npm - 9remote - Versions diffs - 2.5.5 → 3.0.0 - Mend

9remote 2.5.5 → 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (597) hide show

package/dist/web/manifest.json ADDED Viewed

@@ -0,0 +1,53 @@
+{
+  "name": "9Remote Terminal",
+  "short_name": "9Remote",
+  "id": "/?source=pwa",
+  "description": "Access your terminal from anywhere - secure remote terminal access",
+  "start_url": "/login",
+  "display": "standalone",
+  "background_color": "#0f0f0f",
+  "theme_color": "#121212",
+  "icons": [
+    {
+      "src": "/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any"
+    },
+    {
+      "src": "/maskable-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "maskable"
+    },
+    {
+      "src": "/maskable-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "maskable"
+    }
+  ],
+  "categories": ["utilities", "productivity"],
+  "screenshots": [
+    {
+      "src": "/screenshot-desktop.png",
+      "sizes": "1280x720",
+      "type": "image/png",
+      "form_factor": "wide",
+      "label": "9Remote on desktop"
+    },
+    {
+      "src": "/screenshot-mobile.png",
+      "sizes": "390x844",
+      "type": "image/png",
+      "form_factor": "narrow",
+      "label": "9Remote on mobile"
+    }
+  ]
+}

package/dist/web/maskable-192.png ADDED Viewed

Binary file

package/dist/web/maskable-512.png ADDED Viewed

Binary file

package/dist/web/next.svg ADDED Viewed

@@ -0,0 +1 @@

+ <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>

package/dist/web/proxy.html ADDED Viewed

@@ -0,0 +1,179 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>9Remote site proxy</title>
+<style>
+  html, body { margin: 0; height: 100%; background: #0b1220; }
+  iframe { width: 100%; height: 100%; border: 0; display: block; }
+  p { font: 14px system-ui; color: #94a3b8; text-align: center; padding-top: 3rem; margin: 0; }
+</style>
+<p id="status">Connecting to local site…</p>
+<script>
+// Proxy shell for the sites origin.
+//
+// This page is ours, the site inside it is not. It lives here so the browsed
+// server gets an origin with nothing worth stealing: the app's storage — the
+// device-trust tail, the saved keys — belongs to the app's own origin and is
+// unreachable from this one.
+//
+// It sits between two parties that cannot address each other. The service
+// worker can only postMessage its own clients, and the transport socket lives
+// in the app on the other origin, so this page carries each request across:
+//   SW --(MessageChannel port)--> proxy --(postMessage)--> app --> agent
+// and the reply back along the same path.
+(function () {
+  "use strict";
+  // Only the app may drive this page, and only this page's opener is told
+  // anything. An opaque origin sends the literal "null" — never a match.
+  //
+  // The agent serves its workspace on every loopback name, so this has to accept
+  // the app whichever one it was opened on — a single hardcoded "localhost"
+  // leaves the frame unable to talk to a page opened on 127.0.0.1, and it shows
+  // as a shell that never loads anything.
+  var APP_ORIGINS = (function () {
+    var h = location.hostname;
+    var port = location.port ? ":" + location.port : "";
+    if (h === "sites.9remote.cc") return ["https://9remote.cc"];
+    if (h === "sites-dev.9remote.cc") return ["https://dev.9remote.cc"];
+    if (h === "sites.localhost") return ["http://localhost" + port, "http://127.0.0.1" + port, "http://[::1]" + port];
+    return [];
+  })();
+  function isAppOrigin(origin) {
+    return APP_ORIGINS.indexOf(origin) !== -1;
+  }
+  var status = document.getElementById("status");
+  var frame = null;
+  var pending = new Map(); // reqId -> MessagePort back to the SW
+  var reqSeq = 0;
+  function fail(text) {
+    if (status) status.textContent = text;
+  }
+  function parseHash() {
+    var h = new URLSearchParams((location.hash || "").replace(/^#/, ""));
+    var port = Number(h.get("port"));
+    if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+    return { port: port, path: h.get("path") || "/" };
+  }
+  // ── SW side ───────────────────────────────────────────────────────────────
+  navigator.serviceWorker.addEventListener("message", function (event) {
