@pi-harness/pi-harness 0.1.23 → 0.1.25

package/packages/cli/test/cli.test.ts

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { Readable, Writable } from "node:stream";
 import { describe, expect, test } from "vitest";
-import { runCli, type CliEnvironment } from "../src/main.js";
+import { DUPLICATE_SIGNAL_WINDOW_MS, runCli, type CliEnvironment } from "../src/main.js";
 
 interface TestEnvironment extends CliEnvironment {
   readonly stdin: Readable;
@@ -200,6 +200,8 @@ describe("runCli", () => {
     await waitForFileContent(join(profile.directory, "marker.txt"), "started");
 
     environment.emitSignal("SIGINT");
+    // A deliberate second Ctrl-C is hundreds of milliseconds after the first; only a repeat inside DUPLICATE_SIGNAL_WINDOW_MS is treated as one keypress delivered twice.
+    await new Promise((resolve) => setTimeout(resolve, DUPLICATE_SIGNAL_WINDOW_MS + 10));
     environment.emitSignal("SIGINT");
 
     expect(environment.forcedExitCodes).toEqual([130]);

package/packages/cli/test/main.test.ts

@@ -0,0 +1,134 @@
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Readable, Writable } from "node:stream";
+import { pathToFileURL } from "node:url";
+import { describe, expect, test } from "vitest";
+import { DUPLICATE_SIGNAL_WINDOW_MS, runCli, type CliEnvironment } from "../src/main.js";
+
+interface TestEnvironment extends CliEnvironment {
+  readonly output: string[];
+  readonly errors: string[];
+  readonly forcedExitCodes: number[];
+  emitSignal(signal: NodeJS.Signals): void;
+}
+
+function createEnvironment(cwd: string, shutdownTimeoutMs = 5_000): TestEnvironment {
+  const output: string[] = [];
+  const errors: string[] = [];
+  const forcedExitCodes: number[] = [];
+  const signals = new Set<(signal: NodeJS.Signals) => void>();
+  const stdin = new Readable({ read() {} });
+  stdin.push(null);
+  return {
+    cwd,
+    agentDir: join(cwd, ".pi-agent-test"),
+    version: "0.1.0-test",
+    stdin,
+    stdout: new Writable({
+      write(chunk, _encoding, callback) {
+        output.push(String(chunk));
+        callback();
+      },
+    }),
+    stderr: new Writable({
+      write(chunk, _encoding, callback) {
+        errors.push(String(chunk));
+        callback();
+      },
+    }),
+    output,
+    errors,
+    forcedExitCodes,
+    shutdownTimeoutMs,
+    forceExit(code) {
+      forcedExitCodes.push(code);
+    },
+    onSignal(listener) {
+      signals.add(listener);
+      return () => signals.delete(listener);
+    },
+    emitSignal(signal) {
+      for (const listener of signals) listener(signal);
+    },
+  };
+}
+
+async function createApplicationProfile(source: string): Promise<{ configPath: string; directory: string; markerPath: string }> {
+  const directory = await mkdtemp(join(tmpdir(), "pi-harness-signal-"));
+  const pluginPath = join(directory, "application.mjs");
+  const configPath = join(directory, "cordis.yml");
+  const markerPath = join(directory, "marker.txt");
+  await writeFile(pluginPath, source, "utf8");
+  await writeFile(configPath, JSON.stringify([{ name: pathToFileURL(pluginPath).href, config: { markerPath } }]), "utf8");
+  return { configPath, directory, markerPath };
+}
+
+async function waitForFileContent(path: string, expected: string, timeoutMs = 5_000): Promise<void> {
+  const startedAt = Date.now();
+  while (true) {
+    try {
+      if ((await readFile(path, "utf8")) === expected) return;
+    } catch {
+      // The producer has not created the marker yet.
+    }
+    if (Date.now() - startedAt > timeoutMs) throw new Error(`Timed out waiting for ${path} to contain ${expected}`);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+}
+
+const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));
+
