@amoshydra/oktoso 0.1.5 → 0.1.6

package/README.md

@@ -2,11 +2,11 @@
 
 Oktoso is a hub-first session hub for AI agents. One place to see what needs attention, browse sessions, start chats, and reply across OpenCode, Open WebUI, Hermes, and other providers.
 
-The hub is a small Node/TypeScript HTTP service. Clients are thin and replaceable: web, mobile, desktop, Even G2 glasses, and VR.
+The hub is a small Node/TypeScript HTTP service. Clients are thin and replaceable: web, mobile, desktop, [Even G2 glasses](apps/even-realities-g2/README.md), and VR.
 
 ## Status
 
-Implementation phase. OpenCode and Open WebUI are live, the web hub has search, drafts, attention, the newest-first transcript, and incremental message streaming, and the Even G2 client has its first inbox/chat/reply slice. Desktop notifications, real Hermes, and voice STT remain pending. The approved UI reference is frozen as `design-v1.1`.
+Implementation phase. OpenCode and Open WebUI are live, the web hub has search, drafts, attention, the newest-first transcript, and incremental message streaming, and the [Even G2 client](apps/even-realities-g2/README.md) has pairing, inbox, chat, questions, batches, discovery, failure states, and a glyph legend. Desktop notifications, real Hermes, and voice STT remain pending. The approved UI reference is frozen as `design-v1.1`.
 
 ## Documents
 
@@ -18,9 +18,7 @@ Implementation phase. OpenCode and Open WebUI are live, the web hub has search,
 - [`docs/design-lock.md`](docs/design-lock.md) - frozen `design-v1.1` reference and change policy
 - [`AGENTS.md`](AGENTS.md) - UI/design contract and repository instructions for agents
 - [`docs/openapi.yaml`](docs/openapi.yaml) - generated API contract
-- [`docs/wearables.md`](docs/wearables.md) - Even G2 setup, packaging, and device limits
-- [`docs/glass-ux.md`](docs/glass-ux.md) - glass screen map, interaction grammar, and validation plan
-- [`docs/g2-hardware-validation.md`](docs/g2-hardware-validation.md) - scripted G2 hardware acceptance run
+- [`apps/even-realities-g2/README.md`](apps/even-realities-g2/README.md) - Even G2 client, screenshots, pairing, symbols, subagent policy, packaging, and hardware validation
 - [`SECURITY.md`](SECURITY.md) - credential handling and vulnerability reporting
 - [`docs/publishing.md`](docs/publishing.md) - npm trusted publishing and release workflow
 - [`docs/prototypes/index.html`](docs/prototypes/index.html) - interactive UI prototype with mock data
@@ -48,7 +46,7 @@ pnpm dev
 - Open WebUI: chats, current branches, models, new chats, and prompt sends
 - Providers: OpenCode and Open WebUI adapters; Hermes remains a health-only fake
 - Attention: permissions, forms, unread sessions, failures, provider-backed actions, and live navigation badges
-- Wearables: `apps/even-realities-g2` (Oktoso G2), shared wearable core, phone pairing/keyboard, and hub-side reply assistance settings
+- Wearables: [`apps/even-realities-g2`](apps/even-realities-g2/README.md) (Oktoso G2), shared wearable core, phone pairing/keyboard, and hub-side reply assistance settings
 
 `pnpm dev` starts the hub, Vite, fake Open WebUI/Hermes servers, and a fake OpenCode server. Real provider credentials belong in the ignored `.env.local` file:
 
@@ -195,31 +193,18 @@ Use `--plain` for a scrollback-friendly session; human output stays on stdout an
 
 ## Even G2 URL hosting
 
-The hub can serve the glass app under a generic app prefix, alongside the web UI and API:
-
-```text
-http://localhost:8787/          web UI
-http://localhost:8787/api       hub API
-http://localhost:8787/apps/even-g2/
-```
-
-Build the hub, web UI, and hosted G2 app in one pass:
+The hub serves the glass app at `/apps/even-g2/`. See the
+[G2 README](apps/even-realities-g2/README.md) for the client screens, pairing,
+symbols, subagent policy, packaging, and hardware validation.
 
 ```sh
 pnpm build:single-port
 pnpm start:local
 ```
 
-`start:local` loads `.env.local`, uses the dev provider config, binds `0.0.0.0:8787`, and starts the built hub. For a real production config, use `HUB_CONFIG=./hub.config.json node dist/hub.js` instead.
-
-Open a pairing link, or enter a token if the app is loaded from another origin. The app uses the same origin for `/api`, so a paired browser uses the HttpOnly session cookie and needs no CORS or separate Vite server.
-
-The optional `.ehpk` flow still exists:
-
-```sh
-VITE_HUB_URL=https://hub.example.com pnpm --filter @amoshydra/oktoso-even-g2 build
-HUB_ORIGIN=https://hub.example.com pnpm pack:even-g2
-```
+`start:local` loads `.env.local`, uses the dev provider config, binds
+`0.0.0.0:8787`, and starts the built hub. For production, use
+`HUB_CONFIG=./hub.config.json node dist/hub.js`.
 
 ## Stack
 

package/dist/hub.js

@@ -29456,7 +29456,7 @@ var IdempotencyService = class {
 };
 
 // package.json
-var version2 = "0.1.5";
+var version2 = "0.1.6";
 
 // packages/hub/src/version.ts
 var VERSION = version2;
@@ -29602,16 +29602,17 @@ function requestHost(c) {
 }
 function isSameOriginRequest(c) {
   const origin = c.req.header("origin");
+  const site = c.req.header("sec-fetch-site");
   if (origin && origin !== "null") {
     try {
       const host = requestHost(c) ?? new URL(c.req.url).host;
-      return new URL(origin).host === host;
+      if (new URL(origin).host === host) return true;
     } catch {
-      return false;
     }
+    return site === "same-origin" || site === "none";
   }
-  const site = c.req.header("sec-fetch-site");
-  return site === "same-origin" || site === "none";
+  if (site) return site === "same-origin" || site === "none";
+  return false;
 }
 
 // packages/hub/src/http/auth-cookie.ts
@@ -29956,12 +29957,13 @@ function registerPairRoutes(app, deps) {
   });
   app.post("/pair/:code", (c) => {
     noStore2(c);
-    if (c.req.header("origin") && !isSameOriginRequest(c)) {
-      throw new AppError(
-        "forbidden",
-        "Cross-origin pairing request rejected",
-        403
-      );
+    if (!isSameOriginRequest(c)) {
+      c.get("logger").warn("pairing origin mismatch", {
+        origin: c.req.header("origin") ?? null,
+        host: requestHost(c) ?? null,
+        forwardedHost: c.req.header("x-forwarded-host") ?? null,
+        site: c.req.header("sec-fetch-site") ?? null
+      });
     }
     const consumed = deps.auth.consumePairing(c.req.param("code"));
     if (!consumed) {