@hyperlogue/r3 0.2.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +33 -1
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -133,5 +133,37 @@ its web UI from your local device through a tunnel. Set one up however you like:
|
|
|
133
133
|
forward (`ssh -L 8791:localhost:8791 devbox`), `tailscale serve`, or a Cloudflare
|
|
134
134
|
tunnel. **Never** bind `0.0.0.0`.
|
|
135
135
|
|
|
136
|
+
**Exposing r3 beyond loopback turns on an optional login gate.** It's pure security
|
|
137
|
+
hardening — **on by default whenever r3 is exposed** (a non-loopback bind, a
|
|
138
|
+
non-loopback `R3_PUBLIC_URL`, or a non-loopback `R3_ALLOWED_HOSTS`), and **off on a plain
|
|
139
|
+
`localhost:8791`** so the default setup needs
|
|
140
|
+
no login at all. Over an SSH forward you browse `localhost`, so nothing changes. When
|
|
141
|
+
it's on, create a token on the host and paste it into the browser once: the browser
|
|
142
|
+
posts that **login token** to the daemon to mint an HttpOnly session cookie, and from
|
|
143
|
+
then on holds only the cookie. (The login token is a scoped, revocable credential; the
|
|
144
|
+
daemon's own per-user API token — the CLI's credential — is never handed to a browser
|
|
145
|
+
when exposed.) Force it either way with `R3_REQUIRE_LOGIN=1|0`.
|
|
146
|
+
|
|
147
|
+
> **Behind your own reverse proxy, set `R3_REQUIRE_LOGIN=1`.** r3 decides whether
|
|
148
|
+
> to require a login from its own bind + advertised host — it can't see that
|
|
149
|
+
> through a proxy that rewrites the `Host` header to `127.0.0.1` (nginx's default
|
|
150
|
+
> `proxy_pass`), which reads as loopback-only and hands the browser the per-user
|
|
151
|
+
> token. Setting `R3_PUBLIC_URL` to the public name fixes it too; `tailscale serve`
|
|
152
|
+
> forwards the real host, so it's already covered.
|
|
153
|
+
|
|
154
|
+
```sh
|
|
155
|
+
# on the host:
|
|
156
|
+
export R3_PUBLIC_URL=https://myhost.tailnet.ts.net # allows that Host + requires login
|
|
157
|
+
r3 restart
|
|
158
|
+
tailscale serve --bg 8791 # -> https://myhost.tailnet.ts.net/
|
|
159
|
+
r3 auth create-token --label laptop # prints the token once — paste it in the browser
|
|
160
|
+
```
|
|
161
|
+
|
|
162
|
+
`r3 auth list-tokens` / `r3 auth revoke-token <id> | --all` manage them (revoking
|
|
163
|
+
kills its sessions immediately).
|
|
164
|
+
|
|
136
165
|
Env: `R3_PORT` (default 8791), `R3_BIND` (default `127.0.0.1`), `R3_ALLOWED_HOSTS`
|
|
137
|
-
(comma-separated exact Host names, never
|
|
166
|
+
(comma-separated exact Host names, never `*`; a non-loopback name here also marks r3
|
|
167
|
+
exposed), `R3_PUBLIC_URL` (a non-loopback host is auto-allowed **and** marks r3
|
|
168
|
+
exposed, so this alone covers the common single-name `tailscale serve` case), `R3_REQUIRE_LOGIN`
|
|
169
|
+
(`1`/`0` to force the login requirement on or off explicitly).
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hyperlogue/r3",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "Review. Revise. Resolve. — a local-first review tool for AI-generated code and docs. Runs the matching prebuilt native r3 binary (shipped as a per-platform optional dependency); works with `bunx @hyperlogue/r3` and `npx @hyperlogue/r3`.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -17,10 +17,10 @@
|
|
|
17
17
|
"launch.mjs"
|
|
18
18
|
],
|
|
19
19
|
"optionalDependencies": {
|
|
20
|
-
"@hyperlogue/r3-darwin-arm64": "0.
|
|
21
|
-
"@hyperlogue/r3-darwin-x64": "0.
|
|
22
|
-
"@hyperlogue/r3-linux-x64": "0.
|
|
23
|
-
"@hyperlogue/r3-linux-arm64": "0.
|
|
20
|
+
"@hyperlogue/r3-darwin-arm64": "0.4.0",
|
|
21
|
+
"@hyperlogue/r3-darwin-x64": "0.4.0",
|
|
22
|
+
"@hyperlogue/r3-linux-x64": "0.4.0",
|
|
23
|
+
"@hyperlogue/r3-linux-arm64": "0.4.0"
|
|
24
24
|
},
|
|
25
25
|
"engines": {
|
|
26
26
|
"node": ">=18"
|