@singhak/nodeui-core 0.1.0 → 0.3.0

package/dist/index.mjs

@@ -50,7 +50,15 @@ var RingBuffer = class {
 };
 
 // src/safety.ts
-var SECRET_KEY_PATTERN = /token|key|secret|password|credential/i;
+var SECRET_KEY_PATTERN = /token|key|secret|passw(?:or)?d|credential|auth|cookie|dsn|private|signature|session|bearer|connection.?string|database.?url|conn.?str/i;
+var TEXT_PAIR_PATTERN = /\b([\w.-]*(?:token|secret|passw(?:or)?d|api[_-]?key|credential|authorization|cookie|dsn)[\w.-]*["']?)(\s*[=:]\s*)("[^"]*"|'[^']*'|[^\s,;&"'}]+)/gi;
+var URL_CREDENTIALS_PATTERN = /([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+(@)/gi;
+var BEARER_PATTERN = /\b(Bearer|Basic)\s+[A-Za-z0-9\-._~+/]+=*/gi;
+var JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g;
+function maskSecretText(text) {
+  if (text.length < 6) return text;
+  return text.replace(URL_CREDENTIALS_PATTERN, `$1${SECRET_MASKED}$2`).replace(BEARER_PATTERN, `$1 ${SECRET_MASKED}`).replace(JWT_PATTERN, SECRET_MASKED).replace(TEXT_PAIR_PATTERN, `$1$2${SECRET_MASKED}`);
+}
 function resolveActivation(env) {
   if (env.NODEUI_ENABLED === "true") {
     return { active: true, reason: "activated by NODEUI_ENABLED=true" };
@@ -73,7 +81,55 @@ function isLoopbackAddress(address) {
   if (!address) return false;
   return address.startsWith("127.") || address === "::1" || address.startsWith("::ffff:127.") || address === "localhost";
 }
+function normalizeIp(address) {
+  return address.startsWith("::ffff:") ? address.slice(7) : address;
+}
+function ipv4ToInt(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let out = 0;
+  for (const part of parts) {
+    const n = Number(part);
+    if (!Number.isInteger(n) || n < 0 || n > 255) return null;
+    out = out * 256 + n;
+  }
+  return out;
+}
+function matchesAddress(address, allowed) {
+  if (!address) return false;
+  const ip = normalizeIp(address);
+  for (const entry of allowed) {
+    if (!entry.includes("/")) {
+      if (normalizeIp(entry) === ip) return true;
+      continue;
+    }
+    const [base, bitsRaw] = entry.split("/");
+    const bits = Number(bitsRaw);
+    const a = ipv4ToInt(ip);
+    const b = ipv4ToInt(base ?? "");
+    if (a === null || b === null || !Number.isInteger(bits) || bits < 0 || bits > 32) continue;
+    const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
+    if ((a & mask) >>> 0 === (b & mask) >>> 0) return true;
+  }
+  return false;
+}
+function hostnameFromHostHeader(value) {
+  if (!value) return null;
+  const trimmed = value.trim().toLowerCase();
+  if (trimmed.startsWith("[")) {
+    const end = trimmed.indexOf("]");
+    return end === -1 ? null : trimmed.slice(1, end);
+  }
+  return trimmed.split(":")[0] || null;
+}
+function isLoopbackHostname(hostname) {
+  if (!hostname) return false;
+  return hostname === "localhost" || hostname.endsWith(".localhost") || isLoopbackAddress(hostname);
+}
 function maskSecrets(value, pattern = SECRET_KEY_PATTERN) {
+  if (typeof value === "string") {
+    return maskSecretText(value);
+  }
   if (value !== null && typeof value === "object") {
     if (Array.isArray(value)) {
       return value.map((v) => maskSecrets(v, pattern));
@@ -97,16 +153,132 @@ function maskSecrets(value, pattern = SECRET_KEY_PATTERN) {
   return value;
 }
 
+// src/guard.ts
+import { createHash, timingSafeEqual } from "crypto";
+var AUTH_COOKIE = "nodeui_token";
+var FORWARD_HEADERS = ["x-forwarded-for", "x-forwarded-host", "forwarded", "x-real-ip"];
+function digest(value) {
+  return createHash("sha256").update(value).digest();
+}
+function tokenEquals(a, b) {
+  return timingSafeEqual(digest(a), digest(b));
+}
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const [k, ...rest] = part.trim().split("=");
+    if (k === name) {
+      try {
+        return decodeURIComponent(rest.join("="));
+      } catch {
+        return void 0;
+      }
+    }
+  }
+  return void 0;
+}
