@rogatio/cli 6.20.0 → 6.20.2

package/README.md

@@ -45,7 +45,7 @@ rogatio <command> [options]
 | `rogatio runtime <install\|uninstall\|verify>` | Register the native-messaging host with `install` and trust the device-local CA in one **transactional** call; it needs elevated privileges (Linux `sudo`, macOS keychain authorization, Windows Administrator) and rolls back with exit `1` and `trust unsupported: <reasons>` when a capability or elevation is missing. Release users never pass `--extension-id`. That flag is only for development (a local unpacked build without the release key) and for forks. `uninstall` removes the host manifest, the device-local CA files, and the CA trust installation (idempotent). `verify` reports whether manifest, `runtime-host` wrapper, allowed origins, and CA trust are all valid, and fails when `allowed_origins` omits the release ID. Release users never pass `--extension-id` on verify either. |
 | `rogatio runtime host [path]` | Run the consolidated native-messaging host for the project (pair/authorize/body transforms and mock responses over stdio). Normally launched by the browser; run manually only for debugging. `--root <dir>` overrides the confined mock file root. When omitted, a saved device-local root for that project file is used, otherwise the project directory. A stdin project that contains a file mock requires `--root`. |
 
-`rogatio edit` includes **Run checks**. It calls `POST /api/doctor` (CSRF-protected) and shows editor checks plus the same report as `rogatio doctor` for the open file. A provider configured after the page opened is picked up on the next `rogatio edit`.
+`rogatio edit` includes **Run checks**. It calls `POST /e/<session>/api/doctor` (session path, loopback Origin, and `X-CSRF-Token`) and shows editor checks plus the same report as `rogatio doctor` for the open file. A provider configured after the page opened is picked up on the next `rogatio edit`.
 
 Global options: `--help, -h` and `--version, -v`. Run `rogatio <command> --help`
 for command-specific usage.

package/dist/node/index.js

@@ -7,8 +7,6 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // packages/runtime/dist/node/index.js
 import { isIP } from "node:net";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
 
 // packages/schema/dist/node/index.js
 import { Ajv2020 } from "ajv/dist/2020.js";
@@ -2260,6 +2258,8 @@ function sameOrigin(a, b) {
 }
 
