@rogatio/cli 6.20.1 → 6.20.3

package/README.md

@@ -45,7 +45,7 @@ rogatio <command> [options]
 | `rogatio runtime <install\|uninstall\|verify>` | Register the native-messaging host with `install` and trust the device-local CA in one **transactional** call; it needs elevated privileges (Linux `sudo`, macOS keychain authorization, Windows Administrator) and rolls back with exit `1` and `trust unsupported: <reasons>` when a capability or elevation is missing. Release users never pass `--extension-id`. That flag is only for development (a local unpacked build without the release key) and for forks. `uninstall` removes the host manifest, the device-local CA files, and the CA trust installation (idempotent). `verify` reports whether manifest, `runtime-host` wrapper, allowed origins, and CA trust are all valid, and fails when `allowed_origins` omits the release ID. Release users never pass `--extension-id` on verify either. |
 | `rogatio runtime host [path]` | Run the consolidated native-messaging host for the project (pair/authorize/body transforms and mock responses over stdio). Normally launched by the browser; run manually only for debugging. `--root <dir>` overrides the confined mock file root. When omitted, a saved device-local root for that project file is used, otherwise the project directory. A stdin project that contains a file mock requires `--root`. |
 
-`rogatio edit` includes **Run checks**. It calls `POST /api/doctor` (CSRF-protected) and shows editor checks plus the same report as `rogatio doctor` for the open file. A provider configured after the page opened is picked up on the next `rogatio edit`.
+`rogatio edit` includes **Run checks**. It calls `POST /e/<session>/api/doctor` (session path, loopback Origin, and `X-CSRF-Token`) and shows editor checks plus the same report as `rogatio doctor` for the open file. A provider configured after the page opened is picked up on the next `rogatio edit`.
 
 Global options: `--help, -h` and `--version, -v`. Run `rogatio <command> --help`
 for command-specific usage.

package/dist/node/index.js

@@ -7,8 +7,6 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // packages/runtime/dist/node/index.js
 import { isIP } from "node:net";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
 
 // packages/schema/dist/node/index.js
 import { Ajv2020 } from "ajv/dist/2020.js";
@@ -2260,6 +2258,8 @@ function sameOrigin(a, b) {
 }
 
 // packages/runtime/dist/node/index.js
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
 import { isIP as isIP2 } from "node:net";
 import { constants, existsSync } from "node:fs";
 import { open, readlink, realpath } from "node:fs/promises";
@@ -2283,21 +2283,23 @@ import { basename, dirname as dirname2, isAbsolute as isAbsolute2, join as join2
 import { X509Certificate } from "node:crypto";
 import { generateKeyPairSync, webcrypto } from "node:crypto";
 import { spawn, spawnSync } from "node:child_process";
-import { accessSync, constants as constants2, unlinkSync, writeFileSync } from "node:fs";
-import { mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join3 } from "node:path";
+import { accessSync, constants as constants3 } from "node:fs";
+import { mkdtemp as mkdtemp2, rm as rm3 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname3, join as join4 } from "node:path";
 import { join as posixJoin } from "node:path/posix";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat2, mkdtemp, open as open3, rm as rm2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join as join3 } from "node:path";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync as accessSync2, constants as constants3, mkdirSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { accessSync as accessSync2, constants as constants4, mkdirSync, unlinkSync } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 import { join as posixJoin2 } from "node:path/posix";
 import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
-import { accessSync as accessSync3, constants as constants4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join4 } from "node:path";
+import { accessSync as accessSync3, constants as constants5 } from "node:fs";
 import { join as posixJoin3 } from "node:path/posix";
-import { constants as constants5 } from "node:fs";
+import { constants as constants6 } from "node:fs";
 import { open as open4, realpath as realpath2 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
@@ -21299,67 +21301,23 @@ function createAIClient(config) {
     }
   };
 }
-var RESOURCE_TYPES2 = [
-  "main_frame",
-  "sub_frame",
-  "stylesheet",
-  "script",
-  "image",
-  "font",
-  "object",
-  "xmlhttprequest",
-  "fetch",
-  "media",
-  "websocket",
-  "manifest",
-  "other"
-];
-var HTTP_METHODS2 = [
-  "GET",
-  "POST",
-  "PUT",
-  "PATCH",
-  "DELETE",
-  "HEAD",
-  "OPTIONS",
-  "CONNECT",
-  "TRACE"
-];
-var FORBIDDEN_REQUEST_HEADERS2 = [
-  "accept-charset",
-  "accept-encoding",
-  "access-control-request-headers",
-  "access-control-request-method",
-  "connection",
-  "content-length",
-  "cookie",
-  "cookie2",
-  "date",
-  "dnt",
-  "expect",
-  "host",
-  "keep-alive",
-  "origin",
-  "referer",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade",
-  "via"
-];
-var FORBIDDEN_RESPONSE_HEADERS2 = ["set-cookie", "set-cookie2"];
+var MAX_PROJECTS_PER_PROFILE = 64;
 function formatResourceTypes() {
-  return RESOURCE_TYPES2.join(", ");
+  return [...RESOURCE_TYPES].join(", ");
 }
 function formatHttpMethods() {
-  return HTTP_METHODS2.join(", ");
+  return [...HTTP_METHODS].join(", ");
 }
 function formatForbiddenHeaders() {
   return [
-    ...FORBIDDEN_REQUEST_HEADERS2.map((h) => `request: ${h}`),
-    ...FORBIDDEN_RESPONSE_HEADERS2.map((h) => `response: ${h}`)
+    ...FORBIDDEN_REQUEST_HEADERS.map((header) => `request: ${header}`),
+    ...FORBIDDEN_REQUEST_PREFIXES.map((prefix) => `request prefix: ${prefix}`),
+    ...FORBIDDEN_RESPONSE_HEADERS.map((header) => `response: ${header}`)
   ].join(", ");
 }
+function formatDiagnostics() {
+  return Object.entries(MESSAGES).map(([code, message]) => `- ${code} - ${message}`).join("\n");
+}
 function formatProjectContext(project) {
   try {
     return JSON.stringify(project, null, 2);
@@ -21392,9 +21350,10 @@ ${formatResourceTypes()}
 ${formatHttpMethods()}
 
