npm - @surething/cockpit - Versions diffs - 1.0.242 → 1.0.243 - Mend

@surething/cockpit 1.0.242 → 1.0.243

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (479) hide show

package/dist/wsServer.mjs CHANGED Viewed

@@ -2,7 +2,7 @@ import {
   addRunListener,
   getGlobalSessionsSnapshot,
   getRunSnapshot
-} from "./chunk-RBT65EBM.mjs";
+} from "./chunk-4S76JXBU.mjs";
 import {
   addExitListener,
   addOutputListener,
@@ -18,7 +18,7 @@ import {
   resolvePendingRequest,
   unregisterBrowser,
   writeStdinToCommand
-} from "./chunk-53DHIXIY.mjs";
+} from "./chunk-V2ZASC2X.mjs";
 import {
   AppError,
   Effect_exports,
@@ -33,7 +33,7 @@ import {
   Stream_exports,
   ValidationError,
   WSError
-} from "./chunk-PTHQK26K.mjs";
+} from "./chunk-NW4I3U26.mjs";
 import "./chunk-7P6ASYW6.mjs";
 // src/lib/wsServer.ts
@@ -665,7 +665,7 @@ var handleJupyter = (conn, bubbleId, cwd) => Effect_exports.gen(function* () {
     Effect_exports.annotateLogs("cwd", cwd)
   );
   const { kernelManager } = yield* Effect_exports.tryPromise({
-    try: () => import("./server-XWLYHEMD.mjs"),
+    try: () => import("./server-YK62AFE6.mjs"),
     catch: (cause) => new AppError({
       message: "failed to import kernel manager",
       cause

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@surething/cockpit",
-  "version": "1.0.242",
+  "version": "1.0.243",
   "description": "The open-source Claude Code GUI — an IDE-like workbench for parallel AI coding. Drive Claude (default), Codex, DeepSeek, Kimi, or local Ollama in tabs. Terminal, browser & DB bubbles, code review. Self-host on a shared dev box — a seat for every teammate. Local-first, MIT.",
   "author": "Robert",
   "license": "MIT",

package/server.mjs CHANGED Viewed

@@ -188,6 +188,24 @@ app.prepare().then(async () => {
     return false;
   };
+  // ============================================
+  // Local-admin marker — stamp an internal, client-UNFORGEABLE header telling
+  // the app layer whether this request comes from a trusted LOCAL peer (loopback
+  // socket + no forwarding header), the same "local exempt" notion checkAccess()
+  // uses. Review viewing of a CLOSED review is revoked for everyone except the
+  // local admin; the app can't see the TCP peer, so we decide it here.
+  //
+  // We ALWAYS overwrite any inbound x-cockpit-local first: without this a remote
+  // client could send the header and impersonate a local admin. Mirrors the
+  // share server's x-forwarded-for injection discipline.
+  // ============================================
+  const LOCAL_HEADER = 'x-cockpit-local';
+  const markLocalRequest = (req) => {
+    const gi = gateInput(req, false);
+    const isLocal = !gi.forwarded && auth.isLoopbackAddr(gi.remoteAddr);
+    req.headers[LOCAL_HEADER] = isLocal ? '1' : '0';
+  };
   // ============================================
   // /api/* JSON gzip — Next's built-in compression only runs under
   // `next start`; with this custom server, API JSON goes out uncompressed
@@ -270,6 +288,7 @@ app.prepare().then(async () => {
   const server = createServer(async (req, res) => {
     if (applyHttpGate(req, res)) return;
+    markLocalRequest(req);
     if (req.url?.startsWith('/api/')) gzipJsonResponse(req, res);
     // /api/browser/* must be handled inside the custom server (it shares
@@ -357,6 +376,11 @@ app.prepare().then(async () => {
     if (applyHttpGate(req, res)) return;
     if (req.url?.startsWith('/api/')) gzipJsonResponse(req, res);
     if (isShareAllowed(req.url || '')) {
+      // The share port is the revocation surface for LAN viewers — never the
+      // local admin. Force the marker to '0' (also strips any forged inbound
+      // value). The admin uses the main port (localhost) to keep access to a
+      // closed review.
+      req.headers['x-cockpit-local'] = '0';
       // Inject the client's real IP for /api/review/identify
       const clientIp = req.socket.remoteAddress || '';
       req.headers['x-forwarded-for'] = clientIp;

