@clearlysh/beehaven 0.8.16

package/dist/daemon-codex.js

@@ -0,0 +1,349 @@
+/**
+ * Daemon-side Codex — OpenAI Codex SDK integration, sibling of daemon-omni.
+ *
+ * The "treehouse" architecture: one daemon process hosts multiple AI
+ * agent SDKs in parallel, each as its own module with the same shape:
+ *   • daemon-omni.ts     → @anthropic-ai/claude-agent-sdk (Claude)
+ *   • daemon-codex.ts    → @openai/codex-sdk             (GPT/Codex)
+ *   • daemon-gemini-cli  → @google/gemini-cli-core       (planned)
+ *
+ * Each emits the SAME event shapes (agent:text-delta, agent:tool-call,
+ * agent:tool-result, agent:done) so the FAB renderer doesn't need a
+ * per-provider code path.
+ *
+ * IPC verbs the daemon exposes:
+ *   codex:prompt   { prompt, sessionId, model?, workingDir? }
+ *   codex:end      { sessionId }
+ *   codex:sessions {}
+ *
+ * Codex SDK shape (v0.130):
+ *   const codex = new Codex({ apiKey? });
+ *   const thread = codex.startThread({ model?, workingDirectory? });
+ *   const stream = thread.runStreamed(prompt);
+ *   for await (const event of stream.events) { ... }
+ *
+ * Auth:
+ *   Reads OPENAI_API_KEY from process.env. If absent, the SDK refuses
+ *   to start. Future: per-user BYOK via daemon settings.
+ */
+const sessions = new Map();
+const subscribers = new Set();
+// Lazy SDK instance — keeps the Codex client warm across sessions in
+// the same daemon process. Constructed on first session start.
+let _codex = null;
+// ── Safety knobs (parity with daemon-omni — audit task #64) ──────────
+/** Default max prompts queued per session before promptCodex rejects. */
+const DEFAULT_MAX_QUEUED_PROMPTS = 20;
+/** Idle-session reaper: a Codex session held in memory after the user
+ *  stops using it leaks a Thread object (which the SDK may keep TCP
+ *  connections / file descriptors warm for). Reaper sweeps every minute
+ *  and ends sessions idle longer than the timeout. The Codex SDK's
+ *  thread store survives — next promptCodex resumes via resumeThreadId. */
+const IDLE_TIMEOUT_MS = (() => {
+    const env = process.env.BEEHAVEN_CODEX_IDLE_TIMEOUT_MS;
+    if (env != null) {
+        const n = Number(env);
+        if (Number.isFinite(n) && n >= 0)
+            return n;
+    }
+    return 30 * 60_000; // 30 min default — matches Omni
+})();
+const CLEANUP_INTERVAL_MS = 60_000;
+let cleanupTimer = null;
+function reapIdleSessions() {
+    if (IDLE_TIMEOUT_MS === 0)
+        return 0;
+    const now = Date.now();
+    let reaped = 0;
+    for (const [id, sess] of sessions) {
+        if (sess.turnInFlight)
+            continue; // never reap mid-turn
+        if (sess.queuedPrompts.length > 0)
+            continue; // pending work
+        if (now - sess.lastActivityAt > IDLE_TIMEOUT_MS) {
+            endSession(id);
+            reaped++;
+        }
+    }
+    return reaped;
+}
+function ensureCleanupTimer() {
+    if (cleanupTimer)
+        return;
+    if (IDLE_TIMEOUT_MS === 0)
+        return;
+    cleanupTimer = setInterval(() => {
+        const reaped = reapIdleSessions();
+        if (reaped > 0) {
+            // eslint-disable-next-line no-console
+            console.log(`[codex] reaped ${reaped} idle session(s); ${sessions.size} remain`);
+        }
+    }, CLEANUP_INTERVAL_MS);
+    if (typeof cleanupTimer?.unref === 'function')
+        cleanupTimer.unref();
+}
