@avsbhq/cli 3.8.2 → 3.9.1

package/dist/cli.js

@@ -26788,14 +26788,14 @@ var require_receiver = __commonJS({
        * @return {(Error|RangeError)} The error
        * @private
        */
-      createError(ErrorCtor, message, prefix, statusCode, errorCode) {
+      createError(ErrorCtor, message, prefix, statusCode, errorCode2) {
         this._loop = false;
         this._errored = true;
         const err = new ErrorCtor(
           prefix ? `Invalid WebSocket frame: ${message}` : message
         );
         Error.captureStackTrace(err, this.createError);
-        err.code = errorCode;
+        err.code = errorCode2;
         err[kStatusCode] = statusCode;
         return err;
       }
@@ -27681,7 +27681,7 @@ var require_websocket = __commonJS({
     var EventEmitter2 = __require("events");
     var https = __require("https");
     var http2 = __require("http");
-    var net = __require("net");
+    var net2 = __require("net");
     var tls = __require("tls");
     var { randomBytes, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
@@ -28415,12 +28415,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net.connect(options);
+      return net2.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net.isIP(options.host) ? "" : options.host;
+        options.servername = net2.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -39213,27 +39213,87 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 
 // src/lib/wsServer.ts
 import http from "node:http";
+import net from "node:net";
+
+// src/lib/devOrigin.ts
+var LOCAL_PAGE = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d{1,5})?$/;
+var CHROME_EXTENSION = /^chrome-extension:\/\/[a-p]{32}$/;
+var FIREFOX_EXTENSION = /^moz-extension:\/\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function isAllowedDevOrigin(origin) {
+  if (origin === void 0 || origin === "") return true;
+  const value = origin.trim().toLowerCase();
+  return LOCAL_PAGE.test(value) || CHROME_EXTENSION.test(value) || FIREFOX_EXTENSION.test(value);
+}
+var REFUSED_ORIGIN_STATUS = 403;
+
+// src/lib/wsServer.ts
 var PORT_START = 4400;
 var PORT_END = 4409;
+var DEFAULT_HOST = "127.0.0.1";
 var PING_INTERVAL_MS = 3e4;
+var PROBE_TIMEOUT_MS = 300;
+var LOOPBACK_PROBES = ["127.0.0.1", "::1"];
 function portsBusyError(start, end) {
   return new CliError("cli_failed", `Ports ${start} to ${end} are all busy.`, [
     "Another `avsb dev` (or another program) is holding them. Stop it, then run this again.",
     `\`lsof -i :${start}\` shows what is listening on a port.`
   ]);
 }
+function errorCode(err) {
+  return typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
+}
 function isAddressInUse(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "EADDRINUSE";
+  return errorCode(err) === "EADDRINUSE";
+}
+var BAD_HOST_CODES = /* @__PURE__ */ new Set(["EADDRNOTAVAIL", "ENOTFOUND", "EAI_AGAIN", "EAI_NONAME"]);
+function badHostError(host) {
+  return new CliError("cli_failed", `Cannot listen on ${host}: it is not an address of this machine.`, [
+    `Leave out --host to listen on ${DEFAULT_HOST} (this machine only), or pass 0.0.0.0 to listen on every interface.`
+  ]);
+}
+function isLoopbackHost(host) {
+  return host === "localhost" || host === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+function describeDevServer(server) {
+  if (isLoopbackHost(server.host)) {
+    return { line: `Dev server running at ${server.url} (this machine only)`, warning: null };
+  }
+  return {
+    line: `Dev server running at ${server.url}`,
+    warning: `Listening on ${server.host}: other devices on your network can reach this server and read the code it serves.`
+  };
+}
+function devServerUrl(host, port) {
+  return `http://${host.includes(":") ? `[${host}]` : host}:${port}`;
+}
+function answersOn(address, port) {
+  return new Promise((resolve3) => {
+    const socket = net.connect({ host: address, port });
+    const done = (answered) => {
+      socket.destroy();
+      resolve3(answered);
