@townco/cli 0.1.117 → 0.1.118

package/dist/commands/run-wrapper.d.ts

@@ -8,6 +8,7 @@ declare const _default: {
         readonly prompt: string | undefined;
         readonly port: number | undefined;
         readonly noSession: true | undefined;
+        readonly proxy: true | undefined;
     }, ["matched", string] | ["parsing", {
         readonly command: "run";
         readonly name: import("@optique/core").ValueParserResult<string> | undefined;
@@ -17,6 +18,7 @@ declare const _default: {
         readonly prompt: [import("@optique/core").ValueParserResult<string> | undefined] | undefined;
         readonly port: [import("@optique/core").ValueParserResult<number> | undefined] | undefined;
         readonly noSession: [import("@optique/core").ValueParserResult<true> | undefined] | undefined;
+        readonly proxy: [import("@optique/core").ValueParserResult<true> | undefined] | undefined;
     }] | undefined>;
     impl: (def: {
         readonly command: "run";
@@ -27,6 +29,7 @@ declare const _default: {
         readonly prompt: string | undefined;
         readonly port: number | undefined;
         readonly noSession: true | undefined;
+        readonly proxy: true | undefined;
     }) => unknown;
 };
 export default _default;

package/dist/commands/run-wrapper.js

@@ -12,14 +12,16 @@ export default createCommand({
         prompt: optional(argument(string({ metavar: "PROMPT" }))),
         port: optional(option("-p", "--port", integer())),
         noSession: optional(flag("--no-session")),
+        proxy: optional(flag("--proxy")),
     }), { brief: message `Run an agent.` }),
-    impl: async ({ name, http, gui, cli, prompt, port, noSession }) => {
+    impl: async ({ name, http, gui, cli, prompt, port, noSession, proxy }) => {
         const options = {
             name,
             http: http === true,
             gui: gui === true,
             cli: cli === true,
             noSession: noSession === true,
+            proxy: proxy === true,
         };
         if (prompt !== null && prompt !== undefined) {
             options.prompt = prompt;

package/dist/commands/run.d.ts

@@ -6,5 +6,6 @@ export interface RunCommandOptions {
     prompt?: string;
     port?: number;
     noSession?: boolean;
+    proxy?: boolean;
 }
 export declare function runCommand(options: RunCommandOptions): Promise<void>;

