termdock 1.4.356 → 1.4.358

package/dist/server/federation/relayTransport.js

@@ -0,0 +1,147 @@
+import { RELAY_CLIENT_CONNECT_TIMEOUT_MS, RELAY_MAX_FRAME_BYTES, RELAY_MAX_BUFFERED_BYTES } from './streamLimits.js';
+import { fromBase64, toBase64 } from './packets.js';
+import { ConnectionAccessError } from './connectionErrors.js';
+const MAX_FRAME_BYTES = RELAY_MAX_FRAME_BYTES;
+const MAX_BUFFER_BYTES = RELAY_MAX_BUFFERED_BYTES;
+/** A byte WebSocket facade over a single explicitly addressed relay stream. */
+export class RelayTransport extends EventTarget {
+    url;
+    CONNECTING = 0;
+    OPEN = 1;
+    CLOSING = 2;
+    CLOSED = 3;
+    protocol = '';
+    extensions = '';
+    binaryType = 'arraybuffer';
+    readyState = 0;
+    transportFailure;
+    onopen = null;
+    onmessage = null;
+    onerror = null;
+    onclose = null;
+    connectionTimings = { entryOpenMs: null, routeOpenMs: null };
+    upstream;
+    streamId = crypto.randomUUID();
+    requested = false;
+    deadline;
+    get bufferedAmount() { return this.upstream.bufferedAmount; }
+    constructor(url, targetServiceId, socketFactory, context = {}) {
+        super();
+        this.url = url;
+        if (!/^[a-zA-Z0-9_.:-]{1,160}$/.test(targetServiceId))
+            throw new Error('Invalid target identity');
+        if (context.entryServiceId === targetServiceId)
+            throw new ConnectionAccessError('RELAY_SELF_TARGET', { ...context, targetServiceId });
+        const started = performance.now();
+        let entryReadyAt;
+        this.upstream = socketFactory(url);
+        this.upstream.addEventListener('open', () => {
+            this.connectionTimings.entryOpenMs = performance.now() - started;
+        });
+        this.deadline = setTimeout(() => this.fail('Relay connection timed out'), RELAY_CLIENT_CONNECT_TIMEOUT_MS);
+        this.upstream.addEventListener('message', event => {
+            if (this.readyState === 3)
+                return;
+            try {
+                if (typeof event.data !== 'string' || new TextEncoder().encode(event.data).length > MAX_FRAME_BYTES)
+                    throw new Error('Invalid relay envelope');
+                const frame = JSON.parse(event.data);
+                if (frame.type === 'ready') {
+                    if (this.requested || this.readyState !== 0)
+                        throw new Error('Repeated relay handshake');
+                    entryReadyAt = performance.now();
+                    this.requested = true;
+                    this.transmit({ type: 'open', streamId: this.streamId, serviceId: targetServiceId });
+                    return;
+                }
+                if (frame.streamId !== this.streamId)
+                    return;
+                if (frame.type === 'opened' && this.readyState === 0) {
+                    this.connectionTimings.routeOpenMs = entryReadyAt === undefined ? null : performance.now() - entryReadyAt;
+                    clearTimeout(this.deadline);
+                    this.readyState = 1;
+                    const e = new Event('open');
+                    this.dispatchEvent(e);
+                    this.onopen?.(e);
+                    return;
+                }
+                if (frame.type === 'close') {
+                    if (frame.code === 'RELAY_AUTHORIZATION_REQUIRED' || frame.reason === 'Authorization revoked') {