+function firstHeader(value) {
+  return Array.isArray(value) ? value[0] : value;
+}
+function deny(status, code, message) {
+  return { ok: false, status, code, message };
+}
+function createGuard(options) {
+  const strict = isLoopbackAddress(options.host);
+  const allowedHosts = options.allowedHosts.map((h) => h.toLowerCase());
+  const allowedOrigins = options.allowedOrigins.map((o) => o.toLowerCase().replace(/\/+$/, ""));
+  return (req) => {
+    const remote = req.socket.remoteAddress;
+    const remoteLoopback = isLoopbackAddress(remote);
+    const remoteAllowed = remoteLoopback || matchesAddress(remote, options.allowedRemoteAddresses);
+    if (strict && !remoteAllowed) {
+      return deny(
+        403,
+        "forbidden",
+        "nodeui is loopback-only; requests from other hosts are rejected"
+      );
+    }
+    if (!strict && options.allowedRemoteAddresses.length > 0 && !remoteAllowed) {
+      return deny(403, "forbidden", "remote address is not in the nodeui allow-list");
+    }
+    if (strict && !options.trustProxy && !matchesAddress(remote, options.allowedRemoteAddresses)) {
+      if (FORWARD_HEADERS.some((h) => req.headers[h] !== void 0)) {
+        return deny(
+          403,
+          "forbidden",
+          "proxied requests are rejected (set trustProxy to allow forwarded traffic)"
+        );
+      }
+    }
+    const hostHeader = firstHeader(req.headers.host);
+    const hostname = hostnameFromHostHeader(hostHeader);
+    if (hostname !== null) {
+      const hostOk = isLoopbackHostname(hostname) || allowedHosts.includes(hostname) || !strict && allowedHosts.length === 0;
+      if (!hostOk) {
+        return deny(
+          403,
+          "forbidden",
+          `Host "${hostname}" is not allowed (add it to allowedHosts to use nodeui via this name)`
+        );
+      }
+    }
+    const origin = firstHeader(req.headers.origin);
+    if (origin !== void 0) {
+      let originOk = false;
+      const normalized = origin.toLowerCase().replace(/\/+$/, "");
+      if (allowedOrigins.includes(normalized)) {
+        originOk = true;
+      } else {
+        try {
+          originOk = hostHeader !== void 0 && new URL(origin).host === hostHeader.toLowerCase();
+        } catch {
+          originOk = false;
+        }
+      }
+      if (!originOk) {
+        return deny(403, "forbidden", "cross-origin requests to nodeui are rejected");
+      }
+    }
+    if (options.authToken) {
+      const authHeader = firstHeader(req.headers.authorization);
+      const bearer = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : void 0;
+      const queryToken = new URL(req.url ?? "/", "http://localhost").searchParams.get("token");
+      const cookieToken = readCookie(firstHeader(req.headers.cookie), AUTH_COOKIE);
+      const candidates = [
+        bearer,
+        firstHeader(req.headers["x-nodeui-token"]),
+        cookieToken,
+        queryToken ?? void 0
+      ];
+      const matched = candidates.find((c) => c !== void 0 && tokenEquals(c, options.authToken));
+      if (matched === void 0) {
+        return deny(401, "unauthorized", "a valid nodeui token is required");
+      }
+      if (queryToken !== null && matched === queryToken) {
+        return { ok: true, setToken: queryToken };
+      }
+    }
+    return { ok: true };
+  };
+}
+
 // src/confirmations.ts
 import { randomBytes } from "crypto";
 var ConfirmationStore = class {
-  constructor(ttlMs) {
+  constructor(ttlMs, maxOutstanding = 100) {
     this.ttlMs = ttlMs;
+    this.maxOutstanding = maxOutstanding;
   }
   ttlMs;
+  maxOutstanding;
   nonces = /* @__PURE__ */ new Map();
   issue() {
     this.prune();
+    while (this.nonces.size >= this.maxOutstanding) {
+      const oldest = this.nonces.keys().next().value;
+      if (oldest === void 0) break;
+      this.nonces.delete(oldest);
+    }
     const nonce = randomBytes(16).toString("hex");