package/.next-prod/static/YsWseNHOrhvA60UWaNkzK/_buildManifest.js DELETED Viewed

@@ -1 +0,0 @@

- self.__BUILD_MANIFEST={__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:127,errorRate:1e-4,numBits:2435,numHashes:14,bitArray:[1,1,0,1,1,0,1,1,1,1,1,1,1,1,0,1,1,1,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,1,1,0,0,1,0,1,0,0,1,0,1,1,0,1,1,1,1,0,0,1,1,0,0,1,1,0,0,0,1,1,1,0,0,0,1,1,0,0,1,0,1,1,0,0,1,1,0,1,1,0,1,0,1,1,1,0,1,1,0,0,0,1,1,0,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,1,0,0,1,0,1,1,1,0,0,1,0,1,1,1,0,0,1,1,0,1,1,0,0,1,1,0,1,1,0,0,0,0,0,1,0,1,0,0,1,0,1,1,0,0,1,0,0,0,1,0,1,1,1,0,0,0,0,1,1,1,0,1,0,1,0,0,1,1,1,0,1,1,1,0,0,1,0,0,1,0,0,0,0,1,0,0,1,1,1,1,0,0,1,1,1,1,1,1,1,1,0,0,0,0,0,1,0,0,1,1,1,0,0,0,0,0,1,0,1,1,1,0,1,0,1,1,1,1,0,1,1,1,0,1,0,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,1,0,1,1,1,1,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,0,1,1,1,1,1,0,0,0,1,1,1,1,0,1,0,0,0,1,1,0,1,0,1,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,1,0,0,1,0,0,1,1,1,0,0,0,1,1,1,0,1,1,1,0,0,0,0,1,1,1,0,0,0,1,1,0,0,1,1,1,1,1,1,1,0,1,1,1,0,1,0,0,1,1,1,1,0,1,1,1,0,1,0,1,1,1,1,1,1,1,1,1,0,0,1,0,1,0,1,0,0,1,0,0,1,1,1,1,1,0,0,0,0,0,0,0,1,1,1,1,0,1,0,0,0,0,1,0,0,0,1,0,0,1,0,0,0,1,0,0,0,0,0,1,1,1,0,0,1,1,1,0,0,0,0,1,1,0,0,1,1,1,1,0,0,1,0,1,1,0,1,0,1,1,0,0,1,0,1,1,1,1,0,0,1,1,0,0,0,0,1,0,0,1,1,1,1,0,0,0,1,0,1,1,0,1,1,0,0,0,1,0,1,0,1,1,0,1,1,1,1,1,1,1,1,1,0,0,1,0,1,0,1,1,0,0,1,1,0,1,1,0,0,0,1,1,1,1,0,1,0,0,1,1,1,1,0,1,1,1,0,1,1,0,0,0,0,1,0,1,1,0,0,1,1,0,1,0,0,0,1,0,1,0,0,1,1,0,0,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0,1,1,1,0,0,0,0,0,0,0,1,1,0,1,0,1,1,1,1,0,0,0,0,0,1,0,0,1,0,1,1,0,0,1,1,1,1,0,0,0,1,1,1,1,1,0,1,1,1,1,0,1,1,0,1,0,0,0,0,1,0,1,1,0,0,1,0,1,0,1,1,1,1,1,1,0,1,1,0,0,1,0,0,1,0,0,1,1,1,1,1,1,1,0,1,0,0,1,1,1,1,0,0,0,1,0,0,0,1,1,1,0,0,1,0,1,1,0,0,0,0,1,1,0,1,1,1,0,1,1,0,1,0,1,1,1,0,0,0,0,0,1,1,1,0,0,0,1,0,0,1,0,1,0,1,1,