@threadbase-sh/streamer 1.52.2 → 1.52.4

package/README.md

@@ -35,7 +35,7 @@ node dist/cli.cjs serve --verbose --local-no-auth
 
 #### Server address
 
-The server listens on `http://localhost:8766` (WebSocket at `ws://localhost:8766/ws`).
+By default, the server listens on port `8766` on all interfaces (WebSocket path: `/ws`).
 
 #### Automatic updates
 
@@ -43,7 +43,7 @@ npm and Homebrew installs can auto-update: [docs/guides/auto-update.md](docs/gui
 
 ## Remote Access
 
-The server listens on port 8766 on all interfaces, so devices on the same LAN can already reach it. To let the mobile app reach it from *outside* your LAN, expose it via a tunnel — the fastest is a Cloudflare quick-tunnel (no account needed):
+The server listens on port 8766 on all interfaces by default, so devices on the same LAN can already reach it. To restrict it to this machine, start it with `tb-streamer serve --host 127.0.0.1`. To let the mobile app reach it from *outside* your LAN, expose it via a tunnel — the fastest is a Cloudflare quick-tunnel (no account needed):
 
 > **Before you do this, read [Security](#security--read-this-before-exposing-the-server).** A tunnel makes the server reachable from the public internet, and the API key is the only thing between a stranger and a shell on this machine.
 
@@ -72,11 +72,15 @@ npm run db:validate       # check for missing/duplicate/orphaned project_id data
 
 The key lives at `~/.threadbase/server.yaml` as plaintext (`chmod 0600`), which is the same posture as `~/.aws/credentials` or `~/.npmrc`. Rotate it with `POST /api/auth/rotate` if it leaks; re-pair your devices afterwards.
 
-**The server listens on all network interfaces**, not just loopback — `httpServer.listen(port)` is called without a host, which is Node's listen-everywhere default, and there is currently no flag to narrow it. So every device on your LAN can already reach port 8766, and the API key is the only thing stopping them. On a home network that is usually fine; on café Wi-Fi, a co-working space, or a corporate VLAN it is not.
+**The server listens on all network interfaces by default**, not just loopback. So every device on your LAN can already reach port 8766, and the API key is the only thing stopping them. On a home network that is usually fine; on café Wi-Fi, a co-working space, or a corporate VLAN it is not. To bind only to loopback, run:
+
+```bash
+tb-streamer serve --host 127.0.0.1
+```
 
 **A tunnel extends that to the entire internet.** From that moment the key is the only thing between a stranger and your filesystem.
 
-If you need it strictly local today, bind it yourself at the firewall or run it inside a network namespace — the server will not do it for you. Tracked as [#517](https://github.com/RonenMars/threadbase-streamer/issues/517).
+For stricter network policies, also use your firewall or a network namespace.
 
