npm - @neuralnomads/codenomad-dev - Versions diffs - 0.20.0-dev-20260909-855d2ee7 → 0.20.0-dev-20260911-ea37f97b - Mend

@neuralnomads/codenomad-dev 0.20.0-dev-20260909-855d2ee7 → 0.20.0-dev-20260911-ea37f97b

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (177) hide show

package/dist/server/listener-base-url.js CHANGED Viewed

@@ -1,7 +1,16 @@
+import { isIP } from "node:net";
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "./network-host";
+export function resolvePreferredRemoteListener(input) {
+    return input.httpsStart ?? input.httpStart ?? null;
+}
 export function resolvePluginBaseUrl(input) {
     const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost));
     if (loopbackListener) {
-        return `${loopbackListener.protocol}://127.0.0.1:${loopbackListener.port}`;
+        const bindHost = normalizeNetworkHost(loopbackListener.bindHost);
+        const loopbackHost = isWildcardHost(bindHost)
+            ? isIP(bindHost) === 6 ? "::1" : "127.0.0.1"
+            : bindHost;
+        return `${loopbackListener.protocol}://${formatHostForUrl(loopbackHost)}:${loopbackListener.port}`;
     }
     if (input.remoteUrl) {
         return input.remoteUrl;
@@ -10,7 +19,7 @@ export function resolvePluginBaseUrl(input) {
     if (!fallbackListener) {
         throw new Error("No listeners started");
     }
-    return `${fallbackListener.protocol}://${fallbackListener.bindHost}:${fallbackListener.port}`;
+    return `${fallbackListener.protocol}://${formatHostForUrl(fallbackListener.bindHost)}:${fallbackListener.port}`;
 }
 export function resolveAutomationBridgeUrl(listener) {
     if (listener.protocol !== "http" || !acceptsLoopback(listener.bindHost)) {
@@ -19,6 +28,6 @@ export function resolveAutomationBridgeUrl(listener) {
     return `http://127.0.0.1:${listener.port}`;
 }
 function acceptsLoopback(bindHost) {
-    return bindHost === "0.0.0.0" || bindHost === "::" || bindHost === "localhost" || bindHost === "::1" || bindHost.startsWith("127.");
+    return bindHost === "localhost" || isWildcardHost(bindHost) || isLoopbackHost(bindHost);
 }
 //# sourceMappingURL=listener-base-url.js.map

package/dist/server/listener-base-url.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"listener-base-url.js","sourceRoot":"","sources":["../../src/server/listener-base-url.ts"],"names":[],"mappings":"~~AAYA~~,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/H,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,GAAG,gBAAgB,CAAC,QAAQ,gBAAgB,gBAAgB,CAAC,IAAI,EAAE,CAAA;~~IAC5E~~,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,SAAS,CAAA;IACxB,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IAED,OAAO,GAAG,gBAAgB,CAAC,QAAQ,MAAM,gBAAgB,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAA;~~AAC/F~~,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAqC;IAC9E,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,oBAAoB,QAAQ,CAAC,IAAI,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,QAAQ,KAAK,~~SAAS~~,IAAI,~~QAAQ~~,~~KAAK~~,~~IAAI,IAAI,~~QAAQ,~~KAAK~~,~~WAAW,~~IAAI,~~QAAQ~~,~~KAAK~~,~~KAAK,IAAI,~~QAAQ,CAAC,~~UAAU,CAAC,MAAM,CAAC,~~CAAA;~~AACrI~~,CAAC","sourcesContent":["~~export~~ interface StartedListenerBaseUrlInput {\n protocol: \"http\" \| \"https\"\n bindHost: string\n port: number\n}\n\nexport interface ResolvePluginBaseUrlInput {\n httpStart?: StartedListenerBaseUrlInput \| null\n httpsStart?: StartedListenerBaseUrlInput \| null\n remoteUrl?: string\n}\n\nexport function resolvePluginBaseUrl(input: ResolvePluginBaseUrlInput): string {\n const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost))\n if (loopbackListener) {\n ~~return~~ ~~`${~~loopbackListener.~~protocol}://~~127.0.0.1:${loopbackListener.port}`\n }\n\n if (input.remoteUrl) {\n return input.remoteUrl\n }\n\n const fallbackListener = input.httpStart ?? input.httpsStart\n if (!fallbackListener) {\n throw new Error(\"No listeners started\")\n }\n\n return `${fallbackListener.protocol}://${fallbackListener.bindHost}:${fallbackListener.port}`\n}\n\nexport function resolveAutomationBridgeUrl(listener: StartedListenerBaseUrlInput): string {\n if (listener.protocol !== \"http\" \|\| !acceptsLoopback(listener.bindHost)) {\n throw new Error(\"Developer Mode requires a loopback HTTP listener\")\n }\n return `http://127.0.0.1:${listener.port}`\n}\n\nfunction acceptsLoopback(bindHost: string): boolean {\n return bindHost === \"~~0.0.0.0\" \|\| bindHost === \"::\" \|\| bindHost === \"~~localhost\" \|\| bindHost ~~=== \"::1\"~~ \|\| bindHost~~.startsWith(\"127.\"~~)\n}\n"]}
1	+ {"version":3,"file":"listener-base-url.js","sourceRoot":"","sources":["../../src/server/listener-base-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAcvG,MAAM,UAAU,8BAA8B,CAC5C,KAAkE;IAElE,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/H,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAChE,MAAM,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;YAC5C,CAAC,CAAC,QAAQ,CAAA;QACZ,OAAO,GAAG,gBAAgB,CAAC,QAAQ,MAAM,gBAAgB,CAAC,YAAY,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAA;IACpG,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,SAAS,CAAA;IACxB,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzC,CAAC;IAED,OAAO,GAAG,gBAAgB,CAAC,QAAQ,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAA;AACjH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAqC;IAC9E,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,oBAAoB,QAAQ,CAAC,IAAI,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,QAAQ,KAAK,WAAW,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAA;AACzF,CAAC","sourcesContent":["import { isIP } from \"node:net\"\nimport { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from \"./network-host\"\n\nexport interface StartedListenerBaseUrlInput {\n protocol: \"http\" \| \"https\"\n bindHost: string\n port: number\n}\n\nexport interface ResolvePluginBaseUrlInput {\n httpStart?: StartedListenerBaseUrlInput \| null\n httpsStart?: StartedListenerBaseUrlInput \| null\n remoteUrl?: string\n}\n\nexport function resolvePreferredRemoteListener(\n input: Pick<ResolvePluginBaseUrlInput, \"httpStart\" \| \"httpsStart\">,\n): StartedListenerBaseUrlInput \| null {\n return input.httpsStart ?? input.httpStart ?? null\n}\n\nexport function resolvePluginBaseUrl(input: ResolvePluginBaseUrlInput): string {\n const loopbackListener = [input.httpStart, input.httpsStart].find((listener) => listener && acceptsLoopback(listener.bindHost))\n if (loopbackListener) {\n const bindHost = normalizeNetworkHost(loopbackListener.bindHost)\n const loopbackHost = isWildcardHost(bindHost)\n ? isIP(bindHost) === 6 ? \"::1\" : \"127.0.0.1\"\n : bindHost\n return `${loopbackListener.protocol}://${formatHostForUrl(loopbackHost)}:${loopbackListener.port}`\n }\n\n if (input.remoteUrl) {\n return input.remoteUrl\n }\n\n const fallbackListener = input.httpStart ?? input.httpsStart\n if (!fallbackListener) {\n throw new Error(\"No listeners started\")\n }\n\n return `${fallbackListener.protocol}://${formatHostForUrl(fallbackListener.bindHost)}:${fallbackListener.port}`\n}\n\nexport function resolveAutomationBridgeUrl(listener: StartedListenerBaseUrlInput): string {\n if (listener.protocol !== \"http\" \|\| !acceptsLoopback(listener.bindHost)) {\n throw new Error(\"Developer Mode requires a loopback HTTP listener\")\n }\n return `http://127.0.0.1:${listener.port}`\n}\n\nfunction acceptsLoopback(bindHost: string): boolean {\n return bindHost === \"localhost\" \|\| isWildcardHost(bindHost) \|\| isLoopbackHost(bindHost)\n}\n"]}

