termdock 1.4.177 → 1.4.179

package/dist/server/agent/collaborationDeliveryWorker.js

@@ -0,0 +1,154 @@
+export class CollaborationDeliveryWorker {
+    options;
+    running = new Map();
+    states = new Map();
+    failures = new Map();
+    submitted = new Set();
+    timer = null;
+    ticking = null;
+    constructor(options) {
+        this.options = options;
+    }
+    start() {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => { void this.tick(); }, 2_000);
+        this.timer.unref?.();
+        void this.tick();
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+    }
+    state(id) {
+        const state = this.states.get(id);
+        return state && Date.now() - state.checkedAt < 15_000 ? state
+            : { state: 'recovering', reason: 'ROUTE_NOT_CHECKED', checkedAt: state?.checkedAt ?? null };
+    }
+    wake(id) {
+        void this.run(id).catch(this.options.onError);
+    }
+    tick() {
+        if (this.ticking)
+            return this.ticking;
+        this.ticking = this.tickOnce().finally(() => { this.ticking = null; });
+        return this.ticking;
+    }
+    async tickOnce() {
+        try {
+            const ids = [...new Set([...this.options.peers(), ...this.options.store.pendingRecipients()])].filter(this.options.isLocal);
+            // Bound process probes/attachments while keeping a broken peer from
+            // serially blocking the entire queue.
+            let cursor = 0;
+            await Promise.all(Array.from({ length: Math.min(4, ids.length) }, async () => {
+                while (cursor < ids.length)
+                    await this.run(ids[cursor++]).catch(this.options.onError);
+            }));
+        }
+        catch (error) {
+            this.options.onError(error);
+        }
+    }
+    run(id) {
+        const running = this.running.get(id);
+        if (running)
+            return running;
+        if (!this.options.isLocal(id))
+            return Promise.resolve();
+        const operation = Promise.resolve().then(() => this.deliver(id)).finally(() => {
+            if (this.running.get(id) === operation)
+                this.running.delete(id);
+        });
+        this.running.set(id, operation);
+        return operation;
+    }
+    reconfigure(id, configure) {
+        const previous = this.running.get(id) ?? Promise.resolve();
+        const operation = previous.catch(() => undefined).then(async () => {
+            await configure();
+            this.failures.delete(id);
+            this.states.delete(id);
+            for (const message of this.options.store.inbox(id, { pendingOnly: true, limit: 200 })) {
+                const diagnostic = this.options.store.diagnostic(message.id);
+                if (diagnostic)
+                    this.options.store.recordTransport(message.id, { ...diagnostic, next_retry_at: null, last_error: null });
+            }
+        }).finally(() => {
+            if (this.running.get(id) === operation)
+                this.running.delete(id);
+        });
+        this.running.set(id, operation);
+        return operation;
+    }
+    async deliver(id) {
+        const { store } = this.options;
+        const first = store.inbox(id, { pendingOnly: true, limit: 1 })[0];
+        if (!first && Date.now() - (this.states.get(id)?.checkedAt ?? 0) < 5_000)
+            return;
+        if (first && this.submitted.has(first.id)) {
+            this.complete(id, first);
+            return;
+        }
+        if (first && (store.diagnostic(first.id)?.next_retry_at ?? 0) > Date.now())
+            return;
+        this.states.set(id, { state: 'recovering', reason: null, checkedAt: Date.now() });
+        let route;
+        try {
+            route = await this.options.resolve(id);
+        }
+        catch (error) {
+            route = { state: 'unavailable', reason: `ROUTE_RECOVERY_FAILED: ${error instanceof Error ? error.message : String(error)}` };
+        }
+        this.states.set(id, { state: route.state, reason: route.reason ?? null, checkedAt: Date.now() });
+        // Re-read after asynchronous recovery: a consumer may have read the
+        // message, or its TTL may have elapsed while tmux was being inspected.
+        const pending = store.inbox(id, { pendingOnly: true, limit: 1 });
+        if (!pending.length)
+            return;
+        if (route.state !== 'ready' || !route.write) {
+            this.retry(id, pending, route.reason ?? route.state, false);
+            return;
+        }
+        const message = pending[0];
+        if (!this.submitted.has(message.id)) {
+            store.recordTransport(message.id, {
+                relay_online: null, peer_reachable: true,
+                attempt_count: (store.diagnostic(message.id)?.attempt_count ?? 0) + 1,
+                next_retry_at: Date.now() + 2_000, last_error: 'DELIVERY_IN_PROGRESS', checked_at: Date.now(),
+            });
+            try {
+                await route.write(pending);
+            }
+            catch (error) {
+                this.retry(id, pending, `TERMINAL_WRITE_FAILED: ${error instanceof Error ? error.message : String(error)}`, true);
+                return;
+            }
+            this.submitted.add(message.id);
+        }
+        // If persistence fails after writing, the in-process guard avoids a
+        // second write on retry. Across a crash, transport is at-least-once.
+        this.complete(id, message);
+    }
+    complete(id, message) {
+        const { store } = this.options;
+        store.markDelivered([message.id]);
+        this.submitted.delete(message.id);
+        store.recordTransport(message.id, {
+            relay_online: null, peer_reachable: true, attempt_count: store.diagnostic(message.id)?.attempt_count ?? 1,
+            next_retry_at: null, last_error: null, checked_at: Date.now(),
+        });
+        this.failures.delete(id);
+    }
+    retry(id, messages, reason, reachable) {
+        const failures = (this.failures.get(id) ?? 0) + 1;
+        this.failures.set(id, failures);
+        const next = Date.now() + Math.min(30_000, 2_000 * 2 ** Math.min(failures - 1, 4));
+        for (const message of messages)
+            this.options.store.recordTransport(message.id, {
+                relay_online: null, peer_reachable: reachable,
+                attempt_count: this.options.store.diagnostic(message.id)?.attempt_count ?? 0,
+                next_retry_at: next, last_error: reason, checked_at: Date.now(),
+            });
+    }
+}