+    var msg = event.data;
+    if (!msg || typeof msg !== "object") return;
+    if (msg.type === "http-request") {
+      // The SW handed us a port for this one request; remember it, ask the app,
+      // and answer on that port when the app replies.
+      var id = "px-" + (++reqSeq);
+      var replyPort = event.ports && event.ports[0];
+      if (!replyPort) return;
+      pending.set(id, replyPort);
+      post({ type: "site:request", id: id, payload: msg });
+      return;
+    }
+    if (msg.type === "site-nav") {
+      post({ type: "site:nav", port: msg.port, path: msg.path });
+      return;
+    }
+    // The worker could not serve a page at all. Its own reply is plain text that
+    // the frame renders as a bare white page, so relay the reason upward.
+    if (msg.type === "site-error") {
+      post({ type: "site-error", message: msg.message, port: msg.port });
+      return;
+    }
+    // The worker restarted and lost its bridge pointer — re-announce.
+    if (msg.type === "sw-hello") {
+      helloTo(event.source);
+    }
+  });
+  function helloTo(worker) {
+    try { worker && worker.postMessage({ type: "bridge-hello" }); } catch (e) { /* gone */ }
+  }
+  // ── App side ──────────────────────────────────────────────────────────────
+  // The shell speaks first (site:ready, and requests relayed from the worker),
+  // so it cannot wait to learn the parent's origin from a message. Posting to
+  // every allowed origin is enough: the browser delivers to the parent only for
+  // the one that matches it, and a parent outside the list receives nothing.
+  function post(message) {
+    for (var i = 0; i < APP_ORIGINS.length; i++) {
+      try { parent.postMessage(message, APP_ORIGINS[i]); } catch (e) { /* shell gone */ }
+    }
+  }
+  window.addEventListener("message", function (event) {
+    // Everything below acts on the app's word; an unchecked origin here would
+    // let any page that frames us speak for it.
+    if (!isAppOrigin(event.origin) || event.source !== parent) return;
+    var msg = event.data;
+    if (!msg || typeof msg !== "object") return;
+    if (msg.type === "site:reply") {
+      var port = pending.get(msg.id);
+      if (!port) return;
+      pending.delete(msg.id);
+      try { port.postMessage(msg.payload); } catch (e) { /* SW gone */ }
+      return;
+    }
+  });
+  // ── Boot ──────────────────────────────────────────────────────────────────
+  function show(port, path) {
+    var src = "/browse/" + Number(port) + (path || "/");
+    if (!frame) {
+      frame = document.createElement("iframe");
+      frame.title = "local site";
+      document.body.appendChild(frame);
+      if (status) status.remove();
+    }
+    frame.src = src;
+  }
+  if (!APP_ORIGINS.length) {
+    fail("9Remote: unknown host");
+    return;
+  }
+  if (!("serviceWorker" in navigator)) {
+    fail("Cannot connect: service worker unavailable");
+    return;
+  }
+  navigator.serviceWorker.register("/sw-site.js", { scope: "/" }).then(function (reg) {
+    var sayHello = function () { helloTo(reg.active || reg.waiting || reg.installing); };
+    sayHello();
+    reg.addEventListener("updatefound", function () {
+      var installing = reg.installing;
+      installing && installing.addEventListener("statechange", function () {
+        if (installing.state === "activated") sayHello();
+      });
+    });
+    // The frame must not load before the worker controls this origin, or the
+    // request goes to the edge and comes back as this same page.
+    var start = function () {
+      var target = parseHash();
+      if (!target) return fail("9Remote: no site address");
+      show(target.port, target.path);
+      post({ type: "site:ready" });
+    };
+    if (navigator.serviceWorker.controller) return start();
+    navigator.serviceWorker.addEventListener("controllerchange", start, { once: true });
+    // Activation without a controllerchange happens; don't hang forever on it.
+    setTimeout(function () { if (!frame) start(); }, 4000);
+  }).catch(function () {
+    fail("Cannot connect: service worker blocked");
+    post({ type: "site:swBlocked" });
+  });
+})();
+</script>