+// A shutdown that outlives the duplicate window is what makes the second delivery observable at all; a 20ms abort handler stands in for a plugin dispose or a stdio flush.
+const SLOW_SHUTDOWN_APPLICATION = `import { appendFileSync, writeFileSync } from "node:fs"; export default { apply(ctx, config) { writeFileSync(config.markerPath, "started"); ctx.effect(() => () => appendFileSync(config.markerPath, ":disposed")); ctx.provide("piApplication", { async run(signal) { appendFileSync(config.markerPath, ":run"); await new Promise((resolve) => signal.addEventListener("abort", resolve, { once: true })); await new Promise((resolve) => setTimeout(resolve, 20)); appendFileSync(config.markerPath, ":aborted"); return 0; } }); } };`;
+// A shutdown that never finishes keeps the signal listener registered, so a deliberate second Ctrl-C arriving long after the first still has something to interrupt.
+const STUCK_SHUTDOWN_APPLICATION = `import { writeFileSync } from "node:fs"; export default { apply(ctx, config) { writeFileSync(config.markerPath, "started"); ctx.provide("piRuntime", { async abort() { return new Promise(() => {}); }, async dispose() {} }); ctx.provide("piApplication", { async run() { return new Promise(() => {}); } }); } };`;
+
+describe("runCli duplicate signal delivery", () => {
+  test("collapses the same signal delivered twice inside the duplicate window into one graceful shutdown", async () => {
+    const profile = await createApplicationProfile(SLOW_SHUTDOWN_APPLICATION);
+    const environment = createEnvironment(profile.directory);
+    const result = runCli(["--config", profile.configPath], environment);
+    await waitForFileContent(profile.markerPath, "started:run");
+
+    // The terminal broadcasts Ctrl-C to the process group and the development supervisor relays the same signal; both land within a millisecond or two of each other.
+    environment.emitSignal("SIGINT");
+    await sleep(2);
+    environment.emitSignal("SIGINT");
+
+    await expect(result).resolves.toBe(130);
+    expect(environment.forcedExitCodes).toEqual([]);
+    expect(environment.errors.join("")).not.toContain("Received SIGINT again");
+    await expect(readFile(profile.markerPath, "utf8")).resolves.toBe("started:run:aborted:disposed");
+  });
+
+  test("still force-quits when the same signal arrives again after the duplicate window", async () => {
+    const profile = await createApplicationProfile(STUCK_SHUTDOWN_APPLICATION);
+    const environment = createEnvironment(profile.directory, 60_000);
+    const result = runCli(["--config", profile.configPath], environment);
+    await waitForFileContent(profile.markerPath, "started");
+
+    environment.emitSignal("SIGINT");
+    await sleep(DUPLICATE_SIGNAL_WINDOW_MS + 10);
+    environment.emitSignal("SIGINT");
+
+    expect(environment.forcedExitCodes).toEqual([130]);
+    expect(environment.errors.join("")).toContain("Received SIGINT again");
+    await expect(Promise.race([result, sleep(200).then(() => "pending")])).resolves.toBe("pending");
+  });
+
+  test("does not collapse two different signals that arrive inside the duplicate window", async () => {
+    const profile = await createApplicationProfile(STUCK_SHUTDOWN_APPLICATION);
+    const environment = createEnvironment(profile.directory, 60_000);
+    const result = runCli(["--config", profile.configPath], environment);
+    await waitForFileContent(profile.markerPath, "started");
+
+    environment.emitSignal("SIGINT");
+    await sleep(2);
+    environment.emitSignal("SIGTERM");
+
+    expect(environment.forcedExitCodes).toEqual([143]);
+    expect(environment.errors.join("")).toContain("Received SIGTERM again");
+    await expect(Promise.race([result, sleep(200).then(() => "pending")])).resolves.toBe("pending");
+  });
+});

