ba85871227
New relay-run/ package boots the REAL term-relay relay-node between a browser WSS
listener and an agent mTLS listener, delegating every authz verdict to the real
relay-auth onUpgrade (Origin/CSWSH + capability verify + DPoP PoP + single-use jti),
with the real P4 E2E crypto. No audited package modified.
- P1 (done): in-process integration test round-trips a sealed payload both ways
through the real createRelayNode splice + real createMuxSession; INV2 asserted
(relay sees only ciphertext); negative controls (foreign Origin / missing DPoP -> 401).
- P2 (boots): main.ts brings up self-signed TLS + 3 listeners + in-memory control-plane.
- P3 (not landed): no agent dial / node-pty / relay-web serve yet.
- 4 tests green, tsc clean. node_modules via symlinks (gitignored).
Two real seam drifts surfaced (documented in PLAN_RELAY_RUN_PHASE0, not hacked):
(1) term-relay authz-port DpopContext shape vs relay-auth — reconciled (server-derived htu/htm);
(2) control-plane CapabilityVerifier.verify is sync but relay-auth verify is async — blocks
HTTP account/pairing seeding until a 1-line async widen.
17 lines
608 B
JSON
17 lines
608 B
JSON
{
|
|
"name": "relay-run",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Phase 0 single-host runnable rendezvous-relay. Composes the REAL P1 (term-relay data-plane), P4 (relay-e2e), and P5 (relay-auth) exports through in-memory control-plane stores + self-signed TLS, so a browser can click through to a local shell E2E-spliced by the real relay-node. Dev only. See docs/PLAN_RELAY_RUN_PHASE0.md.",
|
|
"engines": {
|
|
"node": ">=20"
|
|
},
|
|
"scripts": {
|
|
"start": "tsx src/main.ts",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"typecheck": "tsc --noEmit"
|
|
}
|
|
}
|