@abstractframework/code 0.5.0 → 0.6.0

package/README.md

@@ -13,6 +13,15 @@ Run it without installing anything:
 npx @abstractframework/code      # serves on http://127.0.0.1:3002
 ```
 
+The server listens on `127.0.0.1` by default; pass `--host 0.0.0.0` to accept
+other machines directly (it then prints a warning that it is exposed beyond
+this machine). AbstractGateway (0.7.0 or later) can also start it
+and serve it at `/apps/code/` on the gateway's own address, which is the one
+address to expose or tunnel for a remote machine. Launch flags:
+`--gateway-url <url>`, `--port <n>`, `--host <addr>`, `--help`; without
+`--gateway-url` the server uses the gateway installed on this computer
+(`~/.abstractframework/gateway.json`), else `http://127.0.0.1:8080`.
+
 The interface uses AbstractUIC themes, authentication, settings, and reusable
 workflow chat. It builds without a sibling checkout: the shared
 `@abstractframework/*` components install from npm like any other dependency,
@@ -32,7 +41,7 @@ npm run dev
 
 In the UI:
 - set `Gateway URL` (e.g. `http://127.0.0.1:8080`), or configure it on the
-  server with `ABSTRACTCODE_GATEWAY_URL`
+  server with `--gateway-url` (the packaged server; `npm start -- --gateway-url …`)
 - set `Gateway user` and that user's `Gateway token`
 
 When a Gateway user is provided, the web server exchanges the token for a
@@ -51,10 +60,11 @@ gateway's versions. Agent tasks use the composer; structured workflows use
 event waits appear in the conversation. Runs and history remain on the gateway
 when you close the browser. Unsent drafts and queued turns do not survive reload.
 
-Whether a browser may change the Gateway URL is decided by the **connection
-peer**, not by any request header: only a request arriving from loopback may
-reconfigure it, and the server-configured Gateway URL is authoritative for
-everyone else. Set `ABSTRACTCODE_ALLOW_REMOTE_BROWSER_GATEWAY_CONFIG=1` to allow
+Whether a browser may change the Gateway URL is decided by the browser's
+address: only a browser on this machine may reconfigure it (forwarded headers
+count only from a loopback peer such as the gateway's `/apps/code/` relay),
+and a sign-in over a loopback connection must name a loopback host. The
+server-configured Gateway URL is authoritative for everyone else. Set `ABSTRACTCODE_ALLOW_REMOTE_BROWSER_GATEWAY_CONFIG=1` to allow
 it from anywhere, behind your own access control. Behind a reverse proxy every
 peer is the proxy, so loopback carries no meaning there — set
 `ABSTRACTCODE_TRUST_PROXY_HEADERS=1` to refuse browser-supplied changes

package/bin/cli.js

@@ -1,30 +1,35 @@
 #!/usr/bin/env node
 
-import { createCodeServer } from "./server.js";
-
-const port = process.env.PORT || 3002;
-const host = process.env.HOST || "0.0.0.0";
-const server = createCodeServer();
-
-server.listen(port, host, () => {
-  console.log(`
-╔════════════════════════════════════════════════════╗
-║      AbstractCode Web UI is running!               ║
-╚════════════════════════════════════════════════════╝
+import { createGatewayUrlResolver, parseAppFlagsOrExit } from "@abstractframework/app-server";
+
+import { bindExposureWarning, createCodeServer } from "./server.js";
+
+// The shared launch flags: --gateway-url (aliases --gateway, --url), --port,
+// --host (default 127.0.0.1: the gateway serves this app at /apps/code/),
+// --help. Environment variables are legacy aliases only (PORT, HOST,
+// ABSTRACTCODE_GATEWAY_URL, ABSTRACTGATEWAY_URL).
+const flags = parseAppFlagsOrExit(process.argv.slice(2), {
+  appName: "AbstractCode Web",
+  command: "abstractcode-web",
+  envPrefix: "ABSTRACTCODE",
+  defaultPort: 3002,
+});
 
-  🌐 Local:   http://localhost:${port}
-  🌐 Network: http://${host}:${port}
+// A flag or environment choice is fixed; otherwise the local gateway pointer
+// is followed (re-read when the gateway refuses a connection, so a running
+// app follows the gateway onto a new port).
+const fixed = flags.gatewayUrlSource === "flag" || flags.gatewayUrlSource.startsWith("env:");
+const server = createCodeServer({ defaultGatewayUrl: fixed ? flags.gatewayUrl : createGatewayUrlResolver() });
 
-  💻 Browser-based coding assistant
-  🔗 Connect to AbstractGateway in settings
-  🚀 Start coding with durable agent sessions
+// Said before listening, so it shows even when the bind then fails.
+const exposure = bindExposureWarning(flags.host, flags.port);
+if (exposure) console.warn(exposure);
 
-  Press Ctrl+C to stop
-`);
+server.listen(flags.port, flags.host, () => {
+  console.log(`AbstractCode Web on http://${flags.host}:${flags.port}/ (gateway ${flags.gatewayUrl}, from ${flags.gatewayUrlSource})`);
 });
 
 function shutdown() {
-  console.log("\n\n👋 Shutting down AbstractCode Web...\n");
   server.close(() => process.exit(0));
 }