 // packages/runtime/dist/node/index.js
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
 import { isIP as isIP2 } from "node:net";
 import { constants, existsSync } from "node:fs";
 import { open, readlink, realpath } from "node:fs/promises";
@@ -21133,79 +21133,51 @@ function sleep(ms) {
 function calculateRetryDelay(attempt) {
   return RETRY_DELAY_BASE * 2 ** attempt + Math.random() * 100;
 }
-async function fetchWithRetry(url, init, signal) {
-  let lastError;
-  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-    if (signal?.aborted) {
-      throw new DOMException("Aborted", "AbortError");
-    }
-    try {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), COMPLETE_TIMEOUT);
-      if (signal) {
-        signal.addEventListener("abort", () => controller.abort());
-      }
-      const response = await fetch(url, {
-        ...init,
-        signal: controller.signal
-      });
-      clearTimeout(timeoutId);
-      if (response.ok) {
-        return response;
-      }
-      const shouldRetry = response.status === 429 || response.status >= 500;
-      if (shouldRetry && attempt < MAX_RETRIES) {
-        const retryAfter = response.headers.get("Retry-After");
-        const delay = retryAfter ? parseInt(retryAfter, 10) * 1e3 : calculateRetryDelay(attempt);
-        await sleep(Math.min(delay, 1e4));
-        continue;
-      }
-      const errorText = await response.text().catch(() => "");
-      throw new Error(`HTTP ${response.status}: ${errorText}`);
-    } catch (e) {
-      lastError = e;
-      if (e instanceof DOMException && e.name === "AbortError") {
-        throw e;
-      }
-      if (attempt < MAX_RETRIES && e.name !== "AbortError") {
-        await sleep(calculateRetryDelay(attempt));
-        continue;
-      }
-      throw e;
-    }
-  }
-  throw lastError;
+function providerStatusError(status) {
+  return new Error(`HTTP ${status}`);
+}
+async function releaseResponse(response) {
+  await response.body?.cancel().catch(() => void 0);
 }
-async function fetchStreamWithRetry(url, init, signal) {
+async function fetchProvider(url, init, timeoutMs, signal) {
   let lastError;
   for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
     if (signal?.aborted) {
       throw new DOMException("Aborted", "AbortError");
     }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    if (signal) {
+      signal.addEventListener("abort", () => controller.abort());
+    }
+    let terminalStatus;
     try {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), STREAM_TIMEOUT);
-      if (signal) {
-        signal.addEventListener("abort", () => controller.abort());
-      }
       const response = await fetch(url, {
         ...init,
+        // Stay on the configured URL. A 3xx response is not followed.
+        redirect: "manual",
         signal: controller.signal
       });
       clearTimeout(timeoutId);
-      if (response.ok) {
+      if (response.status >= 300 && response.status <= 399) {
+        await releaseResponse(response);
+        terminalStatus = response.status;
+      } else if (response.ok) {
         return response;
+      } else {
+        const shouldRetry = response.status === 429 || response.status >= 500;
+        if (shouldRetry && attempt < MAX_RETRIES) {
+          await releaseResponse(response);
+          const retryAfter = response.headers.get("Retry-After");
+          const delay = retryAfter ? parseInt(retryAfter, 10) * 1e3 : calculateRetryDelay(attempt);
+          await sleep(Math.min(delay, 1e4));
+          continue;
+        }
+        await releaseResponse(response);
+        terminalStatus = response.status;
       }
-      const shouldRetry = response.status === 429 || response.status >= 500;
-      if (shouldRetry && attempt < MAX_RETRIES) {
-        const retryAfter = response.headers.get("Retry-After");
-        const delay = retryAfter ? parseInt(retryAfter, 10) * 1e3 : calculateRetryDelay(attempt);
-        await sleep(Math.min(delay, 1e4));
-        continue;
-      }
-      const errorText = await response.text().catch(() => "");
-      throw new Error(`HTTP ${response.status}: ${errorText}`);
     } catch (e) {
+      clearTimeout(timeoutId);
       lastError = e;
       if (e instanceof DOMException && e.name === "AbortError") {
         throw e;
@@ -21216,9 +21188,18 @@ async function fetchStreamWithRetry(url, init, signal) {
       }
       throw e;
     }
+    if (terminalStatus !== void 0) {
+      throw providerStatusError(terminalStatus);
+    }
   }
   throw lastError;
 }
+function fetchWithRetry(url, init, signal) {
+  return fetchProvider(url, init, COMPLETE_TIMEOUT, signal);
+}
+function fetchStreamWithRetry(url, init, signal) {
+  return fetchProvider(url, init, STREAM_TIMEOUT, signal);
+}
 function sanitizeResponse(text) {
   return text;
 }
@@ -21318,67 +21299,23 @@ function createAIClient(config) {
     }
   };
 }
-var RESOURCE_TYPES2 = [
-  "main_frame",
-  "sub_frame",
-  "stylesheet",
-  "script",
-  "image",
-  "font",
-  "object",
-  "xmlhttprequest",
-  "fetch",
-  "media",
-  "websocket",
-  "manifest",
-  "other"
-];
-var HTTP_METHODS2 = [
-  "GET",
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE",
-  "HEAD",
-  "OPTIONS",
-  "CONNECT",
-  "TRACE"
-];
-var FORBIDDEN_REQUEST_HEADERS2 = [
-  "accept-charset",
-  "accept-encoding",
-  "access-control-request-headers",
-  "access-control-request-method",
-  "connection",
-  "content-length",
-  "cookie",
-  "cookie2",
-  "date",
-  "dnt",
-  "expect",
-  "host",
-  "keep-alive",
-  "origin",
-  "referer",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade",
-  "via"
-];
-var FORBIDDEN_RESPONSE_HEADERS2 = ["set-cookie", "set-cookie2"];
+var MAX_PROJECTS_PER_PROFILE = 64;
 function formatResourceTypes() {
-  return RESOURCE_TYPES2.join(", ");
+  return [...RESOURCE_TYPES].join(", ");
 }
 function formatHttpMethods() {
-  return HTTP_METHODS2.join(", ");
+  return [...HTTP_METHODS].join(", ");
 }
 function formatForbiddenHeaders() {
   return [
-    ...FORBIDDEN_REQUEST_HEADERS2.map((h) => `request: ${h}`),
-    ...FORBIDDEN_RESPONSE_HEADERS2.map((h) => `response: ${h}`)
+    ...FORBIDDEN_REQUEST_HEADERS.map((header) => `request: ${header}`),
+    ...FORBIDDEN_REQUEST_PREFIXES.map((prefix) => `request prefix: ${prefix}`),
+    ...FORBIDDEN_RESPONSE_HEADERS.map((header) => `response: ${header}`)
   ].join(", ");
 }
+function formatDiagnostics() {
+  return Object.entries(MESSAGES).map(([code, message]) => `- ${code} - ${message}`).join("\n");
+}
 function formatProjectContext(project) {
   try {
     return JSON.stringify(project, null, 2);
@@ -21411,9 +21348,10 @@ ${formatResourceTypes()}
 ${formatHttpMethods()}
 
