termdock 1.4.341 → 1.4.342

package/dist/client/sw.js

@@ -1 +1 @@
-if(!self.define){let e,s={};const n=(n,i)=>(n=new URL(n+".js",i).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(i,a)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let r={};const c=e=>n(e,o),d={module:{uri:o},exports:r,require:c};s[o]=Promise.all(i.map(e=>d[e]||c(e))).then(e=>(a(...e),r))}}define(["./workbox-9845bf53"],function(e){"use strict";importScripts("sw-encrypted-background.js","sw-notifications.js","sw-secure-api.js","sw-downloads.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"index.html",revision:"e34a208e8afdf5687993c6320422767a"},{url:"assets/app-DIurxlSe.js",revision:null},{url:"assets/react-XDCjal2T.js",revision:null},{url:"assets/dnd-BCFAPC0L.js",revision:null},{url:"assets/terminal-C7X98Amf.js",revision:null},{url:"assets/index-A-ZC9mbr.css",revision:null},{url:"icons/agents/opencode.svg",revision:"851c2931d95821ba2b39b68587b48976"},{url:"icons/agents/kimi.svg",revision:"5366c710f4f763022fe159a69cf17409"},{url:"icons/agents/grok.svg",revision:"cd745b0b964545bc7a6b4f36021c3298"},{url:"icons/agents/goose.svg",revision:"c79b927278983c19098d77b4b0c11ab3"},{url:"icons/agents/gemini.svg",revision:"7a64f6d6f80a908255e9c0256903882e"},{url:"icons/agents/droid.svg",revision:"f28723b8c5c115e0908ba3c72613e256"},{url:"icons/agents/cursor.svg",revision:"a1528f3d3cda497f75a5db28defb19de"},{url:"icons/agents/copilot.svg",revision:"dd52e96c1eac0b6ec4bedcd0ddd3b52d"},{url:"icons/agents/codex.svg",revision:"608e55babb0b217e1f2da287342b46d3"},{url:"icons/agents/claude.svg",revision:"08af0225b7acdd8e8f573f3247e5e1c3"},{url:"icons/agents/amp.svg",revision:"af12f8b33faa81e4d46ea7b93c7e43f3"},{url:"apple-touch-icon-180x180.png",revision:"628c2e2f28a9b545aa57be1352025643"},{url:"boot-logo.png",revision:"2e3a25efd9b0b8ca1eab53b5f2284556"},{url:"favicon.ico",revision:"2994debfa6f59a0898e24eb0c54d64b5"},{url:"ipad-status-bar.js",revision:"3a8080edb8a5cc658a7908f6ad69537f"},{url:"maskable-icon-512x512.png",revision:"4d489331fd81f0713c400b26426442b9"},{url:"pwa-192x192.png",revision:"4d6f899888cfb8ccd7a1fd3c9e583ad2"},{url:"pwa-512x512.png",revision:"0885dd7ec8932e7f878b013d51a380a4"},{url:"robots.txt",revision:"d9339907142917dee4aac78494ac9cfe"},{url:"sw-downloads.js",revision:"48dab2e78bd93b4eee27fca487eccfde"},{url:"sw-notifications.js",revision:"fde578590ea8b0540d488ef448b48f45"},{url:"sw-secure-api.js",revision:"cf2bdbd03d41d66d60344c0b5a1075de"},{url:"manifest.webmanifest",revision:"83f9a43b74c236012adafb077fb6d774"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("index.html"),{denylist:[/^\/api\//,/^\/__termdock-download\//,/^\/health$/]})),e.registerRoute(/\/assets\/.*\.(?:js|css)$/,new e.CacheFirst({cacheName:"termdock-lazy-assets-v1",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:96,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/terminal\/[^/]+-[a-f0-9]{12}\.woff2$/,new e.CacheFirst({cacheName:"termdock-fonts-v2",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:384,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/.*\.(?:woff2|ttf)$/,new e.StaleWhileRevalidate({cacheName:"termdock-fonts-v1",plugins:[new e.ExpirationPlugin({maxEntries:24,maxAgeSeconds:2592e3})]}),"GET")});
