@tiflis-io/tiflis-code-tunnel 0.3.9 → 0.3.11

package/README.md

@@ -20,15 +20,30 @@
 
 ## Overview
 
-The Tunnel Server acts as a secure reverse proxy between mobile clients (iOS/watchOS) and workstations running the Tiflis Code workstation server. It enables remote access to your workstation without requiring a public IP address.
+The Tunnel Server acts as a secure reverse proxy between clients (iOS/watchOS/Android/Web) and workstations running the Tiflis Code workstation server. It enables remote access to your workstation without requiring a public IP address.
 
 ```
 ┌─────────────┐         ┌─────────────┐         ┌─────────────────┐
-│   Mobile    │◄───────►│   Tunnel    │◄───────►│   Workstation   │
-│  (iOS/Watch)│   WSS   │   Server    │   WS    │     Server      │
+│   Clients   │◄───────►│   Tunnel    │◄───────►│   Workstation   │
+│ iOS/Watch/  │   WSS   │   Server    │   WS    │     Server      │
+│ Android/Web │         │ (+Web App)  │         │                 │
 └─────────────┘         └─────────────┘         └─────────────────┘
 ```
 
+### Web Client
+
+The tunnel server includes a bundled web client built with Next.js and assistant-ui, accessible at the root URL of your tunnel server:
+
+```
+https://your-tunnel-url.com/
+```
+
+Features:
+- Voice messaging with STT/TTS
+- Mobile-first responsive design
+- Cross-device message sync
+- Lazy history loading (protocol v1.13)
+
 ## Installation
 
 ```bash
@@ -170,6 +185,16 @@ server {
     ssl_certificate /path/to/cert.pem;
     ssl_certificate_key /path/to/key.pem;
 
+    # Web client (static files)
+    location / {
+        proxy_pass http://tiflis_tunnel;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # WebSocket endpoint
     location /ws {
         proxy_pass http://tiflis_tunnel;
         proxy_http_version 1.1;
@@ -182,9 +207,19 @@ server {
         proxy_read_timeout 86400s;
     }
 
+    # Health check endpoint
     location /health {
         proxy_pass http://tiflis_tunnel;
     }
+
+    # watchOS polling API
+    location /api/v1/watch/ {
+        proxy_pass http://tiflis_tunnel;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
 }
 ```
 
@@ -196,10 +231,12 @@ See `deploy/docker-compose.traefik.yml` for a complete example with automatic Le
 
 | Endpoint   | Method    | Description                                 |
 | ---------- | --------- | ------------------------------------------- |
+| `/`        | GET       | Web client (bundled static files)           |
 | `/health`  | GET       | Detailed health check with connection stats |
 | `/healthz` | GET       | Simple liveness probe                       |
 | `/readyz`  | GET       | Readiness probe                             |
 | `/ws`      | WebSocket | Main WebSocket endpoint                     |
+| `/api/v1/watch/*` | HTTP | watchOS polling API endpoints                |
 
