@dylanpiercey/work 0.0.201 → 0.0.202

package/README.md

@@ -62,11 +62,33 @@ work-source                # status
 ./scripts/update.sh       # later: pull latest, rebuild, restart
 ```
 
-To reach it from other devices, put it behind something that terminates TLS
-and authenticates — e.g. a Cloudflare Tunnel with Access, or Tailscale.
-Everything (pages, API, and the `/term` websockets) serves from the single
-app port, so route the whole hostname to it. Set
-`WORK_ALLOWED_HOSTS=your.domain` so the dev server accepts the hostname.
+### Access
+
+work has no login of its own — it runs agents and terminals as you, so it
+answers **this machine only** by default (it listens on `127.0.0.1`). To
+reach it from other devices, put it behind something that terminates TLS
+and authenticates — a reverse proxy with a login, a Cloudflare Tunnel with
+Access, `tailscale serve` — and tell work about it:
+
+- `WORK_ALLOWED_HOSTS=work.example.com` — the name(s) the proxy serves
+  (their workspace-port subdomains are included). work refuses any other
+  name, which is what stops a web page elsewhere from pointing its own name
+  at your machine (DNS rebinding).
+- If the proxy runs on **another machine**, work has to listen on the
+  network for it: `WORK_LISTEN=0.0.0.0` and
+  `WORK_TRUSTED_PROXIES=<proxy ip>` (IPs or CIDRs, comma-separated). work
+  then answers that proxy and this machine, and refuses everyone else on the
+  network, who would otherwise walk around the proxy's login.
+  `WORK_TRUSTED_PROXIES=*` answers any machine — only on a network you
+  trust as it is.
+
+Set them when installing (`WORK_ALLOWED_HOSTS=… WORK_TRUSTED_PROXIES=…
+WORK_LISTEN=0.0.0.0 work setup`); `work setup` keeps them in the service
+from then on. A refused request gets a page saying which setting it needs.
+Installs from before this default keep listening on every interface, and
+other machines see that page until they are configured. Everything (pages,
+API, and the `/term` websockets) serves from the single app port, so route
+the whole hostname to it.
 
 **Opening workspace ports remotely.** The port chips in the sidebar link to
 `http://<host>:<port>`, which only works where the machine is reachable
@@ -131,7 +153,9 @@ targeting that branch.
 | `WORK_ROOT`               | `~/work`              | Workspaces root (+ `.cache` bare repos)              |
 | `WORK_DATA_DIR`           | `~/.local/share/work` | sqlite db and server state                           |
 | `WORK_APP_PORT`           | `7171`                | HTTP server (app, assets, and `/term` websockets)    |
-| `WORK_ALLOWED_HOSTS`      | —                     | Extra dev-server hostnames (comma-separated)         |
+| `WORK_ALLOWED_HOSTS`      | —                     | Hostnames a proxy serves it under (see Access)       |
+| `WORK_LISTEN`             | `127.0.0.1`           | Listen address (`0.0.0.0` for every interface)       |
+| `WORK_TRUSTED_PROXIES`    | —                     | Proxy IPs/CIDRs allowed in from the network (`*`)    |
 | `WORK_PORT_HOSTS`         | `sub`                 | Port-chip hostname shape: `sub` / `dash` (see above) |
 | `WORK_USER` / `WORK_HOST` | current user/host     | Branch-name prefix parts                             |
 | `WORK_BRANCH_PREFIX`      | `<user>-<host>`       | Whole branch-name prefix, overriding the parts       |

package/bin/work.mjs

@@ -645,9 +645,22 @@ async function doctorCmd() {
   }
   if (args.includes("--json")) return console.log(JSON.stringify(d, null, 2));
   console.log(formatDoctor(d));
+  const access = accessNote();
+  if (access) warn(access);
   if (!d.ready) process.exit(1);
 }
 
+/** Said when the service listens beyond this machine with nothing declared
+ * to answer there: every other machine is refused (server/access.ts), which
+ * is safe, but likely not what the listening was for. */
+function accessNote() {
+  const env = installedServiceEnv();
+  const listen = env.WORK_LISTEN;
+  if (!listen || listen === "127.0.0.1" || listen === "::1") return null;
+  if (env.WORK_TRUSTED_PROXIES) return null;
+  return `work listens on ${listen} but WORK_TRUSTED_PROXIES is unset, so other machines are refused. Reaching it from elsewhere goes through an auth proxy: WORK_TRUSTED_PROXIES=<proxy ip> WORK_ALLOWED_HOSTS=<its hostname> work setup (or WORK_LISTEN= to go back to this machine only).`;
+}
+
 /**
  * Bring the machine to "ready": required tools, then optional ones (each
  * non-fatal). GitHub sign-in and agent CLIs are app jobs (Settings) — this
@@ -730,6 +743,15 @@ function serviceFile() {
  * first update silently resets the port, root and data dir to defaults —
  * and a lost WORK_DATA_DIR points the server at an empty database, making
  * every workspace look like it vanished. */
+/** work.socket's ListenStream for WORK_LISTEN: this machine only unless
+ * set, every interface for `0.0.0.0` / `::` / `*`, else that address. */
+function listenStream(listen, port) {
+  if (!listen) return `127.0.0.1:${port}`;
+  if (listen === "0.0.0.0" || listen === "::" || listen === "*")
+    return String(port);
+  return listen.includes(":") ? `[${listen}]:${port}` : `${listen}:${port}`;
+}
+
 function installedServiceEnv() {
   const installed = {};
   try {
@@ -766,12 +788,22 @@ function serviceEnv() {
     "WORK_ROOT",
     "WORK_DATA_DIR",
     "WORK_ALLOWED_HOSTS",
+    "WORK_LISTEN",
+    "WORK_TRUSTED_PROXIES",
   ]) {
     // `in` rather than a truthy check, so `WORK_ALLOWED_HOSTS= work setup`
     // can deliberately clear a setting the installed service still carries.
     const value = key in process.env ? process.env[key] : installed[key];
     if (value) env[key] = value;
   }
+  // A new install listens on this machine only. One installed before that
+  // default listened on every interface, and other machines (a phone, the
+  // proxy in front of it) may be reaching it that way: keep it listening,
+  // so they get work's page naming the setting to add (server/access.ts)
+  // rather than a connection that is simply refused.
+  if (!("WORK_LISTEN" in process.env) && !installed.WORK_LISTEN) {
+    if (fs.existsSync(serviceFile())) env.WORK_LISTEN = "0.0.0.0";
+  }
   // entry.ts prefers PORT, so carrying WORK_APP_PORT forward without this
   // would leave the service on the default port anyway.
   env.PORT = env.WORK_APP_PORT || appPort;
@@ -1052,7 +1084,7 @@ ${envXml}
 Description=work, agentic dev workspace GUI (its port, held across restarts)
 
 [Socket]
-ListenStream=${port}
+ListenStream=${listenStream(serviceEnv().WORK_LISTEN, port)}
 
 [Install]
 WantedBy=sockets.target

package/dist/_7W8iLTql.js

@@ -0,0 +1,2 @@
+import { h as notifySessionsChanged } from "./_B9FeLAO5.js";
+export { notifySessionsChanged };