+if(!self.define){let e,s={};const n=(n,i)=>(n=new URL(n+".js",i).href,s[n]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=s,document.head.appendChild(e)}else e=n,importScripts(n),s()}).then(()=>{let e=s[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(i,a)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let r={};const c=e=>n(e,o),d={module:{uri:o},exports:r,require:c};s[o]=Promise.all(i.map(e=>d[e]||c(e))).then(e=>(a(...e),r))}}define(["./workbox-9845bf53"],function(e){"use strict";importScripts("sw-encrypted-background.js","sw-notifications.js","sw-secure-api.js","sw-downloads.js"),self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"index.html",revision:"3a82afb4a898c5c563748bbe9a5f4920"},{url:"assets/app-By1Q_guu.js",revision:null},{url:"assets/react-XDCjal2T.js",revision:null},{url:"assets/dnd-BCFAPC0L.js",revision:null},{url:"assets/terminal-C7X98Amf.js",revision:null},{url:"assets/index-A-ZC9mbr.css",revision:null},{url:"icons/agents/opencode.svg",revision:"851c2931d95821ba2b39b68587b48976"},{url:"icons/agents/kimi.svg",revision:"5366c710f4f763022fe159a69cf17409"},{url:"icons/agents/grok.svg",revision:"cd745b0b964545bc7a6b4f36021c3298"},{url:"icons/agents/goose.svg",revision:"c79b927278983c19098d77b4b0c11ab3"},{url:"icons/agents/gemini.svg",revision:"7a64f6d6f80a908255e9c0256903882e"},{url:"icons/agents/droid.svg",revision:"f28723b8c5c115e0908ba3c72613e256"},{url:"icons/agents/cursor.svg",revision:"a1528f3d3cda497f75a5db28defb19de"},{url:"icons/agents/copilot.svg",revision:"dd52e96c1eac0b6ec4bedcd0ddd3b52d"},{url:"icons/agents/codex.svg",revision:"608e55babb0b217e1f2da287342b46d3"},{url:"icons/agents/claude.svg",revision:"08af0225b7acdd8e8f573f3247e5e1c3"},{url:"icons/agents/amp.svg",revision:"af12f8b33faa81e4d46ea7b93c7e43f3"},{url:"apple-touch-icon-180x180.png",revision:"628c2e2f28a9b545aa57be1352025643"},{url:"boot-logo.png",revision:"2e3a25efd9b0b8ca1eab53b5f2284556"},{url:"favicon.ico",revision:"2994debfa6f59a0898e24eb0c54d64b5"},{url:"ipad-status-bar.js",revision:"3a8080edb8a5cc658a7908f6ad69537f"},{url:"maskable-icon-512x512.png",revision:"4d489331fd81f0713c400b26426442b9"},{url:"pwa-192x192.png",revision:"4d6f899888cfb8ccd7a1fd3c9e583ad2"},{url:"pwa-512x512.png",revision:"0885dd7ec8932e7f878b013d51a380a4"},{url:"robots.txt",revision:"d9339907142917dee4aac78494ac9cfe"},{url:"sw-downloads.js",revision:"48dab2e78bd93b4eee27fca487eccfde"},{url:"sw-notifications.js",revision:"fde578590ea8b0540d488ef448b48f45"},{url:"sw-secure-api.js",revision:"cf2bdbd03d41d66d60344c0b5a1075de"},{url:"manifest.webmanifest",revision:"83f9a43b74c236012adafb077fb6d774"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("index.html"),{denylist:[/^\/api\//,/^\/__termdock-download\//,/^\/health$/]})),e.registerRoute(/\/assets\/.*\.(?:js|css)$/,new e.CacheFirst({cacheName:"termdock-lazy-assets-v1",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:96,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/terminal\/[^/]+-[a-f0-9]{12}\.woff2$/,new e.CacheFirst({cacheName:"termdock-fonts-v2",plugins:[new e.CacheableResponsePlugin({statuses:[0,200]}),new e.ExpirationPlugin({maxEntries:384,maxAgeSeconds:2592e3})]}),"GET"),e.registerRoute(/\/fonts\/.*\.(?:woff2|ttf)$/,new e.StaleWhileRevalidate({cacheName:"termdock-fonts-v1",plugins:[new e.ExpirationPlugin({maxEntries:24,maxAgeSeconds:2592e3})]}),"GET")});

