@hyperlogue/r3 0.3.0 → 0.5.0

package/README.md

@@ -8,6 +8,11 @@
   <a href="https://www.npmjs.com/package/@hyperlogue/r3"><img src="https://img.shields.io/npm/v/@hyperlogue/r3?color=cb3837&amp;logo=npm&amp;label=%40hyperlogue%2Fr3" alt="npm version"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="license: MIT"></a>
   <img src="https://img.shields.io/badge/platform-macOS%20%7C%20Linux-lightgrey" alt="platforms: macOS, Linux">
+  <a href="https://hyperlogue.github.io/r3/demo/"><img src="https://img.shields.io/badge/live-demo-6164ff?logo=googlechrome&amp;logoColor=white" alt="live demo"></a>
+</p>
+
+<p align="center">
+  <a href="https://hyperlogue.github.io/r3/demo/"><b>▶&nbsp;Try the live demo</b></a> — the full UI, running entirely in your browser.
 </p>
 
 r3 is a review tool for the diffs and docs produced by your coding agents, running
@@ -133,5 +138,47 @@ its web UI from your local device through a tunnel. Set one up however you like:
 forward (`ssh -L 8791:localhost:8791 devbox`), `tailscale serve`, or a Cloudflare
 tunnel. **Never** bind `0.0.0.0`.
 
-Env: `R3_PORT` (default 8791), `R3_BIND` (default `127.0.0.1`), `R3_ALLOWED_HOSTS`
-(comma-separated exact Host names, never `*`), `R3_PUBLIC_URL`.
+**Exposing r3 beyond loopback turns on an optional login gate.** It's pure security
+hardening — **on by default whenever r3 is exposed** (a non-loopback bind, a
+non-loopback `R3_PUBLIC_URL`, or a non-loopback `R3_ALLOWED_HOSTS`), and **off on a plain
+`localhost:8791`** so the default setup needs
+no login at all. Over an SSH forward you browse `localhost`, so nothing changes. When
+it's on, create a token on the host and paste it into the browser once: the browser
+posts that **login token** to the daemon to mint an HttpOnly session cookie, and from
+then on holds only the cookie. (The login token is a scoped, revocable credential; the
+daemon's own per-user API token — the CLI's credential — is never handed to a browser
+when exposed.) Force it either way with `R3_REQUIRE_LOGIN=1|0`.
+
+> **Behind your own reverse proxy, set `R3_REQUIRE_LOGIN=1`.** r3 decides whether
+> to require a login from its own bind + advertised host — it can't see that
+> through a proxy that rewrites the `Host` header to `127.0.0.1` (nginx's default
+> `proxy_pass`), which reads as loopback-only and hands the browser the per-user
+> token. Setting `R3_PUBLIC_URL` to the public name fixes it too; `tailscale serve`
+> forwards the real host, so it's already covered.
+
+```sh
+# on the host:
+r3 config set publicUrl https://myhost.tailnet.ts.net    # allows that Host + requires login
+r3 restart                                                # config.json is read below env
+tailscale serve --bg 8791                                 # -> https://myhost.tailnet.ts.net/
+r3 auth create-token --label laptop                       # prints the token once — paste it in the browser
+```
+
+`r3 config set` **persists** these settings to `$XDG_CONFIG_HOME/r3/config.json`, so
+a restart — or a daemon lazily re-spawned by any CLI call from a shell that never
+exported the env vars — keeps serving remotely instead of silently dropping to
+loopback-only. (`export R3_PUBLIC_URL=…` still works for a one-off run; it just
+isn't remembered.) The store is a flat map — names `bind`, `port`, `publicUrl`,
+`allowedHosts` (comma list), `requireLogin`: `r3 config show` dumps the JSON,
+`r3 config get <name>` prints one value, `r3 config unset <name>` reverts one.
+
+`r3 auth list-tokens` / `r3 auth revoke-token <id> | --all` manage tokens (revoking
+kills its sessions immediately).
+
+Settings: `R3_PORT` (default 8791), `R3_BIND` (default `127.0.0.1`), `R3_ALLOWED_HOSTS`
+(comma-separated exact Host names, never `*`; a non-loopback name here also marks r3
+exposed), `R3_PUBLIC_URL` (a non-loopback host is auto-allowed **and** marks r3
+exposed, so this alone covers the common single-name `tailscale serve` case), `R3_REQUIRE_LOGIN`
+(`1`/`0` to force the login requirement on or off explicitly). Each resolves
+**env → `config.json` (via `r3 config set`) → default**, so env overrides the
+persisted file for a single run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperlogue/r3",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Review. Revise. Resolve. — a local-first review tool for AI-generated code and docs. Runs the matching prebuilt native r3 binary (shipped as a per-platform optional dependency); works with `bunx @hyperlogue/r3` and `npx @hyperlogue/r3`.",
   "license": "MIT",
   "type": "module",
@@ -17,10 +17,10 @@
     "launch.mjs"
   ],
   "optionalDependencies": {
-    "@hyperlogue/r3-darwin-arm64": "0.3.0",
-    "@hyperlogue/r3-darwin-x64": "0.3.0",
-    "@hyperlogue/r3-linux-x64": "0.3.0",
-    "@hyperlogue/r3-linux-arm64": "0.3.0"
+    "@hyperlogue/r3-darwin-arm64": "0.5.0",
+    "@hyperlogue/r3-darwin-x64": "0.5.0",
+    "@hyperlogue/r3-linux-x64": "0.5.0",
+    "@hyperlogue/r3-linux-arm64": "0.5.0"
   },
   "engines": {
     "node": ">=18"