termdock 1.4.356 → 1.4.357

package/dist/server/federation/cli.js

@@ -4,15 +4,15 @@ import { dirname, resolve } from 'node:path';
 import WebSocket from 'ws';
 import QRCode from 'qrcode';
 import { RelayClient } from './relay.js';
+import { openServiceSocket } from './serviceTransport.js';
+import { serviceEndpoint } from './connectionModel.js';
 function secureEndpoint(value, endpoint) {
     const url = new URL(value);
     if (!['https:', 'wss:'].includes(url.protocol) || url.username || url.password || url.search || url.hash)
         throw new Error('Federation relay URLs must use HTTPS/WSS without credentials, query or fragment');
     if (url.pathname !== '/' && url.pathname !== endpoint)
         throw new Error('Federation relay URL must be a service origin or the exact tunnel endpoint');
-    url.protocol = 'wss:';
-    url.pathname = endpoint;
-    return url.toString();
+    return serviceEndpoint(url.origin, endpoint === '/api/federation/relay' ? 'relay' : 'secure').href;
 }
 export function parseRelayConfig(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -30,47 +30,12 @@ export function parseRelayConfig(value) {
     }
     return structuredClone(v);
 }
-function connect(url, ca, sockets, token, readyHandshake = false) {
-    return new Promise((accept, reject) => {
-        const ws = new WebSocket(url, { ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 10_000, maxPayload: 256 * 1024, ...(token ? { headers: { Authorization: `Bearer ${token}` } } : {}) });
-        sockets.add(ws);
-        ws.once('close', () => sockets.delete(ws));
-        const failed = () => { ws.terminate(); reject(new Error('Secure relay connection failed')); };
-        ws.once('error', failed);
-        ws.once('close', failed);
-        ws.once('open', () => {
-            ws.off('error', failed);
-            ws.off('close', failed);
-            ws.on('error', () => ws.terminate());
-            if (readyHandshake)
-                void awaitReady(ws).then(() => accept(ws), reject);
-            else
-                accept(ws);
-        });
-    });
-}
-async function awaitReady(ws) {
-    return new Promise((accept, reject) => {
-        const timer = setTimeout(() => fail(), 10_000);
-        const cleanup = () => { clearTimeout(timer); ws.off('message', ready); ws.off('close', fail); };
-        const fail = () => { cleanup(); ws.terminate(); reject(new Error('Relay authentication failed')); };
-        const ready = (raw) => {
-            try {
-                const frame = JSON.parse(raw.toString());
-                if (frame.type !== 'ready') {
-                    fail();
-                    return;
-                }
-                cleanup();
-                accept();
-            }
-            catch {
-                fail();
-            }
-        };
-        ws.once('message', ready);
-        ws.once('close', fail);
-    });
+async function connect(url, ca, sockets, token, readyHandshake = false, signal) {
+    const ws = await openServiceSocket(url, { ca }, { maxPayload: 256 * 1024, handshakeTimeout: 10_000, relayReady: readyHandshake, signal,
+        ...(token ? { headers: { Authorization: `Bearer ${token}` } } : {}) });
+    sockets.add(ws);
+    ws.once('close', () => sockets.delete(ws));
+    return ws;
 }
 export function pairingInviteUrl(serviceId, code, value) {
     const url = new URL(value);
@@ -131,11 +96,12 @@ export async function runFederationCli(args) {
         const loadCa = (file) => file ? readFileSync(resolve(dirname(configPath), file)) : undefined;
         const entryCa = loadCa(config.caPath);
         const targets = config.targets.map(t => ({ ...t, ca: loadCa(t.caPath ?? config.caPath) }));
+        const lifetime = new AbortController();
         const sockets = new Set();
         let stopped = false;
         let client;
         let wake;
-        const stop = () => { stopped = true; wake?.(); client?.close(); for (const socket of sockets)
+        const stop = () => { stopped = true; lifetime.abort(); wake?.(); client?.close(); for (const socket of sockets)
             socket.terminate(); };
         process.once('SIGINT', stop);
         process.once('SIGTERM', stop);
@@ -143,12 +109,12 @@ export async function runFederationCli(args) {
         try {
             while (!stopped) {
                 try {
-                    const upstream = await connect(secureEndpoint(config.entryUrl, '/api/federation/relay'), entryCa, sockets, config.relayToken, true);
+                    const upstream = await connect(secureEndpoint(config.entryUrl, '/api/federation/relay'), entryCa, sockets, config.relayToken, true, lifetime.signal);
                     if (stopped) {
                         upstream.terminate();
                         break;
                     }
-                    client = new RelayClient(upstream, { targets: new Map(targets.map(t => [t.serviceId, () => connect(secureEndpoint(t.url, '/api/federation/secure'), t.ca, sockets)])) });
+                    client = new RelayClient(upstream, { targets: new Map(targets.map(t => [t.serviceId, (signal) => connect(secureEndpoint(t.url, '/api/federation/secure'), t.ca, sockets, undefined, false, AbortSignal.any([signal, lifetime.signal]))])) });
                     process.stderr.write('加密中继已连接。\n');
                     delay = 1000;
                     await new Promise(done => { if (upstream.readyState !== WebSocket.OPEN)