 ### Bounds
-- Max 64 projects per profile
-- Max 100 groups per project
-- Max 500 rules per project
+- Max ${MAX_PROJECTS_PER_PROFILE} projects per profile
+- Max ${LIMITS.maxGroups} groups per project
+- Max ${LIMITS.maxRulesPerGroup} rules per group
+- Max ${LIMITS.maxRulesPerProject} rules per project
 
 ## Rule Types
 
@@ -21435,22 +21373,7 @@ Replace-mode body may use URL captures. Regex-mode replacement strings use captu
 Replace-mode body may use URL captures. Regex-mode replacement strings use captures from the body pattern, not the source pattern.
 
 ## Compiler Diagnostic Codes (stable)
-- schema.required - Required project data is missing
-- schema.unknown-property - The project contains an unknown property
-- schema.invalid-type - A value has an invalid type
-- schema.invalid-format - A value has an invalid format
-- schema.invalid-value - A value is invalid
-- schema.out-of-range - A value is outside its allowed bounds
-- schema.invalid-structure - A value has invalid structure
-- schema.duplicate-id - Duplicate group or rule ID
-- schema.duplicate-name - Duplicate group or rule name; every group and rule name must be unique in the project
-- schema.rule-limit - The project contains too many rules
-- compiler.invariant - The compiler could not normalize the project
-- compiler.forbidden-header - The header is forbidden for this direction
-- compiler.header-value-required - A header value is required for set and append
-- compiler.header-value-unexpected - A header value is not allowed for remove
-- compiler.invalid-header-direction - Invalid header direction
-- compiler.invalid-header-operation - Invalid header operation
+${formatDiagnostics()}
 
 ## Current Project
 ${projectJson}
@@ -29697,7 +29620,7 @@ function createServer3(handler, options = {}) {
 }
 
 // packages/cli/src/server/routes.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 import { readFile as readFile5 } from "node:fs/promises";
 import { dirname as dirname9, isAbsolute as isAbsolute5, resolve as resolve5 } from "node:path";
 