 ### Health Check Response
 

package/dist/main.js

@@ -447,7 +447,10 @@ function registerWatchApiRoute(app, deps) {
       return await reply.status(200).send({
         messages,
         current_sequence: result.currentSequence,
-        workstation_online: result.workstationOnline
+        workstation_online: result.workstationOnline,
+        // Gap detection fields - helps clients know if they missed messages
+        oldest_available_sequence: result.oldestAvailableSequence,
+        may_have_missed_messages: result.mayHaveMissedMessages
       });
     } catch (error) {
       return await handleError(error, reply, log);
@@ -545,13 +548,15 @@ var SECURITY_HEADERS = {
   // Content Security Policy
   "Content-Security-Policy": [
     "default-src 'self'",
-    "script-src 'self'",
+    // Allow wasm-unsafe-eval for WebAssembly (audio processing libraries)
+    "script-src 'self' 'wasm-unsafe-eval'",
     "style-src 'self' 'unsafe-inline'",
     // unsafe-inline needed for Tailwind
     "img-src 'self' data: blob:",
     "font-src 'self'",
     "connect-src 'self' ws: wss:",
-    "media-src 'self' blob:",
+    // Allow data: URIs for audio (TTS responses are base64-encoded)
+    "media-src 'self' blob: data:",
     "worker-src 'self' blob:",
     "frame-ancestors 'none'",
     "base-uri 'self'",
@@ -1926,13 +1931,19 @@ var HttpClient = class _HttpClient {
   /**
    * Gets messages since a given sequence number.
    * Also cleans up expired messages.
+   * Returns both messages and metadata about potential gaps.
    */
   getMessagesSince(sinceSequence) {
     const now = Date.now();
     this._messageQueue = this._messageQueue.filter(
       (msg) => now - msg.timestamp.getTime() < _HttpClient.MESSAGE_TTL_MS
     );
-    return this._messageQueue.filter((msg) => msg.sequence > sinceSequence);
+    const cleanedQueue = this._messageQueue;
+    const messages = cleanedQueue.filter((msg) => msg.sequence > sinceSequence);
+    const firstMessage = cleanedQueue[0];
+    const oldestAvailableSequence = firstMessage !== void 0 ? firstMessage.sequence : null;
+    const mayHaveMissedMessages = sinceSequence > 0 && oldestAvailableSequence !== null && sinceSequence < oldestAvailableSequence - 1;
+    return { messages, oldestAvailableSequence, mayHaveMissedMessages };
   }
   /**
    * Clears messages up to a given sequence (acknowledged by client).
@@ -2107,24 +2118,34 @@ var HttpClientOperationsUseCase = class {
       return {
         messages: [],
         currentSequence: 0,
-        workstationOnline: false
+        workstationOnline: false,
+        oldestAvailableSequence: null,
+        mayHaveMissedMessages: false
       };
     }
     client.recordPoll();
     if (acknowledgeSequence !== void 0 && acknowledgeSequence > 0) {
       client.acknowledgeMessages(acknowledgeSequence);
     }
-    const messages = client.getMessagesSince(sinceSequence);
+    const { messages, oldestAvailableSequence, mayHaveMissedMessages } = client.getMessagesSince(sinceSequence);
     const workstation = this.workstationRegistry.get(client.tunnelId);
     const workstationOnline = workstation?.isOnline ?? false;
+    if (mayHaveMissedMessages) {
+      this.logger.warn(
+        { deviceId, sinceSequence, oldestAvailableSequence, currentSequence: client.currentSequence },
+        "HTTP client may have missed messages due to stale sequence"
+      );
+    }
     this.logger.debug(
-      { deviceId, sinceSequence, messageCount: messages.length, currentSequence: client.currentSequence },
+      { deviceId, sinceSequence, messageCount: messages.length, currentSequence: client.currentSequence, mayHaveMissedMessages },
       "HTTP client poll"
     );
     return {
       messages,
       currentSequence: client.currentSequence,
-      workstationOnline
+      workstationOnline,
+      oldestAvailableSequence,
+      mayHaveMissedMessages
     };
   }
   /**
@@ -2191,15 +2212,23 @@ var HttpClientOperationsUseCase = class {
     if (acknowledgeSequence !== void 0 && acknowledgeSequence > 0) {
       client.acknowledgeMessages(acknowledgeSequence);
     }
-    const messages = client.getMessagesSince(sinceSequence);
+    const { messages, oldestAvailableSequence, mayHaveMissedMessages } = client.getMessagesSince(sinceSequence);
+    if (mayHaveMissedMessages) {
+      this.logger.warn(
+        { deviceId, sinceSequence, oldestAvailableSequence, currentSequence: client.currentSequence },
+        "HTTP client may have missed messages due to stale sequence (with auth)"
+      );
+    }
     this.logger.debug(
-      { deviceId, sinceSequence, messageCount: messages.length, currentSequence: client.currentSequence },
+      { deviceId, sinceSequence, messageCount: messages.length, currentSequence: client.currentSequence, mayHaveMissedMessages },
       "HTTP client poll with auth"
     );
     return {
       messages,
       currentSequence: client.currentSequence,
-      workstationOnline: workstation.isOnline
+      workstationOnline: workstation.isOnline,
+      oldestAvailableSequence,
+      mayHaveMissedMessages
     };
   }
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiflis-io/tiflis-code-tunnel",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "Tunnel server for tiflis-code - reverse proxy for workstation connections",
   "author": "Roman Barinov <rbarinov@gmail.com>",
   "license": "FSL-1.1-NC",