@pixelbyte-software/pixcode 1.54.5 → 1.54.7

package/dist/index.html

@@ -35,7 +35,7 @@
     
     <!-- Prevent zoom on iOS -->
     <meta name="format-detection" content="telephone=no" />
-    <script type="module" crossorigin src="/assets/index-C8DB6Dud.js"></script>
+    <script type="module" crossorigin src="/assets/index-D-4VRH1a.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DB6V5Fl1.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-codemirror-CIYNS698.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-xterm-C7tpxJl7.js">

package/dist-server/server/index.js

@@ -88,7 +88,17 @@ function resolveMonacoAssetsPath() {
 import { c } from './utils/colors.js';
 // Server port is logged after binding in startServer() — avoid leaking
 // env configuration to stdout on every import.
-import pty from 'node-pty';
+// node-pty is a native module — use dynamic require so the server doesn't
+// crash on startup if it isn't compiled (allow-scripts blocking, etc.)
+let pty;
+try {
+    pty = require('node-pty');
+}
+catch (e) {
+    console.warn('[WARN] node-pty native module not available. Terminal/shell features will be disabled.');
+    console.warn('[WARN] Run: npm install -g --allow-scripts=better-sqlite3,node-pty @pixelbyte-software/pixcode');
+    pty = null;
+}
 import mime from 'mime-types';
 import { getProjects, getSessions, renameProject, deleteSession, deleteProject, extractProjectDirectory, clearProjectDirectoryCache, searchConversations } from './projects.js';
 import { queryClaudeSDK, abortClaudeSDKSession, isClaudeSDKSessionActive, getActiveClaudeSDKSessions, resolveToolApproval, getPendingApprovalsForSession, reconnectSessionWriter } from './claude-sdk.js';
@@ -1563,32 +1573,17 @@ app.use(cors({
     credentials: true,
     exposedHeaders: ['X-Refreshed-Token'],
 }));
-// Security headers middleware (replaces helmet which isn't installed).
+// Security headers — kept lightweight for self-hosted tool compatibility.
+// CSP removed: it blocked Vite inline modulepreload, Google Fonts, and
+// IP-based WebSocket access. X-Frame-Options + nosniff are the high-value
+// headers that don't break anything.
 app.use((req, res, next) => {
     res.setHeader('X-Content-Type-Options', 'nosniff');
     res.setHeader('X-Frame-Options', 'SAMEORIGIN');
     res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-    res.setHeader('X-XSS-Protection', '1; mode=block');
-    res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
-    // Strict-Transport-Security only makes sense over HTTPS; skip for plain HTTP
-    // so local dev doesn't pin an HSTS policy on localhost.
     if (req.secure || req.headers['x-forwarded-proto'] === 'https') {
         res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
     }
-    // CSP for the SPA shell — relaxed for self-hosted tool accessed from
-    // various IPs/hostnames. 'unsafe-inline' + 'unsafe-eval' needed for Vite.
-    // ws:/wss: in connect-src allows WebSocket from any origin (IP access).
-    res.setHeader('Content-Security-Policy', [
-        "default-src 'self'",
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' data: blob: https:",
-        "font-src 'self' data:",
-        "connect-src 'self' ws: wss: http: https:",
-        "frame-ancestors 'self'",
-        "base-uri 'self'",
-        "form-action 'self'",
-    ].join('; '));
     next();
 });
 app.use(express.json({
@@ -4115,6 +4110,10 @@ function handleShellConnection(ws, request) {
                         // already sandboxed, so the flag is safe to use.
                         ...(isRunningAsRoot ? { IS_SANDBOX: '1' } : {}),
                     };
+                    if (!pty) {
+                        ws.send(JSON.stringify({ type: 'error', message: 'Terminal not available — node-pty native module is not installed. Run: npm install -g --allow-scripts=better-sqlite3,node-pty @pixelbyte-software/pixcode' }));
+                        return;
+                    }
                     shellProcess = pty.spawn(shell, shellArgs, {
                         name: 'xterm-256color',
                         cols: termCols,