termdock 1.4.239 → 1.4.241

package/dist/server/cli.js

@@ -20,6 +20,7 @@ import { detectLocalSessionContext, resolveLocalCollaborationContext } from './a
 import { parseAutomationCommand, executeAutomationCommand, AUTOMATION_HELP } from './agent/automationCli.js';
 import { parseCollaborationCommand, executeCollaborationCommand, COLLAB_HELP } from './agent/collaborationCli.js';
 import fs from 'fs';
+import { getMissingCertificateNames } from './utils/certificateNames.js';
 import http from 'http';
 import https from 'https';
 import path from 'path';
@@ -323,19 +324,6 @@ function getOrCreateLocalApiToken() {
     fs.writeFileSync(localApiTokenPath, `${token}\n`, { mode: 0o600 });
     return token;
 }
-function buildServerState(params) {
-    return {
-        pid: params.pid,
-        host: params.host,
-        port: params.port,
-        scheme: params.scheme,
-        localUrl: `${params.scheme}://${params.host === '0.0.0.0' ? 'localhost' : params.host}:${params.port}`,
-        localAccessReason: params.localAccessReason,
-        logFile: logFilePath,
-        startedAt: new Date().toISOString(),
-        localApiToken: params.localApiToken,
-    };
-}
 function fileExists(filePath) {
     return typeof filePath === 'string' && filePath.length > 0 && fs.existsSync(filePath);
 }
@@ -417,50 +405,10 @@ function getRequiredLocalHttpsNames() {
         '::1',
     ];
 }
-async function readCertificateSans(certPath) {
-    try {
-        const { stdout } = await execFileAsync('openssl', ['x509', '-in', certPath, '-noout', '-ext', 'subjectAltName'], {
-            timeout: 5000,
-            maxBuffer: 256 * 1024,
-        });
-        return stdout
-            .split(/[\n,]/)
-            .map((part) => part.trim())
-            .filter(Boolean);
-    }
-    catch {
-        return [];
-    }
-}
-function sanMatches(required, sans) {
-    if (/^\d+\.\d+\.\d+\.\d+$/.test(required)) {
-        return sans.some((san) => san === `IP Address:${required}` || san === `IP:${required}`);
-    }
-    if (required.includes(':')) {
-        const normalizeIpv6 = (value) => {
-            const [left = '', right = ''] = value.toLowerCase().split('::');
-            const leftGroups = left ? left.split(':') : [];
-            const rightGroups = right ? right.split(':') : [];
-            const missing = Math.max(0, 8 - leftGroups.length - rightGroups.length);
-            return [...leftGroups, ...Array(missing).fill('0'), ...rightGroups]
-                .map((group) => Number.parseInt(group || '0', 16).toString(16))
-                .join(':');
-        };
-        const normalizedRequired = normalizeIpv6(required);
-        return sans.some((san) => {
-            const match = /^(?:IP Address|IP):(.+)$/.exec(san);
-            return match ? normalizeIpv6(match[1]) === normalizedRequired : false;
-        });
-    }
-    return sans.some((san) => san === `DNS:${required}`);
-}
 async function defaultCertificateNeedsRefresh() {
     if (!fileExists(defaultHttpsCertPath) || !fileExists(defaultHttpsKeyPath))
         return true;
-    const sans = await readCertificateSans(defaultHttpsCertPath);
-    if (sans.length === 0)
-        return true;
-    return getRequiredLocalHttpsNames().some((name) => !sanMatches(name, sans));
+    return (await getMissingCertificateNames(defaultHttpsCertPath, getRequiredLocalHttpsNames())).length > 0;
 }
 async function ensureDefaultHttpsCertificateFresh() {
     if (!(await defaultCertificateNeedsRefresh()))
@@ -1443,12 +1391,19 @@ const STOP_GRACE_MS = 5000;
 /** Max time to wait for the daemon child to respond to /health after spawn. */
 const DAEMON_START_TIMEOUT_MS = 10000;
 /** Poll the health endpoint until it responds or timeout expires. */
-async function waitForHealth(healthUrl, caPath, timeoutMs) {
+async function waitForHealth(healthUrl, caPath, timeoutMs, isReady, isAlive) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
+        if (!isAlive())
+            return false;
+        if (!isReady()) {
+            await new Promise((resolve) => setTimeout(resolve, 100));
+            continue;
+        }
         try {
             const ok = await new Promise((resolve) => {
-                const req = https.get(healthUrl, {
+                const transport = healthUrl.startsWith('https:') ? https : http;
+                const req = transport.get(healthUrl, {
                     ca: caPath ? fs.readFileSync(caPath) : undefined,
                     rejectUnauthorized: Boolean(caPath),
                     timeout: 2000,
@@ -1460,7 +1415,7 @@ async function waitForHealth(healthUrl, caPath, timeoutMs) {
                 req.on('error', () => resolve(false));
                 req.on('timeout', () => { req.destroy(); resolve(false); });
             });
-            if (ok)
+            if (ok && isAlive())
                 return true;
         }
         catch {
@@ -3473,10 +3428,6 @@ async function main() {
         await runPluginRemove(options.pluginRemove);
         process.exit(0);
     }
-    const localApiToken = getOrCreateLocalApiToken();
