@sovovs/bycli 2.1.1 → 2.1.2

package/dist/src/daemon-config.d.ts

@@ -0,0 +1,2 @@
+export type DaemonHost = '127.0.0.1' | '0.0.0.0';
+export declare function resolveDaemonHost(env?: NodeJS.ProcessEnv): DaemonHost;

package/dist/src/daemon-config.js

@@ -0,0 +1,11 @@
+import { ConfigError } from './errors.js';
+export function resolveDaemonHost(env = process.env) {
+    const raw = env.BYCLI_DAEMON_HOST;
+    if (raw === undefined || raw === '') {
+        return '127.0.0.1';
+    }
+    if (raw === '127.0.0.1' || raw === '0.0.0.0') {
+        return raw;
+    }
+    throw new ConfigError(`config_invalid: BYCLI_DAEMON_HOST=${raw} is not allowed`, 'Use 127.0.0.1 for local use or 0.0.0.0 for an isolated sandbox.');
+}

package/dist/src/daemon-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/daemon.d.ts

@@ -17,6 +17,6 @@
  * Lifecycle:
  *   - Auto-spawned by bycli on first browser command
  *   - Persistent — stays alive until explicit shutdown, SIGTERM, or uninstall
- *   - Listens on localhost:19825
+ *   - Listens on 127.0.0.1:19825 by default; isolated sandboxes may opt into 0.0.0.0
  */
 export {};

package/dist/src/daemon.js

@@ -17,7 +17,7 @@
  * Lifecycle:
  *   - Auto-spawned by bycli on first browser command
  *   - Persistent — stays alive until explicit shutdown, SIGTERM, or uninstall
- *   - Listens on localhost:19825
+ *   - Listens on 127.0.0.1:19825 by default; isolated sandboxes may opt into 0.0.0.0
  */
 import { createServer } from 'node:http';
 import { WebSocketServer, WebSocket } from 'ws';
@@ -37,7 +37,9 @@ import { defaultSessionKeyRegistry } from './recorder/runner/session-keys.js';
 import { recordExtensionVersion } from './update-check.js';
 import { EXTENSION_CAPABILITY_MISSING_ERROR_CODE, EXTENSION_CAPABILITY_MISSING_HTTP_STATUS, extensionCapabilityHint, missingRequiredExtensionCapability, normalizeExtensionCapabilities, } from './browser/extension-capabilities.js';
 import { buildCommandDispatchFailure, buildExtensionDisconnectFailure, getResponseCorsHeaders, } from './daemon-utils.js';
+import { resolveDaemonHost } from './daemon-config.js';
 const PORT = parseInt(process.env.BYCLI_DAEMON_PORT ?? String(DEFAULT_DAEMON_PORT), 10);
+const HOST = resolveDaemonHost();
 // The verify runner (M6b) spawns child processes that connect back to THIS daemon for a
 // browser Page. Hand them our port (→ BYCLI_DAEMON_PORT in the child env) so the child's
 // Page reaches us, not a freshly-spawned daemon. Must run before the first /v1/verify
@@ -585,8 +587,8 @@ wss.on('connection', (ws) => {
     });
 });
 // ─── Start ───────────────────────────────────────────────────────────
-httpServer.listen(PORT, '127.0.0.1', () => {
-    log.info(`[daemon] Listening on http://127.0.0.1:${PORT}`);
+httpServer.listen(PORT, HOST, () => {
+    log.info(`[daemon] Listening on http://${HOST}:${PORT}`);
     // Temp-store reap policy (M7b · 09:27-29). Resolved once at startup; out-of-range env → throws,
     // but we keep the daemon alive by falling back to the (validated-elsewhere) defaults on error.
     let tempPolicy;

package/dist/src/recorder/http/handlers.js

@@ -142,7 +142,33 @@ export async function handleVerify(ctx, body) {
     const executionSeedArgs = body.executionSeedArgs && typeof body.executionSeedArgs === 'object' && !Array.isArray(body.executionSeedArgs)
         ? body.executionSeedArgs
         : undefined;
-    const input = { name, requestId, sessionId, executionSeedArgs, fixture, trace };
+    const adapterPathRaw = body.adapterPath;
+    const expectedSourceSha256Raw = body.expectedSourceSha256;
+    const invalidAdapterPath = adapterPathRaw !== undefined
+        && (typeof adapterPathRaw !== 'string' || adapterPathRaw.trim().length === 0);
+    const invalidExpectedSourceHash = expectedSourceSha256Raw !== undefined
+        && (typeof expectedSourceSha256Raw !== 'string' || !/^[0-9a-f]{64}$/.test(expectedSourceSha256Raw));
+    if (invalidAdapterPath || invalidExpectedSourceHash) {
+        ctx.registry.finalizeRequest(requestId, {
+            status: 'failed',
+            error: errorBody('validation_failed', 'adapterPath or expectedSourceSha256 is invalid'),
+        });
+        return { status: 202, body: accepted(requestId) };
+    }
+    const adapterPath = typeof adapterPathRaw === 'string' ? adapterPathRaw : undefined;
+    const expectedSourceSha256 = typeof expectedSourceSha256Raw === 'string'
+        ? expectedSourceSha256Raw
+        : undefined;
+    const input = {
+        name,
+        requestId,
+        sessionId,
+        executionSeedArgs,
+        fixture,
+        trace,
+        adapterPath,
+        expectedSourceSha256,
+    };
     const result = await verifyAdapter(input, sessionHmacKey, ctx.runner);
     if (!result.ok) {
         ctx.registry.finalizeRequest(requestId, { status: 'failed', error: errorBody(result.errorCode, result.reason) });

package/dist/src/recorder/runner/verify-runner-main.js

@@ -236,7 +236,7 @@ export async function runVerifyRunner(input, emit, dependencies = {}) {
             emit({
                 type: 'result', requestId: input.requestId, ok: false,
                 data: { stage: 'load', sourceSha256 },
-                error: { code: 'source_hash_mismatch', message: 'adapter source hash does not match expected source' },
+                error: { code: 'validation_failed', message: 'adapter source hash does not match expected source' },
             });
             return;
         }

package/dist/src/release-workflow.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sovovs/bycli",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "publishConfig": {
     "access": "public"
   },