termdock 1.4.240 → 1.4.242

package/dist/server/entry.js

@@ -14,6 +14,7 @@ import { RouteInvitationStore } from './federation/routeInvitations.js';
 import { attachRegisteredDirectTargets, verifyDirectTarget } from './federation/directRoutes.js';
 import { secureChannelOriginAllowed } from './federation/originPolicy.js';
 import { RelayRouter } from './federation/relay.js';
+import { DesktopSelfRelay } from './federation/selfRelay.js';
 import { assertPublicSecurity, securityHeaders } from './utils/publicSecurity.js';
 import { apiCachePolicy } from './utils/apiCachePolicy.js';
 import 'dotenv/config';
@@ -415,13 +416,15 @@ export function startServer(options = {}) {
     let entrySubjectAllowed = (_subjectId) => false;
     let routeInvitations;
     let federationServiceId = '';
+    let activeRouteIds = () => [];
     const desktopTargets = () => desktopDirectTargets(path.join(homedir(), '.termdock', 'desktop.json'), federationServiceId);
-    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true || collaborationTransport?.canRoute(subjectId, targetServiceId) === true, desktopTargets);
+    const routeAccess = new RouteAccess(path.join(homedir(), '.termdock', 'federation', 'routes.json'), Date.now, (subjectId, targetServiceId) => routeInvitations?.allows(subjectId, targetServiceId) === true || collaborationTransport?.canRoute(subjectId, targetServiceId) === true, desktopTargets, () => activeRouteIds());
     const relayRouter = new RelayRouter({
         authenticate: context => context,
         allowRegister: (principal, serviceId) => routeAccess.allowRegister(principal, serviceId),
         allowRoute: (principal, serviceId) => routeAccess.allowRoute(principal, serviceId),
     });
+    activeRouteIds = () => relayRouter.activeRouteIds();
     const dynamicDirectTargets = new Map();
     const refreshDirectTargets = () => {
         const desired = new Map(routeAccess.configuredDirectTargets().filter(target => target.serviceId !== federationServiceId).map(target => [target.serviceId, target]));
@@ -493,6 +496,7 @@ export function startServer(options = {}) {
         },
         revokeRouteAccess: id => routeInvitations?.revoke(id) || false,
         issueRouteTicket: (subjectId, serviceId) => routeAccess.issueRouteTicket(subjectId, serviceId),
+        issueSelfRelayTicket: (serviceId) => routeAccess.issueSelfRelayTicket(serviceId),
         hasRouteGrant: (subjectId, serviceId) => routeInvitations?.allows(subjectId, serviceId) === true || collaborationTransport?.canRoute(subjectId, serviceId) === true,
         createRouteInvitation: (issuerId, serviceId) => {
             if (!routeInvitations)
@@ -567,6 +571,20 @@ export function startServer(options = {}) {
             issuerAllowed: subjectId => entrySubjectAllowed(subjectId),
             targetAvailable: serviceId => routeAccess.hasConfiguredTarget(serviceId) && relayRouter.hasRoute(serviceId),
         });
+        let localCa;
+        if (scheme === 'https' && options.httpsCaPath)
+            try {
+                localCa = fs.readFileSync(options.httpsCaPath);
+            }
+            catch { /* System trust may still validate the local certificate. */ }
+        const localHostname = ['0.0.0.0', '::'].includes(host) ? 'localhost' : host;
+        const localAuthority = localHostname.includes(':') && !localHostname.startsWith('[') ? `[${localHostname}]` : localHostname;
+        const selfRelay = new DesktopSelfRelay({
+            desktopFile: path.join(homedir(), '.termdock', 'desktop.json'), identity: runtime.identity, serviceId: runtime.serviceId,
+            localOrigin: `${scheme}://${localAuthority}:${port}`, ...(localCa ? { localCa } : {}),
+        });
+        selfRelay.start();
+        server.once('close', () => selfRelay.close());
     }).catch(() => console.error('Route invitations unavailable; uninitialized route grants remain denied.'));
     void federation.catch(() => console.error('Encrypted access initialization failed; business access remains closed.'));
     server.once('close', () => { void federation.then(runtime => runtime.close()).catch(() => { }); });
@@ -661,7 +679,11 @@ export function startServer(options = {}) {
                 socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
                 return;
             }
-            const principal = routeAccess.authenticate(request.headers.authorization, url.searchParams.get('routeToken'));
+            const routeToken = url.searchParams.get('routeToken');
+            const selfRelayToken = url.searchParams.get('selfRelayToken');
+            const principal = selfRelayToken && !request.headers.authorization && !routeToken
+                ? routeAccess.authenticateSelfRelay(selfRelayToken)
+                : !selfRelayToken ? routeAccess.authenticate(request.headers.authorization, routeToken) : null;
             if (!principal) {
                 socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
                 return;