+// ── Subscriber API ───────────────────────────────────────────────────
+export function subscribe(fn) {
+    subscribers.add(fn);
+    return () => subscribers.delete(fn);
+}
+function emit(event) {
+    for (const fn of subscribers) {
+        try {
+            fn(event);
+        }
+        catch { /* subscriber errors don't sink the loop */ }
+    }
+}
+async function getOrCreateCodex() {
+    if (_codex)
+        return _codex;
+    const mod = await import('@openai/codex-sdk');
+    _codex = new mod.Codex();
+    return _codex;
+}
+async function getOrCreateSession(opts) {
+    const existing = sessions.get(opts.sessionId);
+    if (existing)
+        return existing;
+    const now = Date.now();
+    const session = {
+        sessionId: opts.sessionId,
+        userId: opts.userId,
+        thread: null,
+        threadId: opts.resumeThreadId ?? null,
+        ended: false,
+        turnIndex: 0,
+        startedAt: now,
+        currentText: '',
+        turnInFlight: false,
+        queuedPrompts: [],
+        lastActivityAt: now,
+        maxQueuedPrompts: opts.maxQueuedPrompts ?? DEFAULT_MAX_QUEUED_PROMPTS,
+    };
+    sessions.set(opts.sessionId, session);
+    ensureCleanupTimer();
+    const codex = await getOrCreateCodex();
+    // Resolve working directory (#103): if compositionId is set, use the
+    // composition's scratch dir — same as Claude's FAB session. Codex
+    // and Claude operating in the same directory is the basis of the
+    // handoff pattern (Claude writes plan.md, Codex reads + implements).
+    // Explicit workingDir overrides; otherwise compositionId wins;
+    // otherwise SDK default.
+    let workingDirectory;
+    if (opts.workingDir) {
+        workingDirectory = opts.workingDir;
+    }
+    else if (opts.compositionId) {
+        const { homedir } = await import('os');
+        const { join } = await import('path');
+        const { existsSync, mkdirSync } = await import('fs');
+        workingDirectory = join(homedir(), '.clearly', 'compositions', opts.compositionId);
+        try {
+            if (!existsSync(workingDirectory))
+                mkdirSync(workingDirectory, { recursive: true });
+        }
+        catch { /* fall through — Codex will fail with a clearer error */ }
+    }
+    // `skipGitRepoCheck`: Codex defaults to requiring a Git repo for the
+    // working directory (refuses to start otherwise). Composition dirs
+    // aren't git repos by default, so we disable the check.
+    session.thread = opts.resumeThreadId
+        ? codex.resumeThread(opts.resumeThreadId)
+        : codex.startThread({
+            ...(opts.model ? { model: opts.model } : {}),
+            ...(workingDirectory ? { workingDirectory } : {}),
+            skipGitRepoCheck: true,
+        });
+    return session;
+}
+/**
+ * Run a single Codex turn — the SDK's runStreamed returns an iterable
+ * of typed events; we re-shape each into our CodexEvent union and emit.
+ *
+ * Codex's event taxonomy (per SDK 0.130):
+ *   • item.completed → text chunks (kind: 'agent_message')
+ *   • item.completed → tool calls/results (kind: 'command_execution')
+ *   • turn.completed → end of turn marker
+ *   • thread.started → session id update
+ *   • error → fail the turn
+ *
+ * We translate these to the same {agent:text-delta, agent:tool-call,
+ * agent:tool-result, agent:done} the FAB already speaks for Claude.
