@openscout/scout 0.2.78 → 0.2.79

package/dist/runtime/base-daemon.mjs

@@ -1,15 +1,17 @@
 // @bun
+import "reflect-metadata";
+
 // packages/runtime/src/base-daemon.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, openSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, openSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir6 } from "os";
 import { dirname as dirname4, join as join6, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/runtime/src/broker-process-manager.ts
 import { spawn as spawn2, spawnSync } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir5, networkInterfaces } from "os";
 import { dirname as dirname3, join as join5, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
@@ -2059,10 +2061,32 @@ function isTmpPath(p) {
   return /^\/(?:private\/)?tmp\//.test(p);
 }
 var DEFAULT_BROKER_HOST = "127.0.0.1";
-var DEFAULT_BROKER_HOST_MESH = "0.0.0.0";
 var DEFAULT_BROKER_PORT = OPENSCOUT_PORTS.broker;
 var DEFAULT_ADVERTISE_SCOPE = "local";
-function resolveAdvertiseScope(env = process.env) {
+var MESH_BIND_CONFIG_FILE = "mesh-bind.json";
+function meshBindConfigPath(supportDirectory) {
+  const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
+  return join5(dir, MESH_BIND_CONFIG_FILE);
+}
+function readPersistedAdvertiseScope(supportDirectory) {
+  const path = meshBindConfigPath(supportDirectory);
+  if (!existsSync5(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    if (parsed.version !== 1)
+      return null;
+    if (parsed.advertiseScope === "mesh" || parsed.advertiseScope === "local") {
+      return parsed.advertiseScope;
+    }
+  } catch {}
+  return null;
+}
+function resolveAdvertiseScope(env = process.env, readPersisted = null) {
+  const persisted = readPersisted?.() ?? null;
+  if (persisted === "mesh" || persisted === "local") {
+    return persisted;
+  }
   if (openScoutNetworkDiscoveryEnabled(env))
     return "mesh";
   const raw = (env.OPENSCOUT_ADVERTISE_SCOPE ?? "").trim().toLowerCase();
@@ -2072,15 +2096,12 @@ function resolveAdvertiseScope(env = process.env) {
     return "local";
   return DEFAULT_ADVERTISE_SCOPE;
 }
-function resolveBrokerHost(scope = resolveAdvertiseScope(), env = process.env) {
+function resolveBrokerHost(_scope = resolveAdvertiseScope(), env = process.env) {
   const explicit = env.OPENSCOUT_BROKER_HOST?.trim();
-  if (explicit) {
-    if (scope === "mesh" && isLoopbackHost(explicit)) {
-      return DEFAULT_BROKER_HOST_MESH;
-    }
+  if (explicit && !isWildcardHost(explicit)) {
     return explicit;
   }
-  return scope === "mesh" ? DEFAULT_BROKER_HOST_MESH : DEFAULT_BROKER_HOST;
+  return DEFAULT_BROKER_HOST;
 }
 function isLoopbackHost(host) {
   const trimmed = host.trim();
@@ -2096,7 +2117,10 @@ function localBrokerControlHost(host) {
 function buildDefaultBrokerUrl(host = DEFAULT_BROKER_HOST, port = DEFAULT_BROKER_PORT) {
   return `http://${host}:${port}`;
 }
-function resolveBrokerUrl(host, port, scope, env = process.env) {
+function buildDefaultBrokerHttpsUrl(host, port = DEFAULT_BROKER_PORT) {
+  return `https://${host}:${port}`;
+}
+function resolveBrokerUrl(host, port, scope, env = process.env, lanHost = findLanIPv4Address()) {
   const explicit = env.OPENSCOUT_BROKER_URL?.trim();
   if (explicit && !(scope === "mesh" && isUnreachableMeshBrokerUrl(explicit))) {
     return explicit;
@@ -2104,11 +2128,64 @@ function resolveBrokerUrl(host, port, scope, env = process.env) {
   if (scope === "mesh") {
     const tailnetHost = readTailscaleSelfWebHostsSync(env)[0];
     if (tailnetHost) {
-      return buildDefaultBrokerUrl(tailnetHost, port);
+      return buildDefaultBrokerHttpsUrl(tailnetHost, port);
+    }
+    if (lanHost) {
+      return buildDefaultBrokerHttpsUrl(lanHost, port);
     }
   }
   return buildDefaultBrokerUrl(host, port);
 }
+function findLanIPv4Address(interfaces = networkInterfaces()) {
+  const candidates = [];
+  for (const [name, entries] of Object.entries(interfaces)) {
+    for (const entry of entries ?? []) {
+      if (entry.internal)
+        continue;
+      if (entry.family !== "IPv4" && entry.family !== 4)
+        continue;
+      if (!isPrivateIPv4(entry.address) || isLinkLocalIPv4(entry.address) || isTailscaleIPv4(entry.address))
