termdock 1.4.295 → 1.4.297

package/dist/server/shared/computerPreferences.js

@@ -0,0 +1,29 @@
+export function defaultComputerPreferences(os) {
+    const platform = os === 'darwin' ? 'mac' : os === 'win32' ? 'windows' : 'linux';
+    const profile = { host: '127.0.0.1', platform, protocol: platform === 'mac' ? 'vnc' : 'rdp', port: '3389', username: '', domain: '', ignoreCert: false, rememberLogin: true };
+    return { target: 'local', local: profile, remote: { ...profile, host: '' }, viewOnly: false, fit: true, autoConnect: true };
+}
+/** Project only non-secret, supported fields, including when reading old files. */
+export function computerPreferences(value, os) {
+    const defaults = defaultComputerPreferences(os);
+    if (!value || typeof value !== 'object')
+        return defaults;
+    const raw = value;
+    const profile = (value, fallback) => {
+        const p = value && typeof value === 'object' ? value : {};
+        const text = (key, limit) => typeof p[key] === 'string' && p[key].length <= limit && !/[\x00-\x1f]/.test(p[key]) ? p[key] : fallback[key];
+        return {
+            host: text('host', 253), username: text('username', 255), domain: text('domain', 255),
+            platform: ['mac', 'linux', 'windows'].includes(String(p.platform)) ? p.platform : fallback.platform,
+            protocol: p.protocol === 'rdp' || p.protocol === 'vnc' ? p.protocol : fallback.protocol,
+            port: typeof p.port === 'string' && /^\d{0,5}$/.test(p.port) && Number(p.port) <= 65535 ? p.port : fallback.port,
+            ignoreCert: p.ignoreCert === true,
+            rememberLogin: p.rememberLogin !== false,
+        };
+    };
+    return { target: raw.target === 'remote' ? 'remote' : 'local', local: { ...profile(raw.local, defaults.local), host: '127.0.0.1' }, remote: profile(raw.remote, defaults.remote), viewOnly: raw.viewOnly === true, fit: raw.fit !== false, autoConnect: raw.autoConnect !== false };
+}
+/** Identity binding deliberately excludes display and certificate preferences. */
+export function computerLoginKey(profile) {
+    return JSON.stringify([profile.host.trim().toLowerCase(), profile.protocol, profile.protocol === 'vnc' ? 5900 : Number(profile.port), profile.username.trim(), profile.domain.trim()]);
+}

package/dist/server/utils/computerCredentials.js

@@ -0,0 +1,88 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, chmodSync, unlinkSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { computerLoginKey } from '../shared/computerPreferences.js';
+/** Credentials are independent of ordinary settings, encrypted and owner-readable. */
+export class ComputerCredentialStore {
+    directory;
+    file;
+    keyFile;
+    constructor(directory = join(homedir(), '.termdock')) {
+        this.directory = directory;
+        this.file = join(directory, 'computer-credentials.json');
+        this.keyFile = join(directory, 'computer-credentials.key');
+    }
+    id(profile) { return createHash('sha256').update(computerLoginKey(profile)).digest('hex'); }
+    records() {
+        if (!existsSync(this.file))
+            return {};
+        const bytes = readFileSync(this.file);
+        if (bytes.length > 1024 * 1024)
+            throw new Error('COMPUTER_CREDENTIALS_READ_FAILED');
+        const data = JSON.parse(bytes.toString());
+        if (!data || typeof data !== 'object' || Array.isArray(data))
+            throw new Error('COMPUTER_CREDENTIALS_READ_FAILED');
+        return data;
+    }
+    key() {
+        if (!existsSync(this.keyFile)) {
+            if (existsSync(this.file))
+                throw new Error('COMPUTER_CREDENTIALS_KEY_MISSING');
+            mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+            try {
+                writeFileSync(this.keyFile, randomBytes(32), { flag: 'wx', mode: 0o600 });
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+        }
+        const key = readFileSync(this.keyFile);
+        if (key.length !== 32)
+            throw new Error('COMPUTER_CREDENTIALS_KEY_INVALID');
+        chmodSync(this.keyFile, 0o600);
+        return key;
+    }
+    write(records) {
+        mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+        const temporary = `${this.file}.${randomBytes(8).toString('hex')}.tmp`;
+        try {
+            writeFileSync(temporary, JSON.stringify(records), { flag: 'wx', mode: 0o600 });
+            renameSync(temporary, this.file);
+        }
+        finally {
+            if (existsSync(temporary))
+                unlinkSync(temporary);
+        }
+    }
+    has(profile) { return Boolean(this.records()[this.id(profile)]); }
+    get(profile) {
+        const id = this.id(profile), record = this.records()[id];
+        if (!record)
+            return null;
+        const decipher = createDecipheriv('aes-256-gcm', this.key(), Buffer.from(record.iv, 'base64'));
+        decipher.setAAD(Buffer.from(id));
+        decipher.setAuthTag(Buffer.from(record.tag, 'base64'));
+        return Buffer.concat([decipher.update(Buffer.from(record.ciphertext, 'base64')), decipher.final()]).toString();
+    }
+    save(profile, password) {
+        if (!password || password.length > 1024 || password.includes('\0'))
+            throw new Error('INVALID_COMPUTER_CREDENTIALS');
+        const records = this.records(), id = this.id(profile), iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.key(), iv);
+        cipher.setAAD(Buffer.from(id));
+        const ciphertext = Buffer.concat([cipher.update(password, 'utf8'), cipher.final()]);
+        if (!records[id] && Object.keys(records).length >= 64)
+            delete records[Object.keys(records)[0]];
+        records[id] = { iv: iv.toString('base64'), tag: cipher.getAuthTag().toString('base64'), ciphertext: ciphertext.toString('base64') };
+        this.write(records);
+    }
+    forget(profile) {
+        const records = this.records(), id = this.id(profile);
+        if (!records[id])
+            return;
+        delete records[id];
+        this.write(records);
+    }
+}