package/dist/server/agent/collaborationRoutes.js

@@ -1,19 +1,28 @@
 import { Router } from 'express';
 import { COLLAB_LIMITS, CollaborationError, extrasFromBody } from './collaborationProtocol.js';
-export function collaborationRoutes({ store, resolveSession, deliver }) {
+export function collaborationRoutes({ store, resolveSession, deliver, rebind }) {
     const router = Router();
-    const run = (handler) => (req, res) => {
+    const run = (handler) => async (req, res) => {
         try {
             const sessionId = resolveSession((req.method === 'GET' ? req.query : req.body) ?? {});
             if (!sessionId)
                 throw new CollaborationError('SESSION_NOT_FOUND', 'Run inside a Termdock managed session', 404);
-            handler(req, res, sessionId);
+            await handler(req, res, sessionId);
         }
         catch (error) {
             res.status(error instanceof CollaborationError ? error.httpStatus : 400).json({ ok: false,
                 code: error instanceof CollaborationError ? error.code : 'COLLABORATION_ERROR', error: error instanceof Error ? error.message : String(error) });
         }
     };
+    router.post('/route/rebind', run(async (req, res, sessionId) => {
+        if (!rebind)
+            throw new CollaborationError('ROUTE_REBIND_UNAVAILABLE', 'Route rebinding is not available');
+        const pane = req.body.pane;
+        if (pane !== undefined && pane !== null && (typeof pane !== 'string' || !/^%\d+$/.test(pane))) {
+            throw new CollaborationError('INVALID_PANE', 'pane must be a tmux pane id such as %3');
+        }
+        res.json({ ok: true, route: await rebind(sessionId, pane ?? null) });
+    }));
     const ownMessage = (id, sessionId, recipientOnly = false) => {
         const message = store.getMessage(id);
         if (!message || (message.toSessionId !== sessionId && (recipientOnly || message.fromSessionId !== sessionId)))
@@ -27,11 +36,13 @@ export function collaborationRoutes({ store, resolveSession, deliver }) {
     };
     router.get('/capabilities', run((_req, res) => {
         res.json({ protocol_version: 2, limits: COLLAB_LIMITS,
+            routing: { background_recovery: true, explicit_rebind: Boolean(rebind), fixed_tmux_pane: true },
             statuses: ['pending', 'delivered', 'read', 'failed', 'expired'], queued_status: 'pending',
             semantics: { delivered: 'written to terminal; no application acknowledgement implied', read: 'explicit consumer acknowledgement',
                 ack: 'explicit response_kind=ack', result: 'explicit response_kind=result; inspect task.status and evidence',
                 done: 'adapter reports turn ended, never proof of task completion', heartbeat: 'null unless explicitly observed',
-                timeout: 'stops waiting, does not cancel delivery' } });
+                timeout: 'stops waiting, does not cancel delivery',
+                retry: 'same message id may be submitted again after a crash or uncertain transport result; consumers deduplicate by message id' } });
     }));
     router.post('/send', run((req, res, sessionId) => {
         const target = typeof req.body.targetSessionId === 'string' ? req.body.targetSessionId.trim() : '';

