@hydra-acp/browser 0.1.0

package/dist/index.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+import { writeFileSync, chmodSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { loadConfig } from "./config.js";
+import { HydraRestClient } from "./hydra/client.js";
+import { ensureAuthkey, rotateAuthkey } from "./server/auth.js";
+import { buildContext, createServer } from "./server/http.js";
+import { registerSessionRoutes } from "./server/routes-sessions.js";
+import { registerAgentRoutes } from "./server/routes-agents.js";
+import { registerFileRoutes } from "./server/routes-files.js";
+import { registerRootRoutes } from "./server/routes-root.js";
+import { attachWsBridge } from "./server/ws-bridge.js";
+import { logger, setDebug } from "./util/log.js";
+const log = logger("main");
+function ensureLoopbackOrTls(host, hasTls) {
+    const isLoopback = host === "127.0.0.1" ||
+        host === "::1" ||
+        host === "localhost" ||
+        host === "[::1]";
+    if (!isLoopback && !hasTls) {
+        throw new Error(`Refusing to bind to non-loopback host ${host} without TLS configured. Set BROWSER_TLS_CERT and BROWSER_TLS_KEY in ~/.hydra-acp-browser.conf.`);
+    }
+}
+async function main(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        printHelp();
+        return;
+    }
+    const rotate = argv.includes("--rotate-authkey");
+    const config = loadConfig();
+    setDebug(config.debug);
+    ensureLoopbackOrTls(config.browserHost, !!config.tls);
+    const authkey = rotate
+        ? rotateAuthkey(config.authkeyFile)
+        : ensureAuthkey(config.authkeyFile);
+    const rest = new HydraRestClient(config.hydraDaemonUrl, config.hydraToken);
+    const ctx = buildContext(config, rest, authkey);
+    const app = createServer(ctx);
+    registerRootRoutes(app, ctx);
+    registerSessionRoutes(app, ctx);
+    registerAgentRoutes(app, ctx);
+    registerFileRoutes(app, ctx);
+    await app.listen({ host: config.browserHost, port: config.browserPort });
+    attachWsBridge(app.server, ctx);
+    const scheme = config.tls ? "https" : "http";
+    const url = `${scheme}://${displayHost(config.browserHost)}:${config.browserPort}/?authkey=${authkey}`;
+    writeLinkFile(config.linkFile, url);
+    log.info(`hydra daemon: ${config.hydraDaemonUrl}`);
+    log.info(`listening on ${scheme}://${config.browserHost}:${config.browserPort}`);
+    log.info(`Open: ${url}`);
+    const shutdown = async (signal) => {
+        log.info(`received ${signal}, shutting down`);
+        try {
+            await app.close();
+        }
+        catch (err) {
+            log.warn(`shutdown error: ${err.message}`);
+        }
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+}
+function displayHost(host) {
+    if (host === "0.0.0.0") {
+        return "127.0.0.1";
+    }
+    return host;
+}
+function writeLinkFile(path, url) {
+    try {
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        writeFileSync(path, url + "\n", { mode: 0o600 });
+        chmodSync(path, 0o600);
+    }
+    catch (err) {
+        log.warn(`unable to write link file ${path}: ${err.message}`);
+    }
+}
+function printHelp() {
+    process.stdout.write(`hydra-acp-browser — web UI extension for hydra-acp
+
+Usage:
+  hydra-acp-browser                Start the server.
+  hydra-acp-browser --rotate-authkey
+                                   Generate a fresh authkey, kicking existing
+                                   browsers, and exit after starting.
+  hydra-acp-browser --help         Show this message.
+
+Config: ~/.hydra-acp-browser.conf (KEY=VALUE).
+When run as an hydra-acp extension, HYDRA_ACP_DAEMON_URL / HYDRA_ACP_TOKEN /
+HYDRA_ACP_WS_URL are injected automatically.