     const expiresAtMs = Date.now() + this.ttlMs;
     this.nonces.set(nonce, expiresAtMs);
@@ -419,15 +591,65 @@ var EventLoopLagProvider = class {
 // src/providers/health.ts
 var LAG_OK_MS = 50;
 var LAG_DEGRADED_MS = 200;
+var CHECK_TIMEOUT_MS = 3e3;
+var CHECK_CACHE_MS = 5e3;
+function withTimeout(promise, ms) {
+  return new Promise((resolve3, reject) => {
+    const timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve3(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    );
+  });
+}
 var HealthProvider = class {
+  constructor(checks = {}) {
+    this.checks = checks;
+  }
+  checks;
   id = "health";
-  get(ctx) {
+  cache = null;
+  async runChecks() {
+    const names = Object.keys(this.checks);
+    if (names.length === 0) return [];
+    if (this.cache && Date.now() - this.cache.at < CHECK_CACHE_MS) return this.cache.results;
+    const results = await Promise.all(
+      names.map(async (name) => {
+        const started = Date.now();
+        try {
+          const outcome = await withTimeout(
+            Promise.resolve().then(() => this.checks[name]()),
+            CHECK_TIMEOUT_MS
+          );
+          if (outcome === false) throw new Error("check returned false");
+          return { name, status: "up", durationMs: Date.now() - started };
+        } catch (err) {
+          return {
+            name,
+            status: "down",
+            durationMs: Date.now() - started,
+            error: err instanceof Error ? err.message : String(err)
+          };
+        }
+      })
+    );
+    this.cache = { at: Date.now(), results };
+    return results;
+  }
+  async get(ctx) {
     const loop = ctx.store["event-loop"];
     const memory = ctx.store.memory;
     const lagMs = typeof loop?.currentMs === "number" ? loop.currentMs : null;
     const totalMem = typeof memory?.totalMem === "number" ? memory.totalMem : 0;
     const rss = typeof memory?.rss === "number" ? memory.rss : 0;
     const memoryUsedPercent = totalMem > 0 ? rss / totalMem * 100 : null;
+    const checks = await this.runChecks();
     let status;
     let statusReason;
     if (lagMs === null) {
@@ -443,6 +665,11 @@ var HealthProvider = class {
       status = "critical";
       statusReason = `event-loop lag ${lagMs.toFixed(1)}ms above ${LAG_DEGRADED_MS}ms`;
     }
+    const down = checks.filter((c) => c.status === "down");
+    if (down.length > 0) {
+      status = "critical";
+      statusReason = `dependency down: ${down.map((c) => c.name).join(", ")}`;
+    }
     return {
       ok: true,
       data: {
@@ -453,19 +680,202 @@ var HealthProvider = class {
         nodeVersion: process.version,
         platform: process.platform,
         eventLoopLagMs: lagMs,
-        memoryUsedPercent
+        memoryUsedPercent,
+        checks
+      }
+    };
+  }
+};
+
+// src/providers/outgoing.ts
+import diagnosticsChannel from "diagnostics_channel";
+import http from "http";
+import https from "https";
+import { syncBuiltinESMExports } from "module";
+var RESPONSE_PAGE_SIZE = 100;
+var recorders = /* @__PURE__ */ new Set();
+var originals = /* @__PURE__ */ new Map();
+var undiciUnsubscribe = null;
+function describeTarget(defaultProtocol, args) {
+  try {
+    let method = "GET";
+    let host = "unknown";
+    let path2 = "/";
+    const [first, second] = args;
+    const opts = typeof first === "string" || first instanceof URL ? second : first;
+    if (typeof first === "string" || first instanceof URL) {
+      const parsed = new URL(first.toString());
+      host = parsed.host;
+      path2 = parsed.pathname;
+    }
+    if (opts && typeof opts === "object") {
+      if (typeof opts.method === "string") method = opts.method.toUpperCase();
+      if (typeof first !== "string" && !(first instanceof URL)) {
+        const name = opts.hostname ?? opts.host ?? "localhost";
+        host = opts.port ? `${name}:${String(opts.port)}` : name;