package/dist/server/federation/connectionErrors.js

@@ -0,0 +1,37 @@
+const messages = {
+    RELAY_AUTHORIZATION_REQUIRED: '没有有效中转授权', TARGET_AUTHORIZATION_REQUIRED: '目标服务需要重新登录',
+    PERMISSION_DENIED: '当前权限不允许此操作', TARGET_IDENTITY_MISMATCH: '服务身份与保存的身份不一致',
+    RELAY_SELF_TARGET: '不能通过服务中转到其自身；同一服务的其它地址请添加为备用地址。',
+};
+export class ConnectionAccessError extends Error {
+    code;
+    context;
+    name = 'ConnectionAccessError';
+    constructor(code, context = {}) {
+        super(messages[code]);
+        this.code = code;
+        this.context = context;
+    }
+}
+export function connectionAccessError(error, context = {}) {
+    if (error instanceof ConnectionAccessError) {
+        Object.assign(error.context, { ...context, ...error.context });
+        return error;
+    }
+    // Retained workspaces/test module reloads can carry the same protocol error
+    // from another module instance. Never accept arbitrary messages as a code.
+    if (error instanceof Error && error.name === 'ConnectionAccessError' && 'code' in error
+        && typeof error.code === 'string' && Object.hasOwn(messages, error.code)) {
+        return new ConnectionAccessError(error.code, context);
+    }
+    if (error instanceof Error && error.name === 'UnexpectedPeerError')
+        return new ConnectionAccessError('TARGET_IDENTITY_MISMATCH', context);
+    return undefined;
+}
+export function relayAuthorizationError(error, context) {
+    if (error instanceof Error && (error.message === 'AUTHORIZATION_DENIED'
+        || error instanceof ConnectionAccessError && error.code === 'PERMISSION_DENIED')) {
+        return new ConnectionAccessError('RELAY_AUTHORIZATION_REQUIRED', context);
+    }
+    return error instanceof Error ? error : new Error('中转连接暂不可用');
+}