package/dist/server/utils/sharedSampling.js

@@ -0,0 +1,93 @@
+/** Bounded snapshots with one refresh per key, including forced refreshes.
+ * Failures are never cached; a later observation can retry immediately. */
+export class SharedSnapshotCache {
+    ttlMs;
+    maxEntries;
+    entries = new Map();
+    pending = new Map();
+    constructor(ttlMs, maxEntries = 256) {
+        this.ttlMs = ttlMs;
+        this.maxEntries = maxEntries;
+    }
+    get(key, load, refresh = false) {
+        const pending = this.pending.get(key);
+        if (pending)
+            return pending;
+        const entry = this.entries.get(key);
+        if (!refresh && entry && Date.now() - entry.at < this.ttlMs)
+            return Promise.resolve(entry.value);
+        const promise = Promise.resolve().then(load).then(value => {
+            this.entries.delete(key);
+            this.entries.set(key, { value, at: Date.now() });
+            while (this.entries.size > this.maxEntries)
+                this.entries.delete(this.entries.keys().next().value);
+            return value;
+        }).finally(() => { this.pending.delete(key); });
+        this.pending.set(key, promise);
+        return promise;
+    }
+}
+/** One non-overlapping sampler per session. Observers receive a full initial
+ * snapshot and subsequent changes, including observers joining during a poll. */
+export class SharedSessionSampler {
+    sample;
+    intervalMs;
+    onError;
+    observers = new Set();
+    latest = new Map();
+    timer = null;
+    pending = null;
+    epoch = 0;
+    constructor(sample, intervalMs, onError) {
+        this.sample = sample;
+        this.intervalMs = intervalMs;
+        this.onError = onError;
+    }
+    subscribe(observer) {
+        this.observers.add(observer);
+        for (const { event } of this.latest.values())
+            observer(event);
+        if (!this.timer) {
+            this.timer = setInterval(() => { void this.poll(); }, this.intervalMs());
+            this.timer.unref?.();
+            void this.poll();
+        }
+        return () => {
+            this.observers.delete(observer);
+            if (this.observers.size === 0)
+                this.stop();
+        };
+    }
+    stop() {
+        this.epoch += 1;
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+        this.latest.clear();
+        this.observers.clear();
+    }
+    poll() {
+        if (this.pending)
+            return this.pending;
+        const epoch = this.epoch;
+        this.pending = Promise.resolve().then(this.sample).then(events => {
+            if (epoch !== this.epoch)
+                return;
+            for (const event of events) {
+                const signature = JSON.stringify(event);
+                if (this.latest.get(event.type)?.signature === signature)
+                    continue;
+                this.latest.set(event.type, { event, signature });
+                for (const observer of this.observers) {
+                    try {
+                        observer(event);
+                    }
+                    catch (error) {
+                        this.onError(error);
+                    }
+                }
+            }
+        }).catch(this.onError).finally(() => { this.pending = null; });
+        return this.pending;
+    }
+}

