provide-terminal 2026-03-31
PAM server-side integration, capture modes, gateway WS reconnect, rate limiting
47 files · 6,106+ · 151-

Server-side PAM integration: notify/capture modes and CF relay

instantiate behavioral
3 files changed
  • pam_server.py PAM event server: notify and capture modes for sshd bridge
  • app.py PAM events forwarded to CF DO and auto-tunnel via TunnelClient
  • libpam.py Direct libpam ctypes bindings replacing pamela dependency — works on Python 3.12+
  • PAM server-side integration wires pam_uterm.so into the server: notify mode broadcasts PAM open/close events; capture mode routes PTY streams to CF Durable Object via TunnelClient relay. pamela dependency replaced with direct libpam ctypes for Python 3.12+ compatibility. relay_url/relay_token renamed from cf_url/cf_token. instantiate behavioral
    3 files
    • pam_server.py
    • app.py
    • libpam.py

Colima PAM smoke test and LD_PRELOAD capture integration tests

qualify internal
3 files changed
  • test_pam_colima.py Colima smoke test: proves pam_uterm.so fires open/close events on a real PAM stack
  • test_capture_linux.py 5 Linux integration tests proving LD_PRELOAD capture works
  • install_colima.sh Colima install script for pam_uterm.so + libuterm_capture.so
  • Colima PAM smoke test proves pam_uterm.so fires open/close events on a real PAM stack in a Docker/Colima environment. Five Linux integration tests prove LD_PRELOAD capture intercepts PTY output. Full PAM lifecycle and CaptureConnector tests added. CF DO E2E relay tests verify end-to-end PAM event forwarding. qualify internal
    2 files
    • test_pam_colima.py
    • test_capture_linux.py

Capture demo server and E2E proof scripts

specify internal
2 files changed
  • capture_demo_server.py Capture demo server for testing capture pipeline
  • capture_e2e_proof.py E2E proof script demonstrating capture flow end to end
  • Capture demo server and E2E proof scripts added for manual validation of the PTY capture pipeline outside of automated tests. specify internal
    1 file
    • capture_demo_server.py

Gateway WS reconnect, runtime recv drain, rate limiting

remediate behavioral
3 files changed
  • gateway.py Reconnect on WS drop while TCP client is alive
  • session_runtime.py Drain completed recv_task before recreating — prevent dropped inbound messages
  • config.py browser_rate_limit_per_sec config added — default 300 WS messages/sec
  • Gateway now reconnects WebSocket when the WS drops but TCP client is still alive, preventing session loss on transient network blips. recv_task now drained before recreation to prevent dropped inbound messages during restart. browser_rate_limit_per_sec config added (default 300 WS msg/sec) to cap browser message rate. remediate behavioral
    3 files
    • gateway.py
    • session_runtime.py
    • config.py

macOS DYLD_INTERPOSE and pam_uterm.c buffer hardening

remediate internal
1 file changed
  • pam_uterm.c GCC 13 write() warning fixed; buffer hardened; macOS DYLD_INTERPOSE resolves originals from interpose struct
  • pam_uterm.c buffer hardened against overflow. macOS DYLD_INTERPOSE implementation corrected to resolve original function pointers from the interpose struct rather than calling originals directly. GCC 13 write() return value warning resolved. remediate internal
    1 file
    • pam_uterm.c
← 2026-03-30 provide-terminal changelog → 2026-04-01 provide-terminal →