+`);
+}
+main(process.argv.slice(2)).catch((err) => {
+    log.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAE3B,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAe;IACxD,MAAM,UAAU,GACd,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,OAAO,CAAC;IACnB,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,iGAAiG,CAC/I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvB,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC;QACnC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAE9B,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE7B,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzE,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,MAAM,MAAM,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,aAAa,OAAO,EAAE,CAAC;IACvG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,GAAG,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,IAAI,CAAC,gBAAgB,MAAM,MAAM,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAEzB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACxC,GAAG,CAAC,IAAI,CAAC,YAAY,MAAM,iBAAiB,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,GAAW;IAC9C,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,aAAa,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;;;;;;;;;;;;CAYH,CACE,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/server/auth.js

@@ -0,0 +1,104 @@
+import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { dirname } from "node:path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { logger } from "../util/log.js";
+const log = logger("auth");
+export const COOKIE_NAME = "hb_authkey";
+export const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+export function ensureAuthkey(path) {
+    try {
+        const existing = readFileSync(path, "utf8").trim();
+        if (existing.length >= 32) {
+            return existing;
+        }
+        log.warn(`existing authkey at ${path} too short; rotating`);
+    }
+    catch {
+        // Doesn't exist yet or unreadable; we'll create it.
+    }
+    return rotateAuthkey(path);
+}
+export function rotateAuthkey(path) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const key = randomBytes(32).toString("hex");
+    writeFileSync(path, key + "\n", { mode: 0o600 });
+    chmodSync(path, 0o600);
+    log.info(`authkey written to ${path}`);
+    return key;
+}
+export function constantTimeKeyMatch(a, b) {
+    if (typeof a !== "string" || typeof b !== "string") {
+        return false;
+    }
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length) {
+        return false;
+    }
+    return timingSafeEqual(aBuf, bBuf);
+}
+// Simple per-IP rate limiter for failed auth attempts. 10 failures in 15 min
+// triggers a temporary block.
+export class AuthRateLimiter {
+    entries = new Map();
+    maxFails = 10;
+    windowMs = 15 * 60 * 1000;
+    isBlocked(ip) {
+        const e = this.entries.get(ip);
+        if (!e) {
+            return false;
+        }
+        if (Date.now() - e.windowStart > this.windowMs) {
+            this.entries.delete(ip);
+            return false;
+        }
+        return e.fails >= this.maxFails;
+    }
+    recordFailure(ip) {
+        const now = Date.now();
+        const e = this.entries.get(ip);
+        if (!e || now - e.windowStart > this.windowMs) {
+            this.entries.set(ip, { fails: 1, windowStart: now });
+            return;
+        }
+        e.fails += 1;
+    }
+    recordSuccess(ip) {
+        this.entries.delete(ip);
+    }
+}
+export function buildSetCookie(value, opts) {
+    const parts = [
+        `${COOKIE_NAME}=${value}`,
+        "HttpOnly",
+        "SameSite=Strict",
+        "Path=/",
+        `Max-Age=${opts.maxAgeSeconds}`,
+    ];
+    if (opts.secure) {
+        parts.push("Secure");
+    }
+    return parts.join("; ");
+}
+export function buildClearCookie() {
+    return `${COOKIE_NAME}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`;
+}
+export function parseCookies(header) {
+    const out = new Map();
+    if (!header) {
+        return out;
+    }
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq === -1) {
+            continue;
+        }
+        const k = part.slice(0, eq).trim();
+        const v = part.slice(eq + 1).trim();
+        if (k.length > 0) {
+            out.set(k, v);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAE3B,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,sBAAsB,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAS,EAAE,CAAS;IACvD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAOD,6EAA6E;AAC7E,8BAA8B;AAC9B,MAAM,OAAO,eAAe;IAClB,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9B,QAAQ,GAAG,EAAE,CAAC;IACd,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE3C,SAAS,CAAC,EAAU;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACf,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,IAAgD;IAEhD,MAAM,KAAK,GAAG;QACZ,GAAG,WAAW,IAAI,KAAK,EAAE;QACzB,UAAU;QACV,iBAAiB;QACjB,QAAQ;QACR,WAAW,IAAI,CAAC,aAAa,EAAE;KAChC,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,GAAG,WAAW,iDAAiD,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/server/http.js

@@ -0,0 +1,128 @@
+import { readFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import Fastify from "fastify";
+import { logger } from "../util/log.js";
+import { buildSecurityContext, checkStateChanging } from "../util/csrf.js";
+import { AuthRateLimiter, COOKIE_NAME, buildSetCookie, constantTimeKeyMatch, parseCookies, } from "./auth.js";
+const log = logger("http");
+export function createServer(ctx) {
+    const httpsOptions = ctx.config.tls
+        ? {
+            cert: readFileSync(ctx.config.tls.cert),
+            key: readFileSync(ctx.config.tls.key),
+        }
+        : undefined;
+    const app = Fastify({
+        logger: false,
+        https: httpsOptions ?? null,
+    });
+    app.addHook("onRequest", async (request, reply) => {
+        const nonce = randomBytes(16).toString("base64");
+        request.cspNonce = nonce;
+        setSecurityHeaders(reply, nonce, ctx.scheme === "https");
+    });
+    app.addHook("onRequest", async (request, reply) => {
+        if (request.routeOptions.config?.skipCsrf) {
+            return;
+        }
+        const headers = request.headers;
+        const result = checkStateChanging(ctx.security, headers);
+        if (!result.ok) {
+            log.warn(`csrf reject ${request.method} ${request.url} ${result.reason}`);
+            reply.code(result.status).send({ error: result.reason });
+        }
+    });
+    app.addHook("onRequest", async (request, reply) => {
+        if (request.routeOptions.config?.skipAuth) {
+            return;
+        }
+        if (!authenticate(request, reply, ctx)) {
+            return reply;
+        }
+    });
+    return app;
+}
+function setSecurityHeaders(reply, nonce, secure) {
+    const csp = [
+        "default-src 'self'",
+        `script-src 'self' 'nonce-${nonce}'`,
+        `style-src 'self' 'nonce-${nonce}'`,
+        "img-src 'self' data:",
+        "connect-src 'self'",
+        "frame-ancestors 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+    ].join("; ");
+    reply.header("Content-Security-Policy", csp);
+    reply.header("X-Frame-Options", "DENY");
+    reply.header("X-Content-Type-Options", "nosniff");
+    reply.header("Referrer-Policy", "no-referrer");
+    reply.header("Cache-Control", "no-store");
+    if (secure) {
+        reply.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+}
+// Returns true if the request is authenticated; otherwise it has already
+// written a response and the caller should stop.
+function authenticate(request, reply, ctx) {
+    const ip = request.ip ?? "unknown";
+    if (ctx.rateLimiter.isBlocked(ip)) {
+        reply.code(429).send({ error: "rate limited" });
+        return false;
+    }
+    const cookies = parseCookies(request.headers.cookie);
+    const provided = cookies.get(COOKIE_NAME);
+    if (!provided) {
+        ctx.rateLimiter.recordFailure(ip);
+        reply.code(401).send({ error: "unauthorized" });
+        return false;
+    }
+    if (!constantTimeKeyMatch(provided, ctx.authkey)) {
+        ctx.rateLimiter.recordFailure(ip);
+        reply.code(401).send({ error: "unauthorized" });
+        return false;
+    }
+    ctx.rateLimiter.recordSuccess(ip);
+    return true;
+}
+// Check + set cookie for a `?authkey=…` query against the root path. Returns
+// "redirect" (cookie set, caller should 302), "ok" (already authenticated,
+// caller serves the SPA), or "deny" (caller serves the login instructions).
