@ours.network/fleet 0.13.3 → 0.14.1

package/dist/web/auth.js

@@ -1,6 +1,7 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { FleetError } from '../application/errors.js';
 import { TrustedDeviceStore } from './device-store.js';
+import { verifyPassword } from './access.js';
 const token = (bytes = 32) => randomBytes(bytes).toString('base64url');
 const same = (a, b) => {
     const left = Buffer.from(a);
@@ -12,6 +13,7 @@ export class WebAuth {
     _host;
     now;
     devices;
+    access;
     _bootstrapSecret = token(32);
     bootstrapExpiresAt = Date.now() + 5 * 60_000;
     bootstrapUsed = false;
@@ -20,18 +22,25 @@ export class WebAuth {
     tickets = new Map();
     rates = new Map();
     sockets = new Map();
-    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore()) {
+    constructor(_origin, _host, now = Date.now, devices = new TrustedDeviceStore(), access = { version: 1, mode: 'pairing' }) {
         this._origin = _origin;
         this._host = _host;
         this.now = now;
         this.devices = devices;
+        this.access = access;
     }
     get bootstrapSecret() { return this._bootstrapSecret; }
     get origin() { return this._origin; }
     get host() { return this._host; }
-    setBoundary(origin, host) {
+    get mode() { return this.access.mode; }
+    get secureCookies() { return this._origin.startsWith('https:'); }
+    allowedOrigins = new Set();
+    allowedHosts = new Set();
+    setBoundary(origin, host, aliases = {}) {
         this._origin = origin;
         this._host = host;
+        this.allowedOrigins = new Set([origin, ...(aliases.origins ?? [])]);
+        this.allowedHosts = new Set([host, ...(aliases.hosts ?? [])]);
     }
     /** Mint a replacement for an operator-triggered reauthentication ceremony. */
     mintBootstrap() {
@@ -42,16 +51,20 @@ export class WebAuth {
     }
     validateBoundary(request, requireOrigin) {
         const host = request.headers.host;
-        if (host !== this.host)
-            throw new FleetError('forbidden', 'invalid Host header');
-        if (requireOrigin && request.headers.origin !== this.origin)
-            throw new FleetError('forbidden', 'invalid Origin header');
+        const hosts = this.allowedHosts.size ? this.allowedHosts : new Set([this.host]);
+        const origins = this.allowedOrigins.size ? this.allowedOrigins : new Set([this.origin]);
+        if (!host || !hosts.has(host))
+            throw new FleetError('forbidden', `This address is not configured for the fleet console. Open ${this.origin} or set --public-origin.`);
+        if (requireOrigin && (!request.headers.origin || !origins.has(request.headers.origin)))
+            throw new FleetError('forbidden', 'request Origin does not match the configured control-panel origin');
         const fetchSite = request.headers['sec-fetch-site'];
         if (fetchSite && !['same-origin', 'none'].includes(String(fetchSite)))
             throw new FleetError('forbidden', 'cross-site request rejected');
     }
     exchange(request) {
         this.validateBoundary(request, true);
+        if (this.access.mode !== 'pairing')
+            throw new FleetError('forbidden', 'one-time pairing is disabled for this access mode');
         this.consumeRate('bootstrap', 10, 60_000);
         const authorization = request.headers.authorization ?? '';
         const supplied = authorization.startsWith('Bootstrap ') ? authorization.slice(10) : '';
@@ -61,8 +74,24 @@ export class WebAuth {
         const device = this.devices.issue();
         return { session: this.createSession(device.id), device };
     }
+    login(request, password) {
+        this.validateBoundary(request, true);
+        this.consumeRate('password-login', 10, 60_000);
+        if (!verifyPassword(this.access, password))
+            throw new FleetError('unauthorized', 'invalid control-panel password');
+        const device = this.devices.issue();
+        return { session: this.createSession(device.id), device };
+    }
+    anonymous(request) {
+        this.validateBoundary(request, true);
+        if (this.access.mode !== 'none')
+            throw new FleetError('forbidden', 'unprotected access is disabled');
+        return this.createSession('unprotected');
+    }
     resume(request) {
         this.validateBoundary(request, true);
+        if (this.access.mode === 'none')
+            throw new FleetError('forbidden', 'trusted devices are disabled');
         this.consumeRate('device-resume', 30, 60_000);
         const current = parseCookies(request.headers.cookie ?? '').ofs_device;
         const device = current ? this.devices.rotate(current) : undefined;
@@ -92,7 +121,7 @@ export class WebAuth {
     logout(request) {
         const session = this.authenticate(request, true);
         const deviceId = this.sessionDevices.get(session.id);
-        if (deviceId)
+        if (deviceId && deviceId !== 'unprotected')
             this.devices.revokeId(deviceId);
         this.removeSession(session.id);
     }

package/dist/web/runtime.d.ts

@@ -1,10 +1,14 @@
 import { type WebServer } from './server.js';
+import { type WebAccessConfig } from './access.js';
 export interface StartWebOptions {
     configPath?: string;
     port?: number;
     open?: boolean;
     binPath: string;
     log?(line: string): void;
+    bind?: string;
+    publicOrigin?: string;
+    access?: WebAccessConfig;
 }
 export interface RunningWebConsole extends WebServer {
     address: string;

package/dist/web/runtime.js

@@ -22,6 +22,7 @@ import { acquireWebServerLock } from './lock.js';
