@pleri/olam-cli 0.1.41 → 0.1.42

package/dist/image-digests.json

@@ -1,8 +1,8 @@
 {
   "auth": "sha256:4e2ea22c5ef026ecf7b10892fbe381384b32e83636962d86d9ab1fc572972f8e",
   "devbox": "sha256:9363a1979d7df0ed2b2c964c183ba3e739383c146416f27b1ceb976f64648fd9",
-  "host-cp": "sha256:7687f465665a0a946cd1c16bbc5c384011bd68df752cab2c19e8f4deb2b263cb",
+  "host-cp": "sha256:29d2e544db7fabae259a0311a76ff367ee5e2ca5f48e9640ebefaf3c5997bda3",
   "$schema_version": 1,
-  "$published_version": "0.1.41",
+  "$published_version": "0.1.42",
   "$registry": "ghcr.io/pleri"
 }

package/host-cp/src/server.mjs

@@ -2155,7 +2155,37 @@ let _spaCacheMtime = 0;
 // would 404 through host-cp returning the SPA shell — observed during
 // M5 dogfood: clicking Dispatch on /world/<id> hit /dispatch directly,
 // host-cp had no handler, and the SPA got HTML back instead of JSON.
-const BOOTSTRAP_SCRIPT = `<script>(function(){try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);document.cookie='olam_host_cp_token='+d.token+'; path=/; samesite=strict';}}catch(e){console.error('[host-cp bootstrap]',e);}var HN=['/api/bootstrap','/api/worlds','/api/projects','/api/workspaces','/api/workspaces/match','/api/auth','/health'];var WP=['/api/','/session/','/hooks/','/dispatch','/lanes','/codex/','/review/'];function sr(p){if(typeof p!=='string')return false;if(p.startsWith('/api/world/'))return false;for(var i=0;i<HN.length;i++){var n=HN[i];if(p===n||p.startsWith(n+'?')||p.startsWith(n+'/'))return false;}for(var j=0;j<WP.length;j++){var w=WP[j];if(p===w||p===w.replace(/\\/$/,'')||p.startsWith(w)||p.startsWith(w.replace(/\\/$/,'')+'?')||p.startsWith(w.replace(/\\/$/,'')+'/'))return true;}return false;}function wid(){var p=location.pathname;var m=p.match(/^\\/(world|inbox)\\/([^/?#]+)/);if(m)return m[2];if(/^\\/(?:worlds?|workspaces?|world|sandbox|inbox|plan|design|assets|api|health|favicon)($|\\/|\\?)/.test(p))return null;var r=p.match(/^\\/([a-z][a-z0-9-]+)(?:\\/|$|\\?)/);return r?r[1]:null;}function rw(p){var w=wid();return w?'/api/world/'+w+p:p;}var of=window.fetch.bind(window);window.fetch=function(input,init){if(typeof input==='string'&&sr(input))return of(rw(input),init);if(input&&typeof input.url==='string'&&sr(input.url))return of(new Request(rw(input.url),input),init);return of(input,init);};var OE=window.EventSource;if(OE){window.EventSource=function(u,i){var s=u;if(typeof s==='string'&&sr(s))s=rw(s);return new OE(s,i);};window.EventSource.prototype=OE.prototype;window.EventSource.CONNECTING=OE.CONNECTING;window.EventSource.OPEN=OE.OPEN;window.EventSource.CLOSED=OE.CLOSED;}})();</script>`;
+// SPA bootstrap script — runs INLINE before any other script tag so it
+// can wrap window.fetch / window.EventSource before the SPA bundle loads.
+//
+// Three responsibilities:
+//
+//   (1) Cookie sync: read /api/bootstrap synchronously to seed
+//       `olam_host_cp_token`. The SPA's fetch calls then carry the
+//       cookie automatically.
+//
+//   (2) Path rewriting: `fetch('/session/<id>/state')` and similar
+//       host-native short URLs get rewritten to the world-scoped form
+//       `/api/world/<wid>/...` so host-cp's path-segment routing
+//       dispatches them to the right per-world CP. EventSource gets
+//       the same treatment for `/api/stream`, etc.
+//
+//   (3) Auth-recovery: when a fetch returns 401 (the canonical signal
+//       that the operator's cookie is stale — e.g. after an
