@cabane/companion 0.6.238 → 0.6.240

package/README.md

@@ -38,6 +38,8 @@ Enter the code in Cabane, signed in as yourself: from Your settings → Devices
 
 Without a terminal, setup prints the same lines once and waits, so a container's logs carry the code. An expired code is replaced by a fresh one, up to three; Ctrl-C stops cleanly. The link is on the Cabane the device pairs with. There is no default: setup pairs with the Cabane named by `--server <url>`, by `CABANE_BASE_URL`, or by the device's config, and stops if none names one. Once a Cabane has issued a code, setup keeps its address, so after a cancelled or expired pairing a bare `cabane setup` pairs with the same one.
 
+The address must be https, or plain http to this machine (`localhost`, `127.0.0.1`). A Companion that reaches its Cabane across a private network where the server has no certificate, such as a container on a Docker network it shares only with the server, can be allowed plain http to that one host with `CABANE_ALLOW_PLAIN_HTTP_HOST`: for example `CABANE_ALLOW_PLAIN_HTTP_HOST=app` with `CABANE_BASE_URL=http://app:8788`. The value must be a name with no dot, which only the local network's resolver answers, or a private address (`10.x.x.x`, `172.16.x.x`–`172.31.x.x`, `192.168.x.x`, or IPv6 `fc00::/7`); anything else is ignored. A Companion that pairs over plain http to that host keeps that address, instead of the public one Cabane names, since that is the only way it reaches Cabane. A browser can't open that address, so the Companion doesn't print it: where it would name the device's page in Cabane, it says Your settings → Devices instead. Over plain http, anything else on that network can read the device token and the agents' work, so use it only on a network nothing else joins.
+
 From an interactive terminal, setup then starts the Companion in the background, waits for its first check-in and reports the device's state. Without an interactive terminal, setup stays attached to the running Companion.
 
 If no harness is usable, interactive setup asks which one you want to set up. Follow the complete CLI installation and sign-in steps for [Mac setup](https://cabane.ai/docs/mac-setup#2-sign-in), [Windows setup](https://cabane.ai/docs/windows-setup#2-sign-in) or [Server and VPS setup](https://cabane.ai/docs/server-and-vps-setup#2-sign-in-without-a-browser), then check `cabane status`.
@@ -57,7 +59,7 @@ If no harness is usable, interactive setup asks which one you want to set up. Fo
   In Cabane: https://cabane.example.com/settings/devices
 ```
 
-Setup never installs the service. On macOS or Linux, run `cabane service install` when you want the Companion to start at login and keep itself updated; the closing block names it. Native Windows uses the background process and has no service installer.
+Setup never installs the service. On macOS or Linux, run `cabane service install` when you want the Companion to start at login and keep itself updated; the closing block names it. Native Windows uses the background process and has no service installer. Inside a container the Companion names neither the service nor automatic updates, in the closing block, `cabane status` or `cabane update`: whatever runs the container keeps it running, and you update it by replacing the container with a newer image.
 
 If `cabane` isn't found afterwards, open a new terminal, or run the `source` line setup printed.
