@oh-my-pi/omp-stats 17.2.8 → 17.2.9

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [17.2.9] - 2026-08-05
+
+### Fixed
+
+- Restricted the stats dashboard to IPv4 loopback and removed wildcard CORS access to its API ([#7633](https://github.com/can1357/oh-my-pi/issues/7633)).
+
 ## [17.2.4] - 2026-08-01
 
 ### Fixed

package/dist/types/port-conflict.d.ts

@@ -1,4 +1,14 @@
 /** Header stamped on every dashboard response so reuse probes can identify us. */
 export declare const STATS_DASHBOARD_HEADER = "x-omp-stats-dashboard";
-/** Reuse a live stats dashboard or reclaim the port from a stale omp runtime. */
+/** Identity-header value for dashboards enforcing loopback-only, same-origin access. */
+export declare const STATS_DASHBOARD_SECURITY_VERSION = "2";
+/** IPv4 loopback address shared by the dashboard server and reuse probe. */
+export declare const STATS_DASHBOARD_HOSTNAME = "127.0.0.1";
+/**
+ * Reuse a secure dashboard or reclaim an insecure HTTP dashboard before binding.
+ * The preflight is needed on platforms that permit wildcard and loopback-specific
+ * listeners to coexist on one port.
+ */
+export declare function prepareStatsPort(port: number): Promise<"retry" | "reuse">;
+/** Reuse or reclaim a listener found after the server bind reports EADDRINUSE. */
 export declare function recoverStatsPort(port: number): Promise<"retry" | "reuse">;

package/dist/types/server.d.ts

@@ -6,6 +6,7 @@ export declare function handleApi(req: Request): Promise<Response>;
  * Start the HTTP server, reusing a live dashboard or reclaiming a stale omp listener.
  */
 export declare function startServer(port?: number): Promise<{
+    hostname: string;
     port: number;
     stop: () => void;
 }>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/omp-stats",
-	"version": "17.2.8",
+	"version": "17.2.9",
 	"description": "Local observability dashboard for pi AI usage statistics",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -39,9 +39,9 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-ai": "17.2.8",
-		"@oh-my-pi/pi-catalog": "17.2.8",
-		"@oh-my-pi/pi-utils": "17.2.8",
+		"@oh-my-pi/pi-ai": "17.2.9",
+		"@oh-my-pi/pi-catalog": "17.2.9",
+		"@oh-my-pi/pi-utils": "17.2.9",
 		"@tailwindcss/node": "^4.3.2",
 		"chart.js": "^4.5.1",
 		"date-fns": "^4.4.0",

package/src/index.ts

@@ -171,8 +171,8 @@ Examples:
 
 		// Start server
 		const port = parseInt(values.port || "3847", 10);
-		const { port: actualPort } = await startServer(port);
-		console.log(`Dashboard available at: http://localhost:${actualPort}`);
+		const { hostname, port: actualPort } = await startServer(port);
+		console.log(`Dashboard available at: http://${hostname}:${actualPort}`);
 		console.log("Press Ctrl+C to stop\n");
 
 		// Keep process running

package/src/port-conflict.ts

@@ -18,30 +18,27 @@ interface PortHolder {
 /** Header stamped on every dashboard response so reuse probes can identify us. */
 export const STATS_DASHBOARD_HEADER = "x-omp-stats-dashboard";
 
-async function probeStatsDashboard(port: number): Promise<boolean> {
+/** Identity-header value for dashboards enforcing loopback-only, same-origin access. */
+export const STATS_DASHBOARD_SECURITY_VERSION = "2";
+
+/** IPv4 loopback address shared by the dashboard server and reuse probe. */
+export const STATS_DASHBOARD_HOSTNAME = "127.0.0.1";
+
+type StatsDashboardProbe = "reusable" | "occupied" | "unreachable";
+
+async function probeStatsDashboard(port: number): Promise<StatsDashboardProbe> {
 	try {
-		const response = await fetch(`http://localhost:${port}/api/stats/models`, {
+		const response = await fetch(`http://${STATS_DASHBOARD_HOSTNAME}:${port}/api/stats/models`, {
 			signal: AbortSignal.timeout(STATS_PROBE_TIMEOUT_MS),
 		});
-		if (response.status !== 200) {
-			await response.body?.cancel();
-			return false;
-		}
-		// A live omp-stats dashboard stamps this header on every response.
-		if (response.headers.get(STATS_DASHBOARD_HEADER)) {
-			await response.body?.cancel();
-			return true;
-		}
-		// Older dashboards predate the header; fall back to the response shape
-		// (`/api/stats/models` returns a JSON array) so we never reuse — or later
-		// kill — a foreign 200 responder such as an SPA dev server catch-all.
-		if (!(response.headers.get("content-type") ?? "").includes("application/json")) {
-			await response.body?.cancel();
-			return false;
-		}
-		return Array.isArray(await response.json());
+		const reusable =
+			response.status === 200 &&
+			response.headers.get(STATS_DASHBOARD_HEADER) === STATS_DASHBOARD_SECURITY_VERSION &&
+			!response.headers.has("Access-Control-Allow-Origin");
+		await response.body?.cancel();
+		return reusable ? "reusable" : "occupied";
 	} catch {
-		return false;
+		return "unreachable";
 	}
 }
 
@@ -216,10 +213,7 @@ async function terminatePortHolder(holder: PortHolder): Promise<void> {
 	await Bun.sleep(PROCESS_EXIT_POLL_MS);
 }
 