-    await refreshDefaultHttpsCertificateSafely();
-    const https = resolveHttpsOptions(options);
-    const isManagedDefaultHttps = Boolean(https.cert === defaultHttpsCertPath && https.key === defaultHttpsKeyPath);
     if (options.status) {
         const runningState = getRunningState();
         if (!runningState) {
@@ -3513,6 +3464,10 @@ async function main() {
         }
         process.exit(0);
     }
+    const localApiToken = getOrCreateLocalApiToken();
+    await refreshDefaultHttpsCertificateSafely();
+    const https = resolveHttpsOptions(options);
+    const isManagedDefaultHttps = Boolean(https.cert === defaultHttpsCertPath && https.key === defaultHttpsKeyPath);
     if (options.foreground) {
         // Boot check (marker prevents re-run if parent already completed)
         runBootChecks();
@@ -3582,6 +3537,20 @@ async function main() {
             startedAt: new Date().toISOString(),
             localApiToken,
         });
+        // Only this child can acknowledge startup; an existing listener on the
+        // same port must not make the parent report a successful launch.
+        const acknowledgeStartup = () => {
+            if (process.connected) {
+                process.send?.({ type: 'termdock-ready' }, () => {
+                    if (process.connected)
+                        process.disconnect();
+                });
+            }
+        };
+        if (result.server.listening)
+            acknowledgeStartup();
+        else
+            result.server.once('listening', acknowledgeStartup);
         return;
     }
     const runningState = getRunningState();
@@ -3622,24 +3591,40 @@ async function main() {
         childArgs.push('--https-ca', activeHttps.ca);
     }
     const scheme = activeHttps.cert && activeHttps.key ? 'https' : 'http';
-    const localAccessReason = activeHttps.source === 'default'
-        ? 'Using local HTTPS certificates from ~/.termdock/certs.'
-        : null;
     const logFileFd = fs.openSync(logFilePath, 'a');
     const child = spawn(process.execPath, childArgs, {
         detached: true,
-        stdio: ['ignore', logFileFd, logFileFd],
+        stdio: ['ignore', logFileFd, logFileFd, 'ipc'],
     });
     fs.closeSync(logFileFd);
+    let ready = false;
+    let startupError;
+    child.on('error', (error) => { startupError = error; });
+    child.on('message', (message) => {
+        if (message && typeof message === 'object' && 'type' in message
+            && message.type === 'termdock-ready')
+            ready = true;
+    });
+    const isAlive = () => !startupError && child.pid !== undefined
+        && child.exitCode === null && child.signalCode === null && isProcessRunning(child.pid);
+    const displayHost = childHost === '0.0.0.0' ? 'localhost' : childHost;
+    const healthOk = await waitForHealth(`${scheme}://${displayHost}:${childPort}/health`, activeHttps.ca, DAEMON_START_TIMEOUT_MS, () => ready, isAlive);
+    if (child.connected)
+        child.disconnect();
     child.unref();
-    writeState(buildServerState({
-        pid: child.pid,
-        host: childHost,
-        port: childPort,
-        scheme,
-        localAccessReason,
-        localApiToken,
-    }));
+    if (!healthOk) {
+        const alive = isAlive();
+        if (!alive && child.pid !== undefined && readState()?.pid === child.pid)
+            removeStateFile();
+        const detail = startupError?.message ?? (alive
+            ? 'Startup timed out; the process is still running but readiness could not be confirmed.'
+            : `Background process exited (code: ${child.exitCode ?? 'unknown'}, signal: ${child.signalCode ?? 'none'}).`);
+        console.error(`${ICON.err} ${c.red('Termdock startup could not be confirmed.')} ${detail}`);
+        console.error(`  ${c.dim('Log:')} ${logFilePath}`);
+        console.error(`  Read the startup error with: tail -n 80 ${shellQuote(logFilePath)}`);
+        process.exitCode = 1;
+        return;
+    }
     console.log(`${ICON.ok} ${c.green('Termdock started in background.')}`);
     console.log(`  ${c.dim('URL:')} ${c.cyan(`${scheme}://${childHost === '0.0.0.0' ? 'localhost' : childHost}:${childPort}`)}`);
     if (scheme === 'https') {
@@ -3651,16 +3636,6 @@ async function main() {
     console.log(`  ${c.dim('PID:')} ${child.pid}`);
     console.log(`  ${c.dim('Log:')} ${logFilePath}`);
     warnIfAuthDisabled(childHost);
-    // Wait for the daemon child to become healthy before returning — a
-    // subsequent deploy step that curls the server won't race startup.
-    {
-        const displayHost = childHost === '0.0.0.0' ? 'localhost' : childHost;
-        const healthUrl = `${scheme}://${displayHost}:${childPort}/health`;
-        const healthOk = await waitForHealth(healthUrl, activeHttps.ca, DAEMON_START_TIMEOUT_MS);
-        if (!healthOk) {
-            console.log(`${ICON.warn} ${c.yellow('Server started but health check did not respond in time — it may still be initializing.')}`);
-        }
-    }
     process.exit(0);
 }
 main().catch((err) => {