 import { TrustedDeviceStore } from './device-store.js';
 import { WebAuth } from './auth.js';
 import { startWebControlServer } from './control.js';
+import { WebAccessStore, validatePublicOrigin } from './access.js';
 import { buildWatchdogFindings, cachedWatchdogFindingsProvider, WatchdogQueryService } from '../watchdog/query.js';
 import { latestReport } from '../watchdog/store.js';
 const CONFIG_CACHE_TTL_MS = 5_000;
@@ -46,7 +47,14 @@ export async function startWebConsole(options) {
         throw new FleetError('invalid_request', 'port must be between 0 and 65535');
     const lock = acquireWebServerLock();
     const webDir = resolve(stateRoot(), 'web');
-    const auth = new WebAuth(`http://127.0.0.1:${requestedPort}`, `127.0.0.1:${requestedPort}`, Date.now, new TrustedDeviceStore(webDir));
+    const bind = options.bind ?? '127.0.0.1';
+    const publicOrigin = options.publicOrigin ? validatePublicOrigin(options.publicOrigin) : undefined;
+    if (!isLoopback(bind) && !publicOrigin) {
+        lock.release();
+        throw new FleetError('forbidden', 'a non-loopback bind requires an explicit --public-origin');
+    }
+    const access = options.access ?? new WebAccessStore(webDir).read();
+    const auth = new WebAuth(publicOrigin?.origin ?? `http://127.0.0.1:${requestedPort}`, publicOrigin?.host ?? `127.0.0.1:${requestedPort}`, Date.now, new TrustedDeviceStore(webDir), access);
     const tmux = new Tmux();
     const backend = pickBackend();
     const repository = new RoleRepository({
@@ -157,7 +165,7 @@ export async function startWebConsole(options) {
     }
     let address;
     try {
-        address = await server.app.listen({ host: '127.0.0.1', port: requestedPort });
+        address = await server.app.listen({ host: bind, port: requestedPort });
     }
     catch (error) {
         await server.close();
@@ -165,19 +173,24 @@ export async function startWebConsole(options) {
         throw error;
     }
     const actual = new URL(address);
-    if (actual.hostname !== '127.0.0.1') {
-        await server.close();
-        lock.release();
-        throw new FleetError('forbidden', 'web console refused a non-loopback bind');
-    }
-    const host = `127.0.0.1:${actual.port}`;
-    server.auth.setBoundary(`http://${host}`, host);
+    const localHost = `127.0.0.1:${actual.port}`;
+    const browserOrigin = publicOrigin?.origin ?? `http://${localHost}`;
+    const browserHost = publicOrigin?.host ?? localHost;
+    server.auth.setBoundary(browserOrigin, browserHost, publicOrigin ? {
+        // nginx's safe default uses the loopback upstream as Host. The declared
+        // browser Origin remains mandatory for auth/mutations and WebSocket hello,
+        // so operators do not need a fragile Host-rewrite incantation.
+        hosts: [localHost, `localhost:${actual.port}`],
+    } : {
+        hosts: [`localhost:${actual.port}`], origins: [`http://localhost:${actual.port}`],
+    });
     let control;
     try {
         control = await startWebControlServer({
             dir: webDir,
             onOpen() {
-                const url = `http://${host}/#bootstrap=${server.auth.mintBootstrap()}`;
+                const url = access.mode === 'pairing'
+                    ? `${browserOrigin}/#bootstrap=${server.auth.mintBootstrap()}` : `${browserOrigin}/`;
                 openBrowser(url);
             },
             onRevokeAll() { server.auth.revokeAllTrustedDevices(); },
@@ -189,9 +202,10 @@ export async function startWebConsole(options) {
         throw error;
     }
     if (options.open !== false)
-        openBrowser(`http://${host}/#bootstrap=${server.auth.bootstrapSecret}`);
+        openBrowser(access.mode === 'pairing'
+            ? `${browserOrigin}/#bootstrap=${server.auth.bootstrapSecret}` : `${browserOrigin}/`);
     return {
-        ...server, address: `http://${host}`,
+        ...server, address: browserOrigin,
         async close() {
             try {
                 await control.close();
@@ -204,6 +218,9 @@ export async function startWebConsole(options) {
         },
     };
 }
+function isLoopback(host) {
+    return ['127.0.0.1', 'localhost', '::1'].includes(host);
+}
 function openBrowser(url) {
     const command = process.platform === 'darwin' ? 'open'
         : process.platform === 'win32' ? 'cmd' : 'xdg-open';

package/dist/web/server.js

@@ -33,12 +33,19 @@ export async function buildWebServer(services, boundary, options = {}) {
         reply.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()');
         reply.header('X-Frame-Options', 'DENY');
         reply.header('Content-Security-Policy', `default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; ` +
-            `connect-src 'self' ws://${auth.host}; object-src 'none'; base-uri 'none'; ` +
+            `connect-src 'self' ${auth.secureCookies ? 'wss' : 'ws'}://${auth.host}; object-src 'none'; base-uri 'none'; ` +
             `frame-ancestors 'none'; form-action 'self'; manifest-src 'self'; worker-src 'self'`);
         if (request.url.startsWith('/api/'))
             reply.header('Cache-Control', 'no-store');
-        if (request.headers.host !== auth.host)
-            throw new FleetError('forbidden', 'invalid Host header');
+        try {
+            auth.validateBoundary(request, false);
+        }
+        catch (error) {
+            if (request.url.startsWith('/api/'))
+                throw error;
+            const message = normalizeError(error).message;
