
+## Definition of done for implementation PRs
+
+- Add a release-note fragment for every user-visible change, bug fix, security fix, or protocol change under `changelog.d/YYYYMMDDHHMMSS-short-slug.md`. Keep it to one concise, user-facing sentence; do not edit generated release notes directly.
+- Tests added or updated.
+- Relevant docs updated.
+- `npm test` passes.
+- Lint/typecheck passes once configured.
+- Security-sensitive changes mention how credentials/tokens are protected.
+- No open proxy behavior introduced.

package/Dockerfile

@@ -0,0 +1,30 @@
+FROM node:24-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03 AS base
+
+WORKDIR /app
+
+FROM base AS development
+
+ENV NODE_ENV=development
+
+COPY package.json package-lock.json ./
+RUN npm ci && npm cache clean --force
+
+COPY --chown=node:node . .
+
+USER node
+CMD ["npm", "test"]
+
+FROM base AS runtime
+
+ENV NODE_ENV=production
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+
+COPY src ./src
+
+RUN mkdir -p /certs && chown node:node /certs
+
+USER node
+EXPOSE 3100
+CMD ["node", "src/index.js"]

package/README.md

@@ -0,0 +1,134 @@
+# Socketduct
+
+See the [wire protocol](docs/protocol.md) for multiplexed v3, rollback-compatible
+compact framing v2, replay, flow control, and scheduling semantics.
+
+Resilient authenticated tunnel/proxy for keeping socket streams alive across flaky links.
+
+Socketduct is intended for setups where the application machine and a local Socketduct edge are on a stable LAN, but the edge's internet connection occasionally drops for a few seconds. Applications connect to the local edge; Socketduct reconnects and resumes the upstream tunnel when the WAN returns.
+
+```text
+App / client software
+  -> local Socketduct edge on stable LAN
+  -> flaky internet
+  -> Socketduct relay/server
+  -> target service
+```
+
+## Core idea
+
+Normal TCP sockets cannot magically resume after the underlying internet path dies. Socketduct works by owning both sides of the unstable leg:
+
+- the local edge keeps the application-facing socket alive
+- the remote relay validates the requested target per session and keeps the target-facing side alive across brief edge disconnects when possible
+- the edge and relay exchange framed stream data with sequence numbers and acknowledgements
+- stream data payloads are compressed with zstd when both peers negotiate it, falling back to raw framing otherwise; sequences, acknowledgements and limits stay in uncompressed bytes (see [Protocol sketch](docs/protocol.md))
+- on interruption, unacknowledged session data is persisted to a temporary spool file
+- on reconnect, the client authenticates, resumes the session by identifier, sends the spool state/data, and continues from the last acknowledged sequence
+- initial target acquisition is retried with bounded exponential backoff before readiness; established targets and application operations are never automatically replayed
+- dedicated `socketduct/http` and `socketduct/https` agents support HTTP and strict target HTTPS/mTLS without a local listener
+- protocol v3 exposes `MultiplexedSocketductConnection`: one authenticated
+  physical TCP/TLS transport carries many normal `VirtualSocket` Duplex streams,
+  with fair flow control and one shared reconnect/resume owner
+- protocol v3 also exposes `MultiplexedSocketductTransportSet`: one explicit
+  warm member per gateway path, bounded readiness waiting for app-facing
+  sockets, and deterministic per-socket round-robin across ready members
+- native reverse-gateway v3 lets authenticated private home members register
+  outbound with a Server3 hub, so CGNAT paths need no inbound forwarding
+- optional bounded JSONL lifecycle logs can be written to per-process files in
+  a Docker bind-mounted directory without replacing existing stdout/stderr
+
+## MVP goals
+
+- Node.js implementation.
+- Multi-core server using Node's cluster/worker model.
+- Username/password authentication before session operations.
+- Session creation with a human-readable name and stable opaque identifier.
+- Session-scoped target selection through an explicit allowlist policy.
+- Session resume by identifier.
+- Temporary spool files for interrupted sessions.
+- Bounded buffering and cleanup.
+- No unauthenticated open proxy behavior.
+
+## Multiplexed v3 API
+
+```js
+import {MultiplexedSocketductConnection} from "socketduct/multiplexed"
+
+const transport = new MultiplexedSocketductConnection({
