@stim-cli/server 1.17.1 → 1.17.2

package/README.md

@@ -13,7 +13,8 @@ The design is in
 ## Commands
 
 ```bash
-stim-server [--port <n>]          # serve paired clients, port 7787 by default
+stim-server [--port <n>] [--loopback-only]
+                                  # serve paired clients, port 7787 by default
 stim-server pair [--port <n>] [--control]
                                   # print a single-use pairing payload
 stim-server devices [list]        # list pairings, approvals, requests and hosted sessions
@@ -28,6 +29,13 @@ stim-server service install|status|update|rollback|uninstall
                                   # run stim-server as a macOS LaunchAgent, see below
 ```
 
+`--loopback-only` makes the server listen on `127.0.0.1` only and refuse any request
+that names a remote peer (`X-Forwarded-For`, as `tailscale serve --https` adds), so
+phones and other Macs cannot connect; `/health` then reports `loopbackOnly: true`.
+Without it, the server also listens on this Mac's Tailscale addresses while Tailscale
+runs (see [Tailscale](#tailscale)). Stim Desktop starts its own server with the flag
+unless it serves phones.
+
 `--env KEY=VALUE` and `--path-prepend <dir>` (each repeatable) apply to the
 serving command: see [Run as a service](#run-as-a-service).
 
@@ -208,8 +216,9 @@ same tailnet or with the Mac shared to the phone's user.
 addresses, never on every interface. It re-reads the Tailscale state in the
 background, so a server that started before Tailscale was up, or while it did
 not answer, starts listening on the Tailscale addresses once it runs, and stops
-when it goes away. In Stim Desktop, choose **Set up connection** in Settings >
-Phones to create and verify the private route without a terminal command. A
+when it goes away. In Stim Desktop, the Pair a Phone wizard (Settings > Phones) creates and
+verifies the private route without a terminal command; with the Phone app flag
+off, **Set up connection** on Settings > Server does. A
 missing or unreadable route keeps Desktop pairing unavailable; HTTPS setup may
 require Tailscale browser approval. Existing routes stay unchanged.
 

