@evandu/super-pi 0.1.21 → 0.1.23

package/dist/server/ws-server.js

@@ -45,12 +45,14 @@ export class WsServer {
     catalogService;
     accessToken;
     rootDir;
+    onSocketClose;
     constructor(options) {
         this.broadcaster = options.broadcaster;
         this.commandHandler = options.commandHandler;
         this.catalogService = options.catalogService;
         this.accessToken = options.accessToken;
         this.rootDir = options.rootDir;
+        this.onSocketClose = options.onSocketClose;
         this.websocketServer = new WebSocketServer({ noServer: true });
         this.setupUpgrade(options.httpServer);
         this.setupConnectionHandling();
@@ -61,14 +63,45 @@ export class WsServer {
                 socket.destroy();
                 return;
             }
+            const origin = request.headers.origin;
+            if (origin) {
+                try {
+                    const parsed = new URL(origin);
+                    const host = request.headers.host;
+                    if (!host || parsed.host !== host || !["http:", "https:"].includes(parsed.protocol)) {
+                        socket.destroy();
+                        return;
+                    }
+                }
+                catch {
+                    socket.destroy();
+                    return;
+                }
+            }
             this.websocketServer.handleUpgrade(request, socket, head, (ws) => {
                 this.websocketServer.emit("connection", ws, request);
             });
         });
     }
     setupConnectionHandling() {
-        this.websocketServer.on("connection", (socket) => {
+        this.websocketServer.on("connection", (socket, request) => {
             this.broadcaster.register(socket);
+            /**
+             * The peer address, captured ONCE per connection rather than read per message.
+             *
+             * `socket._socket.remoteAddress` is the real TCP peer, but the terminal re-checks it on every
+             * command (`TerminalService.assertUsable`), so it has to be read where the underlying socket is
+             * still reachable. Reading it inside the message handler would reach for a private field on a
+             * `WebSocket` that may already be torn down, and the terminal is exactly the command family where
+             * a missing address must fail CLOSED rather than fall back to "allowed".
+             */
+            const remoteAddress = request.socket.remoteAddress;
+            /**
+             * Terminal session ids this socket has opened. Recorded on `terminal.open` rather than inferred
+             * from the service on close, because the service is shared across sockets and a close must kill
+             * only the shells belonging to the socket that went away.
+             */
+            const terminalSessionIds = new Set();
             socket.send(JSON.stringify({ type: "state", state: this.broadcaster.getStateSnapshot() }));
             if (this.rootDir) {
                 socket.send(JSON.stringify({ type: "server.version", version: checkDiskVersion(this.rootDir) }));
@@ -97,16 +130,23 @@ export class WsServer {
             socket.on("close", () => {
                 clearInterval(heartbeat);
                 this.broadcaster.unregister(socket);
+                // Kill the shells this socket started BEFORE clearing the set, so a close that races a final
+                // `terminal.open` cannot leak one. The set is per-connection, so another tab's terminal survives.
+                if (terminalSessionIds.size)
+                    this.onSocketClose?.([...terminalSessionIds]);
+                terminalSessionIds.clear();
             });
             socket.on("message", async (raw) => {
                 let command;
                 try {
                     command = JSON.parse(raw.toString());
+                    if (command.type === "terminal.open")
+                        terminalSessionIds.add(command.sessionId);
                     const entityId = await this.commandHandler.handleCommand(command, (event) => {
                         if (socket.readyState === WebSocket.OPEN) {
                             socket.send(JSON.stringify(event));
                         }
-                    });
+                    }, remoteAddress);
                     if (command.operationRequestId)
                         socket.send(JSON.stringify({ type: "operation.result", requestId: command.operationRequestId, ok: true, entityId }));
                 }

package/package.json

@@ -1,129 +1,2 @@
-{
-  "name": "@evandu/super-pi",
-  "version": "0.1.21",
-  "description": "Web control plane and companion for Pi",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "super-pi": "bin/super-pi.js"
-  },
-  "pi": {
-    "extensions": [
-      "./dist/extension.js"
-    ]
-  },
-  "files": [
-    "dist",
-    "agents",
-    "bin",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=22.19.0"
-  },
-  "scripts": {
-    "prepack": "npm run build",
-    "dev": "concurrently --kill-others-on-fail \"npm:dev:server\" \"npm:dev:client\"",
-    "dev:client": "vite --host 0.0.0.0",
-    "dev:server": "tsx watch src/server/index.ts",
-    "build": "tsc -b && vite build",
-    "start": "node dist/server/index.js",
-    "restart:server": "node scripts/restart-server.mjs",
-    "smoke": "npm run build && node scripts/smoke.mjs",
-    "check": "node scripts/run-check.mjs"
-  },
-  "check:logic": [
-    "scripts/dispatch-ancestry.test.mjs",
-    "scripts/dispatch-endpoint.test.mjs",
-    "scripts/dispatched-by.test.mjs",
-    "scripts/verify-source-text.test.mjs",
-    "scripts/runtime-extension-ui.test.mjs",
-    "scripts/agent-mechanism.test.mjs",
-    "scripts/agent-wiring.test.mjs",
-    "scripts/message-timestamps.test.mjs",
-    "scripts/pi-resolution.test.mjs",
-    "scripts/agent-real-pi.test.mjs",
-    "scripts/image-input-real-pi.test.mjs",
-    "scripts/image-upload.test.mjs",
-    "scripts/extension-ui-e2e.test.mjs",
-    "scripts/session-picker.test.mjs",
-    "scripts/workspace-cwd.test.mjs",
-    "scripts/subagents.test.mjs",
-    "scripts/subagent-noise.test.mjs",
-    "scripts/subagent-runs.test.mjs",
-    "scripts/conversation-reconcile.test.mjs",
-    "scripts/subagent-dispatch.test.mjs",
-    "scripts/workflow-plan.test.mjs",
-    "scripts/workflow-engine.test.mjs",
-    "scripts/workflow-endpoint.test.mjs",
-    "scripts/workflow-ui.test.mjs",
-    "scripts/agent-vis-records.test.mjs",
-    "scripts/queue-store.test.mjs",
-    "scripts/followup.test.mjs",
-    "scripts/md-render.test.mjs",
-    "scripts/revert-session-format.test.mjs",
-    "scripts/revert-session-file.test.mjs",
-    "scripts/revert-real-pi.test.mjs",
-    "scripts/revert-browser.test.mjs",
-    "scripts/bg-task.test.mjs",
-    "scripts/todo-tool.test.mjs",
-    "scripts/tool-calls.test.mjs",
-    "scripts/files-api.test.mjs",
-    "scripts/files-missing-path.test.mjs",
-    "scripts/task-tool.test.mjs",
-    "scripts/fork-server.test.mjs",
-    "scripts/styles-no-dangling.test.mjs",
-    "scripts/theme-no-hardcoded-colours.test.mjs",
-    "scripts/agent-config-regression.test.mjs",
-    "scripts/model-filter.test.mjs"
-  ],
-  "check:browser": [
-    "scripts/extension-ui-browser.test.mjs",
-    "scripts/inline-rename-blur.test.mjs",
-    "scripts/message-timestamps-browser.test.mjs",
-    "scripts/session-picker-browser.test.mjs",
-    "scripts/workspace-settings-browser.test.mjs",
-    "scripts/subagent-card-browser.test.mjs",
-    "scripts/workflow-browser.test.mjs",
-    "scripts/conversation-reconcile-browser.test.mjs",
-    "scripts/visual-defects-browser.test.mjs",
-    "scripts/agent-vis-card-browser.test.mjs",
-    "scripts/queue-dock.test.mjs",
-    "scripts/md-render-browser.test.mjs",
-    "scripts/right-sidebar-browser.test.mjs",
-    "scripts/sidebar-tools-browser.test.mjs",
-    "scripts/tool-call-blocks-browser.test.mjs",
-    "scripts/files-tab-browser.test.mjs",
-    "scripts/msg-tabs-browser.test.mjs",
-    "scripts/tabs-on-top-browser.test.mjs",
-    "scripts/subagent-source.test.mjs",
-    "scripts/fork-resize-browser.test.mjs",
-    "scripts/msg-bubbles.test.mjs",
-    "scripts/narrow-layout.test.mjs",
-    "scripts/scrollbar-style.test.mjs",
-    "scripts/theme-contrast.test.mjs",
-    "scripts/theme-switch-state.test.mjs",
-    "scripts/settings-window-structure.test.mjs",
-    "scripts/file-tab-selected-contrast.test.mjs",
-    "scripts/help-window.test.mjs",
-    "scripts/composer-regression-browser.test.mjs",
-    "scripts/workspace-picker-browser.test.mjs",
-    "scripts/optimistic-browser.test.mjs"
-  ],
-  "dependencies": {
-    "ws": "latest"
-  },
-  "devDependencies": {
-    "@types/node": "latest",
-    "@types/react": "latest",
-    "@types/react-dom": "latest",
-    "@types/ws": "latest",
-    "@vitejs/plugin-react": "latest",
-    "concurrently": "latest",
-    "react": "latest",
-    "react-dom": "latest",
-    "tsx": "latest",
-    "typescript": "latest",
-    "vite": "latest"
-  }
-}
+{   "name": "@evandu/super-pi",   "version": "0.1.23",   "description": "Web control plane and companion for Pi",   "license": "MIT",   "type": "module",   "bin": {     "super-pi": "bin/super-pi.js"   },   "pi": {     "extensions": [       "./dist/extension.js"     ]   },   "files": [     "dist",     "agents",     "bin",     "README.md"   ],   "engines": {     "node": ">=22.19.0"   },   "scripts": {     "prepack": "npm run build",     "dev": "concurrently --kill-others-on-fail \"npm:dev:server\" \"npm:dev:client\"",     "dev:client": "vite --host 0.0.0.0",     "dev:server": "tsx watch src/server/index.ts",     "build": "tsc -b && vite build",     "start": "node dist/server/index.js",     "restart:server": "node scripts/restart-server.mjs",     "smoke": "npm run build && node scripts/smoke.mjs",     "check": "node scripts/run-check.mjs"   },   "check:logic": [     "scripts/lan-access.test.mjs",     "scripts/terminal-pty.test.mjs",     "scripts/persistence-repository.test.mjs",     "scripts/sqlite-repository.test.mjs",     "scripts/dispatch-ancestry.test.mjs",     "scripts/dispatch-endpoint.test.mjs",     "scripts/dispatched-by.test.mjs",     "scripts/verify-source-text.test.mjs",     "scripts/runtime-extension-ui.test.mjs",     "scripts/agent-mechanism.test.mjs",     "scripts/agent-wiring.test.mjs",     "scripts/message-timestamps.test.mjs",     "scripts/pi-resolution.test.mjs",     "scripts/agent-real-pi.test.mjs",     "scripts/image-input-real-pi.test.mjs",     "scripts/image-upload.test.mjs",     "scripts/extension-ui-e2e.test.mjs",     "scripts/session-picker.test.mjs",     "scripts/workspace-cwd.test.mjs",     "scripts/subagents.test.mjs",     "scripts/subagent-noise.test.mjs",     "scripts/subagent-runs.test.mjs",     "scripts/conversation-reconcile.test.mjs",     "scripts/subagent-dispatch.test.mjs",     "scripts/workflow-plan.test.mjs",     "scripts/workflow-engine.test.mjs",     "scripts/workflow-endpoint.test.mjs",     "scripts/workflow-ui.test.mjs",     "scripts/agent-vis-records.test.mjs",     "scripts/queue-store.test.mjs",     "scripts/followup.test.mjs",     "scripts/md-render.test.mjs",     "scripts/revert-session-format.test.mjs",     "scripts/revert-session-file.test.mjs",     "scripts/revert-real-pi.test.mjs",     "scripts/revert-browser.test.mjs",     "scripts/bg-task.test.mjs",     "scripts/todo-tool.test.mjs",     "scripts/tool-calls.test.mjs",     "scripts/files-api.test.mjs",     "scripts/files-missing-path.test.mjs",     "scripts/task-tool.test.mjs",     "scripts/fork-server.test.mjs",     "scripts/styles-no-dangling.test.mjs",     "scripts/theme-no-hardcoded-colours.test.mjs",     "scripts/agent-config-regression.test.mjs",     "scripts/model-filter.test.mjs",     "scripts/active-memory.test.mjs"   ],   "check:browser": [     "scripts/extension-ui-browser.test.mjs",     "scripts/inline-rename-blur.test.mjs",     "scripts/message-timestamps-browser.test.mjs",     "scripts/session-picker-browser.test.mjs",     "scripts/workspace-settings-browser.test.mjs",     "scripts/subagent-card-browser.test.mjs",     "scripts/workflow-browser.test.mjs",     "scripts/conversation-reconcile-browser.test.mjs",     "scripts/visual-defects-browser.test.mjs",     "scripts/agent-vis-card-browser.test.mjs",     "scripts/queue-dock.test.mjs",     "scripts/md-render-browser.test.mjs",     "scripts/right-sidebar-browser.test.mjs",     "scripts/sidebar-tools-browser.test.mjs",     "scripts/tool-call-blocks-browser.test.mjs",     "scripts/files-tab-browser.test.mjs",     "scripts/msg-tabs-browser.test.mjs",     "scripts/tabs-on-top-browser.test.mjs",     "scripts/subagent-source.test.mjs",     "scripts/fork-resize-browser.test.mjs",     "scripts/msg-bubbles.test.mjs",     "scripts/narrow-layout.test.mjs",     "scripts/scrollbar-style.test.mjs",
+    "scripts/stream-tail-browser.test.mjs",     "scripts/theme-contrast.test.mjs",     "scripts/theme-switch-state.test.mjs",     "scripts/settings-window-structure.test.mjs",     "scripts/file-tab-selected-contrast.test.mjs",     "scripts/help-window.test.mjs",     "scripts/composer-regression-browser.test.mjs",     "scripts/workspace-picker-browser.test.mjs",     "scripts/optimistic-browser.test.mjs",     "scripts/active-memory-browser.test.mjs"   ],   "dependencies": {     "ws": "latest"   },   "optionalDependencies": {     "node-pty": "^1.2.0-beta.15"   },   "devDependencies": {     "@types/node": "latest",     "@types/react": "latest",     "@types/react-dom": "latest",     "@types/ws": "latest",     "@vitejs/plugin-react": "latest",     "concurrently": "latest",     "react": "latest",     "react-dom": "latest",     "tsx": "latest",     "typescript": "latest",     "vite": "latest"   } }