package/packages/cli/test/relaunch.test.ts

@@ -1,8 +1,9 @@
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test } from "vitest";
+import { DUPLICATE_SIGNAL_WINDOW_MS } from "../src/main.js";
 import { PI_HARNESS_RESTART_EXIT_CODE, shouldRelaunchForDevelopmentProfile, superviseDevelopmentProcess } from "../src/relaunch.js";
 
 describe("development profile relaunch", () => {
@@ -66,7 +67,8 @@ describe("development profile signal forwarding", () => {
     const directory = await mkdtemp(join(tmpdir(), `pi-harness-supervisor-${label}-`));
     const markerPath = join(directory, "started.txt");
     const childPath = join(directory, "child.mjs");
-    await writeFile(childPath, `import { writeFileSync } from "node:fs"; writeFileSync(process.argv[2], "started"); ${body}`, "utf8");
+    // The marker is written last, after the body has installed its handlers. Written first, it announces a child that node would still kill outright with the default disposition, because a signal only becomes catchable once a listener for it exists - which is how this test was seen to observe exit 130 where it expected 31.
+    await writeFile(childPath, `import { writeFileSync } from "node:fs"; ${body} writeFileSync(process.argv[2], "started");`, "utf8");
     return { markerPath, childPath };
   }
 
@@ -80,17 +82,90 @@ describe("development profile signal forwarding", () => {
     await expect(supervised).resolves.toBe(143);
   });
 
