100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
DuProcess	f3c7ec225d	Repaint terminal after idle tab return	2026-07-07 12:00:40 -04:00
DuProcess	d3c40a06ac	Bump release candidate to rc5	2026-07-07 11:49:41 -04:00
DuProcess	6b12b3dfe0	Harden terminal reconnect packet handling	2026-07-07 11:48:59 -04:00
DuProcess	b90c34dc17	Bump release candidate to rc4	2026-07-05 18:00:59 -04:00
DuProcess	f205e0c128	Harden native auth and SDK datagram handling	2026-07-05 18:00:31 -04:00
DuProcess	92c94176bd	Bump release candidate to rc3	2026-07-05 09:39:21 -04:00
DuProcess	4b2e9a62d5	Harden embedded transport under UDP churn	2026-07-05 09:37:44 -04:00
DuProcess	689d20f7e7	Bump release candidate to rc2	2026-07-04 23:00:18 -04:00
DuProcess	252f081a61	Suppress stale terminal mouse reports after reconnect	2026-07-04 22:56:32 -04:00
DuProcess	b1e8326b0a	Stop local benchmark holder leaks	2026-07-04 22:31:14 -04:00
DuProcess	3b4931aa8f	Keep server alive on transient UDP send errors	2026-07-04 22:29:52 -04:00
DuProcess	5c54601cdf	Prepare Dosh 1.0.0 rc1	2026-07-04 16:58:15 -04:00
DuProcess	c085137250	Add hostile network TUI soak gate	2026-07-04 14:37:23 -04:00
DuProcess	237ad52bef	Flush queued input after reconnect contact	2026-07-03 16:35:22 -04:00
DuProcess	a8ba852f16	Keep Dosh server service alive	2026-07-03 14:51:47 -04:00
DuProcess	f1a3de7730	Rate limit terminal gap resync	2026-07-03 10:19:53 -04:00
DuProcess	80699dcf9d	Stabilize terminal frame recovery	2026-07-03 10:06:23 -04:00
DuProcess	274c0f505e	Stop sandboxing remote shells	2026-07-02 20:03:42 -04:00
DuProcess	b393c0e5d5	Allow netlink for terminal network monitors	2026-07-02 19:40:30 -04:00
DuProcess	d5bc8e3c64	Recover terminal output gaps with resume repaint	2026-07-02 19:29:20 -04:00
DuProcess	c40f5459ba	Keep live TUI output raw under retransmit pressure	2026-07-02 19:21:43 -04:00
DuProcess	601510687e	Prepare Dosh 0.1.9 release	2026-07-02 19:07:46 -04:00
DuProcess	60387e9222	Install Dosh binaries atomically	2026-07-02 18:41:02 -04:00
DuProcess	a48aa15308	Preserve raw terminal output for TUIs	2026-07-02 18:34:09 -04:00
DuProcess	691b58e531	Harden update and release tooling	2026-07-01 19:48:46 -04:00
DuProcess	431dcc3997	Prepare Dosh 0.1.7 release	2026-07-01 18:03:42 -04:00
DuProcess	3224a9c699	Fix Dosh stdio proxy for VS Code	2026-07-01 09:58:26 -04:00
DuProcess	00f5b2e001	Default Windows installer to Dosh repo	2026-06-30 19:54:16 -04:00
DuProcess	03cb5c0f75	Ignore packaged VS Code extension artifacts	2026-06-30 19:43:48 -04:00
DuProcess	f8056b03b6	Add VS Code Remote SSH integration	2026-06-30 19:42:45 -04:00
DuProcess	42fbf86ca9	Add Dosh stdio proxy for SSH streams	2026-06-30 19:42:35 -04:00
DuProcess	13f8cb07c5	Document Dosh Rust SDK examples	2026-06-30 19:21:28 -04:00
DuProcess	bbf6ffd725	Add native services and embeddable transport SDK	2026-06-30 19:21:23 -04:00
DuProcess	35d9c9c6de	Bump version to 0.1.6	2026-06-28 09:31:50 -04:00
DuProcess	51247576f3	Harden server install restart path	2026-06-28 09:31:06 -04:00
DuProcess	255f584545	Add release check gate	2026-06-28 09:27:34 -04:00
DuProcess	d947ccd934	Clarify update checks for releases	2026-06-28 09:24:20 -04:00
DuProcess	cf27ba7ddf	Drop stale mouse reports on reconnect	2026-06-28 08:57:34 -04:00
DuProcess	02607b49b1	Harden reconnect and stream open reliability	2026-06-27 21:16:12 -04:00
DuProcess	48e3de2922	Refresh reconnect send address and guard prebuilts	2026-06-27 20:11:41 -04:00
DuProcess	c95a913422	Add short post-submit printable input hold	2026-06-27 19:31:47 -04:00
DuProcess	6292784f3a	Keep queued startup control input ordered	2026-06-27 18:54:55 -04:00
DuProcess	d2fd7ee346	Make post-submit input gate command agnostic	2026-06-27 18:36:45 -04:00
DuProcess	acd22b93e8	Gate manual TUI launch input	2026-06-27 18:05:29 -04:00
DuProcess	ef712a79ee	Gate startup command input before TUI readiness	2026-06-27 17:53:59 -04:00
DuProcess	48a59496b2	Expose build identity in version output	2026-06-27 13:45:48 -04:00
DuProcess	606fad72e3	Respect update prebuilt override	2026-06-27 11:48:06 -04:00
DuProcess	9d0396dbf9	Fix reconnect stale keys and TUI status rendering	2026-06-27 11:46:26 -04:00
DuProcess	f71cd975bc	Make update build current source	2026-06-26 19:34:10 -04:00
DuProcess	4842a129f2	Fix startup command and holder fallback	2026-06-26 19:31:33 -04:00
DuProcess	60d73df5be	Support cross Windows release packaging	2026-06-22 17:19:16 -04:00
DuProcess	f9a378a9cd	Harden release readiness gates	2026-06-22 17:14:59 -04:00
DuProcess	fb6cf4e7c2	Warn on client server version mismatch	2026-06-22 01:52:34 -04:00
DuProcess	c0d83c9133	Add Dosh server restart command	2026-06-22 01:50:39 -04:00
DuProcess	a4b3e7c89b	Add Dosh status command	2026-06-22 01:48:16 -04:00
DuProcess	44717e4956	Harden release upload scripts	2026-06-22 01:42:17 -04:00
DuProcess	149ea07edf	Automate Gitea release publishing	2026-06-22 01:41:34 -04:00
DuProcess	6f40ff9e25	Prefer direct Gitea release assets	2026-06-21 15:52:42 -04:00
DuProcess	b21c2eed9d	Slim release packaging	2026-06-21 11:21:05 -04:00
DuProcess	29d894b43b	Read Gitea release token from config	2026-06-21 11:02:22 -04:00
DuProcess	fcc21c7aef	Make restart reconnect persistent	2026-06-21 10:51:12 -04:00
DuProcess	a029564d80	Add Mosh parity hardening	2026-06-21 10:23:06 -04:00
DuProcess	689d2a9575	Buffer input across reconnect	2026-06-21 09:44:39 -04:00
DuProcess	38e70611c5	Clarify Dosh positioning	2026-06-20 19:44:40 -04:00
DuProcess	6adcdc01e8	Tighten README	2026-06-20 19:43:54 -04:00
DuProcess	742477bf6e	Add Windows client packaging and recovery tools	2026-06-20 19:40:33 -04:00
DuProcess	a202f97704	Quiet missing release lookup	2026-06-20 19:20:55 -04:00
DuProcess	f6ead86db4	Add setup selftest and diagnostics polish	2026-06-20 19:19:29 -04:00
DuProcess	013d653f99	Quiet Gitea prebuilt fallback	2026-06-20 18:10:15 -04:00
DuProcess	4e7e4cff10	Update release artifact checksums	2026-06-20 18:09:25 -04:00
DuProcess	fbad776441	Resolve Gitea release downloads	2026-06-20 18:08:13 -04:00
DuProcess	90d9b583c0	Try prebuilt installers by default	2026-06-20 18:03:11 -04:00
DuProcess	f7c4ebaaf7	Add macOS release artifact evidence	2026-06-20 18:00:56 -04:00
DuProcess	27419f4ca8	Fix Gitea release id parsing	2026-06-20 17:51:36 -04:00
DuProcess	ec2422bc3e	Remove personal host aliases from defaults	2026-06-20 17:50:26 -04:00
DuProcess	d51cc248e7	Add release evidence and audit packet	2026-06-20 10:45:55 -04:00
DuProcess	b44ff8e773	Improve release and benchmark tooling	2026-06-20 10:37:26 -04:00
DuProcess	7884ea2796	Add prebuilt update path	2026-06-19 16:40:58 -04:00
DuProcess	774da7371e	Chunk terminal output below MTU	2026-06-19 16:30:51 -04:00
DuProcess	41cdb0f54f	Add optional command extensions	2026-06-19 16:17:38 -04:00
DuProcess	90e53f4b68	Add reliable stream retransmission	2026-06-19 16:00:51 -04:00
DuProcess	d0d6f59cdf	Add launch hardening gates	2026-06-18 09:45:27 -04:00
DuProcess	25d9a6aefa	Expand native auth and benchmark gates	2026-06-18 09:29:06 -04:00
DuProcessandClaude Opus 4.8	2835da76b0	Persist only named/prewarmed sessions, not implicit ones ... Implicit sessions (dosh host with no --session) get a random term-<millis>-<pid> name you can never reattach to, so persisting them just left unreattachable holder processes lingering across restarts. The server now only uses a persistent holder for prewarmed or explicitly-named sessions; implicit ones use the in-process shell that dies on restart and reaps on disconnect, as before. Adds a shared protocol::{generate,is}_implicit_session_name as the single source of truth for the name shape, used by both client (generate) and server (detect). Server-only behavior change; wire VERSION unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 22:46:10 -04:00
DuProcessandClaude Opus 4.8	eec8ef0a02	Fall back to xterm-256color when the client TERM isn't on the server ... dosh propagates the client's TERM, but a server lacking that terminal's terminfo (e.g. xterm-ghostty, xterm-kitty) made tmux/vim fail with "missing or unsuitable terminal". build_shell_command now keeps the requested TERM only when its terminfo exists on this host, otherwise falls back to xterm-256color so remote apps always work. Affects both the in-process and holder-spawned shells. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 17:03:06 -04:00
DuProcessandClaude Opus 4.8	41256b66b7	persist_sessions: default off (opt-in until stress-tested) ... Restart-survivable sessions change the core model (per-session holder processes + SCM_RIGHTS fd passing). Keep them OFF by default so deploying the build can't flip the daily driver's session model unproven; enable with persist_sessions = true after stress-testing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 14:23:48 -04:00
DuProcess	14b7e75025	Merge persistence: server-restart-survivable sessions (holder + SCM_RIGHTS fd passing)	2026-06-14 14:21:17 -04:00
DuProcessandClaude Opus 4.8	8b1af51bc6	Persist sessions across server restarts via per-session holders ... Make dosh terminal sessions survive a dosh-server restart (crash/upgrade/systemctl restart): a reattaching client lands on the SAME shell with screen state intact, instead of a fresh one. Design: when persist_sessions is on (new config, default true) each terminal session's shell runs in a small detached per-session holder process (the dosh-server binary re-exec'd as `dosh-server hold`). The holder double-forks + setsid into its own session, opens the PTY, spawns the shell as ITS child, and serves the PTY master fd over a per-session Unix socket via SCM_RIGHTS. The server adopts that fd to build a PtyHandle that DETACHES (does not kill the shell) on drop, so a server exit leaves holder + shell alive. On startup the server scans the runtime dir under sessions_dir/run, reconnects to each live holder, receives the master fd again, restores the persisted vt100 screen, and rebuilds the Session. Screen/scrollback (server-memory only) is mirrored to disk atomically: byte-throttled on the output hot path plus a 2s periodic flush, and restored on re-adoption so reattach repaints. Truly-abandoned persistent sessions are still reaped per the existing grace logic by asking the holder to shut down. Anything in the persistent path failing degrades gracefully to the original in-process shell. PtyHandle gains an Owned (kill-on-drop, unchanged default) vs Adopted (detach-on-drop) backing; resize on an adopted master uses TIOCSWINSZ. No wire-format change, so protocol::VERSION stays 3. New deps: libc (direct). New config: persist_sessions (default true); existing integration tests pin it false to keep exercising the non-persistent path unchanged. Adds tests/integration_smoke.rs::session_survives_server_restart_same_ shell_and_screen: attaches, sets `cd /tmp; export MARK=...`, paints a screen marker, KILLs the server, restarts it on the same config, reattaches and asserts same shell pid + MARK + PWD + restored screen. Plus persist.rs unit tests (name round-trip, screen save/load, dead-holder scan cleanup, SCM_RIGHTS fd round-trip). cargo fmt --check and cargo test green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 14:19:09 -04:00
DuProcessandClaude Opus 4.8	a88d912d2b	Client: instant SIGWINCH-driven terminal resize (mosh-style) ... The client only polled crossterm size() every 250ms, so window resizes (esp. in VSCode/terminals that signal rather than expecting polling) lagged or felt unresponsive. Add a SIGWINCH select branch that resizes the instant the signal fires, matching mosh (which reacts to SIGWINCH + TIOCGWINSZ). Keep the 250ms poll as a fallback. Client-only; wire VERSION unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 14:02:08 -04:00
DuProcess	683c3cd01d	Merge Wave 2: disconnect status line, prediction tick-policy fix, SSH-agent forwarding (VERSION 3)	2026-06-14 11:11:42 -04:00
DuProcess	9a52d65beb	Add opt-in, security-gated SSH-agent forwarding ... Item 3: SSH-agent forwarding, double-gated (client -A/forward_agent AND server allow_agent_forwarding) and off by default on both ends. Wire: new ForwardingKind::Agent (appended, existing bincode discriminants unchanged). Bumped protocol VERSION 2 -> 3 so a pre-agent peer answers with a clear version-mismatch reject instead of a deserialize error. Client: -A / --forward-agent flag; requires local SSH_AUTH_SOCK. Requests an Agent forwarding during native auth (agent forwarding requires native auth) and, on a server-initiated StreamOpen carrying the reserved @dosh-agent sentinel, splices the stream into the local agent unix socket (separate agent_writers map, TCP forwarding paths untouched). Rejects agent StreamOpens unless it opted in, so a server cannot reach the agent without consent. Server: when the client opted in and allow_agent_forwarding is set, binds a per-session proxy unix socket (dir 0700, socket 0600) before the shell spawns, exports its path as the session's SSH_AUTH_SOCK, and tunnels each connection back to the client over the agent sentinel stream. Applies only to freshly spawned shells (documented). Socket cleaned up on auth/forward failure and when the accept loop ends. SECURITY rationale documented in comments. Tests: 2 end-to-end integration tests (full chain identities round-trip via a PTY-hosted client + looping fake agent; and "no -A => no proxy socket"). Docs updated (README forwarding + disconnect-status note, spec §12.1). fmt + full test suite green (122 tests). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 11:10:44 -04:00
DuProcess	6b2933eb05	Add non-destructive disconnect status line and tick-driven prediction policy ... Item 1: mosh-style disconnect status line. When UDP packets stop arriving, paint a single reverse-video cyan "[dosh] last contact Ns ago — reconnecting…" on the terminal's bottom row using save/restore cursor (ESC7/ESC8) so the app cursor never moves and full-screen TUIs are not corrupted. Cleared the instant a packet resumes and refreshed on the status timer tick. Configurable via client.toml `disconnect_status` (default on) and `DOSH_DISCONNECT_STATUS` env override. State machine and rendered escape sequences are pure and unit-tested. Item 2: re-evaluate the prediction display policy on the select-loop status tick via `Predictor::refresh_policy`, so a latency spike flips speculation on (or off on recovery) promptly instead of waiting for the next keystroke. Repaints only when the on-screen result would change, so idle ticks are no-ops. Tests: 8 new client unit tests (status state machine + overlay bytes, predictor spike/recovery/idle). fmt + full test suite green. No wire-format change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:57:40 -04:00