 ### Bounds
-- Max 64 projects per profile
-- Max 100 groups per project
-- Max 500 rules per project
+- Max ${MAX_PROJECTS_PER_PROFILE} projects per profile
+- Max ${LIMITS.maxGroups} groups per project
+- Max ${LIMITS.maxRulesPerGroup} rules per group
+- Max ${LIMITS.maxRulesPerProject} rules per project
 
 ## Rule Types
 
@@ -21416,22 +21375,7 @@ Replace-mode body may use URL captures. Regex-mode replacement strings use captu
 Replace-mode body may use URL captures. Regex-mode replacement strings use captures from the body pattern, not the source pattern.
 
 ## Compiler Diagnostic Codes (stable)
-- schema.required - Required project data is missing
-- schema.unknown-property - The project contains an unknown property
-- schema.invalid-type - A value has an invalid type
-- schema.invalid-format - A value has an invalid format
-- schema.invalid-value - A value is invalid
-- schema.out-of-range - A value is outside its allowed bounds
-- schema.invalid-structure - A value has invalid structure
-- schema.duplicate-id - Duplicate group or rule ID
-- schema.duplicate-name - Duplicate group or rule name; every group and rule name must be unique in the project
-- schema.rule-limit - The project contains too many rules
-- compiler.invariant - The compiler could not normalize the project
-- compiler.forbidden-header - The header is forbidden for this direction
-- compiler.header-value-required - A header value is required for set and append
-- compiler.header-value-unexpected - A header value is not allowed for remove
-- compiler.invalid-header-direction - Invalid header direction
-- compiler.invalid-header-operation - Invalid header operation
+${formatDiagnostics()}
 