package/dist/server/network-addresses.js CHANGED Viewed

@@ -1,51 +1,40 @@
 import os from "os";
+import { isIP } from "node:net";
+import { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from "./network-host";
 export function resolveNetworkAddresses(args) {
-    const { host, protocol, port } = args;
+    const { protocol, port } = args;
+    const host = normalizeNetworkHost(args.host);
     const interfaces = os.networkInterfaces();
     const seen = new Set();
     const results = [];
     const addAddress = (ip, scope) => {
-        if (!ip || ip === "0.0.0.0")
+        const normalizedIp = normalizeNetworkHost(ip);
+        const ipVersion = isIP(normalizedIp);
+        if (!ipVersion || isWildcardHost(normalizedIp) || (ipVersion === 6 && isLinkLocalIPv6(normalizedIp)))
             return;
-        const key = `ipv4-${ip}`;
+        const family = ipVersion === 6 ? "ipv6" : "ipv4";
+        const key = `${family}-${normalizedIp}`;
         if (seen.has(key))
             return;
         seen.add(key);
-        results.push({ ip, family: "ipv4", scope, remoteUrl: `${protocol}://${ip}:${port}` });
+        results.push({ ip: normalizedIp, family, scope, remoteUrl: `${protocol}://${formatHostForUrl(normalizedIp)}:${port}` });
     };
-    const normalizeFamily = (value) => {
-        if (typeof value === "string") {
-            const lowered = value.toLowerCase();
-            if (lowered === "ipv4") {
-                return "ipv4";
-            }
-        }
-        if (value === 4)
-            return "ipv4";
-        return null;
-    };
-    if (host === "0.0.0.0") {
-        // Enumerate system interfaces (IPv4 only)
+    if (isWildcardHost(host)) {
+        const wildcardVersion = isIP(host);
         for (const entries of Object.values(interfaces)) {
             if (!entries)
                 continue;
             for (const entry of entries) {
-                const family = normalizeFamily(entry.family);
-                if (!family)
-                    continue;
-                if (!entry.address || entry.address === "0.0.0.0")
+                const entryVersion = isIP(normalizeNetworkHost(entry.address));
+                if (entryVersion !== wildcardVersion && !(wildcardVersion === 6 && entryVersion === 4))
                     continue;
                 const scope = entry.internal ? "loopback" : "external";
                 addAddress(entry.address, scope);
             }
         }
     }
-    // Always include loopback address
-    addAddress("127.0.0.1", "loopback");
-    // Include explicitly configured host if it was IPv4
-    if (isIPv4Address(host) && host !== "0.0.0.0") {
-        const isLoopback = host.startsWith("127.");
-        addAddress(host, isLoopback ? "loopback" : "external");
+    else if (isIP(host)) {
+        addAddress(host, isLoopbackHost(host) ? "loopback" : "external");
     }
     const scopeWeight = { external: 0, internal: 1, loopback: 2 };
     return results.sort((a, b) => {
@@ -93,23 +82,12 @@ function isPrivateIPv4(ip) {
     return first === 172 && second >= 16 && second <= 31;
 }
 function parseIPv4(value) {
-    if (!isIPv4Address(value))
+    if (isIP(value) !== 4)
         return null;
     return value.split(".").map((part) => Number(part));
 }
-function isIPv4Address(value) {
-    if (!value)
-        return false;
-    const parts = value.split(".");
-    if (parts.length !== 4)
-        return false;
-    return parts.every((part) => {
-        if (part.length === 0 || part.length > 3)
-            return false;
-        if (!/^[0-9]+$/.test(part))
-            return false;
-        const num = Number(part);
-        return Number.isInteger(num) && num >= 0 && num <= 255;
-    });
+function isLinkLocalIPv6(ip) {
+    const firstSegment = Number.parseInt(ip.split(":", 1)[0], 16);
+    return Number.isInteger(firstSegment) && firstSegment >= 0xfe80 && firstSegment <= 0xfebf;
 }
 //# sourceMappingURL=network-addresses.js.map