package/dist/server/agent/collaborationRouting.js

@@ -0,0 +1,94 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export class CollaborationRoutingStore {
+    file;
+    bindings = new Map();
+    loadError = null;
+    constructor(file) {
+        this.file = file;
+        try {
+            const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+            if (data.version !== 1 || !Array.isArray(data.bindings))
+                throw new Error('Invalid collaboration routing store');
+            for (const binding of data.bindings) {
+                if (!binding || typeof binding.sessionId !== 'string' || !['shell', 'tmux'].includes(binding.mode)
+                    || ![binding.backendSessionId, binding.tmuxSessionName, binding.agentSlug, binding.nativeSessionId].every((value) => value === null || typeof value === 'string')
+                    || (binding.pane !== null && (!binding.pane || !Number.isInteger(binding.pane.serverPid) || !Number.isInteger(binding.pane.panePid)
+                        || !/^%\d+$/.test(binding.pane.paneId) || !/^\$\d+$/.test(binding.pane.sessionId) || typeof binding.pane.agentSlug !== 'string'))) {
+                    throw new Error('Invalid collaboration binding');
+                }
+                this.bindings.set(binding.sessionId, binding);
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                this.bindings.clear();
+                this.loadError = error;
+            }
+        }
+    }
+    get(id) {
+        const binding = this.bindings.get(id);
+        return binding ? structuredClone(binding) : null;
+    }
+    assertReadable() {
+        if (this.loadError)
+            throw new Error('COLLABORATION_ROUTING_STORE_UNREADABLE', { cause: this.loadError });
+    }
+    ownerOfBackend(id) {
+        return [...this.bindings.values()].find((binding) => binding.backendSessionId === id)?.sessionId ?? null;
+    }
+    bind(binding) {
+        this.assertReadable();
+        const owner = binding.backendSessionId ? this.ownerOfBackend(binding.backendSessionId) : null;
+        if (owner && owner !== binding.sessionId)
+            throw new Error('BACKEND_ALREADY_BOUND');
+        if (JSON.stringify(this.bindings.get(binding.sessionId)) === JSON.stringify(binding))
+            return;
+        const next = new Map(this.bindings);
+        next.set(binding.sessionId, structuredClone(binding));
+        this.persist(next);
+    }
+    remove(id) {
+        if (!this.bindings.has(id))
+            return;
+        const next = new Map(this.bindings);
+        next.delete(id);
+        this.persist(next);
+    }
+    persist(next) {
+        this.assertReadable();
+        fs.mkdirSync(path.dirname(this.file), { recursive: true });
+        const temporary = `${this.file}.${process.pid}.tmp`;
+        fs.writeFileSync(temporary, JSON.stringify({ version: 1, bindings: [...next.values()] }), { mode: 0o600 });
+        fs.renameSync(temporary, this.file);
+        this.bindings = next;
+    }
+}
+// Once pinned, changing the active pane cannot change the recipient. A reused
+// tmux name/pane after a server restart must not inherit an old peer's inbox.
+export function selectCollaborationPane(binding, panes) {
+    if (binding.pane) {
+        const previous = binding.pane;
+        const pane = panes.find((candidate) => candidate.serverPid === previous.serverPid
+            && candidate.sessionId === previous.sessionId && candidate.paneId === previous.paneId && candidate.panePid === previous.panePid);
+        if (!pane)
+            return { state: 'identity-mismatch', reason: 'TMUX_PANE_CHANGED' };
+        if (!pane.agentSlug)
+            return { state: 'agent-exited', reason: 'AGENT_NOT_RUNNING' };
+        if (pane.agentSlug !== previous.agentSlug || (previous.nativeSessionId && pane.nativeSessionId && previous.nativeSessionId !== pane.nativeSessionId)) {
+            return { state: 'identity-mismatch', reason: 'AGENT_IDENTITY_CHANGED' };
+        }
+        return { state: 'ready', pane };
+    }
+    const candidates = panes.filter((pane) => pane.agentSlug && (!binding.agentSlug || binding.agentSlug === pane.agentSlug)
+        && (!binding.nativeSessionId || !pane.nativeSessionId || binding.nativeSessionId === pane.nativeSessionId));
+    const exact = binding.nativeSessionId ? candidates.filter((pane) => pane.nativeSessionId === binding.nativeSessionId) : [];
+    const matches = exact.length ? exact : candidates;
+    if (matches.length === 1)
+        return { state: 'ready', pane: matches[0] };
+    if (!matches.length && panes.some((pane) => pane.agentSlug))
+        return { state: 'identity-mismatch', reason: 'AGENT_IDENTITY_CHANGED' };
+    return matches.length > 1 ? { state: 'ambiguous', reason: 'MULTIPLE_AGENT_PANES' }
+        : { state: 'agent-exited', reason: 'AGENT_NOT_RUNNING_OR_IDENTITY_CHANGED' };
+}

