@roamcode.ai/server 1.0.0 → 1.0.1

package/dist/push-dispatch.d.ts

@@ -1,81 +0,0 @@
-import type { PushStore } from "./push-store.js";
-import type { PushSendFn } from "./web-push-send.js";
-import type { ProviderId } from "./providers/types.js";
-/**
- * The "away-from-desk" events that warrant a phone push. This is the whole point of roamcode: get
- * pinged when claude needs you (awaiting), when it's done (finished), or when it hands you a file.
- * "test" is the odd one out — a user-triggered "are notifications working?" ping (POST /push/test), which
- * carries no session and never touches the home-screen badge.
- */
-export type PushEventKind = "awaiting" | "finished" | "file" | "test";
-export interface PushEvent {
-    kind: PushEventKind;
-    /** The session the event is about — becomes the deep-link (`/?session=<id>`) AND the notification tag.
-     *  Absent for a "test" ping (which isn't about any session). */
-    sessionId?: string;
-    /** Optional enrichment: the file name (kind:"file") for the body. */
-    detail?: string;
-    /** Provider/session identity is bounded display metadata, never an auth or protocol payload. */
-    provider?: ProviderId;
-    label?: string;
-    /**
-     * Home-screen app-badge value = the count of sessions currently awaiting you. Stamped by the transport on
-     * every real dispatch (awaiting/finished/file) from {@link TerminalManager.awaitingCount}, so the SW
-     * can keep the badge in sync with "how many sessions need you". Omitted for a "test" ping (it must never
-     * clobber the badge). A missing value leaves the badge untouched on the client.
-     */
-    badgeCount?: number;
-}
-/**
- * The Web Push payload the browser service worker consumes (packages/web `push` handler). The `tag` +
- * `renotify` pair COLLAPSES repeated pushes for the same session into one re-alerting notification (so a
- * flapping awaiting detector can't spam a phone), and `requireInteraction` keeps a "needs-you" alert
- * sticky while a "done"/"file" alert can auto-dismiss.
- */
-export interface PushPayload {
-    title: string;
-    body: string;
-    /** Deep-link the notification opens — always `/?session=<sessionId>`. */
-    url: string;
-    /** Notification tag = sessionId, so the OS collapses per-session alerts (with renotify) rather than stack. */
-    tag: string;
-    renotify: boolean;
-    /** True for a waiting-for-user alert (awaiting); false for a done/file alert. */
-    requireInteraction: boolean;
-    /**
-     * The home-screen app-badge value the SW should apply (applyBadgeFromPush): the count of sessions currently
-     * awaiting you. Present on every real away-from-desk payload; ABSENT on a "test" ping (so it never clobbers
-     * the badge). The SW treats a missing value as "leave the badge alone" and 0 as "clear it". Android/desktop
-     * honor the app badge; iOS can't badge from a push.
-     */
-    badgeCount?: number;
-}
-export interface PushDispatcher {
-    /**
-     * Build the payload for an away-from-desk event and fan it out over every matching subscription. NEVER
-     * throws (a push failure must never break the terminal / the calling route); dead subscriptions (404/410)
-     * are pruned from the store as a side effect.
-     */
-    dispatch(event: PushEvent): Promise<void>;
-}
-/**
- * Map a semantic away-from-desk event to the Web Push payload the SW renders. Pure + exported so the exact
- * contract is unit-testable (and the web agents can match it): every payload deep-links to the session and
- * tags on the session id; only "needs-you" alerts (awaiting) set requireInteraction.
- */
-export declare function buildPushPayload(event: PushEvent): PushPayload;
-export interface CreatePushDispatcherDeps {
-    pushStore: PushStore;
-    /** The bound Web Push sender (createWebPushSend). Injected so tests drive a fake without real crypto/HTTP. */
-    send: PushSendFn;
-    /** Optional log sink for a non-HTTP send failure (defaults to a no-op). */
-    log?: (msg: string) => void;
-}
-/**
- * Build the push dispatcher. Fans an event out to the GLOBAL subscriptions UNION the ones scoped to the
- * event's session (that's exactly what `pushStore.list({ sessionId })` returns), delivering to all in
- * parallel. A send that reports 404 (Not Found) / 410 (Gone) means the browser subscription is dead — it's
- * pruned from the store so it isn't retried forever. A non-HTTP failure (encryption, network throw) is
- * logged and the sub is KEPT (it isn't known-dead). Never throws.
- */
-export declare function createPushDispatcher(deps: CreatePushDispatcherDeps): PushDispatcher;