+  relay: {host: "relay.example.net", port: 3100, token: process.env.SOCKETDUCT_TOKEN}
+})
+
+const socket = transport.createConnection({host: "service.internal", port: 443})
+```
+
+Pass the pre-bound `transport.createConnection` directly to generic Node clients.
+Every returned `VirtualSocket` is an independent `Duplex`; closing one does not
+close the physical transport. Legacy v2 APIs and HTTP agents remain available
+for rollback.
+
+For process-scoped path diversity, configure a transport set with stable gateway
+IDs and distinct gateway-pinned relay endpoints or physical socket factories:
+
+```js
+import {MultiplexedSocketductTransportSet} from "socketduct/multiplexed"
+
+const transports = new MultiplexedSocketductTransportSet({
+  connectionId: "build_runner_01",
+  gateways: [
+    {gatewayId: "starlink", endpoint: {relay: starlinkRelay}},
+    {gatewayId: "zyxel", endpoint: {relay: zyxelRelay}},
+    {gatewayId: "o2gateway", endpoint: {relay: o2Relay}}
+  ]
+})
+const starting = transports.start()
+const socket = transports.createConnection({host: "service.internal", port: 443})
+await starting
+```
+
+The default minimum readiness is one. Other configured paths continue warming
+and automatically rejoin selection. A socket created before readiness is
+returned immediately and waits inside Socketduct with normal callback, event,
+timeout and backpressure behavior; assignment stays FIFO and occurs only on a
+ready member. A virtual socket never changes members.
+Durable process-replacement recovery uses `recoverConnection()` with the
+original gateway ID before the replacement set starts.
+
+For home Docker hosts behind O2, Zyxel, and Starlink, run
+`OutboundReverseGateway` in each router-pinned namespace and
+`startReverseGatewayHub` on Server3. TensorBuzz can keep this transport-set API
+by configuring each member with `endpoint.reverseHub`; all three may share one
+hub address because `gatewayId` selects the outbound member. Docker remains
+`docker-server:2375` on a private Compose network and is never published. See
+[Native reverse gateway](docs/reverse-gateway.md).
+
+## Documentation
+
+- [Architecture](docs/architecture.md)
+- [Protocol sketch](docs/protocol.md)
+- [Session lifecycle](docs/session-lifecycle.md)
+- [Security model](docs/security.md)
+- [Running Socketduct](docs/running.md)
+- [Docker gateway setup](docs/docker.md)
+- [Docker topology](docs/docker-topology.md)
+- [Node-compatible socket API design](docs/socket-api.md)
+- [Native reverse gateway](docs/reverse-gateway.md)
+- [Persistent structured logging](docs/logging.md)
+- [Initial implementation plan](docs/plans/initial-implementation.md)
+- [Socket + Docker integration plan](docs/plans/socket-docker-integration.md)
+
+## Contributing
+
+Every user-visible change, bug fix, security fix, and protocol change must include a concise release-note fragment in `changelog.d/YYYYMMDDHHMMSS-short-slug.md`. Release tooling consumes these fragments; do not edit generated release notes directly.
+
+TensorBuzz is the sole CI and private-container publication workflow owner for
+this repository; `tensorbuzz.yml` defines dependency installation, tests,
+typechecking, linting, and a real Dockerfile build against an isolated Docker
+service. Pull-request builds never publish images. Private GHCR publication
+remains disabled until TensorBuzz supplies trusted default-branch/tag/manual
+trigger metadata and the Socketduct project has an established secret-backed
+private-registry write credential input.
+
+## Status
+
+Initial MVP skeleton. The project includes authenticated session create/resume control messages with per-session targets, bounded initial target recovery, a cluster-based server skeleton, local TCP edge/relay forwarding, target-side socket retention across relay reconnects, spool-backed replay, multiplexed multi-gateway transport sets, HTTP and target HTTPS/mTLS adapters, and tests for those flows.

package/changelog.d/20260716083144-v2-ack-wire-format.md

@@ -0,0 +1,3 @@
+# Fix V2 stream ACK framing validation
+
+The TCP relay now validates post-V2-handshake `stream.ack` records using the decoder-provided wire format, so a length-prefixed envelope cannot spoof compact framing through its JSON header.

package/changelog.d/20260716092044-v2-only-stream-framing.md

@@ -0,0 +1 @@
+Require compact framing v2 for Socketduct application data and reject legacy length-prefixed stream records, including envelopes that spoof the compact marker.