+export function processRootAuth(request, reply, ctx) {
+    const ip = request.ip ?? "unknown";
+    if (ctx.rateLimiter.isBlocked(ip)) {
+        reply.code(429).send({ error: "rate limited" });
+        return "deny";
+    }
+    const query = (request.query ?? {});
+    if (typeof query.authkey === "string") {
+        if (constantTimeKeyMatch(query.authkey, ctx.authkey)) {
+            ctx.rateLimiter.recordSuccess(ip);
+            reply.header("Set-Cookie", buildSetCookie(ctx.authkey, {
+                secure: ctx.scheme === "https",
+                maxAgeSeconds: 60 * 60 * 24 * 30,
+            }));
+            return "redirect";
+        }
+        ctx.rateLimiter.recordFailure(ip);
+        return "deny";
+    }
+    const cookies = parseCookies(request.headers.cookie);
+    const provided = cookies.get(COOKIE_NAME);
+    if (provided && constantTimeKeyMatch(provided, ctx.authkey)) {
+        return "ok";
+    }
+    return "deny";
+}
+export function buildContext(config, rest, authkey) {
+    const scheme = config.tls ? "https" : "http";
+    return {
+        config,
+        rest,
+        authkey,
+        security: buildSecurityContext(config.browserHost, config.browserPort, scheme, config.allowedHosts),
+        rateLimiter: new AuthRateLimiter(),
+        scheme,
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/server/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,OAAyE,MAAM,SAAS,CAAC;AAGhG,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAwB,MAAM,iBAAiB,CAAC;AACjG,OAAO,EACL,eAAe,EACf,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,YAAY,GACb,MAAM,WAAW,CAAC;AAEnB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAwB3B,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG;QACjC,CAAC,CAAC;YACE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACvC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;SACtC;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,YAAY,IAAI,IAAI;KAC5B,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;QACzB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAmB,EACnB,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GAAG;QACV,oBAAoB;QACpB,4BAA4B,KAAK,GAAG;QACpC,2BAA2B,KAAK,GAAG;QACnC,sBAAsB;QACtB,oBAAoB;QACpB,wBAAwB;QACxB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC7C,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACxC,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAClD,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC/C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,MAAM,CACV,2BAA2B,EAC3B,qCAAqC,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,iDAAiD;AACjD,SAAS,YAAY,CACnB,OAAuB,EACvB,KAAmB,EACnB,GAAkB;IAElB,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;IACnC,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAC7B,OAAuB,EACvB,KAAmB,EACnB,GAAkB;IAElB,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;IACnC,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAyB,CAAC;IAC5D,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACtC,IAAI,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAClC,KAAK,CAAC,MAAM,CACV,YAAY,EACZ,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,OAAO;gBAC9B,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aACjC,CAAC,CACH,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,IAAqB,EACrB,OAAe;IAEf,MAAM,MAAM,GAAqB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO;QACL,MAAM;QACN,IAAI;QACJ,OAAO;QACP,QAAQ,EAAE,oBAAoB,CAC5B,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,WAAW,EAClB,MAAM,EACN,MAAM,CAAC,YAAY,CACpB;QACD,WAAW,EAAE,IAAI,eAAe,EAAE;QAClC,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/server/routes-agents.js

@@ -0,0 +1,14 @@
+import { HydraRestError } from "../hydra/client.js";
+export function registerAgentRoutes(app, ctx) {
+    app.get("/api/agents", async (_request, reply) => {
+        try {
+            const result = await ctx.rest.listAgents();
+            reply.send(result);
+        }
+        catch (err) {
+            const status = err instanceof HydraRestError ? err.status : 502;
+            reply.code(status).send({ error: err.message });
+        }
+    });
+}
+//# sourceMappingURL=routes-agents.js.map

package/dist/server/routes-agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-agents.js","sourceRoot":"","sources":["../../src/server/routes-agents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,GAAkB;IAElB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes-files.js

@@ -0,0 +1,170 @@
+import { promises as fsp } from "node:fs";
+import { resolve, sep } from "node:path";
+// Resolve a request `path` (relative to the session's cwd) and verify it is
+// inside the cwd after symlink resolution. Returns the realpath if safe,
+// otherwise throws PathScopeError.
