termdock 1.4.373 → 1.4.375

package/dist/server/federation/invitations.js

@@ -4,13 +4,13 @@ import { mkdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync,
 import { dirname } from 'node:path';
 import { validSessionAppearances, restrictSessionAppearances } from '../shared/sessionAppearance.js';
 const TTL = 10 * 60 * 1000;
-const actions = new Set(['session.view', 'session.input', 'session.resize', 'session.terminate']);
+const actions = new Set(['session.view', 'session.input', 'session.resize', 'session.terminate', 'session.chat-view', 'session.chat-send', 'session.terminal-view', 'session.chat-clear', 'session.terminal-input']);
 const identity = (v) => typeof v === 'string' && v.length > 0 && v.length <= 512 && !/[\s\x00-\x1f]/.test(v);
 const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 function requireValid(ok) { if (!ok)
     throw new Error('INVALID_INVITATION'); }
 export function validateInvitation(input) {
-    requireValid(record(input) && Object.keys(input).every(k => ['scope', 'actions', 'label', 'expiresAt', 'resources', 'sessionAppearance'].includes(k)));
+    requireValid(record(input) && Object.keys(input).every(k => ['scope', 'actions', 'label', 'expiresAt', 'resources', 'sessionAppearance', 'reusable', 'linkExpiresAt'].includes(k)));
     requireValid(record(input.scope) && Array.isArray(input.actions) && input.actions.length > 0 && new Set(input.actions).size === input.actions.length);
     requireValid(input.resources === undefined || validShareResources(input.resources));
     requireValid(input.sessionAppearance === undefined || validSessionAppearances(input.sessionAppearance, input.scope));
@@ -26,9 +26,11 @@ export function validateInvitation(input) {
     }
     requireValid(input.label === undefined || (typeof input.label === 'string' && input.label.trim().length > 0 && input.label.length <= 80 && !/[\x00-\x1f\x7f]/.test(input.label)));
     requireValid(input.expiresAt === undefined || (Number.isSafeInteger(input.expiresAt) && Number(input.expiresAt) > 0));
+    requireValid(input.reusable === undefined || typeof input.reusable === 'boolean');
+    requireValid(input.linkExpiresAt === undefined || input.linkExpiresAt === null || (Number.isSafeInteger(input.linkExpiresAt) && Number(input.linkExpiresAt) > 0));
 }
-/** Single owning process, synchronous consume-before-grant: a crash may burn an invite,
- * but can never redeem it twice. Raw invitation codes are never persisted. */
+/** Single owning process. Legacy links are consumed before grant creation;
+ * reusable links bind issued grants to revocable link authority. Codes are never persisted. */
 export class InvitationStore {
     options;
     now;
@@ -39,6 +41,14 @@ export class InvitationStore {
         this.read();
     }
     hash(code) { return createHash('sha256').update(`termdock-invitation-v1:${this.options.serviceId}:`).update(code).digest('hex'); }
+    /** Link expiry stops new acceptance, while explicit link revocation also
+     * invalidates existing reusable-link grants, even across a crash mid-revoke. */
+    hasGrantAuthority(id) { try {
+        return this.read().some(invite => invite.hash === id && invite.reusable === true);
+    }
+    catch {
+        return false;
+    } }
     read() {
         let raw;
         try {
@@ -54,13 +64,15 @@ export class InvitationStore {
         requireValid(record(data) && data.version === 1 && data.serviceId === this.options.serviceId && Array.isArray(data.invitations) && data.invitations.length <= 2048);
         const seen = new Set();
         for (const item of data.invitations) {
-            requireValid(record(item) && Object.keys(item).every(k => ['scope', 'actions', 'label', 'expiresAt', 'hash', 'issuerId', 'createdAt', 'invitationExpiresAt', 'consumedAt', 'consumedBy', 'resources', 'sessionAppearance'].includes(k)));
+            requireValid(record(item) && Object.keys(item).every(k => ['scope', 'actions', 'label', 'expiresAt', 'hash', 'issuerId', 'createdAt', 'invitationExpiresAt', 'consumedAt', 'consumedBy', 'resources', 'sessionAppearance', 'reusable', 'linkExpiresAt', 'subjects'].includes(k)));
             const { scope, actions, resources, sessionAppearance, label, expiresAt, hash, issuerId, createdAt, invitationExpiresAt, consumedAt, consumedBy } = item;
-            validateInvitation({ scope, actions, ...(resources === undefined ? {} : { resources }), ...(sessionAppearance === undefined ? {} : { sessionAppearance }), ...(label === undefined ? {} : { label }), ...(expiresAt === undefined ? {} : { expiresAt }) });
+            validateInvitation({ scope, actions, ...(resources === undefined ? {} : { resources }), ...(sessionAppearance === undefined ? {} : { sessionAppearance }), ...(label === undefined ? {} : { label }), ...(expiresAt === undefined ? {} : { expiresAt }), ...(item.reusable === undefined ? {} : { reusable: item.reusable }), ...(item.linkExpiresAt === undefined ? {} : { linkExpiresAt: item.linkExpiresAt }) });
             requireValid(typeof hash === 'string' && /^[a-f0-9]{64}$/.test(hash) && !seen.has(hash) && identity(issuerId));
             seen.add(hash);
-            requireValid(Number.isSafeInteger(createdAt) && Number.isSafeInteger(invitationExpiresAt) && Number(invitationExpiresAt) === Number(createdAt) + TTL);
+            requireValid(Number.isSafeInteger(createdAt) && (invitationExpiresAt === null ? item.linkExpiresAt === null
+                : Number.isSafeInteger(invitationExpiresAt) && Number(invitationExpiresAt) === (item.linkExpiresAt ?? Number(createdAt) + TTL)));
             requireValid((consumedAt === undefined && consumedBy === undefined) || (Number.isSafeInteger(consumedAt) && identity(consumedBy)));
+            requireValid(item.subjects === undefined || item.reusable === true && Array.isArray(item.subjects) && item.subjects.length <= 10000 && item.subjects.every(identity) && new Set(item.subjects).size === item.subjects.length);
         }
         return data.invitations;
     }
@@ -90,12 +102,12 @@ export class InvitationStore {
     }
     listPending() {
         const now = this.now();
-        return this.read().filter(i => i.consumedAt === undefined && i.invitationExpiresAt > now && (i.expiresAt === undefined || i.expiresAt > now))