+            return reply.code(421).type('text/html').send(`<!doctype html><html><head><title>Fleet console address</title></head><body><main><h1>This fleet-console address is not configured</h1><p>${escapeHtml(message)}</p><p>For nginx or VPS access, configure an explicit public origin. The console does not guess proxy hosts.</p></main></body></html>`);
+        }
     });
     app.setErrorHandler(async (error, request, reply) => {
         const fleetError = normalizeError(error, request.id);
@@ -50,13 +57,29 @@ export async function buildWebServer(services, boundary, options = {}) {
     });
     app.post('/api/v1/auth/exchange', async (request, reply) => {
         const { session, device } = auth.exchange(request);
-        setAuthCookies(reply, session.id, device.token);
+        setAuthCookies(reply, session.id, device.token, auth.secureCookies);
         await audit.record({ requestId: request.id, browser: session.id, action: 'auth.exchange', result: 'succeeded' });
         return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
     });
+    app.get('/api/v1/auth/mode', async () => ({
+        mode: auth.mode,
+        warning: auth.mode === 'none'
+            ? 'Unprotected mode: anyone who can reach this address can control the fleet.' : undefined,
+    }));
+    app.post('/api/v1/auth/login', async (request, reply) => {
+        const { session, device } = auth.login(request, String(request.body?.password ?? ''));
+        setAuthCookies(reply, session.id, device.token, auth.secureCookies);
+        await audit.record({ requestId: request.id, browser: session.id, action: 'auth.password', result: 'succeeded' });
+        return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
+    });
+    app.post('/api/v1/auth/anonymous', async (request, reply) => {
+        const session = auth.anonymous(request);
+        setSessionCookie(reply, session.id, auth.secureCookies);
+        return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
+    });
     app.post('/api/v1/auth/resume', async (request, reply) => {
         const { session, device } = auth.resume(request);
-        setAuthCookies(reply, session.id, device.token);
+        setAuthCookies(reply, session.id, device.token, auth.secureCookies);
         await audit.record({ requestId: request.id, browser: session.id, action: 'auth.resume', result: 'succeeded' });
         return { csrfToken: session.csrf, expiresAt: new Date(session.absoluteExpiresAt).toISOString() };
     });
@@ -243,12 +266,16 @@ export async function buildWebServer(services, boundary, options = {}) {
         },
     };
 }
-function setAuthCookies(reply, session, device) {
+function setAuthCookies(reply, session, device, secure = false) {
+    const suffix = secure ? '; Secure' : '';
     reply.header('Set-Cookie', [
-        `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=28800`,
-        `ofs_device=${encodeURIComponent(device)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=2592000`,
+        `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=28800${suffix}`,
+        `ofs_device=${encodeURIComponent(device)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=2592000${suffix}`,
     ]);
 }
+function setSessionCookie(reply, session, secure = false) {
+    reply.header('Set-Cookie', `ofs_session=${encodeURIComponent(session)}; HttpOnly; SameSite=Strict; Path=/api; Max-Age=28800${secure ? '; Secure' : ''}`);
+}
 function clearAuthCookies(reply) {
     reply.header('Set-Cookie', [
         'ofs_session=; HttpOnly; SameSite=Strict; Path=/api; Max-Age=0',
@@ -256,6 +283,9 @@ function clearAuthCookies(reply) {
     ]);
 }
 function cryptoRandomId() { return randomBytes(12).toString('hex'); }
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[char]));
+}
 function requireSubprotocol(request, expected) {
     const protocols = String(request.headers['sec-websocket-protocol'] ?? '')
         .split(',').map(value => value.trim());

package/dist/web/service.d.ts

@@ -2,12 +2,14 @@ import { type Exec } from '../exec.js';
 export declare const WEB_SYSTEMD_UNIT = "ours-fleet-web.service";
 export declare const WEB_LAUNCHD_LABEL = "network.ours.fleet.web";
 interface ServiceMetadata {
-    version: 2;
+    version: 3;
     platform: 'linux' | 'darwin';
     runtime: string;
     script: string;
     port: number;
     configuration?: string;
+    bind?: string;
+    publicOrigin?: string;
 }
 export interface WebServiceOptions {
     platform?: NodeJS.Platform;
@@ -27,7 +29,10 @@ export declare class WebServiceManager {
     constructor(options?: WebServiceOptions);
     get metadataPath(): string;
     get definitionPath(): string;
-    install(script: string, port?: number, configuration?: string): Promise<string[]>;
+    install(script: string, port?: number, configuration?: string, web?: {
+        bind?: string;
+        publicOrigin?: string;
+    }): Promise<string[]>;
     start(): Promise<void>;
     stop(): Promise<void>;
     restart(): Promise<void>;
@@ -37,6 +42,12 @@ export declare class WebServiceManager {
     private requireInstalled;
     private must;
 }
-export declare function systemdUnit(runtime: string, script: string, port: number, configuration?: string): string;
-export declare function launchdPlist(runtime: string, script: string, port: number, configuration?: string): string;
+export declare function systemdUnit(runtime: string, script: string, port: number, configuration?: string, web?: {
+    bind?: string;
+    publicOrigin?: string;
+}): string;
+export declare function launchdPlist(runtime: string, script: string, port: number, configuration?: string, web?: {
+    bind?: string;
