@camstack/system 1.2.116 → 1.2.118

package/dist/builtins/local-network/local-network.addon.js

@@ -1,11 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
-const require_lan_http_bind = require("../../lan-http-bind-CZ4EBeD_.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
+const require_lan_http_bind = require("../../lan-http-bind-DmgpFP6_.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
 let node_net = require("node:net");
 //#region src/builtins/local-network/local-hostname.ts
 var DNS_NAME = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])$/;
@@ -41,6 +42,111 @@ function parseLocalHostname(raw) {
 	};
 }
 //#endregion
+//#region src/builtins/local-network/ipv6-lan.ts
+/**
+* IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
+* rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
+* that keeps temporary GUA off the connection candidate list.
+*/
+var IFA_F_TEMPORARY = 1;
+var IFA_F_DEPRECATED = 32;
+var IFA_F_TENTATIVE = 64;
+/** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
+function ipv6Prefix64Key(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.slice(0, 4).map((g) => g.toString(16).padStart(4, "0")).join(":");
+}
+/** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
+function ipv6ToHex32(address) {
+	const groups = parseIpv6Groups(address);
+	if (groups === null) return null;
+	return groups.map((g) => g.toString(16).padStart(4, "0")).join("");
+}
+/**
+* Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+* are skipped. Keys match {@link ipv6ToHex32}.
+*/
+function parseProcIfInet6(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed === "") continue;
+		const parts = trimmed.split(/\s+/);
+		const hex = parts[0]?.toLowerCase();
+		const flagsRaw = parts[4];
+		if (!hex || hex.length !== 32 || flagsRaw === void 0) continue;
+		const flags = Number.parseInt(flagsRaw, 16);
+		if (!Number.isFinite(flags)) continue;
+		out.set(hex, flags);
+	}
+	return out;
+}
+/**
+* Whether this IPv6 should be auto-seeded / advertised.
+* `flags === undefined` means the platform did not tell us (macOS, tests
+* without a proc snapshot) — keep every non-link-local plausible address.
+*
+* On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+* `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+* (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+* stateful DHCPv6 GUA often has only NODAD (0x02).
+*/
+function shouldAdvertiseIpv6(address, flags) {
+	const a = address.toLowerCase().split("%")[0] ?? address;
+	if (a === "::" || a === "::1") return false;
+	if (a.startsWith("fe80:")) return false;
+	if (a.startsWith("ff")) return false;
+	if (flags === void 0) return true;
+	if ((flags & IFA_F_TEMPORARY) !== 0) return false;
+	if ((flags & IFA_F_DEPRECATED) !== 0) return false;
+	if ((flags & IFA_F_TENTATIVE) !== 0) return false;
+	if (flags === 0) return false;
+	return true;
+}
+function ipv6AllowlistMatches(address, allowed) {
+	if (allowed.includes(address)) return true;
+	const key = ipv6Prefix64Key(address);
+	if (key === null) return false;
+	for (const entry of allowed) {
+		if (!entry.includes(":")) continue;
+		if (ipv6Prefix64Key(entry) === key) return true;
+	}
+	return false;
+}
+function parseIpv6Groups(address) {
+	const raw = address.toLowerCase().split("%")[0];
+	if (!raw || raw.includes(".")) return null;
+	const sides = raw.split("::");
+	if (sides.length > 2) return null;
+	const parsePart = (part) => {
+		if (part === void 0 || part === "") return [];
+		const groups = part.split(":");
+		const out = [];
+		for (const g of groups) {
+			if (g === "") return null;
+			if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+			out.push(Number.parseInt(g, 16));
+		}
+		return out;
+	};
+	if (sides.length === 1) {
+		const groups = parsePart(sides[0]);
+		if (groups === null || groups.length !== 8) return null;
+		return groups;
+	}
+	const left = parsePart(sides[0]);
+	const right = parsePart(sides[1]);
+	if (left === null || right === null) return null;
+	const fill = 8 - left.length - right.length;
+	if (fill < 0) return null;
+	return [
+		...left,
+		...Array(fill).fill(0),
+		...right
+	];
+}
+//#endregion
 //#region src/builtins/local-network/local-network.addon.ts
 /**
 * local-network — hub-only system cap implementation.
@@ -66,6 +172,8 @@ function parseLocalHostname(raw) {
 */
 var MESH_PROVIDER_ADDON_IDS = ["tailscale-client"];
 var POLL_INTERVAL_MS = 3e4;
+/** Drop rotated IPv6 / dead extras from the persisted allowlist. */
+var ALLOWLIST_RECONCILE_INTERVAL_MS = 3600 * 1e3;
 /**
 * Compiled-in boot default — mirrors `CONFIG_DEFAULTS.server.port` in
 * `server/backend/src/boot/boot-config.ts`. Used only when neither the live
@@ -74,6 +182,8 @@ var POLL_INTERVAL_MS = 3e4;
 var DEFAULT_HUB_PORT = 4443;
 var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	pollTimer = null;
+	allowlistTimer = null;
+	allowlistReconcilePending = false;
 	lastSnapshotKey = "";
 	/** Optional public hostname tracked from `NetworkTunnelStarted`/
 	*  `Stopped` events on the bus. */
@@ -90,6 +200,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			allowedAddresses: [],
 			bootSeeded: false,
 			notificationBaseUrl: "",
+			viewerBaseUrls: [],
 			httpEnabled: true,
 			httpPort: require_lan_http_bind.DEFAULT_LAN_HTTP_PORT,
 			localHostname: ""
@@ -110,6 +221,31 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		if (mesh !== null && mesh.host !== "") return `https://${mesh.host}:${mesh.port}`;
 		return null;
 	}
+	async snapshotViewerEndpoints() {
+		const selected = selectViewerEndpoints(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.config.viewerBaseUrls);
+		return {
+			baseUrls: this.config.viewerBaseUrls,
+			resolved: selected.map((e) => e.baseUrl)
+		};
+	}
+	/**
+	* Palette shown in the Network tab: LAN IPv4, stable LAN IPv6, public,
+	* mesh. The viewer HTTP/WS race is a subset (`selectViewerEndpoints`) —
+	* IPv6 stays in this list because ICE/WebRTC gathers it regardless.
+	*/
+	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
+		const allow = this.config.allowedAddresses;
+		const interfaces = applyAllowlist(this.enumerate(), allow);
+		await this.reconcileMeshEndpoint();
+		const httpState = require_lan_http_bind.readLanHttpState();
+		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
+			enabled: this.config.httpEnabled !== false,
+			listening: httpState.listening,
+			httpPort: this.resolvedHttpPort(),
+			httpsPort,
+			localHostname: this.config.localHostname || null
+		});
+	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
 			const seed = autoSeedAllowlist(this.enumerate());
@@ -119,6 +255,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			});
 			this.ctx.logger.info("local-network: first-boot auto-seed", { meta: { addresses: seed } });
 		}
+		await this.persistReconciledAllowlist();
 		const provider = {
 			list: async () => ({
 				interfaces: this.enumerate(),
@@ -126,27 +263,16 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			}),
 			getPreferred: async () => pickPreferred(applyAllowlist(this.enumerate(), this.config.allowedAddresses)),
 			getConnectionEndpoints: async (input) => {
-				const includeLoopback = input.includeLoopback ?? true;
-				const ipv4Only = input.ipv4Only ?? false;
+				const includeLoopback = input.includeLoopback ?? false;
 				const scheme = input.scheme ?? "http";
-				const allow = this.config.allowedAddresses;
-				const interfaces = applyAllowlist(this.enumerate(), allow);
 				const localPort = await this.resolveAdvertisedListenPort(input.port ?? null);
 				if (input.port !== void 0 && input.port !== localPort.port) this.ctx.logger.info("local-network: caller port hint overridden", { meta: {
 					hint: input.port,
 					advertised: localPort.port,
 					source: localPort.source
 				} });
-				await this.reconcileMeshEndpoint();
-				const httpState = require_lan_http_bind.readLanHttpState();
 				return {
-					endpoints: buildEndpoints(interfaces, localPort.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
-						enabled: this.config.httpEnabled !== false,
-						listening: httpState.listening,
-						httpPort: this.resolvedHttpPort(),
-						httpsPort: localPort.port,
-						localHostname: this.config.localHostname || null
-					}),
+					endpoints: await this.buildAdvertisedEndpoints(includeLoopback, input.ipv4Only ?? false, scheme, localPort.port),
 					localPort
 				};
 			},
@@ -162,6 +288,16 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					resolved: this.resolveNotificationEndpoint()
 				};
 			},
+			getViewerEndpoints: async () => this.snapshotViewerEndpoints(),
+			setViewerEndpoints: async ({ baseUrls }) => {
+				const cleaned = [...new Set(baseUrls.filter((u) => u.length > 0))];
+				await this.updateGlobalSettings({ viewerBaseUrls: cleaned });
+				this.ctx.logger.info("local-network: viewer endpoints set", { meta: {
+					count: cleaned.length,
+					auto: cleaned.length === 0
+				} });
+				return this.snapshotViewerEndpoints();
+			},
 			getAllowedAddresses: async () => ({ addresses: this.config.allowedAddresses }),
 			resetAllowlistToBestMatch: async () => {
 				const seed = autoSeedAllowlist(this.enumerate());
@@ -213,6 +349,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		this.lastSnapshotKey = snapshotKey(this.enumerate());
 		this.pollTimer = setInterval(() => this.detectChanges(), POLL_INTERVAL_MS);
 		this.pollTimer.unref?.();
+		this.allowlistTimer = setInterval(() => {
+			this.persistReconciledAllowlist();
+		}, ALLOWLIST_RECONCILE_INTERVAL_MS);
+		this.allowlistTimer.unref?.();
 		this.ctx.eventBus?.subscribe({ category: require_dist.EventCategory.NetworkTunnelStarted }, (event) => {
 			const data = event.data ?? {};
 			if (typeof data.url === "string") try {
@@ -288,6 +428,10 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			clearInterval(this.pollTimer);
 			this.pollTimer = null;
 		}
+		if (this.allowlistTimer) {
+			clearInterval(this.allowlistTimer);
+			this.allowlistTimer = null;
+		}
 	}
 	/**
 	* Other hub addons (e.g. cloudflare-tunnel) signal the active public
@@ -421,7 +565,26 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(node_os.networkInterfaces());
+		return enumerateOsInterfaces(node_os.networkInterfaces(), readLinuxIpv6Flags());
+	}
+	/**
+	* Replace rotated IPv6 and drop addresses that no longer exist, without
+	* clearing operator extras that are still live (docker/vpn opt-in).
+	*/
+	async persistReconciledAllowlist(interfaces = this.enumerate()) {
+		if (this.allowlistReconcilePending) return;
+		this.allowlistReconcilePending = true;
+		try {
+			const next = reconcileAllowlist(this.config.allowedAddresses, interfaces);
+			if (sameAddressSet(this.config.allowedAddresses, next)) return;
+			await this.updateGlobalSettings({
+				allowedAddresses: next,
+				bootSeeded: true
+			});
+			this.ctx.logger.info("local-network: allowlist reconciled", { meta: { addresses: next } });
+		} finally {
+			this.allowlistReconcilePending = false;
+		}
 	}
 	detectChanges() {
 		const interfaces = this.enumerate();
@@ -432,6 +595,7 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			key
 		} });
 		this.lastSnapshotKey = key;
+		this.persistReconciledAllowlist(interfaces);
 		this.ctx.eventBus?.emit({
 			id: `local-network-changed-${Date.now()}`,
 			timestamp: /* @__PURE__ */ new Date(),
@@ -480,7 +644,7 @@ function validPort(value) {
 	if (value === null) return null;
 	return Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
 }
-function enumerateOsInterfaces(ifaces) {
+function enumerateOsInterfaces(ifaces, ipv6Flags) {
 	const raw = [];
 	for (const [name, addrs] of Object.entries(ifaces)) {
 		if (!addrs) continue;
@@ -500,8 +664,12 @@ function enumerateOsInterfaces(ifaces) {
 	const classified = raw.map((r) => {