package/dist/push-dispatch.js

@@ -1,100 +0,0 @@
-/**
- * Map a semantic away-from-desk event to the Web Push payload the SW renders. Pure + exported so the exact
- * contract is unit-testable (and the web agents can match it): every payload deep-links to the session and
- * tags on the session id; only "needs-you" alerts (awaiting) set requireInteraction.
- */
-export function buildPushPayload(event) {
-    // A user-triggered "are notifications working?" ping (POST /push/test): fixed copy, opens the app root (no
-    // session), never sticky, and DELIBERATELY carries no badgeCount so it can't clobber the home-screen badge.
-    if (event.kind === "test") {
-        return {
-            title: "roamcode",
-            body: "Notifications are working ✓",
-            url: "/",
-            tag: "roamcode-test",
-            renotify: true,
-            requireInteraction: false,
-        };
-    }
-    // Every real away-from-desk payload deep-links to the session, tags on the session id, and — when the
-    // transport stamped it — carries the awaiting-session count as `badgeCount` (0 included, so the SW can
-    // CLEAR the badge when nothing is left waiting).
-    const base = {
-        url: `/?session=${event.sessionId}`,
-        tag: event.sessionId ?? "",
-        renotify: true,
-        ...(typeof event.badgeCount === "number" ? { badgeCount: event.badgeCount } : {}),
-    };
-    const provider = event.provider === "codex" ? "Codex" : "Claude";
-    const safeLabel = (() => {
-        const clean = event.label
-            ?.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, "")
-            .trim()
-            .slice(0, 80);
-        return clean || "Session";
-    })();
-    switch (event.kind) {
-        case "awaiting":
-            return {
-                ...base,
-                title: `${provider} is waiting`,
-                body: `${safeLabel} needs your input in ${provider}.`,
-                requireInteraction: true,
-            };
-        case "file":
-            return {
-                ...base,
-                title: `${provider} sent a file`,
-                body: `${safeLabel} has a file ready in the Files panel.`,
-                requireInteraction: false,
-            };
-        case "finished":
-            return {
-                ...base,
-                title: `${provider} session ended`,
-                body: `${safeLabel} has ended in ${provider}.`,
-                requireInteraction: false,
-            };
-    }
-}
-/**
- * Build the push dispatcher. Fans an event out to the GLOBAL subscriptions UNION the ones scoped to the
- * event's session (that's exactly what `pushStore.list({ sessionId })` returns), delivering to all in
- * parallel. A send that reports 404 (Not Found) / 410 (Gone) means the browser subscription is dead — it's
- * pruned from the store so it isn't retried forever. A non-HTTP failure (encryption, network throw) is
- * logged and the sub is KEPT (it isn't known-dead). Never throws.
- */
-export function createPushDispatcher(deps) {
-    const { pushStore, send } = deps;
-    async function deliverOne(sub, payload) {
-        let result;
-        try {
-            result = await send(sub, payload);
-        }
-        catch (err) {
-            // A non-HTTP failure (e.g. encryption) — NOT proof the subscription is dead, so keep it; just log.
-            deps.log?.(`push send failed for ${sub.endpoint}: ${err.message}`);
-            return;
-        }
-        // 404/410 → the push service says this subscription no longer exists; prune it so we stop retrying.
-        if (result.statusCode === 404 || result.statusCode === 410)
-            pushStore.remove(sub.endpoint);
-    }
-    return {
-        async dispatch(event) {
-            const payload = JSON.stringify(buildPushPayload(event));
-            // Global subs (no sessionId) + subs scoped to THIS session. A "test" ping has no sessionId, so it fans
-            // out to EVERY subscription (list() with no filter) — the caller just enabled push and wants any of
-            // their devices to confirm delivery. A store read failure must not throw here.
-            let subs;
-            try {
-                subs = pushStore.list({ sessionId: event.sessionId });
-            }
-            catch (err) {
-                deps.log?.(`push fan-out skipped (store list failed): ${err.message}`);
-                return;
-            }
-            await Promise.all(subs.map((sub) => deliverOne(sub, payload)));
-        },
-    };
-}

