@haowjy/remote-workspace 0.1.2 → 0.1.3

package/README.md

@@ -9,7 +9,7 @@ Mobile-friendly read/upload web workspace for this repository.
 - Delete images from `.clipboard/` and `.playwright-mcp/` from the UI
 - Preview text files and images
 - Render Markdown with Mermaid diagrams
-- Hide and block access to dotfiles/dot-directories (for example `.env`, `.git`)
+- Hide and block access to configured path segments (always hides `.git`)
 - Dedicated collapsible `.clipboard` panel for upload + quick image viewing
 
 This app is intentionally **no text editing** to keep remote access simple and lower risk.
@@ -62,6 +62,7 @@ cd /path/to/your/repo && pnpm dev
 ```bash
 pnpm dev -- config /path/to/config
 pnpm dev -- port 18111
+pnpm dev -- always-hidden .git,.env,.secrets
 pnpm dev -- install
 pnpm dev -- no-serve
 pnpm dev -- password your-password
@@ -76,6 +77,7 @@ pnpm dev -- password your-password --funnel
 - `REMOTE_WS_MAX_UPLOAD_BYTES` (default `26214400`)
 - `REMOTE_WS_PASSWORD` (optional, enables HTTP Basic Auth when set)
 - `REMOTE_WS_CONFIG_FILE` (optional config file path override)
+- `REMOTE_WS_ALWAYS_HIDDEN` (optional comma-separated extra hidden path segments)
 - `REPO_ROOT` (injected by launcher script)
 
 Password config file format (default: repo root `.remote-workspace.conf`):
@@ -102,7 +104,7 @@ Config file selection precedence:
 - `POST /api/clipboard/upload` always writes to `REPO_ROOT/.clipboard`
 - `DELETE /api/clipboard/file?name=<filename>` deletes one image in `REPO_ROOT/.clipboard`
 - `.clipboard` panel uses dedicated clipboard endpoints (`/api/clipboard/upload`, `/api/clipboard/list`, `/api/clipboard/file`)
-- Main repository browser still blocks all hidden paths and gitignored paths
+- Main repository browser blocks always-hidden path segments (`.git` + optional configured segments)
 - Gitignored paths are hidden/blocked (for example `node_modules/`, build artifacts, local secrets)
 - Accepted upload types are images only (`png`, `jpg`, `jpeg`, `gif`, `webp`, `svg`, `bmp`, `heic`, `heif`, `avif`)
 - Clipboard panel supports both file picker and `Paste From Clipboard` button (when browser clipboard image API is available)

package/dist/launcher.js

@@ -14,6 +14,7 @@ Options:
   --repo-root <path> Repository root to expose (default: REPO_ROOT or cwd)
   --config <path>    Config file path (default uses precedence search)
   --port <port>      Listen port (default: REMOTE_WS_PORT or 18080)
+  --always-hidden <csv> Extra always-hidden path segments (comma-separated)
   --install          Force dependency install before start
   --skip-install     Skip install check even if node_modules is missing
   --no-serve         Skip tailscale serve setup
@@ -27,6 +28,7 @@ Examples:
   pnpm dev -- --repo-root /path/to/repo
   pnpm dev -- --config ~/.config/remote-workspace/config
   pnpm dev -- --port 18111
+  pnpm dev -- --always-hidden .git,.env,.secrets
   pnpm dev -- --password
   pnpm dev -- --password mypass --serve
   pnpm dev -- --password mypass --funnel
@@ -47,6 +49,23 @@ function parsePort(rawPort) {
     }
     return value;
 }
+function parseAlwaysHiddenCsv(rawValue, sourceLabel) {
+    const segments = rawValue
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    if (segments.length === 0) {
+        fail(`Invalid ${sourceLabel} value: provide at least one segment.`);
+    }
+    const normalizedSegments = new Set();
+    for (const segment of segments) {
+        if (segment.includes("/") || segment.includes("\\") || segment.includes("\u0000")) {
+            fail(`Invalid ${sourceLabel} segment "${segment}": segments must not contain path separators or null bytes.`);
+        }
+        normalizedSegments.add(segment);
+    }
+    return Array.from(normalizedSegments).join(",");
+}
 function parseConfigPassword(configFilePath) {
     if (!existsSync(configFilePath)) {
         return "";
@@ -100,6 +119,7 @@ function parseArgs(argv) {
     let workspacePassword = "";
     let configFileFromArg = null;
     let configFile = "";
+    let alwaysHidden = null;
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
         switch (arg) {
@@ -130,6 +150,15 @@ function parseArgs(argv) {
                 i += 1;
                 break;
             }
+            case "--always-hidden": {
+                const next = argv[i + 1];
+                if (!next || next.startsWith("--")) {
