@kaitranntt/ccs 7.78.0-dev.1 → 7.78.0-dev.10

package/dist/web-server/index.js

@@ -46,6 +46,10 @@ const proxy_target_resolver_1 = require("../cliproxy/proxy/proxy-target-resolver
 const sync_1 = require("../cliproxy/sync");
 const aggregator_1 = require("./usage/aggregator");
 const logging_1 = require("../services/logging");
+const config_dashboard_host_1 = require("../commands/config-dashboard-host");
+function getListenHost(options) {
+    return options.host || config_dashboard_host_1.DEFAULT_DASHBOARD_HOST;
+}
 const logger = (0, logging_1.createLogger)('web-server');
 /**
  * Start Express server with WebSocket support
@@ -54,8 +58,7 @@ async function startServer(options) {
     const app = (0, express_1.default)();
     const server = http_1.default.createServer(app);
     const wss = new ws_1.WebSocketServer({
-        server,
-        path: '/ws',
+        noServer: true,
         maxPayload: 1024 * 1024, // 1MB hard limit to prevent DoS
         perMessageDeflate: false, // Prevent zip bomb attacks
     });
@@ -70,7 +73,8 @@ async function startServer(options) {
     });
     app.use(request_logging_middleware_1.requestLoggingMiddleware);
     // Session middleware (for dashboard auth)
-    app.use((0, auth_middleware_1.createSessionMiddleware)());
+    const sessionMiddleware = (0, auth_middleware_1.createSessionMiddleware)();
+    app.use(sessionMiddleware);
     // Auth middleware (protects API routes when enabled)
     app.use(auth_middleware_1.authMiddleware);
     // CLIProxy local reverse proxy (avoids cross-origin issues in Docker)
@@ -111,6 +115,33 @@ async function startServer(options) {
             res.sendFile(path_1.default.join(staticDir, 'index.html'));
         });
     }
+    server.on('upgrade', (request, socket, head) => {
+        const pathname = getUpgradePathname(request.url);
+        if (!pathname) {
+            rejectWebSocketUpgrade(socket, 400, 'Invalid WebSocket upgrade request');
+            return;
+        }
+        if (pathname !== '/ws') {
+            if (!options.dev) {
+                rejectWebSocketUpgrade(socket, 404, 'WebSocket endpoint not found');
+            }
+            return;
+        }
+        const response = new http_1.default.ServerResponse(request);
+        sessionMiddleware(request, response, (error) => {
+            if (error) {
+                rejectWebSocketUpgrade(socket, 500, 'WebSocket session validation failed');
+                return;
+            }
+            if (!(0, auth_middleware_1.isDashboardWebSocketUpgradeAllowed)(request)) {
+                rejectWebSocketUpgrade(socket, (0, auth_middleware_1.getDashboardWebSocketRejectionStatus)(request), 'WebSocket access denied');
+                return;
+            }
+            wss.handleUpgrade(request, socket, head, (ws) => {
+                wss.emit('connection', ws, request);
+            });
+        });
+    });
     // WebSocket connection handler + file watcher
     const { cleanup: wsCleanup } = (0, websocket_1.setupWebSocket)(wss);
     // Start auto-sync watcher (if enabled in config)
@@ -130,11 +161,12 @@ async function startServer(options) {
     };
     // Start listening
     return new Promise((resolve, reject) => {
+        const listenHost = getListenHost(options);
         const onError = (error) => {
             logger.error('server.listen_failed', 'Dashboard server failed to start', {
                 code: error.code || 'unknown',
                 message: error.message,
-                host: options.host || null,
+                host: listenHost,
                 port: options.port,
             });
             cleanup();
@@ -143,8 +175,18 @@ async function startServer(options) {
         server.once('error', onError);
         const onListening = () => {
             server.off('error', onError);
+            try {
+                assertSafeDashboardBind(options, server.address());
+            }
+            catch (error) {
+                cleanup();
+                server.close(() => {
+                    reject(error instanceof Error ? error : new Error(String(error)));
+                });
+                return;
+            }
             logger.info('server.listening', 'Dashboard server listening', {
-                host: options.host || '0.0.0.0',
+                host: listenHost,
                 port: options.port,
                 dev: Boolean(options.dev),
             });
@@ -153,11 +195,7 @@ async function startServer(options) {
             resolve({ server, wss, cleanup });
         };
         try {
-            if (options.host) {
-                server.listen(options.port, options.host, onListening);
-                return;
-            }
-            server.listen(options.port, onListening);
+            server.listen(options.port, listenHost, onListening);
         }
         catch (error) {
             server.off('error', onError);
@@ -167,22 +205,44 @@ async function startServer(options) {
     });
 }
 exports.startServer = startServer;
-function formatListenError(error, options) {
-    if (error.code === 'EADDRINUSE' && options.host) {
-        return `Unable to bind ${options.host}:${options.port}; the address may be unavailable or the port may already be in use`;
+function getUpgradePathname(requestUrl) {
+    try {
+        return new URL(requestUrl ?? '/', 'http://localhost').pathname;
+    }
+    catch {
+        return null;
     }
+}
+function rejectWebSocketUpgrade(socket, statusCode, message) {
+    socket.write(`HTTP/1.1 ${statusCode} ${message}\r\n` +
+        'Connection: close\r\n' +
+        'Content-Type: text/plain; charset=utf-8\r\n' +
+        `Content-Length: ${Buffer.byteLength(message)}\r\n` +
+        '\r\n' +
+        message);
+    socket.destroy();
+}
+function assertSafeDashboardBind(options, address) {
+    const listenHost = getListenHost(options);
+    if (!(0, config_dashboard_host_1.isLoopbackHost)(listenHost) || typeof address === 'string' || !address) {
+        return;
+    }
+    if ((0, config_dashboard_host_1.isLoopbackHost)(address.address)) {
+        return;
+    }
+    throw new Error(`Dashboard host ${listenHost} resolved to non-loopback address ${address.address}; pass --host explicitly to allow network exposure.`);
+}
+function formatListenError(error, options) {
+    const listenHost = getListenHost(options);
     if (error.code === 'EADDRINUSE') {
-        return `Port ${options.port} is already in use`;
+        return `Unable to bind ${listenHost}:${options.port}; the address may be unavailable or the port may already be in use`;
     }
-    if (error.code === 'EADDRNOTAVAIL' && options.host) {
-        return `Cannot bind to ${options.host}:${options.port} on this machine`;
+    if (error.code === 'EADDRNOTAVAIL') {
+        return `Cannot bind to ${listenHost}:${options.port} on this machine`;
     }
     if (error.code === 'EACCES') {
         return `Permission denied while binding to port ${options.port}`;
     }
-    if (options.host) {
-        return `Cannot bind to ${options.host}:${options.port}: ${error.message}`;
-    }
-    return error.message;
+    return `Cannot bind to ${listenHost}:${options.port}: ${error.message}`;
 }
 //# sourceMappingURL=index.js.map