+//       `olam host-cp stop && start` rotates the token), re-read
+//       /api/bootstrap. If the token changed, write the fresh cookie
+//       and `location.reload()`. The SPA gets a clean restart with
+//       the new auth context. This avoids the dogfood class where a
+//       host-cp restart left the dashboard's readiness ladder stuck
+//       at "Created" because the SPA's state poll silently 401'd and
+//       no UI cue suggested a hard-reload.
+//
+//       Guards against reload storms: a single `reloading` flag in the
+//       closure prevents N concurrent 401s from triggering N reloads,
+//       and the token-comparison check skips reload when the cookie
+//       already matches (so non-rotation 401s — e.g. genuine auth
+//       failures — don't cause a refresh loop).
+const BOOTSTRAP_SCRIPT = `<script>(function(){function ck(){var m=document.cookie.match(/olam_host_cp_token=([^;]+)/);return m?m[1]:'';}function sw(t){document.cookie='olam_host_cp_token='+t+'; path=/; samesite=strict';}try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);sw(d.token);}}catch(e){console.error('[host-cp bootstrap]',e);}var reloading=false;function recover(){if(reloading)return;try{var x=new XMLHttpRequest();x.open('GET','/api/bootstrap',false);x.send();if(x.status===200){var d=JSON.parse(x.responseText);if(d.token&&ck()!==d.token){reloading=true;sw(d.token);console.warn('[host-cp auth recover] token rotated; reloading');location.reload();}}}catch(e){console.error('[host-cp auth recover]',e);}}var HN=['/api/bootstrap','/api/worlds','/api/projects','/api/workspaces','/api/workspaces/match','/api/auth','/health'];var WP=['/api/','/session/','/hooks/','/dispatch','/lanes','/codex/','/review/'];function sr(p){if(typeof p!=='string')return false;if(p.startsWith('/api/world/'))return false;for(var i=0;i<HN.length;i++){var n=HN[i];if(p===n||p.startsWith(n+'?')||p.startsWith(n+'/'))return false;}for(var j=0;j<WP.length;j++){var w=WP[j];if(p===w||p===w.replace(/\\/$/,'')||p.startsWith(w)||p.startsWith(w.replace(/\\/$/,'')+'?')||p.startsWith(w.replace(/\\/$/,'')+'/'))return true;}return false;}function wid(){var p=location.pathname;var m=p.match(/^\\/(world|inbox)\\/([^/?#]+)/);if(m)return m[2];if(/^\\/(?:worlds?|workspaces?|world|sandbox|inbox|plan|design|assets|api|health|favicon)($|\\/|\\?)/.test(p))return null;var r=p.match(/^\\/([a-z][a-z0-9-]+)(?:\\/|$|\\?)/);return r?r[1]:null;}function rw(p){var w=wid();return w?'/api/world/'+w+p:p;}var of=window.fetch.bind(window);window.fetch=function(input,init){var pr;if(typeof input==='string'&&sr(input))pr=of(rw(input),init);else if(input&&typeof input.url==='string'&&sr(input.url))pr=of(new Request(rw(input.url),input),init);else pr=of(input,init);return pr.then(function(res){if(res&&res.status===401)recover();return res;});};var OE=window.EventSource;if(OE){window.EventSource=function(u,i){var s=u;if(typeof s==='string'&&sr(s))s=rw(s);var es=new OE(s,i);es.addEventListener('error',function(){if(es.readyState===OE.CLOSED)recover();});return es;};window.EventSource.prototype=OE.prototype;window.EventSource.CONNECTING=OE.CONNECTING;window.EventSource.OPEN=OE.OPEN;window.EventSource.CLOSED=OE.CLOSED;}})();</script>`;
 
 async function renderSpaShell(filePath) {
   const stat = fs.statSync(filePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pleri/olam-cli",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "type": "module",
   "bin": {
     "olam": "./dist/index.js"