package/dist/push-store.d.ts

@@ -1,25 +0,0 @@
-export interface PushSubscriptionRecord {
-    /** Browser push endpoint URL (PRIMARY KEY — one per subscription). */
-    endpoint: string;
-    /** PushSubscription.keys.p256dh (client public key). */
-    p256dh: string;
-    /** PushSubscription.keys.auth (client auth secret). */
-    auth: string;
-    /** Optional session scope; undefined = subscribed to ALL sessions. */
-    sessionId?: string;
-    createdAt: number;
-}
-export interface PushStore {
-    upsert(sub: PushSubscriptionRecord): void;
-    /** All subscriptions, or — with { sessionId } — the global (NULL) ones UNION the session-scoped ones. */
-    list(opts?: {
-        sessionId?: string;
-    }): PushSubscriptionRecord[];
-    remove(endpoint: string): void;
-    close(): void;
-}
-export interface OpenPushStoreOptions {
-    /** SQLite file path. ":memory:" uses an in-process DB. */
-    dbPath: string;
-}
-export declare function openPushStore(opts: OpenPushStoreOptions): PushStore;

package/dist/push-store.js

@@ -1,79 +0,0 @@
-import { createRequire } from "node:module";
-const require = createRequire(import.meta.url);
-function rowToSub(r) {
-    const s = {
-        endpoint: r.endpoint,
-        p256dh: r.p256dh,
-        auth: r.auth,
-        createdAt: r.created_at,
-    };
-    if (r.session_id !== null)
-        s.sessionId = r.session_id;
-    return s;
-}
-/**
- * In-memory fallback used when the native better-sqlite3 module cannot load
- * (no toolchain / unsupported platform) so the server still boots. NOT durable
- * across process restarts — mirrors the SessionStore/idempotency-store pattern.
- */
-function inMemoryStore() {
-    const map = new Map();
-    return {
-        upsert: (s) => void map.set(s.endpoint, { ...s }),
-        list: (opts) => {
-            const all = [...map.values()].map((v) => ({ ...v }));
-            if (!opts?.sessionId)
-                return all;
-            return all.filter((s) => s.sessionId === undefined || s.sessionId === opts.sessionId);
-        },
-        remove: (endpoint) => void map.delete(endpoint),
-        close: () => map.clear(),
-    };
-}
-export function openPushStore(opts) {
-    let Database;
-    try {
-        // Dynamic require keeps the native dep out of the module graph until needed
-        // and lets us fall back gracefully if the build is missing.
-        const mod = require("better-sqlite3");
-        Database = (mod.default ?? mod);
-    }
-    catch {
-        return inMemoryStore();
-    }
-    const db = new Database(opts.dbPath);
-    db.pragma("journal_mode = WAL"); // parity with the session store (concurrent reader/writer safety)
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS push_subscriptions (
-      endpoint TEXT PRIMARY KEY,
-      p256dh TEXT NOT NULL,
-      auth TEXT NOT NULL,
-      session_id TEXT,
-      created_at INTEGER NOT NULL
-    )
-  `);
-    const upsertStmt = db.prepare(`
-    INSERT INTO push_subscriptions (endpoint, p256dh, auth, session_id, created_at)
-    VALUES (@endpoint, @p256dh, @auth, @session_id, @created_at)
-    ON CONFLICT(endpoint) DO UPDATE SET
-      p256dh=excluded.p256dh, auth=excluded.auth, session_id=excluded.session_id, created_at=excluded.created_at
-  `);
-    const listAllStmt = db.prepare("SELECT * FROM push_subscriptions ORDER BY created_at ASC");
-    const listScopedStmt = db.prepare("SELECT * FROM push_subscriptions WHERE session_id IS NULL OR session_id = ? ORDER BY created_at ASC");
-    const removeStmt = db.prepare("DELETE FROM push_subscriptions WHERE endpoint = ?");
-    return {
-        upsert: (s) => void upsertStmt.run({
-            endpoint: s.endpoint,
-            p256dh: s.p256dh,
-            auth: s.auth,
-            session_id: s.sessionId ?? null,
-            created_at: s.createdAt,
-        }),
-        list: (opts) => {
-            const rows = (opts?.sessionId ? listScopedStmt.all(opts.sessionId) : listAllStmt.all());
-            return rows.map(rowToSub);
-        },
-        remove: (endpoint) => void removeStmt.run(endpoint),
-        close: () => db.close(),
-    };
-}