+        path2 = typeof opts.path === "string" ? opts.path.split("?")[0] ?? "/" : "/";
+        const protocol = typeof opts.protocol === "string" ? opts.protocol : defaultProtocol;
+        return { method, url: `${protocol}//${host}${path2}` };
       }
+    }
+    return { method, url: `${defaultProtocol}//${host}${path2}` };
+  } catch {
+    return null;
+  }
+}
+function emit(entry) {
+  for (const record of recorders) {
+    try {
+      record(entry);
+    } catch {
+    }
+  }
+}
+function wrapModule(mod, protocol) {
+  for (const name of ["request", "get"]) {
+    const key = `${protocol}${name}`;
+    const original = mod[name];
+    originals.set(key, original);
+    const wrapped = function(...args) {
+      const req = original.apply(this, args);
+      const target = recorders.size > 0 ? describeTarget(protocol, args) : null;
+      if (target && req && typeof req.once === "function") {
+        const started = process.hrtime.bigint();
+        const timestampMs = Date.now();
+        let done = false;
+        const finish = (status, error) => {
+          if (done) return;
+          done = true;
+          emit({
+            ...target,
+            status,
+            durationMs: Number(process.hrtime.bigint() - started) / 1e6,
+            timestampMs,
+            ...error ? { error } : {}
+          });
+        };
+        req.once("response", (res) => {
+          const status = res.statusCode ?? null;
+          res.once("end", () => finish(status));
+          res.once("close", () => finish(status));
+        });
+        req.once("error", (err) => finish(null, err.message));
+      }
+      return req;
     };
+    mod[name] = wrapped;
+  }
+  syncBuiltinESMExports();
+}
+function unwrapModule(mod, protocol) {
+  for (const name of ["request", "get"]) {
+    const original = originals.get(`${protocol}${name}`);
+    if (original) mod[name] = original;
+    originals.delete(`${protocol}${name}`);
+  }
+  syncBuiltinESMExports();
+}
+function subscribeUndici() {
+  const started = /* @__PURE__ */ new WeakMap();
+  const statuses = /* @__PURE__ */ new WeakMap();
+  const target = (req) => ({
+    method: (req.method ?? "GET").toUpperCase(),
+    url: `${String(req.origin ?? "")}${(req.path ?? "/").split("?")[0]}`
+  });
+  const onCreate = (message) => {
+    const request = message.request;
+    if (request) started.set(request, { at: process.hrtime.bigint(), ts: Date.now() });
+  };
+  const onHeaders = (message) => {
+    const { request, response } = message;
+    if (request && typeof response?.statusCode === "number") {
+      statuses.set(request, response.statusCode);
+    }
+  };
+  const finish = (request, error) => {
+    if (!request) return;
+    const begin = started.get(request);
+    if (!begin) return;
+    started.delete(request);
+    emit({
+      ...target(request),
+      status: statuses.get(request) ?? null,
+      durationMs: Number(process.hrtime.bigint() - begin.at) / 1e6,
+      timestampMs: begin.ts,
+      ...error ? { error } : {}
+    });
+  };
+  const onTrailers = (message) => finish(message.request);
+  const onError = (message) => {
+    const { request, error } = message;
+    finish(request, error?.message ?? "request failed");
+  };
+  diagnosticsChannel.subscribe("undici:request:create", onCreate);
+  diagnosticsChannel.subscribe("undici:request:headers", onHeaders);
+  diagnosticsChannel.subscribe("undici:request:trailers", onTrailers);
+  diagnosticsChannel.subscribe("undici:request:error", onError);
+  return () => {
+    diagnosticsChannel.unsubscribe("undici:request:create", onCreate);
+    diagnosticsChannel.unsubscribe("undici:request:headers", onHeaders);
+    diagnosticsChannel.unsubscribe("undici:request:trailers", onTrailers);
+    diagnosticsChannel.unsubscribe("undici:request:error", onError);
+  };
+}
+function interceptOutgoing(record) {
+  const first = recorders.size === 0;
+  recorders.add(record);