package/dist/server/network-addresses.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"network-addresses.js","sourceRoot":"","sources":["../../src/server/network-addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;~~AASnB~~,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,MAAM,EAAE,~~IAAI~~,EAAE,~~QAAQ~~,EAAE,IAAI,~~EAAE~~,GAAG,IAAI,CAAA;~~IACrC~~,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAqB,EAAE,CAAA;IAEpC,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAA8B,EAAE,EAAE;QAChE,~~IAAI~~,CAAC,EAAE,IAAI,~~EAAE~~,KAAK,~~SAAS~~;YAAE,OAAM;~~QACnC~~,MAAM,GAAG,GAAG,~~QAAQ~~,~~EAAE~~,EAAE,CAAA;~~QACxB~~,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,~~MAAM~~,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,MAAM,~~EAAE~~,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;~~IACvF~~,CAAC,CAAA;IAED,~~MAAM~~,~~eAAe~~,~~GAAG,~~CAAC,~~KAAsB,EAAE,EAAE;QACjD,~~IAAI,~~OAAO~~,~~KAAK,KAAK,QAAQ,~~EAAE,CAAC;~~YAC9B~~,MAAM,~~OAAO~~,GAAG,~~KAAK,CAAC,WAAW,EAAE,CAAA;YACnC,~~IAAI,~~OAAO,KAAK,MAAM,EAAE,~~CAAC~~;gBACvB~~,~~OAAO,MAAe,CAAA;YACxB,CAAC;QACH,CAAC;QACD,~~IAAI,~~KAAK,KAAK,~~CAAC~~;YAAE~~,~~OAAO,MAAe,~~CAAA;~~QACvC~~,~~OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,IAAI,IAAI,~~KAAK,~~SAAS,EAAE,CAAC;QACvB,0CAA0C;QAC1C,KAAK,~~MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,~~MAAM~~,GAAG,~~eAAe~~,CAAC,KAAK,CAAC,~~MAAM~~,CAAC,CAAA;~~gBAC5C~~,IAAI,~~CAAC~~,~~MAAM;oBAAE~~,~~SAAQ;gBACrB~~,IAAI,CAAC,KAAK,CAAC,~~OAAO,~~IAAI,KAAK,CAAC,~~OAAO,KAAK,SAAS~~;oBAAE,SAAQ;~~gBAC3D~~,MAAM,KAAK,GAA4B,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;gBAC/E,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;~~IAED~~,~~kCAAkC;IAClC~~,~~UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IAEnC,oDAAoD;IACpD,~~IAAI,~~aAAa,~~CAAC,IAAI,CAAC,~~IAAI,IAAI,KAAK,SAAS,~~EAAE,CAAC;~~QAC9C~~,~~MAAM,~~UAAU,~~GAAG~~,IAAI,~~CAAC~~,~~UAAU~~,CAAC,~~MAAM~~,CAAC,~~CAAA;QAC1C,UAAU,~~CAAC,~~IAAI,EAAE,UAAU,~~CAAC,CAAC,~~CAAC,~~UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;~~IACxD~~,CAAC;IAED,MAAM,WAAW,GAA4C,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IAEtG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAA;QAEvC,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAA;IACnG,OAAO;QACL,GAAG;QACH,WAAW;QACX,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,SAA2B;IAC3D,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,sBAAsB,CAAC,EAAU;IACxC,IAAI,aAAa,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IAC/B,IAAI,eAAe,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IACjC,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAC9B,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAE9B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC,~~aAAa~~,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;~~IACtC~~,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,~~aAAa~~,CAAC,~~KAAyB~~;~~IAC9C~~,~~IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IACxB,~~MAAM,~~KAAK~~,GAAG,~~KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,~~MAAM,~~KAAK,~~CAAC~~;QAAE~~,~~OAAO~~,~~KAAK,CAAA;IACpC,OAAO,KAAK,~~CAAC,~~KAAK,CAAC,CAAC,IAAI,~~EAAE,~~EAAE;QAC1B,IAAI,IAAI,~~CAAC,~~MAAM,~~KAAK,CAAC,~~IAAI~~,~~IAAI~~,CAAC,~~MAAM,GAAG,~~CAAC~~;YAAE~~,~~OAAO,KAAK,CAAA;QACtD,IAAI,~~CAAC,~~UAAU,~~CAAC,~~IAAI,~~CAAC,~~IAAI~~,~~CAAC;YAAE~~,~~OAAO,KAAK,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,~~CAAC,~~IAAI,CAAC,~~CAAA;~~QACxB~~,OAAO,MAAM,CAAC,SAAS,CAAC,~~GAAG~~,CAAC,IAAI,~~GAAG~~,IAAI,~~CAAC~~,IAAI,~~GAAG~~,IAAI,~~GAAG~~,CAAA;~~IACxD~~,CAAC~~,CAAC,CAAA;AACJ,CAAC~~","sourcesContent":["import os from \"os\"\nimport type { NetworkAddress } from \"../api-types\"\n\nexport interface ResolvedRemoteAddresses {\n all: NetworkAddress[]\n userVisible: NetworkAddress[]\n primaryRemoteUrl?: string\n}\n\nexport function resolveNetworkAddresses(args: {\n host: string\n protocol: \"http\" \| \"https\"\n port: number\n}): NetworkAddress[] {\n const { ~~host,~~ protocol, port } = args\n const interfaces = os.networkInterfaces()\n const seen = new Set<string>()\n const results: NetworkAddress[] = []\n\n const addAddress = (ip: string, scope: NetworkAddress[\"scope\"]) => {\n if (!ip \|\| ip === \"~~0.0.0.0~~\") ~~return~~\n const key = ~~`ipv4~~-${ip}`\n if (seen.has(key)) return\n seen.add(key)\n results.push({ ip, family~~: \"ipv4\"~~, scope, remoteUrl: `${protocol}://${ip}:${port}` })\n }\n\n ~~const normalizeFamily = (value: string \| number) => {\n~~ if (~~typeof value === \"string\") {\n const lowered = value.toLowerCase~~()~~\n if (lowered === \"ipv4\"~~) {\n ~~return \"ipv4\" as~~ const~~\n }\n }\n if~~ ~~(value~~ ~~===~~ ~~4) return \"ipv4\" as const\n return null\n }\n\n if~~ (host ~~=== \"0.0.0.0\"~~) {\n ~~// Enumerate system interfaces (IPv4 only)\n~~ for (const entries of Object.values(interfaces)) {\n if (!entries) continue\n for (const entry of entries) {\n const ~~family~~ = ~~normalizeFamily~~(entry.~~family~~)\n if (~~!family)~~ ~~continue\n if~~ (~~!entry.address~~ \|\| ~~entry.address~~ === ~~\"0.0.0.0\"~~) continue\n const scope: NetworkAddress[\"scope\"] = entry.internal ? \"loopback\" : \"external\"\n addAddress(entry.address, scope)\n }\n }\n }~~\n\n //~~ ~~Always~~ ~~include loopback address\n addAddress(\"127.0.0.1\", \"loopback\")\n\n // Include explicitly configured host~~ if ~~it was IPv4\n if~~ (~~isIPv4Address~~(host) ~~&& host !== \"0.0.0.0\"~~) {\n ~~const isLoopback = host.startsWith(\"127.\")\n~~ addAddress(host, ~~isLoopback~~ ? \"loopback\" : \"external\")\n }\n\n const scopeWeight: Record<NetworkAddress[\"scope\"], number> = { external: 0, internal: 1, loopback: 2 }\n\n return results.sort((a, b) => {\n const scopeDelta = scopeWeight[a.scope] - scopeWeight[b.scope]\n if (scopeDelta !== 0) return scopeDelta\n\n return 0\n })\n}\n\nexport function resolveRemoteAddresses(args: {\n host: string\n protocol: \"http\" \| \"https\"\n port: number\n}): ResolvedRemoteAddresses {\n const all = resolveNetworkAddresses(args)\n const userVisible = sortUserVisibleAddresses(all.filter((address) => address.scope === \"external\"))\n return {\n all,\n userVisible,\n primaryRemoteUrl: userVisible[0]?.remoteUrl,\n }\n}\n\nfunction sortUserVisibleAddresses(addresses: NetworkAddress[]): NetworkAddress[] {\n return [...addresses].sort((left, right) => getUserVisiblePriority(left.ip) - getUserVisiblePriority(right.ip))\n}\n\nfunction getUserVisiblePriority(ip: string): number {\n if (isPrivateIPv4(ip)) return 0\n if (isLinkLocalIPv4(ip)) return 2\n return 1\n}\n\nfunction isLinkLocalIPv4(ip: string): boolean {\n const octets = parseIPv4(ip)\n if (!octets) return false\n const [first, second] = octets\n return first === 169 && second === 254\n}\n\nfunction isPrivateIPv4(ip: string): boolean {\n const octets = parseIPv4(ip)\n if (!octets) return false\n const [first, second] = octets\n\n if (first === 10) return true\n if (first === 192 && second === 168) return true\n return first === 172 && second >= 16 && second <= 31\n}\n\nfunction parseIPv4(value: string): number[] \| null {\n if (~~!isIPv4Address~~(value)) return null\n return value.split(\".\").map((part) => Number(part))\n}\n\nfunction ~~isIPv4Address~~(~~value~~: string ~~\| undefined~~): ~~value~~ ~~is string~~ {\n ~~if (!value) return false\n~~ const ~~parts~~ = ~~value~~.split(\".\"~~)\n if~~ ~~(parts.length !== 4~~) ~~return false\n return parts.every((part) => {\n if (part.length === 0 \|\| part.length > 3) return false\n if (!/^~~[0-9]~~+$/.test(part))~~ ~~return false\n const num = Number(part~~)\n return Number.isInteger(~~num~~) && ~~num~~ >= 0 && ~~num~~ <= ~~255~~\n })\n~~}\n~~"]}
1	+ {"version":3,"file":"network-addresses.js","sourceRoot":"","sources":["../../src/server/network-addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAE/B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAQvG,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,OAAO,GAAqB,EAAE,CAAA;IAEpC,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,KAA8B,EAAE,EAAE;QAChE,MAAM,YAAY,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAA;QACpC,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;YAAE,OAAM;QAC5G,MAAM,MAAM,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAChD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,YAAY,EAAE,CAAA;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAM;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,MAAM,gBAAgB,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;IACzH,CAAC,CAAA;IAED,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QAClC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;gBAC9D,IAAI,YAAY,KAAK,eAAe,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC;oBAAE,SAAQ;gBAChG,MAAM,KAAK,GAA4B,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;gBAC/E,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,WAAW,GAA4C,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IAEtG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAA;QAEvC,OAAO,CAAC,CAAA;IACV,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAItC;IACC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAA;IACnG,OAAO;QACL,GAAG;QACH,WAAW;QACX,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS;KAC5C,CAAA;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,SAA2B;IAC3D,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;AACjH,CAAC;AAED,SAAS,sBAAsB,CAAC,EAAU;IACxC,IAAI,aAAa,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IAC/B,IAAI,eAAe,CAAC,EAAE,CAAC;QAAE,OAAO,CAAC,CAAA;IACjC,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAC9B,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAA;IAE9B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC7B,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChD,OAAO,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAA;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,MAAM,IAAI,YAAY,IAAI,MAAM,CAAA;AAC3F,CAAC","sourcesContent":["import os from \"os\"\nimport { isIP } from \"node:net\"\nimport type { NetworkAddress } from \"../api-types\"\nimport { formatHostForUrl, isLoopbackHost, isWildcardHost, normalizeNetworkHost } from \"./network-host\"\n\nexport interface ResolvedRemoteAddresses {\n all: NetworkAddress[]\n userVisible: NetworkAddress[]\n primaryRemoteUrl?: string\n}\n\nexport function resolveNetworkAddresses(args: {\n host: string\n protocol: \"http\" \| \"https\"\n port: number\n}): NetworkAddress[] {\n const { protocol, port } = args\n const host = normalizeNetworkHost(args.host)\n const interfaces = os.networkInterfaces()\n const seen = new Set<string>()\n const results: NetworkAddress[] = []\n\n const addAddress = (ip: string, scope: NetworkAddress[\"scope\"]) => {\n const normalizedIp = normalizeNetworkHost(ip)\n const ipVersion = isIP(normalizedIp)\n if (!ipVersion \|\| isWildcardHost(normalizedIp) \|\| (ipVersion === 6 && isLinkLocalIPv6(normalizedIp))) return\n const family = ipVersion === 6 ? \"ipv6\" : \"ipv4\"\n const key = `${family}-${normalizedIp}`\n if (seen.has(key)) return\n seen.add(key)\n results.push({ ip: normalizedIp, family, scope, remoteUrl: `${protocol}://${formatHostForUrl(normalizedIp)}:${port}` })\n }\n\n if (isWildcardHost(host)) {\n const wildcardVersion = isIP(host)\n for (const entries of Object.values(interfaces)) {\n if (!entries) continue\n for (const entry of entries) {\n const entryVersion = isIP(normalizeNetworkHost(entry.address))\n if (entryVersion !== wildcardVersion && !(wildcardVersion === 6 && entryVersion === 4)) continue\n const scope: NetworkAddress[\"scope\"] = entry.internal ? \"loopback\" : \"external\"\n addAddress(entry.address, scope)\n }\n }\n } else if (isIP(host)) {\n addAddress(host, isLoopbackHost(host) ? \"loopback\" : \"external\")\n }\n\n const scopeWeight: Record<NetworkAddress[\"scope\"], number> = { external: 0, internal: 1, loopback: 2 }\n\n return results.sort((a, b) => {\n const scopeDelta = scopeWeight[a.scope] - scopeWeight[b.scope]\n if (scopeDelta !== 0) return scopeDelta\n\n return 0\n })\n}\n\nexport function resolveRemoteAddresses(args: {\n host: string\n protocol: \"http\" \| \"https\"\n port: number\n}): ResolvedRemoteAddresses {\n const all = resolveNetworkAddresses(args)\n const userVisible = sortUserVisibleAddresses(all.filter((address) => address.scope === \"external\"))\n return {\n all,\n userVisible,\n primaryRemoteUrl: userVisible[0]?.remoteUrl,\n }\n}\n\nfunction sortUserVisibleAddresses(addresses: NetworkAddress[]): NetworkAddress[] {\n return [...addresses].sort((left, right) => getUserVisiblePriority(left.ip) - getUserVisiblePriority(right.ip))\n}\n\nfunction getUserVisiblePriority(ip: string): number {\n if (isPrivateIPv4(ip)) return 0\n if (isLinkLocalIPv4(ip)) return 2\n return 1\n}\n\nfunction isLinkLocalIPv4(ip: string): boolean {\n const octets = parseIPv4(ip)\n if (!octets) return false\n const [first, second] = octets\n return first === 169 && second === 254\n}\n\nfunction isPrivateIPv4(ip: string): boolean {\n const octets = parseIPv4(ip)\n if (!octets) return false\n const [first, second] = octets\n\n if (first === 10) return true\n if (first === 192 && second === 168) return true\n return first === 172 && second >= 16 && second <= 31\n}\n\nfunction parseIPv4(value: string): number[] \| null {\n if (isIP(value) !== 4) return null\n return value.split(\".\").map((part) => Number(part))\n}\n\nfunction isLinkLocalIPv6(ip: string): boolean {\n const firstSegment = Number.parseInt(ip.split(\":\", 1)[0], 16)\n return Number.isInteger(firstSegment) && firstSegment >= 0xfe80 && firstSegment <= 0xfebf\n}\n"]}