package/dist/{stim-server-CGqz0EFG.mjs → stim-server-CJIlV28Y.mjs}

@@ -848,15 +848,27 @@ function answersAs(health, expected) {
 	return !health.stimBuild || !expected.stimBuild || health.stimBuild === expected.stimBuild;
 }
 const packageNames = (entries) => entries.map((entry) => isJsonObject(entry) ? `${String(entry.name)}@${String(entry.version)}` : "?").join(", ");
-/** Why `npm audit signatures --json` output does not vouch for every installed package, or null when it does. */
-function signatureProblem(output) {
+const lastLines = (text) => text.trim().split("\n").slice(-8).join("\n");
+/**
+* Why `npm audit signatures --json` output does not vouch for every installed package, or null when it does. When npm
+* fails it prints `{"error":{"summary","detail"}}` on stdout, or only text on stderr; the message carries that error.
+*/
+function signatureProblem(output, stderr = "") {
 	let report;
 	try {
 		report = JSON.parse(output);
 	} catch {
-		return "npm audit signatures did not print a JSON report";
+		report = null;
+	}
+	if (isJsonObject(report) && isJsonObject(report.error)) {
+		const { summary, detail } = report.error;
+		const text = [summary, detail].filter((part) => typeof part === "string" && part.trim() !== "");
+		if (text.length) return `npm audit signatures failed: ${text.map((part) => part.trim()).join(" ")}`;
+	}
+	if (!isJsonObject(report) || !Array.isArray(report.invalid) || !Array.isArray(report.missing)) {
+		const error = lastLines(stderr);
+		return `npm audit signatures did not print a JSON report${error ? `:\n${error}` : ""}`;
 	}
-	if (!isJsonObject(report) || !Array.isArray(report.invalid) || !Array.isArray(report.missing)) return "npm audit signatures did not print a JSON report";
 	if (report.invalid.length) return `npm found invalid registry signatures or attestations: ${packageNames(report.invalid)}`;
 	if (report.missing.length) return `npm found packages without registry signatures: ${packageNames(report.missing)}`;
 	return null;
@@ -1107,6 +1119,10 @@ function findTailscale(env) {
 	for (const dir of (env.PATH ?? "").split(delimiter)) if (dir && executable(join(dir, "tailscale"))) return join(dir, "tailscale");
 	return executable(MAC_APP_BINARY) ? MAC_APP_BINARY : null;
 }
+function tailscaleInstall(env, isExecutable = executable) {
+	if (isExecutable(MAC_APP_BINARY)) return "app";
+	return (env.PATH ?? "").split(delimiter).some((dir) => dir && isExecutable(join(dir, "tailscale"))) ? "cli" : "none";
+}
 function parseTailscaleStatus(value) {
 	if (!isJsonObject(value) || typeof value.BackendState !== "string") return {
 		state: "unavailable",
@@ -1900,7 +1916,6 @@ function serverBuild(script) {
 	}
 }
 const describeBuild = (build) => `stim-server ${build.version}${build.stimBuild ? ` (Stim build ${build.stimBuild})` : ""}`;
-const lastLines = (text) => text.trim().split("\n").slice(-8).join("\n");
 function sameFile(a, b) {
 	try {
 		return realpathSync(a) === realpathSync(b);
@@ -1931,6 +1946,32 @@ function installedIntegrity(staging) {
 		return null;
 	}
 }
+/**
+* The uploaded package files by package name, as `file:` specs. npm `audit signatures` skips a node only when its
+* dependent's spec is a file spec (npm lib/utils/verify-signatures.js), so the staging project lists every uploaded
+* package as a direct dependency and overrides every edge to it with `$name`.
+*/
+async function localPackageSpecs(dir, names) {
+	const specs = {};
+	for (const file of names) {
+		const path = join(dir, file);
+		const manifest = await run$2("/usr/bin/tar", [
+			"-xzOf",
+			path,
+			"package/package.json"
+		], process.env, 6e4);
+		let name;
+		try {
+			name = JSON.parse(manifest.stdout).name;
+		} catch {
+			name = null;
+		}
+		if (!manifest.ok || typeof name !== "string" || !name) throw new ServiceError(`${path} is not an npm package file.${manifest.ok ? "" : `\n${lastLines(manifest.stderr)}`}`);
+		if (specs[name]) throw new ServiceError(`${dir} has more than one package file for ${name}.`);
+		specs[name] = `file:${path}`;
+	}
+	return specs;
+}
 async function installServer(versions, source, node, log) {
 	mkdirSync(versions, { recursive: true });
 	for (const entry of readdirSync(versions)) if (entry.startsWith(".install-")) rmSync(join(versions, entry), {
@@ -1944,6 +1985,7 @@ async function installServer(versions, source, node, log) {
 		const registry = [`--registry=${REGISTRY}`, `--@stim-cli:registry=${REGISTRY}`];
 		let files = [];
 		let specs;
+		let localPackages = null;
 		if ("release" in source) specs = [`${SERVER_PACKAGE}@${source.release}`];
 		else {
 			const names = readdirSync(source.from).filter((name) => name.endsWith(".tgz"));
@@ -1952,9 +1994,16 @@ async function installServer(versions, source, node, log) {
 				name,
 				sha256: createHash("sha256").update(readFileSync(join(source.from, name))).digest("hex")