-            .map(({ hash, scope, actions, resources, sessionAppearance, label, expiresAt, createdAt, invitationExpiresAt }) => ({ id: hash, scope, actions, ...(resources === undefined ? {} : { resources }), ...(sessionAppearance === undefined ? {} : { sessionAppearance }), ...(label ? { label } : {}), ...(expiresAt === undefined ? {} : { expiresAt }), createdAt, invitationExpiresAt }));
+        return this.read().filter(i => i.reusable || i.consumedAt === undefined && (i.invitationExpiresAt === null || i.invitationExpiresAt > now) && (i.expiresAt === undefined || i.expiresAt > now))
+            .map(({ hash, scope, actions, resources, sessionAppearance, label, expiresAt, createdAt, invitationExpiresAt, reusable }) => ({ id: hash, scope, actions, ...(resources === undefined ? {} : { resources }), ...(sessionAppearance === undefined ? {} : { sessionAppearance }), ...(label ? { label } : {}), ...(expiresAt === undefined ? {} : { expiresAt }), ...(reusable ? { reusable } : {}), createdAt, invitationExpiresAt }));
     }
     revoke(id) {
         const current = this.read();
-        const index = current.findIndex(i => i.hash === id && i.consumedAt === undefined);
+        const index = current.findIndex(i => i.hash === id && (i.reusable || i.consumedAt === undefined));
         if (index < 0)
             return false;
         current.splice(index, 1);
@@ -106,7 +118,7 @@ export class InvitationStore {
         const current = this.read();
         let changed = 0;
         const next = current.filter(invitation => {
-            if (invitation.consumedAt !== undefined || invitation.scope.kind !== 'sessions')
+            if (!invitation.reusable && invitation.consumedAt !== undefined || invitation.scope.kind !== 'sessions')
                 return true;
             const remaining = invitation.scope.sessionIds.filter(id => normalize(id) !== sessionId);
             if (remaining.length === invitation.scope.sessionIds.length)
@@ -127,18 +139,19 @@ export class InvitationStore {
         validateInvitation(input);
         const now = this.now();
         requireValid(input.expiresAt === undefined || input.expiresAt > now);
-        const current = this.read().filter(i => i.consumedAt !== undefined || i.invitationExpiresAt > now);
-        if (current.filter(i => i.consumedAt === undefined).length >= 256)
+        requireValid(input.linkExpiresAt === undefined || input.linkExpiresAt === null || input.linkExpiresAt > now);
+        const current = this.read().filter(i => i.consumedAt !== undefined || i.invitationExpiresAt === null || i.invitationExpiresAt > now);
+        if (current.filter(i => (i.reusable || i.consumedAt === undefined) && (i.invitationExpiresAt === null || i.invitationExpiresAt > now) && (i.expiresAt === undefined || i.expiresAt > now)).length >= 256)
             throw new Error('INVITATION_LIMIT');
         // Keep bounded device-friendly metadata; retain all still-active invitations.
         while (current.length >= 2048) {
-            const index = current.findIndex(i => i.consumedAt !== undefined);
+            const index = current.findIndex(i => !i.reusable && i.consumedAt !== undefined);
             if (index < 0)
                 throw new Error('INVITATION_LIMIT');
             current.splice(index, 1);
         }
         const code = randomBytes(32).toString('base64url');
-        const invitation = { ...structuredClone(input), ...(input.label ? { label: input.label.trim() } : {}), hash: this.hash(code), issuerId, createdAt: now, invitationExpiresAt: now + TTL };
+        const invitation = { ...structuredClone(input), ...(input.label ? { label: input.label.trim() } : {}), hash: this.hash(code), issuerId, createdAt: now, invitationExpiresAt: input.linkExpiresAt === undefined ? now + TTL : input.linkExpiresAt };
         current.push(invitation);
         this.save(current);
         return { invitationId: invitation.hash, code, expiresAt: invitation.invitationExpiresAt };
@@ -150,16 +163,24 @@ export class InvitationStore {
         const invite = current.find(i => i.hash === hash);
         if (!invite || !issuerAllowed(invite.issuerId))
             throw new Error('PAIRING_DENIED');
-        if (invite.consumedAt !== undefined)
+        if (!invite.reusable && invite.consumedAt !== undefined)
             throw new Error('INVITATION_USED');
-        if (invite.invitationExpiresAt <= now || (invite.expiresAt !== undefined && invite.expiresAt <= now))
+        if (invite.invitationExpiresAt !== null && invite.invitationExpiresAt <= now || (invite.expiresAt !== undefined && invite.expiresAt <= now))
             throw new Error('INVITATION_EXPIRED');
+        if (invite.reusable) {
+            invite.subjects ??= [];
+            if (!invite.subjects.includes(subjectId)) {
+                if (invite.subjects.length >= 10000)
+                    throw new Error('INVITATION_LIMIT');
+                invite.subjects.push(subjectId);
+            }
+        }
         invite.consumedAt = now;
         invite.consumedBy = subjectId;
         this.save(current);
-        return { subjectId, ...(invite.resources ? { resources: structuredClone(invite.resources) } : {}), ...(invite.sessionAppearance ? { sessionAppearance: structuredClone(invite.sessionAppearance) } : {}), scope: structuredClone(invite.scope), actions: [...invite.actions], ...(invite.expiresAt === undefined ? {} : { expiresAt: invite.expiresAt }), canDelegate: false };
+        return { subjectId, ...(invite.reusable ? { invitationId: invite.hash } : {}), ...(invite.resources ? { resources: structuredClone(invite.resources) } : {}), ...(invite.sessionAppearance ? { sessionAppearance: structuredClone(invite.sessionAppearance) } : {}), scope: structuredClone(invite.scope), actions: [...invite.actions], ...(invite.expiresAt === undefined ? {} : { expiresAt: invite.expiresAt }), canDelegate: false };
     }
     subjectLabels() {
-        return Object.fromEntries(this.read().filter(i => i.consumedBy && i.label).map(i => [i.consumedBy, i.label]));
+        return Object.fromEntries(this.read().filter(i => i.label).flatMap(i => (i.subjects || (i.consumedBy ? [i.consumedBy] : [])).map(subject => [subject, i.label])));
     }
 }