package/dist/server/network-host.js ADDED Viewed

@@ -0,0 +1,62 @@
+import { isIP } from "node:net";
+import { domainToASCII } from "node:url";
+export function stripHostBrackets(host) {
+    const trimmed = host.trim();
+    return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+}
+export function normalizeNetworkHost(host) {
+    const value = stripHostBrackets(host).toLowerCase();
+    if (isIP(value) === 6) {
+        const canonical = canonicalIPv6(value);
+        const mapped = canonical?.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (mapped) {
+            const high = Number.parseInt(mapped[1], 16);
+            const low = Number.parseInt(mapped[2], 16);
+            return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+        }
+    }
+    if (isIP(value))
+        return value;
+    return domainToASCII(value) || value;
+}
+export function hasIPv6Zone(host) {
+    const value = stripHostBrackets(host);
+    return value.includes("%") && isIP(value) === 6;
+}
+export function stripIPv6Zone(host) {
+    const value = stripHostBrackets(host);
+    return hasIPv6Zone(value) ? value.slice(0, value.lastIndexOf("%")) : value;
+}
+export function isWildcardHost(host) {
+    const value = normalizeNetworkHost(host);
+    if (value === "0.0.0.0")
+        return true;
+    return isIP(value) === 6 && value.split(":").every((segment) => segment === "" || /^0+$/.test(segment));
+}
+export function isLoopbackHost(host) {
+    const value = normalizeNetworkHost(host);
+    if (value === "localhost")
+        return true;
+    if (isIP(value) === 4)
+        return value.startsWith("127.");
+    if (isIP(value) !== 6)
+        return false;
+    const segments = value.split(":");
+    const last = segments.pop();
+    return Boolean(last && /^0*1$/.test(last)) && segments.every((segment) => segment === "" || /^0+$/.test(segment));
+}
+export function formatHostForUrl(host) {
+    const value = normalizeNetworkHost(host);
+    return isIP(value) === 6 ? `[${value}]` : value;
+}
+function canonicalIPv6(value) {
+    if (hasIPv6Zone(value))
+        return null;
+    try {
+        return new URL(`http://[${value}]`).hostname.slice(1, -1);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=network-host.js.map

