termdock 1.4.340 → 1.4.342

package/dist/server/federation/webTransportCertificate.js

@@ -0,0 +1,52 @@
+import { X509Certificate, createPrivateKey, createPublicKey, randomBytes, webcrypto } from 'node:crypto';
+import { readFile, writeFile, rename, chmod, mkdir, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+function inspect(value, now) {
+    const cert = new X509Certificate(value.cert);
+    const key = createPrivateKey(value.key);
+    if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1'
+        || !createPublicKey(key).export({ type: 'spki', format: 'der' }).equals(cert.publicKey.export({ type: 'spki', format: 'der' })))
+        throw new Error('Invalid QUIC certificate key');
+    const expiresAt = Date.parse(cert.validTo), startsAt = Date.parse(cert.validFrom);
+    if (!Number.isFinite(expiresAt) || startsAt > now || expiresAt - startsAt > 14 * 86400_000 || expiresAt < now + 2 * 86400_000)
+        throw new Error('QUIC certificate needs renewal');
+    return { ...value, hash: cert.fingerprint256.replaceAll(':', '').toLowerCase(), expiresAt };
+}
+/** Browsers require short-lived ECDSA certificates for hash-pinned QUIC.
+ * Their public hash is delivered through the already authenticated Noise link;
+ * the normal HTTPS certificate/CA is unchanged. */
+export async function transportCertificate(directory, now = Date.now()) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const file = join(directory, 'quic-certificate.json');
+    try {
+        const stored = JSON.parse(await readFile(file, 'utf8'));
+        const result = inspect(stored, now);
+        await chmod(file, 0o600);
+        return result;
+    }
+    catch { /* Missing, invalid or expiring certificates are replaced atomically. */ }
+    await import('reflect-metadata');
+    const x509 = await import('@peculiar/x509');
+    const keys = await webcrypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+    const cert = await x509.X509CertificateGenerator.createSelfSigned({
+        serialNumber: randomBytes(16).toString('hex'), name: 'CN=Termdock QUIC',
+        notBefore: new Date(now - 60_000), notAfter: new Date(now + 13 * 86400_000),
+        signingAlgorithm: { name: 'ECDSA', hash: 'SHA-256' }, keys: keys,
+        extensions: [new x509.BasicConstraintsExtension(false), new x509.SubjectAlternativeNameExtension([
+                { type: 'dns', value: 'localhost' }, { type: 'ip', value: '127.0.0.1' }, { type: 'ip', value: '::1' },
+            ])],
+    }, webcrypto);
+    const exported = Buffer.from(await webcrypto.subtle.exportKey('pkcs8', keys.privateKey));
+    const key = `-----BEGIN PRIVATE KEY-----\n${exported.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END PRIVATE KEY-----\n`;
+    const value = { cert: cert.toString('pem'), key };
+    const temp = `${file}.${randomBytes(8).toString('hex')}.tmp`;
+    try {
+        await writeFile(temp, JSON.stringify(value), { mode: 0o600, flag: 'wx' });
+        await rename(temp, file);
+    }
+    catch (error) {
+        await unlink(temp).catch(() => { });
+        throw error;
+    }
+    return inspect(value, now);
+}

package/dist/server/federation/webTransportProtocol.js

@@ -0,0 +1,25 @@
+export const WEBTRANSPORT_PATH = '/api/federation/transport';
+export const WEBTRANSPORT_CONNECT_TIMEOUT_MS = 4000;
+export const WEBTRANSPORT_STREAM_TIMEOUT_MS = 4000;
+export const WEBTRANSPORT_MAX_STREAMS = 128;
+export function readWebTransportDescriptor(value, now = Date.now()) {
+    if (!value || typeof value !== 'object')
+        return;
+    const d = value;
+    if (d.version !== 1 || d.path !== WEBTRANSPORT_PATH || !Number.isSafeInteger(d.port) || d.port < 1 || d.port > 65535
+        || typeof d.certificateHash !== 'string' || !/^[a-f0-9]{64}$/.test(d.certificateHash)
+        || !Number.isSafeInteger(d.expiresAt) || d.expiresAt <= now || d.expiresAt > now + 14 * 86400_000)
+        return;
+    return { version: 1, path: WEBTRANSPORT_PATH, port: d.port, certificateHash: d.certificateHash, expiresAt: d.expiresAt };
+}
+/** Cancel the operation, including late arrivals, rather than leaving a timed
+ * out stream/handshake attached to a live session. */
+export async function abortable(promise, signal, cancel) {
+    return new Promise((resolve, reject) => {
+        const abort = () => { cancel(); reject(signal.reason ?? new Error('Transport aborted')); };
+        signal.addEventListener('abort', abort, { once: true });
+        void promise.then(value => { signal.removeEventListener('abort', abort); resolve(value); }, error => { signal.removeEventListener('abort', abort); reject(error); });
+        if (signal.aborted)
+            abort();
+    });
+}