package/dist/server/entry.js

@@ -14,6 +14,7 @@ import { RouteInvitationStore } from './federation/routeInvitations.js';
 import { attachRegisteredDirectTargets, verifyDirectTarget } from './federation/directRoutes.js';
 import { secureChannelOriginAllowed } from './federation/originPolicy.js';
 import { RelayRouter } from './federation/relay.js';
+import { DesktopSelfRelay } from './federation/selfRelay.js';
 import { assertPublicSecurity, securityHeaders } from './utils/publicSecurity.js';
 import { apiCachePolicy } from './utils/apiCachePolicy.js';
 import 'dotenv/config';
@@ -415,13 +416,15 @@ export function startServer(options = {}) {
     let entrySubjectAllowed = (_subjectId) => false;
     let routeInvitations;
     let federationServiceId = '';
+    let activeRouteIds = () => [];
     const desktopTargets = () => desktopDirectTargets(path.join(homedir(), '.termdock', 'desktop.json'), federationServiceId);
-    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true || collaborationTransport?.canRoute(subjectId, targetServiceId) === true, desktopTargets);
+    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true || collaborationTransport?.canRoute(subjectId, targetServiceId) === true, desktopTargets, () => activeRouteIds());
     const relayRouter = new RelayRouter({
         authenticate: context => context,
         allowRegister: (principal, serviceId) => routeAccess.allowRegister(principal, serviceId),
         allowRoute: (principal, serviceId) => routeAccess.allowRoute(principal, serviceId),
     });
+    activeRouteIds = () => relayRouter.activeRouteIds();
     const dynamicDirectTargets = new Map();
     const refreshDirectTargets = () => {
         const desired = new Map(routeAccess.configuredDirectTargets().filter(target => target.serviceId !== federationServiceId).map(target => [target.serviceId, target]));
@@ -493,6 +496,7 @@ export function startServer(options = {}) {
         },
         revokeRouteAccess: id => routeInvitations?.revoke(id) || false,
         issueRouteTicket: (subjectId, serviceId) => routeAccess.issueRouteTicket(subjectId, serviceId),
+        issueSelfRelayTicket: (serviceId) => routeAccess.issueSelfRelayTicket(serviceId),
         hasRouteGrant: (subjectId, serviceId) => routeInvitations?.allows(subjectId, serviceId) === true || collaborationTransport?.canRoute(subjectId, serviceId) === true,
         createRouteInvitation: (issuerId, serviceId) => {
             if (!routeInvitations)
@@ -567,6 +571,20 @@ export function startServer(options = {}) {
             issuerAllowed: subjectId => entrySubjectAllowed(subjectId),
             targetAvailable: serviceId => routeAccess.hasConfiguredTarget(serviceId) && relayRouter.hasRoute(serviceId),
         });
+        let localCa;
+        if (scheme === 'https' && options.httpsCaPath)
+            try {
+                localCa = fs.readFileSync(options.httpsCaPath);
+            }
+            catch { /* System trust may still validate the local certificate. */ }
+        const localHostname = ['0.0.0.0', '::'].includes(host) ? 'localhost' : host;
+        const localAuthority = localHostname.includes(':') && !localHostname.startsWith('[') ? `[${localHostname}]` : localHostname;
+        const selfRelay = new DesktopSelfRelay({
+            desktopFile: path.join(homedir(), '.termdock', 'desktop.json'), identity: runtime.identity, serviceId: runtime.serviceId,
+            localOrigin: `${scheme}://${localAuthority}:${port}`, ...(localCa ? { localCa } : {}),
+        });
+        selfRelay.start();
+        server.once('close', () => selfRelay.close());
     }).catch(() => console.error('Route invitations unavailable; uninitialized route grants remain denied.'));
     void federation.catch(() => console.error('Encrypted access initialization failed; business access remains closed.'));
     server.once('close', () => { void federation.then(runtime => runtime.close()).catch(() => { }); });
@@ -661,7 +679,11 @@ export function startServer(options = {}) {
                 socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
                 return;
             }
-            const principal = routeAccess.authenticate(request.headers.authorization, url.searchParams.get('routeToken'));
+            const routeToken = url.searchParams.get('routeToken');
+            const selfRelayToken = url.searchParams.get('selfRelayToken');
+            const principal = selfRelayToken && !request.headers.authorization && !routeToken
+                ? routeAccess.authenticateSelfRelay(selfRelayToken)
+                : !selfRelayToken ? routeAccess.authenticate(request.headers.authorization, routeToken) : null;
             if (!principal) {
                 socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
                 return;

package/dist/server/federation/relay.js

@@ -111,6 +111,9 @@ export class RelayRouter {
         const route = this.routes.get(serviceId);
         return !this.stopped && !!route && route.expires > Date.now() && route.peer.ws.readyState === 1 && this.canRegister(route.peer, serviceId);
     }
+    activeRouteIds() {
+        return [...this.routes.keys()].filter(serviceId => this.hasRoute(serviceId));
+    }
     /** Trusted local configuration only. Clients never supply a target URL or factory. */
     registerDirect(serviceId, connect) {
         if (this.stopped || !identifier(serviceId) || typeof connect !== 'function' || this.hasRoute(serviceId))