 			}));
-			specs = names.map((name) => join(source.from, name));
-		}
-		writeFileSync(join(staging, "package.json"), "{ \"private\": true }\n");
+			specs = [];
+			localPackages = await localPackageSpecs(source.from, names);
+		}
+		const overrides = localPackages && Object.fromEntries(Object.keys(localPackages).map((name) => [name, `$${name}`]));
+		const project = localPackages ? {
+			private: true,
+			dependencies: localPackages,
+			overrides
+		} : { private: true };
+		writeFileSync(join(staging, "package.json"), `${JSON.stringify(project, null, 2)}\n`);
 		log(`Installing ${"release" in source ? `${SERVER_PACKAGE}@${source.release} from ${REGISTRY}` : `${files.length} package file(s) from ${source.from}`}.`);
 		const installed = await run$2(npm, [
 			"install",
@@ -1969,14 +2018,15 @@ async function installServer(versions, source, node, log) {
 			...specs
 		], env, NPM_TIMEOUT_MS);
 		if (!installed.ok) throw new ServiceError(`npm install failed:\n${lastLines(installed.stderr)}`);
-		const problem = signatureProblem((await run$2(npm, [
+		const audit = await run$2(npm, [
 			"audit",
 			"signatures",
 			"--json",
 			"--prefix",
 			staging,
 			...registry
-		], env, NPM_TIMEOUT_MS)).stdout);
+		], env, NPM_TIMEOUT_MS);
+		const problem = signatureProblem(audit.stdout, audit.stderr);
 		if (problem) throw new ServiceError(`${problem}. Not switching to it.`);
 		const script = join(staging, ...SERVER_SCRIPT);
 		const build = existsSync(script) ? serverBuild(script) : null;
@@ -3499,6 +3549,11 @@ function setupVersionDecision(current, desired, managed) {
 	if (managed && compareVersions(current, desired) < 0) return "update";
 	return compareVersions(current.replace(/-.*/, ""), SETUP_MIN_VERSION) < 0 ? "too-old" : "reuse";
 }
+function tailscaleRefusal(install) {
+	if (install === "none") return "Install Tailscale on this Mac and sign in to the same tailnet: https://tailscale.com/download/mac";
+	if (install === "app") return "Turn on Tailscale from its menu bar icon on this Mac, then run this again.";
+	return "Run tailscale up on this Mac, then run this again.";
+}
 function setupExitCode(journal) {
 	if (journal.steps.some((s) => s.state === "failed")) return 1;
 	if (journal.granted.length === 0) return 2;
@@ -3594,7 +3649,7 @@ function defaultSetupDeps() {
 			if (process.platform !== "darwin") throw new SetupRefusal("setup runs only on macOS.");
 			if (compareVersions(process.versions.node, "22.12.0") < 0) throw new SetupRefusal("setup needs Node 22.12 or later.");
 			const status = await readRawTailscaleStatus(binary(), process.env);
-			if (!isJsonObject(status) || !isJsonObject(status.Self) || typeof status.Self.DNSName !== "string" || !status.Self.DNSName) throw new SetupRefusal("Start Tailscale on this Mac: tailscale up.");
+			if (!isJsonObject(status) || !isJsonObject(status.Self) || typeof status.Self.DNSName !== "string" || !status.Self.DNSName) throw new SetupRefusal(tailscaleRefusal(tailscaleInstall(process.env)));
 			if (!isJsonObject(status.Peer) || !Object.values(status.Peer).some((p) => isJsonObject(p) && p.ID === options.nodeId)) throw new SetupRefusal("That Mac is not on this tailnet");
 			if (!(await run$2("launchctl", ["print", `gui/${process.getuid?.()}`])).ok) throw new SetupRefusal("Log in to a GUI session on this Mac before running setup.");
 			return { dnsName: status.Self.DNSName.replace(/\.$/, "") };
@@ -14939,6 +14994,10 @@ async function startServer(options) {
 			return;
 		}
 		const peer = peerAddress(request);
+		if (options.loopbackOnly && peer !== null) {
+			socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+			return;
+		}
 		if (limiter.blocked(peer ?? "local")) {
 			socket.end("HTTP/1.1 429 Too Many Requests\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
 			return;
@@ -14980,7 +15039,8 @@ async function startServer(options) {
 			},
 			tailscale: healthTailscale(tailscale),
 			route,
-			nativeViewerOpened
+			nativeViewerOpened,
+			...options.loopbackOnly ? { loopbackOnly: true } : {}
 		};
 		response.writeHead(startup.state === "ready" ? 200 : 503, { "content-type": "application/json" }).end(JSON.stringify(body));
 	};
@@ -15027,6 +15087,10 @@ async function startServer(options) {
 	};
 	async function listenOn(host) {
 		const server = createServer$1((request, response) => {
+			if (options.loopbackOnly && peerAddress(request) !== null) {
+				response.writeHead(403, { "content-type": "text/plain" }).end("This stim-server serves this Mac only.\n");
+				return;
+			}
 			if (localHealthRequest(request)) {
 				answerHealth(response);
 				return;
@@ -15095,7 +15159,7 @@ async function startServer(options) {
 	const monitor = options.tailscaleMonitor;
 	const listenFailures = /* @__PURE__ */ new Set();
 	const reconcile = async (snapshot) => {