package/dist/server/federation/relay.js

@@ -111,6 +111,9 @@ export class RelayRouter {
         const route = this.routes.get(serviceId);
         return !this.stopped && !!route && route.expires > Date.now() && route.peer.ws.readyState === 1 && this.canRegister(route.peer, serviceId);
     }
+    activeRouteIds() {
+        return [...this.routes.keys()].filter(serviceId => this.hasRoute(serviceId));
+    }
     /** Trusted local configuration only. Clients never supply a target URL or factory. */
     registerDirect(serviceId, connect) {
         if (this.stopped || !identifier(serviceId) || typeof connect !== 'function' || this.hasRoute(serviceId))

package/dist/server/federation/routeAccess.js

@@ -9,12 +9,15 @@ export class RouteAccess {
     now;
     canRouteSubject;
     additionalTargets;
+    additionalTargetIds;
     tickets = new Map();
-    constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => []) {
+    selfRelayTickets = new Map();
+    constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => [], additionalTargetIds = () => []) {
         this.filePath = filePath;
         this.now = now;
         this.canRouteSubject = canRouteSubject;
         this.additionalTargets = additionalTargets;
+        this.additionalTargetIds = additionalTargetIds;
     }
     registry() {
         const empty = { relays: [], directTargets: [] };
@@ -62,6 +65,34 @@ export class RouteAccess {
         this.tickets.set(digest(routeToken).toString('hex'), { subjectId, serviceId, expiresAt });
         return { routeToken, expiresAt };
     }
+    /** A Noise-authenticated service can advertise only its own identity. The
+     * short-lived token merely transfers that identity onto the relay socket; it
+     * grants neither route use nor target-service access. */
+    issueSelfRelayTicket(serviceId) {
+        if (!validId(serviceId))
+            throw new Error('INVALID_SELF_RELAY_IDENTITY');
+        for (const [key, value] of this.selfRelayTickets)
+            if (value.expiresAt <= this.now())
+                this.selfRelayTickets.delete(key);
+        if (this.selfRelayTickets.size >= 1024)
+            throw new Error('SELF_RELAY_TICKET_LIMIT');
+        const selfRelayToken = randomBytes(32).toString('base64url');
+        const expiresAt = this.now() + 30_000;
+        this.selfRelayTickets.set(digest(selfRelayToken).toString('hex'), { serviceId, expiresAt });
+        return { selfRelayToken, expiresAt };
+    }
+    /** Single-use, fail-closed transfer from the authenticated Noise channel to
+     * the opaque relay transport. */
+    authenticateSelfRelay(selfRelayToken) {
+        if (!selfRelayToken || selfRelayToken.length > 512)
+            return null;
+        const key = digest(selfRelayToken).toString('hex');
+        const ticket = this.selfRelayTickets.get(key);
+        this.selfRelayTickets.delete(key);
+        if (!ticket || ticket.expiresAt <= this.now())
+            return null;
+        return { kind: 'self-relay', serviceId: ticket.serviceId };
+    }
     /** Called once before upgrading. A route ticket is consumed even if expired. */
     authenticate(authorization, routeToken) {
         if (authorization && routeToken)
@@ -83,6 +114,8 @@ export class RouteAccess {
         return { kind: 'client', subjectId: ticket.subjectId, serviceId: ticket.serviceId };
     }
     allowRegister(principal, serviceId) {
+        if (principal.kind === 'self-relay')
+            return principal.serviceId === serviceId;
         return principal.kind === 'relay' && this.relays().some(r => r.id === principal.id && digest(r.token).toString('hex') === principal.tokenHash && r.targets.includes(serviceId));
     }
     allowRoute(principal, serviceId) {
@@ -92,7 +125,8 @@ export class RouteAccess {
         if (!validId(serviceId))
             return false;
         const registry = this.registry();
-        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId) || this.additionalTargets().some(target => target.serviceId === serviceId);
+        return registry.relays.some(relay => relay.targets.includes(serviceId)) || registry.directTargets.some(target => target.serviceId === serviceId)
+            || this.additionalTargets().some(target => target.serviceId === serviceId) || this.additionalTargetIds().includes(serviceId);
     }
     addDirectTarget(target) {
         const url = new URL(target.url);
@@ -139,6 +173,9 @@ export class RouteAccess {
             url.protocol = 'https:';
             targets.set(target.serviceId, { serviceId: target.serviceId, url: url.origin, ...(target.label ? { label: target.label } : {}) });
         }
+        for (const serviceId of this.additionalTargetIds())
+            if (validId(serviceId) && !targets.has(serviceId))
+                targets.set(serviceId, { serviceId });
         return [...targets.values()];
     }
 }

