@dylanpiercey/work 0.0.138 → 0.0.139

package/README.md

@@ -68,6 +68,29 @@ Everything (pages, API, and the `/term` websockets) serves from the single
 app port, so route the whole hostname to it. Set
 `WORK_ALLOWED_HOSTS=your.domain` so the dev server accepts the hostname.
 
+**Opening workspace ports remotely.** The port chips in the sidebar link to
+`http://<host>:<port>`, which only works where the machine is reachable
+directly. Through a tunnel, route a wildcard hostname to the app port as
+well and work proxies it — HTTP and websockets, so HMR works — to
+`localhost:<port>`. Two hostname shapes are accepted; `WORK_PORT_HOSTS`
+picks which one the chips link to:
+
+- `sub` (default): `https://3000.work.example.com`. Needs a wildcard
+  `*.work.example.com` route and a certificate that covers it (your own
+  reverse proxy with a DNS-01 wildcard; Cloudflare only with Advanced
+  Certificate Manager, since Universal SSL covers one label).
+- `dash`: `https://3000-work.example.com`. One label under the zone, so a
+  Cloudflare Tunnel works on the free plan. DNS wildcards match a whole
+  label, so the tunnel's public hostname is `*.example.com` pointing at
+  the app port, with an Access application on the same wildcard so the
+  ports sit behind the same login as the app. Work ignores hostnames that
+  do not start with a port, so other names under the zone are unaffected.
+
+Only loopback ports on the work machine are reachable, behind the same
+auth as the app. API writes and the terminal websockets refuse a foreign
+`Origin`, so a page a workspace serves cannot drive work with the shared
+login cookie.
+
 > **Upgrading from the two-port layout:** older setups routed `/term/*` to a
 > separate terminal port (7172). That port no longer exists — remove the
 > `/term` rule from your tunnel/proxy config and send all traffic to the app
@@ -109,6 +132,7 @@ targeting that branch.
 | `WORK_DATA_DIR`           | `~/.local/share/work` | sqlite db and server state                        |
 | `WORK_APP_PORT`           | `7171`                | HTTP server (app, assets, and `/term` websockets) |
 | `WORK_ALLOWED_HOSTS`      | —                     | Extra dev-server hostnames (comma-separated)      |
+| `WORK_PORT_HOSTS`         | `sub`                 | Port-chip hostname shape: `sub` / `dash` (see above) |
 | `WORK_USER` / `WORK_HOST` | current user/host     | Branch-name prefix parts                          |
 | `WORK_BRANCH_PREFIX`      | `<user>-<host>`       | Whole branch-name prefix, overriding the parts    |
 

package/bin/work.mjs

@@ -612,9 +612,13 @@ function allowScriptsArgs() {
 
 async function update() {
   log("updating @dylanpiercey/work");
+  // `--prefer-online`: npm serves `latest` from a cached packument for a
+  // few minutes after a publish, so an update right behind a release
+  // reinstalled the version already running.
   sh("npm", [
     "install",
     "-g",
+    "--prefer-online",
     ...allowScriptsArgs(),
     "@dylanpiercey/work@latest",
   ]);

package/dist/{_NJRrlQSH.js → _B9jB3eUh.js}

@@ -1968,14 +1968,14 @@ function repoLabel(fullName) {
 	return fullName;
 }
 var toastKind = {
-	error: "_bk",
-	warn: "_bl",
-	info: "_bm"
+	error: "_bi",
+	warn: "_bj",
+	info: "_bk"
 };
 var toastTitle = {
-	error: "_bn",
-	warn: "_bo",
-	info: "_bp"
+	error: "_bl",
+	warn: "_bm",
+	info: "_bn"
 };
 //#endregion
 //#region src/styles/tokens.css.ts
@@ -2021,18 +2021,18 @@ var toast_default = _template("F", (input) => {
 	const kind = inputKind || "error";
 	const placement = inputPlacement || "float";
 	const placementClass = {
-		float: "_bi",
-		inline: "_bj"
+		float: "_bg",
+		inline: "_bh"
 	}[placement];
 	_html(`<div${_attr_class([
-		"_bh",
+		"_bf",
 		toastKind[kind],
 		placementClass,
 		inputClass
 	])} role=${kind === "error" ? "alert" : "status"}${_attrs_partial(htmlInput, {
 		class: 1,
 		role: 1
-	}, "a", $scope0_id, "div")}><div${_attr_class("_bq")}>`);
+	}, "a", $scope0_id, "div")}><div${_attr_class("_bo")}>`);
 	_if(() => {
 		if (title) {
 			const $scope1_id = _scope_id();
@@ -2044,7 +2044,7 @@ var toast_default = _template("F", (input) => {
 	_if(() => {
 		if (content) {
 			const $scope2_id = _scope_id();
-			_html(`<div${_attr_class("_br")}>`);
+			_html(`<div${_attr_class("_bp")}>`);
 			_dynamic_tag($scope2_id, "b", content, {}, 0, 0, $sg__input_content);
 			_html("</div>");
 			$si__input_content && writeScope($scope2_id, { _: _scope_with_id($scope0_id) });
@@ -2055,7 +2055,7 @@ var toast_default = _template("F", (input) => {
 	_if(() => {
 		if (action || onDismiss) {
 			const $scope3_id = _scope_id();
-			_html(`<div${_attr_class(["_bs", action && "_bt"])}>`);
+			_html(`<div${_attr_class(["_bq", action && "_br"])}>`);
 			_if(() => {
 				if (action) {
 					const $scope4_id = _scope_id();
@@ -2067,7 +2067,7 @@ var toast_default = _template("F", (input) => {
 			_if(() => {
 				if (onDismiss) {
 					const $scope5_id = _scope_id();
-					_html(`<button${_attr_class([iconBtnRow, "_bu"])} type=button title=Dismiss aria-label=Dismiss>`);
+					_html(`<button${_attr_class([iconBtnRow, "_bs"])} type=button title=Dismiss aria-label=Dismiss>`);
 					icon_xmark_default({ size: 14 });
 					_html(`</button>${_el_resume($scope5_id, "a")}`);
 					_script($scope5_id, "F0");
@@ -2182,8 +2182,8 @@ function theme() {
 function setTheme(mode) {
 	set("theme", mode === "system" ? null : mode);
 }
-var sectionCount = "_by _L _M";
-var row = "_bJ _bB";
+var sectionCount = "_bH _L _M";
+var row = "_bS _bK";
 var iconBtn = "_3 _j";
 //#endregion
 //#region src/tags/icons/icon-refresh.marko
@@ -2329,8 +2329,8 @@ var icon_sidebar_default = _template("mb", (input) => {
 	});
 	_serialize_if($scope0_reason, 0) && writeScope($scope0_id, { a: _existing_scope($childScope) });
 });
-var findInput = "_gE _l";
-var findIconBtn = "_gH _j";
+var findInput = "_gI _l";
+var findIconBtn = "_gL _j";
 //#endregion
 //#region src/tags/icons/icon-arrow-down.marko
 var icon_arrow_down_default = _template("K", (input) => {

package/dist/_BNGMa45b.js

@@ -0,0 +1,2 @@
+import { f as notifySessionsChanged } from "./_BlEiBDGk.js";
+export { notifySessionsChanged };

package/dist/{_BJg54Xa1.js → _BlEiBDGk.js}

@@ -30,7 +30,13 @@ var config = {
 	},
 	/** HTTP server port — the app, static assets, and /term websockets all
 	* serve from this single port (src/entry.ts). */
-	appPort: Number(process.env.WORK_APP_PORT || 7171)
+	appPort: Number(process.env.WORK_APP_PORT || 7171),
+	/** How a workspace port is named in a hostname the app proxies
+	* (server/port-proxy.ts): `sub` is `3000.work.example.com`, `dash` is
+	* `3000-work.example.com`. The server accepts both; this only picks
+	* which one the port chips link to. `dash` stays one label under the
+	* zone, which is what a free Cloudflare certificate covers. */
+	portHosts: process.env.WORK_PORT_HOSTS === "dash" ? "dash" : "sub"
 };
 fs.mkdirSync(config.dataDir, { recursive: true });
 //#endregion
@@ -6573,7 +6579,7 @@ function publishChange(sessionId) {
 	const row = get("SELECT workspace_id FROM sessions WHERE id = ?", sessionId);
 	if (row?.workspace_id) {
 		const workspaceId = row.workspace_id;
-		import("./_B3qThpAM.js").then((m) => m.notifySessionsChanged(workspaceId));
+		import("./_BNGMa45b.js").then((m) => m.notifySessionsChanged(workspaceId));
 		return;
 	}
 	publish("sessions.changed");