0,0,0,0,1,0,1,0,0,1,0,1,0,1,0,0,1,1,0,0,1,0,0,0,1,0,1,0,1,1,0,1,1,1,1,1,1,0,1,1,0,1,0,1,0,1,1,1,0,1,1,0,0,1,1,1,1,0,0,0,1,1,1,1,1,0,1,0,1,0,1,0,0,1,0,0,1,1,0,1,0,1,0,1,1,0,0,1,1,0,1,1,0,0,0,1,1,1,0,0,1,0,0,0,1,1,1,0,0,0,1,1,1,0,0,0,0,0,0,0,0,0,1,0,0,1,1,1,0,0,0,1,1,0,1,0,1,1,0,0,0,0,0,1,1,0,0,0,1,0,0,1,1,0,1,0,1,0,1,0,0,1,0,0,1,0,1,0,1,1,0,1,0,0,1,0,1,0,1,1,0,1,1,0,1,1,0,1,0,0,0,0,0,1,0,1,0,0,0,0,0,1,0,1,1,1,0,1,1,0,1,0,1,0,0,0,1,0,0,1,1,1,0,1,1,1,1,1,0,1,0,0,0,0,1,0,1,1,0,0,0,1,0,1,0,0,0,0,1,1,0,1,1,1,0,1,1,0,1,1,1,1,0,1,0,1,0,0,1,0,1,1,1,0,1,0,1,0,1,0,0,1,1,0,0,1,0,1,0,1,0,1,1,0,0,1,1,1,1,1,0,0,1,0,1,0,0,1,0,1,1,0,0,1,1,1,1,0,1,1,0,1,1,1,1,1,1,1,1,1,0,0,1,1,0,0,1,0,1,0,0,0,0,0,0,1,0,1,0,1,1,1,0,1,1,0,1,0,0,0,1,1,0,1,1,0,1,1,0,0,1,0,0,1,0,1,1,0,0,0,1,0,0,0,0,0,0,0,0,0,1,0,1,0,0,1,0,0,0,1,0,0,1,1,1,1,0,1,1,1,0,0,0,0,1,0,0,0,1,0,1,0,1,1,1,0,1,0,0,0,0,1,1,0,0,1,1,0,1,0,1,0,0,1,1,1,1,1,1,1,0,0,0,0,0,1,1,0,1,0,0,0,1,0,1,0,0,0,0,0,1,0,1,1,1,1,1,1,1,1,0,1,0,1,1,1,1,1,0,1,1,1,1,0,1,1,1,0,0,1,1,1,1,1,0,1,0,1,0,1,1,1,0,0,1,1,1,0,1,0,1,0,0,1,0,0,1,0,0,1,1,0,0,1,1,0,1,1,1,0,1,1,1,1,1,1,0,1,0,0,0,1,1,0,1,1,1,0,0,0,1,1,0,0,0,0,1,0,0,1,0,1,0,0,1,0,0,0,0,1,0,1,1,1,1,1,1,0,1,1,1,0,0,0,0,1,1,0,1,0,1,1,0,1,1,1,1,0,0,0,1,1,0,1,0,1,1,1,0,0,1,0,0,1,1,1,0,1,0,1,1,1,1,1,1,1,1,1,0,0,1,1,0,1,1,0,0,1,0,0,0,1,0,1,0,1,1,0,1,0,1,0,1,1,1,1,0,1,1,1,1,0,1,1,0,0,0,0,0,1,0,0,0,1,0,0,0,1,0,1,0,0,1,1,1,1,1,1,0,1,0,0,1,1,0,1,1,1,1,1,0,0,0,0,1,0,1,1,1,1,1,0,1,1,0,0,0,0,0,1,1,1,0,0,1,1,0,1,1,0,0,1,1,0,0,1,1,0,1,0,0,1,1,0,0,0,0,0,1,1,0,0,1,0,1,1,0,0,1,0,1,0,1,1,1,1,1,1,0,0,0,1,0,0,1,1,0,1,0,1,0,0,0,1,1,0,1,0,0,1,1,1,1,1,1,1,0,0,1,0,0,0,1,0,0,1,0,1,1,0,0,1,0,0,1,0,0,0,1,1,0,1,1,1,1,0,1,0,1,1,1,1,0,0,1,1,0,0,1,0,0,1,1,1,0,0,0,0,1,1,0,0,1,0,1,1,0,0,1,1,0,1,1,0,0,1,1,0,0,1,0,0,0,1,0,0,0,1,1,1,1,1,0,1,0,0,0,0,1,0,0,1,0,1,0,1,1,1,0,0,0,1,1,1,1,1,1,0,1,0,1,0,0,1,1,1,1,0,0,0,1,0,0,0,0,0,1,1,1,0,0,0,1,1,1,0,1,1,1