+    publicOrigin?: string;
+}): string;
 export {};

package/dist/web/service.js

@@ -5,7 +5,7 @@ import { replaceFileAtomically } from '../atomic-file.js';
 import { FleetError } from '../application/errors.js';
 import { realExec } from '../exec.js';
 import { home, stateRoot } from '../paths.js';
-const VERSION = 2;
+const VERSION = 3;
 export const WEB_SYSTEMD_UNIT = 'ours-fleet-web.service';
 export const WEB_LAUNCHD_LABEL = 'network.ours.fleet.web';
 export class WebServiceManager {
@@ -32,7 +32,7 @@ export class WebServiceManager {
             ? join(this.homeDir, '.config', 'systemd', 'user', WEB_SYSTEMD_UNIT)
             : join(this.homeDir, 'Library', 'LaunchAgents', `${WEB_LAUNCHD_LABEL}.plist`);
     }
-    async install(script, port = 49_271, configuration) {
+    async install(script, port = 49_271, configuration, web = {}) {
         validatePort(port);
         const resolvedScript = resolveExecutable(script, 'web CLI script');
         const runtime = resolveExecutable(this.runtimeExecutable, 'Node runtime');
@@ -43,10 +43,12 @@ export class WebServiceManager {
         const metadata = {
             version: VERSION, platform: this.platform, runtime, script: resolvedScript, port,
             ...(config ? { configuration: config } : {}),
+            ...(web.bind ? { bind: web.bind } : {}),
+            ...(web.publicOrigin ? { publicOrigin: web.publicOrigin } : {}),
         };
         replaceFileAtomically(this.definitionPath, this.platform === 'linux'
-            ? systemdUnit(runtime, resolvedScript, port, config)
-            : launchdPlist(runtime, resolvedScript, port, config), 0o600);
+            ? systemdUnit(runtime, resolvedScript, port, config, web)
+            : launchdPlist(runtime, resolvedScript, port, config, web), 0o600);
         replaceFileAtomically(this.metadataPath, JSON.stringify(metadata, null, 2) + '\n', 0o600);
         if (this.platform === 'linux') {
             await this.must('systemctl', ['--user', 'daemon-reload']);
@@ -123,9 +125,9 @@ export class WebServiceManager {
     readMetadata() {
         try {
             const parsed = JSON.parse(readFileSync(this.metadataPath, 'utf8'));
-            return parsed.version === VERSION && parsed.platform === this.platform
+            return [2, VERSION].includes(parsed.version) && parsed.platform === this.platform
                 && typeof parsed.runtime === 'string' && typeof parsed.script === 'string'
-                && Number.isInteger(parsed.port) ? parsed : undefined;
+                && Number.isInteger(parsed.port) ? { ...parsed, version: VERSION } : undefined;
         }
         catch {
             return undefined;
@@ -157,24 +159,28 @@ function validatePort(port) {
 function systemdQuote(value) {
     return `"${value.replace(/[%\\"]/g, char => char === '%' ? '%%' : `\\${char}`)}"`;
 }
-export function systemdUnit(runtime, script, port, configuration) {
+export function systemdUnit(runtime, script, port, configuration, web = {}) {
     const config = configuration ? ` --configuration ${systemdQuote(configuration)}` : '';
+    const access = `${web.bind ? ` --bind ${systemdQuote(web.bind)}` : ''}`
+        + `${web.publicOrigin ? ` --public-origin ${systemdQuote(web.publicOrigin)}` : ''}`;
     return `[Unit]\nDescription=ours-fleet localhost web console\nAfter=default.target\n\n`
-        + `[Service]\nType=simple\nExecStart=${systemdQuote(runtime)} ${systemdQuote(script)} web serve --port ${port} --no-open${config}\n`
+        + `[Service]\nType=simple\nExecStart=${systemdQuote(runtime)} ${systemdQuote(script)} web serve --port ${port} --no-open${config}${access}\n`
         + `Restart=on-failure\nRestartSec=5\nTimeoutStopSec=15\n\n`
         + `[Install]\nWantedBy=default.target\n`;
 }
 const xml = (value) => value.replace(/[&<>"']/g, char => ({
     '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&apos;',
 }[char]));
-export function launchdPlist(runtime, script, port, configuration) {
+export function launchdPlist(runtime, script, port, configuration, web = {}) {
     const config = configuration
         ? `<string>--configuration</string><string>${xml(configuration)}</string>` : '';
+    const access = `${web.bind ? `<string>--bind</string><string>${xml(web.bind)}</string>` : ''}`
+        + `${web.publicOrigin ? `<string>--public-origin</string><string>${xml(web.publicOrigin)}</string>` : ''}`;
     return `<?xml version="1.0" encoding="UTF-8"?>\n`
         + `<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n`
         + `<plist version="1.0"><dict>\n<key>Label</key><string>${WEB_LAUNCHD_LABEL}</string>\n`
         + `<key>ProgramArguments</key><array><string>${xml(runtime)}</string><string>${xml(script)}</string><string>web</string>`
-        + `<string>serve</string><string>--port</string><string>${port}</string><string>--no-open</string>${config}</array>\n`
+        + `<string>serve</string><string>--port</string><string>${port}</string><string>--no-open</string>${config}${access}</array>\n`
         + `<key>RunAtLoad</key><true/><key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>\n`
         + `<key>ProcessType</key><string>Background</string>\n</dict></plist>\n`;
 }

package/dist/web-app/assets/{TerminalView-BvcIkuIF.js → TerminalView-DMoT8udI.js}

@@ -1,4 +1,4 @@
