@hydra-acp/browser 0.1.0

package/dist/util/csrf.js

@@ -0,0 +1,57 @@
+export function buildSecurityContext(host, port, scheme, extraHosts) {
+    const hostsAndPorts = new Set();
+    const origins = new Set();
+    const portSuffix = `:${port}`;
+    const baseHosts = new Set([host, "127.0.0.1", "localhost", "[::1]"]);
+    for (const h of baseHosts) {
+        hostsAndPorts.add(`${h}${portSuffix}`.toLowerCase());
+        origins.add(`${scheme}://${h}${portSuffix}`.toLowerCase());
+    }
+    for (const h of extraHosts) {
+        const trimmed = h.trim();
+        if (!trimmed) {
+            continue;
+        }
+        const withPort = trimmed.includes(":") ? trimmed : `${trimmed}${portSuffix}`;
+        hostsAndPorts.add(withPort.toLowerCase());
+        origins.add(`${scheme}://${withPort}`.toLowerCase());
+    }
+    return { allowedHosts: hostsAndPorts, allowedOrigins: origins };
+}
+export function checkHost(ctx, headers) {
+    const host = headers.host;
+    if (typeof host !== "string") {
+        return false;
+    }
+    return ctx.allowedHosts.has(host.toLowerCase());
+}
+export function checkOrigin(ctx, headers) {
+    const origin = headers.origin;
+    if (typeof origin !== "string") {
+        // Same-origin browser navigations sometimes omit Origin; allow when
+        // Sec-Fetch-Site is present and same-origin/none.
+        return checkSecFetchSite(headers);
+    }
+    return ctx.allowedOrigins.has(origin.toLowerCase());
+}
+export function checkSecFetchSite(headers) {
+    const v = headers["sec-fetch-site"];
+    if (typeof v !== "string") {
+        // Older browsers / non-fetch clients don't send this; fall through.
+        return true;
+    }
+    return v === "same-origin" || v === "none";
+}
+export function checkStateChanging(ctx, headers) {
+    if (!checkHost(ctx, headers)) {
+        return { ok: false, reason: "host not allowed", status: 421 };
+    }
+    if (!checkOrigin(ctx, headers)) {
+        return { ok: false, reason: "origin not allowed", status: 403 };
+    }
+    if (!checkSecFetchSite(headers)) {
+        return { ok: false, reason: "cross-site request blocked", status: 403 };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=csrf.js.map

package/dist/util/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/util/csrf.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,IAAY,EACZ,MAAwB,EACxB,UAAoB;IAEpB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7E,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,MAAM,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,GAAoB,EACpB,OAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAoB,EACpB,OAA4B;IAE5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,oEAAoE;QACpE,kDAAkD;QAClD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,MAAM,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAoB,EACpB,OAA4B;IAE5B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/util/log.js

@@ -0,0 +1,46 @@
+let debugEnabled = false;
+export function setDebug(on) {
+    debugEnabled = on;
+}
+function emit(level, scope, args) {
+    const ts = new Date().toISOString();
+    const stream = level === "error" || level === "warn" ? process.stderr : process.stdout;
+    stream.write(`[${ts}] ${level} [${scope}] ${formatArgs(args)}\n`);
+}
+function formatArgs(args) {
+    return args
+        .map((a) => {
+        if (typeof a === "string") {
+            return a;
+        }
+        if (a instanceof Error) {
+            return a.stack ?? a.message;
+        }
+        try {
+            return JSON.stringify(a);
+        }
+        catch {
+            return String(a);
+        }
+    })
+        .join(" ");
+}
+export function logger(scope) {
+    return {
+        debug(...args) {
+            if (debugEnabled) {
+                emit("debug", scope, args);
+            }
+        },
+        info(...args) {
+            emit("info", scope, args);
+        },
+        warn(...args) {
+            emit("warn", scope, args);
+        },
+        error(...args) {
+            emit("error", scope, args);
+        },
+    };
+}
+//# sourceMappingURL=log.js.map

package/dist/util/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/util/log.ts"],"names":[],"mappings":"AAEA,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,MAAM,UAAU,QAAQ,CAAC,EAAW;IAClC,YAAY,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CAAC,KAAY,EAAE,KAAa,EAAE,IAAe;IACxD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,MAAM,GACV,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,KAAK,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO;QACL,KAAK,CAAC,GAAG,IAAe;YACtB,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,IAAe;YACrB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,GAAG,IAAe;YACrB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,GAAG,IAAe;YACtB,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/util/paths.js

@@ -0,0 +1,24 @@
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+const HOME_DIR = `${homedir()}/.hydra-acp-browser`;
+export function expandHome(p) {
+    if (p.startsWith("~/")) {
+        return resolve(homedir(), p.slice(2));
+    }
+    return p;
+}
+export const paths = {
+    home() {
+        return HOME_DIR;
+    },
+    authkeyFile() {
+        return `${HOME_DIR}/authkey`;
+    },
+    linkFile() {
+        return `${HOME_DIR}/link`;
+    },
+    configFile() {
+        return `${homedir()}/.hydra-acp-browser.conf`;
+    },
+};
+//# sourceMappingURL=paths.js.map

package/dist/util/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/util/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,QAAQ,GAAG,GAAG,OAAO,EAAE,qBAAqB,CAAC;AAEnD,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,IAAI;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,WAAW;QACT,OAAO,GAAG,QAAQ,UAAU,CAAC;IAC/B,CAAC;IACD,QAAQ;QACN,OAAO,GAAG,QAAQ,OAAO,CAAC;IAC5B,CAAC;IACD,UAAU;QACR,OAAO,GAAG,OAAO,EAAE,0BAA0B,CAAC;IAChD,CAAC;CACF,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@hydra-acp/browser",
+  "version": "0.1.0",
+  "description": "Browser-based UI for hydra-acp sessions.",
+  "license": "MIT",
+  "type": "module",
+  "homepage": "https://github.com/smagnuso/hydra-acp-browser#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/smagnuso/hydra-acp-browser.git"
+  },
+  "bugs": {
+    "url": "https://github.com/smagnuso/hydra-acp-browser/issues"
+  },
+  "keywords": [
+    "acp",
+    "hydra-acp",
+    "browser",
+    "spa",
+    "agent-client-protocol",
+    "claude",
+    "codex"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "main": "dist/index.js",
+  "bin": {
+    "hydra-acp-browser": "dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc -p . && tsc -p tsconfig.ui.json && node scripts/build-ui.mjs",
+    "build:server": "tsc -p .",
+    "build:ui": "tsc -p tsconfig.ui.json && node scripts/build-ui.mjs",
+    "watch": "tsc -p . --watch",
+    "start": "node dist/index.js",
+    "dev": "npm run build && node dist/index.js",
+    "test": "node --test --import tsx 'test/**/*.test.ts'",
+    "lint": "tsc -p . --noEmit && tsc -p tsconfig.ui.json --noEmit",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@fastify/cookie": "^11.0.2",
+    "fastify": "^5.0.0",
+    "ws": "^8.20.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@types/ws": "^8.18.1",
+    "esbuild": "^0.28.0",
+    "tsx": "^4.20.0",
+    "typescript": "^5.6.3"
+  }
+}