-/** Reuse a live stats dashboard or reclaim the port from a stale omp runtime. */
-export async function recoverStatsPort(port: number): Promise<"retry" | "reuse"> {
-	if (await probeStatsDashboard(port)) return "reuse";
-
+async function reclaimStatsPort(port: number): Promise<"retry"> {
 	const holder = await findPortHolder(port);
 	if (!holder) {
 		throw new Error(`Port ${port} is in use, but the listening process could not be identified.`);
@@ -248,3 +242,22 @@ export async function recoverStatsPort(port: number): Promise<"retry" | "reuse">
 	await terminatePortHolder(holder);
 	return "retry";
 }
+
+/**
+ * Reuse a secure dashboard or reclaim an insecure HTTP dashboard before binding.
+ * The preflight is needed on platforms that permit wildcard and loopback-specific
+ * listeners to coexist on one port.
+ */
+export async function prepareStatsPort(port: number): Promise<"retry" | "reuse"> {
+	if (port === 0) return "retry";
+	const probe = await probeStatsDashboard(port);
+	if (probe === "reusable") return "reuse";
+	if (probe === "occupied") return reclaimStatsPort(port);
+	return "retry";
+}
+
+/** Reuse or reclaim a listener found after the server bind reports EADDRINUSE. */
+export async function recoverStatsPort(port: number): Promise<"retry" | "reuse"> {
+	if ((await probeStatsDashboard(port)) === "reusable") return "reuse";
+	return reclaimStatsPort(port);
+}

package/src/server.ts

@@ -21,7 +21,13 @@ import {
 import { decodeEmbeddedClientArchive } from "./embedded-client";
 import embeddedClientArchiveTxt from "./embedded-client.generated.txt";
 import { getGainDashboardStats } from "./gain-aggregator";
-import { recoverStatsPort, STATS_DASHBOARD_HEADER } from "./port-conflict";
+import {
+	prepareStatsPort,
+	recoverStatsPort,
+	STATS_DASHBOARD_HEADER,
+	STATS_DASHBOARD_HOSTNAME,
+	STATS_DASHBOARD_SECURITY_VERSION,
+} from "./port-conflict";
 
 const EMBEDDED_CLIENT_ARCHIVE = decodeEmbeddedClientArchive(embeddedClientArchiveTxt);
 
@@ -303,21 +309,19 @@ async function handleStatic(requestPath: string): Promise<Response> {
 function createDashboardServer(port: number) {
 	const server = Bun.serve({
 		port,
+		hostname: STATS_DASHBOARD_HOSTNAME,
 		async fetch(req) {
 			const url = new URL(req.url);
 			const path = url.pathname;
 
-			// CORS headers for local development; the identity header lets another
-			// omp session's reuse probe positively recognize this dashboard.
-			const corsHeaders: Record<string, string> = {
-				"Access-Control-Allow-Origin": "*",
-				"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-				"Access-Control-Allow-Headers": "Content-Type",
-				[STATS_DASHBOARD_HEADER]: "1",
+			// The identity header lets another omp session's reuse probe positively
+			// recognize this dashboard without allowing cross-origin API reads.
+			const dashboardHeaders: Record<string, string> = {
+				[STATS_DASHBOARD_HEADER]: STATS_DASHBOARD_SECURITY_VERSION,
 			};
 
 			if (req.method === "OPTIONS") {
-				return new Response(null, { headers: corsHeaders });
+				return new Response(null, { headers: dashboardHeaders });
 			}
 
 			try {
@@ -329,10 +333,10 @@ function createDashboardServer(port: number) {
 					response = await handleStatic(path);
 				}
 
-				// Add CORS headers to all responses
+				// Add the dashboard identity header to all responses.
 				const headers = new Headers(response.headers);
-				for (const key in corsHeaders) {
-					headers.set(key, corsHeaders[key]);
+				for (const key in dashboardHeaders) {
+					headers.set(key, dashboardHeaders[key]);
 				}
 
 				return new Response(response.body, {
@@ -343,7 +347,7 @@ function createDashboardServer(port: number) {
 				console.error("Server error:", error);
 				return Response.json(
 					{ error: error instanceof Error ? error.message : "Unknown error" },
-					{ status: 500, headers: corsHeaders },
+					{ status: 500, headers: dashboardHeaders },
 				);
 			}
 		},
@@ -354,12 +358,17 @@ function createDashboardServer(port: number) {
 /**
  * Start the HTTP server, reusing a live dashboard or reclaiming a stale omp listener.
  */
-export async function startServer(port = 3847): Promise<{ port: number; stop: () => void }> {
+export async function startServer(port = 3847): Promise<{ hostname: string; port: number; stop: () => void }> {
 	await ensureClientBuild();
+	const preparation = await prepareStatsPort(port);
+	if (preparation === "reuse") {
+		return { hostname: STATS_DASHBOARD_HOSTNAME, port, stop: () => {} };
+	}
 
 	try {
 		const server = createDashboardServer(port);
 		return {
+			hostname: STATS_DASHBOARD_HOSTNAME,
 			port: server.port ?? port,
 			stop: () => server.stop(),
 		};
@@ -368,12 +377,13 @@ export async function startServer(port = 3847): Promise<{ port: number; stop: ()
 
 		const recovery = await recoverStatsPort(port);
 		if (recovery === "reuse") {
-			return { port, stop: () => {} };
+			return { hostname: STATS_DASHBOARD_HOSTNAME, port, stop: () => {} };
 		}
 
 		try {
 			const server = createDashboardServer(port);
 			return {
+				hostname: STATS_DASHBOARD_HOSTNAME,
 				port: server.port ?? port,
 				stop: () => server.stop(),
 			};