termdock 1.4.240 → 1.4.241

package/dist/server/federation/relay.js

@@ -111,6 +111,9 @@ export class RelayRouter {
         const route = this.routes.get(serviceId);
         return !this.stopped && !!route && route.expires > Date.now() && route.peer.ws.readyState === 1 && this.canRegister(route.peer, serviceId);
     }
+    activeRouteIds() {
+        return [...this.routes.keys()].filter(serviceId => this.hasRoute(serviceId));
+    }
     /** Trusted local configuration only. Clients never supply a target URL or factory. */
     registerDirect(serviceId, connect) {
         if (this.stopped || !identifier(serviceId) || typeof connect !== 'function' || this.hasRoute(serviceId))

package/dist/server/federation/routeAccess.js

@@ -9,12 +9,15 @@ export class RouteAccess {
     now;
     canRouteSubject;
     additionalTargets;
+    additionalTargetIds;
     tickets = new Map();
-    constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => []) {
+    selfRelayTickets = new Map();
+    constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => [], additionalTargetIds = () => []) {
         this.filePath = filePath;
         this.now = now;
         this.canRouteSubject = canRouteSubject;
         this.additionalTargets = additionalTargets;
+        this.additionalTargetIds = additionalTargetIds;
     }
     registry() {
         const empty = { relays: [], directTargets: [] };
@@ -62,6 +65,34 @@ export class RouteAccess {
         this.tickets.set(digest(routeToken).toString('hex'), { subjectId, serviceId, expiresAt });
         return { routeToken, expiresAt };
     }
+    /** A Noise-authenticated service can advertise only its own identity. The
+     * short-lived token merely transfers that identity onto the relay socket; it
+     * grants neither route use nor target-service access. */
+    issueSelfRelayTicket(serviceId) {
+        if (!validId(serviceId))
+            throw new Error('INVALID_SELF_RELAY_IDENTITY');
+        for (const [key, value] of this.selfRelayTickets)
+            if (value.expiresAt <= this.now())
+                this.selfRelayTickets.delete(key);
+        if (this.selfRelayTickets.size >= 1024)
+            throw new Error('SELF_RELAY_TICKET_LIMIT');
+        const selfRelayToken = randomBytes(32).toString('base64url');
+        const expiresAt = this.now() + 30_000;
+        this.selfRelayTickets.set(digest(selfRelayToken).toString('hex'), { serviceId, expiresAt });
+        return { selfRelayToken, expiresAt };
+    }
+    /** Single-use, fail-closed transfer from the authenticated Noise channel to
+     * the opaque relay transport. */
+    authenticateSelfRelay(selfRelayToken) {
+        if (!selfRelayToken || selfRelayToken.length > 512)
+            return null;
+        const key = digest(selfRelayToken).toString('hex');
+        const ticket = this.selfRelayTickets.get(key);
+        this.selfRelayTickets.delete(key);
+        if (!ticket || ticket.expiresAt <= this.now())
+            return null;
+        return { kind: 'self-relay', serviceId: ticket.serviceId };
+    }
     /** Called once before upgrading. A route ticket is consumed even if expired. */
     authenticate(authorization, routeToken) {
         if (authorization && routeToken)
@@ -83,6 +114,8 @@ export class RouteAccess {
         return { kind: 'client', subjectId: ticket.subjectId, serviceId: ticket.serviceId };
     }
     allowRegister(principal, serviceId) {
+        if (principal.kind === 'self-relay')
+            return principal.serviceId === serviceId;
         return principal.kind === 'relay' && this.relays().some(r => r.id === principal.id && digest(r.token).toString('hex') === principal.tokenHash && r.targets.includes(serviceId));
     }
     allowRoute(principal, serviceId) {
@@ -92,7 +125,8 @@ export class RouteAccess {
         if (!validId(serviceId))
             return false;
         const registry = this.registry();
-        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId) || this.additionalTargets().some(target => target.serviceId === serviceId);
+        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId)
+            || this.additionalTargets().some(target => target.serviceId === serviceId) || this.additionalTargetIds().includes(serviceId);
     }
     addDirectTarget(target) {
         const url = new URL(target.url);
@@ -139,6 +173,9 @@ export class RouteAccess {
             url.protocol = 'https:';
             targets.set(target.serviceId, { serviceId: target.serviceId, url: url.origin, ...(target.label ? { label: target.label } : {}) });
         }
+        for (const serviceId of this.additionalTargetIds())
+            if (validId(serviceId) && !targets.has(serviceId))
+                targets.set(serviceId, { serviceId });
         return [...targets.values()];
     }
 }