+ */
+async function runTurn(session, prompt) {
+    if (session.ended)
+        return;
+    if (!session.thread) {
+        throw new Error('Codex session not initialized');
+    }
+    session.turnInFlight = true;
+    session.currentText = '';
+    const turnStart = Date.now();
+    try {
+        const stream = await session.thread.runStreamed(prompt);
+        for await (const event of stream.events) {
+            if (session.ended)
+                break;
+            handleCodexEvent(session, event);
+        }
+        session.turnIndex += 1;
+        emit({
+            type: 'agent:turn-complete',
+            sessionId: session.sessionId,
+            turnIndex: session.turnIndex,
+        });
+        emit({
+            type: 'agent:done',
+            sessionId: session.sessionId,
+            result: {
+                text: session.currentText,
+                turns: session.turnIndex,
+                durationMs: Date.now() - turnStart,
+            },
+        });
+    }
+    catch (err) {
+        emit({
+            type: 'agent:error',
+            sessionId: session.sessionId,
+            error: err?.message ?? String(err),
+        });
+    }
+    finally {
+        session.turnInFlight = false;
+        session.lastActivityAt = Date.now();
+        // Drain queued prompts FIFO (parity with daemon-omni — audit #64).
+        const next = session.queuedPrompts.shift();
+        if (next && !session.ended) {
+            void runTurn(session, next).catch((e) => {
+                emit({
+                    type: 'agent:error',
+                    sessionId: session.sessionId,
+                    error: e?.message ?? String(e),
+                });
+            });
+        }
+    }
+}
+function handleCodexEvent(session, event) {
+    // Item events — Codex bundles assistant messages, tool calls, and
+    // tool results all as "items." We dispatch on kind.
+    if (event?.type === 'item.completed' || event?.type === 'item.updated') {
+        const item = event.item;
+        if (!item)
+            return;
+        if (item.item_type === 'agent_message' && typeof item.text === 'string') {
+            // Codex sends the full assistant message text in one item rather
+            // than delta-chunks. We emit it as a single agent:text-delta with
+            // the whole payload — the FAB's streaming bubble handler treats
+            // "current = '' + this chunk" as full text, which is the right
+            // behavior since the bubble had no prior content.
+            const delta = item.text.slice(session.currentText.length);
+            if (delta) {
+                session.currentText = item.text;
+                emit({
+                    type: 'agent:text-delta',
+                    sessionId: session.sessionId,
+                    text: delta,
+                });
+            }
+            return;
+        }
+        if (item.item_type === 'command_execution') {
+            // Two-phase: when Codex starts a command, we emit tool-call.
+            // When it finishes (status === 'completed' | 'failed'), we emit
+            // tool-result. Both carry the same call id so the FAB can match.
+            const callId = item.id ?? `codex-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+            const status = item.status;
+            if (status === 'in_progress' || event.type === 'item.updated') {
+                emit({
+                    type: 'agent:tool-call',
+                    sessionId: session.sessionId,
+                    callId,
+                    tool: 'Bash', // Codex's command_execution is shell-based
+                    input: { command: item.command ?? '', description: '' },
+                });
+            }
+            else if (status === 'completed' || status === 'failed') {
+                const out = item.aggregated_output ?? '';
+                emit({
+                    type: 'agent:tool-result',
+                    sessionId: session.sessionId,
+                    callId,
+                    tool: 'Bash',
+                    ok: status === 'completed',
+                    preview: typeof out === 'string' ? out.slice(0, 200) : '',
+                });
+            }
+            return;
+        }
+        return;
+    }
+    if (event?.type === 'thread.started' && event.thread_id) {
+        session.threadId = event.thread_id;
+        return;
+    }
+    if (event?.type === 'error') {
+        emit({
+            type: 'agent:error',
+            sessionId: session.sessionId,
+            error: event.message ?? 'Codex error',
+        });
+        return;
+    }
+}
+/** Push a user message into a Codex session. Resolves when the SDK
+ *  starts processing (events stream via subscribers). One concurrent
+ *  turn per session; subsequent prompts queue FIFO (parity with
+ *  daemon-omni). Throws QUEUE_FULL if the queue is at capacity. */
+export async function promptCodex(input) {
+    const session = await getOrCreateSession({
+        sessionId: input.sessionId,
+        userId: input.userId,
+        model: input.model,
+        workingDir: input.workingDir,
+        compositionId: input.compositionId,
+        resumeThreadId: input.resumeThreadId,
+        maxQueuedPrompts: input.maxQueuedPrompts,
+    });
+    if (session.ended) {
+        throw new Error(`Codex session ${input.sessionId} has ended; start a new one.`);
+    }
+    if (session.turnInFlight) {
+        // Queue cap (audit task #64 — parity with daemon-omni).
+        if (session.queuedPrompts.length >= session.maxQueuedPrompts) {
+            throw new Error(`QUEUE_FULL: Codex session ${input.sessionId} has ${session.queuedPrompts.length} prompts queued (max ${session.maxQueuedPrompts}). ` +
+                `Wait for the current turn to finish or end this session.`);
+        }
+        session.queuedPrompts.push(input.prompt);
+    }
+    else {
+        // Fire-and-forget the turn — the subscriber stream surfaces progress.
+        void runTurn(session, input.prompt).catch((err) => {
+            emit({
+                type: 'agent:error',
+                sessionId: session.sessionId,
+                error: err?.message ?? String(err),
+            });
+        });
+    }
+    return { sessionId: input.sessionId, threadId: session.threadId };
+}
+export function endSession(sessionId) {
+    const session = sessions.get(sessionId);
+    if (!session)
+        return;
+    session.ended = true;
+    sessions.delete(sessionId);
+}
+export function listSessions() {
+    const now = Date.now();
+    return Array.from(sessions.values()).map((s) => ({
+        sessionId: s.sessionId,
+        userId: s.userId,
+        turns: s.turnIndex,
+        ageMs: now - s.startedAt,
+        threadId: s.threadId,
+    }));
+}

package/dist/daemon-entry.js

@@ -0,0 +1,101 @@
+/**
+ * Daemon entry point.
+ *
+ * Invoked by the Clearly Dev Mac app tray (or any launchd/systemd unit) via:
+ *
+ *   node /path/to/dist/daemon.js
+ *
+ * This is the ONE AND ONLY way to launch the daemon process. The user-facing
+ * `beehaven` CLI does NOT expose a `start` subcommand by design — daemon
+ * lifecycle is owned by the tray, and the tray spawns this entry file
+ * directly instead of going through a CLI subcommand. That decoupling means
+ * the CLI's command surface can change without risking the tray.
+ *
+ * Environment contract from the tray:
+ *   BEEHAVEN_NO_REPL=1       — skip interactive login; rely on provisioned token
+ *   HOME=<user home>         — so keychain + config paths resolve correctly
+ *   PATH=<curated path>      — so nvm node + system tools are reachable
+ *
+ * Exit behaviour:
+ *   - Normal lifetime: process stays up until SIGTERM/SIGINT from the tray.
+ *   - Fatal start error: logged to stderr (captured by the tray's log files)
+ *     and exits 1. The tray supervises and won't auto-respawn on fatal
+ *     startup errors (those usually need user intervention — expired token,
+ *     missing config, etc).
+ */
+import { startDaemon } from './daemon.js';
+// ── Parent-watcher (tray-coupled enforcement) ──
+// The daemon is documented as tray-coupled: it must not outlive the
+// tray that spawned it. The tray's own `before-quit` handler tries
+// to send SIGTERM, but that path is bypassed when:
+//   - User Cmd+Q's the app (event.preventDefault() → window hides, no shutdown)
+//   - Tray process crashes / force-quits / OOM-kills
+//   - Electron itself segfaults
+//
+// All of those leave the daemon orphaned, still holding the relay WS
+// open, still answering canvas-* RPCs, still costing DO active-time
+// for the user's session that they thought they ended.
+//
+// macOS reparents orphans to launchd (PID 1). We capture the original
+// parent PID at boot and poll every 3s; the moment it changes (parent
+// is gone), we exit. 3s is short enough to feel responsive to the
+// user but long enough that a tray restart isn't flagged as a death.
+//
+// Why poll instead of process.on('disconnect'): disconnect only fires
+// for child_process.fork() IPC channels. The Mac app uses plain spawn
+// + stdio:'pipe', so there's no IPC channel to detect the parent's
+// exit through. Polling ppid is the portable Node API.
+const ORIGINAL_PARENT_PID = process.ppid;
+const PARENT_CHECK_INTERVAL_MS = 3_000;
+// HEADLESS mode (e.g. a Cloudflare sandbox container): there is no Mac-app tray
+// parent to be coupled to, so the parent-death suicide must be disabled — else the
+// daemon exits ~3s after boot (ppid=1) and the agent's box has no daemon. Opt in
+// via BEEHAVEN_HEADLESS=1 (set by the sandbox image + control-server).
+const BEEHAVEN_HEADLESS = process.env.BEEHAVEN_HEADLESS === '1' || process.env.BEEHAVEN_HEADLESS === 'true';
+if (!BEEHAVEN_HEADLESS && ORIGINAL_PARENT_PID && ORIGINAL_PARENT_PID !== 1) {
+    setInterval(() => {
+        const currentPpid = process.ppid;
+        if (currentPpid !== ORIGINAL_PARENT_PID) {
+            console.error(`[beehaven daemon] parent died (was=${ORIGINAL_PARENT_PID}, now=${currentPpid}) — self-terminating to enforce tray-coupled lifecycle`);
+            process.exit(0);
+        }
+    }, PARENT_CHECK_INTERVAL_MS).unref();
+    // .unref() so this timer doesn't block the event loop from draining
+    // when shutdown is in progress.
+}
+async function run() {
+    if (process.argv[2] === '--restart-after-update') {
+        // A daemon started by `beehaven start --headless` has no launchd/systemd or tray to restart
+        // it after exit 75. The updated entry waits for the old owner to release the IPC socket.
+        if (process.env.BEEHAVEN_CLI_OWNED_DAEMON !== '1')
+            throw new Error('update restart requires a CLI-owned daemon');
+        const previousPid = Number(process.argv[3]);
+        if (!Number.isSafeInteger(previousPid) || previousPid <= 1)
+            throw new Error('invalid previous daemon PID');
+        const deadline = Date.now() + 15_000;
+        while (Date.now() < deadline) {
+            try {
+                process.kill(previousPid, 0);
+            }
+            catch (error) {
+                if (error?.code === 'ESRCH')
+                    break;
+                throw error;
+            }
+            await new Promise((resolve) => setTimeout(resolve, 200));
+        }
+        try {
+            process.kill(previousPid, 0);
+            throw new Error('previous daemon did not exit');
+        }
+        catch (error) {
+            if (error?.code !== 'ESRCH')
+                throw error;
+        }
+    }
+    await startDaemon({});
+}
+run().catch((err) => {
+    console.error('[beehaven daemon] fatal:', err?.stack ?? err?.message ?? err);
+    process.exit(1);
+});

package/dist/daemon-fetch-allowlist.js

@@ -0,0 +1,194 @@
+/**
+ * daemon-fetch URL allowlist.
+ *
+ * The daemon-fetch IPC proxy lets local clients make HTTP requests with
+ * the daemon's Firebase ID token attached as `Authorization: Bearer …`.
+ * Without a URL allowlist, any local process that gets past IPC auth can
+ * use the daemon as a confused deputy — hit arbitrary endpoints with the
+ * user's cloud credentials.
+ *
+ * Policy: allow-by-host. We maintain a static allowlist of hosts the
+ * daemon is expected to talk to. Everything else is rejected.
+ *
+ * Callers needing to add a new host should edit this file rather than
+ * disabling the allowlist — forces the decision through code review.
