@drisp/cli 0.5.23 → 0.5.26

package/dist/{WorkflowInstallWizard-CCCUR6KA.js → WorkflowInstallWizard-5FENJHBW.js}

@@ -8,7 +8,7 @@ import {
   installWorkflowPlugins,
   resolveWorkflow,
   writeGlobalConfig
-} from "./chunk-JHSADKDJ.js";
+} from "./chunk-73V7GXV6.js";
 
 // src/setup/steps/WorkflowInstallWizard.tsx
 import { useState, useEffect, useCallback, useRef } from "react";
@@ -92,4 +92,4 @@ function WorkflowInstallWizard({ source, onDone }) {
 export {
   WorkflowInstallWizard as default
 };
-//# sourceMappingURL=WorkflowInstallWizard-CCCUR6KA.js.map
+//# sourceMappingURL=WorkflowInstallWizard-5FENJHBW.js.map

package/dist/athena-gateway.js

@@ -3,23 +3,24 @@ import {
   loadOrCreateToken,
   requireTokenForBind,
   timingSafeTokenEqual
-} from "./chunk-MRAM6EYI.js";
+} from "./chunk-4NX4WFPB.js";
 import {
   CHANNEL_REQUEST_ID_REGEX,
   createUdsServerTransport,
+  createWsServerTransport,
   generateChannelRequestId,
   isLoopbackHost,
   isValidChannelRequestId,
+  openVersionedDb,
   refreshDashboardAccessToken,
   resolveGatewayPaths,
   resolveListenSpec,
-  traceGatewayFrame,
   trackGatewayRuntimeExpired,
   trackGatewayRuntimeRebind,
   trackGatewayTransportConnect,
   trackGatewayTransportDisconnect,
   writeGatewayTrace
-} from "./chunk-BTY7MYYT.js";
+} from "./chunk-3U37HT4T.js";
 
 // src/gateway/daemon.ts
 import fs4 from "fs";
@@ -2440,7 +2441,7 @@ var cachedVersion = null;
 function readVersion() {
   if (cachedVersion !== null) return cachedVersion;
   try {
-    const injected = "0.5.23";
+    const injected = "0.5.26";
     if (typeof injected === "string" && injected.length > 0) {
       cachedVersion = injected;
       return cachedVersion;
@@ -3463,6 +3464,33 @@ var DispatchPipeline = class {
   }
 };
 
+// src/gateway/listenerPlan.ts
+function planListener(spec, token) {
+  requireTokenForBind(spec, token);
+  if (spec.kind === "uds") {
+    return {
+      transport: { kind: "uds", socketPath: spec.socketPath },
+      warnings: []
+    };
+  }
+  const warnings = [];
+  if (spec.insecure && !spec.tls && !isLoopbackHost(spec.host)) {
+    warnings.push(
+      `athena-gateway: WARNING --insecure is set on a non-loopback bind (${spec.host}:${spec.port}); token travels in plaintext. Use only behind TLS-terminating reverse proxy or Tailscale/WireGuard tunnel.`
+    );
+  }
+  return {
+    transport: {
+      kind: "tcp",
+      host: spec.host,
+      port: spec.port,
+      allowNonLoopback: spec.insecure || Boolean(spec.tls),
+      ...spec.tls ? { tls: spec.tls } : {}
+    },
+    warnings
+  };
+}
+
 // src/gateway/lock.ts
 import fs2 from "fs";
 import path2 from "path";
@@ -3758,31 +3786,9 @@ function questionFingerprint(req) {
 