package/dist/commands/run.js

@@ -13,6 +13,7 @@ import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { LogsPane } from "../components/LogsPane.js";
 import { TabbedOutput } from "../components/TabbedOutput.js";
 import { ensurePortAvailable } from "../lib/port-utils.js";
+import { createProxyServer } from "../lib/proxy-server.js";
 function TuiRunner({ agentPath, workingDir, agentName, noSession, onExit, }) {
     const [client, setClient] = useState(null);
     const [error, setError] = useState(null);
@@ -82,15 +83,15 @@ function TuiRunner({ agentPath, workingDir, agentName, noSession, onExit, }) {
     ], [client, error, workingDir]);
     return (_jsx(TabbedOutput, { processes: [], customTabs: customTabs, onExit: onExit }));
 }
-function GuiRunner({ agentProcess, guiProcess, agentPort, agentPath, logger, onExit, }) {
+function GuiRunner({ agentProcess, guiProcess, agentPort, browserPort, agentPath, logger, onExit, }) {
     const browserOpenedRef = useRef(false);
-    const handlePortDetected = useCallback((processIndex, port) => {
+    const handlePortDetected = useCallback((processIndex, _port) => {
         // Process index 1 is the GUI process
         if (processIndex === 1) {
-            // Open browser once we know the actual port
+            // Open browser once we know the GUI is ready
             if (!browserOpenedRef.current) {
                 browserOpenedRef.current = true;
-                const guiUrl = `http://localhost:${port}`;
+                const guiUrl = `http://localhost:${browserPort}`;
                 logger.info("Opening browser", { url: guiUrl });
                 open(guiUrl).catch((error) => {
                     logger.warn("Could not automatically open browser", {
@@ -100,7 +101,7 @@ function GuiRunner({ agentProcess, guiProcess, agentPort, agentPath, logger, onE
                 });
             }
         }
-    }, [logger]);
+    }, [logger, browserPort]);
     // Memoize processes array based only on actual process objects and initial ports
     // Don't include guiPort as dependency to prevent re-creating array when port is detected
     // TabbedOutput will update the displayed port internally via onPortDetected callback
@@ -374,7 +375,7 @@ async function runCliMode(options) {
     }
 }
 export async function runCommand(options) {
-    const { name, http = false, gui = false, cli = false, prompt, port = 3100, noSession = false, } = options;
+    const { name, http = false, gui = false, cli = false, prompt, port = 3100, noSession = false, proxy = false, } = options;
     // Check if we're inside a Town project
     const projectRoot = await isInsideTownProject();
     if (projectRoot === null) {
@@ -512,9 +513,15 @@ export async function runCommand(options) {
         }
         // Ensure agent and GUI ports are available (debugger ports already checked above)
         const guiPort = 5173;
+        const proxyPort = process.env.TOWN_AGENT_PROXY_PORT
+            ? Number.parseInt(process.env.TOWN_AGENT_PROXY_PORT, 10)
+            : 3500;
         try {
             await ensurePortAvailable(port, "agent HTTP server");
             await ensurePortAvailable(guiPort, "GUI dev server");
+            if (proxy) {
+                await ensurePortAvailable(proxyPort, "reverse proxy");
+            }
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
@@ -524,10 +531,18 @@ export async function runCommand(options) {
         logger.info("Starting GUI mode", {
             agentPort: port,
             guiPort,
+            ...(proxy ? { proxyPort } : {}),
         });
         console.log(`Starting agent "${name}" with GUI...`);
-        console.log(`Agent HTTP server will run on port ${port}`);
-        console.log(`GUI dev server will run on port ${guiPort}\n`);
+        if (proxy) {
+            console.log(`Proxy server running on port ${proxyPort}`);
+            console.log(`  - GUI: http://localhost:${proxyPort}/`);
+            console.log(`  - Agent API: http://localhost:${proxyPort}/rpc\n`);
+        }
+        else {
+            console.log(`GUI: http://localhost:${guiPort}/`);
+            console.log(`Agent API: http://localhost:${port}/rpc\n`);
+        }
         // Set stdin to raw mode for Ink
         if (process.stdin.isTTY) {
             process.stdin.setRawMode(true);
@@ -551,13 +566,17 @@ export async function runCommand(options) {
         if (process.env.BIND_HOST) {
             viteArgs.push("--host", process.env.BIND_HOST);
         }
+        // When proxy is enabled, GUI talks to proxy; otherwise directly to agent
+        const agentUrl = proxy
+            ? `http://localhost:${proxyPort}`
+            : `http://localhost:${port}`;
         const guiProcess = spawn("bunx", viteArgs, {
             cwd: guiPath,
             stdio: ["ignore", "pipe", "pipe"], // Pipe stdout/stderr for capture
             env: {
                 ...process.env,
                 ...configEnvVars,
-                VITE_AGENT_URL: `${process.env.EXT_HOST || "http://localhost"}:${port}`,
+                VITE_AGENT_URL: process.env.EXT_HOST ?? agentUrl,
                 VITE_DEBUGGER_URL: `http://localhost:${debuggerUiPort}`,
                 // If agent uses library MCP, pass LIBRARY_API_URL to GUI for auth
                 ...(usesLibraryMcp &&
@@ -567,12 +586,32 @@ export async function runCommand(options) {
                 }),
             },
         });
-        // Setup cleanup handlers for agent and GUI processes
+        // Start the reverse proxy server if enabled
+        const proxyServer = proxy
+            ? createProxyServer({
+                port: proxyPort,
+                vitePort: guiPort,
+                agentPort: port,
+                basicAuthUser: process.env.BASIC_AUTH_USER,
+                basicAuthPass: process.env.BASIC_AUTH_PASS,
+                logger,
+            })
+            : null;
+        // Setup cleanup handlers for agent, GUI, and proxy processes
         let isCleaningUp = false;
         const cleanupProcesses = () => {
             if (isCleaningUp)
                 return;
             isCleaningUp = true;
+            // Stop proxy server if running
+            if (proxyServer) {
+                try {
+                    proxyServer.stop();
+                }
+                catch (_e) {
+                    // Proxy may already be stopped
+                }
+            }
             // Kill child processes - since they're not detached, they're in our process group
             try {
                 agentProcess.kill("SIGTERM");
@@ -600,7 +639,9 @@ export async function runCommand(options) {
             cleanupDebugger?.();
         };
         // Render the tabbed UI with dynamic port detection
-        const { waitUntilExit } = render(_jsx(GuiRunner, { agentProcess: agentProcess, guiProcess: guiProcess, agentPort: port, agentPath: agentPath, logger: logger, onExit: () => {
+        // Browser opens to proxy port if enabled, otherwise to GUI port
+        const browserPort = proxy ? proxyPort : guiPort;
+        const { waitUntilExit } = render(_jsx(GuiRunner, { agentProcess: agentProcess, guiProcess: guiProcess, agentPort: port, browserPort: browserPort, agentPath: agentPath, logger: logger, onExit: () => {
                 cleanupProcesses();
             } }));
         // Register signal handlers AFTER Ink render to ensure they take precedence

