@pasko70/pibo 1.3.1 → 1.3.2

package/dist/plugins/dev-auth.js

@@ -61,7 +61,23 @@ export function isLoopbackDevAuthRequest(request) {
     const forwardedHost = firstHeaderValue(request.headers.get("x-forwarded-host"));
     return isLoopbackHost(host) && (!forwardedHost || isLoopbackHost(forwardedHost));
 }
-function createDevAuthService() {
+/**
+ * Headers-only variants of the loopback predicates so `getSession` can
+ * evaluate the same checks without holding on to the full `Request`
+ * object. `getSession` is part of the auth service contract and only
+ * receives `headers`, but the channel guarantees that the same
+ * `host`, `x-forwarded-host`, and `x-pibo-socket-peer` headers are
+ * present as they would be on a full `Request`.
+ */
+export function isLoopbackDevAuthHeaders(headers) {
+    const host = firstHeaderValue(headers.get("host"));
+    const forwardedHost = firstHeaderValue(headers.get("x-forwarded-host"));
+    return isLoopbackHost(host) && (!forwardedHost || isLoopbackHost(forwardedHost));
+}
+export function isLoopbackSocketPeerForDevAuthHeaders(headers) {
+    return isLoopbackSocketAddress(firstHeaderValue(headers.get(SOCKET_PEER_HEADER)));
+}
+export function createDevAuthService() {
     const containerToken = generateToken();
     const debugSession = {
         identity: {
@@ -81,6 +97,16 @@ function createDevAuthService() {
         },
         stop() { },
         async getSession(headers) {
+            // In local auth mode the loopback bind is the real security
+            // boundary. Once the channel has confirmed that the request
+            // reached us from a loopback host and a loopback TCP socket
+            // peer, the caller is on the same host as the gateway and
+            // there is no cookie jar to share. Headless clients (VS Code
+            // extension, CLI scripts) can use the same dev identity as the
+            // browser without needing the HttpOnly session cookie.
+            if (isLoopbackDevAuthHeaders(headers) && isLoopbackSocketPeerForDevAuthHeaders(headers)) {
+                return debugSession;
+            }
             const token = getCookieValue(headers);
             if (token === containerToken)
                 return debugSession;

package/dist/web/channel.js

@@ -188,7 +188,13 @@ export function createWebHostChannel(options = {}) {
     const handleRequest = async (nodeRequest, nodeResponse) => {
         try {
             const baseURL = createRequestBaseURL(nodeRequest, host, port);
-            const request = await nodeRequestToWebRequest(nodeRequest, baseURL);
+            const baseRequest = await nodeRequestToWebRequest(nodeRequest, baseURL);
+            // Inject the TCP socket peer into every request so the local auth
+            // plugin can apply the same loopback predicate from `getSession`
+            // regardless of whether the call came from a browser cookie, the
+            // VS Code extension, or a CLI script. The header is stripped from
+            // any outgoing response by `stripSocketPeerHeaderFromResponse`.
+            const request = withSocketPeerHeader(baseRequest, nodeRequest.socket.remoteAddress);
             const url = new URL(request.url);
             const canonicalRedirect = createCanonicalRedirect(request, options.canonicalBaseURL);
             if (canonicalRedirect) {
@@ -207,8 +213,7 @@ export function createWebHostChannel(options = {}) {
                 return;
             }
             if (url.pathname.startsWith("/api/auth/")) {
-                const authRequest = withSocketPeerHeader(request, nodeRequest.socket.remoteAddress);
-                const authResponse = stripSocketPeerHeaderFromResponse(await handleAuthRequest(authRequest));
+                const authResponse = stripSocketPeerHeaderFromResponse(await handleAuthRequest(request));
                 await sendWebResponse(nodeResponse, authResponse);
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pasko70/pibo",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "type": "module",
   "description": "Minimal TypeScript wrapper around Pi Coding Agent.",
   "files": [