 		const kind = classifyKind(r.name, r.address, r.internal);
 		const reachableKind = kind === "lan" || kind === "wifi";
-		const plausible = !r.internal && reachableKind && isPlausibleAutoSeed(r.address, r.family);
-		const plausibleReason = plausible ? "" : explainNonPlausible({
+		const hex = r.family === "IPv6" ? ipv6ToHex32(r.address) : null;
+		const flags = hex !== null ? ipv6Flags?.get(hex) : void 0;
+		const rangeOk = isPlausibleAutoSeed(r.address, r.family);
+		const stableV6 = r.family !== "IPv6" || shouldAdvertiseIpv6(r.address, flags);
+		const plausible = !r.internal && reachableKind && rangeOk && stableV6;
+		const plausibleReason = plausible ? "" : r.family === "IPv6" && rangeOk && !stableV6 ? "IPv6 temporary / privacy address — rotates and is not advertised." : explainNonPlausible({
 			kind,
 			family: r.family,
 			address: r.address,
@@ -530,13 +698,14 @@ function enumerateOsInterfaces(ifaces) {
 /**
 * Filter the interface list by the operator's allowlist. Empty
 * allowlist = no-op (every interface passes); otherwise only entries
-* whose `address` matches an allowlist entry remain. Loopback always
-* survives so the SDK keeps `127.0.0.1` as the last-resort fallback.
+* whose `address` matches an allowlist entry remain. IPv6 matches the
+* allowlisted /64 so a rotated privacy address does not hide the live
+* GUA. Loopback is not an advertised client route and is not forced
+* through.
 */
 function applyAllowlist(interfaces, allowed) {
 	if (allowed.length === 0) return interfaces;
-	const set = new Set(allowed);
-	return interfaces.filter((i) => i.kind === "loopback" || set.has(i.address));
+	return interfaces.filter((i) => ipv6AllowlistMatches(i.address, allowed) || allowed.includes(i.address));
 }
 /**
 * Rank interfaces and pick the auto-selected outbound one. See the
@@ -595,6 +764,13 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		if (iface.address.startsWith("169.254.")) continue;
 		emit(iface, "lan-ipv4", `${formatKind(iface.kind)} — ${iface.name}`, `${lanScheme}://${iface.address}:${lanPort}`, 10 + priority++);
 	}
+	if (!ipv4Only) for (const iface of interfaces) {
+		if (iface.internal || iface.family !== "IPv6") continue;
+		if (iface.kind === "loopback") continue;
+		if (iface.address.toLowerCase().startsWith("fe80:")) continue;
+		if (!iface.plausible) continue;
+		emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, 10 + priority++);
+	}
 	if (publicHostname) out.push({
 		label: "Public tunnel",
 		baseUrl: `https://${publicHostname}`,
@@ -613,15 +789,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 		plausibleReason: "",
 		priority: 150
 	});
-	if (!ipv4Only) {
-		let v6prio = 200;
-		for (const iface of interfaces) {
-			if (iface.internal || iface.family !== "IPv6") continue;
-			if (iface.kind === "loopback") continue;
-			if (iface.address.startsWith("fe80:")) continue;
-			emit(iface, "lan-ipv6", `${formatKind(iface.kind)} — ${iface.name} (IPv6)`, `${lanScheme}://[${iface.address}]:${lanPort}`, v6prio++);
-		}
-	}
 	if (includeLoopback) out.push({
 		label: "Loopback",
 		baseUrl: `${scheme}://127.0.0.1:${port}`,
@@ -633,22 +800,39 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 	});
 	return out.toSorted((a, b) => a.priority - b.priority);
 }
+/** AUTO viewer race: LAN IPv4 + the public tunnel. Never IPv6, mesh, or loopback. */
+function isDefaultViewerEndpoint(endpoint) {
+	if (endpoint.kind === "lan-ipv4") return true;
+	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
+}
+/**
+* The URLs the SDK should race for API / viewer access.
+*
+* Empty `viewerBaseUrls` = AUTO (IPv4 + public tunnel). A non-empty list is
+* the operator's pin; if none of those URLs are in the current palette,
+* fall back to AUTO rather than racing an empty set.
+*/
+function selectViewerEndpoints(endpoints, viewerBaseUrls) {
+	const auto = endpoints.filter(isDefaultViewerEndpoint);
+	if (viewerBaseUrls.length === 0) return auto;
+	const wanted = new Set(viewerBaseUrls);
+	const explicit = endpoints.filter((e) => wanted.has(e.baseUrl));
+	return explicit.length > 0 ? explicit : auto;
+}
 /**
 * First-boot heuristic: which addresses should the allowlist start
 * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:
 *
 *   - **IPv4**: skip link-local (`169.254.*`), keep the rest.
 *   - **IPv6**: skip link-local (`fe80::*`), unspecified, and
-*     multicast. Keep ULAs (`fc00::/7` → `fc??:` / `fd??:`) and Global
-*     Unicast addresses (`2000::/3` → `2???`/`3???`). Privacy-extension
-*     temporary addresses get included by default; the operator can
-*     prune them from the Network Addresses tab if the rotating IPs
-*     become a nuisance.
+*     multicast. Keep ULAs (`fc00::/7`) and Global Unicast (`2000::/3`).
+*     Privacy-extension temporary addresses are skipped when Linux flags
+*     mark them non-permanent (`plausible === false`).
 *
 * Skips docker/vpn/loopback/other entirely — those stay opt-in.
 */
 function autoSeedAllowlist(interfaces) {
-	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family)).map((i) => i.address))];
+	return [...new Set(interfaces.filter((i) => !i.internal && (i.kind === "lan" || i.kind === "wifi") && isPlausibleAutoSeed(i.address, i.family) && (i.family !== "IPv6" || i.plausible)).map((i) => i.address))];
 }
 /**
 * Per-interface tooltip text surfaced on the "Unlikely usable" badge.
@@ -737,7 +921,33 @@ function formatKind(kind) {
 		case "other": return "Other";
 	}
 }
+/**
+* Rewrite a persisted allowlist against the live interface set:
+* current auto-seed (LAN/Wi-Fi, stable IPv6) plus still-live operator
+* extras (docker/vpn). Empty stays empty — that is "unrestricted".
+*/
+function reconcileAllowlist(current, interfaces) {
+	if (current.length === 0) return [];
+	const live = new Set(interfaces.map((i) => i.address));
+	const seed = autoSeedAllowlist(interfaces);
+	const seedSet = new Set(seed);
+	const extras = current.filter((a) => live.has(a) && !seedSet.has(a) && !a.includes(":"));
+	return [...new Set([...seed, ...extras])];
+}
+function sameAddressSet(a, b) {
+	if (a.length !== b.length) return false;
+	const set = new Set(a);
+	return b.every((addr) => set.has(addr));
+}
+function readLinuxIpv6Flags() {
+	try {
+		return parseProcIfInet6((0, node_fs.readFileSync)("/proc/net/if_inet6", "utf8"));
+	} catch {
+		return;
+	}
+}
 //#endregion
+exports.ALLOWLIST_RECONCILE_INTERVAL_MS = ALLOWLIST_RECONCILE_INTERVAL_MS;
 exports.LocalNetworkAddon = LocalNetworkAddon;
 exports.applyAllowlist = applyAllowlist;
 exports.autoSeedAllowlist = autoSeedAllowlist;
@@ -745,7 +955,13 @@ exports.buildEndpoints = buildEndpoints;
 exports.classifyKind = classifyKind;
 exports.enumerateOsInterfaces = enumerateOsInterfaces;
 exports.explainNonPlausible = explainNonPlausible;
+exports.ipv6Prefix64Key = ipv6Prefix64Key;
+exports.isDefaultViewerEndpoint = isDefaultViewerEndpoint;
 exports.isPlausibleAutoSeed = isPlausibleAutoSeed;
+exports.parseProcIfInet6 = parseProcIfInet6;
 exports.pickPreferred = pickPreferred;
 exports.prefixLen = prefixLen;
+exports.reconcileAllowlist = reconcileAllowlist;
 exports.resolveAdvertisedPort = resolveAdvertisedPort;
+exports.selectViewerEndpoints = selectViewerEndpoints;
+exports.shouldAdvertiseIpv6 = shouldAdvertiseIpv6;