 

package/dist/cli.js

@@ -279,7 +279,7 @@ var init_errors = __esm({
 });
 
 // src/pairing.ts
-function isAllowedBaseUrl(raw) {
+function isAllowedBaseUrl(raw, env = process.env) {
   let url;
   try {
     url = new URL(raw);
@@ -289,13 +289,63 @@ function isAllowedBaseUrl(raw) {
   if (url.protocol === "https:") return true;
   if (url.protocol === "http:") {
     const host = url.hostname.toLowerCase();
-    return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+    if (host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+      return true;
+    const allowed = plainHttpHost(env);
+    return allowed !== null && host === allowed;
   }
   return false;
 }
+function plainHttpHost(env = process.env) {
+  const raw = env[ALLOW_PLAIN_HTTP_HOST_ENV]?.trim().toLowerCase();
+  if (!raw) return null;
+  if (isSingleLabel(raw) || isPrivateIpv4(raw)) return raw;
+  const bare = raw.startsWith("[") && raw.endsWith("]") ? raw.slice(1, -1) : raw;
+  return privateIpv6(bare);
+}
+function isSingleLabel(host) {
+  return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(host) && !/^\d+$/.test(host);
+}
+function isPrivateIpv4(host) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return false;
+  const [a, b, c, d] = m.slice(1).map(Number);
+  if ([a, b, c, d].some((n) => n > 255)) return false;
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+function privateIpv6(host) {
+  if (!host.includes(":")) return null;
+  let bracketed;
+  try {
+    bracketed = new URL(`http://[${host}]/`).hostname;
+  } catch {
+    return null;
+  }
+  const first = Number.parseInt(bracketed.slice(1).split(":")[0] || "0", 16);
+  return (first & 65024) === 64512 ? bracketed : null;
+}
+function addressToKeep(pairedOver, cabaneNamed, env = process.env) {
+  return onPlainHttpHost(pairedOver, env) ? pairedOver.replace(/\/+$/, "") : cabaneNamed;
+}
+function browserAddress(baseUrl, env = process.env) {
+  return onPlainHttpHost(baseUrl, env) ? null : baseUrl.replace(/\/+$/, "");
+}
+function onPlainHttpHost(raw, env) {
+  const allowed = plainHttpHost(env);
+  if (allowed === null) return false;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  return url.protocol === "http:" && url.hostname.toLowerCase() === allowed;
+}
+var ALLOW_PLAIN_HTTP_HOST_ENV;
 var init_pairing = __esm({
   "src/pairing.ts"() {
     "use strict";
+    ALLOW_PLAIN_HTTP_HOST_ENV = "CABANE_ALLOW_PLAIN_HTTP_HOST";
   }
 });
 
@@ -712,10 +762,10 @@ var init_config = __esm({
     }).strict();
     agentsConfigSchema = z2.record(z2.string(), localAgentConfigSchema);
     companionConfigSchema = z2.object({
-      // https-enforced (loopback exempt), so a hand-edited config can't put the
-      // device token and prompt on a plaintext channel.
-      baseUrl: z2.string().url().refine(isAllowedBaseUrl, {
-        message: "baseUrl must be https (loopback http is allowed for local dev only)"
+      // https-enforced (loopback, and the one private host a person names, exempt), so a
+      // hand-edited config can't put the device token and prompt on a plaintext channel.
+      baseUrl: z2.string().url().refine((url) => isAllowedBaseUrl(url), {
+        message: `baseUrl must be https (plain http only to this machine, or to the private host ${ALLOW_PLAIN_HTTP_HOST_ENV} names)`
       }),
       // The `cabdev_` device token plaintext — the companion's one durable credential,
       // presented as `Authorization: Bearer <token>` on the device-facing pull +
@@ -10065,7 +10115,12 @@ async function awaitEnrollment(baseUrl, code, opts = {}) {
 init_cabane_command();
 init_device_state();
 init_harness_copy();
+init_pairing();
 var UNPAIRED = `This device isn't paired yet. Run  ${cabane("setup")}  on it.`;
+function devicesUrl(baseUrl, env = process.env) {
+  const base = browserAddress(baseUrl, env);
+  return base === null ? null : `${base}/settings/devices`;
+}
 var lease = DEFAULT_DEVICE_OFFLINE_THRESHOLD_MS;
 function age(at, now) {
   const seconds = Math.max(0, Math.floor((now - Date.parse(at)) / 1e3));
@@ -10074,7 +10129,7 @@ function age(at, now) {
 function deviceLine(f, now = Date.now()) {
   if (!f.running) return `not running \u2014 start it with  ${cabane("start")}`;