+  if (first) {
+    wrapModule(http, "http:");
+    wrapModule(https, "https:");
+    try {
+      undiciUnsubscribe = subscribeUndici();
+    } catch {
+      undiciUnsubscribe = null;
+    }
+  }
+  return () => {
+    if (!recorders.delete(record) || recorders.size > 0) return;
+    unwrapModule(http, "http:");
+    unwrapModule(https, "https:");
+    undiciUnsubscribe?.();
+    undiciUnsubscribe = null;
+  };
+}
+var OutgoingProvider = class {
+  id = "outgoing";
+  buffer;
+  nextId = 1;
+  failed = 0;
+  release = null;
+  constructor(size) {
+    this.buffer = new RingBuffer(size);
+  }
+  start() {
+    if (this.release) return;
+    this.release = interceptOutgoing((entry) => this.record(entry));
+  }
+  stop() {
+    this.release?.();
+    this.release = null;
+  }
+  record(entry) {
+    this.buffer.push({ id: this.nextId, ...entry });
+    this.nextId += 1;
+    if (entry.error || entry.status !== null && entry.status >= 500) this.failed += 1;
+  }
+  get() {
+    const entries = this.buffer.slice(Math.max(0, this.buffer.length - RESPONSE_PAGE_SIZE));
+    return { ok: true, data: { total: this.nextId - 1, failed: this.failed, entries } };
   }
 };
 
 // src/providers/heap-snapshot.ts
-import { mkdir, stat } from "fs/promises";
+import { chmod, mkdir, stat } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join2 } from "path";
 import { writeHeapSnapshot } from "v8";
 function defaultSnapshotDir() {
-  return process.env.NODEUI_HEAP_SNAPSHOT_DIR ?? tmpdir();
+  return process.env.NODEUI_HEAP_SNAPSHOT_DIR ?? join2(tmpdir(), "nodeui-heap");
 }
 var HeapSnapshotProvider = class {
   id = "heap-snapshot";
@@ -479,8 +889,9 @@ var HeapSnapshotProvider = class {
     const fileName = `nodeui-heap-${process.pid}-${stamp}.heapsnapshot`;
     const filePath = join2(dir, fileName);
     try {
-      await mkdir(dir, { recursive: true });
+      await mkdir(dir, { recursive: true, mode: 448 });
       writeHeapSnapshot(filePath);
+      await chmod(filePath, 384).catch(() => void 0);
       const fileStat = await stat(filePath);
       const data = {
         fileName,
@@ -503,7 +914,7 @@ var HeapSnapshotProvider = class {
 };
 
 // src/providers/requests.ts
-var RESPONSE_PAGE_SIZE = 100;
+var RESPONSE_PAGE_SIZE2 = 100;
 var RequestsProvider = class {
   id = "requests";
   buffer;
@@ -519,7 +930,7 @@ var RequestsProvider = class {
     return this.buffer.length;
   }
   get() {
-    const entries = this.buffer.slice(Math.max(0, this.buffer.length - RESPONSE_PAGE_SIZE));
+    const entries = this.buffer.slice(Math.max(0, this.buffer.length - RESPONSE_PAGE_SIZE2));
     return { ok: true, data: { total: this.buffer.length, entries } };
   }
 };
@@ -634,6 +1045,11 @@ var RoutesProvider = class {
   id = "routes";
   cache = /* @__PURE__ */ new WeakMap();
   get(ctx) {
+    const source = ctx.store["routes-source"];
+    if (source !== void 0) {
+      const routes2 = typeof source === "function" ? source() : source;
+      return { ok: true, data: { routes: routes2 } };
+    }
     const router = ctx.store["express-router"];
     if (!router) {
       return {
@@ -682,14 +1098,14 @@ function formatArg(arg) {
 var refs = 0;
 var pushes = /* @__PURE__ */ new Set();
 var wrappers = /* @__PURE__ */ new Map();
-var originals = {};
+var originals2 = {};
 function consoleRef() {
   return console;
 }
 function installWrappers() {
   for (const [method, level] of CONSOLE_METHODS) {
     const original = consoleRef()[method];
-    originals[method] = original;
+    originals2[method] = original;
     const wrapper = (...args) => {
       for (const push of pushes) {
         try {
@@ -707,7 +1123,7 @@ function uninstallWrappers() {
   for (const [method] of CONSOLE_METHODS) {
     const current = consoleRef()[method];
     if (current === wrappers.get(method)) {
-      const original = originals[method];
+      const original = originals2[method];