package/dist/server/agent/collaborationStore.js

@@ -160,6 +160,10 @@ export class CollaborationStore {
         this.expire();
         return this.document.messages.filter((message) => message.toSessionId === sessionId && message.status === 'pending').length;
     }
+    pendingRecipients() {
+        this.expire();
+        return [...new Set(this.document.messages.filter((message) => message.status === 'pending').map((message) => message.toSessionId))];
+    }
     markDelivered(messageIds) {
         return this.updateStatus(messageIds, 'delivered');
     }
@@ -249,7 +253,8 @@ export class CollaborationStore {
     expire() {
         let changed = false;
         for (const message of this.document.messages)
-            if (message.status === 'pending' && message.expiresAt && message.expiresAt <= Date.now()) {
+            if (message.status === 'pending' && message.expiresAt && message.expiresAt <= Date.now()
+                && this.document.transport?.[message.id]?.last_error !== 'DELIVERY_IN_PROGRESS') {
                 message.status = 'expired';
                 message.failureReason = 'MESSAGE_EXPIRED';
                 changed = true;

package/dist/server/agent/collaborationTmuxDelivery.js

@@ -0,0 +1,10 @@
+import { buildBracketedSubmitBytes } from './promptDelivery.js';
+export async function writeCollaborationTmuxPane(run, pane, prompt) {
+    const identity = (await run(['display-message', '-p', '-t', pane.paneId,
+        '#{pid}:#{session_id}:#{pane_id}:#{pane_pid}'])).trim();
+    if (identity !== `${pane.serverPid}:${pane.sessionId}:${pane.paneId}:${pane.panePid}`)
+        throw new Error('TMUX_PANE_CHANGED');
+    // A fixed pane target is independent of the current window, keyboard focus
+    // and browser presence. One invocation preserves the bracketed submit bytes.
+    await run(['send-keys', '-t', pane.paneId, '-l', '--', buildBracketedSubmitBytes(prompt)]);
+}