   if (f.lastHeartbeatRefused)
-    return `refused by the server \u2014 it may be deactivated; see ${f.devicesUrl}`;
+    return f.devicesUrl ? `refused by the server \u2014 it may be deactivated; see ${f.devicesUrl}` : "refused by the server \u2014 it may be deactivated; see Your settings \u2192 Devices in Cabane";
   if (!f.lastHeartbeatAckAt) return "starting \u2014 hasn't checked in yet";
   const since = age(f.lastHeartbeatAckAt, now);
   if (now - Date.parse(f.lastHeartbeatAckAt) > lease)
@@ -10123,7 +10178,8 @@ function closingBlock(input, now = Date.now()) {
       "",
       `  Status  ${cabane("status")}${mode === "attached" ? "" : `     Stop  ${cabane("stop")}`}     Log  ${cabane("logs")}`
     );
-    if (!input.service && input.servicePlatform) {
+    if (input.container) {
+    } else if (!input.service && input.servicePlatform) {
       lines2.push(
         `  Start at login and keep Cabane updating itself:  ${cabane("service install")}${input.servicePlatform === "launchd" ? " (macOS will ask you to allow a background item)" : ""}`
       );
@@ -10287,6 +10343,9 @@ function openLink(link) {
   });
 }
 
+// src/commands/setup.ts
+init_pairing();
+
 // src/commands/start.ts
 init_cabane_command();
 init_config();
@@ -10302,7 +10361,7 @@ function resolvePairBaseUrl(server) {
   if (!raw) throw new NoPairAddressError();
   if (!isAllowedBaseUrl(raw)) {
     throw new CompanionError(
-      `invalid server URL "${raw}": must be an https URL (loopback http is allowed for local dev). Pass it as \`${cabane("setup --server https://your-cabane")}\`.`
+      `invalid server URL "${raw}": must be an https URL (plain http only to this machine, or to the private host ${ALLOW_PLAIN_HTTP_HOST_ENV} names). Pass it as \`${cabane("setup --server https://your-cabane")}\`.`
     );
   }
   return raw;
@@ -11585,14 +11644,15 @@ function osUser() {
     return typeof process.getuid === "function" ? `uid ${process.getuid()}` : "unknown";
   }
 }
-function hostReport() {
-  let container;
+function containerHere() {
   try {
-    container = inContainer(readContainerSignals());
+    return inContainer(readContainerSignals());
   } catch {
-    container = null;
+    return null;
   }
-  return { user: osUser(), container };
+}
+function hostReport() {
+  return { user: osUser(), container: containerHere() };
 }
 
 // src/providers/local-process.ts
@@ -14785,6 +14845,217 @@ function defaultSpawnDetached(args) {
   }
 }
 
+// src/commands/service.ts
+init_cabane_command();
+init_config();
+init_term();
+
+// src/commands/stop.ts
+var TERM_GRACE_MS = 6e3;
+var POLL_INTERVAL_MS = 150;
+async function stop(deps = {}) {
+  if ((deps.serviceInstalled ?? serviceInstalled)()) {
+    const outcome = await (deps.stopService ?? stopService)();
+    for (const line of outcome.lines) process.stdout.write(`${line}
+`);
+    if (!outcome.ok) {
+      process.exitCode = 1;
+      return;
+    }
+    process.stdout.write(
+      "companion: stopped the service. It starts again at boot, or with `cabane start`.\n"
+    );
+    return;
+  }
+  const readState = deps.readState ?? readLiveRuntimeState;
+  const verify = deps.verify ?? ((s) => verifyRuntime(s));
+  const kill = deps.kill ?? ((pid2, signal) => process.kill(pid2, signal));
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  const state = readState();
+  if (!state) {
+    process.stdout.write("companion: not running (nothing to stop).\n");
+    return;
+  }
+  if (await verify(state) === "stale") {
+    clearRuntimeState();
+    process.stdout.write("companion: not running (stale marker swept).\n");
+    return;
+  }
+  const { pid } = state;
+  process.stdout.write(`companion: stopping (pid ${pid})\u2026
+`);
+  try {
+    kill(pid, "SIGTERM");
+  } catch {
+    clearRuntimeState();
+    process.stdout.write("companion: already stopped.\n");
+    return;
+  }
+  const deadline = now() + TERM_GRACE_MS;
+  while (now() < deadline) {
+    if (!isAlive(kill, pid)) {
+      process.stdout.write("companion: stopped.\n");
+      return;
+    }
+    await sleep4(POLL_INTERVAL_MS);
+  }
+  process.stdout.write(
+    `companion: didn't exit within ${TERM_GRACE_MS / 1e3}s, sending SIGKILL.
+`
+  );
+  try {
+    kill(pid, "SIGKILL");
+  } catch {
+  }
+  clearRuntimeState();
+  process.stdout.write("companion: force-stopped.\n");
+}
+function isAlive(kill, pid) {
+  try {
+    kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/service.ts
+var STARTUP_WAIT_MS = 2e4;
+async function installAndStartService(deps = {}) {
+  const readState = deps.readState ?? readLiveRuntimeState;
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const before = await serviceState(deps);
+  const running = readState();
+  if (running && running.pid !== before.pid) await (deps.stopRunning ?? (() => stop()))();
+  setRunsAsService(true);
+  const outcome = await installService(deps);
+  for (const line of outcome.lines) write(`${INDENT}${line}`);
+  if (!outcome.ok) {
+    setRunsAsService(false);
+    return false;
+  }
+  const deadline = now() + STARTUP_WAIT_MS;
+  while (now() < deadline) {
+    const state = readState();
+    if (state?.socket) return true;
+    await sleep4(250);
+  }
+  write(
+    `${INDENT}The service is installed but Cabane hasn't come up yet. ${cabane("service status")} and ${cabane("logs")} say why.`
+  );
+  return false;
+}
+async function serviceInstall(deps = {}) {
+  if (!await installAndStartService(deps)) {
+    process.exitCode = 1;
+    return;
+  }
+  write(
+    INDENT + tick(
+      "Cabane runs as a service. It starts at boot, restarts if it stops, and updates itself, usually between turns."
+    )
+  );
+  write(`${INDENT}  Status:  ${cabane("service status")}        Logs:  ${cabane("logs")}`);
+}
+async function serviceUninstall(deps = {}) {
+  const outcome = await uninstallService(deps);
+  for (const line of outcome.lines) write(`${INDENT}${line}`);
+  if (outcome.lines.length > 0) return;
+  setRunsAsService(false);
+  write(
+    INDENT + tick("Removed the service. Cabane won't start at boot, and it isn't running now.")
+  );
+  write(`${INDENT}  Start it again with  ${cabane("start")}`);
+}
+async function serviceStatus(deps = {}) {
+  const state = await serviceState(deps);
+  const container = containerWords(containerHere() === true, state);
+  for (const line of serviceRows(state, { container })) write(line);
+  for (const line of updateRows(readUpdateState(), safeConfig()?.update?.auto, {
+    service: state.installed,
+    container
+  }))
+    write(line);
+  if (state.installed && state.state !== "running") process.exitCode = 1;
+}
+var LABEL_WIDTH = 13;
+var row = (label, value) => `  ${label.padEnd(LABEL_WIDTH)}${value}`;
+function containerWords(container, state, opts = {}) {
+  if (!container || opts.supervisedHere) return false;
+  const serviceRuns = state.installed && state.state === "running";
+  if (!serviceRuns) return true;
+  return opts.companion !== void 0 && state.pid !== opts.companion;
+}
+function serviceRows(state, opts = {}) {
+  if (opts.container) return [row("Service", "not used in a container")];
+  if (!state.installed) {
+    return [
+      row(
+        "Service",
+        state.platform ? `not installed \u2014 ${cabane("service install")} starts Cabane at boot` : "not available on this system"
+      )
+    ];
+  }
+  const via = state.platform === "systemd" ? "systemd" : "launchd";
+  const rows = [
+    row(
+      "Service",
+      state.state === "running" ? `running (${via}${state.pid ? `, pid ${state.pid}` : ""})` : `installed, not running (${via}: ${state.state})`
+    )
+  ];
+  if (!state.nodeOk) {
+    rows.push(
+      `  ! The service's Node at ${tildePath(state.node ?? "")} is gone. Run  ${cabane("service install")}  again.`
+    );
+  }
+  return rows;
+}
+function updateRows(state, auto, opts = {}) {
+  const rows = [];
+  if (opts.version !== false) rows.push(row("Version", COMPANION_VERSION));
+  if (state.server) {
+    rows.push(
+      row(
+        "Cabane wants",
+        `${state.server.latest} (the latest), ${state.server.minimum} or newer to run turns`
+      )
+    );
+  }
+  rows.push(
+    row(
+      "Auto-update",
+      opts.container ? "off \u2014 to update, replace the container with a newer image" : !opts.service ? `off \u2014 runs with the service: ${cabane("service install")}` : auto === true ? "on \u2014 updates install between turns when they can, and roll back if they fail" : `off \u2014 ${cabane("update --auto on")} turns it on`
+    )
+  );
+  const last = state.lastResult;
+  if (last) {
+    const when = new Date(last.at).toLocaleDateString("en-GB", { day: "numeric", month: "short" });
+    const why = last.reason ? `: ${last.reason}` : "";
+    rows.push(
+      row(
+        "Last update",
+        last.kind === "updated" ? `${last.from} \u2192 ${last.to} on ${when}` : last.kind === "rolled_back" ? `${last.to} rolled back to ${last.from} on ${when}${why}` : `${last.to} failed on ${when}${why}`
+      )
+    );
+  }
+  return rows;
+}
+function safeConfig() {
+  try {
+    return loadConfig();
+  } catch {
+    return null;
+  }
+}
+function setRunsAsService(on) {
+  const cfg = safeConfig();
+  if (!cfg) return;
+  const { serviceDeclined: _declined, ...rest } = cfg;
+  saveConfig({ ...rest, update: { auto: on } });
+}
+
 // src/terminal-status.ts
 async function readTerminalStatus(socket, timeoutMs = 1e3) {
   if (!socket) return emptyHeartbeatStatus();
@@ -14810,6 +15081,14 @@ async function waitForAcknowledgement(socket) {
 }
 
 // src/commands/start.ts
+var NO_SERVICE = {
+  installed: false,
+  platform: null,
+  state: "not installed",
+  pid: null,
+  node: null,
+  nodeOk: true
+};
 async function start(opts = {}, deps = {}) {
   setLogOverrides(opts);
   setConsoleLogging(false);
@@ -14923,7 +15202,11 @@ async function startScript(opts, deps) {
       if (service2.state !== "running" || service2.pid !== current.pid) mode = "existing";
     }
   }
-  const address = `${cfg.baseUrl.replace(/\/$/, "")}/settings/devices`;
+  const address = devicesUrl(cfg.baseUrl);
+  const container = containerHere() === true && containerWords(true, installed ? await serviceState() : NO_SERVICE, {
+    companion: runtime ? process.pid : running?.pid ?? null,
+    supervisedHere: runtime !== null && process.env.CABANE_COMPANION_SUPERVISED === "1"
+  });
   if (!daemon)
     for (const line of closingBlock({
       mode,
@@ -14933,6 +15216,7 @@ async function startScript(opts, deps) {
       service: installed,
       servicePlatform: servicePlatform(),
       autoUpdate: cfg.update?.auto !== false,
+      container,
       address
     }))
       write(line);
@@ -15124,7 +15408,7 @@ async function setupScript(opts, deps) {
       onCode: () => rememberPairAddress(baseUrl)
     });
     if (!device) return;
-    writePairedConfig(device);
+    writePairedConfig({ ...device, baseUrl: addressToKeep(baseUrl, device.baseUrl) });
     justPaired = true;
   }
   const detection = await start(
@@ -15324,210 +15608,6 @@ init_harness_copy();
 init_secrets();
 init_term();
 init_transcript_writer();
-
-// src/commands/service.ts
-init_cabane_command();
-init_config();
-init_term();
-
-// src/commands/stop.ts
-var TERM_GRACE_MS = 6e3;
-var POLL_INTERVAL_MS = 150;
-async function stop(deps = {}) {
-  if ((deps.serviceInstalled ?? serviceInstalled)()) {
-    const outcome = await (deps.stopService ?? stopService)();
-    for (const line of outcome.lines) process.stdout.write(`${line}
-`);
-    if (!outcome.ok) {
-      process.exitCode = 1;
-      return;
-    }
-    process.stdout.write(
-      "companion: stopped the service. It starts again at boot, or with `cabane start`.\n"
-    );
-    return;
-  }
-  const readState = deps.readState ?? readLiveRuntimeState;
-  const verify = deps.verify ?? ((s) => verifyRuntime(s));
-  const kill = deps.kill ?? ((pid2, signal) => process.kill(pid2, signal));
-  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? (() => Date.now());
-  const state = readState();
-  if (!state) {
-    process.stdout.write("companion: not running (nothing to stop).\n");
-    return;
-  }
-  if (await verify(state) === "stale") {
-    clearRuntimeState();
-    process.stdout.write("companion: not running (stale marker swept).\n");
-    return;
-  }
-  const { pid } = state;
-  process.stdout.write(`companion: stopping (pid ${pid})\u2026
-`);
-  try {
-    kill(pid, "SIGTERM");
-  } catch {
-    clearRuntimeState();
-    process.stdout.write("companion: already stopped.\n");
-    return;
-  }
-  const deadline = now() + TERM_GRACE_MS;
-  while (now() < deadline) {
-    if (!isAlive(kill, pid)) {
-      process.stdout.write("companion: stopped.\n");
-      return;
-    }
-    await sleep4(POLL_INTERVAL_MS);
-  }
-  process.stdout.write(
-    `companion: didn't exit within ${TERM_GRACE_MS / 1e3}s, sending SIGKILL.
-`
-  );
-  try {
-    kill(pid, "SIGKILL");
-  } catch {
-  }
-  clearRuntimeState();
-  process.stdout.write("companion: force-stopped.\n");
-}
-function isAlive(kill, pid) {
-  try {
-    kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/commands/service.ts
-var STARTUP_WAIT_MS = 2e4;
-async function installAndStartService(deps = {}) {
-  const readState = deps.readState ?? readLiveRuntimeState;
-  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const now = deps.now ?? Date.now;
-  const before = await serviceState(deps);
-  const running = readState();
-  if (running && running.pid !== before.pid) await (deps.stopRunning ?? (() => stop()))();
-  setRunsAsService(true);
-  const outcome = await installService(deps);
-  for (const line of outcome.lines) write(`${INDENT}${line}`);
-  if (!outcome.ok) {
-    setRunsAsService(false);
-    return false;
-  }
-  const deadline = now() + STARTUP_WAIT_MS;
-  while (now() < deadline) {
-    const state = readState();
-    if (state?.socket) return true;
-    await sleep4(250);
-  }
-  write(
-    `${INDENT}The service is installed but Cabane hasn't come up yet. ${cabane("service status")} and ${cabane("logs")} say why.`
-  );
-  return false;
-}
-async function serviceInstall(deps = {}) {
-  if (!await installAndStartService(deps)) {
-    process.exitCode = 1;
-    return;
-  }
-  write(
-    INDENT + tick(
-      "Cabane runs as a service. It starts at boot, restarts if it stops, and updates itself, usually between turns."
-    )
-  );
-  write(`${INDENT}  Status:  ${cabane("service status")}        Logs:  ${cabane("logs")}`);
-}
-async function serviceUninstall(deps = {}) {
-  const outcome = await uninstallService(deps);
-  for (const line of outcome.lines) write(`${INDENT}${line}`);
-  if (outcome.lines.length > 0) return;
-  setRunsAsService(false);
-  write(
-    INDENT + tick("Removed the service. Cabane won't start at boot, and it isn't running now.")
-  );
-  write(`${INDENT}  Start it again with  ${cabane("start")}`);
-}
-async function serviceStatus(deps = {}) {
-  const state = await serviceState(deps);
-  for (const line of serviceRows(state)) write(line);
-  for (const line of updateRows(readUpdateState(), safeConfig()?.update?.auto, {
-    service: state.installed
-  }))
-    write(line);
-  if (state.installed && state.state !== "running") process.exitCode = 1;
-}
-var LABEL_WIDTH = 13;
-var row = (label, value) => `  ${label.padEnd(LABEL_WIDTH)}${value}`;
-function serviceRows(state) {
-  if (!state.installed) {
-    return [
-      row(
-        "Service",
-        state.platform ? `not installed \u2014 ${cabane("service install")} starts Cabane at boot` : "not available on this system"
-      )
-    ];
-  }
-  const via = state.platform === "systemd" ? "systemd" : "launchd";
-  const rows = [
-    row(
-      "Service",
-      state.state === "running" ? `running (${via}${state.pid ? `, pid ${state.pid}` : ""})` : `installed, not running (${via}: ${state.state})`
-    )
-  ];
-  if (!state.nodeOk) {
-    rows.push(
-      `  ! The service's Node at ${tildePath(state.node ?? "")} is gone. Run  ${cabane("service install")}  again.`
-    );
-  }
-  return rows;
-}
-function updateRows(state, auto, opts = {}) {
-  const rows = [];
-  if (opts.version !== false) rows.push(row("Version", COMPANION_VERSION));
-  if (state.server) {
-    rows.push(
-      row(
-        "Cabane wants",
-        `${state.server.latest} (the latest), ${state.server.minimum} or newer to run turns`
-      )
-    );
-  }
-  rows.push(
-    row(
-      "Auto-update",
-      !opts.service ? `off \u2014 runs with the service: ${cabane("service install")}` : auto === true ? "on \u2014 updates install between turns when they can, and roll back if they fail" : `off \u2014 ${cabane("update --auto on")} turns it on`
-    )
-  );
-  const last = state.lastResult;
-  if (last) {
-    const when = new Date(last.at).toLocaleDateString("en-GB", { day: "numeric", month: "short" });
-    const why = last.reason ? `: ${last.reason}` : "";
-    rows.push(
-      row(
-        "Last update",
-        last.kind === "updated" ? `${last.from} \u2192 ${last.to} on ${when}` : last.kind === "rolled_back" ? `${last.to} rolled back to ${last.from} on ${when}${why}` : `${last.to} failed on ${when}${why}`