package/dist/server/network-host.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"network-host.js","sourceRoot":"","sources":["../../src/server/network-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAC1F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IACnD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,SAAS,EAAE,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC1C,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAA;QAChE,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACzG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC3B,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACnH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAA;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC","sourcesContent":["import { isIP } from \"node:net\"\nimport { domainToASCII } from \"node:url\"\n\nexport function stripHostBrackets(host: string): string {\n const trimmed = host.trim()\n return trimmed.startsWith(\"[\") && trimmed.endsWith(\"]\") ? trimmed.slice(1, -1) : trimmed\n}\n\nexport function normalizeNetworkHost(host: string): string {\n const value = stripHostBrackets(host).toLowerCase()\n if (isIP(value) === 6) {\n const canonical = canonicalIPv6(value)\n const mapped = canonical?.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)\n if (mapped) {\n const high = Number.parseInt(mapped[1], 16)\n const low = Number.parseInt(mapped[2], 16)\n return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`\n }\n }\n if (isIP(value)) return value\n return domainToASCII(value) || value\n}\n\nexport function hasIPv6Zone(host: string): boolean {\n const value = stripHostBrackets(host)\n return value.includes(\"%\") && isIP(value) === 6\n}\n\nexport function stripIPv6Zone(host: string): string {\n const value = stripHostBrackets(host)\n return hasIPv6Zone(value) ? value.slice(0, value.lastIndexOf(\"%\")) : value\n}\n\nexport function isWildcardHost(host: string): boolean {\n const value = normalizeNetworkHost(host)\n if (value === \"0.0.0.0\") return true\n return isIP(value) === 6 && value.split(\":\").every((segment) => segment === \"\" || /^0+$/.test(segment))\n}\n\nexport function isLoopbackHost(host: string): boolean {\n const value = normalizeNetworkHost(host)\n if (value === \"localhost\") return true\n if (isIP(value) === 4) return value.startsWith(\"127.\")\n if (isIP(value) !== 6) return false\n\n const segments = value.split(\":\")\n const last = segments.pop()\n return Boolean(last && /^0*1$/.test(last)) && segments.every((segment) => segment === \"\" || /^0+$/.test(segment))\n}\n\nexport function formatHostForUrl(host: string): string {\n const value = normalizeNetworkHost(host)\n return isIP(value) === 6 ? `[${value}]` : value\n}\n\nfunction canonicalIPv6(value: string): string | null {\n if (hasIPv6Zone(value)) return null\n try {\n return new URL(`http://[${value}]`).hostname.slice(1, -1)\n } catch {\n return null\n }\n}\n"]}

package/dist/server/routes/meta.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { isLoopbackHost, isWildcardHost } from "../network-host";
 export function registerMetaRoutes(app, deps) {
     app.get("/api/meta", async () => buildMetaResponse(deps.serverMeta));
 }
@@ -8,7 +9,7 @@ function buildMetaResponse(meta) {
         ...meta,
         localPort,
         remotePort: remote?.port,
-        listeningMode: meta.host === "0.0.0.0" || !isLoopbackHost(meta.host) ? "all" : "local",
+        listeningMode: isWildcardHost(meta.host) || !isLoopbackHost(meta.host) ? "all" : "local",
     };
 }
 function resolveLocalPort(meta) {
@@ -38,8 +39,5 @@ function resolveRemote(meta) {
         return null;
     }
 }
-function isLoopbackHost(host) {
-    return host === "127.0.0.1" || host === "::1" || host.startsWith("127.");
-}
 // NetworkAddress shape is resolved in ../network-addresses
 //# sourceMappingURL=meta.js.map

package/dist/server/routes/meta.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/server/routes/meta.ts"],"names":[],"mappings":"~~AAQA~~,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,IAAe;IACtE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,UAAU,EAAE,MAAM,EAAE,IAAI;QACxB,aAAa,EAAE,IAAI,CAAC,IAAI,~~KAAK~~,~~SAAS,~~IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;~~KACvF~~,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,~~SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC1E,CAAC;AAED,~~2DAA2D","sourcesContent":["import { FastifyInstance } from \"fastify\"\nimport { ServerMeta } from \"../../api-types\"\n \n\ninterface RouteDeps {\n serverMeta: ServerMeta\n}\n\nexport function registerMetaRoutes(app: FastifyInstance, deps: RouteDeps) {\n app.get(\"/api/meta\", async () => buildMetaResponse(deps.serverMeta))\n}\n\nfunction buildMetaResponse(meta: ServerMeta): ServerMeta {\n const localPort = resolveLocalPort(meta)\n const remote = resolveRemote(meta)\n\n return {\n ...meta,\n localPort,\n remotePort: remote?.port,\n listeningMode: meta.host ~~=== \"0.0.0.0\"~~ \|\| !isLoopbackHost(meta.host) ? \"all\" : \"local\",\n }\n}\n\nfunction resolveLocalPort(meta: ServerMeta): number {\n if (Number.isInteger(meta.localPort) && meta.localPort > 0) {\n return meta.localPort\n }\n try {\n const parsed = new URL(meta.localUrl)\n const port = Number(parsed.port)\n return Number.isInteger(port) && port > 0 ? port : 0\n } catch {\n return 0\n }\n}\n\nfunction resolveRemote(meta: ServerMeta): { protocol: \"http\" \| \"https\"; port: number } \| null {\n if (!meta.remoteUrl) {\n return null\n }\n try {\n const parsed = new URL(meta.remoteUrl)\n const protocol = parsed.protocol === \"https:\" ? \"https\" : \"http\"\n const port = Number(parsed.port)\n return { protocol, port: Number.isInteger(port) && port > 0 ? port : 0 }\n } catch {\n return null\n }\n}\n\~~nfunction isLoopbackHost(host: string): boolean {\~~n ~~return host === \"127.0.0.1\" \|\| host === \"::1\" \|\| host.startsWith(\"127.\")\n}\n\n~~// NetworkAddress shape is resolved in ../network-addresses\n"]}
1	+ {"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/server/routes/meta.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAOhE,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,IAAe;IACtE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAElC,OAAO;QACL,GAAG,IAAI;QACP,SAAS;QACT,UAAU,EAAE,MAAM,EAAE,IAAI;QACxB,aAAa,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;KACzF,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAA;IACV,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,2DAA2D","sourcesContent":["import { FastifyInstance } from \"fastify\"\nimport { ServerMeta } from \"../../api-types\"\nimport { isLoopbackHost, isWildcardHost } from \"../network-host\"\n \n\ninterface RouteDeps {\n serverMeta: ServerMeta\n}\n\nexport function registerMetaRoutes(app: FastifyInstance, deps: RouteDeps) {\n app.get(\"/api/meta\", async () => buildMetaResponse(deps.serverMeta))\n}\n\nfunction buildMetaResponse(meta: ServerMeta): ServerMeta {\n const localPort = resolveLocalPort(meta)\n const remote = resolveRemote(meta)\n\n return {\n ...meta,\n localPort,\n remotePort: remote?.port,\n listeningMode: isWildcardHost(meta.host) \|\| !isLoopbackHost(meta.host) ? \"all\" : \"local\",\n }\n}\n\nfunction resolveLocalPort(meta: ServerMeta): number {\n if (Number.isInteger(meta.localPort) && meta.localPort > 0) {\n return meta.localPort\n }\n try {\n const parsed = new URL(meta.localUrl)\n const port = Number(parsed.port)\n return Number.isInteger(port) && port > 0 ? port : 0\n } catch {\n return 0\n }\n}\n\nfunction resolveRemote(meta: ServerMeta): { protocol: \"http\" \| \"https\"; port: number } \| null {\n if (!meta.remoteUrl) {\n return null\n }\n try {\n const parsed = new URL(meta.remoteUrl)\n const protocol = parsed.protocol === \"https:\" ? \"https\" : \"http\"\n const port = Number(parsed.port)\n return { protocol, port: Number.isInteger(port) && port > 0 ? port : 0 }\n } catch {\n return null\n }\n}\n\n// NetworkAddress shape is resolved in ../network-addresses\n"]}