-import{r as le,a as Ee,j as re}from"./index-CUN7ksTw.js";var ge={exports:{}},Se;function ke(){return Se||(Se=1,(function(se,ne){(function(Q,X){se.exports=X()})(globalThis,(()=>(()=>{var Q={4567:function(B,r,o){var l=this&&this.__decorate||function(e,i,a,v){var f,g=arguments.length,c=g<3?i:v===null?v=Object.getOwnPropertyDescriptor(i,a):v;if(typeof Reflect=="object"&&typeof Reflect.decorate=="function")c=Reflect.decorate(e,i,a,v);else for(var m=e.length-1;m>=0;m--)(f=e[m])&&(c=(g<3?f(c):g>3?f(i,a,c):f(i,a))||c);return g>3&&c&&Object.defineProperty(i,a,c),c},_=this&&this.__param||function(e,i){return function(a,v){i(a,v,e)}};Object.defineProperty(r,"__esModule",{value:!0}),r.AccessibilityManager=void 0;const n=o(9042),d=o(9924),u=o(844),p=o(4725),h=o(2585),t=o(3656);let s=r.AccessibilityManager=class extends u.Disposable{constructor(e,i,a,v){super(),this._terminal=e,this._coreBrowserService=a,this._renderService=v,this._rowColumns=new WeakMap,this._liveRegionLineCount=0,this._charsToConsume=[],this._charsToAnnounce="",this._accessibilityContainer=this._coreBrowserService.mainDocument.createElement("div"),this._accessibilityContainer.classList.add("xterm-accessibility"),this._rowContainer=this._coreBrowserService.mainDocument.createElement("div"),this._rowContainer.setAttribute("role","list"),this._rowContainer.classList.add("xterm-accessibility-tree"),this._rowElements=[];for(let f=0;f<this._terminal.rows;f++)this._rowElements[f]=this._createAccessibilityTreeNode(),this._rowContainer.appendChild(this._rowElements[f]);if(this._topBoundaryFocusListener=f=>this._handleBoundaryFocus(f,0),this._bottomBoundaryFocusListener=f=>this._handleBoundaryFocus(f,1),this._rowElements[0].addEventListener("focus",this._topBoundaryFocusListener),this._rowElements[this._rowElements.length-1].addEventListener("focus",this._bottomBoundaryFocusListener),this._refreshRowsDimensions(),this._accessibilityContainer.appendChild(this._rowContainer),this._liveRegion=this._coreBrowserService.mainDocument.createElement("div"),this._liveRegion.classList.add("live-region"),this._liveRegion.setAttribute("aria-live","assertive"),this._accessibilityContainer.appendChild(this._liveRegion),this._liveRegionDebouncer=this.register(new d.TimeBasedDebouncer(this._renderRows.bind(this))),!this._terminal.element)throw new Error("Cannot enable accessibility before Terminal.open");this._terminal.element.insertAdjacentElement("afterbegin",this._accessibilityContainer),this.register(this._terminal.onResize((f=>this._handleResize(f.rows)))),this.register(this._terminal.onRender((f=>this._refreshRows(f.start,f.end)))),this.register(this._terminal.onScroll((()=>this._refreshRows()))),this.register(this._terminal.onA11yChar((f=>this._handleChar(f)))),this.register(this._terminal.onLineFeed((()=>this._handleChar(`
+import{r as le,a as Ee,j as re}from"./index-B6T8JLSd.js";var ge={exports:{}},Se;function ke(){return Se||(Se=1,(function(se,ne){(function(Q,X){se.exports=X()})(globalThis,(()=>(()=>{var Q={4567:function(B,r,o){var l=this&&this.__decorate||function(e,i,a,v){var f,g=arguments.length,c=g<3?i:v===null?v=Object.getOwnPropertyDescriptor(i,a):v;if(typeof Reflect=="object"&&typeof Reflect.decorate=="function")c=Reflect.decorate(e,i,a,v);else for(var m=e.length-1;m>=0;m--)(f=e[m])&&(c=(g<3?f(c):g>3?f(i,a,c):f(i,a))||c);return g>3&&c&&Object.defineProperty(i,a,c),c},_=this&&this.__param||function(e,i){return function(a,v){i(a,v,e)}};Object.defineProperty(r,"__esModule",{value:!0}),r.AccessibilityManager=void 0;const n=o(9042),d=o(9924),u=o(844),p=o(4725),h=o(2585),t=o(3656);let s=r.AccessibilityManager=class extends u.Disposable{constructor(e,i,a,v){super(),this._terminal=e,this._coreBrowserService=a,this._renderService=v,this._rowColumns=new WeakMap,this._liveRegionLineCount=0,this._charsToConsume=[],this._charsToAnnounce="",this._accessibilityContainer=this._coreBrowserService.mainDocument.createElement("div"),this._accessibilityContainer.classList.add("xterm-accessibility"),this._rowContainer=this._coreBrowserService.mainDocument.createElement("div"),this._rowContainer.setAttribute("role","list"),this._rowContainer.classList.add("xterm-accessibility-tree"),this._rowElements=[];for(let f=0;f<this._terminal.rows;f++)this._rowElements[f]=this._createAccessibilityTreeNode(),this._rowContainer.appendChild(this._rowElements[f]);if(this._topBoundaryFocusListener=f=>this._handleBoundaryFocus(f,0),this._bottomBoundaryFocusListener=f=>this._handleBoundaryFocus(f,1),this._rowElements[0].addEventListener("focus",this._topBoundaryFocusListener),this._rowElements[this._rowElements.length-1].addEventListener("focus",this._bottomBoundaryFocusListener),this._refreshRowsDimensions(),this._accessibilityContainer.appendChild(this._rowContainer),this._liveRegion=this._coreBrowserService.mainDocument.createElement("div"),this._liveRegion.classList.add("live-region"),this._liveRegion.setAttribute("aria-live","assertive"),this._accessibilityContainer.appendChild(this._liveRegion),this._liveRegionDebouncer=this.register(new d.TimeBasedDebouncer(this._renderRows.bind(this))),!this._terminal.element)throw new Error("Cannot enable accessibility before Terminal.open");this._terminal.element.insertAdjacentElement("afterbegin",this._accessibilityContainer),this.register(this._terminal.onResize((f=>this._handleResize(f.rows)))),this.register(this._terminal.onRender((f=>this._refreshRows(f.start,f.end)))),this.register(this._terminal.onScroll((()=>this._refreshRows()))),this.register(this._terminal.onA11yChar((f=>this._handleChar(f)))),this.register(this._terminal.onLineFeed((()=>this._handleChar(`