package/dist/server/agent/sessionBindingRecovery.js

@@ -0,0 +1,59 @@
+export function resolveCollaborationBackend(record, records, backends, routing) {
+    routing.assertReadable();
+    const binding = routing.get(record.sessionId);
+    const target = binding ? { ...record, mode: binding.mode, tmuxSessionName: binding.tmuxSessionName,
+        backendSessionId: binding.backendSessionId,
+        agentResume: binding.agentSlug ? { slug: binding.agentSlug, sessionId: binding.nativeSessionId } : record.agentResume } : record;
+    const existing = target.backendSessionId ? backends.get(target.backendSessionId) : null;
+    const recovered = existing && existing.mode === target.mode && existing.tmuxSessionName === target.tmuxSessionName
+        ? [target.backendSessionId, existing]
+        : recoverSessionBinding({ ...target, backendSessionId: null }, records, backends, binding);
+    if (!recovered)
+        return null;
+    const [id, backend] = recovered;
+    if (backend.mode !== 'shell' && backend.mode !== 'tmux')
+        return null;
+    const owner = routing.ownerOfBackend(id);
+    if (owner && owner !== record.sessionId)
+        return null;
+    if (records.some((other) => other.sessionId !== record.sessionId && other.backendSessionId === id))
+        return null;
+    routing.bind({ sessionId: record.sessionId, backendSessionId: id, mode: backend.mode,
+        tmuxSessionName: backend.tmuxSessionName,
+        agentSlug: binding?.agentSlug ?? backend.agent?.slug ?? record.agentResume?.slug ?? null,
+        nativeSessionId: binding?.nativeSessionId ?? backend.agentSession?.sessionId ?? record.agentResume?.sessionId ?? null,
+        pane: binding?.pane ?? null });
+    return recovered;
+}
+// Match live runtime evidence, never the search index or a title/cwd heuristic.
+export function recoverSessionBinding(record, records, backends, binding) {
+    if (binding && binding.sessionId !== record.sessionId)
+        return null;
+    if (record.backendSessionId && backends.has(record.backendSessionId))
+        return null;
+    const nativeSessionId = binding?.nativeSessionId ?? record.agentResume?.sessionId;
+    const agentSlug = binding?.agentSlug ?? record.agentResume?.slug;
+    const candidates = [...backends].filter(([id, backend]) => {
+        if (records.some((other) => other.sessionId !== record.sessionId && other.backendSessionId === id))
+            return false;
+        if (backend.mode !== record.mode)
+            return false;
+        if (record.tmuxSessionName && backend.tmuxSessionName !== record.tmuxSessionName)
+            return false;
+        const nativeId = backend.agentSession?.sessionId;
+        const slug = backend.agent?.slug;
+        if (agentSlug && slug && agentSlug !== slug)
+            return false;
+        if (nativeSessionId && nativeId && nativeSessionId !== nativeId)
+            return false;
+        if (record.agentResume && slug && record.agentResume.slug !== slug)
+            return false;
+        if (record.agentResume?.sessionId && nativeId && record.agentResume.sessionId !== nativeId)
+            return false;
+        const tmuxMatch = record.mode === 'tmux' && Boolean(record.tmuxSessionName)
+            && backend.tmuxSessionName === record.tmuxSessionName;
+        const nativeMatch = Boolean(nativeId) && nativeSessionId === nativeId && agentSlug === slug;
+        return tmuxMatch || nativeMatch;
+    });
+    return candidates.length === 1 ? candidates[0] : null;
+}