package/dist/web/screenshot-desktop.png ADDED Viewed

Binary file

package/dist/web/screenshot-mobile.png ADDED Viewed

Binary file

package/dist/web/screenshots/desktop-ide.webp ADDED Viewed

Binary file

package/dist/web/screenshots/mobile-1.webp ADDED Viewed

Binary file

package/dist/web/screenshots/mobile-2.webp ADDED Viewed

Binary file

package/dist/web/screenshots/mobile-3.webp ADDED Viewed

Binary file

package/dist/web/sw-site.js ADDED Viewed

@@ -0,0 +1,283 @@
+// Site proxy service worker: serves /browse/<port>/... documents via transport bridge.
+importScripts("/swBridgeClaim.js");
+const BROWSE_RE = /^\/browse\/(\d{1,5})(\/.*)?$/;
+const BRIDGE_TIMEOUT_MS = 60000;
+const BRIDGE_DISCOVER_MS = 3000;
+const MAX_REQUEST_BODY_BYTES = 512 * 1024;
+const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+// Restrict framing and origin communication via Content Security Policy.
+const SITE_CSP = [
+  "connect-src 'self'",
+  "form-action 'self'",
+  `frame-ancestors 'self' ${appOriginsFor(self.location.hostname, self.location.port)}`.trim(),
+  "base-uri 'self'"
+].join("; ");
+let bridgeClient = null;
+let bridgeDiscover = null;
+let bridgeResolve = null;
+let reqCounter = 0;
+self.addEventListener("install", (event) => event.waitUntil(self.skipWaiting()));
+self.addEventListener("activate", (event) => event.waitUntil(self.clients.claim()));
+self.addEventListener("message", (event) => {
+  const msg = event.data;
+  if (!msg || typeof msg !== "object") return;
+  if (msg.type === "bridge-hello") {
+    // Verify source is shell to prevent cross-site privilege escalation.
+    if (!canBeBridge(event.source?.url, self.location.origin)) return;
+    bridgeClient = event.source;
+    if (bridgeResolve) {
+      const resolve = bridgeResolve;
+      bridgeDiscover = null;
+      bridgeResolve = null;
+      resolve();
+    }
+    return;
+  }
+});
+function base64ToBytes(b64) {
+  const bin = atob(b64 || "");
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function bytesToBase64(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let bin = "";
+  const CHUNK = 0x8000;
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    bin += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK));
+  }
+  return btoa(bin);
+}
+function discoverBridge() {
+  if (bridgeClient) return Promise.resolve();
+  if (!bridgeDiscover) {
+    bridgeDiscover = new Promise((resolve) => {
+      bridgeResolve = resolve;
+      setTimeout(() => {
+        bridgeDiscover = null;
+        bridgeResolve = null;
+        resolve();
+      }, BRIDGE_DISCOVER_MS);
+    });
+    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((clients) => {
+      for (const client of clients) {
+        if (canBeBridge(client.url, self.location.origin)) client.postMessage({ type: "sw-hello" });
+      }
+    }).catch(() => {});
+  }
+  return bridgeDiscover;
+}
+// Injected script rewriting absolute links/forms into /browse/<port> scope.
+function inScopeScript(port) {
+  return `<script data-9remote="site-proxy">
+(function () {
+  if (window.__nineRemoteSiteProxy) return;
+  window.__nineRemoteSiteProxy = true;
+  var BASE = "/browse/${port}";
+  function scoped(path) {
+    if (!path || path.indexOf(BASE + "/") === 0 || path === BASE) return null;
+    return path.charAt(0) === "/" ? BASE + path : null;
+  }
+  // Bubble phase allows SPA routers to handle owned routes first.
+  document.addEventListener("click", function (e) {
+    if (e.defaultPrevented || e.button !== 0 || e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    var a = e.target && e.target.closest && e.target.closest("a[href]");
+    if (!a || a.target && a.target !== "_self" || a.hasAttribute("download")) return;
+    var url;
+    try { url = new URL(a.getAttribute("href"), location.href); } catch (err) { return; }
+    if (url.origin !== location.origin) return;
+    var next = scoped(url.pathname);
+    if (!next) return;
+    e.preventDefault();
+    location.replace(next + url.search + url.hash);
+  });
+  document.addEventListener("submit", function (e) {
+    if (e.defaultPrevented) return;
+    var form = e.target;
+    if (!form || form.tagName !== "FORM" || form.target && form.target !== "_self") return;
+    var action = form.getAttribute("action");
+    if (action === null) return;
+    var url;
+    try { url = new URL(action, location.href); } catch (err) { return; }
+    if (url.origin !== location.origin) return;
+    var next = scoped(url.pathname);
+    if (next) form.setAttribute("action", next + url.search);
+  }, true);
+  // Downgrade pushState to replaceState so iframe history doesn't swallow parent Back.
+  var nativeReplace = history.replaceState.bind(history);
+  ["pushState", "replaceState"].forEach(function (name) {
+    history[name] = function (state, title, path) {
+      if (typeof path === "string") {
+        try {
+          var url = new URL(path, location.href);
+          if (url.origin === location.origin) {
+            var next = scoped(url.pathname);
+            if (next) path = next + url.search + url.hash;
+          }
+        } catch (err) { /* leave path as-is */ }
+      }
+      return nativeReplace(state, title, path);
+    };
+  });
+})();