+                        this.transportFailure = new ConnectionAccessError('RELAY_AUTHORIZATION_REQUIRED', { ...context, targetServiceId });
+                    }
+                    if (frame.code === 'RELAY_SELF_TARGET')
+                        this.transportFailure = new ConnectionAccessError('RELAY_SELF_TARGET', { ...context, targetServiceId });
+                    this.finish(1001, this.transportFailure?.message || 'Relay route closed');
+                    this.upstream.close();
+                    return;
+                }
+                if (frame.type !== 'data' || this.readyState !== 1 || frame.encoding !== 'base64' || typeof frame.payload !== 'string'
+                    || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(frame.payload))
+                    throw new Error('Invalid ciphertext relay frame');
+                const bytes = fromBase64(frame.payload);
+                const data = this.binaryType === 'blob' ? new Blob([bytes]) : bytes.buffer;
+                const e = new MessageEvent('message', { data });
+                this.dispatchEvent(e);
+                this.onmessage?.(e);
+            }
+            catch {
+                this.fail('Relay protocol rejected frame');
+            }
+        });
+        this.upstream.addEventListener('close', event => this.finish(event.code || 1006, 'Relay disconnected'));
+        this.upstream.addEventListener('error', () => this.fail('Relay transport unavailable'));
+    }
+    transmit(frame) {
+        const data = JSON.stringify(frame);
+        if (this.upstream.readyState !== 1 || this.upstream.bufferedAmount + data.length > MAX_BUFFER_BYTES || data.length > MAX_FRAME_BYTES)
+            throw new Error('Relay unavailable or congested');
+        this.upstream.send(data);
+    }
+    send(data) {
+        if (this.readyState !== 1)
+            throw new Error('Relay socket is not open');
+        let bytes;
+        if (ArrayBuffer.isView(data))
+            bytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+        else if (data instanceof ArrayBuffer)
+            bytes = new Uint8Array(data);
+        else
+            throw new Error('Relay secure transport requires binary bytes');
+        try {
+            this.transmit({ type: 'data', streamId: this.streamId, encoding: 'base64', payload: toBase64(bytes) });
+        }
+        catch (error) {
+            this.fail('Relay transport congested');
+            throw error;
+        }
+    }
+    close(code = 1000, reason = '') {
+        if (this.readyState === 3)
+            return;
+        try {
+            if (this.requested)
+                this.transmit({ type: 'close', streamId: this.streamId });
+        }
+        catch { /* connection already unavailable */ }
+        this.finish(code, reason);
+        this.upstream.close();
+    }
+    fail(reason) {
+        if (this.readyState === 3)
+            return;
+        const e = new Event('error');
+        this.dispatchEvent(e);
+        this.onerror?.(e);
+        this.finish(1006, reason);
+        this.upstream.close();
+    }
+    finish(code, reason) {
+        if (this.readyState === 3)
+            return;
+        clearTimeout(this.deadline);
+        this.readyState = 3;
+        const e = Object.assign(new Event('close'), { code, reason, wasClean: code === 1000 });
+        this.dispatchEvent(e);
+        this.onclose?.(e);
+    }
+}