package/dist/server/utils/terminalOutputDelivery.js

@@ -8,6 +8,7 @@ export class TerminalOutputDelivery {
     active = true;
     replaying = true;
     needsReplay = false;
+    paused = false;
     queue = [];
     queuedBytes = 0;
     outstanding = [];
@@ -30,6 +31,12 @@ export class TerminalOutputDelivery {
         }
         return changed;
     }
+    /** Short flow-control pauses retain the ordered stream within its budget.
+     * Unlike an unsubscribe, they do not discard output or require a new PTY. */
+    setPaused(paused) {
+        this.paused = paused;
+        this.flush();
+    }
     enqueue(frame) {
         if (!this.active || this.needsReplay)
             return;
@@ -68,7 +75,7 @@ export class TerminalOutputDelivery {
     }
     get pendingBytes() { return this.queuedBytes + this.outstandingBytes; }
     flush() {
-        if (!this.active || this.replaying || this.needsReplay)
+        if (!this.active || this.paused || this.replaying || this.needsReplay)
             return;
         while (this.queue.length && (!this.flowControl || this.outstandingBytes < this.windowBytes)) {
             const frame = this.queue.shift();

package/dist/server/utils/tmuxMetadataWriter.js

@@ -0,0 +1,61 @@
+export function batchTmuxOptions(name, options) {
+    const args = [];
+    // tmux parses a trailing semicolon as a command separator even when argv
+    // came from execFile. Escape data arguments, leaving our separators intact.
+    const literal = (value) => value.endsWith(';') ? `${value.slice(0, -1)}\\;` : value;
+    for (const [key, value] of Object.entries(options)) {
+        if (args.length)
+            args.push(';');
+        args.push('set-option', '-t', literal(name), key, literal(value));
+    }
+    return args;
+}
+/** Deduplicate across observers and inventory. Keep only the newest desired
+ * state during a slow write; commit the snapshot only after a successful write. */
+export class TmuxMetadataWriter {
+    write;
+    heartbeatMs;
+    states = new Map();
+    constructor(write, heartbeatMs = 30_000) {
+        this.write = write;
+        this.heartbeatMs = heartbeatMs;
+    }
+    sync(name, metadata) {
+        let state = this.states.get(name);
+        if (!state) {
+            state = { desired: metadata, at: 0 };
+            this.states.set(name, state);
+        }
+        state.desired = metadata;
+        if (state.pending)
+            return state.pending;
+        const current = state;
+        current.pending = Promise.resolve().then(async () => {
+            while (this.states.get(name) === current) {
+                const desired = current.desired;
+                const signature = JSON.stringify(desired);
+                const changed = signature !== current.written;
+                const now = Date.now();
+                if (!changed && now - current.at < this.heartbeatMs)
+                    return;
+                await this.write(name, {
+                    ...(changed ? {
+                        '@termdock-label': desired.label,
+                        '@termdock-program': desired.program ?? '',
+                        '@termdock-cwd': desired.cwd ?? '',
+                    } : {}),
+                    '@termdock-last-active-at': String(now),
+                });
+                current.written = signature;
+                current.at = now;
+            }
+        }).finally(() => { current.pending = undefined; });
+        return current.pending;
+    }
+    retain(names) {
+        for (const name of this.states.keys())
+            if (!names.has(name))
+                this.states.delete(name);
+    }
+    forget(name) { this.states.delete(name); }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.295",
+  "version": "1.4.297",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",
@@ -57,6 +57,7 @@
     "@libp2p/peer-id": "6.0.0",
     "@libp2p/utils": "7.0.7",
     "@noble/hashes": "2.4.0",
+    "@novnc/novnc": "^1.7.0",
     "@serenity-kit/opaque": "1.1.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/csurf": "^1.11.5",
@@ -80,6 +81,7 @@
     "dompurify": "^3.4.14",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
+    "guacamole-common-js": "^1.5.0",
     "heic-convert": "^2.1.0",
     "katex": "^0.17.0",
     "lucide-react": "^1.17.0",
@@ -108,6 +110,7 @@
     "@testing-library/user-event": "^14.5.0",
     "@types/busboy": "^1.5.4",
     "@types/express": "^4.17.21",
+    "@types/guacamole-common-js": "^1.5.5",
     "@types/heic-convert": "^2.1.1",
     "@types/node": "^20.11.0",
     "@types/react": "^18.2.0",

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.295",
+  "version": "1.4.297",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
-  "dependencyHash": "sha256-+FK03eSUIISxxpGNQTlYLuAcpuytFuT+tiLAMYVhwl4=",
-  "serverBundleHash": "sha256-iYtS9ldvYzDUfLm6SANDq/7AB44OIdxy6W8a0qifjnA=",
-  "clientBundleHash": "sha256-0e7BcPx6z10Icj/9eD88DchjikmrZqCXJ+wgQ8d7lkw=",
+  "dependencyHash": "sha256-E9GDa4nrCXADRXdyPKufusZt6IcCr4m2mGdx5h34KMQ=",
+  "serverBundleHash": "sha256-3VqbogIbygH3YPQHa9IyJIP/n0q0heoRoeYit4ahVs0=",
+  "clientBundleHash": "sha256-NncnQcLTlh41QmOg641M52b31XtLTqRYlKA4THOcVEY=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }