c37424eb45
Merge track D: threat model + readiness docs
2026-06-14 10:29:05 -04:00
828206f757
Publish threat model and refresh native v1 docs
...
Add docs/THREAT_MODEL.md deriving a publishable threat model from
NATIVE_V1_SPEC.md sections 4-6: assets, in/out-of-scope attackers,
security properties vs SSH (including where Dosh aims to exceed it),
cryptographic building blocks as implemented, and an honest
accepted-residual-risks / known-gaps section.
Refresh docs/PUBLIC_READINESS.md: feature matrix now reflects native
auth, host-key trust, authorized_keys policy, doctor, and -L/-R/-D
forwarding; add a per-item "Native v1 verification checklist status"
table mapping spec section 16 to done/in-progress/pending from code.
Update README.md status with a native v1 section and honest claim
posture pointing to THREAT_MODEL.md. Annotate NATIVE_V1_SPEC.md with a
v1 status block summarizing milestone progress. Point SPEC.md security
model and header at native auth and the threat model.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-14 10:27:40 -04:00
2a6f28d529
Fix native-v1 connection break, server panic, and resource leaks
...
The native-v1 work changed the UDP wire format (HEADER_LEN 42->58) without a
version bump, so a current client silently timed out against the older
still-deployed server. The server just needed redeploying; alongside that,
fix the robustness bugs surfaced while restoring the connection:
- Server: clamp terminal size to >=1 at every PTY/parser resize site. A client
reporting a 0x0 terminal made vt100::Parser::set_size panic ("attempt to
subtract with overflow") and took down the whole single-threaded daemon.
- Client: treat size() == Ok((0,0)) like a missing size and fall back to 80x24
instead of sending 0x0 to the server.
- Reap abandoned sessions and their shells. PtyHandle now retains the child and
kills it on drop, and the cleanup task removes clientless, non-prewarmed
sessions after the grace period. Previously the shell leaked forever (one
zsh per abandoned session); prewarmed sessions still stay hot.
- Evict half-finished native handshakes (pending_native) after 30s so an
unauthenticated ClientHello flood can't grow the map without bound.
- Drop the per-client, per-packet vt100 Screen clone on the output hot path and
remove the write-only last_screen field.
- Guard load_or_create_server_secret against a <32-byte secret file (was an
index-out-of-range panic at startup).
- Reconcile stream flow-control credit (client and server) when StreamData hits
a missing writer, so a closed/unknown stream can't wedge the peer's window.
Adds a unit test for session reaping. cargo fmt + cargo test green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-14 10:06:27 -04:00
6c14d669b8
Gate non-loopback remote binds
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-14 09:10:09 -04:00
fb5c25ea0b
Add stream window flow control
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-14 09:08:19 -04:00
dd9c4daeda
Report server version in doctor
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:34:09 -04:00
f66de64b3f
Support host-config login users
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:32:45 -04:00
1b1278f39e
Add explicit environment propagation
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:30:15 -04:00
38e2fa091a
Ignore stale packets during attach resume
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:21:20 -04:00
76e2e980f1
Avoid PTY allocation for forward-only mode
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:18:15 -04:00
7fec3592f5
Honor more SSH config in native auth
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:13:47 -04:00
af5e9f7956
Enforce authorized_keys from restrictions
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:07:04 -04:00
0575cf678f
Add native doctor auth diagnostics
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 22:01:27 -04:00
6d1e9d3065
Add background forwarding mode
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:55:14 -04:00
da16588bc5
Add packet session key identifiers
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:51:55 -04:00
3642de71e4
Add native dynamic port forwarding
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:48:49 -04:00
64b00783fd
Bound forwarded stream buffering
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:43:42 -04:00
6a0f12c59e
Add native remote port forwarding
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:41:48 -04:00
6aa81d0ce3
Add native local port forwarding
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:36:10 -04:00
f324a7627f
Support encrypted native identity keys
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:26:31 -04:00
55a0fc1ab4
Add ssh-agent native auth
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 15:21:21 -04:00
e7f3679fc1
Wire native Dosh auth runtime
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 11:54:24 -04:00
80c7889b46
Verify native Dosh Ed25519 user auth
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 11:38:00 -04:00
a72f7eacf5
Add native Dosh handshake skeleton
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 11:34:05 -04:00
26fc863149
Add native Dosh host trust foundation
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 11:32:01 -04:00
f6ab4473bd
Define native Dosh workflow parity requirements
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 11:25:52 -04:00
9bece26bc8
Spec native Dosh auth and forwarding v1
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 10:54:19 -04:00
80166eae15
Keep Dosh alive across stale UDP reconnects
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-13 10:20:03 -04:00
93374162ff
Measure cached Dosh attach fast path
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 22:45:13 -04:00
3a38a9da80
Add public comparison benchmarks and SSH import
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 14:27:58 -04:00
063c44d971
Quiet Dosh update git fetches
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:59:47 -04:00
4ac5d63faf
Avoid login shell for Dosh sessions listing
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:59:12 -04:00
83b2d9d70c
Quote Dosh sessions remote command
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:58:16 -04:00
e3f61a4efb
Add Dosh host workflows and reconnect QoL
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:48:44 -04:00
c56e8f9fe1
Add guarded local typing prediction
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:39:27 -04:00
03df1c6ed7
Ignore stale Dosh snapshots
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:33:55 -04:00
32da29e2fb
Render Dosh frames in stream order
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:32:07 -04:00
f8df38efb0
Stop drawing client overlay over TUIs
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-12 13:03:39 -04:00
fd7849f889
Forward terminal input bytes without cursor rewriting
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 22:22:03 -04:00
6580e75fbf
Resolve SSH aliases for Dosh UDP host
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 22:09:55 -04:00
1860a0e610
Preserve alternate screen snapshots and speed builds
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 16:19:30 -04:00
93a210b420
Normalize application cursor arrows
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 16:11:56 -04:00
63a1cfe3a3
Use raw terminal input without cursor translation
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 15:41:06 -04:00
2257aeca0b
Improve terminal input and client cleanup
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 14:32:55 -04:00
14cdd5fd56
Fix stale client rejection and terminal cursor mode
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 14:14:15 -04:00
8ffbb07bfa
Fix terminal resize handling and cached updates
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 10:20:58 -04:00
66c4c97c9d
Use fresh implicit sessions and raw live terminal output
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 10:10:13 -04:00
3ad8f95833
Add dosh update command
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 09:49:53 -04:00
da60b71984
Gate client timing logs behind verbosity
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 09:45:55 -04:00
0eca4f1cf4
Add fresh default sessions and terminal status handling
ci / test (push) Has been cancelled
ci / remote-bench (push) Has been cancelled
2026-06-11 09:41:46 -04:00
DuProcess