+  // The vitest worker has no terminal on any of the three descriptors, so the tty state is faked here to pin that relaying does not depend on it.
+  function withTerminalStdio<T>(isTTY: boolean, spawnChild: () => T): T {
+    const streams = [process.stdin, process.stdout, process.stderr];
+    const original = streams.map((stream) => stream.isTTY);
+    for (const stream of streams) stream.isTTY = isTTY;
+    try {
+      return spawnChild();
+    } finally {
+      for (const [index, stream] of streams.entries()) stream.isTTY = original[index] ?? false;
+    }
+  }
+
   test.skipIf(process.platform === "win32")(
-    "does not forward SIGINT or SIGHUP, which the shared foreground process group already delivers to the child",
+    "relays SIGINT and SIGHUP to the child whether or not the inherited stdio is a terminal",
     async () => {
-      const { markerPath, childPath } = await startChild("int", "setTimeout(() => process.exit(21), 800);");
-      const supervised = superviseDevelopmentProcess(process.execPath, [childPath, markerPath], { stdio: "ignore" });
-      await expect.poll(() => existsSync(markerPath), { interval: 20, timeout: 5_000 }).toBe(true);
-
-      expect(process.emit("SIGINT", "SIGINT")).toBe(true);
-      expect(process.emit("SIGHUP", "SIGHUP")).toBe(true);
-
-      await expect(supervised).resolves.toBe(21);
+      for (const isTTY of [true, false]) {
+        for (const [signal, code] of [
+          ["SIGINT", 31],
+          ["SIGHUP", 32],
+        ] as const) {
+          const { markerPath, childPath } = await startChild(
+            `${signal.toLowerCase()}-${String(isTTY)}`,
+            // Exiting with 21 when no signal arrives distinguishes a swallowed relay from a slow one.
+            `process.on("SIGINT", () => process.exit(31)); process.on("SIGHUP", () => process.exit(32)); setTimeout(() => process.exit(21), 2_000);`,
+          );
+          const supervised = withTerminalStdio(isTTY, () => superviseDevelopmentProcess(process.execPath, [childPath, markerPath], { stdio: "ignore" }));
+          await expect.poll(() => existsSync(markerPath), { interval: 20, timeout: 5_000 }).toBe(true);
+
+          expect(process.emit(signal, signal)).toBe(true);
+
+          await expect(supervised).resolves.toBe(code);
+        }
+      }
     },
+    30_000,
   );
+
+  // A real `kill -INT -<pgid>` would also hit the vitest worker, so the group broadcast is simulated: the signal is delivered straight to the child (the terminal's copy) and emitted on this process (the copy the supervisor relays), 2ms apart, which matches the sub-millisecond spacing measured between the two copies and is well inside the duplicate window.
+  // How many deliveries the child sees is the kernel's decision, not this code's: two SIGINTs that are pending together are coalesced into one, which was observed on roughly one run in five and is why the count is asserted as at least one rather than exactly two. What this test pins is the outcome under a group broadcast - one graceful shutdown, exit 130, no force-quit - and it holds under either delivery count. The window logic itself is pinned deterministically and in-process against the real runCli in main.test.ts.
+  test.skipIf(process.platform === "win32")("a group broadcast that reaches the child directly and through the relay shuts the child down once", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "pi-harness-supervisor-broadcast-"));
+    const markerPath = join(directory, "signals.txt");
+    const pidPath = join(directory, "pid.txt");
+    const childPath = join(directory, "child.mjs");
+    await writeFile(
+      childPath,
+      // The child mirrors runCli's handler: every delivery is recorded, but a repeat of the same signal inside DUPLICATE_SIGNAL_WINDOW_MS is ignored instead of counting toward the force-quit path.
+      `import { appendFileSync, writeFileSync } from "node:fs";
+const marker = process.argv[2];
+let lastSignal;
+let lastSignalAt = 0;
+let signalCount = 0;
+process.on("SIGINT", () => {
+  appendFileSync(marker, "delivery\\n");
+  const receivedAt = performance.now();
+  if (lastSignal === "SIGINT" && receivedAt - lastSignalAt < ${DUPLICATE_SIGNAL_WINDOW_MS}) return;
+  lastSignal = "SIGINT";
+  lastSignalAt = receivedAt;
+  signalCount += 1;
+  if (signalCount > 1) {
+    appendFileSync(marker, "force-quit\\n");
+    process.exit(1);
+  }
+  setTimeout(() => {
+    appendFileSync(marker, "graceful\\n");
+    process.exit(130);
+  }, 25);
+});
+writeFileSync(process.argv[3], String(process.pid));
+setInterval(() => {}, 1_000);`,
+      "utf8",
+    );
+    const supervised = superviseDevelopmentProcess(process.execPath, [childPath, markerPath, pidPath], { stdio: "ignore" });
+    await expect.poll(() => (existsSync(pidPath) ? readFileSync(pidPath, "utf8") : ""), { interval: 20, timeout: 5_000 }).not.toBe("");
+    const childPid = Number(readFileSync(pidPath, "utf8"));
+
+    process.kill(childPid, "SIGINT");
+    await new Promise((resolve) => setTimeout(resolve, 2));
+    expect(process.emit("SIGINT", "SIGINT")).toBe(true);
+
+    await expect(supervised).resolves.toBe(130);
+    const events = (await readFile(markerPath, "utf8")).split("\n").filter(Boolean);
+    expect(events.filter((event) => event === "delivery").length).toBeGreaterThanOrEqual(1);
+    expect(events).toContain("graceful");
+    expect(events).not.toContain("force-quit");
+  });
 });