+</script>`;
+}
+function injectIntoHtml(html, port) {
+  const tag = inScopeScript(port);
+  const head = html.match(/<head[^>]*>/i);
+  if (head) return html.replace(head[0], () => head[0] + tag);
+  return tag + html;
+}
+async function portFromReferrer(request) {
+  try {
+    if (request.referrer) {
+      const match = new URL(request.referrer).pathname.match(BROWSE_RE);
+      if (match) return Number(match[1]);
+    }
+  } catch { /* bad referrer — fall through */ }
+  const clients = await self.clients.matchAll({ type: "window", includeUncontrolled: false });
+  for (const client of clients) {
+    const match = new URL(client.url).pathname.match(BROWSE_RE);
+    if (match) return Number(match[1]);
+  }
+  return null;
+}
+// MessageChannel per request to keep concurrent requests isolated.
+function requestViaBridge(reqId, port, method, target, headers, bodyB64) {
+  return new Promise((resolve, reject) => {
+    const channel = new MessageChannel();
+    const timer = setTimeout(() => {
+      channel.port1.close();
+      reject(new Error("bridge-timeout"));
+    }, BRIDGE_TIMEOUT_MS);
+    channel.port1.onmessage = (event) => {
+      clearTimeout(timer);
+      channel.port1.close();
+      resolve(event.data);
+    };
+    bridgeClient.postMessage(
+      { type: "http-request", reqId, port, method, target, headers, bodyB64 },
+      [channel.port2]
+    );
+  });
+}
+function fail(message, status, port) {
+  if (port) {
+    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((clients) => {
+      for (const client of clients) {
+        if (canBeBridge(client.url, self.location.origin)) client.postMessage({ type: "site-error", message, port });
+      }
+    }).catch(() => {});
+  }
+  return new Response(`9Remote: ${message}`, { status });
+}
+async function handle(request, url, inScope) {
+  const port = inScope ? Number(inScope[1]) : await portFromReferrer(request);
+  if (!port) return fail("no site context for this request", 503, null);
+  // Prevent cross-site subresource access within shared origin.
+  if (inScope && request.mode !== "navigate") {
+    const from = await portFromReferrer(request);
+    if (from && from !== port) {
+      return new Response("9Remote: cross-site request refused", { status: 403 });
+    }
+  }
+  await discoverBridge();
+  if (!bridgeClient) return fail("bridge not connected — open the 9Remote app", 503, port);
+  url.searchParams.delete("r");
+  const path = inScope ? (inScope[2] || "/") : url.pathname;
+  const target = path + (url.search || "");
+  if (request.mode === "navigate") {
+    bridgeClient.postMessage({ type: "site-nav", port, path });
+  }
+  const headers = {};
+  request.headers.forEach((value, key) => {
+    if (key.toLowerCase() !== "cookie") headers[key] = value;
+  });
+  let bodyB64 = null;
+  if (request.method !== "GET" && request.method !== "HEAD") {
+    const buf = await request.arrayBuffer();
+    if (buf.byteLength > MAX_REQUEST_BODY_BYTES) {
+      return new Response("9Remote: request body too large", { status: 413 });
+    }
+    if (buf.byteLength > 0) bodyB64 = bytesToBase64(buf);
+  }
+  const reqId = `sw-${Date.now()}-${++reqCounter}`;
+  let msg;
+  try {
+    msg = await requestViaBridge(reqId, port, request.method, target, headers, bodyB64);
+  } catch {
+    return fail("request timed out", 504, port);
+  }
+  if (!msg || msg.error) return fail(msg?.error || "no reply from the agent", 502, port);
+  const resHeaders = new Headers(msg.headers || {});
+  const location = resHeaders.get("location");
+  if (location && REDIRECT_STATUSES.includes(msg.status)) {
+    let next = null;
+    try {
+      const abs = new URL(location, `http://localhost:${port}`);
+      const sameSite = location.startsWith("/") || abs.host === `localhost:${port}`;
+      if (sameSite) next = abs.pathname + abs.search;
+    } catch { /* keep null */ }
+    if (next) return Response.redirect(`/browse/${port}${next}`, msg.status);
+    return Response.redirect(location, msg.status);
+  }
+  if (msg.status === 204 || msg.status === 304) {
+    return new Response(null, { status: msg.status, headers: resHeaders });
+  }
+  // Enforce CSP on proxied site content.
+  resHeaders.set("Content-Security-Policy", SITE_CSP);
+  const bytes = base64ToBytes(msg.bodyB64);
+  if ((resHeaders.get("content-type") || "").includes("text/html")) {
+    const html = new TextDecoder("utf-8").decode(bytes);
+    return new Response(injectIntoHtml(html, port), { status: msg.status, headers: resHeaders });
+  }
+  return new Response(bytes, { status: msg.status, headers: resHeaders });
+}
+self.addEventListener("fetch", (event) => {
+  const request = event.request;
+  let url;
+  try { url = new URL(request.url); } catch { return; }
+  if (url.origin !== self.location.origin) return;
+  if (url.pathname === "/sw-site.js") return;
+  if (url.pathname.startsWith("/cdn-cgi/")) return;
+  const inScope = url.pathname.match(BROWSE_RE);
+  if (inScope) {
+    event.respondWith(handle(request, url, inScope));
+    return;
+  }
+  // Handle root-relative subresource requests from in-scope pages.
+  if (request.mode === "navigate") return;
+  event.respondWith(handle(request, url, null));
+});