+                    fail("Missing value for --always-hidden.");
+                }
+                alwaysHidden = parseAlwaysHiddenCsv(next, "--always-hidden");
+                i += 1;
+                break;
+            }
             case "--install":
                 forceInstall = true;
                 break;
@@ -229,6 +258,7 @@ function parseArgs(argv) {
         passwordEnabled,
         workspacePassword,
         configFile,
+        alwaysHidden,
     };
 }
 function hasCommand(commandName) {
@@ -291,25 +321,33 @@ function main() {
     if (args.passwordEnabled) {
         console.log("Auth: Basic Auth enabled");
     }
+    if (args.alwaysHidden !== null) {
+        console.log(`Always hidden segments: .git + ${args.alwaysHidden}`);
+    }
+    else if (process.env.REMOTE_WS_ALWAYS_HIDDEN) {
+        console.log(`Always hidden segments: .git + ${process.env.REMOTE_WS_ALWAYS_HIDDEN}`);
+    }
+    else {
+        console.log("Always hidden segments: .git");
+    }
     console.log("");
+    const childEnv = {
+        ...process.env,
+        REPO_ROOT: args.repoRoot,
+        REMOTE_WS_PORT: String(args.port),
+        REMOTE_WS_PASSWORD: args.workspacePassword,
+    };
+    if (args.alwaysHidden !== null) {
+        childEnv.REMOTE_WS_ALWAYS_HIDDEN = args.alwaysHidden;
+    }
     const child = runBuiltServer
         ? spawn("node", [builtServerPath], {
             stdio: "inherit",
-            env: {
-                ...process.env,
-                REPO_ROOT: args.repoRoot,
-                REMOTE_WS_PORT: String(args.port),
-                REMOTE_WS_PASSWORD: args.workspacePassword,
-            },
+            env: childEnv,
         })
         : spawn("pnpm", ["--dir", appDir, "dev:server"], {
             stdio: "inherit",
-            env: {
-                ...process.env,
-                REPO_ROOT: args.repoRoot,
-                REMOTE_WS_PORT: String(args.port),
-                REMOTE_WS_PASSWORD: args.workspacePassword,
-            },
+            env: childEnv,
         });
     child.on("exit", (code, signal) => {
         if (signal) {

package/dist/server.js

@@ -23,6 +23,26 @@ function parseIntegerFromEnv(envName, fallbackValue, options) {
     }
     return parsedValue;
 }
+function assertValidHiddenSegment(segment, sourceName) {
+    if (segment.includes("/") || segment.includes("\\") || segment.includes("\u0000")) {
+        throw new Error(`Invalid ${sourceName} segment "${segment}": segments must not contain path separators or null bytes`);
+    }
+}
+function parseAlwaysHiddenSegments(rawValue) {
+    const segments = new Set([".git"]);
+    if (rawValue === undefined) {
+        return segments;
+    }
+    for (const rawSegment of rawValue.split(",")) {
+        const segment = rawSegment.trim();
+        if (!segment) {
+            continue;
+        }
+        assertValidHiddenSegment(segment, "REMOTE_WS_ALWAYS_HIDDEN");
+        segments.add(segment);
+    }
+    return segments;
+}
 const REPO_ROOT = path.resolve(process.env.REPO_ROOT ?? process.cwd());
 const HOST = "127.0.0.1";
 const PORT = parseIntegerFromEnv("REMOTE_WS_PORT", 18080, { min: 1, max: 65535 });
@@ -54,6 +74,7 @@ const ALLOWED_IMAGE_EXTENSIONS = new Set([
 const IMAGE_CACHE_CONTROL = "private, max-age=60, stale-while-revalidate=300";
 const METADATA_CACHE_CONTROL = "private, max-age=10, stale-while-revalidate=30";
 const BASIC_AUTH_PASSWORD = process.env.REMOTE_WS_PASSWORD ?? "";
+const ALWAYS_HIDDEN_SEGMENTS = parseAlwaysHiddenSegments(process.env.REMOTE_WS_ALWAYS_HIDDEN);
 const AUTH_WINDOW_MS = 10 * 60 * 1000;
 const AUTH_MAX_ATTEMPTS = 20;
 const AUTH_BLOCK_MS = 15 * 60 * 1000;
@@ -223,7 +244,9 @@ function isHiddenRepoRelativePath(repoRelativePath) {
     if (!repoRelativePath) {
         return false;
     }
-    return repoRelativePath.split("/").some((segment) => segment.startsWith("."));
+    return repoRelativePath
+        .split("/")
+        .some((segment) => ALWAYS_HIDDEN_SEGMENTS.has(segment));
 }
 function isBlockedHiddenRepoRelativePath(repoRelativePath) {
     return isHiddenRepoRelativePath(repoRelativePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haowjy/remote-workspace",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Mobile-friendly web workspace for SSH + tmux workflows.",
   "license": "MIT",
   "repository": {