E2E remote control, stages 1–3: Noise suite, identities, relay harness (no user-facing change)

[nedtwigg]

First of three stacked PRs for the e2e-client-host scope (docs/specs/remote-security-model.md → ## Future): moving pairing, connection, terminal traffic, and push to a mandatory Noise_IK_25519_ChaChaPoly_SHA256 channel the Server cannot read. This PR is infrastructure only; nothing user-visible changes and no ceremony, relay reader, or store is switched.

What lands

• Stage 0 — the plan, dissolved into the specs. The scope, trust model, suite, presence proofs, pairing, connection, Host bounds, push sealing, and residual metadata live under remote-security-model.md ## Future; QR grammar, relay envelope, routes, and state files under server.md; phone flows and the worker build under pocket-app.md; pointers in remote-api.md and alert.md.
• Stage 1 — Noise suite and vectors. server-lib-common/src/security/noise.ts: exactly one suite, Noise rev 34, WebCrypto-only X25519/SHA-256/HMAC, Noise's HMAC-based HKDF, ChaChaPoly from @noble/ciphers pinned at 2.4.0 with the release-versus-audit delta recorded in the module header. Conformance is byte-for-byte against the vendored Cacophony vector plus the RFC 7748 and RFC 8439 vectors; ephemeral injection is the only test hook.
• Stage 2 — additive identities and storage. Host Noise static minted at enrollment and persisted with the enrollment (file store / VS Code SecretStorage), imported non-extractably at start; probeNoiseSupport (not yet enforced); the dormouse/presence/v1 challenge builder and PresenceBinding guards; Pocket IndexedDB v2 with known-hosts and pending-deletions beside the legacy device-key store.
• Stage 3 — relay envelope, framing, harness. The e2e relay frames and bounds accepted and routed additively by the Server; the transport framing module (noise-transport.ts: kind byte, length-prefixed app stream with a 1 MiB reassembly cap, 4096-byte padded control messages, keepalives, permanent session poisoning); a fake Host and fake Client speaking Noise through the real relay, proving transcript binding, directional cipher states, counters, framing, teardown, relay opacity, and tamper rejection.

Each stage had a /simplify pass and a high-effort /code-review pass committed on top of it (the review commits are in the history). Specs were promoted above the fold per stage; pnpm lint:specs is green.

Verification

Root pnpm test (all lints, server-lib-common, server, lib, vscode-ext, website) passes on the head commit.

Next

PR 2 (stacked) lands the atomic pairing/connection/push-re-keying cutover and the Host bounds; PR 3 lands sealed push, the built service worker, and the documentation/lint enforcement. Two iOS facts are still to be verified on a device before PR 2 ships: an X25519 CryptoKey survives IndexedDB structured clone, and getUserMedia works inside a Home Screen web app.

🤖 Generated with Claude Code

https://claude.ai/code/session_016v3meFVinnMLS6Jrffvxbj

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	3abb214
Status:	✅  Deploy successful!
Preview URL:	https://1b4f8b0a.mouseterm.pages.dev
Branch Preview URL:	https://e2e-client-host.mouseterm.pages.dev

View logs

[dormouse-bot]

Build & Test is red on f1be971, and the failure hides more than it looks like: it fires at the Dependency disclosure is current step, which sits ahead of Test and Build in the job — both were skipped, so pnpm test and pnpm build never actually ran on this head. The PR body's "Root pnpm test ... passes on the head commit" is a local claim CI has not confirmed.

The cause is this PR's own new dependency. website/src/data/dependencies-npm.json still has 49 entries and no @noble/ciphers. Fix is node website/scripts/generate-deps.js, committed; the hunk CI printed goes right after the @hono/node-ws entry:

  {
    "name": "@noble/ciphers",
    "version": "2.4.0",
    "license": "MIT",
    "author": "Paul Miller (https://paulmillr.com)",
    "homepage": "https://paulmillr.com/noble/"
  },

It's outside the diff, so no inline suggestion — happy to push that commit if you want it off your plate.

Since CI couldn't, I ran what I could locally, and it's clean: all six root lint/selftest scripts pass, and server-lib-common is 218/218 under node --test against a locally-built dist and a real @noble/ciphers@2.4.0 — Cacophony vector byte-for-byte through both handshake messages and all six transport messages, RFC 7748, RFC 8439, framing, reassembly, and the wire guards included. lib, server, vscode-ext, and website remain unverified until the disclosure step goes green.

No other findings. Details of what I checked and came up empty on, in case it saves a re-derivation later:

Review notes

Noise conformance — traced IK against Noise rev 34 by hand before trusting the vector: message 1 e, es, s, ss and message 2 e, ee, se mix in pattern order on both the write and read sides, the pre-message <- s mixes rs on the initiator and its own s on the responder, and Split gives the initiator k1 for send. NOISE_PROTOCOL_NAME is exactly 32 bytes, so initialize's "name is exactly HASHLEN" guard is load-bearing rather than decorative. Static reflection (a Client claiming the Host's own s) fails at ss because the forger cannot compute DH(priv_r, pub_r) — no separate guard needed.