 ### There is no spend limit
 

package/dist/cli.cjs

@@ -6160,11 +6160,12 @@ function validateFeatureFlagValues(raw2) {
   const out = {};
   const dropped = [];
   for (const [id, value] of Object.entries(raw2)) {
-    if (!findFeatureFlag(id) || typeof value !== "boolean") {
+    const def = findFeatureFlag(id);
+    if (!def || typeof value !== "boolean") {
       dropped.push(id);
       continue;
     }
-    out[id] = value;
+    out[def.id] = value;
   }
   if (dropped.length > 0) {
     getLogger("feature-flags").warn(
@@ -6184,7 +6185,8 @@ function parseFeatureFlagArgs(entries) {
     const eq = entry.indexOf("=");
     const id = (eq === -1 ? entry : entry.slice(0, eq)).trim();
     const rawValue = eq === -1 ? "true" : entry.slice(eq + 1).trim().toLowerCase();
-    if (!findFeatureFlag(id)) {
+    const def = findFeatureFlag(id);
+    if (!def) {
       errors.push(
         `Unknown feature flag "${id}". Known flags: ${FEATURE_FLAGS.map((f2) => f2.id).join(", ")}`
       );
@@ -6194,21 +6196,35 @@ function parseFeatureFlagArgs(entries) {
       errors.push(`Invalid value "${rawValue}" for feature flag "${id}" \u2014 expected true/false`);
       continue;
     }
-    values[id] = rawValue === "true";
+    values[def.id] = rawValue === "true";
   }
   return { values, errors };
 }
 function resolveFeatureFlags(opts) {
   const env = opts?.env ?? process.env;
-  const out = {};
+  const values = {};
+  const sources = {};
   for (const def of FEATURE_FLAGS) {
-    out[def.id] = parseBooleanEnv(env[def.env]) ?? opts?.cli?.[def.id] ?? opts?.yaml?.[def.id] ?? def.default;
+    const rungs = [
+      ["override", opts?.override?.[def.id]],
+      ["env", parseBooleanEnv(env[def.env])],
+      ["cli", opts?.cli?.[def.id]],
+      ["yaml", opts?.yaml?.[def.id]]
+    ];
+    const won = rungs.find(([, v2]) => v2 !== void 0);
+    values[def.id] = won ? won[1] : def.default;
+    sources[def.id] = won ? won[0] : "default";
   }
-  return out;
+  return { values, sources };
 }
 function nonDefaultFeatureFlags(values) {
   return FEATURE_FLAGS.filter((f2) => values[f2.id] !== f2.default).map((f2) => f2.id);
 }
+function describeFeatureFlags(resolution) {
+  return FEATURE_FLAGS.map(
+    (f2) => `${f2.id}=${resolution.values[f2.id]}(${resolution.sources[f2.id]})`
+  ).join(" ");
+}
 var FEATURE_FLAGS;
 var init_feature_flags = __esm({
   "src/feature-flags.ts"() {
@@ -152274,6 +152290,7 @@ var StreamerServer = class {
   dbPool = null;
   dbInstanceId = null;
   disableDb = false;
+  host;
   // Skip the startup warm-up scan (test hook; see ServerConfig.skipStartupWarmup).
   skipStartupWarmup;
   autoResumeOnBoot;
@@ -152289,6 +152306,10 @@ var StreamerServer = class {
   // Resolved once at boot; see src/feature-flags.ts. Total map — every registry
   // id is present, so indexing it never yields undefined.
   featureFlags;
+  // Which rung of the precedence chain decided each flag. Reported at boot and
+  // over GET /api/config/feature-flags — the resolved boolean alone cannot say
+  // whether a value came from the environment, the CLI, server.yaml or nowhere.
+  featureFlagSources;
   // Derived from featureFlags.codexSystemPrompt. Kept as its own field so the
   // read site in startFresh() is unchanged.
   codexSystemPromptEnabled;
@@ -152395,16 +152416,20 @@ var StreamerServer = class {
     }
     this.verbose = config2.verbose ?? false;
     this.disableDb = config2.disableDb ?? false;
+    this.host = config2.host;
     this.skipStartupWarmup = config2.skipStartupWarmup ?? false;
     this.autoResumeOnBoot = config2.autoResumeOnBoot ?? false;
     this.scanProfiles = config2.scanProfiles;
     this.codexRoots = config2.codexRoots ?? [(0, import_path33.join)((0, import_os15.homedir)(), ".codex", "sessions")];
     this.ptyGracePeriodMs = config2.ptyGracePeriodMs ?? DEFAULT_PTY_GRACE_PERIOD_MS;
     this.defaultSystemPrompt = config2.defaultSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
-    this.featureFlags = resolveFeatureFlags({ cli: config2.featureFlags, yaml: loadFeatureFlags() });
-    if (config2.codexSystemPromptEnabled !== void 0) {
-      this.featureFlags.codexSystemPrompt = config2.codexSystemPromptEnabled;
-    }
+    const flagResolution = resolveFeatureFlags({
+      override: config2.codexSystemPromptEnabled === void 0 ? void 0 : { codexSystemPrompt: config2.codexSystemPromptEnabled },
+      cli: config2.featureFlags,
+      yaml: loadFeatureFlags()
+    });
+    this.featureFlags = flagResolution.values;
+    this.featureFlagSources = flagResolution.sources;
     this.codexSystemPromptEnabled = this.featureFlags.codexSystemPrompt;