DuProcessandClaude Opus 4.8	8da98c45e7	Native v1: connection fix, hardening, forwarding robustness, prediction, benchmarks, docs ... Integrates the stability fixes plus 5 parallel work tracks: - Connection/panic/leak fixes + audit hardening (earlier on this branch) - Track A: protocol VERSION 2 w/ clear mismatch reject, rekey, connection migration, native-auth rate limiting, O(1) conn_id index - Track B: hostile-network integration tests + parser fuzzing + CI fuzz job - Track C: benchmark path matrix + safe local harness + docs/BENCHMARKS.md - Track D: docs/THREAT_MODEL.md + readiness/verification status - Track E: clean-room mosh-grade predictive echo - llms.txt agent overview ~112 tests green; cargo fmt clean. Wire VERSION is now 2: server and client must be deployed together. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:49:33 -04:00
DuProcess	2c7654138b	Merge track A: VERSION discipline, rekey, migration, rate limiting, O(1) index	2026-06-14 10:47:14 -04:00
DuProcessandClaude Opus 4.8	f9c1973c13	Harden native protocol: version discipline, rekey, migration, rate limit, O(1) client index ... Track A protocol hardening for native-v1. 1. Protocol VERSION discipline (protocol.rs, native.rs, dosh-server.rs, dosh-client.rs): bump protocol::VERSION to 2 and NATIVE_PROTOCOL_VERSION to 2. Foreign wire-version datagrams now get a clear named "protocol version mismatch - upgrade dosh" reject from the server instead of a silent timeout (peek_foreign_wire_version + VERSION_MISMATCH_REASON). The native handshake's plaintext protocol_version is also checked server-side before any crypto via check_native_protocol_version, returning a typed ProtocolVersionMismatch. 2. Transport rekey (spec section 11/9): server rotates a client's traffic key after rekey_after_packets OR rekey_after_secs (config knobs). Rotated keys are derived independently of the handshake keys from the current key plus fresh server CSPRNG material shipped confidentially in an AEAD Rekey packet (derive_rekey_session_key). The previous epoch's key is retained briefly so in-flight pre-rekey packets still decrypt (matched by session_key_id), and stale-epoch packets are ignored, not fatal. Client handles Rekey/RekeyAck. 3. Connection migration (spec section 11): every authenticated, replay-accepted packet now migrates client.endpoint to the new source address (input, resize, ping, ack, resume, stream*, rekey-ack), not just resume. Ping now verifies its AEAD tag before acting so migration cannot be spoofed. 4. Native auth rate limiting: per-source-IP token bucket (native_auth_rate_limit_per_minute) enforced in handle_native_client_hello BEFORE any X25519/Ed25519 work; over-limit hellos get a non-crypto reject. 5. Speed: replaced O(sessions x clients) per-packet linear scans with an O(1) HashMap<conn_id, session_name> index in ServerState, kept in sync on every client insert/remove (attach handlers, detach, remove_client, cleanup reap, session-exit drain). New config keys (ServerConfig, with defaults): rekey_after_packets = 100000, rekey_after_secs = 3600. Tests: version-mismatch reject (no hang), rate-limit flood reject, rekey round-trip end-to-end + key-derivation unit tests, source-address migration, client-index sync + cleanup purge. fmt and full test suite green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:45:44 -04:00
DuProcess	1306adb558	Merge track E: clean-room mosh-grade predictive echo	2026-06-14 10:42:57 -04:00
DuProcessandClaude Opus 4.8	1e5517dcf1	Add llms.txt agent-oriented overview ... Self-contained orientation for AI agents: what dosh is, capabilities, the bidirectional homelab forwarding patterns (-L/-R/-D with concrete examples), fast-path order, architecture, security summary, config, and how to drive dosh non-interactively. Links to the deeper docs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:42:03 -04:00