       if (original) {
         consoleRef()[method] = original;
       } else {
@@ -716,7 +1132,7 @@ function uninstallWrappers() {
     }
   }
   wrappers.clear();
-  originals = {};
+  originals2 = {};
 }
 function interceptConsole(push) {
   refs += 1;
@@ -763,9 +1179,10 @@ var LogsProvider = class {
 };
 
 // src/sse.ts
-function startSse(res) {
+function startSse(res, extraHeaders = {}) {
   let closed = false;
   res.writeHead(200, {
+    ...extraHeaders,
     "Content-Type": "text/event-stream",
     "Cache-Control": "no-cache",
     Connection: "keep-alive",
@@ -793,11 +1210,38 @@ function startSse(res) {
 
 // src/server.ts
 import { tmpdir as tmpdir2 } from "os";
-import { resolve as resolve2 } from "path";
+import { join as join3, resolve as resolve2 } from "path";
 var STATIC_ROOT = resolve2(__dirname, "..", "static");
 var SSE_HEARTBEAT_MS = 15e3;
-function serializeEnvelope(envelope) {
-  return JSON.stringify(maskSecrets(envelope));
+function serializeEnvelope(envelope, mask = true) {
+  return JSON.stringify(mask ? maskSecrets(envelope) : envelope);
+}
+var BUILT_IN_PANELS = /* @__PURE__ */ new Set([
+  "health",
+  "memory",
+  "cpu",
+  "event-loop",
+  "heap-snapshot",
+  "startup",
+  "requests",
+  "env",
+  "routes",
+  "logs",
+  "metrics",
+  "outgoing"
+]);
+var PLUGIN_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+var RESERVED_API_NAMES = /* @__PURE__ */ new Set(["config", "live", "confirmations"]);
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "no-referrer",
+  "Cross-Origin-Resource-Policy": "same-origin"
+};
+var CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'";
+function listFrom(value, raw) {
+  if (value) return value;
+  return (raw ?? "").split(",").map((v) => v.trim()).filter(Boolean);
 }
 function pathnameOf(req) {
   const raw = req.originalUrl ?? req.url ?? "/";
@@ -857,19 +1301,46 @@ function createNodeUI(options = {}) {
       env.NODEUI_CONFIRM_TTL_MS ? Number(env.NODEUI_CONFIRM_TTL_MS) : 6e4,
       "NODEUI_CONFIRM_TTL_MS"
     ),
-    heapSnapshotDir: options.heapSnapshotDir ?? env.NODEUI_HEAP_SNAPSHOT_DIR ?? tmpdir2()
+    heapSnapshotDir: options.heapSnapshotDir ?? env.NODEUI_HEAP_SNAPSHOT_DIR ?? join3(tmpdir2(), "nodeui-heap"),
+    allowedHosts: listFrom(options.allowedHosts, env.NODEUI_ALLOWED_HOSTS),
+    allowedOrigins: listFrom(options.allowedOrigins, env.NODEUI_ALLOWED_ORIGINS),
+    allowedRemoteAddresses: listFrom(options.allowedRemoteAddresses, env.NODEUI_ALLOWED_REMOTE),
+    trustProxy: options.trustProxy ?? env.NODEUI_TRUST_PROXY === "true",
+    authRequired: Boolean(options.authToken ?? env.NODEUI_TOKEN),
+    maxSseClients: positiveInt(
+      options.maxSseClients,
+      env.NODEUI_MAX_SSE_CLIENTS ? Number(env.NODEUI_MAX_SSE_CLIENTS) : 10,
+      "NODEUI_MAX_SSE_CLIENTS"
+    )
   };
-  if (!isLoopbackAddress(config.host)) {
+  const authToken = options.authToken ?? env.NODEUI_TOKEN;
+  const guard = createGuard({
+    host: config.host,
+    allowedHosts: config.allowedHosts,
+    allowedOrigins: config.allowedOrigins,
+    allowedRemoteAddresses: config.allowedRemoteAddresses,
+    trustProxy: config.trustProxy,
+    authToken: authToken || void 0
+  });
+  if (config.enabled && !isLoopbackAddress(config.host)) {
+    console.warn(
+      `[nodeui] NODEUI_HOST is set to non-loopback "${config.host}". The developer console will be reachable from other hosts; only do this deliberately` + (config.authRequired ? "." : " and set NODEUI_TOKEN (authToken) to require a token.")
+    );
+  }
+  if (config.enabled && env.NODE_ENV === "production") {
     console.warn(
-      `[nodeui] NODEUI_HOST is set to non-loopback "${config.host}". The developer console will be reachable from other hosts; only do this deliberately.`
+      "[nodeui] running with NODE_ENV=production. The console exposes environment, logs and heap data; keep it behind loopback and an auth token."
