2 Commits

Include renames

Author	SHA1	Message	Date
jaap-jan	6e39807cc0	Reach a Spelunk-managed server through Spelunk, and open one from a Spelunk link ... A server Spelunk manages runs Spelunk's agent, which keeps a connection open to Spelunk. A host can now be marked "Connect through Spelunk": a connect asks Spelunk for a ticket, opens a WebSocket, and the agent connects to the SSH server on the machine's own loopback, so the server needs no open SSH port. Shells and file transfers both go this way. Client, in Client.Session: - SpelunkTunnel implements Spelunk's contract: POST {api}/api/servers/{id}/tunnel-tickets with the API key as a bearer token and {"port":N}, then a WebSocket to the API's own origin at the path Spelunk returns, offering spelunk.tunnel.v1 and ticket.<ticket>. After the upgrade the relay's RelayBridge carries the bytes unchanged. Every refusal is a sentence: 401 key, 403 role (with Spelunk's detail), 404 server, 503 agent not connected, 401/503 on the upgrade, and close codes 4502 (agent could not reach the port, or is too old: "Unknown stream kind") and 4503 (agent disconnected). Only a path is taken from the ticket response, so it cannot send the ticket to another host. - IConnectionRoute is what RelayRoute and SpelunkTunnelRoute have in common, so the connect path has one shape for both. Host model: HostSecret.Spelunk is a SpelunkRoute (normalised API base, server id, and the id of the credential holding the API key), at payload schema version 8. It is written last and only when present, so every other host keeps its bytes and its version; an older build reads a Spelunk host as read-only rather than dropping the route. A half-written route makes the item unreadable instead of dialled. It merges as one value and is exclusive with RelayEnabled. The API address must be https, or http to loopback. The API key is an ordinary keychain credential whose password is the key, referenced by id, so it is encrypted, synced, merged and rotated like every other secret, one credential serves every server in the organisation, and the used-by list and deletion warning count it. Routing: OpenRouteAsync is the one decision for both transports. A Spelunk host is never dialled directly, never probed after a failure, and a route that hung up with a reason replaces SSH.NET's transport error. UI: a "Connect through Spelunk" card beside the relay card in the desktop drawer and the phone's editor; ticking one unticks the other. dodossh://spelunk/connect?api=&server=&name=&host= links: - SpelunkLink parses them strictly and never reads a credential from one. - Program reads a link from the arguments; a launch that finds DodoSSH running passes it down the doorbell as "dodossh.open-link <link>", which the running instance parses again, bounded, and otherwise ignores whole. The plain come-forward ring is unchanged. - A saved host routed to that server on that Spelunk is connected to; otherwise the editor opens on a new, unsaved Spelunk host, with the key pre-chosen only when another host already sends it to that Spelunk. A link that arrives while locked waits for the unlock. - Windows registers the scheme under HKCU from Velopack's install and update hooks and removes it on uninstall only if it still points at this executable; the macOS plist template declares CFBundleURLTypes and the app takes the URL from Avalonia's activation event; the Linux desktop entry gets %u and MimeType=x-scheme-handler/dodossh.	2026-09-28 21:25:04 +02:00
jaap-jan	890a5f2246	Give the desktop a macOS head, signed from the first release ... The same application, the same Velopack and the same two-phase person-run release as Windows, with four things forced to differ. Signing is a precondition rather than an improvement: Gatekeeper refuses an un-notarized download outright instead of warning about it, so there was never the "unsigned for now" that ADR 0013 decision 8 argues for on Windows, and release-macos.sh refuses to start without the identities. The packaging split is narrower than it first looked, and the old claim at the foot of ci.yml is why it was worth checking rather than assuming. vpk cross-compiles when told to: 'vpk [osx] bundle' builds a real .app on any platform, and CI now publishes osx-arm64 and bundles it on every main and tag build, which is what catches a restore graph with no macOS native asset. There is no '[osx] pack' off a Mac, and that part is correct — pack drives codesign, notarytool and stapler, which exist nowhere else. The dylib signing loop in the script looks redundant beside vpk's own pass and is not. vpk signs with 'codesign --deep', which is the shape Apple documents as wrong for nested code, and platform-flags has recorded a notarization rejection that names no file since before any of this existed. Signing each native binary inside-out first leaves that pass nothing to get wrong. MacDeviceKeyStore reaches ADR 0007's conclusion through different hardware: a P-256 key in the Secure Enclave under an access control requiring user presence, so the platform enforces the gate rather than this process — which is the whole point of that ADR's amendment. The enclave holds no other kind of key, hence ECIES where Windows uses RSA-OAEP, and the shape that falls out is better than the Windows one: sealing needs only the public half and is silent, so only unlock prompts. IsSupported probes rather than infers, because three ordinary Macs answer no — an Intel machine without a T2, one with no login password, and every unsigned development build, since enclave keys need a signing identity. Two decisions worth stating because they are reversible. arm64 only: a second channel is small work and nobody here has an Intel Mac to walk Phase 18 on, and an x64 package would be the only artefact in this repository reaching users unverified. And the pack id stays DodoSSH.Desktop even though vpk names the bundle after it, so /Applications holds DodoSSH.Desktop.app: decision 2's reasoning binds harder here, because a pack id of DodoSSH would put Velopack's install root on top of ClientPaths.DataDirectory and let an uninstall take the user's un-synced outbox with it. CFBundleDisplayName puts the product name back in front of a person. Measured rather than assumed, since none of it is obvious: the publish and the bundle were both run, LSMinimumSystemVersion is 12.0 because that is the minos in the apphost's own LC_BUILD_VERSION, and vpk copies a custom Info.plist verbatim with no substitution at all — which is why the plist is a template the script renders and not a committed file. What is not done is the half that needs the hardware. There is no macOS runner, so nothing past "it bundles" has ever run. Phase 18 is the whole of the verification, and the two checks most likely to fail are the terminal against WKWebView and the enclave interop, neither of which has executed once.	2026-08-10 10:43:28 +02:00