package/dist/server/entry.js

@@ -1,3 +1,4 @@
+import { desktopDirectTargets } from './federation/desktopTargets.js';
 import { createOpenAccessRouter } from './federation/openAccess.js';
 import { createPasswordLoginRouter } from './federation/passwordLoginRoutes.js';
 import { apiAccessGate, isTrustedLocalRequest } from './utils/apiAccess.js';
@@ -404,26 +405,42 @@ export function startServer(options = {}) {
     const { server, scheme } = createServerForApp(app, options);
     let entrySubjectAllowed = (_subjectId) => false;
     let routeInvitations;
-    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true);
+    let federationServiceId = '';
+    const desktopTargets = () => desktopDirectTargets(path.join(homedir(), '.termdock', 'desktop.json'), federationServiceId);
+    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true, desktopTargets);
     const relayRouter = new RelayRouter({
         authenticate: context => context,
         allowRegister: (principal, serviceId) => routeAccess.allowRegister(principal, serviceId),
         allowRoute: (principal, serviceId) => routeAccess.allowRoute(principal, serviceId),
     });
     const dynamicDirectTargets = new Map();
-    server.once('close', () => { for (const close of dynamicDirectTargets.values())
-        close(); });
-    try {
-        const detachDirectTargets = attachRegisteredDirectTargets(relayRouter, routeAccess.configuredDirectTargets(), path.join(homedir(), '.termdock', 'federation'));
-        server.once('close', detachDirectTargets);
-    }
-    catch {
-        console.error('Configured direct routes unavailable; target access remains closed.');
-    }
+    const refreshDirectTargets = () => {
+        const desired = new Map(routeAccess.configuredDirectTargets().filter(target => target.serviceId !== federationServiceId).map(target => [target.serviceId, target]));
+        for (const [id, registered] of dynamicDirectTargets) {
+            const target = desired.get(id);
+            if (!target || registered.signature !== JSON.stringify([target.url, target.caPath, target.caFingerprint256])) {
+                registered.close();
+                dynamicDirectTargets.delete(id);
+            }
+        }
+        for (const [id, target] of desired)
+            if (!dynamicDirectTargets.has(id)) {
+                try {
+                    dynamicDirectTargets.set(id, { signature: JSON.stringify([target.url, target.caPath, target.caFingerprint256]), close: attachRegisteredDirectTargets(relayRouter, [target], path.join(homedir(), '.termdock', 'federation')) });
+                }
+                catch { /* A malformed or unavailable local route remains unusable. */ }
+            }
+    };
+    refreshDirectTargets();
+    const desktopRoutesTimer = setInterval(refreshDirectTargets, 2000);
+    desktopRoutesTimer.unref();
+    server.once('close', () => { clearInterval(desktopRoutesTimer); for (const target of dynamicDirectTargets.values())
+        target.close(); });
     server.once('close', () => relayRouter.close());
     const federation = createFederationRuntime(app, path.join(homedir(), '.termdock', 'federation'), {
         terminal: handleTerminalWebSocket, control: handleControlWebSocket,
     }, {
+        listRouteTargets: () => { refreshDirectTargets(); return routeAccess.configuredTargets().map(target => ({ ...target, available: relayRouter.hasRoute(target.serviceId) })); },
         listRouteAccess: () => routeInvitations?.list() || [],
         grantRouteAccess: async (issuerId, targetServiceId, subjectId, url) => {
             if (!routeInvitations)
@@ -437,8 +454,7 @@ export function startServer(options = {}) {
                 if (!runtime.store.authorize({ subjectId: issuerId, serviceId: runtime.serviceId, action: 'authorization.manage' }).allowed)
                     throw new Error('AUTHORIZATION_DENIED');
                 routeAccess.addDirectTarget(target);
-                if (!dynamicDirectTargets.has(targetServiceId))
-                    dynamicDirectTargets.set(targetServiceId, attachRegisteredDirectTargets(relayRouter, [target]));
+                refreshDirectTargets();
             }
             return routeInvitations.grant(issuerId, targetServiceId, subjectId);
         },
@@ -457,6 +473,8 @@ export function startServer(options = {}) {
         },
     });
     void federation.then(runtime => {
+        federationServiceId = runtime.serviceId;
+        refreshDirectTargets();
         app.locals.passwordRuntime = runtime;
         entrySubjectAllowed = subjectId => runtime.store.authorize({ subjectId, serviceId: runtime.serviceId, action: 'authorization.manage' }).allowed;
         routeInvitations = new RouteInvitationStore({
@@ -552,8 +570,9 @@ export function startServer(options = {}) {
         }
         const pathname = url.pathname;
         if (pathname === '/api/federation/relay') {
-            // Native relay peers have no Origin. Authenticate explicitly before upgrade.
-            if (scheme !== 'https' || (request.headers.origin && !isUpgradeOriginAllowed(request.headers.origin, request.headers.host))) {
+            // A paired device can use B from another HTTPS PWA origin. This channel
+            // ignores cookies: the single-use target-scoped ticket below is mandatory.
+            if (scheme !== 'https' || !secureChannelOriginAllowed(request.headers.origin, () => isUpgradeOriginAllowed(request.headers.origin, request.headers.host))) {
                 socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
                 return;
             }