     this.defaultPermissionMode = config2.defaultPermissionMode ?? loadDefaultPermissionMode() ?? "acceptEdits";
     this.defaultModel = config2.defaultModel ?? "sonnet";
@@ -152449,13 +152474,12 @@ var StreamerServer = class {
     });
     this.includeAgents = parseIncludeAgentsEnv(process.env.THREADBASE_INCLUDE_AGENTS);
     this.agentEntrypoints = parseAgentEntrypointsEnv(process.env.THREADBASE_AGENT_ENTRYPOINTS);
-    const enabledFlags = nonDefaultFeatureFlags(this.featureFlags);
-    if (enabledFlags.length > 0) {
-      this.log.info(`Feature flags active: ${enabledFlags.join(", ")}`, {
-        event: "config.feature_flags_active",
-        flags: enabledFlags
-      });
-    }
+    this.log.info(`Feature flags: ${describeFeatureFlags(flagResolution)}`, {
+      event: "config.feature_flags",
+      values: this.featureFlags,
+      sources: this.featureFlagSources,
+      nonDefault: nonDefaultFeatureFlags(this.featureFlags)
+    });
     const rawRoot = process.env.THREADBASE_BROWSE_ROOT ?? loadBrowseRoot() ?? config2.browseRoot;
     if (rawRoot) {
       (0, import_promises16.realpath)(rawRoot).then((resolved) => {
@@ -153047,7 +153071,7 @@ var StreamerServer = class {
       await runMigrations2(this.dbPool);
       this.log.info("Database migrations applied", { event: "db.migrations_applied" });
     }
-    await this.bindWithRetry(port);
+    await this.bindWithRetry(port, this.host);
     if (!this.ptyManager.isRemote()) {
       this.idleReaperTimer = setInterval(() => this.reapIdleSessions(), IDLE_REAP_SWEEP_MS);
       this.idleReaperTimer.unref?.();
@@ -153056,7 +153080,8 @@ var StreamerServer = class {
       {
         this.log.info(`Streamer server listening on port ${port}`, {
           port,
-          event: "server.listening"
+          event: "server.listening",
+          ...this.host !== void 0 && { host: this.host }
         });
         try {
           this.runtimeStore = RuntimeStore.open(this.runtimeDbPath);
@@ -153270,15 +153295,15 @@ var StreamerServer = class {
   // Bind the HTTP listener, retrying on a transient EADDRINUSE. See the call
   // site in listen() for why the race exists (kickstart -k relaunch). Total
   // worst case ≈ 6 × 500 ms = 3 s before the final attempt rethrows.
-  async bindWithRetry(port, attempts = 6, delayMs = 500) {
+  async bindWithRetry(port, host, attempts = 6, delayMs = 500) {
     this.binding = true;
     try {
-      await this.bindWithRetryLoop(port, attempts, delayMs);
+      await this.bindWithRetryLoop(port, host, attempts, delayMs);
     } finally {
       this.binding = false;
     }
   }
-  async bindWithRetryLoop(port, attempts, delayMs) {
+  async bindWithRetryLoop(port, host, attempts, delayMs) {
     for (let attempt = 1; attempt <= attempts; attempt++) {
       try {
         await new Promise((resolve4, reject) => {
@@ -153292,7 +153317,11 @@ var StreamerServer = class {
           };
           this.httpServer.once("error", onError);
           this.httpServer.once("listening", onListening);
-          this.httpServer.listen(port);
+          if (host === void 0) {
+            this.httpServer.listen(port);
+          } else {
+            this.httpServer.listen(port, host);
+          }
         });
         return;
       } catch (err) {
@@ -153300,13 +153329,18 @@ var StreamerServer = class {
         if (e.code === "EADDRINUSE" && attempt === attempts) {
           this.log.error(
             `port ${port} still busy (EADDRINUSE) after ${attempts} attempts; giving up`,
-            { port, attempts, event: "server.bind_failed" }
+            {
+              port,
+              attempts,
+              event: "server.bind_failed",
+              ...host !== void 0 && { host }
+            }
           );
         }
         if (e.code !== "EADDRINUSE" || attempt === attempts) throw err;
         this.log.debug?.(
           `port ${port} busy (EADDRINUSE), retry ${attempt}/${attempts - 1} in ${delayMs}ms`,
-          { port, attempt, event: "server.bind_retry" }
+          { port, attempt, event: "server.bind_retry", ...host !== void 0 && { host } }
         );
         await new Promise((r) => setTimeout(r, delayMs));
       }
@@ -153468,7 +153502,11 @@ var StreamerServer = class {
    * the absence of that field is the signal that this endpoint is read-only.
    */
   getFeatureFlagsConfig() {
-    return { registry: FEATURE_FLAGS, values: this.featureFlags };
+    return {
+      registry: FEATURE_FLAGS,
+      values: this.featureFlags,
+      sources: this.featureFlagSources
+    };
   }
   getClaudeFlagsConfig() {
     return {
@@ -157672,7 +157710,7 @@ async function runProdDoctor(opts, deps = {}) {
       );
     }
   }