package/dist/rate-limit.d.ts

@@ -1,52 +0,0 @@
-/**
- * Lightweight, in-memory, per-client rate limiter for the global preHandler. The per-IP auth LOCKOUT
- * (auth.ts) only counts FAILED auth attempts and collapses behind a proxy; this adds a generous request
- * cap so a flood (auth-guessing, scraping, accidental client loop) can't hammer the host — while staying
- * well clear of any legitimate use (the PWA's periodic /sessions + /version poll, a burst of opens).
- *
- * Algorithm: a TOKEN BUCKET per client key (request.ip, honoring trustProxy — same key as the lockout).
- * `capacity` tokens, refilled continuously at `capacity / windowMs` tokens/ms; each request spends one.
- * A token bucket allows a short BURST (up to `capacity`) yet bounds the sustained rate — friendlier to
- * bursty real traffic than a hard fixed window. PURE/I-O-free + an injectable clock so it is unit-testable.
- *
- * SAFE DEFAULTS (see server-config.ts): 600 requests / 60s sustained, burst 120 — orders of magnitude
- * above the app's real cadence. Env-overridable and fully DISABLE-able (enabled:false → allow everything).
- */
-export interface RateLimiterOptions {
-    /** Sustained budget: `capacity` requests refill over `windowMs` (→ capacity/windowMs tokens per ms). */
-    capacity: number;
-    /** Refill window in ms for the full capacity. */
-    windowMs: number;
-    /** Max burst (bucket size). Defaults to `capacity`. A larger value tolerates a bigger instantaneous spike. */
-    burst?: number;
-    /** Master switch. false → {@link RateLimiter.take} always allows (the limiter is off). Default true. */
-    enabled?: boolean;
-    /** Injectable clock for tests. Default Date.now. */
-    now?: () => number;
-}
-export interface RateLimitDecision {
-    /** True → allow the request (a token was spent or the limiter is off). */
-    allowed: boolean;
-    /** When NOT allowed, seconds the client should wait before retrying (for the Retry-After header). */
-    retryAfterSeconds: number;
-}
-export declare class RateLimiter {
-    private readonly capacity;
-    private readonly windowMs;
-    private readonly burst;
-    private readonly enabled;
-    private readonly now;
-    private readonly ratePerMs;
-    private readonly clients;
-    constructor(opts: RateLimiterOptions);
-    /**
-     * Account for ONE request from `clientKey`. Refills the bucket by elapsed time, then spends a token if
-     * one is available. Returns {allowed:true} when a token was spent (or the limiter is disabled), else
-     * {allowed:false, retryAfterSeconds} — the whole-seconds wait until the next token is available.
-     */
-    take(clientKey: string): RateLimitDecision;
-    /** Drop fully-refilled buckets so the map stays bounded (a one-shot client doesn't linger forever). */
-    private sweepFull;
-    /** TEST ONLY: number of tracked client buckets. */
-    trackedClientCount(): number;
-}