package/dist/server/federation/connectionModel.js

@@ -0,0 +1,83 @@
+import { ConnectionAccessError } from './connectionErrors.js';
+export const MAX_SAVED_ROUTES = 4;
+export function normalizeServiceAddress(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 2048)
+        throw new Error('请输入服务地址。');
+    const raw = value.trim();
+    const url = new URL(/^[a-z][a-z\d+.-]*:\/\//i.test(raw) ? raw : `https://${raw}`);
+    if (url.protocol === 'wss:')
+        url.protocol = 'https:';
+    if (url.protocol === 'ws:')
+        url.protocol = 'http:';
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (!['https:', 'http:'].includes(url.protocol) || url.protocol === 'http:' && !loopback)
+        throw new Error('请使用 HTTPS 服务地址。');
+    if (url.username || url.password || url.search || url.hash || !['/', '/api/federation/secure'].includes(url.pathname))
+        throw new Error('请输入服务首页地址，不要包含账号或额外参数。');
+    return url.origin;
+}
+export function normalizedRoutes(record) {
+    if (record.entryServiceId && record.entryServiceId === record.targetPeerId)
+        throw new ConnectionAccessError('RELAY_SELF_TARGET', { entryServiceId: record.entryServiceId, targetServiceId: record.targetPeerId });
+    const candidates = Array.isArray(record.routes) ? record.routes.slice(0, 64) : [];
+    if (record.entryServiceId)
+        candidates.unshift({ url: record.url, targetPeerId: record.entryServiceId });
+    const seen = new Set();
+    return candidates.flatMap(route => {
+        try {
+            if (!route || typeof route.targetPeerId !== 'string' || !/^[a-zA-Z0-9_.:-]{1,160}$/.test(route.targetPeerId))
+                return [];
+            const url = normalizeServiceAddress(route.url), key = JSON.stringify([route.targetPeerId, url]);
+            if (seen.has(key))
+                return [];
+            seen.add(key);
+            return [{ url, targetPeerId: route.targetPeerId }];
+        }
+        catch {
+            return [];
+        }
+    }).slice(0, MAX_SAVED_ROUTES);
+}
+export function relayConnectionRoutes(record) {
+    return normalizedRoutes(record).filter(route => route.targetPeerId !== record.targetPeerId);
+}
+export function directConnectionAddresses(record) {
+    const routes = normalizedRoutes(record);
+    const entryUrls = new Set(routes.filter(route => route.targetPeerId !== record.targetPeerId).map(route => route.url));
+    const candidates = [record.serviceOrigin || record.url, ...routes.filter(route => route.targetPeerId === record.targetPeerId).map(route => route.url)];
+    const result = new Set();
+    for (const value of candidates)
+        try {
+            const address = normalizeServiceAddress(value);
+            if (!entryUrls.has(address))
+                result.add(address);
+        }
+        catch { /* An invalid address cannot substitute for a saved identity. */ }
+    return [...result];
+}
+export function hasIndependentConnectionRoute(record, deniedEntryServiceId, excludedEntries = new Set()) {
+    return directConnectionAddresses(record).length > 0
+        || !!deniedEntryServiceId && relayConnectionRoutes(record).some(route => route.targetPeerId !== deniedEntryServiceId && !excludedEntries.has(route.targetPeerId));
+}
+/** Run after merges, including imports from old native clients. Otherwise an
+ * omitted serviceOrigin can retain an old entry URL from the previous record. */
+export function canonicalConnectionRouting(record) {
+    const result = { ...record, url: normalizeServiceAddress(record.url) };
+    const routes = normalizedRoutes(record);
+    if (record.routes !== undefined)
+        result.routes = routes;
+    if (record.serviceOrigin) {
+        const origin = normalizeServiceAddress(record.serviceOrigin);
+        if (routes.some(route => route.targetPeerId !== record.targetPeerId && route.url === origin))
+            delete result.serviceOrigin;
+        else
+            result.serviceOrigin = origin;
+    }
+    return result;
+}
+export function serviceEndpoint(address, kind = 'secure') {
+    const url = new URL(normalizeServiceAddress(address));
+    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+    url.pathname = `/api/federation/${kind}`;
+    return url;
+}