package/changelog.d/20260727113000-relay-connect-timeout-destroy.md

@@ -0,0 +1 @@
+Relay connection and TLS-handshake timeouts now destroy their owned sockets and ignore late readiness events before reconnecting.

package/changelog.d/20260813093000-private-relay-hardening.md

@@ -0,0 +1 @@
+Socketduct now preserves structured relay errors, reports failed HTTP-agent connects correctly, emits secret-free relay health counters, and ships a Node 24 container that is loopback-published and privilege-hardened by default.

package/changelog.d/20260824183412-initial-target-recovery-https.md

@@ -0,0 +1 @@
+Socketduct now waits and retries for initial target readiness and provides a first-class HTTPS/mTLS agent without replaying established operations.

package/changelog.d/20260824230000-tls-relay-session-close.md

@@ -0,0 +1 @@
+Socketduct now completes intentional HTTP session closes through TLS relays without retaining detached relay sessions.

package/changelog.d/20260825120000-reconnect-close-target-timeout.md

@@ -0,0 +1 @@
+Socketduct now closes interrupted sessions promptly and retries silently hanging initial target connections without delivering data after stream EOF.

package/changelog.d/20260829120000-protocol-v3-multiplexing.md

@@ -0,0 +1 @@
+Socketduct protocol v3 adds many fair, resumable virtual TCP sockets over one authenticated physical transport while retaining protocol v2 for rollback.

package/changelog.d/20260829160000-v3-review-corrections.md

@@ -0,0 +1 @@
+Protocol v3 now safely acknowledges terminal closes, preserves unread replay across replacement recovery, expires abandoned spools, enforces configured pre-authentication input limits, and resumes in-flight stream opens without duplication.

package/changelog.d/20260830000000-fix-socket-idle-timeout.md

@@ -0,0 +1 @@
+Fixed socket idle timeouts firing after newer activity reset the timer.

package/changelog.d/20260830090000-multi-gateway-transport-set.md

@@ -0,0 +1 @@
+Add a process-scoped v3 transport set that warms explicit gateways, fairly pins new virtual sockets, exposes each socket's stable gateway ID for recovery, and enforces shared memory and durable-spool limits.

package/changelog.d/20260830093000-relay-close-settlement.md

@@ -0,0 +1 @@
+Fixed relay interruption recovery so queued frames settle before a dropped tunnel is reported closed.

package/changelog.d/20260830120000-immutable-gateway-image.md

@@ -0,0 +1 @@
+Production Docker gateways now require a digest-pinned Socketduct GHCR image and deploy through a selector-isolated, rendered-model-validated pull-only workflow.

package/changelog.d/20260902210000-native-reverse-gateway.md

@@ -0,0 +1 @@
+Socketduct now provides an authenticated TLS-and-zstd native reverse gateway for multiplexed access to deny-by-default private targets.

package/changelog.d/20260902230000-relay-resume-terminal-order.md

@@ -0,0 +1 @@
+Fix relay resume ordering so final target data is delivered before the target close without resetting wrapped TLS connections.

package/changelog.d/20260902230708-multiplexed-open-ownership.md

@@ -0,0 +1 @@
+Multiplexed streams now coordinate durable spool setup and connection ownership so slow or cancelled opens do not stall later connections.

package/changelog.d/20260902231541-multiplexed-terminal-close.md

@@ -0,0 +1 @@
+Multiplexed clients now suppress delayed acknowledgements after a relay CLOSE so later streams keep the shared connection.

package/changelog.d/20260902231542-reverse-close-position.md

@@ -0,0 +1 @@
+Reverse clients now close early-response streams at the transmitted request position without disrupting sibling streams.

package/changelog.d/20260902231543-reverse-terminal-connect.md

@@ -0,0 +1 @@
+Repeated reverse-client connection attempts now return the preserved authentication, selection, or TLS terminal error promptly.

package/changelog.d/20260902233000-reverse-gateway-bounds.md

@@ -0,0 +1 @@
+Reverse gateway streams now preserve DATA/END ordering, bound pre-TLS clients, and reclaim disconnected client identities safely.

package/changelog.d/20260903001000-reverse-data-ordering.md

@@ -0,0 +1 @@
+Reverse gateways now preserve target DATA before clean termination and respect configured decompression limits in both directions.

package/changelog.d/20260903003000-reverse-hub-restart-window.md

@@ -0,0 +1 @@
+Reverse peers now reconnect after graceful hub restarts and honor smaller advertised receive windows.

