@staff0rd/assist 0.954.4 → 0.955.0

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@staff0rd/assist",
-  version: "0.954.4",
+  version: "0.955.0",
   type: "module",
   main: "dist/index.js",
   bin: {
@@ -33,7 +33,11 @@ var package_default = {
     "docs:install": "npm ci --prefix docs",
     "docs:build": "npm run --prefix docs build",
     "docs:preview": "tsx src/docs/previewDocs.ts",
-    "docs:capture": "tsx src/docs/captureDocs.ts"
+    "docs:capture": "tsx src/docs/captureDocs.ts",
+    "ios:install": "npm ci --prefix ios-app",
+    "ios:build": "npm run build && tsx src/commands/sessions/web/ios/buildIosWeb.ts && npm run --prefix ios-app sync",
+    "ios:open": "npm run --prefix ios-app open",
+    "ios:run": "npm run --prefix ios-app run"
   },
   overrides: {
     lodash: "^4.18.0",
@@ -85,6 +89,8 @@ var package_default = {
     zod: "^4.3.6"
   },
   devDependencies: {
+    "@capacitor/core": "^8.6.0",
+    "@capacitor/preferences": "^8.0.1",
     "@electric-sql/pglite": "^0.4.6",
     "@emotion/cache": "^11.14.0",
     "@emotion/react": "^11.14.0",
@@ -1896,6 +1902,29 @@ function withRepoCwd(line, repoCwd) {
   }
 }
 
+// src/commands/sessions/web/isAppOrigin.ts
+var APP_ORIGIN = "capacitor://localhost";
+function isAppOrigin(origin) {
+  return origin === APP_ORIGIN;
+}
+
+// src/commands/sessions/web/isAllowedSocketOrigin.ts
+function originHost(origin) {
+  try {
+    return new URL(origin).host;
+  } catch {
+    return void 0;
+  }
+}
+function isAllowedSocketOrigin(req) {
+  const origin = req.headers.origin;
+  const isNonBrowserClient = !origin;
+  if (isNonBrowserClient || isAppOrigin(origin)) return true;
+  const host = originHost(origin);
+  const forwardedHost = req.headers["x-forwarded-host"];
+  return !!host && (host === req.headers.host || typeof forwardedHost === "string" && host === forwardedHost);
+}
+
 // src/commands/sessions/web/restartMenu/releaseWebServerPort.ts
 var release;
 function onReleaseWebServerPort(fn) {
@@ -1911,7 +1940,9 @@ function releaseWebServerPort() {
 function attachSessionSocket(server, ctx) {
   const wss = new WebSocketServer({ noServer: true });
   server.on("upgrade", (req, socket, head) => {
-    if (req.url === "/ws") {
+    if (req.url === "/ws" && isAllowedSocketOrigin(req)) {
+      if (isAppOrigin(req.headers.origin))
+        console.log(`ws: accepted app origin ${req.headers.origin}`);
       wss.handleUpgrade(req, socket, head, (ws) => {
         handleSocket(ws, ctx);
       });
@@ -1922,6 +1953,10 @@ function attachSessionSocket(server, ctx) {
         console.log(
           `browser link: refused origin ${req.headers.origin ?? "(none)"}`
         );
+      if (req.url === "/ws")
+        console.log(
+          `ws: refused origin ${req.headers.origin} for host ${req.headers.host}`
+        );
       socket.destroy();
     }
   });
@@ -7683,6 +7718,25 @@ async function handleItemRoute(req, res, pathname) {
   return false;
 }
 
+// src/commands/sessions/web/allowAppOrigin.ts
+function allowAppOrigin(req, res, pathname) {
+  const origin = req.headers.origin;
+  if (!pathname.startsWith("/api/") || !isAppOrigin(origin)) return false;
+  res.setHeader("Access-Control-Allow-Origin", origin);
+  res.setHeader("Vary", "Origin");
+  if (req.method !== "OPTIONS") return false;
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST");
+  res.setHeader(
+    "Access-Control-Allow-Headers",
+    req.headers["access-control-request-headers"] ?? "Content-Type"
+  );
+  res.setHeader("Access-Control-Max-Age", "600");
+  console.log(`app cors: preflight ${pathname} from ${origin}`);
+  res.writeHead(204);
+  res.end();
+  return true;
+}
+
 // src/shared/db/dismissInboxMessage.ts
 import { and as and6, eq as eq16, isNull } from "drizzle-orm";
 async function dismissInboxMessage(orm, source, messageId) {
@@ -7874,7 +7928,7 @@ async function proxyToNode(req, res) {
 
 // src/commands/sessions/web/handleDynamicRoute.ts
 async function handleDynamicRoute(req, res, pathname) {
-  return await proxyToNode(req, res) || await handleInboxRoute(req, res, pathname) || handleItemRoute(req, res, pathname);
+  return allowAppOrigin(req, res, pathname) || await proxyToNode(req, res) || await handleInboxRoute(req, res, pathname) || handleItemRoute(req, res, pathname);
 }
 
 // src/commands/sessions/web/harnessCapabilities.ts

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@staff0rd/assist",
-	"version": "0.954.4",
+	"version": "0.955.0",
 	"type": "module",
 	"main": "dist/index.js",
 	"bin": {
@@ -27,7 +27,11 @@
 		"docs:install": "npm ci --prefix docs",
 		"docs:build": "npm run --prefix docs build",
 		"docs:preview": "tsx src/docs/previewDocs.ts",
-		"docs:capture": "tsx src/docs/captureDocs.ts"
+		"docs:capture": "tsx src/docs/captureDocs.ts",
+		"ios:install": "npm ci --prefix ios-app",
+		"ios:build": "npm run build && tsx src/commands/sessions/web/ios/buildIosWeb.ts && npm run --prefix ios-app sync",
+		"ios:open": "npm run --prefix ios-app open",
+		"ios:run": "npm run --prefix ios-app run"
 	},
 	"overrides": {
 		"lodash": "^4.18.0",
@@ -79,6 +83,8 @@
 		"zod": "^4.3.6"
 	},
 	"devDependencies": {
+		"@capacitor/core": "^8.6.0",
+		"@capacitor/preferences": "^8.0.1",
 		"@electric-sql/pglite": "^0.4.6",
 		"@emotion/cache": "^11.14.0",
 		"@emotion/react": "^11.14.0",