package/dist/server/federation/runtime.js

@@ -356,6 +356,11 @@ export async function createFederationRuntime(app, directory, handlers, options
                         });
                         send({ type: 'result', id: packet.id, items });
                     }
+                    else if (packet.type === 'self-relay-ticket') {
+                        if (!options.issueSelfRelayTicket)
+                            throw new Error('SELF_RELAY_UNAVAILABLE');
+                        send({ type: 'result', id: packet.id, serviceId: subjectId, ...options.issueSelfRelayTicket(subjectId) });
+                    }
                     else if (packet.type === 'route-invite-create') {
                         check('authorization.manage');
                         if (!options.createRouteInvitation || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)

package/dist/server/federation/selfRelay.js

@@ -0,0 +1,182 @@
+import WebSocket from 'ws';
+import { desktopDirectTargets } from './desktopTargets.js';
+import { RelayClient } from './relay.js';
+import { readPinnedCertificateAuthority } from './trustedCa.js';
+import { connectCollaborationRpc } from '../agent/collaborationPeerTransport.js';
+function relayEndpoint(origin, selfRelayToken) {
+    const url = new URL('/api/federation/relay', origin);
+    url.protocol = 'wss:';
+    url.searchParams.set('selfRelayToken', selfRelayToken);
+    return url.href;
+}
+function secureEndpoint(origin) {
+    const url = new URL('/api/federation/secure', origin);
+    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    return url.href;
+}
+function openSocket(url, ca, maxPayload = 256 * 1024) {
+    return new Promise((resolve, reject) => {
+        const secure = new URL(url).protocol === 'wss:';
+        const socket = new WebSocket(url, {
+            ...(secure ? { ...(ca ? { ca } : {}), rejectUnauthorized: true } : {}),
+            followRedirects: false,
+            handshakeTimeout: 10_000,
+            maxPayload,
+        });
+        const failed = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_CONNECTION_FAILED')); };
+        const opened = () => { cleanup(); socket.on('error', () => socket.terminate()); resolve(socket); };
+        const cleanup = () => { socket.off('open', opened); socket.off('error', failed); socket.off('close', failed); };
+        socket.once('open', opened);
+        socket.once('error', failed);
+        socket.once('close', failed);
+    });
+}
+function waitForReady(socket) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => fail(), 10_000);
+        timer.unref?.();
+        const cleanup = () => { clearTimeout(timer); socket.off('message', ready); socket.off('close', fail); };
+        const fail = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_AUTHENTICATION_FAILED')); };
+        const ready = (raw, binary) => {
+            try {
+                const frame = binary ? null : JSON.parse(raw.toString());
+                if (frame?.type !== 'ready') {
+                    fail();
+                    return;
+                }
+                cleanup();
+                resolve();
+            }
+            catch {
+                fail();
+            }
+        };
+        socket.once('message', ready);
+        socket.once('close', fail);
+    });
+}
+/**
+ * A local Termdock service may publish only its own stable identity to other
+ * services pinned by the same Desktop installation. Desktop supplies addresses
+ * and CA pins only; the service proves itself with its own Noise identity and
+ * no browser/device authorization is copied into this process.
+ */
+export class DesktopSelfRelay {
+    options;
+    states = new Map();
+    timer;
+    stopped = false;
+    constructor(options) {
+        this.options = options;
+    }
+    start() {
+        if (this.timer || this.stopped)
+            return;
+        this.refresh();
+        this.timer = setInterval(() => this.refresh(), 2_000);
+        this.timer.unref?.();
+    }
+    close() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        clearInterval(this.timer);
+        this.timer = undefined;
+        for (const state of this.states.values())
+            this.stopState(state);
+        this.states.clear();
+    }
+    refresh() {
+        if (this.stopped)
+            return;
+        const desired = new Map(desktopDirectTargets(this.options.desktopFile, this.options.serviceId)
+            .map(target => [target.serviceId, target]));