package/dist/server/routes/session-pruning.js ADDED Viewed

@@ -0,0 +1,45 @@
+import { messageTargetSchema, PRUNING_RPC_ID, prunePreviewSchema, pruneRequestSchema, pruneResultSchema } from "../../opencode/session-pruning/contract";
+export function registerSessionPruningRoutes(app, deps) {
+    for (const method of ["preview", "prune"]) {
+        app.post(`/api/workspaces/:id/session-pruning/${method}`, { bodyLimit: 1024 * 1024 }, async (request, reply) => {
+            const input = (method === "prune" ? pruneRequestSchema : messageTargetSchema).safeParse(request.body);
+            if (!input.success)
+                return reply.code(400).send({ error: "Invalid pruning request" });
+            const client = await deps.workspaceManager.getSharedServiceClient();
+            const session = await client.session.get({ sessionID: input.data.sessionID });
+            if (!await deps.workspaceManager.ownsLocation(request.params.id, session.location)) {
+                return reply.code(403).send({ error: "Session does not belong to workspace" });
+            }
+            const identity = await deps.workspaceManager.getWorktreeIdentityForPath(request.params.id, session.location.directory);
+            if (!identity)
+                return reply.code(403).send({ error: "Session does not belong to workspace" });
+            const release = deps.worktreeDeletionFence.enter([identity]);
+            if (!release)
+                return reply.code(409).send({ error: "Worktree deletion is in progress" });
+            try {
+                // Narrow broker only: callers cannot choose RPC ID, method, location,
+                // database filename, SQL, or replacement content. Generic RPC stays blocked.
+                const result = await client.rpc.call({
+                    rpcID: PRUNING_RPC_ID, method, input: input.data, location: { directory: session.location.directory },
+                }, { signal: AbortSignal.timeout(15_000) });
+                const output = (method === "prune" ? pruneResultSchema : prunePreviewSchema).safeParse(result.output);
+                if (!output.success)
+                    return { status: "blocked", reason: "unavailable" };
+                if (output.data.status === "pruned" && (output.data.messageID !== input.data.messageID
+                    || !("indexes" in input.data) || !Array.isArray(input.data.indexes) || output.data.removedCount !== input.data.indexes.length)) {
+                    return { status: "blocked", reason: "unavailable" };
+                }
+                return output.data;
+            }
+            catch {
+                // Missing plugin, incompatible runtime, timeout: no legacy API fallback
+                // and no local-only deletion presented as a successful database write.
+                return { status: "blocked", reason: "unavailable" };
+            }
+            finally {
+                release();
+            }
+        });
+    }
+}
+//# sourceMappingURL=session-pruning.js.map

package/dist/server/routes/session-pruning.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"session-pruning.js","sourceRoot":"","sources":["../../../src/server/routes/session-pruning.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AASxJ,MAAM,UAAU,4BAA4B,CAAC,GAAoB,EAAE,IAAe;IAChF,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,OAAO,CAAU,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAA6B,uCAAuC,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACzI,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YACrG,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAA;YACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAA;YACnE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;YAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAA;YAChF,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACtH,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAA;YAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAA;YACxF,IAAI,CAAC;gBACH,sEAAsE;gBACtE,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;oBACnC,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;iBACtG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACrG,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;gBACxE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS;uBACjF,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjI,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;gBACrD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAA;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,uEAAuE;gBACvE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;YACrD,CAAC;oBAAS,CAAC;gBAAC,OAAO,EAAE,CAAA;YAAC,CAAC;QACzB,CAAC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["import type { FastifyInstance } from \"fastify\"\nimport { messageTargetSchema, PRUNING_RPC_ID, prunePreviewSchema, pruneRequestSchema, pruneResultSchema } from \"../../opencode/session-pruning/contract\"\nimport type { WorkspaceManager } from \"../../workspaces/manager\"\nimport type { WorktreeDeletionFence } from \"../../workspaces/worktree-session-evacuation\"\n\ninterface RouteDeps {\n workspaceManager: Pick<WorkspaceManager, \"getSharedServiceClient\" | \"ownsLocation\" | \"getWorktreeIdentityForPath\">\n worktreeDeletionFence: WorktreeDeletionFence\n}\n\nexport function registerSessionPruningRoutes(app: FastifyInstance, deps: RouteDeps): void {\n for (const method of [\"preview\", \"prune\"] as const) {\n app.post<{ Params: { id: string } }>(`/api/workspaces/:id/session-pruning/${method}`, { bodyLimit: 1024 * 1024 }, async (request, reply) => {\n const input = (method === \"prune\" ? pruneRequestSchema : messageTargetSchema).safeParse(request.body)\n if (!input.success) return reply.code(400).send({ error: \"Invalid pruning request\" })\n const client = await deps.workspaceManager.getSharedServiceClient()\n const session = await client.session.get({ sessionID: input.data.sessionID })\n if (!await deps.workspaceManager.ownsLocation(request.params.id, session.location)) {\n return reply.code(403).send({ error: \"Session does not belong to workspace\" })\n }\n const identity = await deps.workspaceManager.getWorktreeIdentityForPath(request.params.id, session.location.directory)\n if (!identity) return reply.code(403).send({ error: \"Session does not belong to workspace\" })\n const release = deps.worktreeDeletionFence.enter([identity])\n if (!release) return reply.code(409).send({ error: \"Worktree deletion is in progress\" })\n try {\n // Narrow broker only: callers cannot choose RPC ID, method, location,\n // database filename, SQL, or replacement content. Generic RPC stays blocked.\n const result = await client.rpc.call({\n rpcID: PRUNING_RPC_ID, method, input: input.data, location: { directory: session.location.directory },\n }, { signal: AbortSignal.timeout(15_000) })\n const output = (method === \"prune\" ? pruneResultSchema : prunePreviewSchema).safeParse(result.output)\n if (!output.success) return { status: \"blocked\", reason: \"unavailable\" }\n if (output.data.status === \"pruned\" && (output.data.messageID !== input.data.messageID\n || !(\"indexes\" in input.data) || !Array.isArray(input.data.indexes) || output.data.removedCount !== input.data.indexes.length)) {\n return { status: \"blocked\", reason: \"unavailable\" }\n }\n return output.data\n } catch {\n // Missing plugin, incompatible runtime, timeout: no legacy API fallback\n // and no local-only deletion presented as a successful database write.\n return { status: \"blocked\", reason: \"unavailable\" }\n } finally { release() }\n })\n }\n}\n"]}