-		const tailnet = snapshot.state.state === "running" ? snapshot.state.ips : [];
+		const tailnet = snapshot.state.state === "running" && !options.loopbackOnly ? snapshot.state.ips : [];
 		const wanted = /* @__PURE__ */ new Set([...options.hosts, ...tailnet]);
 		for (const [host, listener] of servers) {
 			if (wanted.has(host)) continue;
@@ -15247,8 +15311,9 @@ function watchTailscale(options) {
 //#endregion
 //#region bin/stim-server.ts
 const USAGE = `Usage:
-  stim-server [--port <n>] [--env KEY=VALUE]... [--path-prepend <dir>]...
+  stim-server [--port <n>] [--loopback-only] [--env KEY=VALUE]... [--path-prepend <dir>]...
                                     serve paired clients (default port ${DEFAULT_PORT});
+                                    --loopback-only serves this Mac only (127.0.0.1, no remote peers);
                                     --env and --path-prepend apply after the login shell's environment
   stim-server setup --client <node-id> --ticket <t> --expires <iso>
                     [--build] [--device-host] [--port <n>] [--label <name>]
@@ -15298,7 +15363,7 @@ function routeNote(route, port) {
 function macName(tailscale) {
 	return tailscale.state === "running" && tailscale.hostName || hostname();
 }
-async function serve(port, extraEnv, pathPrepend) {
+async function serve(port, extraEnv, pathPrepend, loopbackOnly) {
 	const captureHost = hostFromExecutable(process.env.STIM_HOST_EXECUTABLE);
 	const login = loginShellEnvironment();
 	if (!login) console.error("stim-server: could not read the login shell environment; using this process environment.");
@@ -15324,6 +15389,7 @@ async function serve(port, extraEnv, pathPrepend) {
 			name: macName(tailscale),
 			host: captureHost,
 			hosts: ["127.0.0.1"],
+			...loopbackOnly ? { loopbackOnly: true } : {},
 			port,
 			stimCli: stim.cli,
 			stimVersion: stim.version,
@@ -15354,13 +15420,13 @@ async function serve(port, extraEnv, pathPrepend) {
 		}
 		if (note) console.error(note);
 	};
-	await announce(tailscaleBinary, tailscale);
-	monitor.onChange((snapshot, previous) => {
+	if (!loopbackOnly) monitor.onChange((snapshot, previous) => {
 		const { state } = snapshot;
 		if (state.state === "running") console.log("Tailscale is running.");
 		else if (previous.state.state === "running") console.error("Tailscale stopped.");
 		if (state.state === "running" || previous.state.state === "running") announce(snapshot.binary, state);
 	});
+	if (!loopbackOnly) await announce(tailscaleBinary, tailscale);
 	const shutdown = () => {
 		monitor.stop();
 		server.close().catch((error) => {
@@ -15491,6 +15557,7 @@ async function main() {
 		allowPositionals: true,
 		options: {
 			port: { type: "string" },
+			"loopback-only": { type: "boolean" },
 			json: { type: "boolean" },
 			control: { type: "boolean" },
 			read: { type: "boolean" },
@@ -15533,7 +15600,8 @@ async function main() {
 	}
 	if ((values.label !== void 0 || values.serve) && !service) fail(`--label and --serve apply only to \`service\`.\n${USAGE}`);
 	if ((values.release !== void 0 || values.from !== void 0) && !service) fail(`--release and --from apply only to \`service update\`.\n${USAGE}`);
-	if (command === void 0) return serve(port, extraEnv, pathPrepend);
+	if (values["loopback-only"] && command !== void 0) fail(`--loopback-only applies only to serving.\n${USAGE}`);
+	if (command === void 0) return serve(port, extraEnv, pathPrepend, values["loopback-only"] === true);
 	const grant = command === "devices" && sub === "grant";
 	if (values.read && !grant) fail(`--read applies only to \`devices grant\`.\n${USAGE}`);
 	if (values.build && !grant) fail(`--build applies only to \`devices grant\`.\n${USAGE}`);

package/dist/stim-server.mjs

@@ -4,6 +4,6 @@ const encode = (version) => version.split(".", 3).reduce((sum, part) => sum * 1e
 if (encode(process.versions.node) < encode("22.12.0")) {
 	process.stderr.write(`STIM_NODE_UNSUPPORTED: stim-server needs Node 22.12.0 or later; this is Node ${process.versions.node} at ${process.execPath}. To run stim-server where a project pins an older Node, see https://stim.appandflow.com/docs/requirements#older-node-pins\n`);
 	process.exitCode = 1;
-} else import("./stim-server-CGqz0EFG.mjs");
+} else import("./stim-server-CJIlV28Y.mjs");
 //#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stim-cli/server",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "description": "Serves Stim status to paired clients over Tailscale, and runs reload and stop for clients granted control.",
   "license": "MIT",
   "repository": {
@@ -28,8 +28,8 @@
     "./protocol.schema.json": "./dist/protocol.schema.json"
   },
   "dependencies": {
-    "@stim-cli/core": "^1.17.1",
-    "stim": "1.17.1",
+    "@stim-cli/core": "^1.17.2",
+    "stim": "1.17.2",
     "ws": "^8.21.3"
   },
   "devDependencies": {