package/packages/host-webserver/dist/index.d.ts

@@ -7,6 +7,7 @@ export interface WebRoute {
 export interface WebServerConfig {
     readonly host?: string;
     readonly port?: number;
+    readonly allowedHosts?: readonly string[];
 }
 export interface WebServer {
     readonly host: string;

package/packages/host-webserver/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC;IACtC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,SAAS,EAAE,SAAS,CAAC;KACtB;CACF;;;mBAmEsB,OAAO,UAAU,eAAe;;AAFvD,wBA2DE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAEpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC;IACtC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,SAAS,EAAE,SAAS,CAAC;KACtB;CACF;;;mBAqGsB,OAAO,UAAU,eAAe;;AAFvD,wBA8DE"}

package/packages/host-webserver/dist/index.js

@@ -1,4 +1,5 @@
 import { createServer } from "node:http";
+import { hostname as machineHostname, networkInterfaces } from "node:os";
 export const DEFAULT_WEB_SERVER_PORT = 3141;
 function normalizePath(path) {
     if (!path.startsWith("/") || (path.length > 1 && path.endsWith("/")))
@@ -32,16 +33,48 @@ function parseHttpAuthority(value) {
         return undefined;
     return { hostname: url.hostname, port: url.port === "" ? 80 : Number(url.port) };
 }
-// Browsers send the Origin header on every cross-origin request and on all non-GET/HEAD requests, so requiring it to match the (already validated) Host header blocks cross-site requests from pages the user visits. Requests without an Origin header (same-origin navigations, EventSource, curl, Node fetch) pass. The Host check defeats DNS rebinding: a page on attacker.example that resolves to 127.0.0.1 arrives with Host: attacker.example, which is neither loopback nor the configured bind host.
-function rejectForeignRequest(request, response, configuredHost, boundPort) {
+// Normalizes a configured host or allowlist entry the same way parseHttpAuthority normalizes a header value, so IPv6 forms and letter case compare equal. Returns undefined for values that are not a valid host.
+function canonicalHostname(host) {
+    try {
+        return new URL("http://" + hostForUrl(host)).hostname;
+    }
+    catch {
+        return undefined;
+    }
+}
+// A wildcard bind answers on every local address, so the names a browser may legitimately put in the Host header are this machine's own addresses and hostname. They are read per request because DHCP and interface changes rewrite them while the server runs. An interface-scoped IPv6 address ("fe80::1%en0") is compared without its zone id, which is what a URL host carries.
+function localHostnames() {
+    const names = new Set();
+    const own = canonicalHostname(machineHostname());
+    if (own !== undefined)
+        names.add(own);
+    for (const entries of Object.values(networkInterfaces())) {
+        for (const entry of entries ?? []) {
+            const name = canonicalHostname(entry.address.split("%")[0] ?? entry.address);
+            if (name !== undefined)
+                names.add(name);
+        }
+    }
+    return names;
+}
+function isHostnameAllowed(hostname, configuredHost, allowedHosts) {
+    if (LOOPBACK_HOSTNAMES.has(hostname))
+        return true;
+    if (allowedHosts.some((entry) => canonicalHostname(entry) === hostname))
+        return true;
+    if (!WILDCARD_HOSTS.has(configuredHost))
+        return hostname === hostForUrl(configuredHost).toLowerCase();
+    return localHostnames().has(hostname);
+}
+// Browsers send the Origin header on every cross-origin request and on all non-GET/HEAD requests, so requiring it to match the (already validated) Host header blocks cross-site requests from pages the user visits. Requests without an Origin header (same-origin navigations, EventSource, curl, Node fetch) pass. The Host check defeats DNS rebinding: a page on attacker.example that resolves to one of this machine's addresses arrives with Host: attacker.example, which is neither loopback, nor the bind address, nor an address or hostname this machine owns. The check stays on for a wildcard bind, where only the machine's own addresses (or an operator-supplied allowedHosts entry) are accepted, because the Origin check cannot help: a rebinding page sends a matching Origin and Host pair.
+function rejectForeignRequest(request, response, configuredHost, boundPort, allowedHosts) {
     const hostHeader = request.headers.host;
     const authority = hostHeader === undefined ? undefined : parseHttpAuthority(hostHeader);
     if (authority === undefined) {
         sendError(response, 400, "Invalid Host header");
         return true;
     }
-    const hostnameAllowed = WILDCARD_HOSTS.has(configuredHost) || LOOPBACK_HOSTNAMES.has(authority.hostname) || authority.hostname === hostForUrl(configuredHost).toLowerCase();
-    if (!hostnameAllowed || authority.port !== boundPort) {
+    if (!isHostnameAllowed(authority.hostname, configuredHost, allowedHosts) || authority.port !== boundPort) {
         sendError(response, 400, "Host header does not match the web server address");
         return true;
     }
@@ -60,14 +93,17 @@ export default {
     async apply(context, config) {
         const host = config.host ?? "127.0.0.1";
         const port = config.port ?? DEFAULT_WEB_SERVER_PORT;
+        const allowedHosts = config.allowedHosts ?? [];
+        // A wildcard bind (including the empty host, which listen() accepts) has no hostname of its own, and "http://" + "" is not a parsable URL base, so resolving a request path against it threw out of the request listener. Loopback is the address such a bind always answers on, so it stands in both as the base for request URLs and as the advertised URL.
+        const urlHost = WILDCARD_HOSTS.has(host) ? "127.0.0.1" : hostForUrl(host);
         const routes = new Map();
         let fallback;
         // Assigned once listen() completes; tests bind port 0 so the configured port is not the one clients address.
         let boundPort = 0;
         const server = createServer((request, response) => {
-            if (rejectForeignRequest(request, response, host, boundPort))
+            if (rejectForeignRequest(request, response, host, boundPort, allowedHosts))
                 return;
-            const path = new URL(request.url ?? "/", "http://" + hostForUrl(host)).pathname;
+            const path = new URL(request.url ?? "/", "http://" + urlHost).pathname;
             const handler = routes.get(path) ?? fallback;
             if (handler === undefined) {
                 notFound(response);
@@ -97,7 +133,7 @@ export default {
         const service = {
             host,
             port: address.port,
-            url: "http://" + hostForUrl(host) + ":" + address.port,
+            url: "http://" + urlHost + ":" + address.port,
             register(route) {
                 const path = normalizePath(route.path);
                 if (routes.has(path))