 ## Current Project
 ${projectJson}
@@ -23211,6 +23155,84 @@ function createRequestBodyTrustController(options = {}) {
   }
   return { install, uninstall, status, verify: verify2 };
 }
+var INSTALL_CERT_NAME = "ca.crt";
+function optionalFlag(flag) {
+  return typeof flag === "number" ? flag : 0;
+}
+function exclusiveWriteFlags() {
+  return constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_TRUNC | optionalFlag(constants2.O_NOFOLLOW);
+}
+function readFlags() {
+  return constants2.O_RDONLY | optionalFlag(constants2.O_NOFOLLOW) | optionalFlag(constants2.O_NONBLOCK);
+}
+function refuseCertificateFile(message) {
+  throw new TrustError("trust.internal", message, [
+    "certificate-file-rejected"
+  ]);
+}
+async function writeExclusiveCertificate(certPath, pem) {
+  const handle = await open3(certPath, exclusiveWriteFlags(), 384);
+  try {
+    await handle.writeFile(Buffer.from(pem, "utf8"));
+    await handle.chmod(384);
+  } finally {
+    await handle.close();
+  }
+}
+async function assertCertificateReady(certPath, pem) {
+  let info;
+  try {
+    info = await lstat2(certPath);
+  } catch {
+    refuseCertificateFile("certificate file is not a regular file");
+  }
+  if (!info.isFile() || info.isSymbolicLink() || info.isFIFO()) {
+    refuseCertificateFile("certificate file is not a regular file");
+  }
+  let handle;
+  try {
+    handle = await open3(certPath, readFlags());
+    const opened = await handle.stat();
+    if (!opened.isFile() || opened.isFIFO() || opened.isSymbolicLink()) {
+      refuseCertificateFile("certificate file is not a regular file");
+    }
+    const bytes = await handle.readFile();
+    if (!bytes.equals(Buffer.from(pem, "utf8"))) {
+      refuseCertificateFile(
+        "certificate file does not match the certificate to install"
+      );
+    }
+    if (!isInstallableCaCertificate(bytes.toString("utf8"))) {
+      throw new TrustError("trust.internal", "invalid-ca-certificate", [
+        "invalid-ca-certificate"
+      ]);
+    }
+  } catch (error) {
+    if (error instanceof TrustError) throw error;
+    refuseCertificateFile("certificate file is not a regular file");
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+async function withInstallCertificateFile(pem, use) {
+  if (!isInstallableCaCertificate(pem)) {
+    throw new TrustError("trust.internal", "invalid-ca-certificate", [
+      "invalid-ca-certificate"
+    ]);
+  }
+  const directory = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
+  try {
+    const certPath = join3(directory, INSTALL_CERT_NAME);
+    await writeExclusiveCertificate(certPath, pem);
+    await assertCertificateReady(certPath, pem);
+    await use(certPath);
+  } finally {
+    try {
+      await rm2(directory, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
 var PREVIOUS_CA_PEM_MAX_BYTES = 16 * 1024;
 function spawnSecurity(args) {
   return new Promise((resolve12) => {
@@ -23249,12 +23271,12 @@ var darwinAdapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync(manifestDir, constants2.W_OK);
+      accessSync(manifestDir, constants3.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
     try {
-      accessSync(caDir, constants2.W_OK);
+      accessSync(caDir, constants3.W_OK);
     } catch {
       reasons.push("keychain-unwritable");
     }
@@ -23268,44 +23290,31 @@ var darwinAdapter = {
   },
   async caTrustInstaller(certPem) {
     const keychain = this.defaultCaInstallPath();
-    const tmpPath = join3(tmpdir(), `rogatio-ca-${Date.now()}.crt`);
     try {
-      writeFileSync(tmpPath, certPem, "utf8");
-    } catch {
-      throw new TrustError("trust.internal", "keychain-unwritable", [
-        "keychain-unwritable"
-      ]);
-    }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn("security", [
+      await withInstallCertificateFile(certPem, async (certPath) => {
+        const result = await spawnSecurity([
           "add-trusted-cert",
           "-d",
           "-r",
           "trustRoot",
           "-k",
           keychain,
-          tmpPath
+          certPath
         ]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
-    try {
-      unlinkSync(tmpPath);
-    } catch {
-    }
-    if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "keychain-unwritable";
-      if (stderr.includes("permission") || stderr.includes("auth")) {
-        reason = "keychain-unwritable";
-      }
-      throw new TrustError("trust.internal", reason, [reason]);
+        if (result.code !== 0) {
+          const stderr = result.stderr.toLowerCase();
+          let reason = "keychain-unwritable";
+          if (stderr.includes("permission") || stderr.includes("auth")) {
+            reason = "keychain-unwritable";
+          }
+          throw new TrustError("trust.internal", reason, [reason]);
+        }
+      });
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
+      throw new TrustError("trust.internal", "keychain-unwritable", [
+        "keychain-unwritable"
+      ]);
     }
   },
   async caTrustRemover() {
@@ -23347,17 +23356,11 @@ var darwinAdapter = {
       ]);
     }
     const keychain = this.defaultCaInstallPath();
-    const dir = await mkdtemp(join3(tmpdir(), "rogatio-ca-"));