-      )
-    );
-  }
-  return rows;
-}
-function safeConfig() {
-  try {
-    return loadConfig();
-  } catch {
-    return null;
-  }
-}
-function setRunsAsService(on) {
-  const cfg = safeConfig();
-  if (!cfg) return;
-  const { serviceDeclined: _declined, ...rest } = cfg;
-  saveConfig({ ...rest, update: { auto: on } });
-}
-
-// src/commands/status.ts
 var LABEL_WIDTH2 = 13;
 function row2(label, value) {
   return `  ${label.padEnd(LABEL_WIDTH2)}${value}`;
@@ -15571,15 +15651,19 @@ async function status(deps = {}) {
       deviceLine({
         ...await readTerminalStatus(running?.socket),
         running: !!running,
-        devicesUrl: `${cfg.baseUrl.replace(/\/$/, "")}/settings/devices`
+        devicesUrl: devicesUrl(cfg.baseUrl)
       })
     )
   );
   for (const line of strays) out(line);
-  for (const line of serviceRows(service2)) out(line);
+  const container = containerWords(containerHere() === true, service2, {
+    companion: running?.pid ?? null
+  });
+  for (const line of serviceRows(service2, { container })) out(line);
   for (const line of updateRows(readUpdateState(), cfg.update?.auto, {
     version: false,
-    service: service2.installed
+    service: service2.installed,
+    container
   }))
     out(line);
   for (const line of await agentLines2(cfg, detection)) out(line);
@@ -15713,7 +15797,7 @@ async function update(opts = {}) {
     const auto = opts.auto === "on";
     if (auto && !serviceInstalled()) {
       write(
-        `${INDENT}Cabane updates itself only when it runs as a service. Run  ${cabane("service install")}  to run it as one, with updates on.`
+        containerHere() === true ? `${INDENT}Cabane doesn't update itself in a container. To update it, replace the container with a newer image.` : `${INDENT}Cabane updates itself only when it runs as a service. Run  ${cabane("service install")}  to run it as one, with updates on.`
       );
       process.exitCode = 1;
       return;

package/dist/launch.js

@@ -45,7 +45,8 @@ import { dirname as dirname3, isAbsolute, join as join4 } from "path";
 import { z as z2 } from "zod";
 
 // src/pairing.ts
-function isAllowedBaseUrl(raw) {
+var ALLOW_PLAIN_HTTP_HOST_ENV = "CABANE_ALLOW_PLAIN_HTTP_HOST";
+function isAllowedBaseUrl(raw, env = process.env) {
   let url;
   try {
     url = new URL(raw);
@@ -55,10 +56,41 @@ function isAllowedBaseUrl(raw) {
   if (url.protocol === "https:") return true;
   if (url.protocol === "http:") {
     const host = url.hostname.toLowerCase();
-    return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+    if (host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+      return true;
+    const allowed = plainHttpHost(env);
+    return allowed !== null && host === allowed;
   }
   return false;
 }
+function plainHttpHost(env = process.env) {
+  const raw = env[ALLOW_PLAIN_HTTP_HOST_ENV]?.trim().toLowerCase();
+  if (!raw) return null;
+  if (isSingleLabel(raw) || isPrivateIpv4(raw)) return raw;
+  const bare = raw.startsWith("[") && raw.endsWith("]") ? raw.slice(1, -1) : raw;
+  return privateIpv6(bare);
+}
+function isSingleLabel(host) {
+  return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(host) && !/^\d+$/.test(host);
+}
+function isPrivateIpv4(host) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return false;
+  const [a, b, c, d] = m.slice(1).map(Number);
+  if ([a, b, c, d].some((n) => n > 255)) return false;
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+function privateIpv6(host) {
+  if (!host.includes(":")) return null;
+  let bracketed;
+  try {
+    bracketed = new URL(`http://[${host}]/`).hostname;
+  } catch {
+    return null;
+  }
+  const first = Number.parseInt(bracketed.slice(1).split(":")[0] || "0", 16);
+  return (first & 65024) === 64512 ? bracketed : null;
+}
 
 // src/prepare-hook.ts
 import { spawn } from "child_process";
@@ -121,10 +153,10 @@ function isRootPath(value) {
   return isAbsolute(value) || value === "~" || value.startsWith("~/");
 }
 var companionConfigSchema = z2.object({
-  // https-enforced (loopback exempt), so a hand-edited config can't put the
-  // device token and prompt on a plaintext channel.
-  baseUrl: z2.string().url().refine(isAllowedBaseUrl, {
-    message: "baseUrl must be https (loopback http is allowed for local dev only)"
+  // https-enforced (loopback, and the one private host a person names, exempt), so a
+  // hand-edited config can't put the device token and prompt on a plaintext channel.
+  baseUrl: z2.string().url().refine((url) => isAllowedBaseUrl(url), {
+    message: `baseUrl must be https (plain http only to this machine, or to the private host ${ALLOW_PLAIN_HTTP_HOST_ENV} names)`
   }),
   // The `cabdev_` device token plaintext — the companion's one durable credential,
   // presented as `Authorization: Bearer <token>` on the device-facing pull +

package/dist/postinstall.js

@@ -92,7 +92,8 @@ var ConfigError = class extends CompanionError {
 };
 
 // src/pairing.ts
-function isAllowedBaseUrl(raw) {
+var ALLOW_PLAIN_HTTP_HOST_ENV = "CABANE_ALLOW_PLAIN_HTTP_HOST";
+function isAllowedBaseUrl(raw, env = process.env) {
   let url;
   try {
     url = new URL(raw);
@@ -102,10 +103,41 @@ function isAllowedBaseUrl(raw) {
   if (url.protocol === "https:") return true;
   if (url.protocol === "http:") {
     const host = url.hostname.toLowerCase();
-    return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+    if (host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+      return true;
+    const allowed = plainHttpHost(env);
+    return allowed !== null && host === allowed;
   }
   return false;
 }
+function plainHttpHost(env = process.env) {
+  const raw = env[ALLOW_PLAIN_HTTP_HOST_ENV]?.trim().toLowerCase();
+  if (!raw) return null;
+  if (isSingleLabel(raw) || isPrivateIpv4(raw)) return raw;
+  const bare = raw.startsWith("[") && raw.endsWith("]") ? raw.slice(1, -1) : raw;
+  return privateIpv6(bare);
+}
+function isSingleLabel(host) {
+  return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(host) && !/^\d+$/.test(host);
+}
+function isPrivateIpv4(host) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return false;
+  const [a, b, c, d] = m.slice(1).map(Number);
+  if ([a, b, c, d].some((n) => n > 255)) return false;
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+function privateIpv6(host) {
+  if (!host.includes(":")) return null;
+  let bracketed;
+  try {
+    bracketed = new URL(`http://[${host}]/`).hostname;
+  } catch {
+    return null;
+  }
+  const first = Number.parseInt(bracketed.slice(1).split(":")[0] || "0", 16);
+  return (first & 65024) === 64512 ? bracketed : null;
+}
 
 // src/prepare-hook.ts
 import { spawn } from "child_process";
@@ -171,10 +203,10 @@ function isRootPath(value) {
   return isAbsolute(value) || value === "~" || value.startsWith("~/");
 }
 var companionConfigSchema = z2.object({
-  // https-enforced (loopback exempt), so a hand-edited config can't put the
-  // device token and prompt on a plaintext channel.
-  baseUrl: z2.string().url().refine(isAllowedBaseUrl, {
-    message: "baseUrl must be https (loopback http is allowed for local dev only)"
+  // https-enforced (loopback, and the one private host a person names, exempt), so a
+  // hand-edited config can't put the device token and prompt on a plaintext channel.
+  baseUrl: z2.string().url().refine((url) => isAllowedBaseUrl(url), {
+    message: `baseUrl must be https (plain http only to this machine, or to the private host ${ALLOW_PLAIN_HTTP_HOST_ENV} names)`
   }),
   // The `cabdev_` device token plaintext — the companion's one durable credential,
   // presented as `Authorization: Bearer <token>` on the device-facing pull +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.238",
+  "version": "0.6.240",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",