package/dist/server/routes/session-pruning.test.js ADDED Viewed

@@ -0,0 +1,98 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import Fastify from "fastify";
+import { registerSessionPruningRoutes } from "./session-pruning";
+import { WorktreeDeletionFence } from "../../workspaces/worktree-session-evacuation";
+const payload = { sessionID: "s", messageID: "m", revision: "a".repeat(64), indexes: [0] };
+const url = "/api/workspaces/w/session-pruning/prune";
+function fixture(options = {}) {
+    const calls = [];
+    const app = Fastify();
+    const fence = new WorktreeDeletionFence();
+    registerSessionPruningRoutes(app, { worktreeDeletionFence: fence, workspaceManager: {
+            getSharedServiceClient: async () => ({
+                session: { get: async () => ({ location: { directory: "/owned/worktree" } }) },
+                rpc: { call: async (input, opts) => {
+                        assert(opts.signal instanceof AbortSignal);
+                        calls.push(input);
+                        if (options.fail)
+                            throw new Error("plugin unavailable");
+                        return { output: options.output ?? { status: "blocked", reason: "maintenance_required" } };
+                    } },
+            }),
+            ownsLocation: async () => options.owned !== false,
+            getWorktreeIdentityForPath: async () => "/owned/worktree",
+        } });
+    return { app, calls, fence };
+}
+test("broker pins RPC, method and native session location", async () => {
+    const { app, calls } = fixture();
+    try {
+        const response = await app.inject({ method: "POST", url, payload });
+        assert.equal(response.statusCode, 200);
+        assert.deepEqual(response.json(), { status: "blocked", reason: "maintenance_required" });
+        assert.deepEqual(calls, [{ rpcID: "codenomad.session-pruning", method: "prune", input: payload, location: { directory: "/owned/worktree" } }]);
+    }
+    finally {
+        await app.close();
+    }
+});
+test("rejects unowned sessions before any RPC", async () => {
+    const { app, calls } = fixture({ owned: false });
+    try {
+        assert.equal((await app.inject({ method: "POST", url, payload })).statusCode, 403);
+        assert.equal(calls.length, 0);
+    }
+    finally {
+        await app.close();
+    }
+});
+test("rejects caller-selected location, RPC, database and replacement content", async () => {
+    const { app, calls } = fixture();
+    try {
+        for (const extra of [{ location: { directory: "/other" } }, { rpcID: "other" }, { databasePath: "live.db" }, { content: [] }]) {
+            assert.equal((await app.inject({ method: "POST", url, payload: { ...payload, ...extra } })).statusCode, 400);
+        }
+        assert.equal(calls.length, 0);
+    }
+    finally {
+        await app.close();
+    }
+});
+test("does not bypass worktree deletion fence", async () => {
+    const { app, calls, fence } = fixture();
+    try {
+        await fence.run("/owned/worktree", ["/owned/worktree"], async () => {
+            assert.equal((await app.inject({ method: "POST", url, payload })).statusCode, 409);
+        });
+        assert.equal(calls.length, 0);
+    }
+    finally {
+        await app.close();
+    }
+});
+test("missing plugin, malformed response, wrong message or count never report success", async () => {
+    for (const options of [{ fail: true }, { output: {} }, { output: { status: "pruned", messageID: "other", revision: "a".repeat(64), removedCount: 1 } }, { output: { status: "pruned", messageID: "m", revision: "a".repeat(64), removedCount: 2 } }]) {
+        const { app, fence } = fixture(options);
+        try {
+            const response = await app.inject({ method: "POST", url, payload });
+            assert.deepEqual(response.json(), { status: "blocked", reason: "unavailable" });
+            await fence.run("/owned/worktree", ["/owned/worktree"], async () => { });
+        }
+        finally {
+            await app.close();
+        }
+    }
+});
+test("preview accepts IDs only and uses a distinct fixed RPC method", async () => {
+    const { app, calls } = fixture({ output: { status: "preview", revision: "a".repeat(64), liveMutation: false, parts: [] } });
+    try {
+        const response = await app.inject({ method: "POST", url: url.replace(/prune$/, "preview"), payload: { sessionID: "s", messageID: "m" } });
+        assert.equal(response.json().status, "preview");
+        assert.equal(calls[0].method, "preview");
+    }
+    finally {
+        await app.close();
+    }
+});
+//# sourceMappingURL=session-pruning.test.js.map

package/dist/server/routes/session-pruning.test.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"session-pruning.test.js","sourceRoot":"","sources":["../../../src/server/routes/session-pruning.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAA;AAEpF,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC1F,MAAM,GAAG,GAAG,yCAAyC,CAAA;AACrD,SAAS,OAAO,CAAC,UAAiE,EAAE;IAClF,MAAM,KAAK,GAAU,EAAE,CAAA;IACvB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;IACrB,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAA;IACzC,4BAA4B,CAAC,GAAG,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,gBAAgB,EAAE;YAClF,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACnC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE;gBAC9E,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,IAAS,EAAE,EAAE;wBAC/C,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,WAAW,CAAC,CAAA;wBAC1C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;wBACjB,IAAI,OAAO,CAAC,IAAI;4BAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;wBACvD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,EAAE,CAAA;oBAC5F,CAAC,EAAE;aACJ,CAAQ;YACT,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK;YACjD,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,iBAAiB;SAC1D,EAAE,CAAC,CAAA;IACJ,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACtC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAA;QACxF,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAA;IAChJ,CAAC;YAAS,CAAC;QAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;IACzD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC/B,CAAC;YAAS,CAAC;QAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YAC9H,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC9G,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC/B,CAAC;YAAS,CAAC;QAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;IACzD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QACpF,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC/B,CAAC;YAAS,CAAC;QAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACrP,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;YAC/E,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAA;QACzE,CAAC;gBAAS,CAAC;YAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACjC,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3H,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACzI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAC/C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC1C,CAAC;YAAS,CAAC;QAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACjC,CAAC,CAAC,CAAA","sourcesContent":["import assert from \"node:assert/strict\"\nimport { test } from \"node:test\"\nimport Fastify from \"fastify\"\nimport { registerSessionPruningRoutes } from \"./session-pruning\"\nimport { WorktreeDeletionFence } from \"../../workspaces/worktree-session-evacuation\"\n\nconst payload = { sessionID: \"s\", messageID: \"m\", revision: \"a\".repeat(64), indexes: [0] }\nconst url = \"/api/workspaces/w/session-pruning/prune\"\nfunction fixture(options: { owned?: boolean; output?: unknown; fail?: boolean } = {}) {\n const calls: any[] = []\n const app = Fastify()\n const fence = new WorktreeDeletionFence()\n registerSessionPruningRoutes(app, { worktreeDeletionFence: fence, workspaceManager: {\n getSharedServiceClient: async () => ({\n session: { get: async () => ({ location: { directory: \"/owned/worktree\" } }) },\n rpc: { call: async (input: unknown, opts: any) => {\n assert(opts.signal instanceof AbortSignal)\n calls.push(input)\n if (options.fail) throw new Error(\"plugin unavailable\")\n return { output: options.output ?? { status: \"blocked\", reason: \"maintenance_required\" } }\n } },\n }) as any,\n ownsLocation: async () => options.owned !== false,\n getWorktreeIdentityForPath: async () => \"/owned/worktree\",\n } })\n return { app, calls, fence }\n}\n\ntest(\"broker pins RPC, method and native session location\", async () => {\n const { app, calls } = fixture()\n try {\n const response = await app.inject({ method: \"POST\", url, payload })\n assert.equal(response.statusCode, 200)\n assert.deepEqual(response.json(), { status: \"blocked\", reason: \"maintenance_required\" })\n assert.deepEqual(calls, [{ rpcID: \"codenomad.session-pruning\", method: \"prune\", input: payload, location: { directory: \"/owned/worktree\" } }])\n } finally { await app.close() }\n})\n\ntest(\"rejects unowned sessions before any RPC\", async () => {\n const { app, calls } = fixture({ owned: false })\n try {\n assert.equal((await app.inject({ method: \"POST\", url, payload })).statusCode, 403)\n assert.equal(calls.length, 0)\n } finally { await app.close() }\n})\n\ntest(\"rejects caller-selected location, RPC, database and replacement content\", async () => {\n const { app, calls } = fixture()\n try {\n for (const extra of [{ location: { directory: \"/other\" } }, { rpcID: \"other\" }, { databasePath: \"live.db\" }, { content: [] }]) {\n assert.equal((await app.inject({ method: \"POST\", url, payload: { ...payload, ...extra } })).statusCode, 400)\n }\n assert.equal(calls.length, 0)\n } finally { await app.close() }\n})\n\ntest(\"does not bypass worktree deletion fence\", async () => {\n const { app, calls, fence } = fixture()\n try {\n await fence.run(\"/owned/worktree\", [\"/owned/worktree\"], async () => {\n assert.equal((await app.inject({ method: \"POST\", url, payload })).statusCode, 409)\n })\n assert.equal(calls.length, 0)\n } finally { await app.close() }\n})\n\ntest(\"missing plugin, malformed response, wrong message or count never report success\", async () => {\n for (const options of [{ fail: true }, { output: {} }, { output: { status: \"pruned\", messageID: \"other\", revision: \"a\".repeat(64), removedCount: 1 } }, { output: { status: \"pruned\", messageID: \"m\", revision: \"a\".repeat(64), removedCount: 2 } }]) {\n const { app, fence } = fixture(options)\n try {\n const response = await app.inject({ method: \"POST\", url, payload })\n assert.deepEqual(response.json(), { status: \"blocked\", reason: \"unavailable\" })\n await fence.run(\"/owned/worktree\", [\"/owned/worktree\"], async () => {})\n } finally { await app.close() }\n }\n})\n\ntest(\"preview accepts IDs only and uses a distinct fixed RPC method\", async () => {\n const { app, calls } = fixture({ output: { status: \"preview\", revision: \"a\".repeat(64), liveMutation: false, parts: [] } })\n try {\n const response = await app.inject({ method: \"POST\", url: url.replace(/prune$/, \"preview\"), payload: { sessionID: \"s\", messageID: \"m\" } })\n assert.equal(response.json().status, \"preview\")\n assert.equal(calls[0].method, \"preview\")\n } finally { await app.close() }\n})\n"]}