package/dist/server/federation/requestContext.js

@@ -4,7 +4,9 @@ export function encryptedRequestResources(request) { return resources.get(reques
 const verified = new WeakSet();
 const subjects = new WeakMap();
 const serviceAccess = new WeakSet();
-export function markEncryptedRequest(request, subjectId, fullService = false, shared) {
+const restrictedChat = new WeakSet();
+export function isRestrictedChatRequest(request) { return restrictedChat.has(request); }
+export function markEncryptedRequest(request, subjectId, fullService = false, shared, chatOnly = false) {
     verified.add(request);
     if (shared)
         resources.set(request, shared);
@@ -12,6 +14,8 @@ export function markEncryptedRequest(request, subjectId, fullService = false, sh
         subjects.set(request, subjectId);
     if (fullService)
         serviceAccess.add(request);
+    if (chatOnly)
+        restrictedChat.add(request);
 }
 export function isEncryptedRequest(request) { return verified.has(request); }
 export function encryptedRequestSubject(request) { return subjects.get(request); }

package/dist/server/federation/routeAccess.js

@@ -1,6 +1,7 @@
 import { readFileSync, writeFileSync, mkdirSync, renameSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { relayServiceMetadata } from './serviceMetadata.js';
 const validId = (x) => typeof x === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(x);
 const digest = (s) => createHash('sha256').update(s).digest();
 /** Target directory is re-read on every permission check; invalid config denies all. */
@@ -12,6 +13,8 @@ export class RouteAccess {
     additionalTargetIds;
     tickets = new Map();
     selfRelayTickets = new Map();
+    serviceMetadata = new Map();
+    selfRelayMetadata(serviceId) { return { ...this.serviceMetadata.get(serviceId) }; }
     constructor(filePath, now = Date.now, canRouteSubject = () => false, additionalTargets = () => [], additionalTargetIds = () => []) {
         this.filePath = filePath;
         this.now = now;
@@ -68,7 +71,7 @@ export class RouteAccess {
     /** A Noise-authenticated service can advertise only its own identity. The
      * short-lived token merely transfers that identity onto the relay socket; it
      * grants neither route use nor target-service access. */
-    issueSelfRelayTicket(serviceId) {
+    issueSelfRelayTicket(serviceId, metadata) {
         if (!validId(serviceId))
             throw new Error('INVALID_SELF_RELAY_IDENTITY');
         for (const [key, value] of this.selfRelayTickets)
@@ -78,7 +81,7 @@ export class RouteAccess {
             throw new Error('SELF_RELAY_TICKET_LIMIT');
         const selfRelayToken = randomBytes(32).toString('base64url');
         const expiresAt = this.now() + 30_000;
-        this.selfRelayTickets.set(digest(selfRelayToken).toString('hex'), { serviceId, expiresAt });
+        this.selfRelayTickets.set(digest(selfRelayToken).toString('hex'), { serviceId, expiresAt, metadata: relayServiceMetadata(metadata) });
         return { selfRelayToken, expiresAt };
     }
     /** Single-use, fail-closed transfer from the authenticated Noise channel to
@@ -91,6 +94,12 @@ export class RouteAccess {
         this.selfRelayTickets.delete(key);
         if (!ticket || ticket.expiresAt <= this.now())
             return null;
+        // Publish only after the single-use ticket is consumed. It is bound to the
+        // authenticated service ID, cannot authorize routes, and is never persisted.
+        this.serviceMetadata.delete(ticket.serviceId);
+        if (this.serviceMetadata.size >= 256)
+            this.serviceMetadata.delete(this.serviceMetadata.keys().next().value);
+        this.serviceMetadata.set(ticket.serviceId, ticket.metadata);
         return { kind: 'self-relay', serviceId: ticket.serviceId };
     }
     /** Called once before upgrading. A route ticket is consumed even if expired. */