package/dist/server/federation/desktopTargets.js

@@ -1,4 +1,6 @@
 import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { directConnectionAddresses } from './connectionModel.js';
 const peer = (value) => typeof value === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(value);
 const fingerprint = (value) => typeof value === 'string' && /^(?:[\da-f]{2}:){31}[\da-f]{2}$/i.test(value);
 function origin(value) {
@@ -18,7 +20,7 @@ function origin(value) {
  * have been pinned there before its administrator can discover other entries.
  * This supplies addresses, never the Desktop client's device authorization.
  */
-export function desktopDirectTargets(file, localServiceId) {
+export function desktopDirectTargets(file, localServiceId, format = 'electron') {
     if (!localServiceId)
         return [];
     try {
@@ -27,7 +29,8 @@ export function desktopDirectTargets(file, localServiceId) {
         const data = JSON.parse(readFileSync(file, 'utf8'));
         if (data?.version !== 1 || !Array.isArray(data.connections) || data.connections.length > 256)
             return [];
-        const removed = new Set(Array.isArray(data.removedServiceKeys) ? data.removedServiceKeys : []);
+        const removedKeys = format === 'preview' ? data.removedKeys : data.removedServiceKeys;
+        const removed = new Set(Array.isArray(removedKeys) ? removedKeys : []);
         const connections = data.connections.filter((item) => item && ![item.id, item.targetPeerId, item.serviceOrigin || item.url].some(key => removed.has(key)));
         if (!connections.some((item) => item.targetPeerId === localServiceId))
             return [];
@@ -42,17 +45,23 @@ export function desktopDirectTargets(file, localServiceId) {
         for (const item of connections) {
             if (!peer(item.targetPeerId) || item.targetPeerId === localServiceId)
                 continue;
-            const url = origin(item.serviceOrigin || item.url);
-            if (!url)
-                continue;
-            // An entry-only bookmark does not supply a direct address for its target.
-            if ((!item.serviceOrigin && item.entryServiceId && item.entryServiceId !== item.targetPeerId)
-                || (Array.isArray(item.routes) && item.routes.some((route) => route && route.targetPeerId !== item.targetPeerId && origin(route.url) === url)))
-                continue;
-            const caFingerprint256 = trusts.get(url);
-            targets.set(item.targetPeerId, { serviceId: item.targetPeerId, url,
-                ...(typeof item.label === 'string' && item.label.trim() ? { label: item.label.trim().slice(0, 120) } : {}),
-                ...(caFingerprint256 ? { caFingerprint256 } : {}) });
+            for (const address of directConnectionAddresses(item)) {
+                const url = origin(address);
+                if (!url)
+                    continue;
+                const caFingerprint256 = trusts.get(url);
+                const pin = format === 'preview' ? data.certificatePins?.[url] : undefined;
+                // Preview pins the leaf certificate, whereas Electron approves a CA.
+                // Never reinterpret one as the other or discard an invalid saved pin.
+                if (pin !== undefined && (typeof pin !== 'string' || !/^[\da-f]{64}$/i.test(pin)))
+                    continue;
+                targets.set(JSON.stringify([item.targetPeerId, url]), { serviceId: item.targetPeerId, url,
+                    ...(typeof item.label === 'string' && item.label.trim() ? { label: item.label.trim().slice(0, 120) } : {}),
+                    ...(format === 'electron' && caFingerprint256 ? { caFingerprint256 } : {}),
+                    ...(pin ? { certificateFingerprint256: pin.toUpperCase() } : {}) });
+                if (targets.size >= 64)
+                    break;
+            }
             if (targets.size >= 64)
                 break;
         }
@@ -62,3 +71,16 @@ export function desktopDirectTargets(file, localServiceId) {
         return [];
     }
 }
+/** Both installations keep their own bookmarks and trust. Reading Preview's
+ * native directory also supports already-installed Preview apps, without
+ * copying credentials or overwriting the Electron configuration. */
+export function desktopServiceTargets(home, localServiceId, platform = process.platform) {
+    const previewRoot = platform === 'darwin' ? join(home, 'Library', 'Application Support')
+        : platform === 'win32' ? process.env.APPDATA || join(home, 'AppData', 'Roaming')
+            : process.env.XDG_CONFIG_HOME || join(home, '.config');
+    const key = (target) => JSON.stringify([target.serviceId, target.url]);
+    const targets = new Map(desktopDirectTargets(join(home, '.termdock', 'desktop.json'), localServiceId).map(target => [key(target), target]));
+    for (const target of desktopDirectTargets(join(previewRoot, 'com.jovines.termdock.preview', 'connections.json'), localServiceId, 'preview'))
+        targets.set(key(target), target);
+    return [...targets.values()].slice(0, 64);
+}

package/dist/server/federation/directRoutes.js

@@ -1,20 +1,19 @@
-import { readPinnedCertificateAuthority } from './trustedCa.js';
 import { createIdentity, secureConnection } from './secureProtocol.js';
 import { socketDuplex } from './socketDuplex.js';
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import WebSocket from 'ws';
+import { openServiceSocket } from './serviceTransport.js';
+import { serviceEndpoint } from './connectionModel.js';
 function endpoint(config) {
-    if (!config || typeof config !== 'object' || Object.keys(config).some(key => !['serviceId', 'url', 'caPath', 'caFingerprint256', 'label'].includes(key)) || !/^[a-zA-Z0-9_.:-]{1,160}$/.test(config.serviceId) || typeof config.url !== 'string' || (config.caPath !== undefined && typeof config.caPath !== 'string'))
+    if (!config || typeof config !== 'object' || Object.keys(config).some(key => !['serviceId', 'url', 'caPath', 'caFingerprint256', 'certificateFingerprint256', 'label'].includes(key)) || !/^[a-zA-Z0-9_.:-]{1,160}$/.test(config.serviceId) || typeof config.url !== 'string' || (config.caPath !== undefined && typeof config.caPath !== 'string'))
         throw new Error('Invalid direct target configuration');
     if ((config.caFingerprint256 !== undefined && (typeof config.caFingerprint256 !== 'string' || !/^(?:[\da-f]{2}:){31}[\da-f]{2}$/i.test(config.caFingerprint256))) || (config.caPath && config.caFingerprint256) || (config.label !== undefined && (typeof config.label !== 'string' || config.label.length > 120)))
         throw new Error('Invalid direct target metadata');
+    if (config.certificateFingerprint256 !== undefined && (typeof config.certificateFingerprint256 !== 'string' || !/^[\da-f]{64}$/i.test(config.certificateFingerprint256)
+        || config.caPath !== undefined || config.caFingerprint256 !== undefined))
+        throw new Error('Invalid direct target certificate pin');
     const url = new URL(config.url);
     if (!['https:', 'wss:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || !['/', '/api/federation/secure'].includes(url.pathname))
         throw new Error('Direct targets require a verified HTTPS/WSS origin');
-    url.protocol = 'wss:';
-    url.pathname = '/api/federation/secure';
-    return url.toString();
+    return serviceEndpoint(url.origin).href;
 }
 /** Registers only administrator-configured destinations. TLS validation and redirect
  * refusal apply even though the inner session also has end-to-end encryption. */
@@ -24,37 +23,32 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
     const ids = new Set();
     const targets = configs.map(config => {
         const url = endpoint(config);
-        if (ids.has(config.serviceId))
-            throw new Error('Duplicate direct target');
-        ids.add(config.serviceId);
-        return { serviceId: config.serviceId, url, caFingerprint256: config.caFingerprint256, ca: config.caPath ? readFileSync(resolve(baseDir, config.caPath)) : undefined };
+        const key = JSON.stringify([config.serviceId, url]);
+        if (ids.has(key))
+            throw new Error('Duplicate direct target address');
+        ids.add(key);
+        return { config, serviceId: config.serviceId, url };
     });
     let stopped = false;
     const sockets = new Set();
     const cleanups = [];
-    const cleanup = () => { stopped = true; for (const close of cleanups.splice(0))
+    const lifetime = new AbortController();
+    const cleanup = () => { stopped = true; lifetime.abort(); for (const close of cleanups.splice(0))
         close(); for (const ws of sockets)
         ws.terminate(); };
     try {
         for (const target of targets)
-            cleanups.push(router.registerDirect(target.serviceId, async () => {
-                const ca = target.caFingerprint256 ? await readPinnedCertificateAuthority(target.url.replace(/^wss:/, 'https:'), target.caFingerprint256) : target.ca;
-                return new Promise((accept, reject) => {
-                    if (stopped) {
-                        reject(new Error('Direct target stopped'));
-                        return;
-                    }
-                    const ws = new WebSocket(target.url, { ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 10000, maxPayload: 256 * 1024 });
-                    sockets.add(ws);
-                    ws.once('close', () => sockets.delete(ws));
-                    const failed = () => { reject(new Error('Direct target unavailable')); ws.terminate(); };
-                    ws.once('error', failed);
-                    ws.once('close', failed);
-                    ws.once('open', () => { ws.off('error', failed); ws.off('close', failed); ws.on('error', () => ws.terminate()); if (stopped)
-                        failed();
-                    else
-                        accept(ws); });
-                });
+            cleanups.push(router.registerDirect(target.serviceId, async (signal) => {
+                if (stopped)
+                    throw new Error('Direct target stopped');
+                const ws = await openServiceSocket(target.url, target.config, { baseDir, maxPayload: 256 * 1024, handshakeTimeout: 10000, signal: AbortSignal.any([signal, lifetime.signal]) });
+                if (stopped) {
+                    ws.terminate();
+                    throw new Error('Direct target stopped');
+                }
+                sockets.add(ws);
+                ws.once('close', () => sockets.delete(ws));
+                return ws;
             }));
     }
     catch (error) {
@@ -65,14 +59,12 @@ export function attachRegisteredDirectTargets(router, configs, baseDir = process
 }
 /** An administrator enabling a new backup first proves the target's pinned
  * identity; HTTPS validation remains enabled throughout. */
-export async function verifyDirectTarget(config) {
+export async function verifyDirectTarget(config, baseDir = process.cwd(), signal) {
     const url = endpoint(config);
-    const ca = config.caFingerprint256 ? await readPinnedCertificateAuthority(url.replace(/^wss:/, 'https:'), config.caFingerprint256) : config.caPath ? readFileSync(config.caPath) : undefined;
-    const ws = new WebSocket(url, { ca, rejectUnauthorized: true, followRedirects: false, handshakeTimeout: 5000, maxPayload: 256 * 1024 });
+    const ws = await openServiceSocket(url, config, { baseDir, maxPayload: 256 * 1024, signal });
     const duplex = socketDuplex(ws);
     try {
-        await new Promise((resolve, reject) => { ws.once('open', resolve); ws.once('error', reject); ws.once('close', () => reject(new Error('Target closed'))); });
-        await secureConnection({ identity: await createIdentity(), initiator: true, targetPinnedPeerId: config.serviceId, duplex, signal: AbortSignal.timeout(5000) });
+        await secureConnection({ identity: await createIdentity(), initiator: true, targetPinnedPeerId: config.serviceId, duplex, signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(5000)]) : AbortSignal.timeout(5000) });
     }
     finally {
         ws.close();

package/dist/server/federation/directTargetRegistry.js

@@ -0,0 +1,106 @@
+import { attachRegisteredDirectTargets, verifyDirectTarget } from './directRoutes.js';
+import { normalizeServiceAddress } from './connectionModel.js';
+/** A static configuration is a claim, not proof that its URL serves its ID.
+ * Advertise direct providers only after a real TLS + pinned Noise handshake.
+ * Reverse providers remain independent and keep working during these checks. */
+export class DirectTargetRegistry {
+    router;
+    baseDir;
+    now;
+    states = new Map();
+    stopped = false;
+    activeChecks = 0;
+    constructor(router, baseDir, now = () => performance.now()) {
+        this.router = router;
+        this.baseDir = baseDir;
+        this.now = now;
+    }
+    refresh(targets) {
+        if (this.stopped)
+            return;
+        const desired = new Map(targets.map(target => [this.key(target), target]));
+        const signature = (target) => JSON.stringify([target.url, target.caPath, target.caFingerprint256, target.certificateFingerprint256]);
+        for (const [id, state] of this.states) {
+            const target = desired.get(id);
+            if (!target || signature(target) !== state.signature) {
+                state.controller?.abort();
+                state.close?.();
+                this.states.delete(id);
+            }
+        }
+        for (const [id, target] of desired) {
+            let state = this.states.get(id);
+            if (!state) {
+                state = { target, signature: signature(target), checking: false, nextCheck: 0, error: 'TARGET_CHECKING' };
+                this.states.set(id, state);
+            }
+            state.target = target;
+        }
+        this.pump();
+    }
+    key(target) { return JSON.stringify([target.serviceId, normalizeServiceAddress(target.url)]); }
+    providers(serviceId) { return [...this.states.values()].filter(state => state.target.serviceId === serviceId); }
+    pump() {
+        if (this.stopped)
+            return;
+        for (const state of this.states.values()) {
+            if (this.activeChecks >= 4)
+                break;
+            if (!state.checking && this.now() >= state.nextCheck)
+                void this.check(state.target, state);
+        }
+    }
+    error(serviceId) {
+        const states = this.providers(serviceId);
+        if (states.some(state => state.close))
+            return;
+        return ['TARGET_CHECKING', 'TARGET_IDENTITY_MISMATCH', 'TARGET_UNREACHABLE'].find(error => states.some(state => state.error === error));
+    }
+    describe(target) {
+        const state = this.providers(target.serviceId).find(provider => provider.close);
+        const available = this.router.hasRoute(target.serviceId);
+        // A valid reverse tunnel may coexist with an incorrect static URL. Do not
+        // borrow the unverified URL/name and make A look like the entry B.
+        const metadata = state ? { serviceId: target.serviceId, url: normalizeServiceAddress(state.target.url), ...(state.target.label ? { label: state.target.label } : {}) }
+            : target.url ? { serviceId: target.serviceId } : target;
+        const error = this.error(target.serviceId);
+        return { ...metadata, available, ...(!available && error ? { error } : {}) };
+    }
+    async check(target, state) {
+        state.checking = true;
+        this.activeChecks++;
+        const controller = new AbortController();
+        state.controller = controller;
+        const current = () => !this.stopped && this.states.get(this.key(target)) === state;
+        try {
+            await verifyDirectTarget(target, this.baseDir, controller.signal);
+            if (!current())
+                return;
+            state.close ??= attachRegisteredDirectTargets(this.router, [target], this.baseDir);
+            state.error = undefined;
+            state.nextCheck = this.now() + 30_000;
+        }
+        catch (error) {
+            if (!current())
+                return;
+            state.close?.();
+            state.close = undefined;
+            state.error = error instanceof Error && error.name === 'UnexpectedPeerError' ? 'TARGET_IDENTITY_MISMATCH' : 'TARGET_UNREACHABLE';
+            state.nextCheck = this.now() + 5000;
+        }
+        finally {
+            state.checking = false;
+            state.controller = undefined;
+            this.activeChecks--;
+            this.pump();
+        }
+    }
+    close() {
+        this.stopped = true;
+        for (const state of this.states.values()) {
+            state.controller?.abort();
+            state.close?.();
+        }
+        this.states.clear();
+    }
+}

package/dist/server/federation/httpUploadLimit.js

@@ -0,0 +1,8 @@
+const MIB = 1024 * 1024;
+/** File bodies include multipart framing; filesystem handlers still enforce
+ * the 100 MiB attachment limit. This budget never grants endpoint access. */
+export function httpUploadLimit(pathname) {
+    const fileUpload = pathname === '/api/terminal/fs/upload'
+        || /^\/api\/terminal\/[^/]+\/chat\/attachments$/.test(pathname);
+    return (fileUpload ? 110 : 5) * MIB;
+}

package/dist/server/federation/relay.js

@@ -1,7 +1,7 @@
-import { RELAY_PROVIDER_CONNECT_TIMEOUT_MS, RELAY_ROUTE_OPEN_TIMEOUT_MS } from './streamLimits.js';
+import { RELAY_PROVIDER_CONNECT_TIMEOUT_MS, RELAY_ROUTE_OPEN_TIMEOUT_MS, RELAY_MAX_FRAME_BYTES, RELAY_MAX_BUFFERED_BYTES } from './streamLimits.js';
 import { randomUUID } from 'node:crypto';
 import { EventEmitter } from 'node:events';
-const defaults = { maxFrameBytes: 256 * 1024, maxBufferedBytes: 1024 * 1024,
+const defaults = { maxFrameBytes: RELAY_MAX_FRAME_BYTES, maxBufferedBytes: RELAY_MAX_BUFFERED_BYTES,
     maxStreams: 128, heartbeatMs: 30_000, maxRouteTtlMs: 90_000, connectTimeoutMs: RELAY_PROVIDER_CONNECT_TIMEOUT_MS, routeTimeoutMs: RELAY_ROUTE_OPEN_TIMEOUT_MS };
 const identifier = (v) => typeof v === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(v);
 function parse(raw, limits) {
@@ -118,15 +118,16 @@ export class RelayRouter {
             .map(([peer]) => peer);
     }
     hasRoute(serviceId) {
-        return !this.stopped && this.providers(serviceId).length > 0;
+        return this.providerCount(serviceId) > 0;
     }
+    providerCount(serviceId) { return this.stopped ? 0 : this.providers(serviceId).length; }
     activeRouteIds() {
         return [...this.routes.keys()].filter(serviceId => this.hasRoute(serviceId));
     }
     /** Trusted local configuration only. Clients never supply a target URL or factory. */
     registerDirect(serviceId, connect) {
-        if (this.stopped || !identifier(serviceId) || typeof connect !== 'function' || [...this.peers].some(peer => this.directPeers.get(peer) === serviceId))
-            throw new Error('Invalid or already registered direct target');
+        if (this.stopped || !identifier(serviceId) || typeof connect !== 'function')
+            throw new Error('Invalid direct target');
         const [routerWire, clientWire] = memoryPair();
         // The private WeakMap marks this peer; its placeholder principal is never
         // passed to externally supplied authentication/authorization callbacks.
@@ -342,6 +343,7 @@ export class RelayClient {
     streams = new Map();
     renewal;
     pending = new Map();
+    connecting = new Map();
     stopped = false;
     constructor(upstream, options) {
         this.upstream = upstream;
@@ -358,6 +360,8 @@ export class RelayClient {
     drop(id, reason) {
         clearTimeout(this.pending.get(id));
         this.pending.delete(id);
+        this.connecting.get(id)?.abort();
+        this.connecting.delete(id);
         const target = this.streams.get(id);
         this.streams.delete(id);
         target?.close();
@@ -379,9 +383,11 @@ export class RelayClient {
             const timer = setTimeout(() => { this.drop(f.streamId, 'Target timeout'); }, this.limits.connectTimeoutMs);
             timer.unref?.();
             this.pending.set(f.streamId, timer);
+            const controller = new AbortController();
+            this.connecting.set(f.streamId, controller);
             let target;
             try {
-                target = await connect();
+                target = await connect(controller.signal);
             }
             catch {
                 if (this.pending.get(f.streamId) === timer)
@@ -395,6 +401,7 @@ export class RelayClient {
             }
             clearTimeout(timer);
             this.pending.delete(f.streamId);
+            this.connecting.delete(f.streamId);
             if (target.readyState !== 1) {
                 target.close();
                 this.drop(f.streamId, 'Target not ready');