+        continue;
+      candidates.push({ name, address: entry.address });
+    }
+  }
+  candidates.sort((left, right) => {
+    const scoreDelta = lanInterfaceScore(left.name) - lanInterfaceScore(right.name);
+    return scoreDelta !== 0 ? scoreDelta : left.address.localeCompare(right.address);
+  });
+  return candidates[0]?.address ?? null;
+}
+function lanInterfaceScore(name) {
+  if (/^en\d+$/i.test(name))
+    return 0;
+  if (/^bridge\d*$/i.test(name))
+    return 2;
+  return 1;
+}
+function isPrivateIPv4(address) {
+  const octets = parseIPv4(address);
+  if (!octets)
+    return false;
+  const [first, second] = octets;
+  return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+}
+function isLinkLocalIPv4(address) {
+  const octets = parseIPv4(address);
+  return Boolean(octets && octets[0] === 169 && octets[1] === 254);
+}
+function isTailscaleIPv4(address) {
+  const octets = parseIPv4(address);
+  return Boolean(octets && octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127);
+}
+function parseIPv4(address) {
+  const octets = address.split(".");
+  if (octets.length !== 4)
+    return null;
+  const numbers = octets.map((octet) => Number(octet));
+  if (numbers.some((value) => !Number.isInteger(value) || value < 0 || value > 255))
+    return null;
+  return numbers;
+}
 function isUnreachableMeshBrokerUrl(value) {
   try {
     const host = new URL(value).hostname;
@@ -2248,7 +2325,7 @@ function resolveBrokerServiceConfig() {
   const runtimeDirectory = join5(supportDirectory, "runtime");
   const logsDirectory = join5(supportDirectory, "logs", "broker");
   const controlHome = isTmpPath(supportPaths.controlHome) ? join5(homedir5(), ".openscout", "control-plane") : supportPaths.controlHome;
-  const advertiseScope = resolveAdvertiseScope();
+  const advertiseScope = resolveAdvertiseScope(process.env, () => readPersistedAdvertiseScope(supportDirectory));
   const brokerHost = resolveBrokerHost(advertiseScope);
   const brokerPort = Number.parseInt(process.env.OPENSCOUT_BROKER_PORT ?? String(resolveBrokerPort()), 10);
   const brokerUrl = resolveBrokerUrl(brokerHost, brokerPort, advertiseScope);
@@ -3385,14 +3462,28 @@ function renderCaddyDefaultRouteBlock(config, route, scheme, startPage) {
   const host = scheme === "http" ? `http://${routeHost}` : routeHost;
   return `${host} {
 ` + (scheme === "https" ? `  tls internal
-` : "") + `  handle /__openscout/web/start {
+` : "") + `  @openscout_web_start_local {
+` + `    path /__openscout/web/start
+` + `    remote_ip 127.0.0.1 ::1
+` + `  }
+` + `  handle @openscout_web_start_local {
 ` + `    rewrite * /v1/web/start
 ` + `    reverse_proxy ${config.brokerUpstream}
 ` + `  }
-` + `  handle /__openscout/web/status {
+` + `  handle /__openscout/web/start {
+` + `    respond "Forbidden" 403
+` + `  }
+` + `  @openscout_web_status_local {
+` + `    path /__openscout/web/status
+` + `    remote_ip 127.0.0.1 ::1
+` + `  }
+` + `  handle @openscout_web_status_local {
 ` + `    rewrite * /v1/web/status
 ` + `    reverse_proxy ${config.brokerUpstream}
 ` + `  }
+` + `  handle /__openscout/web/status {
+` + `    respond "Forbidden" 403
+` + `  }
 ` + `  handle {
 ` + `    reverse_proxy ${route.upstream} {
 ` + `      lb_try_duration 15s
@@ -3493,7 +3584,7 @@ function resolveWebTrustedHostsEnv() {
   return appendCsvValues(process.env.OPENSCOUT_WEB_TRUSTED_HOSTS, resolveTailnetWebHosts());
 }
 function ensureDirectory(path) {
-  mkdirSync2(path, { recursive: true });
+  mkdirSync3(path, { recursive: true });
 }
 function logFile(name) {
   const dir = join6(config.supportDirectory, "logs", "base");
@@ -3649,7 +3740,7 @@ function startLocalEdge() {
   const edgeConfig = resolveEdgeConfig();
   const schemes = edgeConfig.scheme === "both" ? ["http", "https"] : [edgeConfig.scheme];
   const caddyfilePath = resolveLocalEdgeCaddyfilePath();
-  writeFileSync2(caddyfilePath, renderOpenScoutCaddyfile(edgeConfig), "utf8");
+  writeFileSync3(caddyfilePath, renderOpenScoutCaddyfile(edgeConfig), "utf8");
   mdnsProcesses = schemes.flatMap((scheme) => {
     const edgePort = scheme === "https" ? 443 : 80;
     const suffix = scheme.toUpperCase();