package/dist/rate-limit.js

@@ -1,72 +0,0 @@
-/**
- * Lightweight, in-memory, per-client rate limiter for the global preHandler. The per-IP auth LOCKOUT
- * (auth.ts) only counts FAILED auth attempts and collapses behind a proxy; this adds a generous request
- * cap so a flood (auth-guessing, scraping, accidental client loop) can't hammer the host — while staying
- * well clear of any legitimate use (the PWA's periodic /sessions + /version poll, a burst of opens).
- *
- * Algorithm: a TOKEN BUCKET per client key (request.ip, honoring trustProxy — same key as the lockout).
- * `capacity` tokens, refilled continuously at `capacity / windowMs` tokens/ms; each request spends one.
- * A token bucket allows a short BURST (up to `capacity`) yet bounds the sustained rate — friendlier to
- * bursty real traffic than a hard fixed window. PURE/I-O-free + an injectable clock so it is unit-testable.
- *
- * SAFE DEFAULTS (see server-config.ts): 600 requests / 60s sustained, burst 120 — orders of magnitude
- * above the app's real cadence. Env-overridable and fully DISABLE-able (enabled:false → allow everything).
- */
-export class RateLimiter {
-    capacity;
-    windowMs;
-    burst;
-    enabled;
-    now;
-    ratePerMs;
-    clients = new Map();
-    constructor(opts) {
-        this.capacity = opts.capacity;
-        this.windowMs = opts.windowMs;
-        this.burst = opts.burst ?? opts.capacity;
-        this.enabled = opts.enabled ?? true;
-        this.now = opts.now ?? Date.now;
-        // Guard against a degenerate config (windowMs<=0): treat as instant refill (effectively no sustained cap).
-        this.ratePerMs = this.windowMs > 0 ? this.capacity / this.windowMs : Number.POSITIVE_INFINITY;
-    }
-    /**
-     * Account for ONE request from `clientKey`. Refills the bucket by elapsed time, then spends a token if
-     * one is available. Returns {allowed:true} when a token was spent (or the limiter is disabled), else
-     * {allowed:false, retryAfterSeconds} — the whole-seconds wait until the next token is available.
-     */
-    take(clientKey) {
-        if (!this.enabled)
-            return { allowed: true, retryAfterSeconds: 0 };
-        this.sweepFull();
-        const t = this.now();
-        const state = this.clients.get(clientKey) ?? { tokens: this.burst, updatedAt: t };
-        // Refill: add the tokens accrued since the last touch, capped at the burst size.
-        const elapsed = Math.max(0, t - state.updatedAt);
-        state.tokens = Math.min(this.burst, state.tokens + elapsed * this.ratePerMs);
-        state.updatedAt = t;
-        if (state.tokens >= 1) {
-            state.tokens -= 1;
-            this.clients.set(clientKey, state);
-            return { allowed: true, retryAfterSeconds: 0 };
-        }
-        // Out of tokens: time until one more accrues.
-        const msToNext = this.ratePerMs > 0 ? (1 - state.tokens) / this.ratePerMs : Number.POSITIVE_INFINITY;
-        const retryAfterSeconds = Number.isFinite(msToNext) ? Math.max(1, Math.ceil(msToNext / 1000)) : 1;
-        this.clients.set(clientKey, state);
-        return { allowed: false, retryAfterSeconds };
-    }
-    /** Drop fully-refilled buckets so the map stays bounded (a one-shot client doesn't linger forever). */
-    sweepFull() {
-        const t = this.now();
-        for (const [key, state] of this.clients) {
-            const elapsed = Math.max(0, t - state.updatedAt);
-            const tokens = Math.min(this.burst, state.tokens + elapsed * this.ratePerMs);
-            if (tokens >= this.burst)
-                this.clients.delete(key);
-        }
-    }
-    /** TEST ONLY: number of tracked client buckets. */
-    trackedClientCount() {
-        return this.clients.size;
-    }
-}

