@corenel/sidecar 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.3.1
+
+This package is Corenel's, and now says so in its defaults. 0.3.0 pointed its
+gateway, and the app it opens, at the sibling product.
+
+The direction is the fix: prompd.app is a CONSUMER of these APIs, so it names
+its own origin (`--app-url https://prompd.app/studio`, `--endpoint <its own>`)
+and corenel.ai is what you get without asking.
+
+### Added
+- `sessions` subcommand: `corenel-sidecar sessions [list | show <id>]`, also
+  reachable as `corenel sessions`. Read-only, and read from the SANDBOXES rather
+  than from a daemon -- a subcommand runs in a new process and cannot see a
+  running daemon's SessionManager, so anything derived from it would be a guess.
+  Asking msb gets the same answer the daemon gets when it adopts at boot, and it
+  works with nothing running.
+
+### Changed
+- `--app-url` defaults to `https://corenel.ai`, and the open URL no longer has
+  `/studio` appended to it. That is a prompd route; corenel serves its app at
+  `/`, so the old shape would have opened a page that does not exist and lost
+  the pairing fragment on the redirect. `--app-url` is now the app URL in full,
+  path included -- prompd pairs at `https://prompd.app/studio`.
+
+### Fixed
+- The daemon called `https://api.prompd.app` for every model run -- the sibling
+  product's gateway, with a token minted against this one. The default endpoint
+  is now `https://api.corenel.ai/api`.
+- That default was also missing the `/api` prefix the gateway is mounted behind.
+  `setGatewayBase` appends `/v1`, so a bare origin composed
+  `https://host/v1/chat/completions` and 404'd -- surfacing as "the run failed",
+  nowhere near the flag responsible. A bare origin now has the prefix added, and
+  any endpoint carrying a path is left exactly as given.
+- `--allow-lan` did not do what it says. It widened the CORS origin allowlist
+  while the socket stayed bound to `127.0.0.1`, so nothing on the network could
+  connect and the banner still printed a loopback URL. It now binds all
+  interfaces and serves `wss://` with the self-signed cert (which already
+  covered the LAN IPs for exactly this). Both halves defer to anything
+  explicit: `--host` keeps its address, a supplied `--tls-cert` is not replaced.
+
+  This is the only way LAN pairing can work from the product: the app is served
+  over https, and a browser on an https page refuses a `ws://` connection to a
+  LAN address.
+
 ## 0.3.0
 
 The isolation release. 0.2.0 could expose a machine's files and shell to a

package/dist/cli.js

@@ -36619,7 +36619,7 @@ var openai_default = OpenAI;
 var enabled = true;
 function setAgentLogging(on) {
   enabled = on;
-  console.log(`[agent] logging ${on ? "enabled" : "disabled"}`);
+  if (on) console.log("[agent] logging enabled");
 }
 function alog(...args) {
   if (enabled) console.debug("[agent]", ...args);
@@ -36738,8 +36738,18 @@ function createChatClient(auth, opts = {}) {
 }
 
 // src/runner/gatewayClient.ts
+var API_PREFIX = "/api";
+function normalizeEndpoint(endpoint) {
+  const trimmed = endpoint.replace(/\/+$/, "");
+  try {
+    const u2 = new URL(trimmed);
+    return u2.pathname === "" || u2.pathname === "/" ? `${u2.origin}${API_PREFIX}` : trimmed;
+  } catch {
+    return trimmed;
+  }
+}
 function nodeGatewayClient(endpoint) {
-  setGatewayBase(endpoint);
+  setGatewayBase(normalizeEndpoint(endpoint));
   return createChatClient(nodeAuthToken(), { origin: "daemon" });
 }
 
@@ -39364,6 +39374,97 @@ async function runHostsCli(argv) {
   }
 }
 
+// src/sessionsCli.ts
+async function listSessions(run) {
+  const listed = await run(listArgs()).catch(() => null);
+  if (!listed || listed.code !== 0) return [];
+  const rows = [];
+  for (const box of parseSandboxList(listed.stdout)) {
+    const inspected = await run(inspectArgs(box.name)).catch(() => null);
+    const labels = inspected && inspected.code === 0 ? parseSandboxLabels(inspected.stdout) : {};
+    const id = labels[LABEL_SESSION];
+    if (!id) continue;
+    const url = labels[LABEL_REPO_URL];
+    const ref = labels[LABEL_REPO_REF];
+    rows.push({
+      id,
+      sandbox: box.name,
+      status: box.status || "unknown",
+      workdir: labels[LABEL_WORKDIR] ?? "",
+      owner: labels[LABEL_OWNER] ?? "",
+      created: labels[LABEL_CREATED] ?? (box.createdAt ? new Date(box.createdAt).toISOString() : ""),
+      ...url ? { repo: ref ? `${url}#${ref}` : url } : {}
+    });
+  }
+  return rows;
+}
+function formatSessions(rows) {
+  if (!rows.length) {
+    return [
+      "no sessions on this machine.",
+      "",
+      "Sessions are created by a daemon running with --isolation microvm.",
+      "Without it, runs execute in the daemon process and leave nothing to list."
+    ].join("\n");
+  }
+  const w2 = (pick2, head) => Math.max(head.length, ...rows.map((r2) => pick2(r2).length));
+  const idW = w2((r2) => r2.id, "session");
+  const stW = w2((r2) => r2.status, "status");
+  const wdW = w2((r2) => r2.workdir, "workdir");
+  const line = (id, st2, wd, cr2) => `${id.padEnd(idW)}  ${st2.padEnd(stW)}  ${wd.padEnd(wdW)}  ${cr2}`;
+  return [
+    line("session", "status", "workdir", "created"),
+    ...rows.map((r2) => line(r2.id, r2.status, r2.workdir, r2.created))
+  ].join("\n");
+}
+function formatSession(r2) {
+  return [
+    `session  ${r2.id}`,
+    `sandbox  ${r2.sandbox}`,
+    `status   ${r2.status}`,
+    `workdir  ${r2.workdir || "(none)"}`,
+    `owner    ${r2.owner || "(none)"}`,
+    `created  ${r2.created || "(unknown)"}`,
+    ...r2.repo ? [`repo     ${r2.repo}`] : []
+  ].join("\n");
+}
+async function runSessionsCli(argv, deps) {
+  const out = deps.out ?? ((s2) => process.stdout.write(s2));
+  const err = deps.err ?? ((s2) => process.stderr.write(s2));
+  const run = deps.run ?? makeMsbRunner(deps.msbBin, deps.wsl ? wslMsb(deps.msbBin) : void 0);
+  const [verb, ...rest] = argv;
+  if (verb === void 0 || verb === "list") {
+    if (rest.length) {
+      err(`corenel sessions list: unexpected argument "${rest[0]}"
+`);
+      return 1;
+    }
+    out(`${formatSessions(await listSessions(run))}
+`);
+    return 0;
+  }
+  if (verb === "show") {
+    const id = rest[0];
+    if (!id) {
+      err("corenel sessions show: missing <id>\n");
+      return 1;
+    }
+    const found = (await listSessions(run)).find((r2) => r2.id === id || r2.sandbox === id);
+    if (!found) {
+      err(`corenel sessions: no session "${id}" on this machine
+`);
+      return 1;
+    }
+    out(`${formatSession(found)}
+`);
+    return 0;
+  }
+  err(`corenel sessions: unknown subcommand "${verb}"
+  usage: corenel sessions [list | show <id>]
+`);
+  return 1;
+}
+
 // src/args.ts
 import { statSync as statSync2 } from "node:fs";
 import { resolve as resolve6 } from "node:path";
@@ -39376,7 +39477,7 @@ var FLAGS = [
   { flag: "--allow-add-under", arg: "<dir>", help: "Let the client add working directories beneath <dir> during a session. Repeatable. Grants directory-name enumeration over the subtree. Added roots last until the sidecar exits." },
   { flag: "--allow-origin", arg: "<url>", help: "Allow a browser origin to connect. Repeatable." },
   { flag: "--allow-shell", help: "Enable the shell tool. Off by default." },
-  { flag: "--allow-lan", help: "Accept connections from the local network, not just this machine." },
+  { flag: "--allow-lan", help: "Serve the local network, not just this machine: binds all interfaces and serves wss with a self-signed cert. --host / --tls-cert override each half." },
   { flag: "--tls-cert", arg: "<file>", help: "TLS certificate for wss://." },
   { flag: "--tls-key", arg: "<file>", help: "TLS private key for wss://." },
   { flag: "--self-signed", help: "Generate a self-signed certificate instead of supplying one." },
@@ -39384,9 +39485,9 @@ var FLAGS = [
   { flag: "--tunnel-name", arg: "<name>", help: "Use a named cloudflared tunnel." },
   { flag: "--tunnel-hostname", arg: "<host>", help: "Hostname for the named tunnel." },
   { flag: "--open", help: "Open the app in a browser once the sidecar is listening." },
-  { flag: "--app-url", arg: "<url>", help: "App to open and pair with (default https://prompd.app)." },
+  { flag: "--app-url", arg: "<url>", help: "App to open and pair with, path included (default https://corenel.ai; prompd pairs at https://prompd.app/studio)." },
   { flag: "--daemon", help: "Run crew agents on this machine unattended: cron, file-change and run-complete triggers." },
-  { flag: "--endpoint", arg: "<url>", help: "Gateway the daemon calls for model runs (default https://api.prompd.app)." },
+  { flag: "--endpoint", arg: "<url>", help: "Gateway the daemon calls for model runs (default https://api.corenel.ai/api). A bare origin gets /api appended." },
   { flag: "--state-dir", arg: "<dir>", help: "Where crew agents, sessions and tokens live (defaults to the Corenel dot-dir)." },
   { flag: "--default-model", arg: "<id>", help: "Model for crew agents that do not name one." },
   { flag: "--name", arg: "<label>", help: "Friendly name advertised to clients (defaults to the hostname)." },
@@ -39442,6 +39543,7 @@ function helpText() {
     "Subcommands:",
     "  hosts list      Show clients that have paired with this sidecar.",
     "  hosts forget    Remove a paired client and its synced files.",
+    "  sessions        List sandbox sessions on this machine (also `corenel sessions`).",
     "  acp-agent       Speak ACP over stdio, for an editor to spawn (Zed, JetBrains).",
     "  login           Sign in to Corenel in your browser.",
     "  logout          Forget the stored sign-in (paired devices are unaffected).",
@@ -39527,14 +39629,18 @@ function parseArgs(argv) {
     guestImage: "corenel-guest:dev",
     selfSigned: false,
     open: false,
-    appUrl: "https://prompd.app",
+    appUrl: "https://corenel.ai",
+    // The gateway this package's own product talks to, and it carries the /api
+    // prefix the gateway actually lives behind -- setGatewayBase appends /v1,
+    // so a bare origin composes .../v1/chat/completions, which is a 404.
     daemon: false,
-    endpoint: "https://api.prompd.app",
+    endpoint: "https://api.corenel.ai/api",
     stateDir: corenelDir2(),
     maxChainDepth: 8,
     addUnder: [],
     cloneUnder: []
   };
+  let hostSet = false;
   for (let i2 = 0; i2 < argv.length; i2++) {
     const a2 = argv[i2];
     if (isHelpFlag(a2)) {
@@ -39542,8 +39648,10 @@ function parseArgs(argv) {
       process.exit(0);
     }
     if (a2 === "--port") out.port = Number(argv[++i2]);
-    else if (a2 === "--host") out.host = argv[++i2];
-    else if (a2 === "--root") out.roots.push(resolve6(argv[++i2]));
+    else if (a2 === "--host") {
+      out.host = argv[++i2];
+      hostSet = true;
+    } else if (a2 === "--root") out.roots.push(resolve6(argv[++i2]));
     else if (a2 === "--allow-add-under") out.addUnder.push(resolve6(argv[++i2]));
     else if (a2 === "--clone-under") out.cloneUnder.push(resolve6(argv[++i2]));
     else if (a2 === "--allow-origin") out.allowOrigins.push(argv[++i2]);
@@ -39580,6 +39688,10 @@ valid flags: ${KNOWN_FLAGS.join(" ")}`);
   }
   out.addUnder = [...new Set(out.addUnder)];
   out.cloneUnder = [...new Set(out.cloneUnder)];
+  if (out.allowLan) {
+    if (!hostSet) out.host = "0.0.0.0";
+    if (!out.tlsCert && !out.tlsKey) out.selfSigned = true;
+  }
   return out;
 }
 function validateArgs(args) {
@@ -41086,6 +41198,14 @@ async function main() {
     await runHostsCli(rawArgv.slice(1));
     return;
   }
+  if (rawArgv[0] === "sessions") {
+    const rest = rawArgv.slice(1);
+    const at2 = rest.indexOf("--msb");
+    const msbBin = at2 >= 0 && rest[at2 + 1] ? rest[at2 + 1] : process.env.MSB_BIN ?? "msb";
+    const verbs = rest.filter((a2, i2) => !a2.startsWith("--") && !(i2 > 0 && rest[i2 - 1].startsWith("--")));
+    process.exitCode = await runSessionsCli(verbs, { msbBin, wsl: process.platform === "win32" });
+    return;
+  }
   if (rawArgv[0] === "login" || rawArgv[0] === "logout" || rawArgv[0] === "auth") {
     const sub = rawArgv[0];
     const parsed = parseArgs(rawArgv.slice(1));
@@ -41408,7 +41528,7 @@ async function main() {
   );
   if (args.open) {
     const loopback = `${handle.secure ? "wss" : "ws"}://127.0.0.1:${handle.port}`;
-    const target = `${args.appUrl.replace(/\/$/, "")}/studio#sidecar=${encodeURIComponent(loopback)}&token=${encodeURIComponent(token)}`;
+    const target = `${args.appUrl.replace(/\/$/, "")}#sidecar=${encodeURIComponent(loopback)}&token=${encodeURIComponent(token)}`;
     process.stdout.write(`  opening ${args.appUrl} (auto-pairing)\u2026
 `);
     openBrowser2(target);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/sidecar",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "license": "Elastic-2.0",
   "description": "Prompd sidecar — a local capability server. Run it next to Prompd (prompd.app) so the browser app can reach your machine: local LLMs (Ollama/LM Studio/vLLM) without CORS, your filesystem, and (opt-in) shell.",