package/packages/host-webserver/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAsBpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAQ5C,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,GAAG,IAAI,CAAC,CAAC;IAC3J,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAe;IAC1E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB;IACxC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACxE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAO9D,6PAA6P;AAC7P,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACxJ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,gfAAgf;AAChf,SAAS,oBAAoB,CAAC,OAAwB,EAAE,QAAwB,EAAE,cAAsB,EAAE,SAAiB;IACzH,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACxF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GACnB,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IACtJ,IAAI,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,mDAAmD,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAChI,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,eAAe;IACb,IAAI,EAAE,cAAc;IACpB,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,MAAuB;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,uBAAuB,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;QACtD,IAAI,QAAyC,CAAC;QAC9C,6GAA6G;QAC7G,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,oBAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;gBAAE,OAAO;YACrE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,mLAAmL;YACnL,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACvE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACzB,QAAQ,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC5E,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBAC/E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAClG,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChH,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,MAAM,OAAO,GAAc;YACzB,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI;YACtD,QAAQ,CAAC,KAAK;gBACZ,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC/E,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChC,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,gBAAgB,CAAC,OAAO;gBACtB,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAClF,QAAQ,GAAG,OAAO,CAAC;gBACnB,OAAO,GAAG,EAAE;oBACV,IAAI,QAAQ,KAAK,OAAO;wBAAE,QAAQ,GAAG,SAAS,CAAC;gBACjD,CAAC,CAAC;YACJ,CAAC;YACD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SAClH,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,QAAQ,IAAI,eAAe,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAwBzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAQ5C,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,GAAG,IAAI,CAAC,CAAC;IAC3J,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAe;IAC1E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB;IACxC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACxE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAO9D,6PAA6P;AAC7P,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACxJ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,kNAAkN;AAClN,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qXAAqX;AACrX,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,eAAe,EAAE,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,cAAsB,EAAE,YAA+B;IAClG,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IACtG,OAAO,cAAc,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,qxBAAqxB;AACrxB,SAAS,oBAAoB,CAC3B,OAAwB,EACxB,QAAwB,EACxB,cAAsB,EACtB,SAAiB,EACjB,YAA+B;IAE/B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACxF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzG,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,mDAAmD,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAChI,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,eAAe;IACb,IAAI,EAAE,cAAc;IACpB,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,MAAuB;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,uBAAuB,CAAC;QACpD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/C,8VAA8V;QAC9V,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;QACtD,IAAI,QAAyC,CAAC;QAC9C,6GAA6G;QAC7G,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,oBAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC;gBAAE,OAAO;YACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,mLAAmL;YACnL,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACvE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACzB,QAAQ,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC5E,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBAC/E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAClG,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChH,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,MAAM,OAAO,GAAc;YACzB,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,SAAS,GAAG,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI;YAC7C,QAAQ,CAAC,KAAK;gBACZ,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC/E,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChC,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,gBAAgB,CAAC,OAAO;gBACtB,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAClF,QAAQ,GAAG,OAAO,CAAC;gBACnB,OAAO,GAAG,EAAE;oBACV,IAAI,QAAQ,KAAK,OAAO;wBAAE,QAAQ,GAAG,SAAS,CAAC;gBACjD,CAAC,CAAC;YACJ,CAAC;YACD,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SAClH,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAC"}

package/packages/host-webserver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/host-webserver",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "private": true,
   "description": "Cordis route-registration service for the Pi Harness web host",
   "homepage": "https://github.com/pi-harness/pi-harness#readme",

package/packages/host-webserver/src/index.ts

@@ -1,4 +1,5 @@
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+import { hostname as machineHostname, networkInterfaces } from "node:os";
 import type { Context } from "@deepseek-ai/cordis";
 
 export interface WebRoute {
@@ -9,6 +10,8 @@ export interface WebRoute {
 export interface WebServerConfig {
   readonly host?: string;
   readonly port?: number;
+  // Extra hostnames accepted in the Host header, on top of loopback names, the bound address and (for a wildcard bind) this machine's own addresses and hostname. Needed when the harness is reached through a proxy or a DNS name the machine itself does not know about.
+  readonly allowedHosts?: readonly string[];
 }
 
 export interface WebServer {
@@ -67,17 +70,51 @@ function parseHttpAuthority(value: string): Authority | undefined {
   return { hostname: url.hostname, port: url.port === "" ? 80 : Number(url.port) };
 }
 