package/dist/server-config.d.ts

@@ -1,60 +0,0 @@
-import type { ServerConfig } from "./config.js";
-/** Safe defaults for the new security/limit controls (generous; never bother a real self-hoster). */
-export declare const DEFAULT_RATE_LIMIT_RPM = 600;
-export declare const DEFAULT_RATE_LIMIT_BURST = 120;
-export declare const DEFAULT_MAX_SESSIONS = 25;
-export interface ServerRuntimeConfig {
-    /** TCP port to listen on. Default 4280. */
-    port: number;
-    /** Address to bind. Default "127.0.0.1" (loopback). */
-    bindAddress: string;
-    /** Mandatory access token. Optional only for loopback binds (spec §9). */
-    accessToken?: string;
-    /** Root directory the file picker / fs-service is confined to. Default $HOME or cwd. */
-    fsRoot: string;
-    /** Max bytes accepted for an upload. Default 25 MiB. */
-    maxUploadBytes: number;
-    /** Host data dir for the SQLite DB + access token file. */
-    dataDir: string;
-    /**
-     * Trust X-Forwarded-* (passed to Fastify as `trustProxy`). Default false. PREFER a specific proxy IP/CIDR
-     * (e.g. "127.0.0.1" for a same-host cloudflared/Caddy) over `true`: `true` trusts EVERY hop and takes the
-     * left-most XFF entry, which a client can prepend to spoof `request.ip` and poison the rate limiter. A
-     * string here is Fastify's trustProxy spec (IP, CIDR, or comma-list); boolean true = trust all hops.
-     */
-    trustProxy?: boolean | string;
-    /**
-     * The public-facing origin (ROAMCODE_PUBLIC_URL). Used by the Origin/CSWSH guard as an allow-listed
-     * origin (the PWA is installed under this when behind a tunnel) AND by start.ts for push deep-links.
-     */
-    publicUrl?: string;
-    /**
-     * Extra Origins the CSWSH guard allows, beyond same-origin / loopback / publicUrl
-     * (ROAMCODE_ALLOWED_ORIGINS, comma-separated). Empty by default — the safe default already lets the
-     * real app through; this is only to permit an additional known front-end origin.
-     */
-    allowedOrigins: string[];
-    /**
-     * Global per-client request rate limit (token bucket). `rateLimitRpm` requests/minute sustained,
-     * `rateLimitBurst` instantaneous. Set rateLimitRpm to 0 to DISABLE the limiter entirely.
-     * (ROAMCODE_RATE_LIMIT_RPM / ROAMCODE_RATE_LIMIT_BURST.)
-     */
-    rateLimitRpm: number;
-    rateLimitBurst: number;
-    /** Max concurrent LIVE sessions/processes; POST /sessions is refused (429) at the cap. 0 disables the
-     *  cap. (ROAMCODE_MAX_SESSIONS.) */
-    maxSessions: number;
-    /** Kill running terminal sessions with NO attached client that have been idle longer than this many ms.
-     *  0 (default) DISABLES it — sessions survive a disconnect indefinitely for later reattach. Opt-in
-     *  (SESSION_IDLE_TTL_MS) for hosts that want to bound detached claude+tmux accumulation. Optional in the
-     *  type (older config literals / tests omit it); consumers treat an absent value as 0 (disabled). */
-    sessionIdleTtlMs?: number;
-    /** The claude-spawn config (claudeBin). */
-    claude: ServerConfig;
-    /** Codex CLI executable. Defaults to `codex`; independently overridable with CODEX_BIN. */
-    codexBin: string;
-}
-export declare function loadServerConfig(env: NodeJS.ProcessEnv): ServerRuntimeConfig;
-export declare function isLoopbackAddress(address: string): boolean;
-/** Spec §9: refuse to serve a non-loopback bind without a token. */
-export declare function assertConfigAllowsStart(cfg: ServerRuntimeConfig): void;

