M9: oversized-message test sends only the frame header (no broken pipe on Linux)

M9: open hosting: fair limits for shared addresses
Third review: - a broadcast counts once per recipient block, welcomes don't count against block caps, and presence, cursor chat and pings have their own per-address budget, so an office behind one address works together - when everyone's reading budget runs out, the biggest readers are cut off until it fits (their bytes freed at once), no cliff - block counters are forgotten once only the table holds them - install.sh: root's downloads, clone, swap file and built binary in a root-only directory; the build user builds its own copy; the binary is copied out with the build user's rights - recommended open-mode settings in install.sh's config and the docs
2026-10-22 19:08:51 +00:00 · 2026-10-12 11:26:06 +07:00 · 2026-10-12 11:07:27 +07:00 · 2026-10-12 11:07:26 +07:00 · 2026-10-12 11:07:25 +07:00 · 2026-10-12 11:07:23 +07:00
2 changed files with 22 additions and 22 deletions
@@ -1407,7 +1407,7 @@ checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"

 [[package]]
 name = "figcraft"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "arboard",
 "eframe",
@@ -1430,7 +1430,7 @@ dependencies = [

 [[package]]
 name = "figcraft-cli"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-doc",
 "figcraft-engine",
@@ -1444,7 +1444,7 @@ dependencies = [

 [[package]]
 name = "figcraft-collab"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "base64 0.22.1",
 "figcraft-color",
@@ -1459,7 +1459,7 @@ dependencies = [

 [[package]]
 name = "figcraft-collab-net"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "base64 0.22.1",
 "figcraft-collab",
@@ -1482,7 +1482,7 @@ dependencies = [

 [[package]]
 name = "figcraft-color"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "kurbo",
 "serde",
@@ -1491,7 +1491,7 @@ dependencies = [

 [[package]]
 name = "figcraft-doc"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-color",
 "figcraft-geom",
@@ -1503,7 +1503,7 @@ dependencies = [

 [[package]]
 name = "figcraft-engine"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "base64 0.22.1",
 "figcraft-collab",
@@ -1530,7 +1530,7 @@ dependencies = [

 [[package]]
 name = "figcraft-format"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-doc",
 "flate2",
@@ -1544,7 +1544,7 @@ dependencies = [

 [[package]]
 name = "figcraft-geom"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "kurbo",
 "serde",
@@ -1552,7 +1552,7 @@ dependencies = [

 [[package]]
 name = "figcraft-layout"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-doc",
 "figcraft-geom",
@@ -1560,7 +1560,7 @@ dependencies = [

 [[package]]
 name = "figcraft-mcp"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "base64 0.22.1",
 "figcraft-collab-net",
@@ -1576,7 +1576,7 @@ dependencies = [

 [[package]]
 name = "figcraft-pathops"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-doc",
 "figcraft-geom",
@@ -1585,7 +1585,7 @@ dependencies = [

 [[package]]
 name = "figcraft-pdf"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-color",
 "figcraft-doc",
@@ -1602,7 +1602,7 @@ dependencies = [

 [[package]]
 name = "figcraft-plugin"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-color",
 "serde",
@@ -1615,7 +1615,7 @@ dependencies = [

 [[package]]
 name = "figcraft-render"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "crc32fast",
 "figcraft-color",
@@ -1633,7 +1633,7 @@ dependencies = [

 [[package]]
 name = "figcraft-server"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "crc32fast",
 "ctrlc",
@@ -1657,7 +1657,7 @@ dependencies = [

 [[package]]
 name = "figcraft-svg"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "base64 0.22.1",
 "figcraft-color",
@@ -1671,7 +1671,7 @@ dependencies = [

 [[package]]
 name = "figcraft-text"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-doc",
 "figcraft-geom",
@@ -1684,7 +1684,7 @@ dependencies = [

 [[package]]
 name = "figcraft-ui-egui"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "base64 0.22.1",
 "egui",
@@ -1707,7 +1707,7 @@ dependencies = [

 [[package]]
 name = "figcraft-web"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "eframe",
 "egui",
@@ -5803,7 +5803,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"

 [[package]]
 name = "xtask"
-version = "0.4.0"
+version = "0.3.1"
 dependencies = [
 "figcraft-color",
 "figcraft-doc",
@@ -6,7 +6,7 @@ exclude = ["plugins"]
 # default-members = ["crates/*", "apps/figcraft", "apps/figcraft-cli", "xtask"]