-// Browsers send the Origin header on every cross-origin request and on all non-GET/HEAD requests, so requiring it to match the (already validated) Host header blocks cross-site requests from pages the user visits. Requests without an Origin header (same-origin navigations, EventSource, curl, Node fetch) pass. The Host check defeats DNS rebinding: a page on attacker.example that resolves to 127.0.0.1 arrives with Host: attacker.example, which is neither loopback nor the configured bind host.
-function rejectForeignRequest(request: IncomingMessage, response: ServerResponse, configuredHost: string, boundPort: number): boolean {
+// Normalizes a configured host or allowlist entry the same way parseHttpAuthority normalizes a header value, so IPv6 forms and letter case compare equal. Returns undefined for values that are not a valid host.
+function canonicalHostname(host: string): string | undefined {
+  try {
+    return new URL("http://" + hostForUrl(host)).hostname;
+  } catch {
+    return undefined;
+  }
+}
+
+// A wildcard bind answers on every local address, so the names a browser may legitimately put in the Host header are this machine's own addresses and hostname. They are read per request because DHCP and interface changes rewrite them while the server runs. An interface-scoped IPv6 address ("fe80::1%en0") is compared without its zone id, which is what a URL host carries.
+function localHostnames(): Set<string> {
+  const names = new Set<string>();
+  const own = canonicalHostname(machineHostname());
+  if (own !== undefined) names.add(own);
+  for (const entries of Object.values(networkInterfaces())) {
+    for (const entry of entries ?? []) {
+      const name = canonicalHostname(entry.address.split("%")[0] ?? entry.address);
+      if (name !== undefined) names.add(name);
+    }
+  }
+  return names;
+}
+
+function isHostnameAllowed(hostname: string, configuredHost: string, allowedHosts: readonly string[]): boolean {
+  if (LOOPBACK_HOSTNAMES.has(hostname)) return true;
+  if (allowedHosts.some((entry) => canonicalHostname(entry) === hostname)) return true;
+  if (!WILDCARD_HOSTS.has(configuredHost)) return hostname === hostForUrl(configuredHost).toLowerCase();
+  return localHostnames().has(hostname);
+}
+
+// Browsers send the Origin header on every cross-origin request and on all non-GET/HEAD requests, so requiring it to match the (already validated) Host header blocks cross-site requests from pages the user visits. Requests without an Origin header (same-origin navigations, EventSource, curl, Node fetch) pass. The Host check defeats DNS rebinding: a page on attacker.example that resolves to one of this machine's addresses arrives with Host: attacker.example, which is neither loopback, nor the bind address, nor an address or hostname this machine owns. The check stays on for a wildcard bind, where only the machine's own addresses (or an operator-supplied allowedHosts entry) are accepted, because the Origin check cannot help: a rebinding page sends a matching Origin and Host pair.
+function rejectForeignRequest(
+  request: IncomingMessage,
+  response: ServerResponse,
+  configuredHost: string,
+  boundPort: number,
+  allowedHosts: readonly string[],
+): boolean {
   const hostHeader = request.headers.host;
   const authority = hostHeader === undefined ? undefined : parseHttpAuthority(hostHeader);
   if (authority === undefined) {
     sendError(response, 400, "Invalid Host header");
     return true;
   }
-  const hostnameAllowed =
-    WILDCARD_HOSTS.has(configuredHost) || LOOPBACK_HOSTNAMES.has(authority.hostname) || authority.hostname === hostForUrl(configuredHost).toLowerCase();
-  if (!hostnameAllowed || authority.port !== boundPort) {
+  if (!isHostnameAllowed(authority.hostname, configuredHost, allowedHosts) || authority.port !== boundPort) {
     sendError(response, 400, "Host header does not match the web server address");
     return true;
   }
@@ -96,13 +133,16 @@ export default {
   async apply(context: Context, config: WebServerConfig) {
     const host = config.host ?? "127.0.0.1";
     const port = config.port ?? DEFAULT_WEB_SERVER_PORT;
+    const allowedHosts = config.allowedHosts ?? [];
+    // A wildcard bind (including the empty host, which listen() accepts) has no hostname of its own, and "http://" + "" is not a parsable URL base, so resolving a request path against it threw out of the request listener. Loopback is the address such a bind always answers on, so it stands in both as the base for request URLs and as the advertised URL.
+    const urlHost = WILDCARD_HOSTS.has(host) ? "127.0.0.1" : hostForUrl(host);
     const routes = new Map<string, WebRoute["handler"]>();
     let fallback: WebRoute["handler"] | undefined;
     // Assigned once listen() completes; tests bind port 0 so the configured port is not the one clients address.
     let boundPort = 0;
     const server = createServer((request, response) => {
-      if (rejectForeignRequest(request, response, host, boundPort)) return;
-      const path = new URL(request.url ?? "/", "http://" + hostForUrl(host)).pathname;
+      if (rejectForeignRequest(request, response, host, boundPort, allowedHosts)) return;
+      const path = new URL(request.url ?? "/", "http://" + urlHost).pathname;
       const handler = routes.get(path) ?? fallback;
       if (handler === undefined) {
         notFound(response);
@@ -131,7 +171,7 @@ export default {
     const service: WebServer = {
       host,
       port: address.port,
-      url: "http://" + hostForUrl(host) + ":" + address.port,
+      url: "http://" + urlHost + ":" + address.port,
       register(route) {
         const path = normalizePath(route.path);
         if (routes.has(path)) throw new Error("Web route already registered: " + path);

package/packages/host-webserver/test/index.test.ts

@@ -1,15 +1,22 @@
 import { Context } from "@deepseek-ai/cordis";
 import { request as httpRequest } from "node:http";
+import { hostname as machineHostname, networkInterfaces } from "node:os";
 import { afterEach, describe, expect, test } from "vitest";
 import webServerPlugin, { DEFAULT_WEB_SERVER_PORT, type WebServer } from "../src/index.js";
 
 const contexts: Context[] = [];
 
+function firstLocalIpv4(): string | undefined {
+  return Object.values(networkInterfaces())
+    .flatMap((entries) => entries ?? [])
+    .find((entry) => entry.family === "IPv4" && !entry.internal)?.address;
+}
+
 afterEach(async () => {
   await Promise.all(contexts.splice(0).map(async (context) => context.fiber.dispose()));
 });
 