package/dist/web/sw.js ADDED Viewed

@@ -0,0 +1,88 @@
+// Service Worker - NO CACHE + WebPush Notifications
+// Handles PWA installation and push notifications
+self.addEventListener("install", () => {
+  self.skipWaiting();
+});
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    caches.keys().then((cacheNames) => {
+      return Promise.all(
+        cacheNames.map((cacheName) => caches.delete(cacheName))
+      );
+    })
+  );
+  return self.clients.claim();
+});
+// Fetch event - Always network, no cache
+self.addEventListener("fetch", (event) => {
+  event.respondWith(
+    fetch(event.request, {
+      cache: "no-store"
+    })
+  );
+});
+// Push notification received
+self.addEventListener("push", (event) => {
+  if (!event.data) return;
+  event.waitUntil(
+    (async () => {
+      // Skip when a PWA window is focused — backstop against stale server focus state
+      const clientList = await self.clients.matchAll({ type: "window", includeUncontrolled: true });
+      if (clientList.some((c) => c.visibilityState === "visible")) return;
+      try {
+        const data = event.data.json();
+        const title = data.title || "9Remote";
+        const options = {
+          body: data.body || "Notification",
+          icon: "/icon-192.png",
+          badge: "/icon-192.png",
+          data: data.data || { url: "/workspace" },
+          vibrate: [200, 100, 200],
+          tag: "9remote-notification",
+          renotify: true
+        };
+        await self.registration.showNotification(title, options);
+        // PWA icon badge (Android/desktop Chrome/Edge/Brave) — iOS silently ignores
+        if (self.registration.setAppBadge) {
+          const badgeCount = typeof data.badge === "number" ? data.badge : 1;
+          await self.registration.setAppBadge(badgeCount);
+        }
+      } catch (error) {
+        console.error("Push event error:", error);
+      }
+    })()
+  );
+});
+// Notification click - focus any same-origin client and deep-link into it
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close();
+  // User acknowledged → clear icon badge
+  if (self.registration.clearAppBadge) {
+    self.registration.clearAppBadge().catch(() => {});
+  }
+  const url = event.notification.data?.url || "/workspace";
+  event.waitUntil(
+    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then((clientList) => {
+      // Focus any existing same-origin client to preserve auth/state
+      for (const client of clientList) {
+        if ("focus" in client) {
+          client.postMessage({ type: "NOTIFICATION_CLICK", url });
+          return client.focus();
+        }
+      }
+      // No existing client — open a new one
+      return self.clients.openWindow(url);
+    })
+  );
+});