package/dist/server/federation/routeAccess.js

@@ -9,12 +9,15 @@ export class RouteAccess {
     now;
     canRouteSubject;
     additionalTargets;
+    additionalTargetIds;
     tickets = new Map();
-    constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => []) {
+    selfRelayTickets = new Map();
+    constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => [], additionalTargetIds = () => []) {
         this.filePath = filePath;
         this.now = now;
         this.canRouteSubject = canRouteSubject;
         this.additionalTargets = additionalTargets;
+        this.additionalTargetIds = additionalTargetIds;
     }
     registry() {
         const empty = { relays: [], directTargets: [] };
@@ -62,6 +65,34 @@ export class RouteAccess {
         this.tickets.set(digest(routeToken).toString('hex'), { subjectId, serviceId, expiresAt });
         return { routeToken, expiresAt };
     }
+    /** A Noise-authenticated service can advertise only its own identity. The
+     * short-lived token merely transfers that identity onto the relay socket; it
+     * grants neither route use nor target-service access. */
+    issueSelfRelayTicket(serviceId) {
+        if (!validId(serviceId))
+            throw new Error('INVALID_SELF_RELAY_IDENTITY');
+        for (const [key, value] of this.selfRelayTickets)
+            if (value.expiresAt <= this.now())
+                this.selfRelayTickets.delete(key);
+        if (this.selfRelayTickets.size >= 1024)
+            throw new Error('SELF_RELAY_TICKET_LIMIT');
+        const selfRelayToken = randomBytes(32).toString('base64url');
+        const expiresAt = this.now() + 30_000;
+        this.selfRelayTickets.set(digest(selfRelayToken).toString('hex'), { serviceId, expiresAt });
+        return { selfRelayToken, expiresAt };
+    }
+    /** Single-use, fail-closed transfer from the authenticated Noise channel to
+     * the opaque relay transport. */
+    authenticateSelfRelay(selfRelayToken) {
+        if (!selfRelayToken || selfRelayToken.length > 512)
+            return null;
+        const key = digest(selfRelayToken).toString('hex');
+        const ticket = this.selfRelayTickets.get(key);
+        this.selfRelayTickets.delete(key);
+        if (!ticket || ticket.expiresAt <= this.now())
+            return null;
+        return { kind: 'self-relay', serviceId: ticket.serviceId };
+    }
     /** Called once before upgrading. A route ticket is consumed even if expired. */
     authenticate(authorization, routeToken) {
         if (authorization && routeToken)
@@ -83,6 +114,8 @@ export class RouteAccess {
         return { kind: 'client', subjectId: ticket.subjectId, serviceId: ticket.serviceId };
     }
     allowRegister(principal, serviceId) {
+        if (principal.kind === 'self-relay')
+            return principal.serviceId === serviceId;
         return principal.kind === 'relay' && this.relays().some(r => r.id === principal.id && digest(r.token).toString('hex') === principal.tokenHash && r.targets.includes(serviceId));
     }
     allowRoute(principal, serviceId) {
@@ -92,7 +125,8 @@ export class RouteAccess {
         if (!validId(serviceId))
             return false;
         const registry = this.registry();
-        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId) || this.additionalTargets().some(target => target.serviceId === serviceId);
+        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId)
+            || this.additionalTargets().some(target => target.serviceId === serviceId) || this.additionalTargetIds().includes(serviceId);
     }
     addDirectTarget(target) {
         const url = new URL(target.url);
@@ -139,6 +173,9 @@ export class RouteAccess {
             url.protocol = 'https:';
             targets.set(target.serviceId, { serviceId: target.serviceId, url: url.origin, ...(target.label ? { label: target.label } : {}) });
         }
+        for (const serviceId of this.additionalTargetIds())
+            if (validId(serviceId) && !targets.has(serviceId))
+                targets.set(serviceId, { serviceId });
         return [...targets.values()];
     }
 }

package/dist/server/federation/runtime.js

@@ -356,6 +356,11 @@ export async function createFederationRuntime(app, directory, handlers, options
                         });
                         send({ type: 'result', id: packet.id, items });
                     }
+                    else if (packet.type === 'self-relay-ticket') {
+                        if (!options.issueSelfRelayTicket)
+                            throw new Error('SELF_RELAY_UNAVAILABLE');
+                        send({ type: 'result', id: packet.id, serviceId: subjectId, ...options.issueSelfRelayTicket(subjectId) });
+                    }
                     else if (packet.type === 'route-invite-create') {
                         check('authorization.manage');
                         if (!options.createRouteInvitation || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)