package/dist/server/federation/webTransportServer.js

@@ -0,0 +1,142 @@
+import { randomBytes } from 'node:crypto';
+import { streamDuplex } from './streamDuplex.js';
+import { transportCertificate } from './webTransportCertificate.js';
+import { WEBTRANSPORT_PATH, WEBTRANSPORT_MAX_STREAMS } from './webTransportProtocol.js';
+export async function startWebTransportServer(options) {
+    // Optional native support must not become a static build/runtime dependency
+    // on platforms without a QUICHE binary. The upstream exports map also lacks
+    // a top-level TypeScript condition; keep our small adapter contract explicit.
+    const moduleName = '@fails-components/webtransport';
+    const implementation = await import(moduleName);
+    await implementation.quicheLoaded;
+    let certificate = await transportCertificate(options.directory);
+    const raw = new implementation.Http3Server({ host: options.host, port: options.port,
+        cert: certificate.cert, privKey: certificate.key, secret: randomBytes(32).toString('hex'),
+        initialStreamFlowControlWindow: 256 * 1024, initialSessionFlowControlWindow: 4 * 1024 * 1024,
+        streamShouldAutoTuneReceiveWindow: true, streamFlowControlWindowSizeLimit: 2 * 1024 * 1024,
+        sessionShouldAutoTuneReceiveWindow: true, sessionFlowControlWindowSizeLimit: 8 * 1024 * 1024,
+        initialBidirectionalReceiveStreams: WEBTRANSPORT_MAX_STREAMS,
+    });
+    const sessions = new Set();
+    const streams = new Set();
+    let stopped = false;
+    let nativeStopped = false;
+    let rotation;
+    const stopNative = () => {
+        if (nativeStopped)
+            return;
+        try {
+            raw.stopServer();
+            nativeStopped = true;
+        }
+        catch { /* Still initializing. */ }
+    };
+    const close = () => {
+        if (stopped)
+            return;
+        stopped = true;
+        clearInterval(rotation);
+        for (const stream of streams)
+            stream.close?.(new Error('QUIC server stopped'));
+        for (const session of sessions)
+            session.close({ closeCode: 0, reason: 'Service restarting' });
+        // Let RESET_STREAM / CONNECTION_CLOSE reach UDP before destroying the
+        // native socket. Closing it in the same turn strands peers until idle timeout.
+        const drain = () => { setTimeout(stopNative, 100).unref(); };
+        drain();
+        void raw.ready.then(drain, () => { });
+    };
+    raw.setRequestCallback(async ({ header }) => ({
+        path: WEBTRANSPORT_PATH,
+        status: !stopped && sessions.size < 64 && header[':path'] === WEBTRANSPORT_PATH
+            && options.hostAllowed(header[':authority']) && options.originAllowed(header.origin, header[':authority']) ? 200 : 403,
+    }));
+    const incoming = raw.sessionStream(WEBTRANSPORT_PATH).getReader();
+    async function serve(session) {
+        if (stopped || sessions.size >= 64) {
+            session.close({ closeCode: 1, reason: 'Connection limit' });
+            return;
+        }
+        sessions.add(session);
+        const own = new Set();
+        const cleanup = () => {
+            sessions.delete(session);
+            for (const duplex of own)
+                duplex.close?.(new Error('QUIC session closed'));
+        };
+        void session.closed.then(cleanup, cleanup);
+        await session.ready;
+        const reader = session.incomingBidirectionalStreams.getReader();
+        try {
+            while (!stopped) {
+                const { done, value } = await reader.read();
+                if (done)
+                    return;
+                const duplex = streamDuplex(value);
+                if (own.size >= WEBTRANSPORT_MAX_STREAMS || streams.size >= 256) {
+                    duplex.close?.(new Error('Stream limit'));
+                    continue;
+                }