package/dist/server/federation/runtime.js

@@ -356,6 +356,11 @@ export async function createFederationRuntime(app, directory, handlers, options
                         });
                         send({ type: 'result', id: packet.id, items });
                     }
+                    else if (packet.type === 'self-relay-ticket') {
+                        if (!options.issueSelfRelayTicket)
+                            throw new Error('SELF_RELAY_UNAVAILABLE');
+                        send({ type: 'result', id: packet.id, serviceId: subjectId, ...options.issueSelfRelayTicket(subjectId) });
+                    }
                     else if (packet.type === 'route-invite-create') {
                         check('authorization.manage');
                         if (!options.createRouteInvitation || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)

package/dist/server/federation/selfRelay.js

@@ -0,0 +1,182 @@
+import WebSocket from 'ws';
+import { desktopDirectTargets } from './desktopTargets.js';
+import { RelayClient } from './relay.js';
+import { readPinnedCertificateAuthority } from './trustedCa.js';
+import { connectCollaborationRpc } from '../agent/collaborationPeerTransport.js';
+function relayEndpoint(origin, selfRelayToken) {
+    const url = new URL('/api/federation/relay', origin);
+    url.protocol = 'wss:';
+    url.searchParams.set('selfRelayToken', selfRelayToken);
+    return url.href;
+}
+function secureEndpoint(origin) {
+    const url = new URL('/api/federation/secure', origin);
+    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    return url.href;
+}
+function openSocket(url, ca, maxPayload = 256 * 1024) {
+    return new Promise((resolve, reject) => {
+        const secure = new URL(url).protocol === 'wss:';
+        const socket = new WebSocket(url, {
+            ...(secure ? { ...(ca ? { ca } : {}), rejectUnauthorized: true } : {}),
+            followRedirects: false,
+            handshakeTimeout: 10_000,
+            maxPayload,
+        });
+        const failed = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_CONNECTION_FAILED')); };
+        const opened = () => { cleanup(); socket.on('error', () => socket.terminate()); resolve(socket); };
+        const cleanup = () => { socket.off('open', opened); socket.off('error', failed); socket.off('close', failed); };
+        socket.once('open', opened);
+        socket.once('error', failed);
+        socket.once('close', failed);
+    });
+}
+function waitForReady(socket) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => fail(), 10_000);
+        timer.unref?.();
+        const cleanup = () => { clearTimeout(timer); socket.off('message', ready); socket.off('close', fail); };
+        const fail = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_AUTHENTICATION_FAILED')); };
+        const ready = (raw, binary) => {
+            try {
+                const frame = binary ? null : JSON.parse(raw.toString());
+                if (frame?.type !== 'ready') {
+                    fail();
+                    return;
+                }
+                cleanup();
+                resolve();
+            }
+            catch {
+                fail();
+            }
+        };
+        socket.once('message', ready);
+        socket.once('close', fail);
+    });
+}
+/**
+ * A local Termdock service may publish only its own stable identity to other
+ * services pinned by the same Desktop installation. Desktop supplies addresses
+ * and CA pins only; the service proves itself with its own Noise identity and
+ * no browser/device authorization is copied into this process.
+ */
+export class DesktopSelfRelay {
+    options;
+    states = new Map();
+    timer;
+    stopped = false;
+    constructor(options) {
+        this.options = options;
+    }
+    start() {
+        if (this.timer || this.stopped)
+            return;
+        this.refresh();
+        this.timer = setInterval(() => this.refresh(), 2_000);
+        this.timer.unref?.();
+    }
+    close() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        clearInterval(this.timer);
+        this.timer = undefined;
+        for (const state of this.states.values())
+            this.stopState(state);
+        this.states.clear();
+    }
+    refresh() {
+        if (this.stopped)
+            return;
+        const desired = new Map(desktopDirectTargets(this.options.desktopFile, this.options.serviceId)
+            .map(target => [target.serviceId, target]));