package/dist/server/federation/selfRelay.js

@@ -0,0 +1,182 @@
+import WebSocket from 'ws';
+import { desktopDirectTargets } from './desktopTargets.js';
+import { RelayClient } from './relay.js';
+import { readPinnedCertificateAuthority } from './trustedCa.js';
+import { connectCollaborationRpc } from '../agent/collaborationPeerTransport.js';
+function relayEndpoint(origin, selfRelayToken) {
+    const url = new URL('/api/federation/relay', origin);
+    url.protocol = 'wss:';
+    url.searchParams.set('selfRelayToken', selfRelayToken);
+    return url.href;
+}
+function secureEndpoint(origin) {
+    const url = new URL('/api/federation/secure', origin);
+    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    return url.href;
+}
+function openSocket(url, ca, maxPayload = 256 * 1024) {
+    return new Promise((resolve, reject) => {
+        const secure = new URL(url).protocol === 'wss:';
+        const socket = new WebSocket(url, {
+            ...(secure ? { ...(ca ? { ca } : {}), rejectUnauthorized: true } : {}),
+            followRedirects: false,
+            handshakeTimeout: 10_000,
+            maxPayload,
+        });
+        const failed = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_CONNECTION_FAILED')); };
+        const opened = () => { cleanup(); socket.on('error', () => socket.terminate()); resolve(socket); };
+        const cleanup = () => { socket.off('open', opened); socket.off('error', failed); socket.off('close', failed); };
+        socket.once('open', opened);
+        socket.once('error', failed);
+        socket.once('close', failed);
+    });
+}
+function waitForReady(socket) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => fail(), 10_000);
+        timer.unref?.();
+        const cleanup = () => { clearTimeout(timer); socket.off('message', ready); socket.off('close', fail); };
+        const fail = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_AUTHENTICATION_FAILED')); };
+        const ready = (raw, binary) => {
+            try {
+                const frame = binary ? null : JSON.parse(raw.toString());
+                if (frame?.type !== 'ready') {
+                    fail();
+                    return;
+                }
+                cleanup();
+                resolve();
+            }
+            catch {
+                fail();
+            }
+        };
+        socket.once('message', ready);
+        socket.once('close', fail);
+    });
+}
+/**
+ * A local Termdock service may publish only its own stable identity to other
+ * services pinned by the same Desktop installation. Desktop supplies addresses
+ * and CA pins only; the service proves itself with its own Noise identity and
+ * no browser/device authorization is copied into this process.
+ */
+export class DesktopSelfRelay {
+    options;
+    states = new Map();
+    timer;
+    stopped = false;
+    constructor(options) {
+        this.options = options;
+    }
+    start() {
+        if (this.timer || this.stopped)
+            return;
+        this.refresh();
+        this.timer = setInterval(() => this.refresh(), 2_000);
+        this.timer.unref?.();
+    }
+    close() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        clearInterval(this.timer);
+        this.timer = undefined;
+        for (const state of this.states.values())
+            this.stopState(state);
+        this.states.clear();
+    }
+    refresh() {
+        if (this.stopped)
+            return;
+        const desired = new Map(desktopDirectTargets(this.options.desktopFile, this.options.serviceId)
+            .map(target => [target.serviceId, target]));
+        for (const [serviceId, state] of this.states) {
+            const target = desired.get(serviceId);
