@abstractframework/code 0.4.2 → 0.5.0

package/README.md

@@ -40,8 +40,14 @@ Gateway browser session and stores only app-scoped session cookies. The raw
 token is not persisted in browser settings. Vite development and the packaged
 server use the same session proxy; the browser keeps API requests same-origin.
 
-Choose an agent or registered workflow in the toolbar. Agent tasks use the
-composer; structured workflows use **Inputs**. Questions, tool approvals, and
+Choose a workflow in the toolbar: **Gateway default** (the coding agent your
+gateway's operator set, resolved by the gateway when the turn starts), a
+published coding agent, or, with **Show all workflows**, any registered
+workflow. The **Files** tab shows the conversation's workspace on the gateway
+with previews, **Settings → Stream replies** shows replies as the model writes
+them (on gateways that support it), and **About** lists the app's and the
+gateway's versions. Agent tasks use the composer; structured workflows use
+**Inputs**. Questions, tool approvals, and
 event waits appear in the conversation. Runs and history remain on the gateway
 when you close the browser. Unsent drafts and queued turns do not survive reload.
 

package/bin/server.js

@@ -96,6 +96,34 @@ function isLoopbackPeer(req) {
   );
 }
 
+/**
+ * The browser connection's real transport peer (req.socket.remoteAddress),
+ * IPv4-mapped IPv6 unwrapped, or "" when unknown. Headers are never read.
+ * Every request this server sends to the gateway on a browser's behalf
+ * carries it as `X-Forwarded-For`, OVERWRITING any client value (contract
+ * A-2; same rule as abstractuic's app-server). An unknown peer is refused.
+ */
+export function socketPeerAddress(req) {
+  let address = String(req?.socket?.remoteAddress || "").trim().toLowerCase();
+  if (address.startsWith("::ffff:") && address.includes(".")) address = address.slice(7);
+  return address;
+}
+
+const UNKNOWN_PEER = { detail: "Cannot determine the client address of this connection" };
+/** Marks every request this server sends to the gateway as coming through
+ * the Code app proxy (the gateway's same-machine fail-safe keys on it). A
+ * browser-supplied value is always dropped and replaced. */
+const APP_PROXY_HEADER = "X-AbstractFramework-App-Proxy";
+const APP_PROXY_NAME = "code";
+const FORWARDING_HEADERS = new Set([
+  "x-abstractframework-app-proxy",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip",
+  "forwarded",
+]);
+
 function connectionConfigAllowed(req, config) {
   if (envBool(config.env, "ABSTRACTCODE_ALLOW_REMOTE_BROWSER_GATEWAY_CONFIG"))
     return true;
@@ -387,6 +415,11 @@ function cookieValueFromSetCookie(rawHeaders, name) {
 }
 
 async function handleConnectionApi(req, res, config) {
+  const peer = socketPeerAddress(req);
+  if (!peer) {
+    sendJson(res, 400, UNKNOWN_PEER);
+    return;
+  }
   if (req.method === "GET") {
     const session = browserSession(req, config);
     if (!session.sessionId) {
@@ -406,6 +439,8 @@ async function handleConnectionApi(req, res, config) {
         headers: {
           Accept: "application/json",
           "X-AbstractGateway-Session": session.sessionId,
+          "X-Forwarded-For": peer,
+          [APP_PROXY_HEADER]: APP_PROXY_NAME,
         },
       },
       undefined,
@@ -454,6 +489,8 @@ async function handleConnectionApi(req, res, config) {
           Accept: "application/json",
           "Content-Type": "application/json",
           "Content-Length": String(body.length),
+          "X-Forwarded-For": peer,
+          [APP_PROXY_HEADER]: APP_PROXY_NAME,
         },
       },
       body,
@@ -511,6 +548,8 @@ async function handleConnectionApi(req, res, config) {
             "Content-Length": String(body.length),
             "X-AbstractGateway-Session": session.sessionId,
             "X-AbstractGateway-CSRF": session.csrfToken,
+            "X-Forwarded-For": peer,
+          [APP_PROXY_HEADER]: APP_PROXY_NAME,
           },
         },
         body,
@@ -541,6 +580,11 @@ function proxyGatewayRequest(req, res, config) {
     sendJson(res, 401, { detail: "Gateway sign-in required" });
     return;
   }
+  const peer = socketPeerAddress(req);
+  if (!peer) {
+    sendJson(res, 400, UNKNOWN_PEER);
+    return;
+  }
   if (mutatingMethod(req.method)) {
     const presented = String(req.headers["x-abstractcode-csrf"] || "").trim();
     if (!session.csrfToken || presented !== session.csrfToken) {
@@ -563,9 +607,13 @@ function proxyGatewayRequest(req, res, config) {
   const headers = { ...req.headers, host: backend.url.host };
   delete headers.cookie;
   delete headers.authorization;
-  delete headers["x-forwarded-for"];
-  delete headers["x-forwarded-host"];
-  delete headers["x-forwarded-proto"];
+  // Forwarding headers: drop every client-supplied spelling (any case, plus
+  // RFC 7239 `Forwarded` and `X-Real-IP`), then X-Forwarded-For = the socket
+  // peer, so the gateway can tell whether the browser is on its machine.
+  for (const key of Object.keys(headers))
+    if (FORWARDING_HEADERS.has(key.toLowerCase())) delete headers[key];
+  headers["x-forwarded-for"] = peer;
+  headers["x-abstractframework-app-proxy"] = APP_PROXY_NAME;
   delete headers["x-abstractcode-csrf"];
   headers["x-abstractgateway-session"] = session.sessionId;
   if (mutatingMethod(req.method))