-    const tmpPath = join3(dir, "previous.crt");
+    const dir = await mkdtemp2(join4(tmpdir2(), "rogatio-ca-"));
+    const tmpPath = join4(dir, "previous.crt");
     let failed = false;
     try {
-      const handle = await open3(tmpPath, "wx", 384);
-      try {
-        await handle.writeFile(certPem, "utf8");
-        await handle.chmod(384);
-      } finally {
-        await handle.close();
-      }
+      await writeExclusiveCertificate(tmpPath, certPem);
       const trust = await spawnSecurity(["remove-trusted-cert", "-d", tmpPath]);
       if (trust.code !== 0 && !securityMiss(trust.stderr)) failed = true;
       const item = await spawnSecurity([
@@ -23372,7 +23375,7 @@ var darwinAdapter = {
       failed = true;
     } finally {
       try {
-        await rm2(dir, { recursive: true, force: true });
+        await rm3(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -23410,7 +23413,7 @@ function exists(path2) {
 }
 function writable(path2) {
   try {
-    accessSync2(path2, constants3.W_OK);
+    accessSync2(path2, constants4.W_OK);
     return true;
   } catch {
     return false;
@@ -23447,7 +23450,7 @@ function p11kitAnchorsDir() {
 function needsElevation(dir) {
   if (writable(dir)) return false;
   try {
-    accessSync2(dir, constants3.W_OK);
+    accessSync2(dir, constants4.W_OK);
   } catch (err) {
     if (nodeCode(err) === "ENOENT" && writable(dirname4(dir))) return false;
   }
@@ -23464,13 +23467,13 @@ function manifestDirFor(browser) {
 }
 function canHostManifest(dir) {
   try {
-    accessSync2(dir, constants3.W_OK);
+    accessSync2(dir, constants4.W_OK);
     return true;
   } catch (err) {
     if (nodeCode(err) !== "ENOENT") return false;
   }
   try {
-    accessSync2(dirname4(dir), constants3.W_OK);
+    accessSync2(dirname4(dir), constants4.W_OK);
     return true;
   } catch {
     return false;
@@ -23600,7 +23603,7 @@ var linuxAdapter = {
   },
   async caTrustRemover() {
     try {
-      unlinkSync2(DEBIAN_CERT);
+      unlinkSync(DEBIAN_CERT);
     } catch {
     }
     if (!toolOnPath("update-ca-trust")) return;
@@ -23661,7 +23664,7 @@ var win32Adapter = {
       reasons.push("tooling-missing");
     }
     try {
-      accessSync3(manifestDir, constants4.W_OK);
+      accessSync3(manifestDir, constants5.W_OK);
     } catch {
       reasons.push("manifest-dir-unwritable");
     }
@@ -23674,37 +23677,42 @@ var win32Adapter = {
     };
   },
   async caTrustInstaller(certPem) {
-    const tmpPath = join4(tmpdir2(), `rogatio-ca-${Date.now()}.crt`);
     try {
-      writeFileSync2(tmpPath, certPem, "utf8");
-    } catch {
+      await withInstallCertificateFile(certPem, async (certPath) => {
+        const result = await new Promise(
+          (resolve12) => {
+            const child = spawn3("certutil", [
+              "-addstore",
+              "-f",
+              "Root",
+              certPath
+            ]);
+            let stderr = "";
+            child.stderr?.on("data", (data) => {
+              stderr += data.toString();
+            });
+            child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
+            child.on(
+              "error",
+              (err) => resolve12({ code: 1, stderr: err.message })
+            );
+          }
+        );
+        if (result.code !== 0) {
+          const stderr = result.stderr.toLowerCase();
+          let reason = "elevation-required";
+          if (stderr.includes("access denied") || stderr.includes("permission")) {
+            reason = "elevation-required";
+          }
+          throw new TrustError("trust.internal", reason, [reason]);
+        }
+      });
+    } catch (error) {
+      if (error instanceof TrustError) throw error;
       throw new TrustError("trust.internal", "elevation-required", [
         "elevation-required"
       ]);
     }
-    const result = await new Promise(
-      (resolve12) => {
-        const child = spawn3("certutil", ["-addstore", "-f", "Root", tmpPath]);
-        let stderr = "";
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => resolve12({ code: code ?? 1, stderr }));
-        child.on("error", (err) => resolve12({ code: 1, stderr: err.message }));
-      }
-    );
-    try {
-      unlinkSync3(tmpPath);
-    } catch {
-    }
-    if (result.code !== 0) {
-      const stderr = result.stderr.toLowerCase();
-      let reason = "elevation-required";
-      if (stderr.includes("access denied") || stderr.includes("permission")) {
-        reason = "elevation-required";
-      }
-      throw new TrustError("trust.internal", reason, [reason]);
-    }
   },
   async caTrustRemover() {
     const result = await new Promise(
@@ -24644,7 +24652,7 @@ async function resolveConfinedRoot(value) {
   }
   let directory;
   try {
-    directory = await open4(value, constants5.O_RDONLY | constants5.O_DIRECTORY);
+    directory = await open4(value, constants6.O_RDONLY | constants6.O_DIRECTORY);
     const info = await directory.stat();
     if (!info.isDirectory()) return failure("runtime.root-invalid");
     return { ok: true, value: await realpath2(value) };
@@ -29678,7 +29686,7 @@ function createServer3(handler, options = {}) {
 }
 