package/dist/server/tls.js CHANGED Viewed

@@ -2,6 +2,8 @@ import crypto from "crypto";
 import fs from "fs";
 import path from "path";
 import { createRequire } from "module";
+import { isIP } from "node:net";
+import { isWildcardHost, normalizeNetworkHost, stripIPv6Zone } from "./network-host";
 const require = createRequire(import.meta.url);
 function loadForge() {
     // node-forge is CJS in many installs; require keeps this compatible with our ESM output.
@@ -39,12 +41,12 @@ function ensureGeneratedTls(args) {
             if (!fs.existsSync(certPath))
                 return true;
             const pem = fs.readFileSync(certPath, "utf-8");
-            const x509 = new crypto.X509Certificate(pem);
-            const validToMs = Date.parse(x509.validTo);
+            const certificate = new crypto.X509Certificate(pem);
+            const validToMs = Date.parse(certificate.validTo);
             if (!Number.isFinite(validToMs))
                 return true;
             const rotateAt = validToMs - ROTATE_IF_EXPIRES_WITHIN_DAYS * 24 * 60 * 60 * 1000;
-            return Date.now() >= rotateAt;
+            return Date.now() >= rotateAt || !certificateCoversRequiredSans(certificate, args.host, args.tlsSANs);
         }
         catch {
             return true;
@@ -164,44 +166,73 @@ function generateServerCertificate(args) {
     };
 }
 function pickCommonName(host) {
-    if (!host || host === "0.0.0.0") {
+    const normalizedHost = normalizeCertificateHost(host);
+    if (!normalizedHost || isWildcardHost(normalizedHost)) {
         return "localhost";
     }
-    if (host === "127.0.0.1") {
+    if (normalizedHost === "127.0.0.1") {
         return "localhost";
     }
-    return host;
+    return normalizedHost;
 }
 function buildSubjectAltNames(host, tlsSANs) {
+    const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs);
+    const altNames = [];
+    // 2 = DNS, 7 = IP
+    for (const name of dns) {
+        altNames.push({ type: 2, value: name });
+    }
+    for (const ip of ips) {
+        altNames.push({ type: 7, ip });
+    }
+    return altNames;
+}
+function resolveRequiredSubjectAltNames(host, tlsSANs) {
     const dns = new Set();
     const ips = new Set();
     dns.add("localhost");
     ips.add("127.0.0.1");
-    if (host && host !== "0.0.0.0") {
-        if (isIPv4(host)) {
-            ips.add(host);
+    const normalizedHost = normalizeCertificateHost(host);
+    if (isWildcardHost(normalizedHost) && isIP(normalizedHost) === 6) {
+        ips.add("::1");
+    }
+    else if (normalizedHost) {
+        if (isIP(normalizedHost)) {
+            ips.add(normalizedHost);
         }
         else {
-            dns.add(host);
+            dns.add(normalizedHost);
         }
     }
     for (const token of splitList(tlsSANs)) {
-        if (isIPv4(token)) {
-            ips.add(token);
+        const normalizedToken = normalizeCertificateHost(token);
+        if (isIP(normalizedToken)) {
+            ips.add(normalizedToken);
         }
-        else if (token) {
-            dns.add(token);
+        else if (normalizedToken) {
+            dns.add(normalizedToken);
         }
     }
-    const altNames = [];
-    // 2 = DNS, 7 = IP
-    for (const name of Array.from(dns)) {
-        altNames.push({ type: 2, value: name });
+    return { dns, ips };
+}
+function normalizeCertificateHost(host) {
+    return normalizeNetworkHost(stripIPv6Zone(host));
+}
+function certificateCoversRequiredSans(certificate, host, tlsSANs) {
+    const { dns, ips } = resolveRequiredSubjectAltNames(host, tlsSANs);
+    const existingDns = new Set((certificate.subjectAltName ?? "")
+        .split(/,\s*/)
+        .filter((entry) => entry.startsWith("DNS:"))
+        .map((entry) => entry.slice(4).toLowerCase()));
+    for (const name of dns) {
+        if (!existingDns.has(name.toLowerCase()))
+            return false;
     }
-    for (const ip of Array.from(ips)) {
-        altNames.push({ type: 7, ip });
+    for (const ip of ips) {
+        if (!certificate.checkIP(ip))
+            return false;
     }
-    return altNames;
+    return true;
 }
 function splitList(input) {
     if (!input)
@@ -211,15 +242,4 @@ function splitList(input) {
         .map((part) => part.trim())
         .filter(Boolean);
 }
-function isIPv4(value) {
-    const parts = value.split(".");
-    if (parts.length !== 4)
-        return false;
-    return parts.every((part) => {
-        if (!/^[0-9]+$/.test(part))
-            return false;
-        const num = Number(part);
-        return Number.isInteger(num) && num >= 0 && num <= 255;
-    });
-}
 //# sourceMappingURL=tls.js.map