 [workspace.package]
-version = "0.4.0"
+version = "0.3.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
Author	SHA1	Message	Date
bflatastic	7d078e9bd8	M9: oversized-message test sends only the frame header (no broken pipe on Linux)	2026-10-12 11:26:06 +07:00
bflatastic	d74eeb4ab3	M9: open hosting: fair limits for shared addresses Third review: - a broadcast counts once per recipient block, welcomes don't count against block caps, and presence, cursor chat and pings have their own per-address budget, so an office behind one address works together - when everyone's reading budget runs out, the biggest readers are cut off until it fits (their bytes freed at once), no cliff - block counters are forgotten once only the table holds them - install.sh: root's downloads, clone, swap file and built binary in a root-only directory; the build user builds its own copy; the binary is copied out with the build user's rights - recommended open-mode settings in install.sh's config and the docs	2026-10-12 11:07:27 +07:00
bflatastic	395a2d9dae	M9: close the remaining open-hosting DoS paths Second security review: - a broadcast counts once against the queued-bytes budget; each block of addresses gets at most an eighth; when the budget runs out the biggest consumer is shed, not the receiver - forced compactions at most once a minute per file - plugin downloads check the per-address share before the global budget and before reading - install.sh never replaces a Caddyfile with other sites (one import line, once; install-test.sh in packaging lint); the built binary runs only as the server's account - bytes being read count against per-block and global budgets, the biggest readers dropped first - block multipliers x2 (/56) and x4 (/48), connection caps at most a sixteenth/eighth of all; global publish and download budgets eight times a /48's share - problems capped at 200; writes refused below max(1 GiB, two files) free; the private-server file cap documented	2026-10-12 11:07:26 +07:00
bflatastic	47d56034a5	M9: harden open hosting against resource exhaustion Fixes from the security review of the public server: - team libraries only in key-published files on open servers; unpacking bounded by the file cap (zip bombs refused) - byte-bounded send queues per connection and in all, a bound on bytes waiting for the hub, per-address and global download budgets - batches checked against the file, per-address and total caps as files grow (refused with a Reject the app rolls back); the core's recent-batch memory bounded in bytes; nothing confirmed when a log can't be written - usage reports kept in memory; per-kind message caps checked while read - layered IPv6 limits (/64, /56, /48), a global publish rate, connections reserved for sessions, short idle timeout for one-shot requests - revoked links and removed files cut library connections - data directory 0700, server key 0600 from creation - install.sh: SSH ports from sshd, ufw left off when other services listen, unprivileged builds of the latest tag, settings checked before use, own Caddy snippet; systemd memory and network caps; backups check free space and say they hold the key - linger reads raw bytes after an oversized frame (tungstenite asserted)	2026-10-12 11:07:25 +07:00
bflatastic	d0f649699c	M9: install.sh, backup timer and docs for a public figcraft-server packaging/server/install.sh sets up Debian/Ubuntu behind Caddy: binary from its release archive, the source tree it sits in, the latest release or a clone (temporary swap under 2 GB of memory), user, dirs and config only when missing, systemd unit, Caddy site, nightly backup timer, ufw for 22/80/443; safe to re-run for upgrades. docs/server.md gains Running a public server (limits, expiry, moderation, operator responsibility, no end-to-end encryption, threat model) and an install.sh walk-through; protocol, MCP, CLI and parity docs updated.	2026-10-12 11:07:23 +07:00
bflatastic	db6f522612	M9: open hosting mode for public figcraft-server Config-gated (open_publish): anyone publishes without the server key and gets an owner token (128-bit, shown once, stored hashed) that manages only that file. Per-address limits (X-Forwarded-For only from trusted_proxy, bounded tables), global caps, idle expiry, reports, persisted blocks, files list --sort, check, GET /healthz on the same listener, startup warnings. The app asks the server first, publishes without a key when it is open, shows the owner token once, the host/terms line, the expiry date and a report button; collab.serverInfo, collab.manageFile, collab.report and pref.publishServer for MCP/CLI. Protocol additions stay within version 2, gated like signals.	2026-10-12 11:07:22 +07:00