 // packages/cli/src/server/routes.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 import { readFile as readFile5 } from "node:fs/promises";
 import { dirname as dirname9, isAbsolute as isAbsolute5, resolve as resolve5 } from "node:path";
 
@@ -30134,17 +30142,44 @@ function isAllowedEditorHost(host, boundPort) {
   return host === `127.0.0.1:${expected}` || host === `localhost:${expected}`;
 }
 function isAllowedEditorOrigin(origin, boundPort) {
-  if (origin === void 0) return true;
-  if (!Number.isInteger(boundPort) || boundPort <= 0) return false;
+  if (origin === void 0 || !Number.isInteger(boundPort) || boundPort <= 0) {
+    return false;
+  }
   const expected = String(boundPort);
   return origin === `http://127.0.0.1:${expected}` || origin === `http://localhost:${expected}`;
 }
 function generateCsrfToken() {
   return randomBytes4(16).toString("hex");
 }
+function tokensEqual(provided, expected) {
+  const providedBytes = Buffer.from(provided);
+  const expectedBytes = Buffer.from(expected);
+  if (providedBytes.length !== expectedBytes.length) return false;
+  return timingSafeEqual2(providedBytes, expectedBytes);
+}
+function scopedPathname(pathname, sessionToken) {
+  const marker = "/e/";
+  if (!pathname.startsWith(marker)) return void 0;
+  const after = pathname.slice(marker.length);
+  const slash = after.indexOf("/");
+  const candidate = slash === -1 ? after : after.slice(0, slash);
+  if (candidate.length === 0 || !tokensEqual(candidate, sessionToken)) {
+    return void 0;
+  }
+  return slash === -1 ? "/" : after.slice(slash);
+}
+function editorSessionPath(token, suffix) {
+  const path2 = suffix.startsWith("/") ? suffix : `/${suffix}`;
+  return `/e/${token}${path2}`;
+}
 function validateCsrf(req, expectedToken) {
-  const token = req.headers["x-csrf-token"];
-  return token === expectedToken;
+  const token = headerValue3(req.headers["x-csrf-token"]);
+  if (token === void 0) return false;
+  return tokensEqual(token, expectedToken);
+}
+function emptyNotFound(res) {
+  res.writeHead(404);
+  res.end();
 }
 var MAX_REQUEST_BODY_BYTES = 8 * 1024 * 1024;
 var RequestBodyError = class extends Error {
@@ -30249,8 +30284,13 @@ function createRoutes(context) {
       );
       return;
     }
-    const { pathname } = parseUrl(req);
+    const { pathname: requestPath } = parseUrl(req);
     const method = req.method || "GET";
+    const pathname = scopedPathname(requestPath, context.csrfToken);
+    if (pathname === void 0) {
+      emptyNotFound(res);
+      return;
+    }
     if (method === "POST") {
       const origin = headerValue3(req.headers.origin);
       if (!isAllowedEditorOrigin(origin, context.boundPort)) {
@@ -30271,7 +30311,8 @@ function createRoutes(context) {
     }
     if (pathname === "/editor.html" && method === "GET") {
       res.writeHead(200, {
-        "Content-Type": "text/html; charset=utf-8"
+        "Content-Type": "text/html; charset=utf-8",
+        "Referrer-Policy": "no-referrer"
       });
       res.end(context.editorHtml);
       return;
@@ -31016,18 +31057,13 @@ async function editCommand(args, options = {}) {
   }
   context.boundPort = server.port;
   const serverUrl = `http://127.0.0.1:${server.port}`;
-  const editorUrl = `${serverUrl}/editor.html`;
+  const editorUrl = `${serverUrl}${editorSessionPath(csrfToken, "/editor.html")}`;
   const {
     bundle: editorBundlePath,
     css: editorCssPath,
     fonts: editorFontsPath
   } = editorAssetPaths();
-  context.editorHtml = generateEditorHtml(
-    serverUrl,
-    csrfToken,
-    filePath,
-    !!aiClient
-  );
+  context.editorHtml = generateEditorHtml(filePath, !!aiClient);
   context.editorBundlePath = editorBundlePath;
   context.editorCssPath = editorCssPath;
   context.editorFontsPath = editorFontsPath;
@@ -31092,7 +31128,7 @@ async function ensureCivilizationProjectName(storage, filePath, data) {
   await storage.update(filePath, named);
   return named;
 }
-function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
+function generateEditorHtml(filePath, aiConfigured) {
   const aiAssistHandler = aiConfigured ? `
     aiAssist: async function(request) {
       const res = await fetch(apiBase + '/api/ai/assist', {
@@ -31121,7 +31157,7 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Rogatio Editor</title>
-  <link rel="stylesheet" href="/vendor/editor.css" />
+  <link rel="stylesheet" href="vendor/editor.css" />
   <style>
     html, body { margin: 0; min-height: 100%; }
     body {
@@ -31149,14 +31185,16 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
    <div id="editor-doctor" hidden></div>
    <div id="editor-root"></div>
    <script type="importmap">
-     { "imports": { "@rogatio/editor": "/vendor/editor.js" } }
+     { "imports": { "@rogatio/editor": "./vendor/editor.js" } }
    </script>
    <script type="module">
       import { createEditor } from '@rogatio/editor';
     