package/dist/server/federation/desktopTargets.js

@@ -0,0 +1,64 @@
+import { readFileSync, statSync } from 'node:fs';
+const peer = (value) => typeof value === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(value);
+const fingerprint = (value) => typeof value === 'string' && /^(?:[\da-f]{2}:){31}[\da-f]{2}$/i.test(value);
+function origin(value) {
+    if (typeof value !== 'string' || value.length > 2048)
+        return;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/')
+            return;
+        return url.origin;
+    }
+    catch {
+        return;
+    }
+}
+/** Read only this OS user's Desktop directory. The local service must itself
+ * have been pinned there before its administrator can discover other entries.
+ * This supplies addresses, never the Desktop client's device authorization.
+ */
+export function desktopDirectTargets(file, localServiceId) {
+    if (!localServiceId)
+        return [];
+    try {
+        if (statSync(file).size > 1024 * 1024)
+            return [];
+        const data = JSON.parse(readFileSync(file, 'utf8'));
+        if (data?.version !== 1 || !Array.isArray(data.connections) || data.connections.length > 256)
+            return [];
+        const removed = new Set(Array.isArray(data.removedServiceKeys) ? data.removedServiceKeys : []);
+        const connections = data.connections.filter((item) => item && ![item.id, item.targetPeerId, item.serviceOrigin || item.url].some(key => removed.has(key)));
+        if (!connections.some((item) => item.targetPeerId === localServiceId))
+            return [];
+        const trusts = new Map();
+        if (Array.isArray(data.trustedCertificateAuthorities))
+            for (const trust of data.trustedCertificateAuthorities.slice(0, 256)) {
+                const url = origin(trust?.origin);
+                if (url && fingerprint(trust.fingerprint256))
+                    trusts.set(url, trust.fingerprint256.toUpperCase());
+            }
+        const targets = new Map();
+        for (const item of connections) {
+            if (!peer(item.targetPeerId) || item.targetPeerId === localServiceId)
+                continue;
+            const url = origin(item.serviceOrigin || item.url);
+            if (!url)
+                continue;
+            // An entry-only bookmark does not supply a direct address for its target.
+            if ((!item.serviceOrigin && item.entryServiceId && item.entryServiceId !== item.targetPeerId)
+                || (Array.isArray(item.routes) && item.routes.some((route) => route && route.targetPeerId !== item.targetPeerId && origin(route.url) === url)))
+                continue;
+            const caFingerprint256 = trusts.get(url);
+            targets.set(item.targetPeerId, { serviceId: item.targetPeerId, url,
+                ...(typeof item.label === 'string' && item.label.trim() ? { label: item.label.trim().slice(0, 120) } : {}),
+                ...(caFingerprint256 ? { caFingerprint256 } : {}) });
+            if (targets.size >= 64)
+                break;
+        }
+        return [...targets.values()];
+    }
+    catch {
+        return [];
+    }
+}