package/dist/server-config.js

@@ -1,77 +0,0 @@
-import { loadConfig } from "./config.js";
-import { resolveDataDir } from "./data-dir.js";
-import { parseAllowedOrigins } from "./origin-check.js";
-/** Safe defaults for the new security/limit controls (generous; never bother a real self-hoster). */
-export const DEFAULT_RATE_LIMIT_RPM = 600; // sustained requests/minute per client (way above the app's poll)
-export const DEFAULT_RATE_LIMIT_BURST = 120; // instantaneous burst allowance (a flurry of opens/polls)
-export const DEFAULT_MAX_SESSIONS = 25; // max concurrent LIVE claude sessions/processes
-/**
- * Parse an integer env option. An ABSENT or UNPARSEABLE value falls back to the default (lenient);
- * a present-but-out-of-range value is a configuration ERROR (fail fast at boot).
- */
-function parseIntOption(raw, fallback, name, range) {
-    if (raw === undefined)
-        return fallback;
-    const n = Number.parseInt(raw, 10);
-    if (Number.isNaN(n))
-        return fallback;
-    if ((range.min !== undefined && n < range.min) || (range.max !== undefined && n > range.max)) {
-        throw new Error(`invalid ${name}: ${raw} (must be ${range.min ?? "-∞"}..${range.max ?? "∞"})`);
-    }
-    return n;
-}
-export function loadServerConfig(env) {
-    // PORT 0 is a legitimate value: it tells the OS to pick a free ephemeral port (used in tests
-    // and for "let the OS choose"). Only a value ABOVE 65535 (or below 0) is a configuration error.
-    const port = parseIntOption(env.PORT, 4280, "PORT", { min: 0, max: 65535 });
-    const maxUploadBytes = parseIntOption(env.MAX_UPLOAD_BYTES, 26214400, "MAX_UPLOAD_BYTES", { min: 1 });
-    // ROAMCODE_* vars fall back to their legacy REMOTE_CODER_* names (pre-rename installs keep working
-    // across an OTA update without touching their service env).
-    const rc = (suffix) => env[`ROAMCODE_${suffix}`] ?? env[`REMOTE_CODER_${suffix}`];
-    // Rate limit: 0 rpm DISABLES the limiter (min:0); burst min 1 (a 0-size bucket would block everything).
-    const rateLimitRpm = parseIntOption(rc("RATE_LIMIT_RPM"), DEFAULT_RATE_LIMIT_RPM, "ROAMCODE_RATE_LIMIT_RPM", { min: 0 }); // prettier-ignore
-    const rateLimitBurst = parseIntOption(rc("RATE_LIMIT_BURST"), DEFAULT_RATE_LIMIT_BURST, "ROAMCODE_RATE_LIMIT_BURST", { min: 1 }); // prettier-ignore
-    // Concurrency cap: 0 DISABLES the cap (unbounded — the prior behavior, opt-out).
-    const maxSessions = parseIntOption(rc("MAX_SESSIONS"), DEFAULT_MAX_SESSIONS, "ROAMCODE_MAX_SESSIONS", { min: 0 }); // prettier-ignore
-    // 0 (default) DISABLES idle reaping — detached sessions survive for later reattach (the core feature).
-    const sessionIdleTtlMs = parseIntOption(env.SESSION_IDLE_TTL_MS, 0, "SESSION_IDLE_TTL_MS", { min: 0 });
-    const cfg = {
-        port,
-        bindAddress: env.BIND_ADDRESS ?? "127.0.0.1",
-        fsRoot: env.FS_ROOT ?? env.HOME ?? process.cwd(),
-        maxUploadBytes,
-        dataDir: resolveDataDir(env),
-        allowedOrigins: parseAllowedOrigins(rc("ALLOWED_ORIGINS")),
-        rateLimitRpm,
-        rateLimitBurst,
-        maxSessions,
-        sessionIdleTtlMs,
-        claude: loadConfig(env),
-        codexBin: env.CODEX_BIN ?? "codex",
-    };
-    if (env.ACCESS_TOKEN)
-        cfg.accessToken = env.ACCESS_TOKEN;
-    // "1"/"true" → trust ALL hops (convenient but spoofable). An IP/CIDR-looking value (has a "." or ":" and
-    // only address chars — e.g. "127.0.0.1", "10.0.0.0/8", "::1") → pass through as Fastify's trustProxy spec
-    // (the recommended form: trust ONLY that proxy hop). Anything else ("0", "false", "no", unset) → off.
-    const tp = (env.TRUST_PROXY ?? "").trim();
-    if (tp === "1" || tp.toLowerCase() === "true")
-        cfg.trustProxy = true;
-    else if (/[.:]/.test(tp) && /^[0-9a-fA-F.:,/\s]+$/.test(tp))
-        cfg.trustProxy = tp;
-    const publicUrl = (rc("PUBLIC_URL") ?? "").trim();
-    if (publicUrl)
-        cfg.publicUrl = publicUrl;
-    return cfg;
-}
-export function isLoopbackAddress(address) {
-    if (address === "::1" || address === "localhost")
-        return true;
-    return /^127(?:\.\d{1,3}){3}$/.test(address);
-}
-/** Spec §9: refuse to serve a non-loopback bind without a token. */
-export function assertConfigAllowsStart(cfg) {
-    if (!isLoopbackAddress(cfg.bindAddress) && !cfg.accessToken) {
-        throw new Error(`refusing to start: bind address ${cfg.bindAddress} is not loopback and no ACCESS_TOKEN is set (set ACCESS_TOKEN or bind to 127.0.0.1)`);
-    }
-}

