DeckMux collaborative presence, undef-terminal-pty package, security headers, OTel tracing

226 files · 20,043+ · 1,369-

7 files changed

hub.py DeckMux TermHub: multi-session presence hub with control_request grant/release mixin
ghost.py Ghost overlay: read-only view for non-controlling observers
presence.py Cols/rows presence tracking across concurrent sessions
app.py DeckMux injected into HijackHost via hub_class param in create_server_app
HijackHost.tsx Frontend: DeckMux collaborative terminal presence components
session_runtime.py DeckMux presence routing in CF Durable Object
2026-03-30-deckmux-design.md 464-line DeckMux design spec: collaborative terminal presence

undef-deckmux adds collaborative terminal presence: TermHub manages concurrent session connections, ghost overlay gives non-controlling observers a read-only view, and cols/rows presence tracks each participant’s terminal dimensions. control_request grant/release coordinates who has keyboard control. E2E Playwright proof verifies collaborative presence across browser sessions. instantiate behavioral
2 files
- hub.py
- app.py

7 files changed

connector.py PTYConnector registered as connector_type='pty' with input validation and nosec annotations
pam_session.py PamSession: PAM lifecycle (authenticate, open_session, close_session) with input validation
capture_socket.py CaptureSocket: Unix domain socket with path validation
uid_map.py UidMap: username to ResolvedUser mapping with validation
validators.py Input validators for command, username, service name, and env vars
pam_uterm.c pam_uterm PAM module: sshd daemon bridge for Phase 2 PAM integration
_build.py libuterm_capture C library locator

undef-terminal-pty adds PTY support as a first-class connector type. PTYConnector registered as connector_type=‘pty’. PamSession handles PAM authentication lifecycle. pam_uterm.c is a PAM module for Phase 2 sshd daemon bridge integration in notify and capture modes. All inputs validated before use in C library calls. 100% coverage achieved in Docker. instantiate behavioral
2 files
- connector.py
- pam_uterm.c

4 files changed

security_headers.py Configurable security headers middleware (CSP, HSTS, X-Frame-Options, etc.)
entry.py Configurable security headers added to CF Worker
index.html SRI hashes added to all CDN resources
2026-03-30-security-headers-design.md Security headers design spec

Configurable security headers middleware added to FastAPI and CF Worker: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. SRI (Subresource Integrity) hashes added to all CDN resources in HTML files to prevent CDN compromise attacks. harden behavioral
2 files
- security_headers.py
- entry.py

2 files changed

app.py OpenTelemetry distributed tracing wired via undef.telemetry
sessions.py Session search/filter API, inactivity timeout, retention sweep, bulk delete, and structured audit logging

OpenTelemetry distributed tracing integrated via undef.telemetry, adding trace context to all server request spans. Session management API extended with search/filter, configurable inactivity timeout, retention sweep for expired sessions, and bulk delete. Structured audit logging added for security-relevant API operations. instantiate behavioral
2 files
- app.py
- sessions.py

2 files changed

All monorepo packages renamed to undef-terminal-* namespace for consistency: undef-shell → undef-terminal-shell, undef-render → undef-terminal-render. undef-deckmux added as new package. Shell render module moved from undef-shell to undef-terminal-shell. baseline internal
2 files
- pyproject.toml
- pyproject.toml

1 file changed

release.yml Standardized release pipeline: TestPyPI staging with verification, auto PyPI publish on release tag, Sigstore artifact signing

Release pipeline standardized: tags trigger TestPyPI staging with install verification before production PyPI publish. Sigstore signing added for all release artifacts. baseline internal
1 file
- release.yml