@mearl/cloud-server 2.0.2 → 2.1.0

package/dist/cli.js

@@ -7,7 +7,8 @@ import { createDaemon, readRecord, removeRecord } from "@mearl/daemon-core";
 // src/index.ts
 import WebSocket, { WebSocketServer } from "ws";
 import { createServer as createHttpServer } from "node:http";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { networkInterfaces } from "node:os";
 
 // src/paths.ts
@@ -75,17 +76,12 @@ var CloudServer = class {
     return this.options.token;
   }
   generateRandomToken() {
-    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-    let token = "";
-    for (let i = 0; i < 32; i++) {
-      token += chars.charAt(Math.floor(Math.random() * chars.length));
-    }
-    return token;
+    return randomBytes(24).toString("base64url");
   }
   async start() {
+    const token = this.getToken();
     await this.createListener(this.options.agentPort, "127.0.0.1", true);
     await this.createListener(this.options.port, "0.0.0.0", false);
-    const token = this.getToken();
     const localWsUrl = `ws://localhost:${this.options.agentPort}${this.options.path}?token=${token}`;
     let publicWsUrl;
     const sandboxUrl = await this.getSandboxPublicUrl(this.options.port);
@@ -104,6 +100,11 @@ var CloudServer = class {
       const publicHost = process.env.CLOUD_SERVER_HOST || this.getPublicIP();
       publicWsUrl = `ws://${publicHost}:${this.options.port}${this.options.path}?token=${token}`;
     }
+    if (publicWsUrl.startsWith("ws://") && !publicWsUrl.startsWith("ws://localhost")) {
+      console.warn(
+        "[CloudServer] Connector traffic is using unencrypted ws://. Use a TLS-terminating proxy and wss:// when the connection crosses a trusted network."
+      );
+    }
     const connectorCommand = `npx @mearl/cloud-connector "${publicWsUrl}"`;
     console.log(
       `[CloudServer] Connector listener on 0.0.0.0:${this.options.port} (network); agent listener on 127.0.0.1:${this.options.agentPort} (local only)`
@@ -176,6 +177,9 @@ var CloudServer = class {
         ws.close();
       }
       this.connections.clear();
+      for (const pending of this.pendingRequests.values()) {
+        clearTimeout(pending.timer);
+      }
       this.pendingRequests.clear();
       this.agentWss?.close();
       this.connectorWss?.close();
@@ -216,7 +220,9 @@ var CloudServer = class {
       ws,
       id: connId,
       lastHeartbeat: Date.now(),
-      isAgent: false,
+      // The loopback listener is agent-only. Marking it immediately prevents an
+      // idle local client from being mistaken for a connector during reconnects.
+      isAgent: fromLocal,
       fromLocal,
       messageBuffer: ""
     };
@@ -302,6 +308,10 @@ var CloudServer = class {
       ws.send(JSON.stringify({ id, success: false, error: "No local connector available" }) + "\n");
       return;
     }
+    if (this.pendingRequests.has(id)) {
+      ws.send(JSON.stringify({ id, success: false, error: "Duplicate request id" }) + "\n");
+      return;
+    }
     const requestedTimeoutSec = Number(message.timeoutSec);
     const timeoutSec = Number.isFinite(requestedTimeoutSec) && requestedTimeoutSec > 0 ? Math.min(requestedTimeoutSec, 3600) : resolveActionTimeoutSec(action, data, this.options.requestTimeout);
     const timer = setTimeout(
@@ -313,7 +323,7 @@ var CloudServer = class {
       },
       timeoutSec * 1e3 + RESPONSE_GRACE_MS
     );
-    this.pendingRequests.set(id, { ws, timer });
+    this.pendingRequests.set(id, { agentWs: ws, connectorWs: targetWs, timer });
     targetWs.send(
       JSON.stringify({ id, action, data, browser: message.browser, timeoutSec }) + "\n"
     );
@@ -321,18 +331,18 @@ var CloudServer = class {
   handleResponse(ws, response, _connId) {
     const conn = this.connections.get(ws);
     if (!conn) return;
-    if (conn.isAgent) return;
+    if (conn.fromLocal || conn.isAgent) return;
     const pending = this.pendingRequests.get(response.id);
-    if (!pending) return;
+    if (!pending || pending.connectorWs !== ws) return;
     this.pendingRequests.delete(response.id);
     clearTimeout(pending.timer);
-    if (pending.ws.readyState === WebSocket.OPEN) {
-      pending.ws.send(JSON.stringify(response) + "\n");
+    if (pending.agentWs.readyState === WebSocket.OPEN) {
+      pending.agentWs.send(JSON.stringify(response) + "\n");
     }
   }
   findConnector() {
     for (const [ws, conn] of this.connections) {
-      if (!conn.isAgent && ws.readyState === WebSocket.OPEN) {
+      if (!conn.fromLocal && !conn.isAgent && ws.readyState === WebSocket.OPEN) {
         return ws;
       }
     }
@@ -340,12 +350,13 @@ var CloudServer = class {
   }
   rejectPendingForWs(ws) {
     this.pendingRequests.forEach((pending, id) => {
-      if (pending.ws === ws) {
-        clearTimeout(pending.timer);
-        if (ws.readyState === WebSocket.OPEN) {
-          ws.send(JSON.stringify({ id, success: false, error: "Connection closed" }) + "\n");
-        }
-        this.pendingRequests.delete(id);
+      if (pending.agentWs !== ws && pending.connectorWs !== ws) return;
+      clearTimeout(pending.timer);
+      this.pendingRequests.delete(id);
+      if (pending.connectorWs === ws && pending.agentWs !== ws && pending.agentWs.readyState === WebSocket.OPEN) {
+        pending.agentWs.send(
+          JSON.stringify({ id, success: false, error: "Connector connection closed" }) + "\n"
+        );
       }
     });
   }
@@ -401,10 +412,17 @@ var CloudServer = class {
   writeConfigFile(info) {
     try {
       if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true });
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
       }
       const config = { server: info.localUrl, ...info };
-      writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), "utf-8");
+      writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), {
+        encoding: "utf-8",
+        mode: 384
+      });
+      if (process.platform !== "win32") {
+        chmodSync(CONFIG_DIR, 448);
+        chmodSync(CONFIG_FILE, 384);
+      }
       console.log(`[CloudServer] Config written to: ${CONFIG_FILE}`);
     } catch (error) {
       console.error("[CloudServer] Failed to write config file:", error);
@@ -489,7 +507,7 @@ async function runForeground(options) {
 }
 
 // src/cli.ts
-var CLOUD_SERVER_VERSION = true ? "2.0.2" : "unknown";
+var CLOUD_SERVER_VERSION = true ? "2.1.0" : "unknown";
 var argv = process.argv.slice(2);
 if (argv.includes("--version") || argv.includes("-v")) {
   console.log(CLOUD_SERVER_VERSION);

package/dist/index.js

@@ -1,7 +1,8 @@
 // src/index.ts
 import WebSocket, { WebSocketServer } from "ws";
 import { createServer as createHttpServer } from "node:http";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { networkInterfaces } from "node:os";
 
 // src/paths.ts
@@ -69,17 +70,12 @@ var CloudServer = class {
     return this.options.token;
   }
   generateRandomToken() {
-    const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-    let token = "";
-    for (let i = 0; i < 32; i++) {
-      token += chars.charAt(Math.floor(Math.random() * chars.length));
-    }
-    return token;
+    return randomBytes(24).toString("base64url");
   }
   async start() {
+    const token = this.getToken();
     await this.createListener(this.options.agentPort, "127.0.0.1", true);
     await this.createListener(this.options.port, "0.0.0.0", false);
-    const token = this.getToken();
     const localWsUrl = `ws://localhost:${this.options.agentPort}${this.options.path}?token=${token}`;
     let publicWsUrl;
     const sandboxUrl = await this.getSandboxPublicUrl(this.options.port);
@@ -98,6 +94,11 @@ var CloudServer = class {
       const publicHost = process.env.CLOUD_SERVER_HOST || this.getPublicIP();
       publicWsUrl = `ws://${publicHost}:${this.options.port}${this.options.path}?token=${token}`;
     }
+    if (publicWsUrl.startsWith("ws://") && !publicWsUrl.startsWith("ws://localhost")) {
+      console.warn(
+        "[CloudServer] Connector traffic is using unencrypted ws://. Use a TLS-terminating proxy and wss:// when the connection crosses a trusted network."
+      );
+    }
     const connectorCommand = `npx @mearl/cloud-connector "${publicWsUrl}"`;
     console.log(
       `[CloudServer] Connector listener on 0.0.0.0:${this.options.port} (network); agent listener on 127.0.0.1:${this.options.agentPort} (local only)`
@@ -170,6 +171,9 @@ var CloudServer = class {
         ws.close();
       }
       this.connections.clear();
+      for (const pending of this.pendingRequests.values()) {
+        clearTimeout(pending.timer);
+      }
       this.pendingRequests.clear();
       this.agentWss?.close();
       this.connectorWss?.close();
@@ -210,7 +214,9 @@ var CloudServer = class {
       ws,
       id: connId,
       lastHeartbeat: Date.now(),
-      isAgent: false,
+      // The loopback listener is agent-only. Marking it immediately prevents an
+      // idle local client from being mistaken for a connector during reconnects.
+      isAgent: fromLocal,
       fromLocal,
       messageBuffer: ""
     };
@@ -296,6 +302,10 @@ var CloudServer = class {
       ws.send(JSON.stringify({ id, success: false, error: "No local connector available" }) + "\n");
       return;
     }
+    if (this.pendingRequests.has(id)) {
+      ws.send(JSON.stringify({ id, success: false, error: "Duplicate request id" }) + "\n");
+      return;
+    }
     const requestedTimeoutSec = Number(message.timeoutSec);
     const timeoutSec = Number.isFinite(requestedTimeoutSec) && requestedTimeoutSec > 0 ? Math.min(requestedTimeoutSec, 3600) : resolveActionTimeoutSec(action, data, this.options.requestTimeout);
     const timer = setTimeout(
@@ -307,7 +317,7 @@ var CloudServer = class {
       },
       timeoutSec * 1e3 + RESPONSE_GRACE_MS
     );
-    this.pendingRequests.set(id, { ws, timer });
+    this.pendingRequests.set(id, { agentWs: ws, connectorWs: targetWs, timer });
     targetWs.send(
       JSON.stringify({ id, action, data, browser: message.browser, timeoutSec }) + "\n"
     );
@@ -315,18 +325,18 @@ var CloudServer = class {
   handleResponse(ws, response, _connId) {
     const conn = this.connections.get(ws);
     if (!conn) return;
-    if (conn.isAgent) return;
+    if (conn.fromLocal || conn.isAgent) return;
     const pending = this.pendingRequests.get(response.id);
-    if (!pending) return;
+    if (!pending || pending.connectorWs !== ws) return;
     this.pendingRequests.delete(response.id);
     clearTimeout(pending.timer);
-    if (pending.ws.readyState === WebSocket.OPEN) {
-      pending.ws.send(JSON.stringify(response) + "\n");
+    if (pending.agentWs.readyState === WebSocket.OPEN) {
+      pending.agentWs.send(JSON.stringify(response) + "\n");
     }
   }
   findConnector() {
     for (const [ws, conn] of this.connections) {
-      if (!conn.isAgent && ws.readyState === WebSocket.OPEN) {
+      if (!conn.fromLocal && !conn.isAgent && ws.readyState === WebSocket.OPEN) {
         return ws;
       }
     }
@@ -334,12 +344,13 @@ var CloudServer = class {
   }
   rejectPendingForWs(ws) {
     this.pendingRequests.forEach((pending, id) => {
-      if (pending.ws === ws) {
-        clearTimeout(pending.timer);
-        if (ws.readyState === WebSocket.OPEN) {
-          ws.send(JSON.stringify({ id, success: false, error: "Connection closed" }) + "\n");
-        }
-        this.pendingRequests.delete(id);
+      if (pending.agentWs !== ws && pending.connectorWs !== ws) return;
+      clearTimeout(pending.timer);
+      this.pendingRequests.delete(id);
+      if (pending.connectorWs === ws && pending.agentWs !== ws && pending.agentWs.readyState === WebSocket.OPEN) {
+        pending.agentWs.send(
+          JSON.stringify({ id, success: false, error: "Connector connection closed" }) + "\n"
+        );
       }
     });
   }
@@ -395,10 +406,17 @@ var CloudServer = class {
   writeConfigFile(info) {
     try {
       if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true });
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
       }
       const config = { server: info.localUrl, ...info };
-      writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), "utf-8");
+      writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), {
+        encoding: "utf-8",
+        mode: 384
+      });
+      if (process.platform !== "win32") {
+        chmodSync(CONFIG_DIR, 448);
+        chmodSync(CONFIG_FILE, 384);
+      }
       console.log(`[CloudServer] Config written to: ${CONFIG_FILE}`);
     } catch (error) {
       console.error("[CloudServer] Failed to write config file:", error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mearl/cloud-server",
-  "version": "2.0.2",
+  "version": "2.1.0",
   "description": "Cloud WebSocket server for Mearl — bridges cloud agents to local connectors",
   "type": "module",
   "main": "dist/index.js",
@@ -29,9 +29,9 @@
   "dependencies": {
     "node-fetch": "^3.3.2",
     "ws": "^8.18.0",
-    "@mearl/client": "2.0.2",
-    "@mearl/cloud-types": "2.0.2",
-    "@mearl/daemon-core": "2.0.2"
+    "@mearl/client": "2.1.0",
+    "@mearl/cloud-types": "2.1.0",
+    "@mearl/daemon-core": "2.1.0"
   },
   "devDependencies": {
     "@types/node": "^24.9.1",