package/dist/web/swBridgeClaim.js ADDED Viewed

@@ -0,0 +1,57 @@
+// Which client may act as the bridge.
+//
+// The worker forwards every browsed request to whichever client announced
+// itself with "bridge-hello", and every browsed site lives on this same origin.
+// So a dev server rendering something the developer did not write can claim the
+// role, then see every other tab's requests — paths, headers, bodies — and
+// answer them with content of its own.
+//
+// The shell is the one page entitled to it, and the worker can tell: the shell
+// is served at /proxy.html, while sites are always under /browse/. Parsing the
+// URL rather than matching on the string is what makes /browse/3000/proxy.html
+// and /browse/3000/../proxy.html answer correctly.
+//
+// Loaded by sw-site.js through importScripts, so this is a classic script and
+// defines a global rather than exporting. The test reads and evaluates it.
+function canBeBridge(clientUrl, expectedOrigin) {
+  if (typeof clientUrl !== "string" || !clientUrl) return false;
+  let url;
+  try {
+    url = new URL(clientUrl);
+  } catch {
+    return false;
+  }
+  if (url.origin !== expectedOrigin) return false;
+  // pathname is already normalised by the URL parser, so ../ is resolved and a
+  // query or fragment cannot smuggle the shell's name into it.
+  return url.pathname === "/proxy.html";
+}
+// The app origins that may sit above a browsed site. frame-ancestors is checked
+// against EVERY ancestor, not just the parent, so a site framed by the shell is
+// also framed by the app — naming only the shell blocks the load.
+//
+// The loopback entry is the agent's own deploy: there the app and the sites host
+// are two names on one server, and the app answers on any loopback name, so all
+// of them have to be listed. A single fixed name leaves the site unframable for
+// whichever spelling the app was not opened on.
+const APP_HOSTS_BY_SITES_HOST = {
+  "sites.9remote.cc": ["https://9remote.cc"],
+  "sites-dev.9remote.cc": ["https://dev.9remote.cc"],
+  // No [::1]: CSP's frame-ancestors rejects an IPv6 literal as a source
+  // expression — Chrome drops the whole directive over it — so a page opened on
+  // that spelling cannot be named, and is left unsupported rather than silently
+  // unframable. localhost and 127.0.0.1 are what the agent is actually reached on.
+  "sites.localhost": ["http://localhost", "http://127.0.0.1"],
+  "sites.127.0.0.1": ["http://127.0.0.1"]
+};
+// "" for an unknown host: the policy then names the shell alone, which is the
+// safe direction — a load fails rather than an unknown origin being allowed.
+// `port` is the sites origin's own port, and the app answers on the same one.
+function appOriginsFor(hostname, port) {
+  const host = String(hostname || "").toLowerCase();
+  const bases = APP_HOSTS_BY_SITES_HOST[host];
+  if (!bases) return "";
+  return bases.map((b) => (port ? `${b}:${port}` : b)).join(" ");
+}