     const root = document.getElementById('editor-root');
-    const apiBase = ${JSON.stringify(apiBase)};
-    const csrfToken = ${JSON.stringify(csrfToken)};
+    const apiBase = location.pathname.endsWith('/editor.html')
+      ? location.pathname.slice(0, -'/editor.html'.length)
+      : location.pathname;
+    const csrfToken = apiBase.slice(apiBase.lastIndexOf('/') + 1);
     const filePath = ${embedJson(filePath)};
     const doctorTitles = ${embedJson(editorPageTitles())};
     const serverStoppedJson = ${embedJson(serializeEditorDiagnostics(editorServerStoppedReport(filePath)))};
@@ -33467,7 +33505,7 @@ function errorMessage(error) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { chmod, mkdir as mkdir5, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod, mkdir as mkdir5, rm as rm4, writeFile as writeFile4 } from "node:fs/promises";
 import { dirname as dirname10, join as join9, resolve as resolve8 } from "node:path";
 function generateHostWrapper(rogatioCommand, logPath) {
   const parts = rogatioCommand.split(" ");
@@ -33578,11 +33616,11 @@ Note: reload the extension at chrome://extensions for the native host to be dete
     case "uninstall": {
       const uninstallResult = await controller.uninstall();
       try {
-        await rm3(hostPath, { force: true });
+        await rm4(hostPath, { force: true });
       } catch {
       }
       try {
-        await rm3(join9(installRoot, "runtime-host.log"), { force: true });
+        await rm4(join9(installRoot, "runtime-host.log"), { force: true });
       } catch {
       }
       return reportTrust(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.20.1",
+  "version": "6.20.3",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "ajv": "8.20.0",
-    "koffi": "3.3.2"
+    "koffi": "3.3.3"
   },
   "devDependencies": {
     "@rogatio/compiler": "workspace:*",
@@ -50,8 +50,8 @@
     "@rogatio/requestly-import": "workspace:*",
     "@rogatio/runtime": "workspace:*",
     "@rogatio/schema": "workspace:*",
-    "@types/node": "26.6.4",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2",
-    "vitest": "5.0.3"
+    "vitest": "5.0.4"
   }
 }