 `)))),this.register(this._terminal.onA11yTab((f=>this._handleTab(f)))),this.register(this._terminal.onKey((f=>this._handleKey(f.key)))),this.register(this._terminal.onBlur((()=>this._clearLiveRegion()))),this.register(this._renderService.onDimensionsChange((()=>this._refreshRowsDimensions()))),this.register((0,t.addDisposableDomListener)(document,"selectionchange",(()=>this._handleSelectionChange()))),this.register(this._coreBrowserService.onDprChange((()=>this._refreshRowsDimensions()))),this._refreshRows(),this.register((0,u.toDisposable)((()=>{this._accessibilityContainer.remove(),this._rowElements.length=0})))}_handleTab(e){for(let i=0;i<e;i++)this._handleChar(" ")}_handleChar(e){this._liveRegionLineCount<21&&(this._charsToConsume.length>0?this._charsToConsume.shift()!==e&&(this._charsToAnnounce+=e):this._charsToAnnounce+=e,e===`
 `&&(this._liveRegionLineCount++,this._liveRegionLineCount===21&&(this._liveRegion.textContent+=n.tooMuchOutput)))}_clearLiveRegion(){this._liveRegion.textContent="",this._liveRegionLineCount=0}_handleKey(e){this._clearLiveRegion(),new RegExp("\\p{Control}","u").test(e)||this._charsToConsume.push(e)}_refreshRows(e,i){this._liveRegionDebouncer.refresh(e,i,this._terminal.rows)}_renderRows(e,i){const a=this._terminal.buffer,v=a.lines.length.toString();for(let f=e;f<=i;f++){const g=a.lines.get(a.ydisp+f),c=[],m=g?.translateToString(!0,void 0,void 0,c)||"",E=(a.ydisp+f+1).toString(),k=this._rowElements[f];k&&(m.length===0?(k.innerText=" ",this._rowColumns.set(k,[0,1])):(k.textContent=m,this._rowColumns.set(k,c)),k.setAttribute("aria-posinset",E),k.setAttribute("aria-setsize",v))}this._announceCharacters()}_announceCharacters(){this._charsToAnnounce.length!==0&&(this._liveRegion.textContent+=this._charsToAnnounce,this._charsToAnnounce="")}_handleBoundaryFocus(e,i){const a=e.target,v=this._rowElements[i===0?1:this._rowElements.length-2];if(a.getAttribute("aria-posinset")===(i===0?"1":`${this._terminal.buffer.lines.length}`)||e.relatedTarget!==v)return;let f,g;if(i===0?(f=a,g=this._rowElements.pop(),this._rowContainer.removeChild(g)):(f=this._rowElements.shift(),g=a,this._rowContainer.removeChild(f)),f.removeEventListener("focus",this._topBoundaryFocusListener),g.removeEventListener("focus",this._bottomBoundaryFocusListener),i===0){const c=this._createAccessibilityTreeNode();this._rowElements.unshift(c),this._rowContainer.insertAdjacentElement("afterbegin",c)}else{const c=this._createAccessibilityTreeNode();this._rowElements.push(c),this._rowContainer.appendChild(c)}this._rowElements[0].addEventListener("focus",this._topBoundaryFocusListener),this._rowElements[this._rowElements.length-1].addEventListener("focus",this._bottomBoundaryFocusListener),this._terminal.scrollLines(i===0?-1:1),this._rowElements[i===0?1:this._rowElements.length-2].focus(),e.preventDefault(),e.stopImmediatePropagation()}_handleSelectionChange(){if(this._rowElements.length===0)return;const e=document.getSelection();if(!e)return;if(e.isCollapsed)return void(this._rowContainer.contains(e.anchorNode)&&this._terminal.clearSelection());if(!e.anchorNode||!e.focusNode)return void console.error("anchorNode and/or focusNode are null");let i={node:e.anchorNode,offset:e.anchorOffset},a={node:e.focusNode,offset:e.focusOffset};if((i.node.compareDocumentPosition(a.node)&Node.DOCUMENT_POSITION_PRECEDING||i.node===a.node&&i.offset>a.offset)&&([i,a]=[a,i]),i.node.compareDocumentPosition(this._rowElements[0])&(Node.DOCUMENT_POSITION_CONTAINED_BY|Node.DOCUMENT_POSITION_FOLLOWING)&&(i={node:this._rowElements[0].childNodes[0],offset:0}),!this._rowContainer.contains(i.node))return;const v=this._rowElements.slice(-1)[0];if(a.node.compareDocumentPosition(v)&(Node.DOCUMENT_POSITION_CONTAINED_BY|Node.DOCUMENT_POSITION_PRECEDING)&&(a={node:v,offset:v.textContent?.length??0}),!this._rowContainer.contains(a.node))return;const f=({node:m,offset:E})=>{const k=m instanceof Text?m.parentNode:m;let D=parseInt(k?.getAttribute("aria-posinset"),10)-1;if(isNaN(D))return console.warn("row is invalid. Race condition?"),null;const b=this._rowColumns.get(k);if(!b)return console.warn("columns is null. Race condition?"),null;let x=E<b.length?b[E]:b.slice(-1)[0]+1;return x>=this._terminal.cols&&(++D,x=0),{row:D,column:x}},g=f(i),c=f(a);if(g&&c){if(g.row>c.row||g.row===c.row&&g.column>=c.column)throw new Error("invalid range");this._terminal.select(g.column,g.row,(c.row-g.row)*this._terminal.cols-g.column+c.column)}}_handleResize(e){this._rowElements[this._rowElements.length-1].removeEventListener("focus",this._bottomBoundaryFocusListener);for(let i=this._rowContainer.children.length;i<this._terminal.rows;i++)this._rowElements[i]=this._createAccessibilityTreeNode(),this._rowContainer.appendChild(this._rowElements[i]);for(;this._rowElements.length>e;)this._rowContainer.removeChild(this._rowElements.pop());this._rowElements[this._rowElements.length-1].addEventListener("focus",this._bottomBoundaryFocusListener),this._refreshRowsDimensions()}_createAccessibilityTreeNode(){const e=this._coreBrowserService.mainDocument.createElement("div");return e.setAttribute("role","listitem"),e.tabIndex=-1,this._refreshRowDimensions(e),e}_refreshRowsDimensions(){if(this._renderService.dimensions.css.cell.height){this._accessibilityContainer.style.width=`${this._renderService.dimensions.css.canvas.width}px`,this._rowElements.length!==this._terminal.rows&&this._handleResize(this._terminal.rows);for(let e=0;e<this._terminal.rows;e++)this._refreshRowDimensions(this._rowElements[e])}}_refreshRowDimensions(e){e.style.height=`${this._renderService.dimensions.css.cell.height}px`}};r.AccessibilityManager=s=l([_(1,h.IInstantiationService),_(2,p.ICoreBrowserService),_(3,p.IRenderService)],s)},3614:(B,r)=>{function o(d){return d.replace(/\r?\n/g,"\r")}function l(d,u){return u?"