+    };
+    socket.setTimeout(PROBE_TIMEOUT_MS, () => done(false));
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+  });
+}
+async function isPortAnsweredOnLoopback(port) {
+  const answers = await Promise.all(LOOPBACK_PROBES.map((address) => answersOn(address, port)));
+  return answers.some(Boolean);
 }
 async function startDevServer(options) {
   const { experimentName, experimentId, onExtensionMessage } = options;
   const start = options.portRange?.start ?? PORT_START;
   const end = options.portRange?.end ?? PORT_END;
+  const host = options.host ?? DEFAULT_HOST;
   let bound = null;
   for (let port2 = start; port2 <= end && !bound; port2++) {
+    if (await isPortAnsweredOnLoopback(port2)) continue;
     try {
-      bound = { ...await tryPort(port2, experimentName, experimentId, onExtensionMessage), port: port2 };
+      bound = { ...await tryPort(port2, host, experimentName, experimentId, onExtensionMessage), port: port2 };
     } catch (err) {
+      if (BAD_HOST_CODES.has(String(errorCode(err)))) throw badHostError(host);
       if (!isAddressInUse(err)) throw err;
     }
   }
@@ -39252,6 +39312,8 @@ async function startDevServer(options) {
   }, PING_INTERVAL_MS);
   return {
     port,
+    host,
+    url: devServerUrl(host, port),
     broadcast(msg) {
       broadcast(JSON.stringify(msg));
     },
@@ -39275,7 +39337,7 @@ async function startDevServer(options) {
     }
   };
 }
-function tryPort(port, experimentName, experimentId, onExtensionMessage) {
+function tryPort(port, host, experimentName, experimentId, onExtensionMessage) {
   return new Promise((resolve3, reject) => {
     const httpServer = http.createServer((req, res) => {
       if (req.url === "/health") {
@@ -39293,7 +39355,14 @@ function tryPort(port, experimentName, experimentId, onExtensionMessage) {
         })
       );
     });
-    const wss = new import_websocket_server.default({ server: httpServer });
+    const wss = new import_websocket_server.default({
+      server: httpServer,
+      // A web page must not reach the code this server streams (devOrigin.ts).
+      verifyClient: (info2, done) => {
+        if (isAllowedDevOrigin(info2.req.headers.origin)) done(true);
+        else done(false, REFUSED_ORIGIN_STATUS, "Origin not allowed");
+      }
+    });
     let settled = false;
     const fail2 = (err) => {
       if (settled) return;
@@ -39313,7 +39382,7 @@ function tryPort(port, experimentName, experimentId, onExtensionMessage) {
         }
       });
     });
-    httpServer.listen(port, () => {
+    httpServer.listen(port, host, () => {
       if (settled) return;
       settled = true;
       resolve3({ httpServer, wss });
@@ -39322,7 +39391,7 @@ function tryPort(port, experimentName, experimentId, onExtensionMessage) {
 }
 
 // src/commands/dev.ts
-var devCommand = new Command("dev").description("Start dev server with live reload for the browser extension").action(async () => {
+var devCommand = new Command("dev").description("Start dev server with live reload for the browser extension").option("--host <host>", "Address to listen on: 127.0.0.1 is this machine only, 0.0.0.0 is every interface", DEFAULT_HOST).action(async (opts) => {
   try {
     ensureLoggedIn();
     const { manifest, dir } = readManifestOrExit();
@@ -39340,6 +39409,7 @@ var devCommand = new Command("dev").description("Start dev server with live relo
     const server = await startDevServer({
       experimentName: manifest.experimentName,
       experimentId: manifest.experimentId,
+      host: opts.host,
       onExtensionMessage(msg, ws) {
         if (msg.type === "ext:connect") {
           const initMsg = {
@@ -39366,7 +39436,9 @@ var devCommand = new Command("dev").description("Start dev server with live relo
       }
     });
     line();
-    success(`Dev server running on port ${server.port}`);
+    const listening = describeDevServer(server);
+    success(listening.line);
+    if (listening.warning) warn(listening.warning);
     info("Watching for changes...");
     line();
     const watcher = startWatcher({
@@ -39670,7 +39742,7 @@ var projectPushCommand = new Command("push").description("Compile and push proje
     failCommand(err);
   }
 });
-var projectDevCommand = new Command("dev").description("Watch project script and hot-reload via browser extension").action(async () => {
+var projectDevCommand = new Command("dev").description("Watch project script and hot-reload via browser extension").option("--host <host>", "Address to listen on: 127.0.0.1 is this machine only, 0.0.0.0 is every interface", DEFAULT_HOST).action(async (opts) => {
   try {
     ensureLoggedIn();
     const { manifest, dir } = readProjectManifestOrExit();
@@ -39696,6 +39768,7 @@ var projectDevCommand = new Command("dev").description("Watch project script and
     const server = await startDevServer({
       experimentName: `${manifest.projectName} (project script)`,
       experimentId: manifest.projectId,
+      host: opts.host,
       onExtensionMessage(msg, ws) {
         if (msg.type === "ext:connect") {
           const initMsg = {
@@ -39711,7 +39784,9 @@ var projectDevCommand = new Command("dev").description("Watch project script and
       }
     });
     line();
-    success(`Dev server running on port ${server.port}`);
+    const listening = describeDevServer(server);
+    success(listening.line);
+    if (listening.warning) warn(listening.warning);
     info("Watching for changes...");
     line();
     const watcher = startWatcher({
@@ -39982,6 +40057,21 @@ function readMetricList(data) {
 function readMetric(data) {
   return isRecord5(data) && isCliMetric(data.metric) ? data.metric : null;
 }
+function plural(count, one, many) {
+  return `${count} ${count === 1 ? one : many}`;
+}
+function describeArchiveCascade(data) {
+  if (!isRecord5(data) || !isRecord5(data.cascade)) return null;
+  const { experimentCount, flagRuleCount } = data.cascade;
+  const experiments = typeof experimentCount === "number" ? experimentCount : 0;
+  const flagRules = typeof flagRuleCount === "number" ? flagRuleCount : 0;
+  if (experiments === 0 && flagRules === 0) return null;
+  const parts = [
+    experiments > 0 ? plural(experiments, "experiment", "experiments") : null,
+    flagRules > 0 ? plural(flagRules, "flag rule", "flag rules") : null
+  ].filter((part) => part !== null);
+  return `Detached from ${parts.join(" and ")}. Unarchiving will not reattach it.`;
+}
 function formatMetricTable(metrics, usage) {
   const rows = metrics.map((metric) => ({
     id: metricIdLabel(metric),
@@ -40130,6 +40220,8 @@ var metricsArchiveCommand = new Command("archive").argument("<metricId>", "Metri
   }
   const metric = readMetric(response.data);
   spinner.succeed(metric ? `Metric archived: ${metric.name} (${metricIdLabel(metric)})` : `Metric ${metricId} archived`);
+  const cascade = describeArchiveCascade(response.data);
+  if (cascade) info(cascade);
 });
 var metricsUnarchiveCommand = new Command("unarchive").argument("<metricId>", "Metric ID").description("Restore an archived metric").option("--project <project>", "Project ID (PRJ-42 or numeric); defaults to local manifest").action(async (metricId, opts) => {
   const config = ensureLoggedIn();
@@ -43226,7 +43318,7 @@ function fishCompletion(entries) {
   for (const entry of entries) {
     const condition = `'test (__avsb_path) = "${entry.path}"'`;
     if (entry.words.length > 0) {
-      lines.push(`complete -c avsb -n ${condition} -a ${quoteFish(entry.words.join(" "))}`);
+      lines.push(`complete -c avsb -n ${condition} -f -a ${quoteFish(entry.words.join(" "))}`);
     }
     for (const flag of entry.flags) {
       lines.push(`complete -c avsb -n ${condition} -l ${flag.replace(/^--/, "")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avsbhq/cli",
-  "version": "3.8.2",
+  "version": "3.9.1",
   "description": "CLI tool for local A/B experiment development with the A vs B platform",
   "type": "module",
   "license": "MIT",