@pixelbyte-software/pixcode 1.54.1 → 1.54.3

package/dist/index.html

@@ -35,7 +35,7 @@
     
     <!-- Prevent zoom on iOS -->
     <meta name="format-detection" content="telephone=no" />
-    <script type="module" crossorigin src="/assets/index-CLO8YURv.js"></script>
+    <script type="module" crossorigin src="/assets/index-CwwdokVl.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DB6V5Fl1.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-codemirror-CIYNS698.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-xterm-C7tpxJl7.js">

package/dist-server/server/index.js

@@ -1555,27 +1555,11 @@ app.disable('x-powered-by');
 // running behind nginx/Caddy/etc. (needed for correct protocol detection
 // in resolvePublicBaseUrl and for rate-limiting middleware if added later).
 app.set('trust proxy', 1);
-// Restrict CORS to known origins instead of reflecting any requester.
-// In production the frontend is same-origin; in dev it's the Vite server.
-const ALLOWED_CORS_ORIGINS = (() => {
-    const envOrigins = process.env.CORS_ALLOWED_ORIGINS;
-    if (envOrigins) {
-        return envOrigins.split(',').map((o) => o.trim()).filter(Boolean);
-    }
-    const devPort = process.env.VITE_PORT || 5173;
-    return [
-        `http://localhost:${devPort}`,
-        `http://127.0.0.1:${devPort}`,
-    ];
-})();
+// CORS: self-hosted tool accessed from various IPs/hostnames.
+// Reflect the requesting origin so IP-based access (e.g. http://85.235.74.198:3001)
+// works without configuration. Credentials needed for auth header passthrough.
 app.use(cors({
-    origin(origin, callback) {
-        // Allow same-origin requests (no Origin header) and allowlisted origins.
-        if (!origin || ALLOWED_CORS_ORIGINS.includes(origin)) {
-            return callback(null, true);
-        }
-        return callback(null, false);
-    },
+    origin: true,
     credentials: true,
     exposedHeaders: ['X-Refreshed-Token'],
 }));
@@ -1591,16 +1575,16 @@ app.use((req, res, next) => {
     if (req.secure || req.headers['x-forwarded-proto'] === 'https') {
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }
-    // CSP for the SPA shell — API responses are JSON so this mainly guards
-    // the served index.html. 'unsafe-inline' is needed for Vite's inline
-    // module preload polyfill; style-src unsafe-inline for Tailwind injected styles.
+    // CSP for the SPA shell — relaxed for self-hosted tool accessed from
+    // various IPs/hostnames. 'unsafe-inline' + 'unsafe-eval' needed for Vite.
+    // ws:/wss: in connect-src allows WebSocket from any origin (IP access).
     res.setHeader('Content-Security-Policy', [
         "default-src 'self'",
         "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
         "style-src 'self' 'unsafe-inline'",
         "img-src 'self' data: blob: https:",
         "font-src 'self' data:",
-        "connect-src 'self' ws: wss:",
+        "connect-src 'self' ws: wss: http: https:",
         "frame-ancestors 'self'",
         "base-uri 'self'",
         "form-action 'self'",
@@ -5057,26 +5041,38 @@ async function startServer() {
             restoreRequestedTunnel({ port: Number(SERVER_PORT) }).catch((err) => {
                 console.warn('[external-access] tunnel restore failed:', err?.message || err);
             });
-            // Auto-open browser unless explicitly disabled
+            // Auto-open browser unless explicitly disabled or headless
             if (process.env.PIXCODE_NO_BROWSER !== '1') {
                 const openUrl = `http://${DISPLAY_HOST}:${SERVER_PORT}`;
-                try {
-                    // Use spawn with an argument array instead of exec with a
-                    // shell string to prevent command injection through the
-                    // host/port values (which come from env vars).
-                    const { spawn: spawnBrowser } = await import('node:child_process');
-                    const browserBin = process.platform === 'darwin' ? 'open'
-                        : process.platform === 'win32' ? 'cmd'
-                            : 'xdg-open';
-                    const browserArgs = process.platform === 'win32'
-                        ? ['/c', 'start', '', openUrl]
-                        : [openUrl];
-                    spawnBrowser(browserBin, browserArgs, { stdio: 'ignore', timeout: 3000, detached: true, shell: false }).unref();
-                    console.log(`${c.ok('[OK]')}   Opening browser at ${c.bright(openUrl)}`);
-                }
-                catch {
+                // Skip browser opening on headless servers (no DISPLAY on Linux,
+                // or xdg-open not installed) — common for VPS/cloud deployments.
+                const isHeadless = process.platform === 'linux' && (!process.env.DISPLAY || process.env.DISPLAY === '' ||
+                    !fs.existsSync('/usr/bin/xdg-open') && !fs.existsSync('/usr/local/bin/xdg-open'));
+                if (isHeadless) {
                     console.log(`${c.tip('[TIP]')}  Open ${c.bright(openUrl)} in your browser to start using Pixcode.`);
                 }
+                else {
+                    try {
+                        const { spawn: spawnBrowser } = await import('node:child_process');
+                        const browserBin = process.platform === 'darwin' ? 'open'
+                            : process.platform === 'win32' ? 'cmd'
+                                : 'xdg-open';
+                        const browserArgs = process.platform === 'win32'
+                            ? ['/c', 'start', '', openUrl]
+                            : [openUrl];
+                        const child = spawnBrowser(browserBin, browserArgs, {
+                            stdio: 'ignore', timeout: 3000, detached: true, shell: false,
+                        });
+                        child.on('error', () => {
+                            // Browser binary not found or failed — non-fatal
+                        });
+                        child.unref();
+                        console.log(`${c.ok('[OK]')}   Opening browser at ${c.bright(openUrl)}`);
+                    }
+                    catch {
+                        console.log(`${c.tip('[TIP]')}  Open ${c.bright(openUrl)} in your browser to start using Pixcode.`);
+                    }
+                }
             }
             console.log(`${c.tip('[TIP]')}  Run "pixcode status" for full configuration details`);
             console.log('');