package/dist/server/entry.js

@@ -11,6 +11,7 @@ import { createPasswordLoginRouter } from './federation/passwordLoginRoutes.js';
 import { apiAccessGate, isTrustedLocalRequest } from './utils/apiAccess.js';
 import { isEncryptedRequest } from './federation/requestContext.js';
 import { createFederationRuntime } from './federation/runtime.js';
+import { startWebTransportServer } from './federation/webTransportServer.js';
 import { RouteAccess } from './federation/routeAccess.js';
 import { RouteInvitationStore } from './federation/routeInvitations.js';
 import { attachRegisteredDirectTargets, verifyDirectTarget } from './federation/directRoutes.js';
@@ -470,6 +471,9 @@ export function startServer(options = {}) {
         runtimeMonitor,
     });
     const { server, scheme } = createServerForApp(app, options);
+    let webTransport;
+    const webTransportDescriptor = () => webTransport?.descriptor();
+    server.once('close', () => webTransport?.close());
     const collaborationChannels = new Map();
     const reverseCollaboration = (id) => [...(collaborationChannels.get(id) ?? [])].find(rpc => !rpc.closed);
     let collaborationService;
@@ -515,6 +519,7 @@ export function startServer(options = {}) {
     const federation = createFederationRuntime(app, path.join(homedir(), '.termdock', 'federation'), {
         terminal: handleTerminalWebSocket, control: handleControlWebSocket, android: handleAndroidWebSocket, computer: handleComputerWebSocket,
     }, {
+        webTransport: webTransportDescriptor,
         resolveSessionId: resolveStableFederationSessionId,
         collaborationConnected: (subjectId, rpc) => {
             const channels = collaborationChannels.get(subjectId) ?? new Set();
@@ -727,29 +732,13 @@ export function startServer(options = {}) {
     certWatcher.start();
     let latestLocalAccessState = localAccessManager.getState();
     let latestOnboardingUrl = null;
-    // WebSocket for bidirectional terminal communication.
-    // Replaces SSE (server→client) + HTTP POST (client→server) with a single
-    // persistent connection per terminal session.
-    //
-    // perMessageDeflate: 终端输出是纯文本，压缩比通常 5-10x。弱网/跨城（高 RTT、
-    // 低带宽）下，刷新页面时 N 个终端各自一次性回放全量 scrollback（每个可达
-    // 100KB），未压缩会同时挤满链路、肉眼可见地卡几秒。开启压缩后带宽需求直接
-    // 降到 1/5~1/10。参数：
-    //  - threshold 1024：小于 1KB 的小包（按键回显等）不压缩，避免 CPU 浪费。
-    //  - concurrencyLimit：限制并发压缩任务，防止突发回放打满 CPU。
-    //  - zlib memLevel 7 + level 6：在压缩比和内存/CPU 间取均衡，避免每连接
-    //    分配过大 zlib 上下文（默认 memLevel 8 内存更高）。
-    //  - serverNoContextTakeover：每条消息独立压缩上下文，降低长连接常驻内存。
+    // Both public WebSocket endpoints carry Noise ciphertext. Compress eligible
+    // terminal records before encryption instead of spending CPU deflating random
+    // ciphertext (including at relay hops).
     const wss = new WebSocketServer({
         noServer: true,
         maxPayload: 1024 * 1024,
-        perMessageDeflate: {
-            threshold: 1024,
-            concurrencyLimit: 10,
-            serverNoContextTakeover: true,
-            clientNoContextTakeover: true,
-            zlibDeflateOptions: { level: 6, memLevel: 7 },
-        },
+        perMessageDeflate: false,
     });
     server.on('upgrade', (request, socket, head) => {
         if (wss.clients.size >= 256) {
@@ -815,6 +804,26 @@ export function startServer(options = {}) {
         const displayHost = host === '0.0.0.0' ? 'localhost' : host;
         console.log(`Termdock server running at ${scheme}://${displayHost}:${listeningPort}`);
         console.log(`Health check: ${scheme}://${displayHost}:${listeningPort}/health`);
+        if ((options.quic ?? process.env.TERMDOCK_QUIC !== '0') && (scheme === 'https' || process.env.TERMDOCK_PUBLIC_ORIGIN?.startsWith('https://'))) {
+            const quicPort = process.env.TERMDOCK_QUIC_PORT === undefined ? listeningPort : Number(process.env.TERMDOCK_QUIC_PORT);
+            void federation.then(async (runtime) => {
+                if (!Number.isSafeInteger(quicPort) || quicPort < 1 || quicPort > 65535)
+                    throw new Error('Invalid TERMDOCK_QUIC_PORT');
+                const transport = await startWebTransportServer({
+                    directory: path.join(homedir(), '.termdock', 'federation'), host: listeningHost, port: quicPort,
+                    hostAllowed: isAllowedHost,
+                    originAllowed: (origin, authority) => secureChannelOriginAllowed(origin, () => isUpgradeOriginAllowed(origin, authority)),
+                    openAccessAllowed: (origin, authority) => !!origin && isUpgradeOriginAllowed(origin, authority),
+                    accept: (duplex, context) => runtime.acceptDuplex(duplex, context),
+                });
+                if (!server.listening) {
+                    transport.close();
+                    return;
+                }
+                webTransport = transport;
+                console.log(`QUIC/WebTransport listening on UDP ${quicPort}; independent encrypted streams enabled`);
+            }).catch(error => console.warn('[quic] Encrypted WebSocket remains available:', error instanceof Error ? error.message : 'Transport unavailable'));
+        }
         const onboardingServerState = scheme === 'https'
             ? startOnboardingServer({ httpsPort: listeningPort, caCertPath: options.httpsCaPath })
             : { server: null, url: null };

package/dist/server/federation/binaryPacket.js

@@ -0,0 +1,28 @@
+import { TRANSFER_CHUNK_BYTES } from './transferWindow.js';
+export const BINARY_RECORD_FLAG = 0x80000000;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder('utf-8', { fatal: true });
+/** Negotiated file chunks avoid JSON/base64 expansion; the entire record,
+ * including its stream id and kind, is still encrypted by Noise. */
+export function binaryPacketBody(packet) {
+    if (!(packet.bytes instanceof Uint8Array))
+        return;
+    if (!['upload', 'chunk'].includes(packet.type))
+        throw new Error('Invalid binary record type');
+    const id = encoder.encode(packet.id);
+    if (!id.length || id.length > 128 || packet.bytes.length > TRANSFER_CHUNK_BYTES)
+        throw new Error('Invalid binary record size');
+    const result = new Uint8Array(2 + id.length + packet.bytes.length);
+    result[0] = packet.type === 'upload' ? 1 : 2;
+    result[1] = id.length;
+    result.set(id, 2);
+    result.set(packet.bytes, 2 + id.length);
+    return result;
+}
+export function readBinaryPacket(body) {
+    const kind = body[0], idLength = body[1];
+    if (![1, 2].includes(kind) || !idLength || idLength > 128 || body.length < 2 + idLength
+        || body.length - 2 - idLength > TRANSFER_CHUNK_BYTES)
+        throw new Error('Invalid binary record');
+    return { type: kind === 1 ? 'upload' : 'chunk', id: decoder.decode(body.subarray(2, 2 + idLength)), bytes: body.slice(2 + idLength) };
+}

package/dist/server/federation/packets.js

@@ -1,3 +1,5 @@
+import { compressRecord } from './recordCompression.js';
+import { BINARY_RECORD_FLAG, binaryPacketBody, readBinaryPacket } from './binaryPacket.js';
 /** Bounded queues are also used at the untrusted, pre-handshake boundary. */
 export class AsyncQueue {
     limit;
@@ -62,6 +64,7 @@ export class PacketChannel {
     outgoing = new AsyncQueue(256);
     outgoingBytes = 0;
     queuedBytesById = new Map();
+    writeWaiters = new Set();
     closed = false;
     get hasPendingWrites() { return this.outgoingBytes > 0; }
     queuedBytesFor(id) { return this.queuedBytesById.get(id) ?? 0; }
@@ -72,7 +75,7 @@ export class PacketChannel {
         this.done = duplex.sink((async function* () {
             for await (const packet of self.outgoing) {
                 try {
-                    yield packet.bytes;
+                    yield packet.compress ? await compressRecord(packet.bytes, packet.id) : packet.bytes;
                 }
                 finally {
                     self.releaseQueuedPacket(packet);
@@ -81,27 +84,66 @@ export class PacketChannel {
         })());
         void this.done.then(() => this.discardPending(), error => this.discardPending(error instanceof Error ? error : new Error('Transport failed')));
     }
-    send(packet) {
+    send(packet, compress = false) {
+        if (this.closed)
+            throw new Error('Channel closed');
         // The item-count cap protects against floods of tiny records. Check it
         // before encoding and keep this queue alive when it is temporarily full.
         if (this.outgoing.size >= 256)
             throw new PacketQueueBackpressureError('Record queue item limit exceeded');
-        const body = encoder.encode(JSON.stringify(packet));
+        const binary = binaryPacketBody(packet);
+        const body = binary ?? encoder.encode(JSON.stringify(packet));
         if (body.length > MAX_PACKET)
             throw new Error('Record too large');
         const bytes = new Uint8Array(body.length + 4);
-        new DataView(bytes.buffer).setUint32(0, body.length);
+        new DataView(bytes.buffer).setUint32(0, binary ? body.length + BINARY_RECORD_FLAG : body.length);
         bytes.set(body, 4);
         if (this.outgoingBytes + bytes.byteLength > 4 * 1024 * 1024)
             throw new PacketQueueBackpressureError('Record queue byte budget exceeded');
-        const queued = { id: packet.id, bytes };
+        const queued = { id: packet.id, bytes, compress };
         if (!this.outgoing.tryPush(queued))
             throw new PacketQueueBackpressureError('Record queue item limit exceeded');
         this.outgoingBytes += bytes.byteLength;
         this.queuedBytesById.set(packet.id, this.queuedBytesFor(packet.id) + bytes.byteLength);
     }
+    /** Bulk producers wait below the hard cap, leaving room for input, ACKs and
+     * cancellation. A busy file stream must not tear down the shared connection. */
+    async sendBulk(packet, signal, beforeSend) {
+        const started = Date.now();
+        while (true) {
+            if (signal.aborted)
+                throw signal.reason ?? new Error('CANCELLED');
+            if (this.closed)
+                throw new Error('Channel closed');
+            if (this.outgoingBytes < 512 * 1024 && this.outgoing.size < 128) {
+                beforeSend?.();
+                try {
+                    this.send(packet);
+                    return;
+                }
+                catch (error) {
+                    if (!(error instanceof PacketQueueBackpressureError))
+                        throw error;
+                }
+            }
+            if (Date.now() - started >= 30_000)
+                throw new Error('Encrypted transport congested');
+            await new Promise((resolve, reject) => {
+                const cleanup = () => { clearTimeout(timer); signal.removeEventListener('abort', abort); this.writeWaiters.delete(wake); };
+                const abort = () => { cleanup(); reject(signal.reason ?? new Error('CANCELLED')); };
+                const wake = () => { cleanup(); resolve(); };
+                const timer = setTimeout(() => { cleanup(); reject(new Error('Encrypted transport congested')); }, Math.max(1, 30_000 - (Date.now() - started)));
+                this.writeWaiters.add(wake);
+                signal.addEventListener('abort', abort, { once: true });
+                if (signal.aborted)
+                    abort();
+            });
+        }
+    }
     releaseQueuedPacket(packet) {
         this.outgoingBytes = Math.max(0, this.outgoingBytes - packet.bytes.byteLength);
+        for (const wake of this.writeWaiters)
+            wake();
         const current = this.queuedBytesById.get(packet.id);
         if (current === undefined)
             return;
@@ -127,6 +169,8 @@ export class PacketChannel {
         this.outgoing.end(error);
         this.outgoingBytes = 0;
         this.queuedBytesById.clear();
+        for (const wake of this.writeWaiters)
+            wake();
         this.duplex.close?.(error);
     }
     async *read() {
@@ -135,6 +179,8 @@ export class PacketChannel {
         let bufferedBytes = 0;
         let spareBlock;
         const parseFrame = (frame) => {
+            if (frame[0] & 0x80)
+                return readBinaryPacket(frame.subarray(4));
             const packet = JSON.parse(decoder.decode(frame.subarray(4)));
             if (!packet || typeof packet !== 'object' || typeof packet.id !== 'string' || typeof packet.type !== 'string')
                 throw new Error('Invalid record');
@@ -232,7 +278,7 @@ export class PacketChannel {
             if (bufferedBytes + chunk.byteLength > MAX_BUFFERED_PACKET_BYTES)
                 throw new Error('Record buffer exceeded');
             if (bufferedBytes === 0 && chunk.byteLength >= 5) {
-                const size = ((chunk[0] * 0x1000000) + (chunk[1] << 16) + (chunk[2] << 8) + chunk[3]) >>> 0;
+                const size = (((chunk[0] & 0x7f) * 0x1000000) + (chunk[1] << 16) + (chunk[2] << 8) + chunk[3]) >>> 0;
                 if (size > MAX_PACKET || size === 0)
                     throw new Error('Invalid record size');
                 if (chunk.byteLength === size + 4) {
@@ -243,7 +289,7 @@ export class PacketChannel {
             if (chunk.byteLength)
                 append(chunk);
             while (bufferedBytes >= 4) {
-                const size = ((byteAt(0) * 0x1000000) + (byteAt(1) << 16) + (byteAt(2) << 8) + byteAt(3)) >>> 0;
+                const size = (((byteAt(0) & 0x7f) * 0x1000000) + (byteAt(1) << 16) + (byteAt(2) << 8) + byteAt(3)) >>> 0;
                 if (size > MAX_PACKET || size === 0)
                     throw new Error('Invalid record size');
                 if (bufferedBytes < size + 4)

package/dist/server/federation/recordCompression.js

@@ -0,0 +1,59 @@
+const MAX_RECORD_BYTES = 2 * 1024 * 1024;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder('utf-8', { fatal: true });
+async function transform(bytes, stream) {
+    const source = new Blob([bytes]).stream();
+    const reader = source.pipeThrough(stream).getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_RECORD_BYTES)
+                throw new Error('Expanded record exceeds budget');
+            chunks.push(value);
+        }
+    }
+    catch (error) {
+        await reader.cancel(error).catch(() => { });
+        throw error;
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const result = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+}
+/** Independent records avoid retaining compression dictionaries across messages.
+ * Only explicitly negotiated terminal output is eligible, before Noise encryption. */
+export async function compressRecord(frame, id) {
+    if (frame.byteLength < 4096 || typeof CompressionStream === 'undefined')
+        return frame;
+    const compressed = await transform(frame.subarray(4), new CompressionStream('gzip'));
+    let binary = '';
+    for (let offset = 0; offset < compressed.length; offset += 8192)
+        binary += String.fromCharCode(...compressed.subarray(offset, offset + 8192));
+    const body = encoder.encode(JSON.stringify({ type: 'compressed', id, encoding: 'gzip', data: btoa(binary) }));
+    // Account for base64 and the envelope: already compressed content goes as-is.
+    if (body.byteLength + 4 >= frame.byteLength * 0.9)
+        return frame;
+    const result = new Uint8Array(body.byteLength + 4);
+    new DataView(result.buffer).setUint32(0, body.byteLength);
+    result.set(body, 4);
+    return result;
+}
+export async function expandRecord(data) {
+    if (typeof data !== 'string' || data.length > Math.ceil(MAX_RECORD_BYTES / 3) * 4)
+        throw new Error('Invalid compressed record');
+    const bytes = Uint8Array.from(atob(data), c => c.charCodeAt(0));
+    const expanded = await transform(bytes, new DecompressionStream('gzip'));
+    return JSON.parse(decoder.decode(expanded));
+}

package/dist/server/federation/runtime.js

@@ -18,19 +18,22 @@ import { readTerminalHandshakeDimensions } from '../utils/terminalHandshakeDimen
 import { openAccessAllowed } from './openAccess.js';
 import { isAuthEnabled, getPasswordCredentialFingerprint, getPasswordVerifier, getLoginBlockMs, recordLoginFailure, recordLoginSuccess } from '../utils/authProtection.js';
 import { MAX_OPEN_SECURE_SOCKETS, MAX_SERVER_HTTP_REQUESTS } from './streamLimits.js';
+import { MAX_TRANSFER_WINDOW, TRANSFER_CHUNK_BYTES, TransferWindow, transferWindow } from './transferWindow.js';
 class LogicalSocket extends EventEmitter {
     channel;
     id;
     canRead;
+    compress;
     OPEN = 1;
     readyState = 1;
     get bufferedAmount() { return this.channel.queuedBytesFor(this.id); }
     maxQueuedBytes;
-    constructor(channel, id, canRead, maxQueuedBytes = 4 * 1024 * 1024) {
+    constructor(channel, id, canRead, maxQueuedBytes = 4 * 1024 * 1024, compress = false) {
         super();
         this.channel = channel;
         this.id = id;
         this.canRead = canRead;
+        this.compress = compress;
         this.maxQueuedBytes = maxQueuedBytes;
     }
     send(data) {
@@ -48,7 +51,7 @@ class LogicalSocket extends EventEmitter {
             return;
         }
         try {
-            this.channel.send({ type: 'ws-data', id: this.id, data });
+            this.channel.send({ type: 'ws-data', id: this.id, data }, this.compress);
         }
         catch {
             this.close(1013, 'Output consumer is too slow');
@@ -113,6 +116,11 @@ export async function createFederationRuntime(app, directory, handlers, options
         markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService);
         app(request, response);
     });
+    // The outer encrypted consumer can apply backpressure long after a local
+    // response was written. Expiring this private keepalive socket while Undici
+    // still drains it can truncate a slow download (UND_ERR_SOCKET / terminated).
+    // Let the local client expire idle connections after it finishes consuming.
+    internal.keepAliveTimeout = 0;
     await new Promise((resolve, reject) => { internal.once('error', reject); internal.listen(0, '127.0.0.1', resolve); });
     const address = internal.address();
     if (!address || typeof address === 'string')
@@ -132,7 +140,7 @@ export async function createFederationRuntime(app, directory, handlers, options
         const inventory = await response.json();
         return Array.isArray(inventory.clientSessions) ? inventory.clientSessions : [];
     }
-    async function accept(socket, context = {}) {
+    async function acceptDuplex(duplex, context = {}) {
         let collaborationRpc;
         let unregisterCollaboration;
         const open = (action) => openAccessAllowed(context.allowOpenAccess === true, isAuthEnabled(), action);
@@ -161,7 +169,7 @@ export async function createFederationRuntime(app, directory, handlers, options
         const sockets = new Map();
         let revokeTimer;
         try {
-            const secured = await secureConnection({ identity, duplex: socketDuplex(socket), initiator: false, signal: AbortSignal.timeout(15000) });
+            const secured = await secureConnection({ identity, duplex, initiator: false, signal: AbortSignal.timeout(15000) });
             const subjectId = secured.authenticatedPeerId;
             channel = new PacketChannel(secured.duplex);
             channels.add(channel);
@@ -225,28 +233,16 @@ export async function createFederationRuntime(app, directory, handlers, options
                             const { done, value } = await reader.read();
                             if (done)
                                 break;
-                            for (let offset = 0; offset < value.length; offset += 65536) {
+                            for (let offset = 0; offset < value.length; offset += TRANSFER_CHUNK_BYTES) {
                                 httpAllowed(operation.head);
-                                await new Promise((resolve, reject) => {
-                                    const cleanup = () => { clearTimeout(timeout); operation.abort.signal.removeEventListener('abort', abort); operation.ack = undefined; };
-                                    const timeout = setTimeout(() => { cleanup(); reject(new Error('CONSUMER_TIMEOUT')); }, 30000);
-                                    const abort = () => { cleanup(); reject(new Error('CANCELLED')); };
-                                    operation.abort.signal.addEventListener('abort', abort, { once: true });
-                                    operation.ack = () => { cleanup(); resolve(); };
-                                    if (operation.abort.signal.aborted) {
-                                        abort();
-                                        return;
-                                    }
-                                    try {
-                                        sendHttp({ type: 'chunk', id, data: toBase64(value.subarray(offset, offset + 65536)) });
-                                    }
-                                    catch (error) {
-                                        cleanup();
-                                        reject(error);
-                                    }
-                                });
+                                await operation.responseWindow.wait();
+                                httpAllowed(operation.head);
+                                operation.responseWindow.sent();
+                                const chunk = value.subarray(offset, offset + TRANSFER_CHUNK_BYTES);
+                                await channel.sendBulk({ type: 'chunk', id, ...(operation.head.binaryChunks === true ? { bytes: chunk } : { data: toBase64(chunk) }) }, operation.abort.signal, () => httpAllowed(operation.head));
                             }
                         }
+                    await operation.responseWindow.wait(true);
                     sendHttp({ type: 'end', id });
                 }
                 catch (error) {
@@ -393,7 +389,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                     }
                     else if (packet.type === 'permissions') {
                         const grants = store.listEffective({ subjectId, serviceId });
-                        send({ type: 'result', id: packet.id, subjectId, serviceId, fullService: full(subjectId), grants });
+                        send({ type: 'result', id: packet.id, subjectId, serviceId, fullService: full(subjectId), grants, httpWindow: MAX_TRANSFER_WINDOW, binaryChunks: true, webTransport: options.webTransport?.() });
                     }
                     else if (packet.type === 'session-list') {
                         const inventory = await sessionInventory();
@@ -515,13 +511,15 @@ export async function createFederationRuntime(app, directory, handlers, options
                         send({ type: 'result', id: packet.id, grant });
                     }
                     else if (packet.type === 'http') {
-                        if (operations.size >= MAX_SERVER_HTTP_REQUESTS || operations.has(packet.id) || sockets.has(packet.id))
+                        if ((context.singleOperation ? operations.size + sockets.size >= 1 : operations.size >= MAX_SERVER_HTTP_REQUESTS) || operations.has(packet.id) || sockets.has(packet.id))
                             throw new Error('STREAM_LIMIT');
                         httpAllowed(packet);
                         const upload = !['GET', 'HEAD'].includes(String(packet.method));
                         if (upload && uploadSlots >= 8)
                             throw new Error('UPLOAD_CONCURRENCY_LIMIT');
-                        const operation = { head: packet, body: new AsyncQueue(2), size: 0, abort: new AbortController(), state: 'uploading', updatedAt: Date.now(), uploadSlot: upload };
+                        const window = transferWindow(packet.window);
+                        const abort = new AbortController();
+                        const operation = { head: packet, body: new AsyncQueue(Math.max(2, window)), size: 0, abort, state: 'uploading', updatedAt: Date.now(), uploadSlot: upload, responseWindow: new TransferWindow(window, abort.signal) };
                         if (upload)
                             uploadSlots++;
                         operations.set(packet.id, operation);
@@ -530,13 +528,14 @@ export async function createFederationRuntime(app, directory, handlers, options
                     }
                     else if (packet.type === 'upload') {
                         const operation = operations.get(packet.id);
-                        if (!operation || operation.state !== 'uploading' || typeof packet.data !== 'string')
+                        if (!operation || operation.state !== 'uploading'
+                            || !(operation.head.binaryChunks === true && packet.bytes instanceof Uint8Array) && typeof packet.data !== 'string')
                             throw new Error('INVALID_UPLOAD');
                         httpAllowed(operation.head);
-                        const bytes = fromBase64(packet.data);
+                        const bytes = operation.head.binaryChunks === true && packet.bytes instanceof Uint8Array ? packet.bytes : fromBase64(packet.data);
                         operation.size += bytes.length;
                         const limit = new URL(String(operation.head.path), 'http://inner').pathname === '/api/terminal/fs/upload' ? 110 * 1024 * 1024 : 5 * 1024 * 1024;
-                        if (['GET', 'HEAD'].includes(String(operation.head.method)) || bytes.length > 65536 || operation.size > limit) {
+                        if (['GET', 'HEAD'].includes(String(operation.head.method)) || bytes.length > TRANSFER_CHUNK_BYTES || operation.size > limit) {
                             cancelHttp(operation);
                             operations.delete(packet.id);
                             throw new Error('UPLOAD_LIMIT');
@@ -561,10 +560,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                             void runHttp(packet.id, operation);
                     }
                     else if (packet.type === 'ack') {
-                        const operation = operations.get(packet.id);
-                        operation?.ack?.();
-                        if (operation)
-                            operation.ack = undefined;
+                        operations.get(packet.id)?.responseWindow.acknowledge();
                     }
                     else if (packet.type === 'cancel') {
                         const operation = operations.get(packet.id);
@@ -573,7 +569,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                         operations.delete(packet.id);
                     }
                     else if (packet.type === 'ws-open') {
-                        if (sockets.size >= MAX_OPEN_SECURE_SOCKETS || operations.has(packet.id) || sockets.has(packet.id))
+                        if ((context.singleOperation ? operations.size + sockets.size >= 1 : sockets.size >= MAX_OPEN_SECURE_SOCKETS) || operations.has(packet.id) || sockets.has(packet.id))
                             throw new Error('STREAM_LIMIT');
                         if (typeof packet.path !== 'string' || !isBusinessApiPath('GET', packet.path))
                             throw new Error('API_NOT_ALLOWED');
@@ -591,7 +587,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                         }
                         else
                             throw new Error('API_NOT_ALLOWED');
-                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]), match ? 1024 * 1024 : undefined);
+                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]), match ? 1024 * 1024 : undefined, !!match && packet.compression === 'gzip');
                         sockets.set(packet.id, { socket: logical, sessionId: match?.[1], android: Boolean(androidMatch), computer,
                             computerProtocol: computer ? url.searchParams.get('protocol') ?? 'vnc' : undefined });
                         logical.once('close', () => sockets.delete(packet.id));
@@ -665,7 +661,7 @@ export async function createFederationRuntime(app, directory, handlers, options
             }
         }
         catch {
-            socket.close(4003, 'Secure channel closed');
+            duplex.close?.(new Error('Secure channel closed'));
         }
         finally {
             unregisterCollaboration?.();
@@ -687,6 +683,8 @@ export async function createFederationRuntime(app, directory, handlers, options
             }
         }
     }
-    return { serviceId, identity, store, accept, close() { for (const channel of channels)
+    return { serviceId, identity, store, acceptDuplex,
+        accept(socket, context = {}) { return acceptDuplex(socketDuplex(socket), context); },
+        close() { for (const channel of channels)
             channel.close(); internal.close(); } };
 }