package/dist/service-install.d.ts

@@ -1,60 +0,0 @@
-export declare function buildServicePath(nodePath: string, home: string): string;
-export interface RenderLaunchdOptions {
-    label: string;
-    nodePath?: string;
-    cliPath?: string;
-    executablePath?: string;
-    dataDir: string;
-    installRoot?: string;
-    servicePath?: string;
-}
-export declare function renderLaunchdPlist(opts: RenderLaunchdOptions): string;
-export interface RenderSystemdOptions {
-    nodePath?: string;
-    cliPath?: string;
-    executablePath?: string;
-    dataDir: string;
-    installRoot?: string;
-    servicePath?: string;
-}
-export declare function renderSystemdUnit(opts: RenderSystemdOptions): string;
-export interface ServiceRecord {
-    manager: "launchd" | "systemd";
-    label: string;
-    path: string;
-    launcherPath?: string;
-    installRoot?: string;
-}
-export interface InstallServiceContext {
-    nodePath: string;
-    cliPath?: string;
-    executablePath?: string;
-    dataDir: string;
-    installRoot?: string;
-    home?: string;
-    os?: NodeJS.Platform;
-    label?: string;
-}
-export interface InstallServiceResult {
-    path: string;
-    instructions: string;
-    record: ServiceRecord;
-}
-export declare function installService(ctx: InstallServiceContext): InstallServiceResult;
-export declare function readServiceRecord(dataDir: string): ServiceRecord | undefined;
-export declare function migrateServiceToLauncher(opts: {
-    dataDir: string;
-    installRoot: string;
-    launcherPath: string;
-    nodePath: string;
-}): ServiceRecord | undefined;
-export declare function restartService(record: ServiceRecord): {
-    ok: boolean;
-    error?: string;
-};
-/** Enable the per-user service and start it immediately. This is only called by the explicit
- * `roamcode install` command; OTA updates use restartService and never change enablement. */
-export declare function enableService(record: ServiceRecord): {
-    ok: boolean;
-    error?: string;
-};