package/dist/server/federation/routeAccess.js

@@ -157,9 +157,11 @@ export class RouteAccess {
         renameSync(temporary, this.filePath);
     }
     configuredDirectTargets() {
-        const targets = new Map(this.additionalTargets().map(target => [target.serviceId, target]));
-        for (const target of this.registry().directTargets)
-            targets.set(target.serviceId, target);
+        const explicit = this.registry().directTargets;
+        const overridden = new Set(explicit.map(target => target.serviceId));
+        const targets = new Map(this.additionalTargets().filter(target => !overridden.has(target.serviceId)).map(target => [JSON.stringify([target.serviceId, target.url]), target]));
+        for (const target of explicit)
+            targets.set(JSON.stringify([target.serviceId, target.url]), target);
         return [...targets.values()];
     }
     configuredTargets() {

package/dist/server/federation/runtime.js

@@ -1,3 +1,4 @@
+import { androidRouteAccess } from '../shared/androidDevices.js';
 import { SessionSharingPresence } from './sessionSharing.js';
 import { collaborationSessionDisplayName } from '../utils/sessionDisplayName.js';
 import { mergeShareResources } from '../shared/shareResources.js';
@@ -15,6 +16,7 @@ import { createIdentity, importIdentity, exportIdentity, secureConnection } from
 import { InvitationStore, validateInvitation } from './invitations.js';
 import { AuthorizationStore } from './authorization.js';
 import { resolveAccessRequest, isBusinessApiPath, terminalMessageAction } from './accessPolicy.js';
+import { httpUploadLimit } from './httpUploadLimit.js';
 import { AsyncQueue, PacketChannel, toBase64, fromBase64 } from './packets.js';
 import { socketDuplex } from './socketDuplex.js';
 import { markEncryptedRequest } from './requestContext.js';
@@ -171,7 +173,7 @@ export async function createFederationRuntime(app, directory, handlers, options
             return stable !== undefined && store.authorize({ subjectId, serviceId, action, sessionId: stable }).allowed;
         };
         const resources = (subjectId) => mergeShareResources(store.listEffective({ subjectId, serviceId }).map(g => g.resources));
-        const androidAllowed = (subjectId, serial, control = false) => full(subjectId) || resources(subjectId).android?.some(d => d.serial === serial && (!control || d.access === 'control')) === true;
+        const androidAllowed = (subjectId, serial, control = false) => full(subjectId) || (control ? androidRouteAccess(resources(subjectId).android, serial) === 'control' : !!androidRouteAccess(resources(subjectId).android, serial));
         const computerAllowed = (subjectId, target) => full(subjectId) || !!computerResource(resources(subjectId), target.host, target.protocol, target.port);
         const full = (subjectId) => open() || store.hasFullServiceAccess({ subjectId, serviceId });
         let channel;
@@ -585,7 +587,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                         httpAllowed(operation.head);
                         const bytes = operation.head.binaryChunks === true && packet.bytes instanceof Uint8Array ? packet.bytes : fromBase64(packet.data);
                         operation.size += bytes.length;
-                        const limit = new URL(String(operation.head.path), 'http://inner').pathname === '/api/terminal/fs/upload' ? 110 * 1024 * 1024 : 5 * 1024 * 1024;
+                        const limit = httpUploadLimit(new URL(String(operation.head.path), 'http://inner').pathname);
                         if (['GET', 'HEAD'].includes(String(operation.head.method)) || bytes.length > TRANSFER_CHUNK_BYTES || operation.size > limit) {
                             cancelHttp(operation);
                             operations.delete(packet.id);

package/dist/server/federation/selfRelay.js

@@ -3,60 +3,14 @@ import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { desktopDirectTargets } from './desktopTargets.js';
 import { RelayClient } from './relay.js';
-import { readPinnedCertificateAuthority } from './trustedCa.js';
+import { openServiceSocket } from './serviceTransport.js';
+import { serviceEndpoint, normalizeServiceAddress } from './connectionModel.js';
 import { connectCollaborationRpc } from '../agent/collaborationPeerTransport.js';
 function relayEndpoint(origin, selfRelayToken) {
-    const url = new URL('/api/federation/relay', origin);
-    url.protocol = 'wss:';
+    const url = serviceEndpoint(origin, 'relay');
     url.searchParams.set('selfRelayToken', selfRelayToken);
     return url.href;
 }
-function secureEndpoint(origin) {
-    const url = new URL('/api/federation/secure', origin);
-    url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
-    return url.href;
-}
-function openSocket(url, ca, maxPayload = 256 * 1024) {
-    return new Promise((resolve, reject) => {
-        const secure = new URL(url).protocol === 'wss:';
-        const socket = new WebSocket(url, {
-            ...(secure ? { ...(ca ? { ca } : {}), rejectUnauthorized: true } : {}),
-            followRedirects: false,
-            handshakeTimeout: 10_000,
-            maxPayload,
-        });
-        const failed = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_CONNECTION_FAILED')); };
-        const opened = () => { cleanup(); socket.on('error', () => socket.terminate()); resolve(socket); };
-        const cleanup = () => { socket.off('open', opened); socket.off('error', failed); socket.off('close', failed); };
-        socket.once('open', opened);
-        socket.once('error', failed);
-        socket.once('close', failed);
-    });
-}
-function waitForReady(socket) {
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => fail(), 10_000);
-        timer.unref?.();
-        const cleanup = () => { clearTimeout(timer); socket.off('message', ready); socket.off('close', fail); };
-        const fail = () => { cleanup(); socket.terminate(); reject(new Error('SELF_RELAY_AUTHENTICATION_FAILED')); };
-        const ready = (raw, binary) => {
-            try {
-                const frame = binary ? null : JSON.parse(raw.toString());
-                if (frame?.type !== 'ready') {
-                    fail();
-                    return;
-                }
-                cleanup();
-                resolve();
-            }
-            catch {
-                fail();
-            }
-        };
-        socket.once('message', ready);
-        socket.once('close', fail);
-    });
-}
 /**
  * A local Termdock service may publish only its own stable identity to other
  * administrator-configured peers or services pinned by the same Desktop
@@ -93,10 +47,10 @@ export class DesktopSelfRelay {
             return;
         const desired = new Map([...desktopDirectTargets(this.options.desktopFile, this.options.serviceId), ...(this.options.targets?.() || [])]
             .filter(target => target.serviceId !== this.options.serviceId)
-            .map(target => [target.serviceId, { ...target, url: new URL(target.url.replace(/^wss:/, 'https:')).origin }]));
+            .map(target => [JSON.stringify([target.serviceId, normalizeServiceAddress(target.url)]), { ...target, url: normalizeServiceAddress(target.url) }]));
         for (const [serviceId, state] of this.states) {
             const target = desired.get(serviceId);
-            const signature = target && JSON.stringify([target.url, target.caFingerprint256, target.caPath]);
+            const signature = target && JSON.stringify([target.url, target.caFingerprint256, target.caPath, target.certificateFingerprint256]);
             if (!target || signature !== state.signature) {
                 this.stopState(state);
                 this.states.delete(serviceId);
@@ -104,7 +58,7 @@ export class DesktopSelfRelay {
         }
         for (const [serviceId, target] of desired)
             if (!this.states.has(serviceId)) {
-                const state = { signature: JSON.stringify([target.url, target.caFingerprint256, target.caPath]), stopped: false };
+                const state = { signature: JSON.stringify([target.url, target.caFingerprint256, target.caPath, target.certificateFingerprint256]), stopped: false, lifetime: new AbortController() };
                 this.states.set(serviceId, state);
                 void this.run(state, target);
             }
@@ -113,6 +67,7 @@ export class DesktopSelfRelay {
         if (state.stopped)
             return;
         state.stopped = true;
+        state.lifetime.abort();
         state.wake?.();
         state.wake = undefined;
         state.client?.close();
@@ -141,7 +96,7 @@ export class DesktopSelfRelay {
     async connect(state, target) {
         const peer = { serviceId: target.serviceId, origin: target.url, ...(target.caFingerprint256 ? { caFingerprint256: target.caFingerprint256 } : {}) };
         const configuredCa = target.caPath ? readFileSync(resolve(this.options.baseDir || process.cwd(), target.caPath)) : undefined;
-        const rpc = await connectCollaborationRpc(this.options.identity, peer, undefined, undefined, configuredCa);
+        const rpc = await connectCollaborationRpc(this.options.identity, peer, undefined, undefined, configuredCa, target.certificateFingerprint256, state.lifetime.signal);
         let selfRelayToken;
         try {
             const result = await rpc.request({ type: 'self-relay-ticket' });
@@ -155,17 +110,13 @@ export class DesktopSelfRelay {
         }
         if (this.stopped || state.stopped)
             return;
-        const ca = target.caFingerprint256 ? await readPinnedCertificateAuthority(target.url, target.caFingerprint256) : configuredCa;
-        const upstream = await openSocket(relayEndpoint(target.url, selfRelayToken), ca);
+        const upstream = await openServiceSocket(relayEndpoint(target.url, selfRelayToken), target, { baseDir: this.options.baseDir, maxPayload: 256 * 1024, relayReady: true, signal: state.lifetime.signal });
         state.upstream = upstream;
         try {
-            if (this.stopped || state.stopped)
-                return;
-            await waitForReady(upstream);
             if (this.stopped || state.stopped)
                 return;
             const client = new RelayClient(upstream, { targets: new Map([[this.options.serviceId,
-                        () => openSocket(secureEndpoint(this.options.localOrigin), this.options.localCa, 1024 * 1024)]]) });
+                        (signal) => openServiceSocket(serviceEndpoint(typeof this.options.localOrigin === 'function' ? this.options.localOrigin() : this.options.localOrigin).href, { ca: this.options.localCa }, { signal: AbortSignal.any([signal, state.lifetime.signal]) })]]) });
             state.client = client;
             await new Promise(resolve => {
                 if (upstream.readyState !== WebSocket.OPEN)

package/dist/server/federation/serviceTransport.js

@@ -0,0 +1,123 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import * as tls from 'node:tls';
+import WebSocket from 'ws';
+import { normalizeServiceAddress } from './connectionModel.js';
+import { pinnedServerTlsOptions, readPinnedCertificateAuthority } from './trustedCa.js';
+import { RELAY_MAX_FRAME_BYTES } from './streamLimits.js';
+/** One trust decision for probes, direct providers, reverse relays and peer RPC.
+ * A pinned leaf, a pinned CA and a CA file are distinct trust modes. */
+export async function serviceTlsOptions(address, trust = {}, baseDir = process.cwd()) {
+    const origin = normalizeServiceAddress(address);
+    const modes = [trust.ca, trust.caPath, trust.caFingerprint256, trust.certificateFingerprint256].filter(value => value !== undefined);
+    if (modes.length > 1)
+        throw new Error('Conflicting service certificate trust');
+    if (trust.certificateFingerprint256 !== undefined)
+        return pinnedServerTlsOptions(origin, trust.certificateFingerprint256);
+    if (trust.caFingerprint256 !== undefined)
+        return { ca: await readPinnedCertificateAuthority(origin, trust.caFingerprint256) };
+    if (trust.caPath !== undefined && !trust.caPath)
+        throw new Error('Invalid service CA path');
+    if (!modes.length) {
+        // Match native clients' OS-approved trust without changing process-global
+        // TLS defaults. Explicit pins/CA files never inherit these additional roots.
+        const getCertificates = tls.getCACertificates;
+        if (getCertificates)
+            return { ca: [...new Set([...getCertificates('default'), ...getCertificates('system')])] };
+    }
+    return { ca: trust.caPath ? readFileSync(resolve(baseDir, trust.caPath)) : trust.ca };
+}
+/** Return a connecting socket, so relay listeners are installed before the
+ * entry's ready frame. No business bytes are sent during TLS pin inspection. */
+export async function createServiceSocket(address, trust = {}, options = {}) {
+    const url = new URL(address);
+    const origin = normalizeServiceAddress(url.origin.replace(/^wss:/, 'https:').replace(/^ws:/, 'http:'));
+    if (!['wss:', 'ws:'].includes(url.protocol) || url.username || url.password || url.hash
+        || !['/api/federation/secure', '/api/federation/relay'].includes(url.pathname)
+        || [...url.searchParams.keys()].length > 1
+        || [...url.searchParams.keys()].some(key => url.pathname !== '/api/federation/relay' || !['routeToken', 'selfRelayToken'].includes(key))
+        || url.search && Object.keys(options.headers || {}).some(key => key.toLowerCase() === 'authorization'))
+        throw new Error('Invalid service transport endpoint');
+    const tls = await serviceTlsOptions(origin, trust, options.baseDir);
+    options.signal?.throwIfAborted();
+    const socket = new WebSocket(url, { ...tls, rejectUnauthorized: true, followRedirects: false, perMessageDeflate: false,
+        maxPayload: options.maxPayload ?? 1024 * 1024, handshakeTimeout: options.handshakeTimeout ?? 5000,
+        ...(options.headers ? { headers: options.headers } : {}) });
+    const abort = () => socket.terminate();
+    options.signal?.addEventListener('abort', abort, { once: true });
+    socket.once('close', () => options.signal?.removeEventListener('abort', abort));
+    socket.on('error', () => socket.terminate());
+    return socket;
+}
+export function waitForServiceSocket(socket, signal) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            socket.removeEventListener('open', opened);
+            socket.removeEventListener('error', failed);
+            socket.removeEventListener('close', failed);
+            signal?.removeEventListener('abort', aborted);
+        };
+        const opened = () => { cleanup(); resolve(); };
+        const failed = () => { cleanup(); reject(socket.transportFailure || new Error('Service transport unavailable')); };
+        const aborted = () => { cleanup(); reject(signal?.reason); };
+        if (signal?.aborted) {
+            aborted();
+            return;
+        }
+        if (socket.readyState === 1) {
+            opened();
+            return;
+        }
+        if (socket.readyState >= 2) {
+            failed();
+            return;
+        }
+        socket.addEventListener('open', opened);
+        socket.addEventListener('error', failed);
+        socket.addEventListener('close', failed);
+        signal?.addEventListener('abort', aborted, { once: true });
+    });
+}
+export async function openServiceSocket(address, trust = {}, options = {}) {
+    const socket = await createServiceSocket(address, trust, options);
+    // Subscribe before open: an upgrade response and ready frame can share a packet.
+    const ready = options.relayReady ? relayEntryReady(socket, options.signal) : undefined;
+    try {
+        await waitForServiceSocket(socket, options.signal);
+        if (ready)
+            await ready;
+        if (socket.readyState !== WebSocket.OPEN)
+            throw new Error('Service transport closed during handshake');
+        return socket;
+    }
+    catch (error) {
+        socket.terminate();
+        throw error;
+    }
+}
+function relayEntryReady(socket, signal) {
+    const ready = new Promise((resolve, reject) => {
+        const cleanup = () => { clearTimeout(timer); socket.off('message', message); socket.off('close', failed); signal?.removeEventListener('abort', aborted); };
+        const failed = () => { cleanup(); reject(new Error('Relay entry handshake failed')); };
+        const aborted = () => { cleanup(); reject(signal?.reason); };
+        const message = (raw, binary) => {
+            try {
+                if (binary || Buffer.byteLength(Array.isArray(raw) ? Buffer.concat(raw) : raw) > RELAY_MAX_FRAME_BYTES || JSON.parse(raw.toString())?.type !== 'ready')
+                    throw new Error('Invalid entry handshake');
+                cleanup();
+                resolve();
+            }
+            catch {
+                failed();
+            }
+        };
+        const timer = setTimeout(failed, 10_000);
+        socket.once('message', message);
+        socket.once('close', failed);
+        signal?.addEventListener('abort', aborted, { once: true });
+        if (signal?.aborted)
+            aborted();
+    });
+    void ready.catch(() => { });
+    return ready;
+}

package/dist/server/federation/streamLimits.js

@@ -8,3 +8,6 @@ export const MAX_OPEN_SECURE_SOCKETS = 128;
 export const RELAY_PROVIDER_CONNECT_TIMEOUT_MS = 10_000;
 export const RELAY_ROUTE_OPEN_TIMEOUT_MS = 15_000;
 export const RELAY_CLIENT_CONNECT_TIMEOUT_MS = 20_000;
+export const RELAY_MAX_FRAME_BYTES = 256 * 1024;
+export const RELAY_MAX_BUFFERED_BYTES = 1024 * 1024;
+export const CONNECTION_ROUND_TIMEOUT_MS = 30_000;

package/dist/server/federation/trustedCa.js

@@ -1,6 +1,67 @@
 import { X509Certificate } from 'node:crypto';
 import { get } from 'node:https';
+import { connect, checkServerIdentity } from 'node:tls';
 const cache = new Map();
+const leafCache = new Map();
+/** Inspect TLS only, without sending HTTP or business data. Preview approves
+ * the leaf itself, so a downloaded CA cannot substitute for that approval. */
+export async function pinnedServerTlsOptions(origin, fingerprint) {
+    const url = new URL(origin);
+    if (url.protocol !== 'https:' || url.username || url.password || !/^[\da-f]{64}$/i.test(fingerprint))
+        throw new Error('Invalid pinned server certificate');
+    const pin = fingerprint.toUpperCase();
+    const key = `${url.origin}:${pin}`;
+    let cached = leafCache.get(key);
+    if (!cached || cached.expires <= Date.now()) {
+        const value = new Promise((resolve, reject) => {
+            const socket = connect({ host: url.hostname.replace(/^\[|\]$/g, ''), port: Number(url.port || 443),
+                ...(url.hostname.includes(':') || /^[\d.]+$/.test(url.hostname) ? {} : { servername: url.hostname }),
+                rejectUnauthorized: false });
+            const timer = setTimeout(() => socket.destroy(new Error('Pinned server certificate inspection timed out')), 5000);
+            socket.once('error', reject);
+            socket.once('close', () => { clearTimeout(timer); reject(new Error('Pinned server certificate inspection closed')); });
+            socket.once('secureConnect', () => {
+                try {
+                    const raw = socket.getPeerCertificate().raw;
+                    if (!raw)
+                        throw new Error('Server did not present a certificate');
+                    const cert = new X509Certificate(raw);
+                    const hostError = checkServerIdentity(url.hostname.replace(/^\[|\]$/g, ''), socket.getPeerCertificate());
+                    if (hostError)
+                        throw hostError;
+                    if (cert.fingerprint256.replaceAll(':', '') !== pin || Date.now() < Date.parse(cert.validFrom)
+                        || Date.now() > Date.parse(cert.validTo))
+                        throw new Error('Server certificate no longer matches Preview trust');
+                    resolve(Buffer.from(cert.toString()));
+                }
+                catch (error) {
+                    reject(error);
+                }
+                finally {
+                    socket.destroy();
+                }
+            });
+        });
+        cached = { expires: Date.now() + 120_000, value };
+        if (leafCache.size >= 64)
+            leafCache.delete(leafCache.keys().next().value);
+        leafCache.set(key, cached);
+        void value.catch(() => { if (leafCache.get(key)?.value === value)
+            leafCache.delete(key); });
+    }
+    return {
+        ca: await cached.value,
+        // A CA-issued leaf can be the exact trust anchor without importing its CA.
+        allowPartialTrustChain: true,
+        checkServerIdentity(host, cert) {
+            const error = checkServerIdentity(host, cert);
+            if (error)
+                return error;
+            if (cert.fingerprint256?.replaceAll(':', '').toUpperCase() !== pin)
+                return new Error('Server certificate no longer matches Preview trust');
+        },
+    };
+}
 /** Only the CA download is unauthenticated. Its exact SHA-256 fingerprint was
  * already approved locally for this origin; the subsequent WSS connection must
  * still pass normal TLS chain, hostname and expiry checks using this CA.

package/dist/server/routes/android.js

@@ -6,12 +6,10 @@ import { createScrcpySession, resolveScrcpyBinaries } from '../android/scrcpy.js
 import { androidRecordings } from '../android/recording.js';
 import { pathValidator } from '../utils/pathValidator.js';
 const router = Router();
-const SERIAL_PATTERN = /^(?:[0-9a-zA-Z_.:\-]+|\[[0-9a-fA-F:.]+\]:\d{1,5})$/;
-/** 逐帧/逐控件的诊断日志默认关闭，需要时 TERMDOCK_ANDROID_DEBUG=1 打开。 */
+import { isValidAndroidSerial, androidRouteAccess } from '../shared/androidDevices.js';
+export { isValidAndroidSerial };
+/** Opt-in per-frame diagnostics. */
 const DEBUG_ANDROID = process.env.TERMDOCK_ANDROID_DEBUG === '1';
-export function isValidAndroidSerial(serial) {
-    return serial.length <= 128 && SERIAL_PATTERN.test(serial);
-}
 router.get('/devices', async (req, res) => {
     try {
         const devices = await listDevices();
@@ -24,7 +22,7 @@ router.get('/devices', async (req, res) => {
             scrcpyVersion = null;
         }
         const shared = encryptedRequestResources(req);
-        res.json({ adbAvailable, scrcpyVersion, devices: shared && !hasEncryptedServiceAccess(req) ? devices.filter(d => shared.android?.some(a => a.serial === d.serial)) : devices });
+        res.json({ adbAvailable, scrcpyVersion, devices: shared && !hasEncryptedServiceAccess(req) ? devices.filter(d => androidRouteAccess(shared.android, d.serial)) : devices });
     }
     catch (error) {
         res.status(503).json({ error: error instanceof Error ? error.message : 'ADB_UNAVAILABLE', code: 'ADB_UNAVAILABLE' });
@@ -66,7 +64,7 @@ router.use('/recordings', async (req, res, next) => {
     try {
         const id = /^\/([^/]+)(?:\/(?:stop|save))?$/.exec(req.path)?.[1];
         const serial = id ? (await androidRecordings.info(id, subject)).serial : req.method === 'GET' ? req.query.serial : req.body?.serial;
-        if (typeof serial !== 'string' || !resources.android?.some(device => device.serial === serial))
+        if (typeof serial !== 'string' || !androidRouteAccess(resources.android, serial))
             throw new Error('PHONE_NOT_SHARED');
         if (req.body?.directory !== undefined && (typeof req.body.directory !== 'string' || !directoryResource(resources, req.body.directory, true)))
             throw new Error('DIRECTORY_NOT_SHARED');