package/dist/server/federation/routeInvitations.js

@@ -55,14 +55,17 @@ export class RouteInvitationStore {
             && data.version === 1 && data.serviceId === this.options.serviceId && Array.isArray(data.invitations) && data.invitations.length <= MAX_RECORDS);
         const hashes = new Set();
         for (const item of data.invitations) {
-            valid(object(item) && Object.keys(item).every(key => ['hash', 'issuerId', 'targetServiceId', 'createdAt', 'expiresAt', 'subjectId', 'consumedAt', 'revokedAt'].includes(key)));
+            valid(object(item) && Object.keys(item).every(key => ['hash', 'issuerId', 'targetServiceId', 'createdAt', 'expiresAt', 'subjectId', 'consumedAt', 'revokedAt', 'reusable', 'linkExpiresAt', 'parentInvitationId'].includes(key)));
             valid(typeof item.hash === 'string' && /^[a-f0-9]{64}$/.test(item.hash) && !hashes.has(item.hash));
             hashes.add(item.hash);
-            valid(validIdentity(item.issuerId) && validIdentity(item.targetServiceId) && timestamp(item.createdAt) && timestamp(item.expiresAt)
-                && item.expiresAt === item.createdAt + INVITATION_TTL_MS);
+            valid(validIdentity(item.issuerId) && validIdentity(item.targetServiceId) && timestamp(item.createdAt) && (item.expiresAt === null ? item.linkExpiresAt === null : timestamp(item.expiresAt)
+                && item.expiresAt === (item.linkExpiresAt ?? item.createdAt + INVITATION_TTL_MS)));
+            valid(item.reusable === undefined || typeof item.reusable === 'boolean');
+            valid(item.linkExpiresAt === undefined || item.linkExpiresAt === null || timestamp(item.linkExpiresAt));
+            valid(item.parentInvitationId === undefined || typeof item.parentInvitationId === 'string' && /^[a-f0-9]{64}$/.test(item.parentInvitationId));
             valid(item.revokedAt === undefined || timestamp(item.revokedAt));
             valid((item.subjectId === undefined && item.consumedAt === undefined)
-                || (validIdentity(item.subjectId) && timestamp(item.consumedAt) && item.consumedAt >= item.createdAt && item.consumedAt < item.expiresAt));
+                || (validIdentity(item.subjectId) && timestamp(item.consumedAt) && item.consumedAt >= item.createdAt && (item.expiresAt === null || item.consumedAt < Number(item.expiresAt))));
         }
         return data.invitations;
     }
@@ -90,24 +93,44 @@ export class RouteInvitationStore {
             }
         }
     }
-    create(issuerId, targetServiceId) {
+    create(issuerId, targetServiceId, settings = {}) {
+        if (!object(settings) || Object.keys(settings).some(k => !['reusable', 'linkExpiresAt'].includes(k)) || settings.reusable !== undefined && typeof settings.reusable !== 'boolean' || settings.linkExpiresAt !== undefined && settings.linkExpiresAt !== null && (!timestamp(settings.linkExpiresAt) || settings.linkExpiresAt <= this.now()))
+            throw new Error('INVALID_ROUTE_INVITATION_SETTINGS');
         if (!validIdentity(issuerId) || !validIdentity(targetServiceId) || !this.available(issuerId, targetServiceId))
             throw new Error('ROUTE_INVITATION_DENIED');
         const now = this.now();
-        const current = this.read().filter(item => item.subjectId !== undefined || item.expiresAt > now);
+        const current = this.read().filter(item => item.subjectId !== undefined || item.reusable || item.expiresAt === null || item.expiresAt > now);
         if (current.length >= MAX_RECORDS || current.filter(item => item.subjectId === undefined).length >= MAX_PENDING)
             throw new Error('ROUTE_INVITATION_LIMIT');
         const routeCode = randomBytes(32).toString('base64url');
-        const expiresAt = now + INVITATION_TTL_MS;
-        current.push({ hash: this.hash(routeCode), issuerId, targetServiceId, createdAt: now, expiresAt });
+        const expiresAt = settings.linkExpiresAt === undefined ? now + INVITATION_TTL_MS : settings.linkExpiresAt;
+        current.push({ hash: this.hash(routeCode), issuerId, targetServiceId, createdAt: now, expiresAt, ...settings });
         this.save(current);
-        return { routeCode, expiresAt };
+        return { routeCode, expiresAt, invitationId: this.hash(routeCode), ...(settings.reusable ? { reusable: true } : {}) };
     }
     consume(routeCode, actualSubjectId) {
         if (typeof routeCode !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(routeCode) || !validIdentity(actualSubjectId))
             throw new Error('ROUTE_PAIRING_DENIED');
         const hash = this.hash(routeCode), current = this.read(), now = this.now();
         const invitation = current.find(item => item.hash === hash);
+        if (invitation?.parentInvitationId)
+            throw new Error('ROUTE_PAIRING_DENIED');
+        if (invitation?.reusable) {
+            if (invitation.revokedAt !== undefined || !this.available(invitation.issuerId, invitation.targetServiceId))
+                throw new Error('ROUTE_PAIRING_DENIED');
+            const previous = current.find(item => item.parentInvitationId === hash && item.subjectId === actualSubjectId);
+            if (previous?.revokedAt !== undefined)
+                throw new Error('ROUTE_INVITATION_DEVICE_REVOKED');
+            if (previous)
+                return { serviceId: invitation.targetServiceId };
+            if (invitation.expiresAt !== null && invitation.expiresAt <= now)
+                throw new Error('ROUTE_INVITATION_EXPIRED');
+            if (current.length >= MAX_RECORDS)
+                throw new Error('ROUTE_INVITATION_LIMIT');
+            current.push({ ...invitation, hash: randomBytes(32).toString('hex'), reusable: undefined, parentInvitationId: hash, subjectId: actualSubjectId, consumedAt: now });
+            this.save(current);
+            return { serviceId: invitation.targetServiceId };
+        }
         if (invitation?.subjectId === actualSubjectId && invitation.revokedAt === undefined && this.available(invitation.issuerId, invitation.targetServiceId))
             return { serviceId: invitation.targetServiceId };
         if (!invitation || invitation.revokedAt !== undefined || invitation.createdAt > now
@@ -115,19 +138,24 @@ export class RouteInvitationStore {
             throw new Error('ROUTE_PAIRING_DENIED');
         if (invitation.subjectId !== undefined)
             throw new Error('ROUTE_INVITATION_USED');
-        if (invitation.expiresAt <= now)
+        if (invitation.expiresAt !== null && invitation.expiresAt <= now)
             throw new Error('ROUTE_INVITATION_EXPIRED');
         invitation.subjectId = actualSubjectId;
         invitation.consumedAt = now;
         this.save(current);
         return { serviceId: invitation.targetServiceId };
     }
+    active(item, current) {
+        const parent = item.parentInvitationId ? current.find(p => p.hash === item.parentInvitationId && p.reusable) : undefined;
+        return item.revokedAt === undefined && (!item.parentInvitationId || !!parent && parent.revokedAt === undefined) && this.available(item.issuerId, item.targetServiceId);
+    }
     list() {
-        return this.read().filter(item => item.subjectId !== undefined).map(item => ({
+        const current = this.read();
+        return current.filter(item => item.subjectId !== undefined).map(item => ({
             id: item.hash, subjectId: item.subjectId, targetServiceId: item.targetServiceId,
             issuerId: item.issuerId, createdAt: item.consumedAt,
             ...(item.revokedAt !== undefined ? { revokedAt: item.revokedAt } : {}),
-            active: item.revokedAt === undefined && this.available(item.issuerId, item.targetServiceId),
+            active: this.active(item, current),
         }));
     }
     grant(issuerId, targetServiceId, subjectId) {
@@ -154,8 +182,9 @@ export class RouteInvitationStore {
         if (!validIdentity(subjectId) || !validIdentity(targetServiceId))
             return false;
         try {
-            return this.read().some(item => item.subjectId === subjectId && item.targetServiceId === targetServiceId
-                && item.revokedAt === undefined && item.consumedAt !== undefined && item.consumedAt <= this.now() && this.available(item.issuerId, targetServiceId));
+            const current = this.read();
+            return current.some(item => item.subjectId === subjectId && item.targetServiceId === targetServiceId
+                && this.active(item, current) && item.consumedAt !== undefined && item.consumedAt <= this.now() && this.available(item.issuerId, targetServiceId));
         }
         catch {
             return false;

package/dist/server/federation/runtime.js

@@ -99,11 +99,12 @@ export async function createFederationRuntime(app, directory, handlers, options
     let passwordComputing = 0;
     const passwordStarts = [];
     const passwordAttempts = new Map();
-    const store = new AuthorizationStore({ serviceId, filePath: join(directory, 'grants.json'), passwordCredential: getPasswordCredentialFingerprint });
+    let invitations;
+    const store = new AuthorizationStore({ serviceId, filePath: join(directory, 'grants.json'), passwordCredential: getPasswordCredentialFingerprint, invitationActive: id => invitations?.hasGrantAuthority(id) === true });
     const sharingPresence = new SessionSharingPresence();
     const deviceProfiles = new DeviceProfiles(join(directory, 'device-profiles.json'));
     const deviceNames = new DeviceNames(join(directory, 'device-names.json'));
-    const invitations = new InvitationStore({ serviceId, filePath: join(directory, 'invitations.json') });
+    invitations = new InvitationStore({ serviceId, filePath: join(directory, 'invitations.json') });
     let pairingCode = randomBytes(32).toString('base64url');
     const savePairing = () => {
         const path = join(directory, 'pairing.json');
@@ -124,7 +125,9 @@ export async function createFederationRuntime(app, directory, handlers, options
         delete request.headers['x-termdock-full-service'];
         const resourcesHeader = request.headers['x-termdock-resources'];
         delete request.headers['x-termdock-resources'];
-        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService, typeof resourcesHeader === 'string' ? JSON.parse(resourcesHeader) : undefined);
+        const chatOnly = request.headers['x-termdock-chat-only'] === '1';
+        delete request.headers['x-termdock-chat-only'];
+        markEncryptedRequest(request, typeof subject === 'string' ? subject : undefined, fullService, typeof resourcesHeader === 'string' ? JSON.parse(resourcesHeader) : undefined, chatOnly);
         app(request, response);
     });
     // The outer encrypted consumer can apply backpressure long after a local
@@ -222,6 +225,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                     const requestResources = mergeShareResources([resources(subjectId), attachment ? { directories: [{ path: attachment, access: 'read' }] } : undefined]);
                     const headers = new Headers({ 'x-termdock-inner': internalToken, 'x-termdock-device': subjectId,
                         'x-termdock-full-service': full(subjectId) ? '1' : '0', 'x-termdock-resources': JSON.stringify(requestResources) });
+                    const policy = resolveAccessRequest(String(operation.head.method), String(operation.head.path));
+                    if (policy?.action === 'session.chat-send' && !full(subjectId) && !allowed(subjectId, 'session.input', policy.sessionId))
+                        headers.set('x-termdock-chat-only', '1');
                     const supplied = operation.head.headers;
                     if (supplied && typeof supplied === 'object')
                         for (const [name, value] of Object.entries(supplied)) {
@@ -294,7 +300,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                             logical.close(4003, 'Authorization revoked');
                         continue;
                     }
-                    if (!allowed(subjectId, sessionId ? 'session.view' : 'service.view', sessionId))
+                    if (!allowed(subjectId, sessionId ? 'session.terminal-view' : 'service.view', sessionId))
                         logical.close(4003, 'Authorization revoked');
                 }
                 for (const [id, operation] of operations)
@@ -408,7 +414,11 @@ export async function createFederationRuntime(app, directory, handlers, options
                         }
                         else {
                             const grant = invitations.consume(typeof packet.code === 'string' ? packet.code : '', subjectId, issuer => allowed(issuer, 'authorization.manage'));
-                            store.grant(grant);
+                            const existing = grant.invitationId ? store.list().filter(item => item.invitationId === grant.invitationId && item.subjectId === subjectId) : [];
+                            if (existing.some(item => item.revokedAt !== undefined))
+                                throw new Error('INVITATION_DEVICE_REVOKED');
+                            if (!existing.length)
+                                store.grant(grant);
                         }
                         send({ type: 'result', id: packet.id, serviceId, subjectId });
                     }
@@ -427,18 +437,18 @@ export async function createFederationRuntime(app, directory, handlers, options
                         if (options.restoreSharedSession && !full(subjectId)) {
                             let restored = false;
                             for (const session of inventory) {
-                                if (session.backendSessionId || typeof session.sessionId !== 'string' || !allowed(subjectId, 'session.view', session.sessionId))
+                                if (session.backendSessionId || typeof session.sessionId !== 'string' || !allowed(subjectId, 'session.metadata', session.sessionId))
                                     continue;
                                 restored = await options.restoreSharedSession(session.sessionId).catch(() => false) || restored;
                             }
                             if (restored)
                                 inventory = await sessionInventory();
                         }
-                        const displayGrants = store.listEffective({ subjectId, serviceId }).filter(grant => grant.actions.includes('session.view')).reverse().sort((a, b) => b.createdAt - a.createdAt);
+                        const displayGrants = store.listEffective({ subjectId, serviceId }).filter(grant => grant.actions.some(action => ['session.view', 'session.chat-view', 'session.terminal-view'].includes(action))).reverse().sort((a, b) => b.createdAt - a.createdAt);
                         const seen = new Set();
                         const items = inventory.flatMap(session => {
                             const sessionId = session.backendSessionId;
-                            if (typeof sessionId !== 'string' || !sessionId || seen.has(sessionId) || !allowed(subjectId, 'session.view', sessionId))
+                            if (typeof sessionId !== 'string' || !sessionId || seen.has(sessionId) || !allowed(subjectId, 'session.metadata', sessionId))
                                 return [];
                             seen.add(sessionId);
                             const matches = (id) => id === session.sessionId || id === sessionId || stableSessionId(id) === session.sessionId;
@@ -447,7 +457,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                             return [{ sessionId, ...(typeof session.sessionId === 'string' ? { sourceSessionId: session.sessionId } : {}),
                                     ...(options.sessionAttachmentDirectory ? { attachmentRoot: sessionAttachmentRoot(options.sessionAttachmentDirectory, typeof session.sessionId === 'string' ? session.sessionId : options.resolveSessionId?.(sessionId) || sessionId) } : {}),
                                     name: appearance?.name || collaborationSessionDisplayName({ ...session, name: typeof session.name === 'string' ? session.name : sessionId }), ...(appearance?.icon ? { icon: appearance.icon } : {}), live: session.live === true,
-                                    canWrite: allowed(subjectId, 'session.input', sessionId), canResize: allowed(subjectId, 'session.resize', sessionId) }];
+                                    canWrite: allowed(subjectId, 'session.input', sessionId), canResize: allowed(subjectId, 'session.resize', sessionId),
+                                    canViewChat: allowed(subjectId, 'session.chat-view', sessionId), canViewTerminal: allowed(subjectId, 'session.terminal-view', sessionId),
+                                    canSendChat: allowed(subjectId, 'session.chat-send', sessionId), canClearChat: allowed(subjectId, 'session.chat-clear', sessionId) }];
                         });
                         send({ type: 'result', id: packet.id, items });
                     }
@@ -469,7 +481,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                     else if (packet.type === 'self-relay-ticket') {
                         if (!options.issueSelfRelayTicket)
                             throw new Error('SELF_RELAY_UNAVAILABLE');
-                        send({ type: 'result', id: packet.id, serviceId: subjectId, ...options.issueSelfRelayTicket(subjectId) });
+                        send({ type: 'result', id: packet.id, serviceId: subjectId, ...options.issueSelfRelayTicket(subjectId, packet.metadata) });
                     }
                     else if (packet.type === 'route-invite-create') {
                         if (packet.serviceId === serviceId)
@@ -477,7 +489,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                         check('authorization.manage');
                         if (!options.createRouteInvitation || typeof packet.serviceId !== 'string' || !packet.serviceId || packet.serviceId.length > 512)
                             throw new Error('ROUTE_NOT_AVAILABLE');
-                        send({ type: 'result', id: packet.id, ...options.createRouteInvitation(subjectId, packet.serviceId) });
+                        const settings = { ...(packet.reusable === undefined ? {} : { reusable: packet.reusable }), ...(packet.linkExpiresAt === undefined ? {} : { linkExpiresAt: packet.linkExpiresAt }) };
+                        const invitation = Object.keys(settings).length ? options.createRouteInvitation(subjectId, packet.serviceId, settings) : options.createRouteInvitation(subjectId, packet.serviceId);
+                        send({ type: 'result', id: packet.id, ...invitation });
                     }
                     else if (packet.type === 'route-pair') {
                         if (!options.consumeRouteInvitation || typeof packet.code !== 'string')
@@ -523,6 +537,7 @@ export async function createFederationRuntime(app, directory, handlers, options
                     else if (packet.type === 'invite-create') {
                         check('authorization.manage');
                         const invitation = { scope: packet.scope, actions: packet.actions, ...(packet.resources === undefined ? {} : { resources: packet.resources }),
+                            ...(packet.reusable === undefined ? {} : { reusable: packet.reusable }), ...(packet.linkExpiresAt === undefined ? {} : { linkExpiresAt: packet.linkExpiresAt }),
                             ...(packet.sessionAppearance === undefined ? {} : { sessionAppearance: packet.sessionAppearance }),
                             ...(packet.label === undefined ? {} : { label: packet.label }),
                             ...(packet.expiresAt === undefined ? {} : { expiresAt: packet.expiresAt }) };
@@ -572,7 +587,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                     }
                     else if (packet.type === 'invite-revoke') {
                         check('authorization.manage');
-                        send({ type: 'result', id: packet.id, revoked: typeof packet.invitationId === 'string' && invitations.revoke(packet.invitationId) });
+                        const revoked = typeof packet.invitationId === 'string' && invitations.revoke(packet.invitationId);
+                        const revokedGrants = revoked ? store.revokeInvitation(String(packet.invitationId)) : 0;
+                        send({ type: 'result', id: packet.id, revoked, revokedGrants });
                     }
                     else if (packet.type === 'grant') {
                         check('authorization.manage');
@@ -657,9 +674,9 @@ export async function createFederationRuntime(app, directory, handlers, options
                         const androidMatch = /^\/api\/android\/([^/%]+)\/ws$/.exec(url.pathname);
                         const computer = url.pathname === '/api/computer/ws';
                         const computerTarget = { host: url.searchParams.get('host') ?? '', protocol: url.searchParams.get('protocol') ?? 'vnc', port: Number(url.searchParams.get('port') ?? (url.searchParams.get('protocol') === 'rdp' ? '3389' : '5900')) };
-                        const canView = () => androidMatch ? androidAllowed(subjectId, androidMatch[1]) : computer ? computerAllowed(subjectId, computerTarget) : allowed(subjectId, match ? 'session.view' : 'service.view', match?.[1]);
+                        const canView = () => androidMatch ? androidAllowed(subjectId, androidMatch[1]) : computer ? computerAllowed(subjectId, computerTarget) : allowed(subjectId, match ? 'session.terminal-view' : 'service.view', match?.[1]);
                         if (match) {
-                            check('session.view', match[1]);
+                            check('session.terminal-view', match[1]);
                             if (!full(subjectId))
                                 sharingPresence.visit(presenceKey, subjectId, stableSessionId(match[1]) || match[1]);
                         }

package/dist/server/federation/selfRelay.js

@@ -1,6 +1,8 @@
 import WebSocket from 'ws';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
+import { hostname } from 'node:os';
+import { getTermdockVersion } from '../utils/version.js';
 import { desktopDirectTargets } from './desktopTargets.js';
 import { RelayClient } from './relay.js';
 import { openServiceSocket } from './serviceTransport.js';
@@ -103,7 +105,7 @@ export class DesktopSelfRelay {
         const rpc = await connectCollaborationRpc(this.options.identity, peer, undefined, undefined, configuredCa, target.certificateFingerprint256, state.lifetime.signal);
         let selfRelayToken;
         try {
-            const result = await rpc.request({ type: 'self-relay-ticket' });
+            const result = await rpc.request({ type: 'self-relay-ticket', metadata: { hostname: hostname(), platform: process.platform, version: getTermdockVersion() } });
             if (result.serviceId !== this.options.serviceId || typeof result.selfRelayToken !== 'string'
                 || !/^[A-Za-z0-9_-]{43}$/.test(result.selfRelayToken))
                 throw new Error('INVALID_SELF_RELAY_TICKET');

package/dist/server/federation/serviceMetadata.js

@@ -0,0 +1,11 @@
+export function relayServiceMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const source = value;
+    const text = (key, max) => typeof source[key] === 'string' && source[key].length <= max
+        && !/[\p{Cc}\p{Cf}]/u.test(source[key]) ? source[key].trim() || undefined : undefined;
+    const hostname = text('hostname', 120), platform = text('platform', 24), version = text('version', 48);
+    return { ...(hostname ? { hostname } : {}),
+        ...(['darwin', 'linux', 'win32', 'freebsd', 'openbsd', 'aix', 'sunos', 'android'].includes(platform || '') ? { platform } : {}),
+        ...(version && /^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/.test(version) ? { version } : {}) };
+}

package/dist/server/federation/serviceTransport.js

@@ -31,6 +31,8 @@ export async function serviceTlsOptions(address, trust = {}, baseDir = process.c
  * entry's ready frame. No business bytes are sent during TLS pin inspection. */
 export async function createServiceSocket(address, trust = {}, options = {}) {
     const url = new URL(address);
+    if (url.protocol === 'ws:' && !['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname))
+        throw new Error('Remote service transport requires HTTPS');
     const origin = normalizeServiceAddress(url.origin.replace(/^wss:/, 'https:').replace(/^ws:/, 'http:'));
     if (!['wss:', 'ws:'].includes(url.protocol) || url.username || url.password || url.hash
         || !['/api/federation/secure', '/api/federation/relay', '/api/federation/relay-target'].includes(url.pathname)

package/dist/server/federation/sessionAttachmentAccess.js

@@ -38,7 +38,7 @@ export function attachmentReadRoot(directory, grants, normalize, method, request
     if (!/^[a-f0-9]{64}$/.test(hash) || !file.length)
         return;
     const root = path.join(base, hash);
-    if (!grants.some(grant => (grant.actions.includes('session.view') || grant.actions.includes('service:*'))
+    if (!grants.some(grant => (grant.actions.some(action => ['session.view', 'session.chat-view', 'session.terminal-view', 'service:*'].includes(action)))
         && (grant.scope.kind === 'service' || grant.scope.sessionIds.some(id => sessionAttachmentRoot(base, normalize(id)) === root))))
         return;
     return resourceHttpAllowed({ directories: [{ path: root, access: 'read' }] }, method, requestPath) ? root : undefined;

package/dist/server/onboardingPage.js

@@ -55,7 +55,7 @@ ${loadOnboardingTheme()}
 ${Object.entries(instructions).map(([key, value]) => `<ol data-device="${key}"${key === device ? '' : ' hidden'}>${value.steps.map(step => `<li>${escapeHtml(step)}</li>`).join('')}</ol>`).join('')}
 <a id="download" class="action primary" href="/onboarding/ca.crt" download="termdock-ca.crt">下载证书</a><p id="download-status" class="muted" role="status"></p></section>
 <section><h2>2. 返回这里，继续访问</h2><p class="muted">已在系统中完成信任，或以前安装过此证书？可以直接继续。</p><a id="continue" class="action" href="${escapeHtml(target.href)}">继续访问</a><p class="muted">若仍出现证书错误，请返回检查是否已开启信任，不必跳过浏览器警告。</p></section>
-<details><summary>核对证书与安全说明</summary><p>此引导页通过 HTTP 提供，无法单凭这个页面确认设备身份。请通过你已信任的对话渠道，与分享者核对以下 SHA-256 指纹后再安装。</p><code>${escapeHtml(fingerprint)}</code><p>目标地址：<span class="host">${escapeHtml(target.origin)}</span></p><p>下载证书不会自动获得系统信任，也不会自动接受分享邀请。进入 HTTPS 页面后，仍按原分享权限验证。</p><p>不再需要时，可在系统或浏览器的证书管理中移除此根证书；iPhone / iPad 可删除对应的描述文件。</p></details><footer>HTTP 仅用于安装引导。此页不加载终端、聊天或文件内容。</footer></main>
+<details><summary>核对证书与安全说明</summary><p>此引导页通过 HTTP 提供，无法单凭这个页面确认设备身份。请通过你已信任的对话渠道，与分享者核对以下 SHA-256 指纹后再安装。</p><code>${escapeHtml(fingerprint)}</code><p>目标地址：<span class="host">${escapeHtml(target.origin)}</span></p><p>下载证书不会自动获得系统信任，也不会自动接受分享邀请。进入 HTTPS 页面后，仍按原分享权限验证。</p><p>不再需要时，可在系统或浏览器的证书管理中移除此根证书；iPhone / iPad 可删除对应的描述文件。</p></details><footer>证书安装是可选步骤。返回原邀请页可直接通过 HTTP 接受邀请；安装并信任后可使用 HTTPS。</footer></main>
 <script nonce="${nonce}">
 const device=document.getElementById('device');device.addEventListener('change',()=>{document.querySelectorAll('[data-device]').forEach(list=>{list.hidden=list.dataset.device!==device.value;});});
 const next=document.getElementById('continue');const destination=new URL(next.href);if(location.hash.startsWith('#termdock-invite=')&&location.hash.length<=8250)destination.hash=location.hash;next.href=destination.href;