https://gitlab.synchro.net/main/sbbs/-/commit/6d79c7841c750cf55f2dc4f8
Added Files:
exec/load/ws_sidecar.js
Modified Files:
exec/websocketservice.js xtrn/wttr.in/locator.js
Log Message:
Put the WebSocket relay's sidecar where every host can read it

The relay writes a small file beside each connection it forwards, so
the service on the far end can learn what a proxied socket cannot tell
it: the client's real address, and the user number of the web session
it authenticated with. That file went into temp_dir.

temp_dir is PER HOST, and a Synchronet install can be shared by several
of them. So a relay running on one machine and a service on another
never saw the same file, and the service was left to conclude from its
absence that the connection was made directly to it. Where a service
grants trust on that basis -- and the fallback for a missing sidecar is naturally the trusting one, because a direct local caller writes no
sidecar either -- being unable to see another host's file is the
dangerous direction to fail in. data_dir is shared, so both ends reach
it.

Moving it made the port an insufficient name. It was unique while the
directory was private to one host; in a shared one, two hosts can hold
the same local port at the same moment, which would turn a missing
sidecar into a WRONG one. So the name now carries the address too.

The name is the entire handshake -- nothing is passed between the two
ends -- so both derive it from the one endpoint they share: the relay
from the local address and port of the socket it opened to the service,
the service from the remote address and port of the connection that
arrived. Those are the same endpoint seen from its two ends, so they
agree without being told.

The address is folded to a filename, anything outside letters, digits
and dots becoming a dash, because an IPv6 address carries colons --
illegal in a filename on Windows, which some hosts sharing an install
will be running -- and may carry a % scope as well. The rule is trivial deliberately: it must be reimplemented exactly by any service that
reads a sidecar without loading this, including ones not written in
JavaScript.

exec/load/ws_sidecar.js holds the rule and the reasoning, so the relay
and the readers cannot drift apart on it.

THIS IS A BREAKING CHANGE to an interface no document describes. A
service still looking in temp_dir will find nothing, and if it treats
that as "direct connection" it will treat relayed clients as local
ones. Both readers in the tree are updated here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net