+        for (const [serviceId, state] of this.states) {
+            const target = desired.get(serviceId);
+            const signature = target && JSON.stringify([target.url, target.caFingerprint256]);
+            if (!target || signature !== state.signature) {
+                this.stopState(state);
+                this.states.delete(serviceId);
+            }
+        }
+        for (const [serviceId, target] of desired)
+            if (!this.states.has(serviceId)) {
+                const state = { signature: JSON.stringify([target.url, target.caFingerprint256]), stopped: false };
+                this.states.set(serviceId, state);
+                void this.run(state, target);
+            }
+    }
+    stopState(state) {
+        if (state.stopped)
+            return;
+        state.stopped = true;
+        state.wake?.();
+        state.wake = undefined;
+        state.client?.close();
+        state.client = undefined;
+        state.upstream?.terminate();
+        state.upstream = undefined;
+    }
+    async run(state, target) {
+        let delay = 1_000;
+        while (!this.stopped && !state.stopped) {
+            try {
+                await this.connect(state, target);
+                delay = 1_000;
+            }
+            catch { /* Offline and older entries remain dormant and retry with backoff. */ }
+            if (this.stopped || state.stopped)
+                break;
+            await new Promise(resolve => {
+                const timer = setTimeout(() => { state.wake = undefined; resolve(); }, delay);
+                timer.unref?.();
+                state.wake = () => { clearTimeout(timer); state.wake = undefined; resolve(); };
+            });
+            delay = Math.min(delay * 2, 30_000);
+        }
+    }
+    async connect(state, target) {
+        const peer = { serviceId: target.serviceId, origin: target.url, ...(target.caFingerprint256 ? { caFingerprint256: target.caFingerprint256 } : {}) };
+        const rpc = await connectCollaborationRpc(this.options.identity, peer);
+        let selfRelayToken;
+        try {
+            const result = await rpc.request({ type: 'self-relay-ticket' });
+            if (result.serviceId !== this.options.serviceId || typeof result.selfRelayToken !== 'string'
+                || !/^[A-Za-z0-9_-]{43}$/.test(result.selfRelayToken))
+                throw new Error('INVALID_SELF_RELAY_TICKET');
+            selfRelayToken = result.selfRelayToken;
+        }
+        finally {
+            rpc.close();
+        }
+        if (this.stopped || state.stopped)
+            return;
+        const ca = target.caFingerprint256 ? await readPinnedCertificateAuthority(target.url, target.caFingerprint256) : undefined;
+        const upstream = await openSocket(relayEndpoint(target.url, selfRelayToken), ca);
+        state.upstream = upstream;
+        try {
+            if (this.stopped || state.stopped)
+                return;
+            await waitForReady(upstream);
+            if (this.stopped || state.stopped)
+                return;
+            const client = new RelayClient(upstream, { targets: new Map([[this.options.serviceId,
+                        () => openSocket(secureEndpoint(this.options.localOrigin), this.options.localCa, 1024 * 1024)]]) });
+            state.client = client;
+            await new Promise(resolve => {
+                if (upstream.readyState !== WebSocket.OPEN)
+                    resolve();
+                else
+                    upstream.once('close', () => resolve());
+            });
+        }
+        finally {
+            state.client?.close();
+            state.client = undefined;
+            if (upstream.readyState !== WebSocket.CLOSED)
+                upstream.terminate();
+            if (state.upstream === upstream)
+                state.upstream = undefined;
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.240",
+  "version": "1.4.242",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.240",
+  "version": "1.4.242",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-K4KyYJuVoQDpZsBM8ZX1Rw3MddOxAzVdp/cPm0iGZz0=",
-  "serverBundleHash": "sha256-OjLwoxfVNp7VlqCwrjCUGgjj0Yb3zlTm1sdlQGCGYIs=",
-  "clientBundleHash": "sha256-1wPbozETRlatzFMaBkX5wcha5zbSwUdAw4I0XckzdLk=",
+  "serverBundleHash": "sha256-pd6lxkGXO9l4hUWug+Q8/kxaLYDXfSgODkoynCdwgBI=",
+  "clientBundleHash": "sha256-v2rqdMlmZKYLB5hGGTlyCG7qH299aT0k0G7gFdoGCCw=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }