termdock 1.4.351 → 1.4.353

package/dist/server/entry.js

@@ -52,10 +52,12 @@ import { isAllowedHost, isUpgradeOriginAllowed, validateHostMiddleware, validate
 import { getCookieSecurityOptions, setSecureCookieMode } from './utils/cookieSecurity.js';
 import { requestDeadlineMiddleware } from './utils/requestDeadline.js';
 import { RuntimeMonitor } from './utils/runtimeMonitor.js';
+import { serverCleanup } from './utils/serverCleanup.js';
 import { startOnboardingServer, stopOnboardingServer, getOnboardingServerUrl } from './onboardingServer.js';
 import { CertificateWatcher } from './certificateWatcher.js';
 import { startTermdockLogMaintenance, writeDiffTraceLog, writeErrorLog, writeJsonLog, writeTextLog, } from './utils/serverLogger.js';
-import { indexRetainedClientModules, pinBundledRuntimeClientDist } from './utils/runtimeClient.js';
+import { indexRetainedClientModules, pinBundledRuntimeClientDist, resolveRetainedClientModule } from './utils/runtimeClient.js';
+import { startGeneratedStorageMaintenance } from './utils/storageMaintenance.js';
 import { installCrashForensics } from './utils/crashForensics.js';
 import { getTermdockVersion, TERMDOCK_CAPABILITIES, TERMDOCK_PROTOCOL_VERSION, } from './utils/version.js';
 import { PORT, DEFAULT_HOST } from './config.js';
@@ -363,6 +365,7 @@ export function createApp(options = {}) {
     app.use('/api/computer', computerRoutes);
     if (fs.existsSync(bundledClientIndexPath)) {
         const clientPath = pinBundledRuntimeClientDist(bundledClientDistPath);
+        app.locals.runtimeClientPath = clientPath;
         const compression = createStaticCompressionMiddleware(clientPath);
         const staticFiles = express.static(clientPath, {
             setHeaders: (res, filePath, stat) => {
@@ -395,7 +398,7 @@ export function createApp(options = {}) {
         });
         const retainedModules = indexRetainedClientModules();
         app.get(/^\/assets\//, (req, res, next) => {
-            const retainedPath = retainedModules.get(req.path);
+            const retainedPath = resolveRetainedClientModule(retainedModules, req.path);
             if (!retainedPath) {
                 // Never cache a missing module or return the SPA HTML as JavaScript.
                 res.setHeader('Cache-Control', 'no-store');
@@ -403,7 +406,7 @@ export function createApp(options = {}) {
                 return;
             }
             setStaticCacheHeaders(req, res);
-            res.sendFile(retainedPath, error => {
+            res.sendFile(path.basename(retainedPath), { root: path.dirname(retainedPath) }, error => {
                 if (!error)
                     return;
                 if (res.headersSent)
@@ -414,7 +417,7 @@ export function createApp(options = {}) {
         });
         app.get(/^(?!\/api(?:\/|$)|\/health$|\/onboarding(?:\/|$)|\/ca(?:\/|$)).*/, (req, res) => {
             setStaticCacheHeaders(req, res);
-            res.sendFile(path.join(clientPath, 'index.html'));
+            res.sendFile('index.html', { root: clientPath });
         });
     }
     // Never expose parser errors, submitted passwords, or stack traces to callers.
@@ -471,9 +474,14 @@ export function startServer(options = {}) {
         runtimeMonitor,
     });
     const { server, scheme } = createServerForApp(app, options);
+    const onServerClose = serverCleanup(server);
+    if (typeof app.locals.runtimeClientPath === 'string')
+        onServerClose(startGeneratedStorageMaintenance({
+            stateDirectory: path.join(homedir(), '.termdock'), clientDirectory: app.locals.runtimeClientPath,
+        }));
     let webTransport;
     const webTransportDescriptor = () => webTransport?.descriptor();
-    server.once('close', () => webTransport?.close());
+    onServerClose(() => webTransport?.close());
     const collaborationChannels = new Map();
     const reverseCollaboration = (id) => [...(collaborationChannels.get(id) ?? [])].find(rpc => !rpc.closed);
     let collaborationService;
@@ -512,11 +520,11 @@ export function startServer(options = {}) {
     refreshDirectTargets();
     const desktopRoutesTimer = setInterval(refreshDirectTargets, 2000);
     desktopRoutesTimer.unref();
-    server.once('close', () => { clearInterval(desktopRoutesTimer); for (const target of dynamicDirectTargets.values())
+    onServerClose(() => { clearInterval(desktopRoutesTimer); for (const target of dynamicDirectTargets.values())
         target.close(); });
-    server.once('close', () => relayRouter.close());
-    server.once('close', () => { void stopAllScrcpySessions(); void androidRecordings.stopAll(); });
-    server.once('close', stopComputerBridges);
+    onServerClose(() => relayRouter.close());
+    onServerClose(() => { void stopAllScrcpySessions(); void androidRecordings.stopAll(); });
+    onServerClose(stopComputerBridges);
     const federation = createFederationRuntime(app, path.join(homedir(), '.termdock', 'federation'), {
         terminal: handleTerminalWebSocket, control: handleControlWebSocket, android: handleAndroidWebSocket, computer: handleComputerWebSocket,
     }, {
@@ -655,7 +663,7 @@ export function startServer(options = {}) {
                     messages: collaborationStore, taskStore: collaborationTaskStore, tasks: collaborationTasks, peers: collaborationService, sessions: integrationSessionAdapter });
                 await integration.listen();
                 app.locals.integrationRuntime = integration;
-                server.once('close', () => { void integration?.close(); });
+                onServerClose(() => { void integration?.close(); });
             }
             catch {
                 await integration?.close();
@@ -663,11 +671,11 @@ export function startServer(options = {}) {
             }
         }
         collaborationTasks.start();
-        server.once('close', () => collaborationTasks.close());
+        onServerClose(() => collaborationTasks.close());
         collaborationService.start();
-        server.once('close', () => collaborationService?.close());
+        onServerClose(() => collaborationService?.close());
         collaborationTransport.start();
-        server.once('close', () => collaborationTransport?.close());
+        onServerClose(() => collaborationTransport?.close());
         entrySubjectAllowed = subjectId => runtime.store.authorize({ subjectId, serviceId: runtime.serviceId, action: 'authorization.manage' }).allowed;
         routeInvitations = new RouteInvitationStore({
             filePath: path.join(homedir(), '.termdock', 'federation', 'route-invitations.json'), serviceId: runtime.serviceId,
@@ -688,10 +696,10 @@ export function startServer(options = {}) {
             localOrigin: `${scheme}://${localAuthority}:${port}`, ...(localCa ? { localCa } : {}),
         });
         selfRelay.start();
-        server.once('close', () => selfRelay.close());
+        onServerClose(() => selfRelay.close());
     }).catch(() => console.error('Route invitations unavailable; uninitialized route grants remain denied.'));
     void federation.catch(() => console.error('Encrypted access initialization failed; business access remains closed.'));
-    server.once('close', () => { void federation.then(runtime => runtime.close()).catch(() => { }); });
+    onServerClose(() => { void federation.then(runtime => runtime.close()).catch(() => { }); });
     server.headersTimeout = 10_000;
     server.requestTimeout = 120_000;
     server.keepAliveTimeout = 5_000;
@@ -699,7 +707,7 @@ export function startServer(options = {}) {
     server.maxRequestsPerSocket = 1000;
     server.maxConnections = 1024;
     server.on('connection', (socket) => runtimeMonitor.trackSocket(socket));
-    server.once('close', () => runtimeMonitor.stop());
+    onServerClose(() => runtimeMonitor.stop());
     setSecureCookieMode(scheme === 'https');
     const certWatcher = new CertificateWatcher({
         enabled: scheme === 'https' && Boolean(options.httpsCertPath && options.httpsKeyPath),
@@ -865,7 +873,7 @@ export function startServer(options = {}) {
         console.error('Server error:', error);
         process.exit(1);
     });
-    server.on('close', () => {
+    onServerClose(() => {
         stopLogMaintenance();
         crashForensics.dispose();
         certWatcher.stop();

package/dist/server/federation/accessPolicy.js

@@ -90,13 +90,18 @@ export function resolveAccessRequest(method, path) {
         return { action: 'file.read' };
     if (method === 'POST' && route === 'create')
         return { action: 'service.create-session' };
-    const session = /^([^/]+)(?:\/(health|attach|stream|input|resize|tmux|restart|agent-resume))?$/.exec(route);
+    const attachment = /^([^/]+)\/chat\/attachments$/.exec(route);
+    if (method === 'POST' && attachment && !reservedSessionIds.has(attachment[1].toLowerCase()))
+        return { action: 'session.input', sessionId: attachment[1] };
+    const session = /^([^/]+)(?:\/(health|attach|stream|input|resize|tmux|restart|agent-resume|chat|view-mode))?$/.exec(route);
     if (session && !reservedSessionIds.has(session[1].toLowerCase())) {
         const sessionId = session[1];
         const op = session[2];
-        if (read && ['health', 'attach', 'stream', 'agent-resume'].includes(op))
+        if (read && ['health', 'attach', 'stream', 'agent-resume', 'chat', 'view-mode'].includes(op))
             return { action: 'session.view', sessionId };
-        if (method === 'POST' && op === 'input')
+        if (method === 'PUT' && op === 'view-mode')
+            return { action: 'session.view', sessionId };
+        if (method === 'POST' && (op === 'input' || op === 'chat'))
             return { action: 'session.input', sessionId };
         if (method === 'POST' && op === 'resize')
             return { action: 'session.resize', sessionId };

package/dist/server/federation/authorization.js

@@ -1,3 +1,4 @@
+import { validShareResources, resourceSubset } from '../shared/shareResources.js';
 import { randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync } from 'node:fs';
 import { dirname } from 'node:path';
@@ -18,6 +19,7 @@ function validateInput(v) {
         assert(v.scope.kind === 'sessions' && ids(v.scope.sessionIds), 'session scope');
         keys(v.scope, ['kind', 'sessionIds']);
     }
+    assert(v.resources === undefined || validShareResources(v.resources), 'shared resources');
     assert(Array.isArray(v.actions) && v.actions.length > 0 && v.actions.length <= 256 && v.actions.every(action) && new Set(v.actions).size === v.actions.length, 'actions');
     if (v.scope.kind === 'sessions')
         assert(v.actions.every(a => a.startsWith('session.')), 'session scope cannot grant service or file capabilities');
@@ -37,7 +39,7 @@ function isSubset(child, parent) {
         return false;
     if (parent.scope.kind === 'sessions' && (child.scope.kind !== 'sessions' || !child.scope.sessionIds.every(s => parent.scope.kind === 'sessions' && parent.scope.sessionIds.includes(s))))
         return false;
-    if (!parent.actions.includes('service:*') && !child.actions.every(a => parent.actions.includes(a)))
+    if (!parent.actions.includes('service:*') && (!child.actions.every(a => parent.actions.includes(a)) || !resourceSubset(child.resources, parent.resources)))
         return false;
     for (const key of ['entryServiceIds', 'relayIds']) {
         const limit = parent.conditions?.[key];
@@ -86,7 +88,7 @@ export class AuthorizationStore {
         for (const value of data.grants) {
             validateInput(value);
             const g = value;
-            keys(g, ['id', 'serviceId', 'createdAt', 'parentGrantId', 'revokedAt', 'subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions', 'passwordCredential']);
+            keys(g, ['id', 'serviceId', 'createdAt', 'parentGrantId', 'revokedAt', 'subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions', 'passwordCredential', 'resources']);
             assert(id(g.id) && g.serviceId === this.options.serviceId && Number.isSafeInteger(g.createdAt) && g.createdAt >= 0, 'grant metadata');
             assert(g.parentGrantId === undefined || id(g.parentGrantId), 'parent identity');
             assert(g.revokedAt === undefined || (Number.isSafeInteger(g.revokedAt) && g.revokedAt >= 0), 'revocation');
@@ -122,7 +124,7 @@ export class AuthorizationStore {
     }
     create(input) {
         validateInput(input);
-        keys(input, ['subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions']);
+        keys(input, ['subjectId', 'scope', 'actions', 'expiresAt', 'canDelegate', 'conditions', 'resources']);
         const now = this.now();
         assert(input.expiresAt === undefined || input.expiresAt > now, 'already expired');
         return { ...structuredClone(input), id: randomUUID(), serviceId: this.options.serviceId, createdAt: now };
@@ -169,6 +171,27 @@ export class AuthorizationStore {
         return true;
     }
     list() { return this.read(); }
+    listActive() { const grants = this.read(); return grants.filter(grant => active(grant, grants, this.now(), new Set(), this.options.passwordCredential?.())); }
+    /** Narrow only this Session, preserving sibling Session grants and descendant checks. */
+    revokeSession(sessionId, normalize = id => id) {
+        const grants = this.read();
+        let changed = 0;
+        for (const grant of grants) {
+            if (grant.revokedAt !== undefined || grant.scope.kind !== 'sessions')
+                continue;
+            const remaining = grant.scope.sessionIds.filter(id => normalize(id) !== sessionId);
+            if (remaining.length === grant.scope.sessionIds.length)
+                continue;
+            changed++;
+            if (!remaining.length)
+                grant.revokedAt = this.now();
+            else
+                grant.scope = { kind: 'sessions', sessionIds: remaining };
+        }
+        if (changed)
+            this.save(grants);
+        return changed;
+    }
     listEffective(request) {
         if (!request || !id(request.subjectId) || request.serviceId !== this.options.serviceId)
             return [];

package/dist/server/federation/invitations.js

@@ -1,3 +1,4 @@
+import { validShareResources } from '../shared/shareResources.js';
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, chmodSync } from 'node:fs';
 import { dirname } from 'node:path';
@@ -8,8 +9,9 @@ const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 function requireValid(ok) { if (!ok)
     throw new Error('INVALID_INVITATION'); }
 export function validateInvitation(input) {
-    requireValid(record(input) && Object.keys(input).every(k => ['scope', 'actions', 'label', 'expiresAt'].includes(k)));
+    requireValid(record(input) && Object.keys(input).every(k => ['scope', 'actions', 'label', 'expiresAt', 'resources'].includes(k)));
     requireValid(record(input.scope) && Array.isArray(input.actions) && input.actions.length > 0 && new Set(input.actions).size === input.actions.length);
+    requireValid(input.resources === undefined || validShareResources(input.resources));
     const scope = input.scope;
     if (scope.kind === 'service') {
         requireValid(Object.keys(scope).length === 1 && ((input.actions.length === 1 && input.actions[0] === 'service:*') || input.actions.every(a => typeof a === 'string' && actions.has(a))));
@@ -50,9 +52,9 @@ export class InvitationStore {
         requireValid(record(data) && data.version === 1 && data.serviceId === this.options.serviceId && Array.isArray(data.invitations) && data.invitations.length <= 2048);
         const seen = new Set();
         for (const item of data.invitations) {
-            requireValid(record(item) && Object.keys(item).every(k => ['scope', 'actions', 'label', 'expiresAt', 'hash', 'issuerId', 'createdAt', 'invitationExpiresAt', 'consumedAt', 'consumedBy'].includes(k)));
-            const { scope, actions, label, expiresAt, hash, issuerId, createdAt, invitationExpiresAt, consumedAt, consumedBy } = item;
-            validateInvitation({ scope, actions, ...(label === undefined ? {} : { label }), ...(expiresAt === undefined ? {} : { expiresAt }) });
+            requireValid(record(item) && Object.keys(item).every(k => ['scope', 'actions', 'label', 'expiresAt', 'hash', 'issuerId', 'createdAt', 'invitationExpiresAt', 'consumedAt', 'consumedBy', 'resources'].includes(k)));
+            const { scope, actions, resources, label, expiresAt, hash, issuerId, createdAt, invitationExpiresAt, consumedAt, consumedBy } = item;
+            validateInvitation({ scope, actions, ...(resources === undefined ? {} : { resources }), ...(label === undefined ? {} : { label }), ...(expiresAt === undefined ? {} : { expiresAt }) });
             requireValid(typeof hash === 'string' && /^[a-f0-9]{64}$/.test(hash) && !seen.has(hash) && identity(issuerId));
             seen.add(hash);
             requireValid(Number.isSafeInteger(createdAt) && Number.isSafeInteger(invitationExpiresAt) && Number(invitationExpiresAt) === Number(createdAt) + TTL);
@@ -87,7 +89,7 @@ export class InvitationStore {
     listPending() {
         const now = this.now();
         return this.read().filter(i => i.consumedAt === undefined && i.invitationExpiresAt > now && (i.expiresAt === undefined || i.expiresAt > now))
-            .map(({ hash, scope, actions, label, expiresAt, createdAt, invitationExpiresAt }) => ({ id: hash, scope, actions, ...(label ? { label } : {}), ...(expiresAt === undefined ? {} : { expiresAt }), createdAt, invitationExpiresAt }));
+            .map(({ hash, scope, actions, resources, label, expiresAt, createdAt, invitationExpiresAt }) => ({ id: hash, scope, actions, ...(resources === undefined ? {} : { resources }), ...(label ? { label } : {}), ...(expiresAt === undefined ? {} : { expiresAt }), createdAt, invitationExpiresAt }));
     }
     revoke(id) {
         const current = this.read();
@@ -98,6 +100,25 @@ export class InvitationStore {
         this.save(current);
         return true;
     }
+    revokeSession(sessionId, normalize = id => id) {
+        const current = this.read();
+        let changed = 0;
+        const next = current.filter(invitation => {
+            if (invitation.consumedAt !== undefined || invitation.scope.kind !== 'sessions')
+                return true;
+            const remaining = invitation.scope.sessionIds.filter(id => normalize(id) !== sessionId);
+            if (remaining.length === invitation.scope.sessionIds.length)
+                return true;
+            changed++;
+            if (!remaining.length)
+                return false;
+            invitation.scope = { kind: 'sessions', sessionIds: remaining };
+            return true;
+        });
+        if (changed)
+            this.save(next);
+        return changed;
+    }
     create(issuerId, input) {
         requireValid(identity(issuerId));
         validateInvitation(input);
@@ -129,7 +150,7 @@ export class InvitationStore {
         invite.consumedAt = now;
         invite.consumedBy = subjectId;
         this.save(current);
-        return { subjectId, scope: structuredClone(invite.scope), actions: [...invite.actions], ...(invite.expiresAt === undefined ? {} : { expiresAt: invite.expiresAt }), canDelegate: false };
+        return { subjectId, ...(invite.resources ? { resources: structuredClone(invite.resources) } : {}), scope: structuredClone(invite.scope), actions: [...invite.actions], ...(invite.expiresAt === undefined ? {} : { expiresAt: invite.expiresAt }), canDelegate: false };
     }
     subjectLabels() {
         return Object.fromEntries(this.read().filter(i => i.consumedBy && i.label).map(i => [i.consumedBy, i.label]));

package/dist/server/federation/requestContext.js

@@ -1,9 +1,13 @@
 // Object identity is deliberately used instead of a remotely forgeable header.
+const resources = new WeakMap();
+export function encryptedRequestResources(request) { return resources.get(request); }
 const verified = new WeakSet();
 const subjects = new WeakMap();
 const serviceAccess = new WeakSet();
-export function markEncryptedRequest(request, subjectId, fullService = false) {
+export function markEncryptedRequest(request, subjectId, fullService = false, shared) {
     verified.add(request);
+    if (shared)
+        resources.set(request, shared);
     if (subjectId)
         subjects.set(request, subjectId);
     if (fullService)

package/dist/server/federation/resourceAccess.js

@@ -0,0 +1,63 @@
+import { realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { canonicalApiPath } from './accessPolicy.js';
+export function computerResource(resources, host, protocol = 'vnc', port = protocol === 'rdp' ? 3389 : 5900) {
+    const matches = resources.computers?.filter(c => c.host.toLowerCase() === host.toLowerCase() && c.protocol === protocol && c.port === port);
+    return matches?.find(c => c.access === 'control') ?? matches?.[0];
+}
+/** Check both the lexical and real path. Symlinks cannot widen a shared root. */
+export function directoryResource(resources, requested, write = false) {
+    if (!path.isAbsolute(requested) || requested.includes('\0'))
+        return false;
+    try {
+        const lexical = path.resolve(requested), real = realpathSync(lexical);
+        const inside = (root, file) => { const rel = path.relative(root, file); return rel === '' || (!rel.startsWith(`..${path.sep}`) && rel !== '..' && !path.isAbsolute(rel)); };
+        return resources.directories?.some(root => (!write || root.access === 'write') && inside(path.resolve(root.path), lexical) && inside(realpathSync(root.path), real)) === true;
+    }
+    catch {
+        return false;
+    }
+}
+export function canonicalShareDirectories(resources) {
+    return { ...resources, ...(resources.directories ? { directories: resources.directories.map(root => {
+                const canonical = realpathSync(root.path);
+                if (!statSync(canonical).isDirectory())
+                    throw new Error('SHARE_DIRECTORY_UNAVAILABLE');
+                return { ...root, path: canonical };
+            }) } : {}) };
+}
+export function resourceHttpAllowed(resources, method, requestPath) {
+    const pathname = canonicalApiPath(requestPath);
+    if (!pathname)
+        return false;
+    if (method === 'GET' && pathname === '/api/android/devices')
+        return !!resources.android?.length;
+    if (resources.android?.length && ((['GET', 'POST'].includes(method) && pathname === '/api/android/recordings') || (method === 'POST' && /^\/api\/android\/recordings\/[a-f0-9-]{36}\/(?:stop|save)$/.test(pathname)) || (method === 'DELETE' && /^\/api\/android\/recordings\/[a-f0-9-]{36}$/.test(pathname))))
+        return true;
+    if (method === 'GET' && pathname === '/api/computer/status')
+        return !!resources.computers?.length;
+    const url = new URL(requestPath, 'http://inner');
+    const op = pathname.slice('/api/terminal/fs/'.length);
+    if (['GET', 'HEAD'].includes(method) && op.startsWith('preview/')) {
+        const parts = op.slice(8).split('/');
+        if (/^[0-9a-f]{32}$/.test(parts[0]))
+            parts.shift();
+        return directoryResource(resources, '/' + parts.join('/'));
+    }
+    if (!pathname.startsWith('/api/terminal/fs/'))
+        return false;
+    // Unregistered Git, shell, native-open and recursive APIs remain unavailable.
+    const read = ['GET', 'HEAD'].includes(method) && ['list', 'read', 'blob', 'video', 'download', 'eda-preview', 'eda-inspect'].includes(op);
+    const write = (method === 'POST' && op === 'upload') || (method === 'PUT' && op === 'write') || (method === 'DELETE' && op === 'file');
+    if (!read && !write)
+        return false;
+    const key = op === 'upload' ? 'dir' : 'path';
+    if (url.searchParams.getAll(key).length !== 1 || !directoryResource(resources, url.searchParams.get(key) ?? '', write))
+        return false;
+    // Listing can run git check-ignore; its repository is another filesystem input.
+    for (const extra of ['gitIgnoreRoot', 'cwd', 'root', 'repoRoot']) {
+        if (url.searchParams.has(extra) && (url.searchParams.getAll(extra).length !== 1 || !directoryResource(resources, url.searchParams.get(extra) ?? '')))
+            return false;
+    }
+    return true;
+}

package/dist/server/federation/runtime.js

@@ -1,3 +1,7 @@
+import { SessionSharingPresence } from './sessionSharing.js';
+import { collaborationSessionDisplayName } from '../utils/sessionDisplayName.js';
+import { mergeShareResources } from '../shared/shareResources.js';
+import { canonicalShareDirectories, computerResource, resourceHttpAllowed } from './resourceAccess.js';
 import { CollaborationRpc } from '../agent/collaborationPeerTransport.js';
 import { PasswordBootstrapServer } from './passwordBootstrap.js';
 import { DeviceProfiles } from './deviceProfiles.js';
@@ -92,6 +96,7 @@ export async function createFederationRuntime(app, directory, handlers, options
     const passwordStarts = [];
     const passwordAttempts = new Map();
     const store = new AuthorizationStore({ serviceId, filePath: join(directory, 'grants.json'), passwordCredential: getPasswordCredentialFingerprint });
+    const sharingPresence = new SessionSharingPresence();
     const deviceProfiles = new DeviceProfiles(join(directory, 'device-profiles.json'));
     const deviceNames = new DeviceNames(join(directory, 'device-names.json'));
     const invitations = new InvitationStore({ serviceId, filePath: join(directory, 'invitations.json') });
@@ -113,7 +118,9 @@ export async function createFederationRuntime(app, directory, handlers, options
         delete request.headers['x-termdock-device'];
         const fullService = request.headers['x-termdock-full-service'] === '1';
         delete request.headers['x-termdock-full-service'];
-        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService);
+        const resourcesHeader = request.headers['x-termdock-resources'];
+        delete request.headers['x-termdock-resources'];
+        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService, typeof resourcesHeader === 'string' ? JSON.parse(resourcesHeader) : undefined);
         app(request, response);
     });
     // The outer encrypted consumer can apply backpressure long after a local
@@ -163,10 +170,14 @@ export async function createFederationRuntime(app, directory, handlers, options
             const stable = stableSessionId(sessionId);
             return stable !== undefined && store.authorize({ subjectId, serviceId, action, sessionId: stable }).allowed;
         };
+        const resources = (subjectId) => mergeShareResources(store.listEffective({ subjectId, serviceId }).map(g => g.resources));
+        const androidAllowed = (subjectId, serial, control = false) => full(subjectId) || resources(subjectId).android?.some(d => d.serial === serial && (!control || d.access === 'control')) === true;
+        const computerAllowed = (subjectId, target) => full(subjectId) || !!computerResource(resources(subjectId), target.host, target.protocol, target.port);
         const full = (subjectId) => open() || store.hasFullServiceAccess({ subjectId, serviceId });
         let channel;
         const operations = new Map();
         const sockets = new Map();
+        const presenceKey = randomUUID();
         let revokeTimer;
         try {
             const secured = await secureConnection({ identity, duplex, initiator: false, signal: AbortSignal.timeout(15000) });
@@ -180,23 +191,26 @@ export async function createFederationRuntime(app, directory, handlers, options
                 if (typeof head.method !== 'string' || typeof head.path !== 'string' || !isBusinessApiPath(head.method, head.path))
                     throw new Error('API_NOT_ALLOWED');
                 const policy = resolveAccessRequest(head.method, head.path);
-                if (!full(subjectId)) {
+                if (!full(subjectId) && !resourceHttpAllowed(resources(subjectId), head.method, head.path)) {
                     if (!policy)
                         throw new Error('API_NOT_ALLOWED');
                     check(policy.action, policy.sessionId);
                 }
             };
             async function runHttp(id, operation) {
+                const scopeStamp = JSON.stringify([full(subjectId), resources(subjectId)]);
                 const sendHttp = (packet) => {
                     if (operations.get(id) !== operation || operation.abort.signal.aborted)
                         throw new Error('CANCELLED');
+                    if (scopeStamp !== JSON.stringify([full(subjectId), resources(subjectId)]))
+                        throw new Error('AUTHORIZATION_CHANGED');
                     httpAllowed(operation.head);
                     send(packet);
                 };
                 try {
                     httpAllowed(operation.head);
                     const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId,
-                        'x-termdock-full-service': full(subjectId) ? '1' : '0' });
+                        'x-termdock-full-service': full(subjectId) ? '1' : '0', 'x-termdock-resources': JSON.stringify(resources(subjectId)) });
                     const supplied = operation.head.headers;
                     if (supplied && typeof supplied === 'object')
                         for (const [name, value] of Object.entries(supplied)) {
@@ -259,9 +273,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                 }
             }
             revokeTimer = setInterval(() => {
-                for (const { socket: logical, sessionId, android, computer } of sockets.values()) {
+                for (const { socket: logical, sessionId, android, computer, computerTarget, computerControl } of sockets.values()) {
                     if (android || computer) {
-                        if (!full(subjectId))
+                        if (android ? !androidAllowed(subjectId, android) : !computerTarget || !computerAllowed(subjectId, computerTarget) || (computerControl && !full(subjectId) && !resources(subjectId).computers?.some(c => c.host.toLowerCase() === computerTarget.host.toLowerCase() && c.protocol === computerTarget.protocol && c.port === computerTarget.port && c.access === 'control')))
                             logical.close(4003, 'Authorization revoked');
                         continue;
                     }
@@ -400,11 +414,26 @@ export async function createFederationRuntime(app, directory, handlers, options
                                 return [];
                             seen.add(sessionId);
                             return [{ sessionId, ...(typeof session.sessionId === 'string' ? { sourceSessionId: session.sessionId } : {}),
-                                    name: typeof session.name === 'string' ? session.name : sessionId, live: session.live === true,
+                                    name: collaborationSessionDisplayName({ ...session, name: typeof session.name === 'string' ? session.name : sessionId }), live: session.live === true,
                                     canWrite: allowed(subjectId, 'session.input', sessionId), canResize: allowed(subjectId, 'session.resize', sessionId) }];
                         });
                         send({ type: 'result', id: packet.id, items });
                     }
+                    else if (packet.type === 'session-sharing-status') {
+                        check('authorization.manage');
+                        const normalize = (id) => options.resolveSessionId?.(id) || id;
+                        send({ type: 'result', id: packet.id, items: sharingPresence.summary(store.listActive(), invitations.listPending(), normalize) });
+                    }
+                    else if (packet.type === 'session-sharing-stop') {
+                        check('authorization.manage');
+                        if (typeof packet.sessionId !== 'string' || !packet.sessionId)
+                            throw new Error('INVALID_SESSION');
+                        const normalize = (id) => options.resolveSessionId?.(id) || id;
+                        const sessionId = normalize(packet.sessionId);
+                        const revoked = store.revokeSession(sessionId, normalize);
+                        invitations.revokeSession(sessionId, normalize);
+                        send({ type: 'result', id: packet.id, revoked });
+                    }
                     else if (packet.type === 'self-relay-ticket') {
                         if (!options.issueSelfRelayTicket)
                             throw new Error('SELF_RELAY_UNAVAILABLE');
@@ -461,10 +490,12 @@ export async function createFederationRuntime(app, directory, handlers, options
                     }
                     else if (packet.type === 'invite-create') {
                         check('authorization.manage');
-                        const invitation = { scope: packet.scope, actions: packet.actions,
+                        const invitation = { scope: packet.scope, actions: packet.actions, ...(packet.resources === undefined ? {} : { resources: packet.resources }),
                             ...(packet.label === undefined ? {} : { label: packet.label }),
                             ...(packet.expiresAt === undefined ? {} : { expiresAt: packet.expiresAt }) };
                         validateInvitation(invitation);
+                        if (invitation.resources)
+                            invitation.resources = canonicalShareDirectories(invitation.resources);
                         if (invitation.scope.kind === 'sessions') {
                             // Bind to the stable client session id, never the transient backend
                             // PTY id: backends are replaced on restart, tmux recovery or
@@ -524,6 +555,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                         if ((context.singleOperation ? operations.size + sockets.size >= 1 : operations.size >= MAX_SERVER_HTTP_REQUESTS) || operations.has(packet.id) || sockets.has(packet.id))
                             throw new Error('STREAM_LIMIT');
                         httpAllowed(packet);
+                        const requestedSession = resolveAccessRequest(String(packet.method), String(packet.path))?.sessionId;
+                        if (requestedSession && !full(subjectId))
+                            sharingPresence.visit(presenceKey, subjectId, stableSessionId(requestedSession) || requestedSession);
                         const upload = !['GET', 'HEAD'].includes(String(packet.method));
                         if (upload && uploadSlots >= 8)
                             throw new Error('UPLOAD_CONCURRENCY_LIMIT');
@@ -587,26 +621,34 @@ export async function createFederationRuntime(app, directory, handlers, options
                         const match = /^\/api\/terminal\/([^/%]+)\/ws$/.exec(url.pathname);
                         const androidMatch = /^\/api\/android\/([^/%]+)\/ws$/.exec(url.pathname);
                         const computer = url.pathname === '/api/computer/ws';
-                        if (match)
+                        const computerTarget = { host: url.searchParams.get('host') ?? '', protocol: url.searchParams.get('protocol') ?? 'vnc', port: Number(url.searchParams.get('port') ?? (url.searchParams.get('protocol') === 'rdp' ? '3389' : '5900')) };
+                        const canView = () => androidMatch ? androidAllowed(subjectId, androidMatch[1]) : computer ? computerAllowed(subjectId, computerTarget) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]);
+                        if (match) {
                             check('session.view', match[1]);
+                            if (!full(subjectId))
+                                sharingPresence.visit(presenceKey, subjectId, stableSessionId(match[1]) || match[1]);
+                        }
                         else if (url.pathname === '/api/control/ws')
                             check('service.view');
                         else if (androidMatch || computer) {
-                            if (!full(subjectId))
+                            if (!canView())
                                 throw new Error('API_NOT_ALLOWED');
                         }
                         else
                             throw new Error('API_NOT_ALLOWED');
-                        const logical = new LogicalSocket(channel, packet.id, () => (androidMatch || computer) ? full(subjectId) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]), match ? 1024 * 1024 : undefined, !!match && packet.compression === 'gzip');
-                        sockets.set(packet.id, { socket: logical, sessionId: match?.[1], android: Boolean(androidMatch), computer,
-                            computerProtocol: computer ? url.searchParams.get('protocol') ?? 'vnc' : undefined });
-                        logical.once('close', () => sockets.delete(packet.id));
+                        const logical = new LogicalSocket(channel, packet.id, canView, match ? 1024 * 1024 : undefined, !!match && packet.compression === 'gzip');
+                        sockets.set(packet.id, { socket: logical, sessionId: match?.[1], android: androidMatch?.[1], computer, computerTarget: computer ? computerTarget : undefined,
+                            computerControl: computer && (full(subjectId) || resources(subjectId).computers?.some(c => c.host.toLowerCase() === computerTarget.host.toLowerCase() && c.protocol === computerTarget.protocol && c.port === computerTarget.port && c.access === 'control')), computerProtocol: computer ? url.searchParams.get('protocol') ?? 'vnc' : undefined });
+                        const shareStreamKey = `${presenceKey}:${packet.id}`;
+                        if (match && !full(subjectId))
+                            sharingPresence.openStream(shareStreamKey, presenceKey, subjectId, stableSessionId(match[1]) || match[1]);
+                        logical.once('close', () => { sockets.delete(packet.id); sharingPresence.closeStream(shareStreamKey); });
                         send({ type: 'ws-ready', id: packet.id });
                         if (match)
                             handlers.terminal(logical, match[1], randomUUID(), {
                                 pushClientId: `device:${subjectId}`, sinceSeq: Math.max(0, Number(url.searchParams.get('since')) || 0), streamEpoch: url.searchParams.get('epoch') ?? undefined,
                                 flowControl: url.searchParams.get('flow') === '2', outputActive: url.searchParams.get('active') !== '0',
-                                independentTmux: full(subjectId) && url.searchParams.get('transport') === 'tmux-client',
+                                independentTmux: allowed(subjectId, 'session.resize', match[1]) && url.searchParams.get('transport') === 'tmux-client',
                             }, allowed(subjectId, 'session.resize', match[1]) ? readTerminalHandshakeDimensions(url.searchParams) : undefined);
                         else if (androidMatch) {
                             if (!handlers.android)
@@ -623,7 +665,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                                 continue;
                             }
                             handlers.computer(logical, url.searchParams.get('host') ?? '', {
-                                protocol: url.searchParams.get('protocol') ?? undefined, port: url.searchParams.get('port') ?? undefined,
+                                protocol: computerTarget.protocol, port: String(computerTarget.port), readOnly: !full(subjectId) && computerResource(resources(subjectId), computerTarget.host, computerTarget.protocol, computerTarget.port)?.access !== 'control',
                             });
                         }
                         else
@@ -635,14 +677,14 @@ export async function createFederationRuntime(app, directory, handlers, options
                             throw new Error('INVALID_STREAM');
                         const data = JSON.parse(packet.data);
                         if (item.computer) {
-                            if (!full(subjectId))
+                            if (!item.computerTarget || !computerAllowed(subjectId, item.computerTarget) || (item.computerControl && !full(subjectId) && !resources(subjectId).computers?.some(c => c.host.toLowerCase() === item.computerTarget.host.toLowerCase() && c.protocol === item.computerTarget.protocol && c.port === item.computerTarget.port && c.access === 'control')))
                                 throw new Error('AUTHORIZATION_DENIED');
                             const types = item.computerProtocol === 'rdp' ? ['start', 'instruction', 'ack'] : ['data', 'ack'];
                             if (!types.includes(data?.type))
                                 throw new Error('ACTION_NOT_ALLOWED');
                         }
                         else if (item.android) {
-                            if (!full(subjectId))
+                            if (!androidAllowed(subjectId, item.android, data?.type === 'control' && data?.data !== 'EQ=='))
                                 throw new Error('AUTHORIZATION_DENIED');
                             if (!['control', 'ack', 'ping', 'bitrate'].includes(data?.type))
                                 throw new Error('ACTION_NOT_ALLOWED');
@@ -678,6 +720,7 @@ export async function createFederationRuntime(app, directory, handlers, options
             duplex.close?.(new Error('Secure channel closed'));
         }
         finally {
+            sharingPresence.close(presenceKey);
             unregisterCollaboration?.();
             collaborationRpc?.close();
             clearInterval(revokeTimer);

package/dist/server/federation/sessionSharing.js

@@ -0,0 +1,39 @@
+export class SessionSharingPresence {
+    connections = new Map();
+    visit(connection, device, session) {
+        const current = this.connections.get(connection) || { device, sessions: new Map() };
+        current.sessions.set(session, Date.now());
+        this.connections.set(connection, current);
+    }
+    streams = new Map();
+    openStream(key, connection, device, session) { this.streams.set(key, { connection, device, session }); }
+    closeStream(key) { this.streams.delete(key); }
+    close(connection) { this.connections.delete(connection); for (const [key, stream] of this.streams)
+        if (stream.connection === connection)
+            this.streams.delete(key); }
+    summary(grants, invitations, normalize) {
+        const result = new Map();
+        const record = (id) => { const key = normalize(id); let item = result.get(key); if (!item) {
+            item = { sessionId: key, devices: new Set(), invitations: 0 };
+            result.set(key, item);
+        } return item; };
+        for (const grant of grants)
+            if (grant.scope.kind === 'sessions')
+                for (const id of grant.scope.sessionIds)
+                    record(id).devices.add(grant.subjectId);
+        for (const invite of invitations)
+            if (invite.scope.kind === 'sessions')
+                for (const id of invite.scope.sessionIds)
+                    record(id).invitations++;
+        return [...result.values()].map(item => {
+            const online = new Set();
+            for (const connection of this.connections.values())
+                if (Date.now() - (connection.sessions.get(item.sessionId) || 0) < 15_000 && item.devices.has(connection.device))
+                    online.add(connection.device);
+            for (const stream of this.streams.values())
+                if (stream.session === item.sessionId && item.devices.has(stream.device))
+                    online.add(stream.device);
+            return { sessionId: item.sessionId, devices: item.devices.size, connectedDevices: online.size, invitations: item.invitations };
+        });
+    }
+}