-async function startServer(config: { host?: string; port: number }): Promise<WebServer> {
+async function startServer(config: { host?: string; port: number; allowedHosts?: readonly string[] }): Promise<WebServer> {
   const context = new Context();
   contexts.push(context);
   await context.plugin(webServerPlugin, config);
@@ -163,12 +170,58 @@ describe("web server plugin", () => {
     expect(health.calls).toBe(3);
   });
 
-  test("accepts the configured non-loopback host and any hostname on a wildcard bind", async () => {
+  test("accepts only this machine's own names on a wildcard bind so DNS rebinding still fails", async () => {
     const wildcard = await startServer({ host: "0.0.0.0", port: 0 });
-    registerHealth(wildcard);
-    await expect(rawRequest(wildcard, { host: "workstation.lan:" + wildcard.port })).resolves.toMatchObject({ status: 200 });
-    await expect(rawRequest(wildcard, { host: "workstation.lan:" + (wildcard.port + 1) })).resolves.toMatchObject({ status: 400 });
+    const health = registerHealth(wildcard);
+    expect(wildcard.url).toBe("http://127.0.0.1:" + wildcard.port);
+
+    await expect(rawRequest(wildcard, { host: "attacker.example:" + wildcard.port })).resolves.toEqual({
+      status: 400,
+      body: JSON.stringify({ error: "Host header does not match the web server address" }),
+    });
+    await expect(rawRequest(wildcard, { host: "workstation.lan:" + wildcard.port })).resolves.toMatchObject({ status: 400 });
+    expect(health.calls).toBe(0);
+
+    await expect(rawRequest(wildcard, { host: "127.0.0.1:" + wildcard.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(wildcard, { host: machineHostname() + ":" + wildcard.port })).resolves.toMatchObject({ status: 200 });
+    const localIpv4 = firstLocalIpv4();
+    if (localIpv4 !== undefined) await expect(rawRequest(wildcard, { host: localIpv4 + ":" + wildcard.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(wildcard, { host: machineHostname() + ":" + (wildcard.port + 1) })).resolves.toMatchObject({ status: 400 });
+  });
+
+  test("accepts hostnames named by allowedHosts on a wildcard bind", async () => {
+    const proxied = await startServer({ host: "0.0.0.0", port: 0, allowedHosts: ["Console.lan"] });
+    registerHealth(proxied);
+
+    await expect(rawRequest(proxied, { host: "console.lan:" + proxied.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(proxied, { host: "console.lan:" + proxied.port, origin: "http://console.lan:" + proxied.port }, "POST")).resolves.toMatchObject({
+      status: 200,
+    });
+    await expect(rawRequest(proxied, { host: "other.lan:" + proxied.port })).resolves.toMatchObject({ status: 400 });
+  });
+
+  test("canonicalizes configured hostnames the same way as the Host header", async () => {
+    // WHATWG URL compresses the IPv6 literal in the Host header, so a bind address or allowlist entry written out in full has to go through the same parser or it can never match.
+    const server = await startServer({ host: "127.0.0.1", port: 0, allowedHosts: ["2001:db8:0:0:0:0:0:1", "WORKSTATION.LAN"] });
+    registerHealth(server);
+
+    await expect(rawRequest(server, { host: "[2001:db8::1]:" + server.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(server, { host: "workstation.lan:" + server.port })).resolves.toMatchObject({ status: 200 });
+    await expect(rawRequest(server, { host: "[2001:db8::2]:" + server.port })).resolves.toMatchObject({ status: 400 });
+  });
+
+  test("serves an empty configured host, which listen() treats as a wildcard bind", async () => {
+    // "http://" + "" is not a parsable URL base, so resolving the request path against the raw configured host threw a TypeError out of the request listener and killed the process on the very first request.
+    const server = await startServer({ host: "", port: 0 });
+    const health = registerHealth(server);
+
+    expect(server.url).toBe("http://127.0.0.1:" + server.port);
+    await expect(rawRequest(server, { host: "127.0.0.1:" + server.port })).resolves.toMatchObject({ status: 200, body: "ok" });
+    await expect(rawRequest(server, { host: "evil.example:" + server.port })).resolves.toMatchObject({ status: 400 });
+    expect(health.calls).toBe(1);
+  });
 
+  test("serves an IPv6 bind at its bracketed URL", async () => {
     const ipv6 = await startServer({ host: "::1", port: 0 });
     registerHealth(ipv6);
     expect(ipv6.url).toBe("http://[::1]:" + ipv6.port);