+        for (const [serviceId, state] of this.states) {
+            const target = desired.get(serviceId);
+            const signature = target && JSON.stringify([target.url, target.caFingerprint256]);
+            if (!target || signature !== state.signature) {
+                this.stopState(state);
+                this.states.delete(serviceId);
+            }
+        }
+        for (const [serviceId, target] of desired)
+            if (!this.states.has(serviceId)) {
+                const state = { signature: JSON.stringify([target.url, target.caFingerprint256]), stopped: false };
+                this.states.set(serviceId, state);
+                void this.run(state, target);
+            }
+    }
+    stopState(state) {
+        if (state.stopped)
+            return;
+        state.stopped = true;
+        state.wake?.();
+        state.wake = undefined;
+        state.client?.close();
+        state.client = undefined;
+        state.upstream?.terminate();
+        state.upstream = undefined;
+    }
+    async run(state, target) {
+        let delay = 1_000;
+        while (!this.stopped && !state.stopped) {
+            try {
+                await this.connect(state, target);
+                delay = 1_000;
+            }
+            catch { /* Offline and older entries remain dormant and retry with backoff. */ }
+            if (this.stopped || state.stopped)
+                break;
+            await new Promise(resolve => {
+                const timer = setTimeout(() => { state.wake = undefined; resolve(); }, delay);
+                timer.unref?.();
+                state.wake = () => { clearTimeout(timer); state.wake = undefined; resolve(); };
+            });
+            delay = Math.min(delay * 2, 30_000);
+        }
+    }
+    async connect(state, target) {
+        const peer = { serviceId: target.serviceId, origin: target.url, ...(target.caFingerprint256 ? { caFingerprint256: target.caFingerprint256 } : {}) };
+        const rpc = await connectCollaborationRpc(this.options.identity, peer);
+        let selfRelayToken;
+        try {
+            const result = await rpc.request({ type: 'self-relay-ticket' });
+            if (result.serviceId !== this.options.serviceId || typeof result.selfRelayToken !== 'string'
+                || !/^[A-Za-z0-9_-]{43}$/.test(result.selfRelayToken))
+                throw new Error('INVALID_SELF_RELAY_TICKET');
+            selfRelayToken = result.selfRelayToken;
+        }
+        finally {
+            rpc.close();
+        }
+        if (this.stopped || state.stopped)
+            return;
+        const ca = target.caFingerprint256 ? await readPinnedCertificateAuthority(target.url, target.caFingerprint256) : undefined;
+        const upstream = await openSocket(relayEndpoint(target.url, selfRelayToken), ca);
+        state.upstream = upstream;
+        try {
+            if (this.stopped || state.stopped)
+                return;
+            await waitForReady(upstream);
+            if (this.stopped || state.stopped)
+                return;
+            const client = new RelayClient(upstream, { targets: new Map([[this.options.serviceId,
+                        () => openSocket(secureEndpoint(this.options.localOrigin), this.options.localCa, 1024 * 1024)]]) });
+            state.client = client;
+            await new Promise(resolve => {
+                if (upstream.readyState !== WebSocket.OPEN)
+                    resolve();
+                else
+                    upstream.once('close', () => resolve());
+            });
+        }
+        finally {
+            state.client?.close();
+            state.client = undefined;
+            if (upstream.readyState !== WebSocket.CLOSED)
+                upstream.terminate();
+            if (state.upstream === upstream)
+                state.upstream = undefined;
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.240",
+  "version": "1.4.241",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.240",
+  "version": "1.4.241",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-K4KyYJuVoQDpZsBM8ZX1Rw3MddOxAzVdp/cPm0iGZz0=",
-  "serverBundleHash": "sha256-OjLwoxfVNp7VlqCwrjCUGgjj0Yb3zlTm1sdlQGCGYIs=",
-  "clientBundleHash": "sha256-1wPbozETRlatzFMaBkX5wcha5zbSwUdAw4I0XckzdLk=",
+  "serverBundleHash": "sha256-pd6lxkGXO9l4hUWug+Q8/kxaLYDXfSgODkoynCdwgBI=",
+  "clientBundleHash": "sha256-zyDixEKnPdU8PZdH7+xvwW32LWLFTq5o2zdqqOr3AJM=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }

