termdock 1.4.239 → 1.4.240

package/dist/server/certificateWatcher.js

@@ -1,38 +1,12 @@
 import { EventEmitter } from 'events';
-import { execFile } from 'child_process';
-import { promisify } from 'util';
+import { getMissingCertificateNames } from './utils/certificateNames.js';
 import { getLocalAccessSetting } from './utils/settings.js';
 import { getLanIPv4Addresses } from './utils/localAccess.js';
-const execFileAsync = promisify(execFile);
 const CHECK_INTERVAL_MS = 15_000;
 const RETRY_INTERVAL_MS = 60_000;
 function fileExists(filePath) {
     return typeof filePath === 'string' && filePath.length > 0;
 }
-async function readCertificateSans(certPath) {
-    try {
-        const { stdout } = await execFileAsync('openssl', ['x509', '-in', certPath, '-noout', '-ext', 'subjectAltName'], {
-            timeout: 5000,
-            maxBuffer: 256 * 1024,
-        });
-        return stdout
-            .split(/[\n,]/)
-            .map((part) => part.trim())
-            .filter(Boolean);
-    }
-    catch {
-        return [];
-    }
-}
-function sanMatches(required, sans) {
-    if (required === '::1') {
-        return sans.some((san) => san === 'IP Address:::1' || san === 'IP Address:0:0:0:0:0:0:0:1' || san === 'IP:::1');
-    }
-    if (/^\d+\.\d+\.\d+\.\d+$/.test(required) || required.includes(':')) {
-        return sans.some((san) => san === `IP Address:${required}` || san === `IP:${required}`);
-    }
-    return sans.some((san) => san === `DNS:${required}`);
-}
 function requiredNames() {
     const localName = getLocalAccessSetting().name;
     return [
@@ -85,8 +59,7 @@ export class CertificateWatcher extends EventEmitter {
             return;
         this.checking = true;
         try {
-            const sans = await readCertificateSans(this.options.certPath);
-            const missing = requiredNames().filter((name) => !sanMatches(name, sans));
+            const missing = await getMissingCertificateNames(this.options.certPath, requiredNames());
             if (missing.length === 0) {
                 this.refreshInFlight = false;
                 this.pendingKey = null;
@@ -104,6 +77,11 @@ export class CertificateWatcher extends EventEmitter {
             console.log(`[cert-watch] certificate missing SANs (${missing.join(', ')}); regenerating and reloading TLS context`);
             this.emit('refresh-needed', missing);
         }
+        catch (error) {
+            // An unreadable certificate is not evidence of missing SANs. Keep the
+            // active TLS context instead of repeatedly regenerating the certificate.
+            console.warn('[cert-watch] could not inspect certificate; keeping current TLS context:', error);
+        }
         finally {
             this.checking = false;
         }

package/dist/server/cli.js

@@ -20,6 +20,7 @@ import { detectLocalSessionContext, resolveLocalCollaborationContext } from './a
 import { parseAutomationCommand, executeAutomationCommand, AUTOMATION_HELP } from './agent/automationCli.js';
 import { parseCollaborationCommand, executeCollaborationCommand, COLLAB_HELP } from './agent/collaborationCli.js';
 import fs from 'fs';
+import { getMissingCertificateNames } from './utils/certificateNames.js';
 import http from 'http';
 import https from 'https';
 import path from 'path';
@@ -417,50 +418,10 @@ function getRequiredLocalHttpsNames() {
         '::1',
     ];
 }
-async function readCertificateSans(certPath) {
-    try {
-        const { stdout } = await execFileAsync('openssl', ['x509', '-in', certPath, '-noout', '-ext', 'subjectAltName'], {
-            timeout: 5000,
-            maxBuffer: 256 * 1024,
-        });
-        return stdout
-            .split(/[\n,]/)
-            .map((part) => part.trim())
-            .filter(Boolean);
-    }
-    catch {
-        return [];
-    }
-}
-function sanMatches(required, sans) {
-    if (/^\d+\.\d+\.\d+\.\d+$/.test(required)) {
-        return sans.some((san) => san === `IP Address:${required}` || san === `IP:${required}`);
-    }
-    if (required.includes(':')) {
-        const normalizeIpv6 = (value) => {
-            const [left = '', right = ''] = value.toLowerCase().split('::');
-            const leftGroups = left ? left.split(':') : [];
-            const rightGroups = right ? right.split(':') : [];
-            const missing = Math.max(0, 8 - leftGroups.length - rightGroups.length);
-            return [...leftGroups, ...Array(missing).fill('0'), ...rightGroups]
-                .map((group) => Number.parseInt(group || '0', 16).toString(16))
-                .join(':');
-        };
-        const normalizedRequired = normalizeIpv6(required);
-        return sans.some((san) => {
-            const match = /^(?:IP Address|IP):(.+)$/.exec(san);
-            return match ? normalizeIpv6(match[1]) === normalizedRequired : false;
-        });
-    }
-    return sans.some((san) => san === `DNS:${required}`);
-}
 async function defaultCertificateNeedsRefresh() {
     if (!fileExists(defaultHttpsCertPath) || !fileExists(defaultHttpsKeyPath))
         return true;
-    const sans = await readCertificateSans(defaultHttpsCertPath);
-    if (sans.length === 0)
-        return true;
-    return getRequiredLocalHttpsNames().some((name) => !sanMatches(name, sans));
+    return (await getMissingCertificateNames(defaultHttpsCertPath, getRequiredLocalHttpsNames())).length > 0;
 }
 async function ensureDefaultHttpsCertificateFresh() {
     if (!(await defaultCertificateNeedsRefresh()))

package/dist/server/utils/certificateNames.js

@@ -0,0 +1,12 @@
+import { X509Certificate } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { isIP } from 'node:net';
+// Use Node's certificate parser: the system openssl (notably LibreSSL on
+// macOS) may not support `x509 -ext`. Propagate read/parse errors so callers
+// cannot mistake an inspection failure for an empty SAN extension.
+export async function getMissingCertificateNames(certPath, required) {
+    const cert = new X509Certificate(await readFile(certPath));
+    return required.filter((name) => isIP(name)
+        ? cert.checkIP(name) === undefined
+        : cert.checkHost(name, { subject: 'never', wildcards: false }) === undefined);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.239",
+  "version": "1.4.240",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.239",
+  "version": "1.4.240",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-K4KyYJuVoQDpZsBM8ZX1Rw3MddOxAzVdp/cPm0iGZz0=",
-  "serverBundleHash": "sha256-b2hW5XzG58ErGFDet7CETfl7sHtPoDhHjTnL3mzU63s=",
+  "serverBundleHash": "sha256-OjLwoxfVNp7VlqCwrjCUGgjj0Yb3zlTm1sdlQGCGYIs=",
   "clientBundleHash": "sha256-1wPbozETRlatzFMaBkX5wcha5zbSwUdAw4I0XckzdLk=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"