\x1B[200~"+d+"\x1B[201~":d}function _(d,u,p,h){d=l(d=o(d),p.decPrivateModes.bracketedPasteMode&&h.rawOptions.ignoreBracketedPasteMode!==!0),p.triggerDataEvent(d,!0),u.value=""}function n(d,u,p){const h=p.getBoundingClientRect(),t=d.clientX-h.left-10,s=d.clientY-h.top-10;u.style.width="20px",u.style.height="20px",u.style.left=`${t}px`,u.style.top=`${s}px`,u.style.zIndex="1000",u.focus()}Object.defineProperty(r,"__esModule",{value:!0}),r.rightClickHandler=r.moveTextAreaUnderMouseCursor=r.paste=r.handlePasteEvent=r.copyHandler=r.bracketTextForPaste=r.prepareTextForTerminal=void 0,r.prepareTextForTerminal=o,r.bracketTextForPaste=l,r.copyHandler=function(d,u){d.clipboardData&&d.clipboardData.setData("text/plain",u.selectionText),d.preventDefault()},r.handlePasteEvent=function(d,u,p,h){d.stopPropagation(),d.clipboardData&&_(d.clipboardData.getData("text/plain"),u,p,h)},r.paste=_,r.moveTextAreaUnderMouseCursor=n,r.rightClickHandler=function(d,u,p,h,t){n(d,u,p),t&&h.rightClickSelect(d),u.value=h.selectionText,u.select()}},7239:(B,r,o)=>{Object.defineProperty(r,"__esModule",{value:!0}),r.ColorContrastCache=void 0;const l=o(1505);r.ColorContrastCache=class{constructor(){this._color=new l.TwoKeyMap,this._css=new l.TwoKeyMap}setCss(_,n,d){this._css.set(_,n,d)}getCss(_,n){return this._css.get(_,n)}setColor(_,n,d){this._color.set(_,n,d)}getColor(_,n){return this._color.get(_,n)}clear(){this._color.clear(),this._css.clear()}}},3656:(B,r)=>{Object.defineProperty(r,"__esModule",{value:!0}),r.addDisposableDomListener=void 0,r.addDisposableDomListener=function(o,l,_,n){o.addEventListener(l,_,n);let d=!1;return{dispose:()=>{d||(d=!0,o.removeEventListener(l,_,n))}}}},3551:function(B,r,o){var l=this&&this.__decorate||function(s,e,i,a){var v,f=arguments.length,g=f<3?e:a===null?a=Object.getOwnPropertyDescriptor(e,i):a;if(typeof Reflect=="object"&&typeof Reflect.decorate=="function")g=Reflect.decorate(s,e,i,a);else for(var c=s.length-1;c>=0;c--)(v=s[c])&&(g=(f<3?v(g):f>3?v(e,i,g):v(e,i))||g);return f>3&&g&&Object.defineProperty(e,i,g),g},_=this&&this.__param||function(s,e){return function(i,a){e(i,a,s)}};Object.defineProperty(r,"__esModule",{value:!0}),r.Linkifier=void 0;const n=o(3656),d=o(8460),u=o(844),p=o(2585),h=o(4725);let t=r.Linkifier=class extends u.Disposable{get currentLink(){return this._currentLink}constructor(s,e,i,a,v){super(),this._element=s,this._mouseService=e,this._renderService=i,this._bufferService=a,this._linkProviderService=v,this._linkCacheDisposables=[],this._isMouseOut=!0,this._wasResized=!1,this._activeLine=-1,this._onShowLinkUnderline=this.register(new d.EventEmitter),this.onShowLinkUnderline=this._onShowLinkUnderline.event,this._onHideLinkUnderline=this.register(new d.EventEmitter),this.onHideLinkUnderline=this._onHideLinkUnderline.event,this.register((0,u.getDisposeArrayDisposable)(this._linkCacheDisposables)),this.register((0,u.toDisposable)((()=>{this._lastMouseEvent=void 0,this._activeProviderReplies?.clear()}))),this.register(this._bufferService.onResize((()=>{this._clearCurrentLink(),this._wasResized=!0}))),this.register((0,n.addDisposableDomListener)(this._element,"mouseleave",(()=>{this._isMouseOut=!0,this._clearCurrentLink()}))),this.register((0,n.addDisposableDomListener)(this._element,"mousemove",this._handleMouseMove.bind(this))),this.register((0,n.addDisposableDomListener)(this._element,"mousedown",this._handleMouseDown.bind(this))),this.register((0,n.addDisposableDomListener)(this._element,"mouseup",this._handleMouseUp.bind(this)))}_handleMouseMove(s){this._lastMouseEvent=s;const e=this._positionFromMouseEvent(s,this._element,this._mouseService);if(!e)return;this._isMouseOut=!1;const i=s.composedPath();for(let a=0;a<i.length;a++){const v=i[a];if(v.classList.contains("xterm"))break;if(v.classList.contains("xterm-hover"))return}this._lastBufferCell&&e.x===this._lastBufferCell.x&&e.y===this._lastBufferCell.y||(this._handleHover(e),this._lastBufferCell=e)}_handleHover(s){if(this._activeLine!==s.y||this._wasResized)return this._clearCurrentLink(),this._askForLink(s,!1),void(this._wasResized=!1);this._currentLink&&this._linkAtPosition(this._currentLink.link,s)||(this._clearCurrentLink(),this._askForLink(s,!0))}_askForLink(s,e){this._activeProviderReplies&&e||(this._activeProviderReplies?.forEach((a=>{a?.forEach((v=>{v.link.dispose&&v.link.dispose()}))})),this._activeProviderReplies=new Map,this._activeLine=s.y);let i=!1;for(const[a,v]of this._linkProviderService.linkProviders.entries())e?this._activeProviderReplies?.get(a)&&(i=this._checkLinkProviderResult(a,s,i)):v.provideLinks(s.y,(f=>{if(this._isMouseOut)return;const g=f?.map((c=>({link:c})));this._activeProviderReplies?.set(a,g),i=this._checkLinkProviderResult(a,s,i),this._activeProviderReplies?.size===this._linkProviderService.linkProviders.length&&this._removeIntersectingLinks(s.y,this._activeProviderReplies)}))}_removeIntersectingLinks(s,e){const i=new Set;for(let a=0;a<e.size;a++){const v=e.get(a);if(v)for(let f=0;f<v.length;f++){const g=v[f],c=g.link.range.start.y<s?0:g.link.range.start.x,m=g.link.range.end.y>s?this._bufferService.cols:g.link.range.end.x;for(let E=c;E<=m;E++){if(i.has(E)){v.splice(f--,1);break}i.add(E)}}}}_checkLinkProviderResult(s,e,i){if(!this._activeProviderReplies)return i;const a=this._activeProviderReplies.get(s);let v=!1;for(let f=0;f<s;f++)this._activeProviderReplies.has(f)&&!this._activeProviderReplies.get(f)||(v=!0);if(!v&&a){const f=a.find((g=>this._linkAtPosition(g.link,e)));f&&(i=!0,this._handleNewLink(f))}if(this._activeProviderReplies.size===this._linkProviderService.linkProviders.length&&!i)for(let