+            const signature = target && JSON.stringify([target.url, target.caFingerprint256]);
+            if (!target || signature !== state.signature) {
+                this.stopState(state);
+                this.states.delete(serviceId);
+            }
+        }
+        for (const [serviceId, target] of desired)
+            if (!this.states.has(serviceId)) {
+                const state = { signature: JSON.stringify([target.url, target.caFingerprint256]), stopped: false };
+                this.states.set(serviceId, state);
+                void this.run(state, target);
+            }
+    }
+    stopState(state) {
+        if (state.stopped)
+            return;
+        state.stopped = true;
+        state.wake?.();
+        state.wake = undefined;
+        state.client?.close();
+        state.client = undefined;
+        state.upstream?.terminate();
+        state.upstream = undefined;
+    }
+    async run(state, target) {
+        let delay = 1_000;
+        while (!this.stopped && !state.stopped) {
+            try {
+                await this.connect(state, target);
+                delay = 1_000;
+            }
+            catch { /* Offline and older entries remain dormant and retry with backoff. */ }
+            if (this.stopped || state.stopped)
+                break;
+            await new Promise(resolve => {
+                const timer = setTimeout(() => { state.wake = undefined; resolve(); }, delay);
+                timer.unref?.();
+                state.wake = () => { clearTimeout(timer); state.wake = undefined; resolve(); };
+            });
+            delay = Math.min(delay * 2, 30_000);
+        }
+    }
+    async connect(state, target) {
+        const peer = { serviceId: target.serviceId, origin: target.url, ...(target.caFingerprint256 ? { caFingerprint256: target.caFingerprint256 } : {}) };
+        const rpc = await connectCollaborationRpc(this.options.identity, peer);
+        let selfRelayToken;
+        try {
+            const result = await rpc.request({ type: 'self-relay-ticket' });
+            if (result.serviceId !== this.options.serviceId || typeof result.selfRelayToken !== 'string'
+                || !/^[A-Za-z0-9_-]{43}$/.test(result.selfRelayToken))
+                throw new Error('INVALID_SELF_RELAY_TICKET');
+            selfRelayToken = result.selfRelayToken;
+        }
+        finally {
+            rpc.close();
+        }
+        if (this.stopped || state.stopped)
+            return;
+        const ca = target.caFingerprint256 ? await readPinnedCertificateAuthority(target.url, target.caFingerprint256) : undefined;
+        const upstream = await openSocket(relayEndpoint(target.url, selfRelayToken), ca);
+        state.upstream = upstream;
+        try {
+            if (this.stopped || state.stopped)
+                return;
+            await waitForReady(upstream);
+            if (this.stopped || state.stopped)
+                return;
+            const client = new RelayClient(upstream, { targets: new Map([[this.options.serviceId,
+                        () => openSocket(secureEndpoint(this.options.localOrigin), this.options.localCa, 1024 * 1024)]]) });
+            state.client = client;
+            await new Promise(resolve => {
+                if (upstream.readyState !== WebSocket.OPEN)
+                    resolve();
+                else
+                    upstream.once('close', () => resolve());
+            });
+        }
+        finally {
+            state.client?.close();
+            state.client = undefined;
+            if (upstream.readyState !== WebSocket.CLOSED)
+                upstream.terminate();
+            if (state.upstream === upstream)
+                state.upstream = undefined;
+        }
+    }
+}