@@ -30153,17 +30076,44 @@ function isAllowedEditorHost(host, boundPort) {
   return host === `127.0.0.1:${expected}` || host === `localhost:${expected}`;
 }
 function isAllowedEditorOrigin(origin, boundPort) {
-  if (origin === void 0) return true;
-  if (!Number.isInteger(boundPort) || boundPort <= 0) return false;
+  if (origin === void 0 || !Number.isInteger(boundPort) || boundPort <= 0) {
+    return false;
+  }
   const expected = String(boundPort);
   return origin === `http://127.0.0.1:${expected}` || origin === `http://localhost:${expected}`;
 }
 function generateCsrfToken() {
   return randomBytes4(16).toString("hex");
 }
+function tokensEqual(provided, expected) {
+  const providedBytes = Buffer.from(provided);
+  const expectedBytes = Buffer.from(expected);
+  if (providedBytes.length !== expectedBytes.length) return false;
+  return timingSafeEqual2(providedBytes, expectedBytes);
+}
+function scopedPathname(pathname, sessionToken) {
+  const marker = "/e/";
+  if (!pathname.startsWith(marker)) return void 0;
+  const after = pathname.slice(marker.length);
+  const slash = after.indexOf("/");
+  const candidate = slash === -1 ? after : after.slice(0, slash);
+  if (candidate.length === 0 || !tokensEqual(candidate, sessionToken)) {
+    return void 0;
+  }
+  return slash === -1 ? "/" : after.slice(slash);
+}
+function editorSessionPath(token, suffix) {
+  const path2 = suffix.startsWith("/") ? suffix : `/${suffix}`;
+  return `/e/${token}${path2}`;
+}
 function validateCsrf(req, expectedToken) {
-  const token = req.headers["x-csrf-token"];
-  return token === expectedToken;
+  const token = headerValue3(req.headers["x-csrf-token"]);
+  if (token === void 0) return false;
+  return tokensEqual(token, expectedToken);
+}
+function emptyNotFound(res) {
+  res.writeHead(404);
+  res.end();
 }
 var MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
 var RequestBodyError = class extends Error {
@@ -30268,8 +30218,13 @@ function createRoutes(context) {
       );
       return;
     }
-    const { pathname } = parseUrl(req);
+    const { pathname: requestPath } = parseUrl(req);
     const method = req.method || "GET";
+    const pathname = scopedPathname(requestPath, context.csrfToken);
+    if (pathname === void 0) {
+      emptyNotFound(res);
+      return;
+    }
     if (method === "POST") {
       const origin = headerValue3(req.headers.origin);
       if (!isAllowedEditorOrigin(origin, context.boundPort)) {
@@ -30290,7 +30245,8 @@ function createRoutes(context) {
     }
     if (pathname === "/editor.html" && method === "GET") {
       res.writeHead(200, {
-        "Content-Type": "text/html; charset=utf-8"
+        "Content-Type": "text/html; charset=utf-8",
+        "Referrer-Policy": "no-referrer"
       });
       res.end(context.editorHtml);
       return;
@@ -31035,18 +30991,13 @@ async function editCommand(args, options = {}) {
   }
   context.boundPort = server.port;
   const serverUrl = `http://127.0.0.1:${server.port}`;
-  const editorUrl = `${serverUrl}/editor.html`;
+  const editorUrl = `${serverUrl}${editorSessionPath(csrfToken, "/editor.html")}`;
   const {
     bundle: editorBundlePath,
     css: editorCssPath,
     fonts: editorFontsPath
   } = editorAssetPaths();
-  context.editorHtml = generateEditorHtml(
-    serverUrl,
-    csrfToken,
-    filePath,
-    !!aiClient
-  );
+  context.editorHtml = generateEditorHtml(filePath, !!aiClient);
   context.editorBundlePath = editorBundlePath;
   context.editorCssPath = editorCssPath;
   context.editorFontsPath = editorFontsPath;
@@ -31111,7 +31062,7 @@ async function ensureCivilizationProjectName(storage, filePath, data) {
   await storage.update(filePath, named);
   return named;
 }
-function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
+function generateEditorHtml(filePath, aiConfigured) {
   const aiAssistHandler = aiConfigured ? `
     aiAssist: async function(request) {
       const res = await fetch(apiBase + '/api/ai/assist', {
@@ -31140,7 +31091,7 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Rogatio Editor</title>
-  <link rel="stylesheet" href="/vendor/editor.css" />
+  <link rel="stylesheet" href="vendor/editor.css" />
   <style>
     html, body { margin: 0; min-height: 100%; }
     body {
@@ -31168,14 +31119,16 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
    <div id="editor-doctor" hidden></div>
    <div id="editor-root"></div>
    <script type="importmap">
-     { "imports": { "@rogatio/editor": "/vendor/editor.js" } }
+     { "imports": { "@rogatio/editor": "./vendor/editor.js" } }
    </script>
    <script type="module">
       import { createEditor } from '@rogatio/editor';
     
     const root = document.getElementById('editor-root');
-    const apiBase = ${JSON.stringify(apiBase)};
-    const csrfToken = ${JSON.stringify(csrfToken)};
+    const apiBase = location.pathname.endsWith('/editor.html')
+      ? location.pathname.slice(0, -'/editor.html'.length)
+      : location.pathname;
+    const csrfToken = apiBase.slice(apiBase.lastIndexOf('/') + 1);
     const filePath = ${embedJson(filePath)};
     const doctorTitles = ${embedJson(editorPageTitles())};
     const serverStoppedJson = ${embedJson(serializeEditorDiagnostics(editorServerStoppedReport(filePath)))};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.20.0",
+  "version": "6.20.2",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",