+export async function resolveScopedPath(cwd, requested) {
+    const cwdReal = await fsp.realpath(cwd);
+    const cwdReq = requested.length === 0 ? "." : requested;
+    const target = resolve(cwdReal, cwdReq);
+    let real;
+    try {
+        real = await fsp.realpath(target);
+    }
+    catch {
+        real = target;
+    }
+    const cwdWithSep = cwdReal.endsWith(sep) ? cwdReal : cwdReal + sep;
+    if (real !== cwdReal && !real.startsWith(cwdWithSep)) {
+        throw new PathScopeError(`path escapes cwd: requested=${requested} resolved=${real} cwd=${cwdReal}`);
+    }
+    return real;
+}
+export class PathScopeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PathScopeError";
+    }
+}
+async function lookupSessionCwd(ctx, sessionId) {
+    const result = await ctx.rest.listSessions({ all: true });
+    const match = result.sessions.find((s) => s.sessionId === sessionId);
+    return match?.cwd;
+}
+export function registerFileRoutes(app, ctx) {
+    app.post("/api/files/list", async (request, reply) => {
+        const body = (request.body ?? {});
+        if (!body.sessionId) {
+            reply.code(400).send({ error: "sessionId required" });
+            return;
+        }
+        const cwd = await lookupSessionCwd(ctx, body.sessionId);
+        if (!cwd) {
+            reply.code(404).send({ error: "session not found" });
+            return;
+        }
+        let target;
+        try {
+            target = await resolveScopedPath(cwd, body.path ?? "");
+        }
+        catch (err) {
+            if (err instanceof PathScopeError) {
+                reply.code(400).send({ error: "path out of scope" });
+                return;
+            }
+            reply.code(500).send({ error: err.message });
+            return;
+        }
+        let stat;
+        try {
+            stat = await fsp.stat(target);
+        }
+        catch (err) {
+            reply.code(404).send({ error: err.message });
+            return;
+        }
+        if (!stat.isDirectory()) {
+            reply.code(400).send({ error: "not a directory" });
+            return;
+        }
+        const dirents = await fsp.readdir(target, { withFileTypes: true });
+        const entries = [];
+        for (const d of dirents) {
+            const childPath = resolve(target, d.name);
+            let s;
+            try {
+                s = await fsp.stat(childPath);
+            }
+            catch {
+                continue;
+            }
+            let kind = "other";
+            if (s.isDirectory()) {
+                kind = "dir";
+            }
+            else if (s.isFile()) {
+                kind = "file";
+            }
+            entries.push({
+                name: d.name,
+                kind,
+                size: s.size,
+                mtimeMs: s.mtimeMs,
+            });
+        }
+        entries.sort((a, b) => {
+            if (a.kind !== b.kind) {
+                return a.kind === "dir" ? -1 : 1;
+            }
+            return a.name.localeCompare(b.name);
+        });
+        reply.send({ cwd, path: body.path ?? "", entries });
+    });
+    app.post("/api/files/read", async (request, reply) => {
+        const body = (request.body ?? {});
+        if (!body.sessionId) {
+            reply.code(400).send({ error: "sessionId required" });
+            return;
+        }
+        if (!body.path) {
+            reply.code(400).send({ error: "path required" });
+            return;
+        }
+        const cwd = await lookupSessionCwd(ctx, body.sessionId);
+        if (!cwd) {
+            reply.code(404).send({ error: "session not found" });
+            return;
+        }
+        let target;
+        try {
+            target = await resolveScopedPath(cwd, body.path);
+        }
+        catch (err) {
+            if (err instanceof PathScopeError) {
+                reply.code(400).send({ error: "path out of scope" });
+                return;
+            }
+            reply.code(500).send({ error: err.message });
+            return;
+        }
+        let stat;
+        try {
+            stat = await fsp.stat(target);
+        }
+        catch (err) {
+            reply.code(404).send({ error: err.message });
+            return;
+        }
+        if (!stat.isFile()) {
+            reply.code(400).send({ error: "not a file" });
+            return;
+        }
+        const max = Math.min(body.maxBytes ?? ctx.config.fileMaxBytes, ctx.config.fileMaxBytes);
+        if (stat.size > max) {
+            reply.code(413).send({ error: `file larger than ${max} bytes` });
+            return;
+        }
+        const buf = await fsp.readFile(target);
+        if (containsBinary(buf)) {
+            reply.code(415).send({ error: "binary file" });
+            return;
+        }
+        reply.send({
+            path: body.path,
+            size: stat.size,
+            mtimeMs: stat.mtimeMs,
+            content: buf.toString("utf8"),
+        });
+    });
+}
+// Heuristic: presence of a NUL byte in the first 8 KiB indicates binary.
+function containsBinary(buf) {
+    const limit = Math.min(buf.length, 8192);
+    for (let i = 0; i < limit; i++) {
+        if (buf[i] === 0) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=routes-files.js.map

package/dist/server/routes-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-files.js","sourceRoot":"","sources":["../../src/server/routes-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAsBzC,4EAA4E;AAC5E,yEAAyE;AACzE,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,SAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;IACnE,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,cAAc,CACtB,+BAA+B,SAAS,aAAa,IAAI,QAAQ,OAAO,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,KAAK,UAAU,gBAAgB,CAC7B,GAAkB,EAClB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,GAAG,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAkB;IAElB,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAa,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC;YACN,IAAI,CAAC;gBACH,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,GAAsB,OAAO,CAAC;YACtC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,GAAG,KAAK,CAAC;YACf,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtB,IAAI,GAAG,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI;gBACJ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtB,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAa,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,EACxC,GAAG,CAAC,MAAM,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,GAAG,QAAQ,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/routes-root.js

@@ -0,0 +1,67 @@
+import { promises as fsp } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { processRootAuth } from "./http.js";
+const here = dirname(fileURLToPath(import.meta.url));
+// In dist layout: dist/server/routes-root.js → ../ui/index.html
+const UI_DIR = resolve(here, "..", "ui");
+let cachedHtml;
+async function loadHtml() {
+    if (cachedHtml) {
+        return cachedHtml;
+    }
+    const path = resolve(UI_DIR, "index.html");
+    cachedHtml = await fsp.readFile(path, "utf8");
+    return cachedHtml;
+}
+export function registerRootRoutes(app, ctx) {
+    app.get("/", {
+        config: { skipAuth: true, skipCsrf: true },
+    }, async (request, reply) => {
+        const result = processRootAuth(request, reply, ctx);
+        if (result === "redirect") {
+            reply.code(302).header("Location", "/").send();
+            return;
+        }
+        reply.header("Content-Type", "text/html; charset=utf-8");
+        if (result === "deny") {
+            reply
+                .code(401)
+                .send(loginPage(request.cspNonce ?? ""));
+            return;
+        }
+        const html = await loadHtml();
+        reply.send(injectNonce(html, request.cspNonce ?? ""));
+    });
+    app.get("/favicon.ico", { config: { skipAuth: true, skipCsrf: true } }, async (_request, reply) => {
+        reply.code(204).send();
+    });
+}
+// Replace the literal placeholder __CSP_NONCE__ in the HTML template with
+// the per-request nonce.
+function injectNonce(html, nonce) {
+    return html.replaceAll("__CSP_NONCE__", nonce);
+}
+function loginPage(nonce) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>hydra-acp-browser</title>
+<style nonce="${nonce}">
+:root { color-scheme: dark; font-family: system-ui, sans-serif; }
+body { background: #0e1116; color: #d6deeb; margin: 0; padding: 4rem 1.5rem; max-width: 38rem; margin-inline: auto; line-height: 1.5; }
+h1 { font-size: 1.25rem; margin: 0 0 1rem; }
+code { background: #1c2230; padding: 0.1rem 0.4rem; border-radius: 4px; }
+.note { color: #7c8aa8; font-size: 0.95rem; }
+</style>
+</head>
+<body>
+<h1>hydra-acp-browser</h1>
+<p>Authentication required.</p>
+<p class="note">Open the URL printed by the server (it contains <code>?authkey=…</code>). The link is also written to <code>~/.hydra-acp-browser/link</code>.</p>
+</body>
+</html>`;
+}
+//# sourceMappingURL=routes-root.js.map

package/dist/server/routes-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes-root.js","sourceRoot":"","sources":["../../src/server/routes-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAsB,MAAM,WAAW,CAAC;AAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErD,gEAAgE;AAChE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAEzC,IAAI,UAA8B,CAAC;AAEnC,KAAK,UAAU,QAAQ;IACrB,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,UAAU,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAkB;IAElB,GAAG,CAAC,GAAG,CACL,GAAG,EACH;QACE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC3C,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,KAAK;iBACF,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,cAAc,EACd,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAC9C,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,yBAAyB;AACzB,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO;;;;;;gBAMO,KAAK;;;;;;;;;;;;;QAab,CAAC;AACT,CAAC"}