+                own.add(duplex);
+                streams.add(duplex);
+                const context = { allowOpenAccess: options.openAccessAllowed(session.header?.origin, session.header?.[':authority']), singleOperation: true };
+                void options.accept(duplex, context).catch(() => duplex.close?.(new Error('Secure stream failed')))
+                    .finally(() => { own.delete(duplex); streams.delete(duplex); });
+            }
+        }
+        finally {
+            reader.releaseLock();
+            cleanup();
+        }
+    }
+    void (async () => {
+        try {
+            while (!stopped) {
+                const { done, value } = await incoming.read();
+                if (done)
+                    return;
+                void serve(value).catch(() => value.close({ closeCode: 1, reason: 'Invalid stream' }));
+            }
+        }
+        catch { /* Native shutdown ends this reader. */ }
+        finally {
+            incoming.releaseLock();
+        }
+    })();
+    void raw.closed.then(close, close);
+    raw.startServer();
+    let timer;
+    try {
+        await Promise.race([raw.ready, new Promise((_resolve, reject) => { timer = setTimeout(() => reject(new Error('QUIC listener startup timed out')), 5000); })]);
+        const port = raw.address()?.port;
+        if (!port)
+            throw new Error('QUIC listener has no port');
+        rotation = setInterval(() => {
+            if (certificate.expiresAt > Date.now() + 3 * 86400_000)
+                return;
+            void transportCertificate(options.directory).then(next => {
+                if (stopped || next.hash === certificate.hash)
+                    return;
+                raw.updateCert(next.cert, next.key, false);
+                certificate = next;
+            }).catch(() => { });
+        }, 60 * 60_000);
+        rotation.unref();
+        return {
+            close,
+            descriptor() {
+                return stopped || certificate.expiresAt <= Date.now() ? undefined : {
+                    version: 1, port, path: WEBTRANSPORT_PATH, certificateHash: certificate.hash, expiresAt: certificate.expiresAt,
+                };
+            },
+            stats: () => ({ sessions: sessions.size, streams: streams.size }),
+        };
+    }
+    catch (error) {
+        close();
+        throw error;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.340",
+  "version": "1.4.342",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",
@@ -65,6 +65,7 @@
     "@libp2p/utils": "7.0.7",
     "@noble/hashes": "2.4.0",
     "@novnc/novnc": "^1.7.0",
+    "@peculiar/x509": "2.2.0",
     "@serenity-kit/opaque": "1.1.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/csurf": "^1.11.5",
@@ -100,6 +101,7 @@
     "react": "^18.2.0",
     "react-diff-view": "^3.3.3",
     "react-dom": "^18.2.0",
+    "reflect-metadata": "0.2.2",
     "refractor": "^2.10.1",
     "swiper": "^12.1.3",
     "tailwind-merge": "^2.2.0",
@@ -167,5 +169,9 @@
   },
   "overrides": {
     "prismjs": "^1.30.0"
+  },
+  "optionalDependencies": {
+    "@fails-components/webtransport": "1.6.11",
+    "@fails-components/webtransport-transport-http3-quiche": "1.6.11"
   }
 }

package/runtime-manifest.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.340",
+  "version": "1.4.342",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
-  "dependencyHash": "sha256-oaGYi/P5ob8sd6VnNBOwshKozjhdV+hYiCmLAsn5x00=",
-  "serverBundleHash": "sha256-LIbvwRq5T1njqAx8n6UKXDMyONxJ3AClU14bfAXyyp4=",
-  "clientBundleHash": "sha256-YYCQf7gPLt84sOKrocwfUaUEv6PgkB2spzYsZn4g+Wk=",
+  "dependencyHash": "sha256-4fjVNH4wSrTRkRTd373WiwHrjn1w8wGVCOPGWBDE+p4=",
+  "serverBundleHash": "sha256-u2oE9LHPmLuBPDnhWHwPC7AgpKHVlrOntYy2PGv3SE0=",
+  "clientBundleHash": "sha256-ESkzBb4GaJ0ikUX3PasxphJNnbX6BdYPA1BuougA0IQ=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }