web-terminal

kai/web-terminal

Fork 0

Commit Graph

Author	SHA1	Message	Date
Yaojia Wang	aa1912b962	feat(relay): Phase1 waves A2-E — server entry, shared-store data plane, agent runtime, deploy artifacts RELAY-PHASE1 Wave A2/B/C/D/E (12-agent workflow, all tsc-clean, 314/314 tests pass): - A2: control-plane server.ts entry + boot/redis.ts revocation-bus wiring + start script. - B1: relay-run shared-store EnforceDeps (relay-auth ports over the SAME Postgres+Redis as P3). - B2: registry-backed MtlsVerifier (verifyAgentCert, fail-closed, INV14). - B3: store-backed RouteResolver (subdomain->hostId). - B4: Redis relay:revocations subscriber -> tunnel teardown (INV12). - B5: main-phase1.ts production entry (public bind, real TLS, async-mTLS prefetch bridge) + staging /auth/mint. - B6 (PARTIAL): relay-web operator login + browser DPoP; proof offered via term.dpop.<b64u> subprotocol. - C: agent dist/cli.js build (esbuild) + runTunnel run-loop + CliDeps. - D1: same-origin static serve of relay-web/public from the browser WSS. - E: systemd units + gen-ca/gen-capability-key/issue-tls-cert scripts + deploy/RUNBOOK.md. Adversarial review: all hard invariants PASS. Follow-ups (B7): close DPoP-subprotocol read on browser-server (blocks browser connect); rate-limit /auth/mint (F1); wire activeSessionCount (F2); scrub error logs (F5). Excludes unrelated public/style.css (concurrent iOS job).	2026-07-06 16:13:34 +02:00
Yaojia Wang	ba85871227	feat(relay-run): Phase 0 single-host relay — real data-plane wiring + integration test New relay-run/ package boots the REAL term-relay relay-node between a browser WSS listener and an agent mTLS listener, delegating every authz verdict to the real relay-auth onUpgrade (Origin/CSWSH + capability verify + DPoP PoP + single-use jti), with the real P4 E2E crypto. No audited package modified. - P1 (done): in-process integration test round-trips a sealed payload both ways through the real createRelayNode splice + real createMuxSession; INV2 asserted (relay sees only ciphertext); negative controls (foreign Origin / missing DPoP -> 401). - P2 (boots): main.ts brings up self-signed TLS + 3 listeners + in-memory control-plane. - P3 (not landed): no agent dial / node-pty / relay-web serve yet. - 4 tests green, tsc clean. node_modules via symlinks (gitignored). Two real seam drifts surfaced (documented in PLAN_RELAY_RUN_PHASE0, not hacked): (1) term-relay authz-port DpopContext shape vs relay-auth — reconciled (server-derived htu/htm); (2) control-plane CapabilityVerifier.verify is sync but relay-auth verify is async — blocks HTTP account/pairing seeding until a 1-line async widen.	2026-07-04 14:13:04 +02:00

Author

SHA1

Message

Date

Yaojia Wang

aa1912b962

feat(relay): Phase1 waves A2-E — server entry, shared-store data plane, agent runtime, deploy artifacts

RELAY-PHASE1 Wave A2/B/C/D/E (12-agent workflow, all tsc-clean, 314/314 tests pass):
- A2: control-plane server.ts entry + boot/redis.ts revocation-bus wiring + start script.
- B1: relay-run shared-store EnforceDeps (relay-auth ports over the SAME Postgres+Redis as P3).
- B2: registry-backed MtlsVerifier (verifyAgentCert, fail-closed, INV14).
- B3: store-backed RouteResolver (subdomain->hostId).
- B4: Redis relay:revocations subscriber -> tunnel teardown (INV12).
- B5: main-phase1.ts production entry (public bind, real TLS, async-mTLS prefetch bridge) + staging /auth/mint.
- B6 (PARTIAL): relay-web operator login + browser DPoP; proof offered via term.dpop.<b64u> subprotocol.
- C: agent dist/cli.js build (esbuild) + runTunnel run-loop + CliDeps.
- D1: same-origin static serve of relay-web/public from the browser WSS.
- E: systemd units + gen-ca/gen-capability-key/issue-tls-cert scripts + deploy/RUNBOOK.md.
Adversarial review: all hard invariants PASS. Follow-ups (B7): close DPoP-subprotocol read on
browser-server (blocks browser connect); rate-limit /auth/mint (F1); wire activeSessionCount (F2);
scrub error logs (F5). Excludes unrelated public/style.css (concurrent iOS job).

2026-07-06 16:13:34 +02:00

Yaojia Wang

ba85871227

feat(relay-run): Phase 0 single-host relay — real data-plane wiring + integration test

New relay-run/ package boots the REAL term-relay relay-node between a browser WSS
listener and an agent mTLS listener, delegating every authz verdict to the real
relay-auth onUpgrade (Origin/CSWSH + capability verify + DPoP PoP + single-use jti),
with the real P4 E2E crypto. No audited package modified.

- P1 (done): in-process integration test round-trips a sealed payload both ways
  through the real createRelayNode splice + real createMuxSession; INV2 asserted
  (relay sees only ciphertext); negative controls (foreign Origin / missing DPoP -> 401).
- P2 (boots): main.ts brings up self-signed TLS + 3 listeners + in-memory control-plane.
- P3 (not landed): no agent dial / node-pty / relay-web serve yet.
- 4 tests green, tsc clean. node_modules via symlinks (gitignored).

Two real seam drifts surfaced (documented in PLAN_RELAY_RUN_PHASE0, not hacked):
(1) term-relay authz-port DpopContext shape vs relay-auth — reconciled (server-derived htu/htm);
(2) control-plane CapabilityVerifier.verify is sync but relay-auth verify is async — blocks
    HTTP account/pairing seeding until a 1-line async widen.

2026-07-04 14:13:04 +02:00

2 Commits