     );
   }
+  if (config.enabled && !config.maskSecrets) {
+    console.warn("[nodeui] secret masking is disabled; panels may show credentials.");
+  }
   const ctx = { config, env, store: {} };
   if (options.config !== void 0) {
     ctx.store["app-config"] = options.config;
   }
   const registry = new ProviderRegistry();
-  registry.register(new HealthProvider());
+  registry.register(new HealthProvider(options.healthChecks));
   registry.register(new MemoryProvider());
   registry.register(new CpuProvider());
   registry.register(new EventLoopLagProvider());
@@ -891,9 +1362,23 @@ function createNodeUI(options = {}) {
   registry.register(envProvider);
   const routesProvider = new RoutesProvider();
   registry.register(routesProvider);
+  registry.register(
+    new OutgoingProvider(positiveInt(options.outgoingLogSize, 200, "outgoingLogSize"))
+  );
+  const pluginMeta = [];
+  for (const plugin of options.plugins ?? []) {
+    if (!PLUGIN_ID_PATTERN.test(plugin.id) || BUILT_IN_PANELS.has(plugin.id) || RESERVED_API_NAMES.has(plugin.id) || registry.get(plugin.id)) {
+      throw new Error(
+        `nodeui plugin id "${plugin.id}" is invalid or already taken (use lowercase letters, digits and "-")`
+      );
+    }
+    registry.register(plugin);
+    pluginMeta.push({ id: plugin.id, title: plugin.title ?? plugin.id });
+  }
   const confirmations = new ConfirmationStore(config.confirmTtlMs);
   const activeProviders = /* @__PURE__ */ new Set();
   let inactivityTimer = null;
+  let sseClients = 0;
   function stopAll() {
     for (const id of activeProviders) {
       registry.get(id)?.stop?.(ctx);
@@ -917,8 +1402,9 @@ function createNodeUI(options = {}) {
     resetInactivityTimer();
   }
   function sendJson(res, status, envelope) {
-    const body = serializeEnvelope(envelope);
+    const body = serializeEnvelope(envelope, config.maskSecrets);
     res.writeHead(status, {
+      ...SECURITY_HEADERS,
       "Content-Type": "application/json",
       "Content-Length": Buffer.byteLength(body),
       "Cache-Control": "no-store"
@@ -936,8 +1422,24 @@ function createNodeUI(options = {}) {
     const provider = registry.get(id);
     if (!provider) return notFound(res);
     const requestCtx = query ? { ...ctx, query } : ctx;
-    const result = await provider.get(requestCtx);
-    sendJson(res, result.ok ? 200 : 500, result);
+    sendJson(res, ...await readPanel(provider, requestCtx));
+  }
+  async function readPanel(provider, requestCtx) {
+    try {
+      const result = await provider.get(requestCtx);
+      return [result.ok ? 200 : 500, result];
+    } catch (err) {
+      return [
+        500,
+        {
+          ok: false,
+          error: {
+            code: "provider-failed",
+            message: err instanceof Error ? err.message : "provider failed"
+          }
+        }
+      ];
+    }
   }
   function configData() {
     return {
@@ -950,7 +1452,9 @@ function createNodeUI(options = {}) {
       logSize: config.logSize,
       pollIntervalMs: config.pollIntervalMs,
       panels: registry.ids(),
-      masking: { enabled: config.maskSecrets, pattern: SECRET_KEY_PATTERN.source }
+      masking: { enabled: config.maskSecrets, pattern: SECRET_KEY_PATTERN.source },
+      authRequired: config.authRequired,
+      plugins: pluginMeta
     };
   }
   function issueConfirmation(res) {
@@ -982,22 +1486,37 @@ function createNodeUI(options = {}) {
     const requested = (search.get("panels") ?? "").split(",").filter(Boolean);
     const panels = (requested.length > 0 ? requested.filter((id) => registry.get(id) !== void 0) : registry.ids()).filter((value, index, self) => self.indexOf(value) === index);
     if (panels.length === 0) return notFound(res);
-    const stream = startSse(res);
+    if (sseClients >= config.maxSseClients) {
+      res.writeHead(429, { ...SECURITY_HEADERS, "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          ok: false,