f=0;f<this._activeProviderReplies.size;f++){const g=this._activeProviderReplies.get(f)?.find((c=>this._linkAtPosition(c.link,e)));if(g){i=!0,this._handleNewLink(g);break}}return i}_handleMouseDown(){this._mouseDownLink=this._currentLink}_handleMouseUp(s){if(!this._currentLink)return;const e=this._positionFromMouseEvent(s,this._element,this._mouseService);e&&this._mouseDownLink===this._currentLink&&this._linkAtPosition(this._currentLink.link,e)&&this._currentLink.link.activate(s,this._currentLink.link.text)}_clearCurrentLink(s,e){this._currentLink&&this._lastMouseEvent&&(!s||!e||this._currentLink.link.range.start.y>=s&&this._currentLink.link.range.end.y<=e)&&(this._linkLeave(this._element,this._currentLink.link,this._lastMouseEvent),this._currentLink=void 0,(0,u.disposeArray)(this._linkCacheDisposables))}_handleNewLink(s){if(!this._lastMouseEvent)return;const e=this._positionFromMouseEvent(this._lastMouseEvent,this._element,this._mouseService);e&&this._linkAtPosition(s.link,e)&&(this._currentLink=s,this._currentLink.state={decorations:{underline:s.link.decorations===void 0||s.link.decorations.underline,pointerCursor:s.link.decorations===void 0||s.link.decorations.pointerCursor},isHovered:!0},this._linkHover(this._element,s.link,this._lastMouseEvent),s.link.decorations={},Object.defineProperties(s.link.decorations,{pointerCursor:{get:()=>this._currentLink?.state?.decorations.pointerCursor,set:i=>{this._currentLink?.state&&this._currentLink.state.decorations.pointerCursor!==i&&(this._currentLink.state.decorations.pointerCursor=i,this._currentLink.state.isHovered&&this._element.classList.toggle("xterm-cursor-pointer",i))}},underline:{get:()=>this._currentLink?.state?.decorations.underline,set:i=>{this._currentLink?.state&&this._currentLink?.state?.decorations.underline!==i&&(this._currentLink.state.decorations.underline=i,this._currentLink.state.isHovered&&this._fireUnderlineEvent(s.link,i))}}}),this._linkCacheDisposables.push(this._renderService.onRenderedViewportChange((i=>{if(!this._currentLink)return;const a=i.start===0?0:i.start+1+this._bufferService.buffer.ydisp,v=this._bufferService.buffer.ydisp+1+i.end;if(this._currentLink.link.range.start.y>=a&&this._currentLink.link.range.end.y<=v&&(this._clearCurrentLink(a,v),this._lastMouseEvent)){const f=this._positionFromMouseEvent(this._lastMouseEvent,this._element,this._mouseService);f&&this._askForLink(f,!1)}}))))}_linkHover(s,e,i){this._currentLink?.state&&(this._currentLink.state.isHovered=!0,this._currentLink.state.decorations.underline&&this._fireUnderlineEvent(e,!0),this._currentLink.state.decorations.pointerCursor&&s.classList.add("xterm-cursor-pointer")),e.hover&&e.hover(i,e.text)}_fireUnderlineEvent(s,e){const i=s.range,a=this._bufferService.buffer.ydisp,v=this._createLinkUnderlineEvent(i.start.x-1,i.start.y-a-1,i.end.x,i.end.y-a-1,void 0);(e?this._onShowLinkUnderline:this._onHideLinkUnderline).fire(v)}_linkLeave(s,e,i){this._currentLink?.state&&(this._currentLink.state.isHovered=!1,this._currentLink.state.decorations.underline&&this._fireUnderlineEvent(e,!1),this._currentLink.state.decorations.pointerCursor&&s.classList.remove("xterm-cursor-pointer")),e.leave&&e.leave(i,e.text)}_linkAtPosition(s,e){const i=s.range.start.y*this._bufferService.cols+s.range.start.x,a=s.range.end.y*this._bufferService.cols+s.range.end.x,v=e.y*this._bufferService.cols+e.x;return i<=v&&v<=a}_positionFromMouseEvent(s,e,i){const a=i.getCoords(s,e,this._bufferService.cols,this._bufferService.rows);if(a)return{x:a[0],y:a[1]+this._bufferService.buffer.ydisp}}_createLinkUnderlineEvent(s,e,i,a,v){return{x1:s,y1:e,x2:i,y2:a,cols:this._bufferService.cols,fg:v}}};r.Linkifier=t=l([_(1,h.IMouseService),_(2,h.IRenderService),_(3,p.IBufferService),_(4,h.ILinkProviderService)],t)},9042:(B,r)=>{Object.defineProperty(r,"__esModule",{value:!0}),r.tooMuchOutput=r.promptLabel=void 0,r.promptLabel="Terminal input",r.tooMuchOutput="Too much output to announce, navigate to rows manually to read"},3730:function(B,r,o){var l=this&&this.__decorate||function(h,t,s,e){var i,a=arguments.length,v=a<3?t:e===null?e=Object.getOwnPropertyDescriptor(t,s):e;if(typeof Reflect=="object"&&typeof Reflect.decorate=="function")v=Reflect.decorate(h,t,s,e);else for(var f=h.length-1;f>=0;f--)(i=h[f])&&(v=(a<3?i(v):a>3?i(t,s,v):i(t,s))||v);return a>3&&v&&Object.defineProperty(t,s,v),v},_=this&&this.__param||function(h,t){return function(s,e){t(s,e,h)}};Object.defineProperty(r,"__esModule",{value:!0}),r.OscLinkProvider=void 0;const n=o(511),d=o(2585);let u=r.OscLinkProvider=class{constructor(h,t,s){this._bufferService=h,this._optionsService=t,this._oscLinkService=s}provideLinks(h,t){const s=this._bufferService.buffer.lines.get(h-1);if(!s)return void t(void 0);const e=[],i=this._optionsService.rawOptions.linkHandler,a=new n.CellData,v=s.getTrimmedLength();let f=-1,g=-1,c=!1;for(let m=0;m<v;m++)if(g!==-1||s.hasContent(m)){if(s.loadCell(m,a),a.hasExtendedAttrs()&&a.extended.urlId){if(g===-1){g=m,f=a.extended.urlId;continue}c=a.extended.urlId!==f}else g!==-1&&(c=!0);if(c||g!==-1&&m===v-1){const E=this._oscLinkService.getLinkData(f)?.uri;if(E){const k={start:{x:g+1,y:h},end:{x:m+(c||m!==v-1?0:1),y:h}};let D=!1;if(!i?.allowNonHttpProtocols)try{const b=new URL(E);["http:","https:"].includes(b.protocol)||(D=!0)}catch{D=!0}D||e.push({text:E,range:k,activate:(b,x)=>i?i.activate(b,x,k):p(0,x),hover:(b,x)=>i?.hover?.(b,x,k),leave:(b,x)=>i?.leave?.(b,x,k)})}c=!1,a.hasExtendedAttrs()&&a.extended.urlId?(g=m,f=a.extended.urlId):(g=-1,f=-1)}}t(e)}};function p(h,t){if(confirm(`Do you want to navigate to ${t}?