DuProcessandClaude Opus 4.8	cdeba047bc	Add mosh-grade predictive local echo ... Replace the basic printable-only predictor with a clean-room speculative local-echo engine modeled on the Mosh paper's prediction overlay design (no GPL code copied or translated; original Rust written from the algorithm). Model: - Per-line cell model with a local cursor; printable keystrokes echo immediately, dimmed (and underlined on a very slow link) via save/restore cursor so full-screen TUIs are never corrupted. - Backspace and in-line Left/Right arrow prediction (CSI and SS3). - Epoch grouping per keystroke burst; anything unmodelable (CR/LF, escapes, control bytes, wide chars, right margin, paste-sized bursts) ends the epoch safely rather than mispredicting. - Frame-sequenced confirmation: an authoritative server frame supersedes and erases the overlay (dosh has no client-side emulator, so it cannot do Mosh's per-cell content match; frame arrival is the confirmation). - Glitch detection: contradicting output (e.g. alternate-screen entry) discards the epoch. - SRTT-based display policy with hysteresis and a latency-spike override; modes off / experimental(adaptive, default) / always via new client config `predict_mode` and `DOSH_PREDICT_MODE` env override. Improvements over the prior predictor: in-line arrow motion, dim+flag styling, exact-width erase, paste guard, and faster (frame-arrival) confirmation. Prediction is display-only and never swallows input. Adds unit tests: printable run, confirmation-clears, glitch-discards, backspace, line-wrap budget, paste-skip, newline, inline arrows, and the experimental SRTT threshold gate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:41:42 -04:00
DuProcess	c47ae98c68	Merge track C: benchmark path matrix + safe local harness + BENCHMARKS.md	2026-06-14 10:34:30 -04:00
DuProcessandClaude Opus 4.8	c48f2280a0	Add benchmark path matrix and safe local harness ... Extend dosh-bench to benchmark the full attach path matrix and emit both raw per-iteration samples and summary statistics (count/min/median/p95/mean/max): - --cold-native: native cold auth terminal-ready (dosh_cold_native_ms) - --cached-ticket: cached attach-ticket fast path (dosh_cached_attach_ms) - --resume: UDP resume path (dosh_resume_ms; roaming-only, see docs) - --local-auth: self-contained local bootstrap, no SSH (dosh_local_attach_ms) - default: legacy SSH-bootstrap cold attach (dosh_attach_ms) Existing ssh-bootstrap/local-auth/mosh modes and all assert gates are preserved; legacy flags (--local-auth/--warm-cache/--no-cache) keep their prior behavior so the CI docker scripts run unchanged. Add --json (machine-readable raw samples) and --label. Add a table/JSON renderer and percentile-based summary stats. Add scripts/bench-local.sh: a safe, self-contained harness that builds release, spins up a throwaway dosh-server bound to 127.0.0.1 on a random free UDP port in a temp HOME (never port 50000, never a systemd unit), runs the matrix, prints results, sanity-checks native auth actually trusted the host, and cleans up. Point `make bench-local` at the new harness and add `make bench-local-json`; keep bench-docker-* targets intact. Add docs/BENCHMARKS.md: how to run each benchmark, metric meanings, methodology and caveats (resume is the roaming path, not cold reconnect; cite cached attach as the core claim per PUBLIC_READINESS.md), plus a real loopback sample table with machine/OS/sample-count and raw samples. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 10:33:37 -04:00