,0,1,0,0,0,1,1,1,1,1,0,1,0,0,1,1,1,0,0,0,0,1,1,0,1,1,1,0,1,0,1,0,0,1,0,0,0,0,0,0,0,1,0,0,0,1,1,0,1,1,0,0,0,1,0,0,0,1,1,0,1,0,1,0,1,0,0,0,1,0,0,1,1,1,0,0,1,1,1,1,1,1,0,1,1,1,0,0,1,0,0,1,1,1,1,0,0,1,0,1,1,1,1,0,1,0,0,0,1,0,0,1,0,1,0,1,0,1,0,1,1,0,0,1,1,1,1,1,0,0,1,1,0,1,1,0,0,0,1,0,0,1,0,1,0,1,0,1,0,1,0,0,0,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,1,1,0,1,0,0,1,0,0,1,0,1,0,0,0,0,0,0,1,1,1,0,1,1,1,0,0,1,1,1,0,1,0,0,0,1,1,1,1,1,0,1,0,0,1,1,0,0,0,1,1,1,0,0,1,0,0,1,0,0,0,1,1,0,0,1,1,1,1,1,0,1,0,0,1,1,1,0,0,1,1,1,1,0,1,0,1,1,1,1,1,1,0,0,0,1,0,1,1,0,0,0,0,1,0,1,0,1,1,1,0,1,0,0,1,1,1,0,1,0,1,1,0,0,1,1,0,0,1,1,1,1,0,1,0,1,1,1,0,0,1,1,0,0,0,0,0,0,0,0,1,1,0,0,0,0,1,1,1,0,1,0,0,1,1,0,0,1,1,1,1,1,0,0,1,1,0,0,1,0,1,1,0,0,1,1,0,0,1,0,0,0,0,0,0,1,1,1,1,0,1,0,0,0,0,0,0,1,0,1,1,1,0,0,1,0,0,1,1,1,1,1,1,0,0,1,1,0,0,1,1,1,1,0,1,0,0,0,1,0,0,1,0,1,1,0,1,1,0,1,0,1,0,1,1,0,1,1,1,1,0,0,0,1,0,1,0,1,0,0,0,0,1,1,0,0,1,1,0,1,0,0,0,1,1,0,0,1,0,0,0,0,1,0,0,1,1,0,0,0,0,0,1,0,1,0,0,1,0,1,1,0,1,0,0,0,0,1,1,1,1,0,1,0,0,1,0,1,1,0,1,0,1,1,0,0,1,1,0,0,1,0,0,1,0,0,1,1,0,1,0,1,1,0,1,0,0,1,0,1,1,0,0,0,0,1,0,0,1,1,1,1,0,1,0,1,1,0,1,1,1,0,1,0,0,0,1,1,0,1,1,0,1,1,0,0,1,1,0,1,0,0,1,1,1,0,1,1,1,1,1,1,1,1,1,0,0,1,1,0,1,1,0,0,0,0,1,0,1,0,1,1,0,0,1,0,1,0,0,0,1,0,1,1,1,1,0,1,0,1,1,0,0,0,0,1,1,1,0,0,1,0,1,0,1,0,1,0,1,1,1,0,1,1,0,0,0,1,1,0,1,0,0,0,1,0,1,1,0,0,0,1,0,0,1,0,0,1,0,1,1,0,0,1,1,1,1,1,0,0,0,0,1,0,0,1,0,0,1,1,1,1,0,0,1,1,1,1,0,1,0,1,1,1,0,1,0,0,0,0,1,0,1,0,1,0,0,0,0,1,1,1,1,1,0]},__routerFilterDynamic:{numItems:6,errorRate:1e-4,numBits:116,numHashes:14,bitArray:[1,0,1,1,1,0,0,1,1,1,0,1,0,0,1,1,0,0,0,0,1,0,0,0,0,0,1,1,1,0,0,0,0,1,0,1,1,1,0,1,1,1,0,1,0,0,0,1,0,0,1,1,1,1,1,1,0,0,0,1,0,1,1,1,1,0,0,0,1,0,1,0,0,1,0,0,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,1,1,1,0,0,1,1,0,1,0,1,0,1,0,1,1,0,1,0,0,0,1,1,1,0]},sortedPages:["/_app"]},self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();