-  const featureFlags = deps.featureFlags ?? resolveFeatureFlags({ yaml: loadFeatureFlags() });
+  const featureFlags = deps.featureFlags ?? resolveFeatureFlags({ yaml: loadFeatureFlags() }).values;
   if (featureFlags.ptyHost) {
     const probe = deps.probePtyHost ?? (() => probePtyHostStatus(hostSocketPath(getInstanceId())));
     try {
@@ -157693,6 +157731,33 @@ async function runProdDoctor(opts, deps = {}) {
 function toPowerShellLiteral(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
+function windowsFollowScript(paths, lines) {
+  const list = `@(${paths.map(toPowerShellLiteral).join(", ")})`;
+  return [
+    "$ErrorActionPreference = 'Stop'",
+    `$paths = ${list}`,
+    `foreach ($f in $paths) { Get-Content -LiteralPath $f -Tail ${lines} }`,
+    "$offsets = @{}",
+    "foreach ($f in $paths) { $offsets[$f] = (Get-Item -LiteralPath $f).Length }",
+    "while ($true) {",
+    "  foreach ($f in $paths) {",
+    "    try {",
+    "      $len = (Get-Item -LiteralPath $f).Length",
+    "      if ($len -lt $offsets[$f]) { $offsets[$f] = 0 }",
+    "      if ($len -gt $offsets[$f]) {",
+    "        $stream = [IO.File]::Open($f, 'Open', 'Read', 'ReadWrite')",
+    "        [void]$stream.Seek($offsets[$f], 'Begin')",
+    "        $reader = New-Object IO.StreamReader($stream)",
+    "        $reader.ReadToEnd()",
+    "        $reader.Dispose(); $stream.Dispose()",
+    "        $offsets[$f] = $len",
+    "      }",
+    "    } catch { }",
+    "  }",
+    "  Start-Sleep -Milliseconds 400",
+    "}"
+  ].join("; ");
+}
 var defaultSpawnTail = ({ files, lines, follow }) => {
   const existing = files.filter((f2) => (0, import_node_fs23.existsSync)(f2));
   if (existing.length === 0) {
@@ -157707,13 +157772,17 @@ var defaultSpawnTail = ({ files, lines, follow }) => {
     "-NoProfile",
     "-NonInteractive",
     "-Command",
-    `Get-Content -LiteralPath @(${existing.map(toPowerShellLiteral).join(", ")}) -Tail ${lines}${follow ? " -Wait" : ""}`
+    follow ? windowsFollowScript(existing, lines) : `$ErrorActionPreference = 'Stop'; Get-Content -LiteralPath @(${existing.map(toPowerShellLiteral).join(", ")}) -Tail ${lines}`
   ] : ["-n", String(lines), ...follow ? ["-F"] : [], ...existing];
+  const program3 = isWindows3 ? "powershell.exe" : "tail";
   return new Promise((resolve4) => {
-    const child = (0, import_node_child_process8.spawn)(isWindows3 ? "powershell.exe" : "tail", args, {
+    const child = (0, import_node_child_process8.spawn)(program3, args, {
       stdio: ["ignore", "inherit", "inherit"]
     });
-    child.on("error", (err) => resolve4({ ok: false, message: `tail failed: ${err.message}` }));
+    child.on(
+      "error",
+      (err) => resolve4({ ok: false, message: `${program3} failed: ${err.message}` })
+    );
     child.on("exit", (code) => resolve4({ ok: code === 0 }));
   });
 };
@@ -157841,7 +157910,7 @@ function registerProdCommands(program3) {
 var log14 = getLogger("cli");
 var program2 = new Command();
 program2.name("threadbase-streamer").description("PTY session management, WebSocket streaming, and REST API server for Claude Code").version(getVersion());
-program2.command("serve").description("Start the streamer server").option("-p, --port <number>", "Port to listen on", "8766").option("--api-key <key>", "API key for authentication").option("--local-no-auth", "Skip auth for localhost requests", false).option("-v, --verbose", "Verbose output", false).option("--log-menubar-requests", "Log /healthz requests from the menubar app", false).option("--browse-root <path>", "Root directory for file browsing").option(
+program2.command("serve").description("Start the streamer server").option("-p, --port <number>", "Port to listen on", "8766").option("--host <address>", "Host/address to bind the server to (default: all interfaces)").option("--api-key <key>", "API key for authentication").option("--local-no-auth", "Skip auth for localhost requests", false).option("-v, --verbose", "Verbose output", false).option("--log-menubar-requests", "Log /healthz requests from the menubar app", false).option("--browse-root <path>", "Root directory for file browsing").option(
   "--public-url <url>",
   "Public URL clients should use to reach this server (https:// required, except localhost). Falls back to THREADBASE_PUBLIC_URL env or public_url: in ~/.threadbase/server.yaml."
 ).option(
@@ -158029,6 +158098,7 @@ program2.command("serve").description("Start the streamer server").option("-p, -
   }
   const server = new StreamerServer({
     port: resolvedPort,
+    host: opts.host,
     apiKey,
     apiKeySource: opts.apiKey ? "cli" : "config",
     localNoAuth: opts.localNoAuth,