+          error: { code: "too-many-streams", message: "too many open live streams" }
+        })
+      );
+      return;
+    }
+    sseClients += 1;
+    const stream = startSse(res, SECURITY_HEADERS);
     const push = async () => {
       for (const id of panels) {
         ensureActive(id);
         const provider = registry.get(id);
         if (!provider) continue;
-        const result = await provider.get(ctx);
-        stream.send({ panel: id, envelope: result });
+        const [, result] = await readPanel(provider, ctx);
+        stream.send({ panel: id, envelope: config.maskSecrets ? maskSecrets(result) : result });
       }
     };
-    void push();
-    const pushTimer = setInterval(() => void push(), config.pollIntervalMs);
+    void push().catch(() => void 0);
+    const pushTimer = setInterval(() => void push().catch(() => void 0), config.pollIntervalMs);
     const heartbeatTimer = setInterval(() => stream.heartbeat(), SSE_HEARTBEAT_MS);
     if (typeof pushTimer.unref === "function") pushTimer.unref();
     if (typeof heartbeatTimer.unref === "function") heartbeatTimer.unref();
+    let cleaned = false;
     const cleanup = () => {
+      if (cleaned) return;
+      cleaned = true;
+      sseClients -= 1;
       clearInterval(pushTimer);
       clearInterval(heartbeatTimer);
       stream.close();
@@ -1040,30 +1559,33 @@ function createNodeUI(options = {}) {
       return;
     }
     res.writeHead(200, {
+      ...SECURITY_HEADERS,
+      "Content-Security-Policy": CSP,
       "Content-Type": asset.contentType,
       "Content-Length": asset.length,
       "Cache-Control": "no-cache"
     });
     asset.content.pipe(res);
   }
-  function guardLoopback(req, res) {
-    if (isLoopbackAddress(config.host)) {
-      const remote = req.socket.remoteAddress;
-      if (!isLoopbackAddress(remote)) {
-        sendJson(res, 403, {
-          ok: false,
-          error: {
-            code: "forbidden",
-            message: "nodeui is loopback-only; requests from other hosts are rejected"
-          }
-        });
-        return false;
-      }
-    }
-    return true;
-  }
   async function handleNodeUIPath(req, res, urlPath) {
-    if (!guardLoopback(req, res)) return;
+    const verdict = guard(req);
+    if (!verdict.ok) {
+      sendJson(res, verdict.status, {
+        ok: false,
+        error: { code: verdict.code, message: verdict.message }
+      });
+      return;
+    }
+    if (verdict.setToken !== void 0) {
+      res.writeHead(302, {
+        ...SECURITY_HEADERS,
+        "Set-Cookie": `${AUTH_COOKIE}=${encodeURIComponent(verdict.setToken)}; Path=${path2}; HttpOnly; SameSite=Strict`,
+        Location: `${path2}/`,
+        "Cache-Control": "no-store"
+      });
+      res.end();
+      return;
+    }
     const apiBase = `${path2}/api`;
     if (urlPath === apiBase || urlPath.startsWith(`${apiBase}/`)) {
       await handleApi(req, res, urlPath.slice(apiBase.length));
@@ -1147,6 +1669,9 @@ function createNodeUI(options = {}) {
       }
       notFound(res);
     },
+    setRoutes(source) {
+      ctx.store["routes-source"] = source;
+    },
     mark(name) {
       startupTracker.mark(name);
     },
@@ -1163,6 +1688,7 @@ function createNodeUI(options = {}) {
   return server;
 }
 export {
+  AUTH_COOKIE,
   ConfirmationStore,
   CpuProvider,
   DEFAULT_LOG_SIZE,
@@ -1173,6 +1699,7 @@ export {
   LogsProvider,
   MemoryProvider,
   MetricsProvider,
+  OutgoingProvider,
   ProviderRegistry,
   RequestsProvider,
   RingBuffer,
@@ -1181,11 +1708,17 @@ export {
   SECRET_MASKED,
   Sampler,
   StartupTracker,
+  createGuard,
   createNodeUI,
   extractRoutes,
+  hostnameFromHostHeader,
   interceptConsole,
+  interceptOutgoing,
   isLoopbackAddress,
+  isLoopbackHostname,
+  maskSecretText,
   maskSecrets,
+  matchesAddress,
   resolveActivation,
   resolveStaticAsset,
   serializeEnvelope,