Framing bounds — MAX_STREAM_BODY_LENGTH (65518) + kind byte + tag lands exactly on 65535, so the chunker sits on the boundary rather than under it. StreamReassembler's queue is bounded by the accepted declared length: at most 4 + 1 MiB - 1 held plus one maximal body. #take's peek path increments index even on a partial chunk, which is harmless — a partial chunk is always the last iteration. #queued stays equal to the sum of the live tail on every path, including the length === 0 case that consumes 4 and pushes an empty message.

Relay — #bindClientToHost is behavior-preserving for pair/connect/connect2: dropEstablished || client.hostId !== hostId is the old client.hostId !== frame.hostId || frame.t === 'connect'. The host→client e2e case is gated by the pre-existing client.hostId !== host.hostId return, so it inherits the binding rule. isE2eId on hostId matches the server's toBase64Url(randomBytes(16)) minting (22 chars), and clientId is minted the same way, well inside MAX_CLIENT_ID_LENGTH.

Packaging — @noble/ciphers@2.4.0 really does map "./chacha.js" in its exports, so the import specifier resolves; it appears in no esbuild external list, so it bundles into the VS Code host rather than needing runtime resolution.

IndexedDB v2 — pocket-db.ts is the only indexedDB.open in the repo, so the "two of them can never disagree about the version" claim holds. The create-what-is-absent upgrade keeps a v1 device-key record with its original out-of-line key. One cosmetic wrinkle: onblocked rejects, but the underlying open request stays live and can still fire onsuccess later, leaving an unclosed handle — the onversionchange handler set there closes it on the next bump, so it self-heals.

utf8Decode accepts overlong sequences and lone surrogates rather than rejecting them, which is a decoder-differential only against consumers that don't use this module. Since the encoder never emits those forms and control bodies are already Noise-authenticated, it isn't a finding today; worth remembering if a non-Dormouse speaker ever reads these bytes.

[nedtwigg]

Fixed in 3abb214 — regenerated website/src/data/dependencies-npm.json with node website/scripts/generate-deps.js; the only change is the @noble/ciphers entry you quoted, byte-for-byte.

You were right that the PR body's claim was unconfirmed, since Test and Build never ran. Re-ran both locally on the new head after the regeneration:

• Root pnpm test exit 0 — server-lib-common and server (217/217 under node --test), lib 1970/1970, vscode-ext 113/113, standalone 62/62, website 65/65, plus all six root lint/selftest scripts.
• Root pnpm build exit 0 (lib, VS Code extension, website).

On the two non-findings in your notes: agreed on both, and neither is changed here. The onblocked handle self-heals as you describe, and utf8Decode's leniency is only a differential against a non-Dormouse speaker of these bytes, which does not exist today — both worth revisiting if a later stage ever puts a foreign decoder on the far end.

One caveat on the local run worth recording: the first full-suite attempt stalled with server/test/handshake.test.mjs idle for 20+ minutes (listening socket, no connections, 0.5s of CPU). It did not reproduce — the file passes in 0.9s alone and the whole server suite passes in 30s — and the machine was running several other builds at the time, so I am treating it as contention rather than a deadlock. Flagging it because node --test runs here with --test-timeout=0, so if it ever is real it hangs the job instead of failing it.

Chromatic's UI Tests reports one unaccepted change, SettingsDialog:With Remote Control. It does not originate here: build 666 baselines against build 662, which is main at fdfe205a and already carries that exact same single unreviewed change. This branch adds no story, no component, and no rendered-path code — the lib files it touches are remote/client/{device-key,pocket-db}, remote/host/{enrollment,remote-host}, and package.json. The baseline needs accepting on main by a maintainer.

[dormouse-bot]

Build & Test is green on 3abb214f, and this time Test and Build actually ran — the two steps that were skipped on f1be971. Test 23:12:46 → 23:14:07 (81s), Build 27s, whole job 3m07s (run). So the PR body's claim is CI-confirmed now, not just local.

UI Tests also flipped to pass on this head — Chromatic build 666 reports "249 tests unchanged", so the SettingsDialog:With Remote Control baseline got accepted on main. Nothing left there.

On the handshake.test.mjs stall, one fact worth having in case it ever is real: build-and-test sets no timeout-minutes — only the zsh install step and standalone-platform-check do — so a genuinely hung node --test runs to GitHub's 360-minute job default and then fails with a bare timeout and no test output. Your read on --test-timeout matches the tree: nothing sets it anywhere, and server's script is a bare node --test test/*.test.mjs, so there is no per-test cap either. It didn't reproduce in CI — the whole server suite fit inside that 81s Test step.