package/dist/server/utils/certificateNames.js

@@ -0,0 +1,12 @@
+import { X509Certificate } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { isIP } from 'node:net';
+// Use Node's certificate parser: the system openssl (notably LibreSSL on
+// macOS) may not support `x509 -ext`. Propagate read/parse errors so callers
+// cannot mistake an inspection failure for an empty SAN extension.
+export async function getMissingCertificateNames(certPath, required) {
+    const cert = new X509Certificate(await readFile(certPath));
+    return required.filter((name) => isIP(name)
+        ? cert.checkIP(name) === undefined
+        : cert.checkHost(name, { subject: 'never', wildcards: false }) === undefined);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.239",
+  "version": "1.4.241",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.239",
+  "version": "1.4.241",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-K4KyYJuVoQDpZsBM8ZX1Rw3MddOxAzVdp/cPm0iGZz0=",
-  "serverBundleHash": "sha256-b2hW5XzG58ErGFDet7CETfl7sHtPoDhHjTnL3mzU63s=",
-  "clientBundleHash": "sha256-1wPbozETRlatzFMaBkX5wcha5zbSwUdAw4I0XckzdLk=",
+  "serverBundleHash": "sha256-pd6lxkGXO9l4hUWug+Q8/kxaLYDXfSgODkoynCdwgBI=",
+  "clientBundleHash": "sha256-zyDixEKnPdU8PZdH7+xvwW32LWLFTq5o2zdqqOr3AJM=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }