@moritzwilksch/diffle 0.1.3 → 0.1.4

package/README.md

@@ -62,11 +62,18 @@ Opening `/diffle` redirects to `/diffle/`. Configure the proxy to strip that pre
 when forwarding to diffle, including WebSocket upgrades at `/diffle/ws`. No build
 or CLI base-path setting is needed.
 
-Run diffle with `--no-open` for a proxy-managed session. Its Host/Origin checks also
-apply behind a proxy: when forwarding to the default loopback listener, use the
-upstream Host (for example `127.0.0.1:4966`). The proxy must validate any browser
-Origin against its public origin before rewriting it to the upstream origin for
-both HTTP requests and WebSocket upgrades.
+Run diffle with `--no-open` for a proxy-managed session. If the proxy preserves its
+public Host or Origin headers, explicitly trust its public origin (without the path):
+
+```bash
+diffle working -H 0.0.0.0 --no-open --allowed-origin https://proxy.example
+```
+
+This applies to both HTTP requests and WebSocket upgrades. The proxy can preserve
+the public Host or rewrite it to an allowed upstream Host, such as `127.0.0.1:4966`.
+Other browser origins remain rejected; forwarded headers do not grant trust.
+Without this setting, the proxy must use an allowed upstream Host and validate any
+browser Origin against its public origin before rewriting it to the upstream origin.
 
 ## Shell completions
 

package/dist/server/main.js

@@ -3951,7 +3951,7 @@ function generateCompletion(program, { shell, executable = program.name() }) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.1.3";
+var version$1 = "0.1.4";
 //#endregion
 //#region src/server/comments/anchor.ts
 function splitLines(contents) {
@@ -15781,35 +15781,31 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 	"localhost"
 ]);
 /**
-* Host/Origin policy for API and WebSocket requests. Pure given its inputs;
-* `bindHost` is the `--host` value. An Origin, when sent, must name the same
-* host:port as Host (blocks cross-site pages). On a loopback bind, Host must be
-* loopback too. On any other bind, Host must be an IP literal, loopback, the
-* bind host, or one of `names` (the machine's own hostnames by default). Both
-* rules block DNS rebinding: an attacker's domain is never an IP literal and
-* never one of ours.
+* Restricts API and WebSocket requests to local hosts and the configured public origin.
+* Proxies may preserve the public Host or rewrite it to an allowed upstream Host.
+* Forwarded headers never grant trust; a public Origin must be explicitly configured.
 */
-function requestGuard(bindHost, names = ownNames()) {
+function requestGuard(bindHost, names = ownNames(), allowedOrigin) {
 	const loopback = LOOPBACK.has(bindHost);
 	const allowed = /* @__PURE__ */ new Set([
 		...LOOPBACK,
 		bindHost.toLowerCase(),
 		...names.map((n) => n.toLowerCase())
 	]);
+	const publicHost = allowedOrigin == null ? void 0 : new URL(allowedOrigin).host;
 	return ({ host, origin }) => {
 		if (!host) return false;
-		if (origin != null) {
-			let originHost;
-			try {
-				originHost = new URL(origin).host;
-			} catch {
-				return false;
-			}
-			if (originHost !== host) return false;
-		}
 		const name = hostnameOf(host).toLowerCase();
-		if (loopback) return LOOPBACK.has(name);
-		return isIP(name) !== 0 || allowed.has(name);
+		const localHost = loopback ? LOOPBACK.has(name) : isIP(name) !== 0 || allowed.has(name);
+		const proxyHost = publicHost != null && host.toLowerCase() === publicHost;
+		if (!localHost && !proxyHost) return false;
+		if (origin == null || allowedOrigin != null && origin === allowedOrigin) return true;
+		if (proxyHost) return false;
+		try {
+			return new URL(origin).host === host;
+		} catch {
+			return false;
+		}
 	};
 }
 /** The machine's hostname, its short form, and its mDNS name, so LAN visitors can use any of them. */
@@ -16501,7 +16497,7 @@ var Server = class {
 	}
 	async listen() {
 		const app = new Hono();
-		const guard = requestGuard(this.opts.host);
+		const guard = requestGuard(this.opts.host, void 0, this.opts.allowedOrigin);
 		app.use("/api/*", async (c, next) => {
 			if (!guard({
 				host: c.req.header("host"),
@@ -21067,6 +21063,16 @@ function intArg(min, max) {
 }
 const parsePort = intArg(0, 65535);
 const parseContext = intArg(0, 1e4);
+/** Accepts an HTTP(S) origin without credentials, a path prefix, query, or fragment. */
+function parseAllowedOrigin(raw) {
+	try {
+		const url = new URL(raw);
+		if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash || !/^https?:\/\/[^/?#]+\/?$/i.test(raw)) throw new Error("invalid origin");
+		return url.origin;
+	} catch {
+		throw new InvalidArgumentError("expected an HTTP(S) origin, e.g. https://proxy.example (without a path)");
+	}
+}
 /** Commander parser for a language diffle knows; anything else lists the ones it does. */
 function parseLanguage(raw) {
 	const language = raw.trim().toLowerCase();
@@ -21238,7 +21244,7 @@ const c = {
 	bold: paint("1"),
 	dim: paint("2")
 };
-const program = new Command().name("diffle").description("Review a git diff in the browser and export line comments as an agent prompt.").version(version$1, "-v, --version", "print the version and exit").addOption(completionHint(new Option("-C <path>", "run as if started in <path> (any directory inside a git worktree)"), { kind: "directory" })).option("-p, --port <port>", `port to listen on (default: ${DEFAULT_PORT}, or the next free one; 0 = random)`, parsePort).option("-H, --host <host>", "address to bind; use 0.0.0.0 to expose on the network", "127.0.0.1").option("--no-open", "do not open a browser").option("--keep-alive", "keep the server running after all browser tabs close").option("--no-watch", "do not watch for changes").addOption(new Option("--auto-viewed <glob>", "mark matching files viewed for this session (repeatable)").argParser(collect).default([], "none")).option("-U, --context <n>", "context lines around changes for this session (default: config, 5)", parseContext).addOption(new Option("--lsp <language=command>", "language server command for one language, started for this run (repeatable); by default the diff's languages are served by whatever is on PATH").argParser(collectLspOverride).default(true, "the diff's languages, resolved on PATH")).option("--no-lsp", "do not start any language server").option("--timing", "print startup phase timings to stderr").option("--dev", "serve the client through Vite (development)", process.env.DIFFLE_DEV === "1" ? true : void 0).addArgument(completionHint(new Argument("[revs...]", "git-diff style revisions: <rev> | <a>..<b> | <a>...<b> | <a> <b>"), {
+const program = new Command().exitOverride().name("diffle").description("Review a git diff in the browser and export line comments as an agent prompt.").version(version$1, "-v, --version", "print the version and exit").addOption(completionHint(new Option("-C <path>", "run as if started in <path> (any directory inside a git worktree)"), { kind: "directory" })).option("-p, --port <port>", `port to listen on (default: ${DEFAULT_PORT}, or the next free one; 0 = random)`, parsePort).option("-H, --host <host>", "address to bind; use 0.0.0.0 to expose on the network", "127.0.0.1").option("--allowed-origin <origin>", "trusted public HTTP(S) origin behind a reverse proxy (without a path)", parseAllowedOrigin).option("--no-open", "do not open a browser").option("--keep-alive", "keep the server running after all browser tabs close").option("--no-watch", "do not watch for changes").addOption(new Option("--auto-viewed <glob>", "mark matching files viewed for this session (repeatable)").argParser(collect).default([], "none")).option("-U, --context <n>", "context lines around changes for this session (default: config, 5)", parseContext).addOption(new Option("--lsp <language=command>", "language server command for one language, started for this run (repeatable); by default the diff's languages are served by whatever is on PATH").argParser(collectLspOverride).default(true, "the diff's languages, resolved on PATH")).option("--no-lsp", "do not start any language server").option("--timing", "print startup phase timings to stderr").option("--dev", "serve the client through Vite (development)", process.env.DIFFLE_DEV === "1" ? true : void 0).addArgument(completionHint(new Argument("[revs...]", "git-diff style revisions: <rev> | <a>..<b> | <a>...<b> | <a> <b>"), {
 	kind: "choices",
 	values: ["working", "pr"]
 })).addHelpText("after", `
@@ -21374,6 +21380,7 @@ async function serve(req, opts, repo, closeRepo, config, timing) {
 		port: opts.port ?? 4966,
 		probe: opts.port == null,
 		host: opts.host,
+		allowedOrigin: opts.allowedOrigin,
 		dev: opts.dev || !hasClientBuild()
 	});
 	let stopBrowserWatch = () => {};
@@ -21471,9 +21478,8 @@ function startLsp(repo, session, hub, overrides, preload) {
 	});
 	return lsp;
 }
-program.exitOverride();
 program.parseAsync(process.argv).catch((e) => {
-	if (e instanceof CommanderError) process.exit(e.exitCode);
+	if (e instanceof CommanderError) process.exit(e.exitCode === 0 ? 0 : 2);
 	console.error(`${c.red("✖")} ${e instanceof Error ? e.message : e}`);
 	process.exit(e instanceof RevspecError || e instanceof GitError || e instanceof GithubError ? 2 : 1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moritzwilksch/diffle",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Local git diff reviewer in the browser with line comments exported as agent prompts",
   "keywords": [
     "agent",