package/dist/web-server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/web-server/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,sDAA8B;AAC9B,gDAAwB;AACxB,gDAAwB;AACxB,2BAAqC;AACrC,2CAA6C;AAC7C,kEAAuF;AACvF,wFAAmF;AACnF,4FAA6F;AAC7F,mFAAyE;AACzE,2CAA6E;AAC7E,mDAA6D;AAC7D,iDAAmD;AAenD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,YAAY,CAAC,CAAC;AAE1C;;GAEG;AACI,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,MAAM,MAAM,GAAG,cAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,oBAAe,CAAC;QAC9B,MAAM;QACN,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,IAAI,GAAG,IAAI,EAAE,gCAAgC;QACzD,iBAAiB,EAAE,KAAK,EAAE,2BAA2B;KACtD,CAAC,CAAC;IAEH,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CACL,CACE,GAA+C,EAC/C,IAAqB,EACrB,GAAqB,EACrB,IAA0B,EAC1B,EAAE;QACF,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,qDAAwB,CAAC,CAAC;IAElC,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CAAC,IAAA,yCAAuB,GAAE,CAAC,CAAC;IAEnC,qDAAqD;IACrD,GAAG,CAAC,GAAG,CAAC,gCAAc,CAAC,CAAC;IAExB,sEAAsE;IACtE,MAAM,kBAAkB,GAAG,CAAC,wDAAa,+BAA+B,GAAC,CAAC,CAAC,OAAO,CAAC;IACnF,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;IAEnD,gCAAgC;IAChC,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE3B,gCAAgC;IAChC,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,iBAAiB,GAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAErC,6BAA6B;IAC7B,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IAEzC,yBAAyB;IACzB,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEnC,wCAAwC;IACxC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,wDAAa,MAAM,GAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,IAAI,EAAE,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;YACtC,MAAM,EAAE;gBACN,cAAc,EAAE,IAAI;gBACpB,8DAA8D;gBAC9D,GAAG,EAAE,EAAE,MAAM,EAAE;aAChB;YACD,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,+CAA+C;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEnC,0DAA0D;QAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8CAA8C;IAC9C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAA,0BAAc,EAAC,GAAG,CAAC,CAAC;IAEnD,iDAAiD;IACjD,IAAA,2BAAoB,GAAE,CAAC;IAEvB,IAAI,CAAC,IAAA,sCAAc,GAAE,CAAC,QAAQ,EAAE,CAAC;QAC/B,KAAK,IAAA,mDAA0B,GAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,oCAAoC,EAAE;gBAC/E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,SAAS,EAAE,CAAC;QACZ,IAAA,0BAAmB,GAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAA,oCAAuB,GAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,kBAAkB;IAClB,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,OAAO,GAAG,CAAC,KAA4B,EAAE,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,kCAAkC,EAAE;gBACvE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;gBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE9B,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,EAAE;gBAC5D,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;gBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAC;YACH,6DAA6D;YAC7D,uEAAuE;YACvE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAA8B,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AA3ID,kCA2IC;AAED,SAAS,iBAAiB,CAAC,KAA4B,EAAE,OAAsB;IAC7E,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,kBAAkB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,oEAAoE,CAAC;IAC5H,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,QAAQ,OAAO,CAAC,IAAI,oBAAoB,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,kBAAkB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,kBAAkB,CAAC;IAC1E,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,2CAA2C,OAAO,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,kBAAkB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/web-server/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,sDAA8B;AAC9B,gDAAwB;AAExB,gDAAwB;AACxB,2BAAqC;AACrC,2CAA6C;AAC7C,kEAKsC;AACtC,wFAAmF;AACnF,4FAA6F;AAC7F,mFAAyE;AACzE,2CAA6E;AAC7E,mDAA6D;AAC7D,iDAAmD;AACnD,6EAA2F;AAe3F,SAAS,aAAa,CAAC,OAAsB;IAC3C,OAAO,OAAO,CAAC,IAAI,IAAI,8CAAsB,CAAC;AAChD,CAAC;AAED,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,YAAY,CAAC,CAAC;AAE1C;;GAEG;AACI,KAAK,UAAU,WAAW,CAAC,OAAsB;IACtD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,MAAM,MAAM,GAAG,cAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,oBAAe,CAAC;QAC9B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI,GAAG,IAAI,EAAE,gCAAgC;QACzD,iBAAiB,EAAE,KAAK,EAAE,2BAA2B;KACtD,CAAC,CAAC;IAEH,0DAA0D;IAC1D,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CACL,CACE,GAA+C,EAC/C,IAAqB,EACrB,GAAqB,EACrB,IAA0B,EAC1B,EAAE;QACF,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CACF,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,qDAAwB,CAAC,CAAC;IAElC,0CAA0C;IAC1C,MAAM,iBAAiB,GAAG,IAAA,yCAAuB,GAAE,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAE3B,qDAAqD;IACrD,GAAG,CAAC,GAAG,CAAC,gCAAc,CAAC,CAAC;IAExB,sEAAsE;IACtE,MAAM,kBAAkB,GAAG,CAAC,wDAAa,+BAA+B,GAAC,CAAC,CAAC,OAAO,CAAC;IACnF,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;IAEnD,gCAAgC;IAChC,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAE3B,gCAAgC;IAChC,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,iBAAiB,GAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAErC,6BAA6B;IAC7B,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,mBAAmB,GAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;IAEzC,yBAAyB;IACzB,MAAM,EAAE,WAAW,EAAE,GAAG,wDAAa,gBAAgB,GAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEnC,wCAAwC;IACxC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,wDAAa,MAAM,GAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC;YAClC,IAAI,EAAE,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;YACtC,MAAM,EAAE;gBACN,cAAc,EAAE,IAAI;gBACpB,8DAA8D;gBAC9D,GAAG,EAAE,EAAE,MAAM,EAAE;aAChB;YACD,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,+CAA+C;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEnC,0DAA0D;QAC1D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,QAAQ,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,cAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,iBAAiB,CACf,OAA0B,EAC1B,QAA4B,EAC5B,CAAC,KAAe,EAAE,EAAE;YAClB,IAAI,KAAK,EAAE,CAAC;gBACV,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAA,oDAAkC,EAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,sBAAsB,CACpB,MAAM,EACN,IAAA,sDAAoC,EAAC,OAAO,CAAC,EAC7C,yBAAyB,CAC1B,CAAC;gBACF,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC9C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAA,0BAAc,EAAC,GAAG,CAAC,CAAC;IAEnD,iDAAiD;IACjD,IAAA,2BAAoB,GAAE,CAAC;IAEvB,IAAI,CAAC,IAAA,sCAAc,GAAE,CAAC,QAAQ,EAAE,CAAC;QAC/B,KAAK,IAAA,mDAA0B,GAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,oCAAoC,EAAE;gBAC/E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,SAAS,EAAE,CAAC;QACZ,IAAA,0BAAmB,GAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACtC,IAAA,oCAAuB,GAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,kBAAkB;IAClB,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,CAAC,KAA4B,EAAE,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,kCAAkC,EAAE;gBACvE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;gBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE9B,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBAChB,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpE,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,EAAE;gBAC5D,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;aAC1B,CAAC,CAAC;YACH,6DAA6D;YAC7D,uEAAuE;YACvE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,KAA8B,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAzLD,kCAyLC;AAED,SAAS,kBAAkB,CAAC,UAA8B;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAuD,EACvD,UAAuC,EACvC,OAAe;IAEf,MAAM,CAAC,KAAK,CACV,YAAY,UAAU,IAAI,OAAO,MAAM;QACrC,uBAAuB;QACvB,6CAA6C;QAC7C,mBAAmB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM;QACnD,MAAM;QACN,OAAO,CACV,CAAC;IACF,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAsB,EACtB,OAAoC;IAEpC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,IAAA,sCAAc,EAAC,UAAU,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,IAAI,IAAA,sCAAc,EAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CACb,kBAAkB,UAAU,qCAAqC,OAAO,CAAC,OAAO,qDAAqD,CACtI,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA4B,EAAE,OAAsB;IAC7E,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,kBAAkB,UAAU,IAAI,OAAO,CAAC,IAAI,oEAAoE,CAAC;IAC1H,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,kBAAkB,UAAU,IAAI,OAAO,CAAC,IAAI,kBAAkB,CAAC;IACxE,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,2CAA2C,OAAO,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,kBAAkB,UAAU,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;AAC1E,CAAC"}

package/dist/web-server/middleware/auth-middleware.d.ts

@@ -2,6 +2,8 @@
  * Dashboard Authentication Middleware
  * Session-based auth with httpOnly cookies for CCS dashboard.
  */
+/// <reference types="node" />
+import type { IncomingMessage } from 'http';
 import type { NextFunction, Request, Response } from 'express';
 declare module 'express-session' {
     interface SessionData {
@@ -24,5 +26,8 @@ export declare function createSessionMiddleware(): (req: Request, res: Response,
  */
 export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;
 export declare function isLoopbackRemoteAddress(value: string | undefined): boolean;
+export declare function isDashboardWebSocketOriginAllowed(req: IncomingMessage): boolean;
+export declare function isDashboardWebSocketUpgradeAllowed(req: IncomingMessage): boolean;
+export declare function getDashboardWebSocketRejectionStatus(req?: IncomingMessage): 401 | 403;
 export declare function requireLocalAccessWhenAuthDisabled(req: Request, res: Response, error?: string): boolean;
 //# sourceMappingURL=auth-middleware.d.ts.map

package/dist/web-server/middleware/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/web-server/middleware/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAc/D,OAAO,QAAQ,iBAAiB,CAAC;IAC/B,UAAU,WAAW;QACnB,aAAa,EAAE,OAAO,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;KAClB;CACF;AAkDD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,sDAO3B,CAAC;AAEH;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,CACzC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,KACf,IAAI,CAeR;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAwBpF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAU1E;AAED,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,SAA6E,GACjF,OAAO,CAWT"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../src/web-server/middleware/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAc/D,OAAO,QAAQ,iBAAiB,CAAC;IAC/B,UAAU,WAAW;QACnB,aAAa,EAAE,OAAO,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;KAClB;CACF;AAkDD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,sDAO3B,CAAC;AAEH;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,CACzC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,KACf,IAAI,CAeR;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAwBpF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAU1E;AAiCD,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CA6B/E;AAED,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAUhF;AAED,wBAAgB,oCAAoC,CAAC,GAAG,CAAC,EAAE,eAAe,GAAG,GAAG,GAAG,GAAG,CAQrF;AAED,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,KAAK,SAA6E,GACjF,OAAO,CAWT"}