+ */
+/**
+ * Hosts we're willing to forward authenticated requests to.
+ *
+ * Each entry is a lowercased hostname or wildcard pattern (leading `*.`
+ * matches any subdomain). Exact host matches win over wildcards, but we
+ * evaluate them uniformly.
+ */
+const ALLOWED_HOSTS = [
+    // Clearly production + staging relays
+    'relay.clearly.sh',
+    'staging-relay.clearly.sh',
+    'clearly.sh',
+    '*.clearly.sh',
+    '*.clearly-sh.pages.dev',
+    // Clearly Cloudflare Workers (named workspaces + routes).
+    // SECURITY: do NOT add a `*.workers.dev` wildcard here — ANY party can
+    // deploy a worker under *.workers.dev. Enumerate only Clearly's workers.
+    'bee-relay.throbbing-unit-1b3f.workers.dev',
+    'bee-relay-staging.throbbing-unit-1b3f.workers.dev',
+    // Firebase auth + project endpoints
+    'identitytoolkit.googleapis.com',
+    'securetoken.googleapis.com',
+    'firestore.googleapis.com',
+    '*.firebaseio.com',
+    '*.firebaseapp.com',
+    // Vertex AI / Google Cloud (for AI, storage, cloud functions)
+    'aiplatform.googleapis.com',
+    '*-aiplatform.googleapis.com',
+    'storage.googleapis.com',
+    // REMOVED: '*-cloudfunctions.net'. It compiled to
+    // `^[a-z0-9-]+-cloudfunctions\.net$`, which matches a SECOND-LEVEL
+    // domain — `evil-cloudfunctions.net` is registrable by anyone, and it
+    // was allowed. Google's real Cloud Functions hosts are subdomains of
+    // cloudfunctions.net, already covered by the next line, so the entry
+    // was redundant as well as dangerous. It sat three lines under the
+    // comment warning about exactly this with *.workers.dev.
+    '*.cloudfunctions.net',
+    '*.run.app',
+    // Shopify (app proxy callbacks for stores the user has installed)
+    '*.myshopify.com',
+];
+/**
+ * The subset of allowed hosts that may receive the user's Firebase ID
+ * token as `Authorization: Bearer …`.
+ *
+ * Being fetchable and being trusted with a credential are DIFFERENT
+ * questions, and conflating them is what made this a confused-deputy
+ * hole. `daemon.ts` attached the bearer to every allowed host, and four
+ * allowlist entries are registrable by third parties:
+ *
+ *   *.myshopify.com    anyone can open a Shopify store
+ *   *.firebaseapp.com  anyone can create a Firebase project
+ *   *.run.app          anyone can deploy a Cloud Run service
+ *   *.cloudfunctions.net   any other Google Cloud customer
+ *
+ * Each of those would have received a live Firebase ID token for the
+ * user — the same class of leak the `*.workers.dev` comment above warns
+ * about, just spelled differently. They stay FETCHABLE (the daemon has
+ * legitimate reasons to talk to a merchant storefront) but they no
+ * longer get the credential.
+ *
+ * Entries here are Clearly-controlled or Google-first-party
+ * (`*.googleapis.com` is Google's registrable domain — no third party
+ * can obtain a host under it). Add to this list only with the same
+ * question answered: *can anyone but us obtain a hostname that matches?*
+ */
+const CREDENTIALED_HOSTS = [
+    'relay.clearly.sh',
+    'staging-relay.clearly.sh',
+    'clearly.sh',
+    '*.clearly.sh',
+    '*.clearly-sh.pages.dev',
+    'bee-relay.throbbing-unit-1b3f.workers.dev',
+    'bee-relay-staging.throbbing-unit-1b3f.workers.dev',
+    // Google first-party API endpoints — all under googleapis.com.
+    'identitytoolkit.googleapis.com',
+    'securetoken.googleapis.com',
+    'firestore.googleapis.com',
+    'aiplatform.googleapis.com',
+    '*-aiplatform.googleapis.com',
+    'storage.googleapis.com',
+];
+/**
+ * Localhost + loopback are allowed — development convenience. Daemon runs
+ * on the user's machine so forwarding to 127.0.0.1:*:*` is strictly less
+ * powerful than what native code can already do.
+ *
+ * URL.hostname strips brackets from IPv6 literals for IP address forms but
+ * keeps them when there's a scope-id etc., so we include both shapes.
+ */
+const LOCALHOST_HOSTS = new Set(['localhost', '127.0.0.1', '0.0.0.0', '::1', '[::1]']);
+export function isDaemonFetchUrlAllowed(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return { ok: false, reason: 'Invalid URL' };
+    }
+    // Only http(s). Block file://, data:, javascript:, etc. outright.
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        return { ok: false, reason: `Protocol ${parsed.protocol} not allowed` };
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    // http is only allowed to localhost — anything else must be https to
+    // avoid leaking the Firebase bearer token over plaintext.
+    if (parsed.protocol === 'http:' && !LOCALHOST_HOSTS.has(hostname)) {
+        return { ok: false, reason: 'http:// only permitted for localhost' };
+    }
+    if (LOCALHOST_HOSTS.has(hostname))
+        return { ok: true };
+    for (const pattern of ALLOWED_HOSTS) {
+        if (matchHost(hostname, pattern))
+            return { ok: true };
+    }
+    return { ok: false, reason: `Host ${hostname} not in daemon-fetch allowlist` };
+}
+/**
+ * May this URL receive the user's Firebase ID token?
+ *
+ * Callers MUST gate the `Authorization` header on this, not on
+ * `isDaemonFetchUrlAllowed`. Fails closed: anything not explicitly
+ * listed in CREDENTIALED_HOSTS gets the request without a credential.
+ */
+export function mayReceiveCredentials(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    // localhost is the one http:// host the allowlist permits, and a dev
+    // server on the user's own machine is already inside the trust
+    // boundary — the token never leaves the loopback interface.
+    if (LOCALHOST_HOSTS.has(hostname))
+        return true;
+    // Everything else: never hand a bearer token to a plaintext endpoint.
+    if (parsed.protocol !== 'https:')
+        return false;
+    return CREDENTIALED_HOSTS.some((pattern) => matchHost(hostname, pattern));
+}
+/**
+ * Match a hostname against a pattern. `*` in the pattern matches a single
+ * non-empty hostname label (alphanumerics + hyphens). So:
+ *   `*.clearly.sh`           matches `foo.clearly.sh`, `a.b.clearly.sh`
+ *   `*-aiplatform.googleapis.com` matches `us-central1-aiplatform.googleapis.com`
+ *   `*.workers.dev`          matches `my-worker.workers.dev`
+ *
+ * Leading `*.` is special-cased to also match the bare domain so that
+ * `*.clearly.sh` accepts `clearly.sh` itself without a separate entry.
+ */
+function matchHost(hostname, pattern) {
+    const p = pattern.toLowerCase();
+    if (p === hostname)
+        return true;
+    // Build a regex: `*` matches one non-empty label (alphanumerics + hyphens),
+    // literal dots escaped. Anchor both ends so partial matches can't sneak
+    // through.
+    //
+    // Design choice: `*.workers.dev` does NOT match bare `workers.dev` — if
+    // you want the root domain accepted, list it explicitly. This prevents
+    // a pattern meant for user subdomains from accidentally whitelisting
+    // the platform's landing page.
+    const regex = '^' +
+        p
+            .split('')
+            .map((ch) => {
+            if (ch === '*')
+                return '[a-z0-9-]+';
+            if (/[.+?^${}()|[\]\\]/.test(ch))
+                return '\\' + ch;
+            return ch;
+        })
+            .join('') +
+        '$';
+    return new RegExp(regex).test(hostname);
+}