package/dist/server/federation/directRoutes.js

@@ -1,11 +1,14 @@
+import { readPinnedCertificateAuthority } from './trustedCa.js';
 import { createIdentity, secureConnection } from './secureProtocol.js';
 import { socketDuplex } from './socketDuplex.js';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import WebSocket from 'ws';
 function endpoint(config) {
-    if (!config || typeof config !== 'object' || Object.keys(config).some(key => !['serviceId', 'url', 'caPath'].includes(key)) || !/^[a-zA-Z0-9_.:-]{1,160}$/.test(config.serviceId) || typeof config.url !== 'string' || (config.caPath !== undefined && typeof config.caPath !== 'string'))
+    if (!config || typeof config !== 'object' || Object.keys(config).some(key => !['serviceId', 'url', 'caPath', 'caFingerprint256', 'label'].includes(key)) || !/^[a-zA-Z0-9_.:-]{1,160}$/.test(config.serviceId) || typeof config.url !== 'string' || (config.caPath !== undefined && typeof config.caPath !== 'string'))
         throw new Error('Invalid direct target configuration');
+    if ((config.caFingerprint256 !== undefined && (typeof config.caFingerprint256 !== 'string' || !/^(?:[\da-f]{2}:){31}[\da-f]{2}$/i.test(config.caFingerprint256))) || (config.caPath && config.caFingerprint256) || (config.label !== undefined && (typeof config.label !== 'string' || config.label.length > 120)))
+        throw new Error('Invalid direct target metadata');
     const url = new URL(config.url);
     if (!['https:', 'wss:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || !['/', '/api/federation/secure'].includes(url.pathname))
         throw new Error('Direct targets require a verified HTTPS/WSS origin');
@@ -24,7 +27,7 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
         if (ids.has(config.serviceId))
             throw new Error('Duplicate direct target');
         ids.add(config.serviceId);
-        return { serviceId: config.serviceId, url, ca: config.caPath ? readFileSync(resolve(baseDir, config.caPath)) : undefined };
+        return { serviceId: config.serviceId, url, caFingerprint256: config.caFingerprint256, ca: config.caPath ? readFileSync(resolve(baseDir, config.caPath)) : undefined };
     });
     let stopped = false;
     const sockets = new Set();
@@ -34,22 +37,25 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
         ws.terminate(); };
     try {
         for (const target of targets)
-            cleanups.push(router.registerDirect(target.serviceId, () => new Promise((accept, reject) => {
-                if (stopped) {
-                    reject(new Error('Direct target stopped'));
-                    return;
-                }
-                const ws = new WebSocket(target.url, { ca: target.ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 10000, maxPayload: 256 * 1024 });
-                sockets.add(ws);
-                ws.once('close', () => sockets.delete(ws));
-                const failed = () => { reject(new Error('Direct target unavailable')); ws.terminate(); };
-                ws.once('error', failed);
-                ws.once('close', failed);
-                ws.once('open', () => { ws.off('error', failed); ws.off('close', failed); ws.on('error', () => ws.terminate()); if (stopped)
-                    failed();
-                else
-                    accept(ws); });
-            })));
+            cleanups.push(router.registerDirect(target.serviceId, async () => {
+                const ca = target.caFingerprint256 ? await readPinnedCertificateAuthority(target.url.replace(/^wss:/, 'https:'), target.caFingerprint256) : target.ca;
+                return new Promise((accept, reject) => {
+                    if (stopped) {
+                        reject(new Error('Direct target stopped'));
+                        return;
+                    }
+                    const ws = new WebSocket(target.url, { ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 10000, maxPayload: 256 * 1024 });
+                    sockets.add(ws);
+                    ws.once('close', () => sockets.delete(ws));
+                    const failed = () => { reject(new Error('Direct target unavailable')); ws.terminate(); };
+                    ws.once('error', failed);
+                    ws.once('close', failed);
+                    ws.once('open', () => { ws.off('error', failed); ws.off('close', failed); ws.on('error', () => ws.terminate()); if (stopped)
+                        failed();
+                    else
+                        accept(ws); });
+                });
+            }));
     }
     catch (error) {
         cleanup();
@@ -60,7 +66,9 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
 /** An administrator enabling a new backup first proves the target's pinned
  * identity; HTTPS validation remains enabled throughout. */
 export async function verifyDirectTarget(config) {
-    const ws = new WebSocket(endpoint(config), { rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 5000, maxPayload: 256 * 1024 });
+    const url = endpoint(config);
+    const ca = config.caFingerprint256 ? await readPinnedCertificateAuthority(url.replace(/^wss:/, 'https:'), config.caFingerprint256) : config.caPath ? readFileSync(config.caPath) : undefined;
+    const ws = new WebSocket(url, { ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 5000, maxPayload: 256 * 1024 });
     const duplex = socketDuplex(ws);
     try {
         await new Promise((resolve, reject) => { ws.once('open', resolve); ws.once('error', reject); ws.once('close', () => reject(new Error('Target closed'))); });