package/dist/server/federation/streamDuplex.js

@@ -0,0 +1,62 @@
+/** One reliable QUIC stream carries one independently authenticated Noise
+ * channel. Closing it never closes unrelated streams in the QUIC session. */
+export function streamDuplex(stream) {
+    const reader = stream.readable.getReader();
+    const writer = stream.writable.getWriter();
+    let closed = false;
+    let writingBytes = 0;
+    const close = (error) => {
+        if (closed)
+            return;
+        closed = true;
+        void reader.cancel(error).catch(() => { });
+        void (error ? writer.abort(error) : writer.close()).catch(() => { });
+    };
+    return {
+        close,
+        bufferedBytes: () => writingBytes,
+        source: {
+            async *[Symbol.asyncIterator]() {
+                try {
+                    while (!closed) {
+                        const { done, value } = await reader.read();
+                        if (done)
+                            return;
+                        if (!(value instanceof Uint8Array))
+                            throw new Error('Invalid transport stream bytes');
+                        yield value;
+                    }
+                }
+                finally {
+                    reader.releaseLock();
+                }
+            },
+        },
+        async sink(source) {
+            try {
+                for await (const chunk of source) {
+                    for (let offset = 0; offset < chunk.byteLength; offset += 64 * 1024) {
+                        if (closed)
+                            throw new Error('Transport stream closed');
+                        const bytes = chunk.subarray(offset, offset + 64 * 1024);
+                        writingBytes = bytes.byteLength;
+                        try {
+                            await writer.write(bytes);
+                        }
+                        finally {
+                            writingBytes = 0;
+                        }
+                    }
+                }
+                await writer.close();
+            }
+            catch (error) {
+                close(error instanceof Error ? error : new Error('Transport stream failed'));
+                throw error;
+            }
+            finally {
+                writer.releaseLock();
+            }
+        },
+    };
+}

package/dist/server/federation/transferWindow.js

@@ -0,0 +1,50 @@
+/** Application flow control inside Noise. Old peers retain one chunk in flight. */
+export const TRANSFER_CHUNK_BYTES = 64 * 1024;
+export const MAX_TRANSFER_WINDOW = 8;
+export function transferWindow(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 1
+        ? Math.min(value, MAX_TRANSFER_WINDOW) : 1;
+}
+/** One producer and ordered acknowledgements; unsolicited ACKs grant no credit. */
+export class TransferWindow {
+    limit;
+    signal;
+    outstanding = 0;
+    wake;
+    constructor(limit, signal) {
+        this.limit = limit;
+        this.signal = signal;
+    }
+    sent() {
+        if (this.outstanding >= this.limit)
+            throw new Error('Transfer window exceeded');
+        this.outstanding++;
+    }
+    acknowledge() {
+        if (this.outstanding === 0)
+            return;
+        this.outstanding--;
+        this.wake?.();
+    }
+    async wait(drained = false) {
+        while (true) {
+            if (this.signal.aborted)
+                throw this.signal.reason ?? new Error('CANCELLED');
+            if (this.outstanding < (drained ? 1 : this.limit))
+                return;
+            await new Promise((resolve, reject) => {
+                const cleanup = () => {
+                    clearTimeout(timer);
+                    this.signal.removeEventListener('abort', abort);
+                    this.wake = undefined;
+                };
+                const abort = () => { cleanup(); reject(this.signal.reason ?? new Error('CANCELLED')); };
+                const timer = setTimeout(() => { cleanup(); reject(new Error('CONSUMER_TIMEOUT')); }, 30_000);
+                this.wake = () => { cleanup(); resolve(); };
+                this.signal.addEventListener('abort', abort, { once: true });
+                if (this.signal.aborted)
+                    abort();
+            });
+        }
+    }
+}