package/dist/web-server/middleware/auth-middleware.js

@@ -7,7 +7,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireLocalAccessWhenAuthDisabled = exports.isLoopbackRemoteAddress = exports.authMiddleware = exports.createSessionMiddleware = exports.loginRateLimiter = void 0;
+exports.requireLocalAccessWhenAuthDisabled = exports.getDashboardWebSocketRejectionStatus = exports.isDashboardWebSocketUpgradeAllowed = exports.isDashboardWebSocketOriginAllowed = exports.isLoopbackRemoteAddress = exports.authMiddleware = exports.createSessionMiddleware = exports.loginRateLimiter = void 0;
 const express_session_1 = __importDefault(require("express-session"));
 const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
 const crypto_1 = __importDefault(require("crypto"));
@@ -125,6 +125,78 @@ function isLoopbackRemoteAddress(value) {
         normalized.startsWith('::ffff:127.'));
 }
 exports.isLoopbackRemoteAddress = isLoopbackRemoteAddress;
+function isLoopbackHostname(value) {
+    if (!value)
+        return false;
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/^\[|\]$/g, '');
+    return (normalized === 'localhost' ||
+        normalized.endsWith('.localhost') ||
+        isLoopbackRemoteAddress(normalized));
+}
+function getSingleHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function parseHostHeader(value) {
+    if (!value)
+        return null;
+    try {
+        return new URL(`http://${value}`);
+    }
+    catch {
+        return null;
+    }
+}
+function isHttpOrigin(origin) {
+    return origin.protocol === 'http:' || origin.protocol === 'https:';
+}
+function isDashboardWebSocketOriginAllowed(req) {
+    const originHeader = getSingleHeader(req.headers.origin);
+    if (!originHeader)
+        return true;
+    let origin;
+    try {
+        origin = new URL(originHeader);
+    }
+    catch {
+        return false;
+    }
+    if (!isHttpOrigin(origin)) {
+        return false;
+    }
+    const host = parseHostHeader(getSingleHeader(req.headers.host));
+    if (!host) {
+        return false;
+    }
+    if (origin.host.toLowerCase() === host.host.toLowerCase()) {
+        return true;
+    }
+    return (isLoopbackHostname(origin.hostname) &&
+        isLoopbackHostname(host.hostname) &&
+        origin.port === host.port);
+}
+exports.isDashboardWebSocketOriginAllowed = isDashboardWebSocketOriginAllowed;
+function isDashboardWebSocketUpgradeAllowed(req) {
+    if (!isDashboardWebSocketOriginAllowed(req)) {
+        return false;
+    }
+    if (!(0, config_loader_facade_1.isDashboardAuthEnabled)()) {
+        return isLoopbackRemoteAddress(req.socket.remoteAddress);
+    }
+    return Boolean(req.session?.authenticated);
+}
+exports.isDashboardWebSocketUpgradeAllowed = isDashboardWebSocketUpgradeAllowed;
+function getDashboardWebSocketRejectionStatus(req) {
+    if (req && !isDashboardWebSocketOriginAllowed(req)) {
+        return 403;
+    }
+    if (!(0, config_loader_facade_1.isDashboardAuthEnabled)())
+        return 403;
+    return 401;
+}
+exports.getDashboardWebSocketRejectionStatus = getDashboardWebSocketRejectionStatus;
 function requireLocalAccessWhenAuthDisabled(req, res, error = 'This endpoint requires localhost access when dashboard auth is disabled.') {
     if ((0, config_loader_facade_1.isDashboardAuthEnabled)()) {
         return true;

package/dist/web-server/middleware/auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/web-server/middleware/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAGH,sEAAsC;AACtC,4EAA2C;AAE3C,oDAA4B;AAC5B,4CAAoB;AACpB,gDAAwB;AACxB,4EAI2C;AAU3C,8EAA8E;AAC9E,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAE9F,6CAA6C;AAC7C,SAAS,oBAAoB;IAC3B,OAAO,cAAI,CAAC,IAAI,CAAC,IAAA,gCAAS,GAAE,EAAE,iBAAiB,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB;IACvB,yBAAyB;IACzB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACxC,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAE1C,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IAED,4CAA4C;IAC5C,MAAM,SAAS,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACU,QAAA,gBAAgB,GAAG,IAAA,4BAAS,EAAC;IACxC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,GAAG,EAAE,CAAC,EAAE,aAAa;IACrB,OAAO,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE;IACtE,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAA,6CAAsB,GAAE;CACtC,CAAC,CAAC;AAEH;;GAEG;AACH,SAAgB,uBAAuB;IAKrC,MAAM,UAAU,GAAG,IAAA,6CAAsB,GAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,qBAAqB,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEzE,OAAO,IAAA,yBAAO,EAAC;QACb,MAAM,EAAE,gBAAgB,EAAE;QAC1B,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,KAAK;QACxB,MAAM,EAAE;YACN,MAAM,EAAE,KAAK,EAAE,sBAAsB;YACrC,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,QAAQ,EAAE,QAAQ;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAnBD,0DAmBC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC5E,wBAAwB;IACxB,IAAI,CAAC,IAAA,6CAAsB,GAAE,EAAE,CAAC;QAC9B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,gBAAgB;IAChB,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,eAAe;IACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAxBD,wCAwBC;AAED,SAAgB,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,CACL,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,KAAK,kBAAkB;QACjC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CACrC,CAAC;AACJ,CAAC;AAVD,0DAUC;AAED,SAAgB,kCAAkC,CAChD,GAAY,EACZ,GAAa,EACb,KAAK,GAAG,0EAA0E;IAElF,IAAI,IAAA,6CAAsB,GAAE,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAfD,gFAeC"}
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../src/web-server/middleware/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;AAIH,sEAAsC;AACtC,4EAA2C;AAE3C,oDAA4B;AAC5B,4CAAoB;AACpB,gDAAwB;AACxB,4EAI2C;AAU3C,8EAA8E;AAC9E,MAAM,YAAY,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAE9F,6CAA6C;AAC7C,SAAS,oBAAoB;IAC3B,OAAO,cAAI,CAAC,IAAI,CAAC,IAAA,gCAAS,GAAE,EAAE,iBAAiB,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB;IACvB,yBAAyB;IACzB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACxC,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAE1C,kCAAkC;IAClC,IAAI,CAAC;QACH,IAAI,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IAED,4CAA4C;IAC5C,MAAM,SAAS,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,YAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACU,QAAA,gBAAgB,GAAG,IAAA,4BAAS,EAAC;IACxC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;IACvC,GAAG,EAAE,CAAC,EAAE,aAAa;IACrB,OAAO,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE;IACtE,eAAe,EAAE,IAAI;IACrB,aAAa,EAAE,KAAK;IACpB,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAA,6CAAsB,GAAE;CACtC,CAAC,CAAC;AAEH;;GAEG;AACH,SAAgB,uBAAuB;IAKrC,MAAM,UAAU,GAAG,IAAA,6CAAsB,GAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,qBAAqB,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEzE,OAAO,IAAA,yBAAO,EAAC;QACb,MAAM,EAAE,gBAAgB,EAAE;QAC1B,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,KAAK;QACxB,MAAM,EAAE;YACN,MAAM,EAAE,KAAK,EAAE,sBAAsB;YACrC,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,QAAQ,EAAE,QAAQ;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAnBD,0DAmBC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC5E,wBAAwB;IACxB,IAAI,CAAC,IAAA,6CAAsB,GAAE,EAAE,CAAC;QAC9B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,gBAAgB;IAChB,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,eAAe;IACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAC7D,CAAC;AAxBD,wCAwBC;AAED,SAAgB,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,CACL,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,KAAK,kBAAkB;QACjC,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CACrC,CAAC;AACJ,CAAC;AAVD,0DAUC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,UAAU,GAAG,KAAK;SACrB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,uBAAuB,CAAC,UAAU,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAoC;IAC3D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACrE,CAAC;AAED,SAAgB,iCAAiC,CAAC,GAAoB;IACpE,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAC1B,CAAC;AACJ,CAAC;AA7BD,8EA6BC;AAED,SAAgB,kCAAkC,CAAC,GAAoB;IACrE,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,IAAA,6CAAsB,GAAE,EAAE,CAAC;QAC9B,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,OAAO,CAAE,GAAe,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAVD,gFAUC;AAED,SAAgB,oCAAoC,CAAC,GAAqB;IACxE,IAAI,GAAG,IAAI,CAAC,iCAAiC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,CAAC,IAAA,6CAAsB,GAAE;QAAE,OAAO,GAAG,CAAC;IAE1C,OAAO,GAAG,CAAC;AACb,CAAC;AARD,oFAQC;AAED,SAAgB,kCAAkC,CAChD,GAAY,EACZ,GAAa,EACb,KAAK,GAAG,0EAA0E;IAElF,IAAI,IAAA,6CAAsB,GAAE,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAfD,gFAeC"}

package/dist/web-server/routes/codex-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-routes.d.ts","sourceRoot":"","sources":["../../../src/web-server/routes/codex-routes.ts"],"names":[],"mappings":"AAWA,QAAA,MAAM,MAAM,4CAAW,CAAC;AA6ExB,eAAe,MAAM,CAAC"}
+{"version":3,"file":"codex-routes.d.ts","sourceRoot":"","sources":["../../../src/web-server/routes/codex-routes.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,MAAM,4CAAW,CAAC;AAqFxB,eAAe,MAAM,CAAC"}

package/dist/web-server/routes/codex-routes.js

@@ -1,8 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
+const auth_middleware_1 = require("../middleware/auth-middleware");
 const codex_dashboard_service_1 = require("../services/codex-dashboard-service");
 const router = (0, express_1.Router)();
+const CODEX_CONFIG_ACCESS_ERROR = 'Codex configuration endpoints require localhost access when dashboard auth is disabled.';
+router.use('/config', (req, res, next) => {
+    if ((0, auth_middleware_1.requireLocalAccessWhenAuthDisabled)(req, res, CODEX_CONFIG_ACCESS_ERROR)) {
+        next();
+    }
+});
 router.get('/diagnostics', async (_req, res) => {
     try {
         res.json(await (0, codex_dashboard_service_1.getCodexDashboardDiagnostics)());

package/dist/web-server/routes/codex-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-routes.js","sourceRoot":"","sources":["../../../src/web-server/routes/codex-routes.ts"],"names":[],"mappings":";;AACA,qCAAiC;AACjC,iFAO6C;AAE7C,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;AAExB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAiB,EAAE;IAC/E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,sDAA4B,GAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAiB,EAAE;IAC9E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,2CAAiB,GAAE,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAElD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IACE,aAAa,KAAK,SAAS;YAC3B,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EACtE,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,4CAAkB,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uDAA6B,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,KAAK,YAAY,qDAA2B,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IACE,IAAI,CAAC,aAAa,KAAK,SAAS;YAChC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAChF,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,0CAAgB,EAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uDAA6B,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,KAAK,YAAY,qDAA2B,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,kBAAe,MAAM,CAAC"}
+{"version":3,"file":"codex-routes.js","sourceRoot":"","sources":["../../../src/web-server/routes/codex-routes.ts"],"names":[],"mappings":";;AACA,qCAAiC;AACjC,mEAAmF;AACnF,iFAO6C;AAE7C,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;AACxB,MAAM,yBAAyB,GAC7B,yFAAyF,CAAC;AAE5F,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAI,EAAE,EAAE;IAC1D,IAAI,IAAA,oDAAkC,EAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC5E,IAAI,EAAE,CAAC;IACT,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAiB,EAAE;IAC/E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,sDAA4B,GAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAa,EAAE,GAAa,EAAiB,EAAE;IAC9E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,2CAAiB,GAAE,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAElD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IACE,aAAa,KAAK,SAAS;YAC3B,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EACtE,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,4CAAkB,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uDAA6B,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,KAAK,YAAY,qDAA2B,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IACE,IAAI,CAAC,aAAa,KAAK,SAAS;YAChC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAChF,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,MAAM,IAAA,0CAAgB,EAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uDAA6B,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,KAAK,YAAY,qDAA2B,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,kBAAe,MAAM,CAAC"}

package/lib/mcp/ccs-browser-server.cjs

@@ -151,6 +151,8 @@ const DEFAULT_DRAG_STEPS = 5;
 const MAX_POINTER_ACTIONS = 25;
 const SESSION_START_SETTLE_WINDOW_MS = 250;
 const MAX_ARTIFACT_FILE_BYTES = 5 * 1024 * 1024;
+const MAX_LOCAL_TRANSFER_FILE_BYTES = 10 * 1024 * 1024;
+const MAX_LOCAL_TRANSFER_FILES = 10;
 const SAFE_ARTIFACT_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const SESSION_CANCELED_ERROR_CODE = 'SESSION_CANCELED';
 
@@ -177,6 +179,37 @@ const recentDownloads = [];
 const interceptSessionsByPageId = new Map();
 let browserDownloadSession = null;
 let sessionDownloadDir = '';
+const SENSITIVE_LOCAL_PATH_SEGMENTS = new Set([
+  '.ssh',
+  '.gnupg',
+  '.aws',
+  '.azure',
+  '.kube',
+  '.docker',
+  '.npmrc',
+  '.netrc',
+  '.pypirc',
+  '.config',
+  '.claude',
+  '.ccs',
+]);
+const SENSITIVE_LOCAL_FILE_NAMES = new Set([
+  '.env',
+  'id_rsa',
+  'id_dsa',
+  'id_ecdsa',
+  'id_ed25519',
+  'known_hosts',
+  'authorized_keys',
+  'credentials',
+  'credentials.json',
+  'config.json',
+  'settings.json',
+  'history',
+  '.bash_history',
+  '.zsh_history',
+  '.fish_history',
+]);
 const MAX_RECENT_REQUESTS = 100;
 const MAX_RECENT_DOWNLOADS = 100;
 const FETCH_FAIL_ERROR_REASON = 'Failed';
@@ -1438,10 +1471,105 @@ function getSessionDownloadPath() {
   return sessionDownloadDir;
 }
 
+function splitConfiguredPathRoots(value) {
+  return String(value || '')
+    .split(path.delimiter)
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map((entry) => path.resolve(entry));
+}
+
+function getDownloadSafeRoots() {
+  return [
+    getSessionDownloadPath(),
+    ...splitConfiguredPathRoots(process.env.CCS_BROWSER_DOWNLOAD_ROOTS),
+  ];
+}
+
+function getUploadSafeRoots() {
+  return [
+    getSessionDownloadPath(),
+    ...splitConfiguredPathRoots(process.env.CCS_BROWSER_UPLOAD_ROOTS),
+  ];
+}
+
+function getNearestExistingAncestor(candidatePath) {
+  let currentPath = candidatePath;
+  while (!fs.existsSync(currentPath)) {
+    const parentPath = path.dirname(currentPath);
+    if (parentPath === currentPath) {
+      return currentPath;
+    }
+    currentPath = parentPath;
+  }
+  return currentPath;
+}
+
+function resolveExistingRoot(rootPath) {
+  fs.mkdirSync(rootPath, { recursive: true });
+  return fs.realpathSync(rootPath);
+}
+
+function resolvePathWithRealAncestor(candidatePath) {
+  const resolvedPath = path.resolve(candidatePath);
+  const ancestorPath = getNearestExistingAncestor(resolvedPath);
+  const realAncestorPath = fs.realpathSync(ancestorPath);
+  const relativeSuffix = path.relative(ancestorPath, resolvedPath);
+  return relativeSuffix ? path.resolve(realAncestorPath, relativeSuffix) : realAncestorPath;
+}
+
+function isPathInsideRoot(candidatePath, rootPath) {
+  const relativePath = path.relative(rootPath, candidatePath);
+  return relativePath === '' || (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));
+}
+
+function findContainingRoot(candidatePath, rootPaths) {
+  return rootPaths.find((rootPath) => isPathInsideRoot(candidatePath, rootPath)) || '';
+}
+
+function getLocalPathSegments(candidatePath, rootPath) {
+  const rootSegments = path.resolve(rootPath).split(path.sep).filter(Boolean);
+  const relativePath = path.relative(rootPath, candidatePath);
+  const relativeSegments = relativePath.split(path.sep).filter(Boolean);
+  return [...rootSegments, ...relativeSegments];
+}
+
+function assertNoSensitiveLocalPathSegments(candidatePath, rootPath, label) {
+  const segments = getLocalPathSegments(candidatePath, rootPath);
+  for (const segment of segments) {
+    const normalizedSegment = segment.toLowerCase();
+    if (normalizedSegment.startsWith('.') || SENSITIVE_LOCAL_PATH_SEGMENTS.has(normalizedSegment)) {
+      throw new Error(`${label} cannot include hidden or sensitive path segment: ${segment}`);
+    }
+  }
+
+  const fileName = path.basename(candidatePath).toLowerCase();
+  if (SENSITIVE_LOCAL_FILE_NAMES.has(fileName)) {
+    throw new Error(
+      `${label} cannot reference sensitive file name: ${path.basename(candidatePath)}`
+    );
+  }
+}
+
 function ensureWritableDirectory(downloadPath) {
-  fs.mkdirSync(downloadPath, { recursive: true });
-  fs.accessSync(downloadPath, fs.constants.W_OK);
-  return downloadPath;
+  const resolvedPath = path.resolve(downloadPath);
+  const candidatePath = resolvePathWithRealAncestor(resolvedPath);
+  const safeRoots = getDownloadSafeRoots().map(resolveExistingRoot);
+  const containingRoot = findContainingRoot(candidatePath, safeRoots);
+  if (!containingRoot) {
+    throw new Error(
+      'downloadPath must be inside the browser session download directory or a CCS_BROWSER_DOWNLOAD_ROOTS entry'
+    );
+  }
+  assertNoSensitiveLocalPathSegments(candidatePath, containingRoot, 'downloadPath');
+
+  fs.mkdirSync(resolvedPath, { recursive: true });
+  const realDownloadPath = fs.realpathSync(resolvedPath);
+  if (!isPathInsideRoot(realDownloadPath, containingRoot)) {
+    throw new Error('downloadPath cannot traverse outside the allowed download root');
+  }
+  fs.accessSync(realDownloadPath, fs.constants.W_OK);
+  return realDownloadPath;
 }
 
 function pushRecentDownload(entry) {
@@ -2418,16 +2546,35 @@ function buildFileInputHandleExpression(selector, nth, frameSelector, pierceShad
 }
 
 function validateLocalFiles(files) {
+  if (files.length > MAX_LOCAL_TRANSFER_FILES) {
+    throw new Error(`files exceeds maximum of ${MAX_LOCAL_TRANSFER_FILES}`);
+  }
+
+  const safeRoots = getUploadSafeRoots().map(resolveExistingRoot);
   return files.map((filePath) => {
     const resolvedPath = path.resolve(filePath);
     if (!fs.existsSync(resolvedPath)) {
       throw new Error(`file does not exist: ${resolvedPath}`);
     }
-    const stat = fs.statSync(resolvedPath);
+    const realFilePath = fs.realpathSync(resolvedPath);
+    const containingRoot = findContainingRoot(realFilePath, safeRoots);
+    if (!containingRoot) {
+      throw new Error(
+        'file must be inside the browser session download directory or a CCS_BROWSER_UPLOAD_ROOTS entry'
+      );
+    }
+    assertNoSensitiveLocalPathSegments(realFilePath, containingRoot, 'file');
+
+    const stat = fs.statSync(realFilePath);
     if (!stat.isFile()) {
-      throw new Error(`file is not a regular file: ${resolvedPath}`);
+      throw new Error(`file is not a regular file: ${realFilePath}`);
+    }
+    if (stat.size > MAX_LOCAL_TRANSFER_FILE_BYTES) {
+      throw new Error(
+        `file exceeds maximum size of ${MAX_LOCAL_TRANSFER_FILE_BYTES} bytes: ${realFilePath}`
+      );
     }
-    return resolvedPath;
+    return realFilePath;
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaitranntt/ccs",
-  "version": "7.78.0-dev.1",
+  "version": "7.78.0-dev.10",
   "description": "Claude Code Switch - Instant profile switching between Claude, GLM, Kimi, and more",
   "keywords": [
     "cli",