package/dist/client/assets/channel-zK78er-R.js

@@ -1 +0,0 @@
-import{c as a,C as n}from"./mermaid.core-DhRpdkKn.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/client/assets/classDiagram-ZZMXUADV-BMh5Sak3.js

@@ -1 +0,0 @@
-import{s as a,a as s,c as t,C as e}from"./chunk-TICWLB2K-CS3jsxv7.js";import{d as i}from"./mermaid.core-DhRpdkKn.js";import"./chunk-5VM5RSS4-cga3WKIM.js";import"./chunk-XXDRQBXY-BYgvxPrj.js";import"./chunk-POPQ4Y6H-Y6gEzK15.js";import"./chunk-F27PBJKO-BNOR_7WA.js";import"./purify.es-4eNOHKSq.js";import"./app-Ctrh4Bku.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:t,get db(){return new e},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{g as diagram};

package/dist/client/assets/classDiagram-v2-VYDZK3BY-BMh5Sak3.js

@@ -1 +0,0 @@
-import{s as a,a as s,c as t,C as e}from"./chunk-TICWLB2K-CS3jsxv7.js";import{d as i}from"./mermaid.core-DhRpdkKn.js";import"./chunk-5VM5RSS4-cga3WKIM.js";import"./chunk-XXDRQBXY-BYgvxPrj.js";import"./chunk-POPQ4Y6H-Y6gEzK15.js";import"./chunk-F27PBJKO-BNOR_7WA.js";import"./purify.es-4eNOHKSq.js";import"./app-Ctrh4Bku.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:t,get db(){return new e},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{g as diagram};

package/dist/client/assets/stateDiagram-v2-MP3YSRHH-CMG96YGj.js

@@ -1 +0,0 @@
-import{b as r,a as e,s as a,S as i}from"./chunk-IMKFNOWR-Dk12DKtC.js";import{d as s}from"./mermaid.core-DhRpdkKn.js";import"./chunk-XXDRQBXY-BYgvxPrj.js";import"./chunk-POPQ4Y6H-Y6gEzK15.js";import"./chunk-F27PBJKO-BNOR_7WA.js";import"./purify.es-4eNOHKSq.js";import"./app-Ctrh4Bku.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:a,get db(){return new i(2)},renderer:e,styles:r,init:s(t=>{t.state||(t.state={}),t.state.arrowMarkerAbsolute=t.arrowMarkerAbsolute},"init")};export{g as diagram};

package/dist/client/assets/swimlanesDiagram-VR7AAH4N-sPKOywKp.js

@@ -1,8 +0,0 @@
-import{c as r,s as e}from"./flowDiagram-HODETNUW-BBIgixMV.js";import{d as o}from"./mermaid.core-DhRpdkKn.js";import"./chunk-5VM5RSS4-cga3WKIM.js";import"./chunk-XXDRQBXY-BYgvxPrj.js";import"./chunk-POPQ4Y6H-Y6gEzK15.js";import"./chunk-F27PBJKO-BNOR_7WA.js";import"./purify.es-4eNOHKSq.js";import"./channel-zK78er-R.js";import"./app-Ctrh4Bku.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var a=o(t=>`${e(t)}
-  .swimlane.cluster rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),m=a,v=r({defaultLayout:"swimlane",styles:m});export{v as diagram};