package/changelog.d/20260903010000-reverse-terminal-lifecycle.md

@@ -0,0 +1 @@
+Reverse gateway streams now preserve target data before terminal errors and release client capacity after terminal close.

package/changelog.d/20260904142743-transport-set-readiness-wait.md

@@ -0,0 +1 @@
+Multi-gateway socket factories now return bounded pending sockets while gateways start or reconnect, then assign each open fairly when an authenticated member is ready.

package/changelog.d/20260904152855-deferred-open-snapshots-binary-views.md

@@ -0,0 +1 @@
+Deferred multi-gateway sockets now snapshot open options and correctly buffer every Node.js TypedArray and DataView payload while awaiting readiness.

package/changelog.d/20260904163041-tensorbuzz-container-workflow.md

@@ -0,0 +1 @@
+TensorBuzz now exclusively owns repository verification and private-container build validation, with pull-request publication disabled.

package/changelog.d/20260904174955-transport-set-terminal-causes.md

@@ -0,0 +1 @@
+Post-readiness transport-set failure now preserves ordered member causes behind a stable error code and exposes only privacy-safe cause codes in status.

package/changelog.d/20260905081000-contain-reverse-auth-write-errors.md

@@ -0,0 +1 @@
+- Contain reverse-client authentication write races inside the reconnecting transport instead of terminating the host process with an unhandled rejection.

package/changelog.d/20260905100520-reverse-hub-close-race.md

@@ -0,0 +1 @@
+Reverse hub stream closure no longer disconnects sibling streams when flow-control messages arrive after a gateway-local close.

package/changelog.d/20260905120000-persistent-jsonl-logging.md

@@ -0,0 +1 @@
+Socketduct can now write bounded, privacy-safe JSONL lifecycle logs to per-process files in a configured persistent directory.

package/changelog.d/20260908071009-jsonl-partial-append-recovery.md

@@ -0,0 +1 @@
+Preserve incomplete JSONL log segments through bounded rotation and pause unsafe file writes without interrupting tunnel traffic.

package/changelog.d/20260908074916-private-log-directory-setup.md

@@ -0,0 +1 @@
+Correct the Docker log-directory setup command to create private mode-0700 directories accepted by the file logger.

package/changelog.d/20260909093057-reverse-large-write-backpressure.md

@@ -0,0 +1 @@
+Reverse gateway clients now backpressure large individual writes without exceeding configured stream or connection buffer limits.

package/changelog.d/20260909135830-actionable-error-diagnostics.md

@@ -0,0 +1 @@
+Socketduct JSONL diagnostics now retain error names, messages, and stacks for actionable transport and virtual-stream failure investigation.

package/changelog.d/20260909150000-transport-set-error-redaction.md

@@ -0,0 +1 @@
+Transport-set lifecycle diagnostics now redact arbitrary member error text while retaining normalized error classifications.

package/docker-compose.dev.yml

@@ -0,0 +1,19 @@
+services:
+  socketduct-dev:
+    build:
+      context: .
+      target: development
+    image: socketduct-dev:local
+    init: true
+    user: "1000:1000"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 256
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=256m
+    command:
+      - npm
+      - test

package/docker-compose.reverse-gateway.yml

@@ -0,0 +1,36 @@
+services:
+  socketduct-reverse-gateway:
+    image: ${SOCKETDUCT_IMAGE:?Set a digest-pinned Socketduct image}
+    restart: unless-stopped
+    init: true
+    user: "1000:1000"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 256
+    stop_grace_period: 45s
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=64m
+    env_file:
+      - .env
+    environment:
+      SOCKETDUCT_MODE: reverse-gateway
+      SOCKETDUCT_TARGET_ALLOWLIST: docker-server:2375
+    networks:
+      wan-egress:
+        gw_priority: 1
+      docker-control:
+        gw_priority: 0
+    volumes:
+      - ${SOCKETDUCT_REVERSE_CERT_DIR:-./certs}:/certs:ro
+      - ${SOCKETDUCT_LOG_HOST_DIRECTORY:-./logs}:/var/log/socketduct
+
+networks:
+  wan-egress:
+    name: ${SOCKETDUCT_WAN_NETWORK:?Set the preconfigured router-pinned Docker network}
+    external: true
+  docker-control:
+    name: ${SOCKETDUCT_DOCKER_CONTROL_NETWORK:?Set the private network shared with docker-server}
+    external: true