 // src/gateway/state/db.ts
 import fs3 from "fs";
-import path3 from "path";
-import Database from "better-sqlite3";
 var GATEWAY_STATE_VERSION = 2;
-function openGatewayState(dbPath) {
-  if (dbPath !== ":memory:") {
-    fs3.mkdirSync(path3.dirname(dbPath), { recursive: true, mode: 448 });
-  }
-  const db = new Database(dbPath);
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA foreign_keys = ON");
-  initGatewayStateSchema(db);
-  if (dbPath !== ":memory:" && process.platform !== "win32") {
-    try {
-      fs3.chmodSync(dbPath, 384);
-    } catch {
-    }
-  }
-  return db;
-}
-function initGatewayStateSchema(db) {
+var migrateGatewayState = (db, fromVersion) => {
   db.exec(`
-		CREATE TABLE IF NOT EXISTS schema_version (
-			version INTEGER NOT NULL
-		);
-
 		-- Inbound chat messages parked while no runtime is registered. Drained
 		-- in FIFO id order on session.register. Idempotency key prevents the
 		-- same provider message from being parked twice if an adapter retries.
@@ -3814,244 +3820,50 @@ function initGatewayStateSchema(db) {
 		CREATE INDEX IF NOT EXISTS ix_channel_outbox_due
 			ON channel_outbox(next_attempt_at);
 	`);
-  const existing = db.prepare("SELECT version FROM schema_version").get();
-  if (existing && existing.version > GATEWAY_STATE_VERSION) {
-    throw new Error(
-      `Gateway state DB has newer schema version ${existing.version} (expected <= ${GATEWAY_STATE_VERSION}). Update athena-cli.`
-    );
-  }
-  if (!existing) {
-    db.prepare("INSERT INTO schema_version (version) VALUES (?)").run(
-      GATEWAY_STATE_VERSION
-    );
-    return;
-  }
+  if (fromVersion === void 0) return;
   const inboundColumns = db.prepare("PRAGMA table_info(inbound_queue)").all();
   if (!inboundColumns.some((column) => column.name === "attachment_id")) {
     db.prepare("ALTER TABLE inbound_queue ADD COLUMN attachment_id TEXT").run();
   }
-  if (existing.version < GATEWAY_STATE_VERSION) {
+  if (fromVersion < GATEWAY_STATE_VERSION) {
     db.prepare("UPDATE schema_version SET version = ?").run(
       GATEWAY_STATE_VERSION
     );
   }
-}
-
-// src/gateway/transport/tlsWs.ts
-import { WebSocketServer } from "ws";
-import { createServer as createHttpsServer } from "https";
-import { readFileSync as readFileSync3 } from "fs";
-function createWsServerTransport(opts) {
-  if (!opts.allowNonLoopback && !isLoopbackHost(opts.host)) {
-    throw new Error(`gateway: refusing non-loopback bind without --insecure`);
-  }
-  let endpoint = null;
-  const scheme = opts.tls ? "wss" : "ws";
-  const rateLimit = createConnectRateLimiter(opts.rateLimitPerMin ?? 10);
-  return {
-    kind: "ws",
-    endpoint: () => {
-      if (!endpoint) {
-        throw new Error("gateway: WS transport has not started listening");
-      }
-      return endpoint;
-    },
-    listen: (onConnection) => new Promise((resolve, reject) => {
-      const verifyClient = (info) => rateLimit.allow(info.req.socket.remoteAddress ?? "unknown");
-      const { wss, httpsServer } = createWss({
-        host: opts.host,
-        port: opts.port,
-        tls: opts.tls,
-        verifyClient
-      });
-      const onError = (err) => reject(err);
-      wss.once("error", onError);
-      if (httpsServer) httpsServer.once("error", onError);
-      const onListening = () => {
-        wss.off("error", onError);
-        if (httpsServer) httpsServer.off("error", onError);
-        const addr = httpsServer ? httpsServer.address() : wss.address();
-        if (typeof addr === "string" || addr === null) {
-          wss.close();
-          httpsServer?.close();
-          reject(
-            new Error("gateway: WS listener did not expose TCP address")
-          );
-          return;
-        }
-        endpoint = {
-          host: opts.host,
-          port: addr.port,
-          url: `${scheme}://${opts.host}:${addr.port}`
-        };
-        resolve({
-          close: () => new Promise((closeResolve) => {
-            for (const client of wss.clients) client.terminate();
-            wss.close(() => {
-              if (httpsServer) httpsServer.close(() => closeResolve());
-              else closeResolve();
-            });
-          })
-        });
-      };
-      if (httpsServer) httpsServer.once("listening", onListening);
-      else wss.once("listening", onListening);
-      const pingIntervalMs = opts.pingIntervalMs ?? 15e3;
-      const pongTimeoutMs = opts.pongTimeoutMs ?? 3e4;
-      wss.on("connection", (ws) => {
-        attachHeartbeat(ws, pingIntervalMs, pongTimeoutMs);
-        onConnection(createWsConnection(ws, `${scheme}:${opts.host}`));
-      });
-    })
-  };
-}
-function loadTlsOptions(tls) {
-  return {
-    cert: readFileSync3(tls.certPath),
-    key: readFileSync3(tls.keyPath)
-  };
-}
-function createWss(input) {
-  if (input.tls) {
-    const httpsServer = createHttpsServer(loadTlsOptions(input.tls));
-    httpsServer.listen({ host: input.host, port: input.port });
-    return {
-      wss: new WebSocketServer({
-        server: httpsServer,
-        verifyClient: input.verifyClient
-      }),
-      httpsServer
-    };
-  }
-  return {
-    wss: new WebSocketServer({
-      host: input.host,
-      port: input.port,
-      verifyClient: input.verifyClient
-    }),
-    httpsServer: null
-  };
-}
-function createConnectRateLimiter(maxPerMin) {
-  if (maxPerMin <= 0) return { allow: () => true };
-  const buckets = /* @__PURE__ */ new Map();
-  let pruneCountdown = 256;
-  const prune = (cutoff) => {
-    for (const [ip, arr] of buckets) {
-      const fresh = arr.filter((t) => t > cutoff);
-      if (fresh.length === 0) buckets.delete(ip);
-      else if (fresh.length !== arr.length) buckets.set(ip, fresh);
-    }
-  };
-  return {
-    allow(ip) {
-      const now = Date.now();
-      const cutoff = now - 6e4;
-      pruneCountdown -= 1;
-      if (pruneCountdown <= 0) {
-        prune(cutoff);
-        pruneCountdown = 256;
-      }
-      const recent = (buckets.get(ip) ?? []).filter((t) => t > cutoff);
-      if (recent.length >= maxPerMin) {
-        buckets.set(ip, recent);
-        return false;
-      }
-      recent.push(now);
-      buckets.set(ip, recent);
-      return true;
-    }
-  };
-}
-function attachHeartbeat(ws, pingIntervalMs, pongTimeoutMs) {
-  if (pingIntervalMs <= 0) return;
-  let pongTimer = null;
-  const clearPongTimer = () => {
-    if (pongTimer) {
-      clearTimeout(pongTimer);
-      pongTimer = null;
-    }
-  };
-  ws.on("pong", clearPongTimer);
-  const interval = setInterval(() => {
-    if (ws.readyState !== ws.OPEN) return;
-    try {
-      ws.ping();
-    } catch {
-      return;
-    }
-    if (!pongTimer) {
-      pongTimer = setTimeout(() => ws.terminate(), pongTimeoutMs);
-    }
-  }, pingIntervalMs);
-  const stop = () => {
-    clearInterval(interval);
-    clearPongTimer();
-  };
-  ws.on("close", stop);
-  ws.on("error", stop);
-}
-function createWsConnection(ws, peer) {
-  const frameHandlers = /* @__PURE__ */ new Set();
-  const closeHandlers = /* @__PURE__ */ new Set();
-  const errorHandlers = /* @__PURE__ */ new Set();
-  ws.on("message", (data) => {
-    let parsed;
+};
+function openGatewayState(dbPath) {
+  const db = openVersionedDb(dbPath, {
+    version: GATEWAY_STATE_VERSION,
+    migrate: migrateGatewayState,
+    foreignKeys: true,
+    ensureDir: true,
+    dirMode: 448,
+    onNewerVersion: (found, expected) => new Error(
+      `Gateway state DB has newer schema version ${found} (expected <= ${expected}). Update athena-cli.`
+    )
+  });
+  if (dbPath !== ":memory:" && process.platform !== "win32") {
     try {
-      parsed = JSON.parse(data.toString());
+      fs3.chmodSync(dbPath, 384);
     } catch {
-      ws.close();
-      return;
     }
-    traceGatewayFrame("ws", peer, "in", parsed);
-    for (const handler of frameHandlers) handler(parsed);
-  });
-  ws.on("error", (err) => {
-    for (const handler of errorHandlers) handler(err);
-  });
-  ws.on("close", () => {
-    for (const handler of closeHandlers) handler();
-  });
-  return {
-    kind: "ws",
-    peer,
-    send: (frame) => {
-      if (ws.readyState !== ws.OPEN) return;
-      traceGatewayFrame("ws", peer, "out", frame);
-      ws.send(JSON.stringify(frame));
-    },
-    close: () => ws.close(),
-    onFrame: (cb) => {
-      frameHandlers.add(cb);
-      return () => frameHandlers.delete(cb);
-    },
-    onClose: (cb) => {
-      closeHandlers.add(cb);
-      return () => closeHandlers.delete(cb);
-    },
-    onError: (cb) => {
-      errorHandlers.add(cb);
-      return () => errorHandlers.delete(cb);
-    }
-  };
+  }
+  return db;
 }
 
 // src/gateway/daemon.ts
-function buildListenerStatus(spec, resolvedPort) {
-  if (spec.kind === "uds") {
-    return { kind: "uds", socketPath: spec.socketPath };
+function describeToStatus(desc, spec) {
+  if (desc.kind === "uds") {
+    return { kind: "uds", socketPath: desc.socketPath };
   }
-  const port = resolvedPort ?? spec.port;
-  const tls = Boolean(spec.tls);
-  const scheme = tls ? "wss" : "ws";
   return {
     kind: "tcp",
-    host: spec.host,
-    port,
-    url: `${scheme}://${spec.host}:${port}`,
-    tls,
-    insecure: spec.insecure,
-    loopback: isLoopbackHost(spec.host)
+    host: desc.host,
+    port: desc.port,
+    url: desc.url,
+    tls: desc.tls,
+    insecure: spec.kind === "tcp" ? spec.insecure : false,
+    loopback: isLoopbackHost(desc.host)
   };
 }
 async function startDaemon(opts) {
@@ -4070,7 +3882,7 @@ async function startDaemon(opts) {
   const lock = acquireLock(paths.lockPath);
   const token = loadOrCreateToken(paths.tokenPath);
   const listenSpec = opts.listenSpec ?? resolveListenSpec({ paths });
-  requireTokenForBind(listenSpec, token);
+  const listenerPlan = planListener(listenSpec, token);
   const listenerHints = {
     transport: listenSpec.kind === "tcp" ? "ws" : "uds",
     tls: listenSpec.kind === "tcp" && Boolean(listenSpec.tls),
@@ -4122,29 +3934,31 @@ async function startDaemon(opts) {
       logRegistrations: !opts.silent
     });
   }
+  let transport;
   const handler = createDispatcher({
     startedAt,
     pipeline,
     channelManager,
     relayCoordinator,
-    getListener: () => listenerStatus ?? buildListenerStatus(listenSpec, null),
+    getListener: () => listenerStatus ?? describeToStatus(transport.describe(), listenSpec),
     reloadChannels
   });
   let server;
   let listener;
   try {
-    const transport = listenSpec.kind === "tcp" ? createWsServerTransport({
-      host: listenSpec.host,
-      port: listenSpec.port,
-      allowNonLoopback: listenSpec.insecure || Boolean(listenSpec.tls),
-      ...listenSpec.tls ? { tls: listenSpec.tls } : {}
-    }) : void 0;
+    const tcpPlan = listenerPlan.transport.kind === "tcp" ? listenerPlan.transport : null;
+    transport = tcpPlan ? createWsServerTransport({
+      host: tcpPlan.host,
+      port: tcpPlan.port,
+      allowNonLoopback: tcpPlan.allowNonLoopback,
+      ...tcpPlan.tls ? { tls: tcpPlan.tls } : {}
+    }) : createUdsServerTransport({ socketPath: paths.socketPath });
     server = await startControlServer({
       socketPath: paths.socketPath,
       token,
       startedAt,
       handler,
-      ...transport !== void 0 ? { transport } : {},
+      transport,
       onConnect: (ctx) => {
         connectionOpenedAt.set(ctx.connectionId, Date.now());
         trackGatewayTransportConnect({
@@ -4165,19 +3979,14 @@ async function startDaemon(opts) {
         pipeline.notifyConnectionClosed(ctx.connectionId);
       }
     });
-    if (listenSpec.kind === "tcp") {
-      const endpoint = transport.endpoint();
-      listener = {
-        kind: "tcp",
-        host: endpoint.host,
-        port: endpoint.port,
-        url: endpoint.url
-      };
-      listenerStatus = buildListenerStatus(listenSpec, endpoint.port);
-    } else {
-      listener = { kind: "uds", socketPath: listenSpec.socketPath };
-      listenerStatus = buildListenerStatus(listenSpec, null);
-    }
+    const description = transport.describe();
+    listenerStatus = describeToStatus(description, listenSpec);
+    listener = description.kind === "uds" ? { kind: "uds", socketPath: description.socketPath } : {
+      kind: "tcp",
+      host: description.host,
+      port: description.port,
+      url: description.url
+    };
   } catch (err) {
     lock.release();
     throw err;
@@ -4187,11 +3996,8 @@ async function startDaemon(opts) {
     process.stdout.write(`athena-gateway: ok pid=${pid} ${target}
 `);
   }
-  if (listenSpec.kind === "tcp" && listenSpec.insecure && !listenSpec.tls && !isLoopbackHost(listenSpec.host)) {
-    process.stderr.write(
-      `athena-gateway: WARNING --insecure is set on a non-loopback bind (${listenSpec.host}:${listenSpec.port}); token travels in plaintext. Use only behind TLS-terminating reverse proxy or Tailscale/WireGuard tunnel.
-`
-    );
+  for (const warning of listenerPlan.warnings) {
+    process.stderr.write(warning + "\n");
   }
   let stopping = false;
   const stop = async () => {