package/dist/lib/proxy-server.d.ts

@@ -0,0 +1,15 @@
+import http from "node:http";
+import type { createLogger } from "@townco/core";
+export interface ProxyServerOptions {
+    port: number;
+    vitePort: number;
+    agentPort: number;
+    basicAuthUser: string | undefined;
+    basicAuthPass: string | undefined;
+    logger: ReturnType<typeof createLogger>;
+}
+export interface ProxyServer {
+    server: http.Server;
+    stop: () => Promise<void>;
+}
+export declare function createProxyServer(options: ProxyServerOptions): ProxyServer;

package/dist/lib/proxy-server.js

@@ -0,0 +1,96 @@
+import crypto from "node:crypto";
+import http from "node:http";
+import httpProxy from "http-proxy";
+// Agent routes that should be proxied to the agent server
+const AGENT_ROUTES = [
+    "/rpc",
+    "/events",
+    "/health",
+    "/sessions",
+    "/sandbox",
+    "/static",
+    "/logs",
+];
+function timingSafeEqual(a, b) {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    // timingSafeEqual requires equal lengths, so pad the shorter buffer
+    const maxLen = Math.max(aBuf.length, bBuf.length);
+    const paddedA = Buffer.alloc(maxLen);
+    const paddedB = Buffer.alloc(maxLen);
+    aBuf.copy(paddedA);
+    bBuf.copy(paddedB);
+    // Always do both comparisons to avoid leaking length information via timing
+    const lengthsMatch = aBuf.length === bBuf.length;
+    const contentsMatch = crypto.timingSafeEqual(paddedA, paddedB);
+    return lengthsMatch && contentsMatch;
+}
+function getTarget(pathname, options) {
+    // Check for agent routes
+    for (const route of AGENT_ROUTES) {
+        if (pathname === route || pathname.startsWith(`${route}/`)) {
+            return `http://localhost:${options.agentPort}`;
+        }
+    }
+    // Default: Vite server
+    return `http://localhost:${options.vitePort}`;
+}
+export function createProxyServer(options) {
+    const { port, basicAuthUser, basicAuthPass, logger } = options;
+    const proxy = httpProxy.createProxyServer({
+        ws: true,
+        changeOrigin: true,
+        // Don't add X-Forwarded headers
+        xfwd: false,
+    });
+    // Handle proxy errors
+    proxy.on("error", (err, req, res) => {
+        logger.error("Proxy error", { error: err.message, url: req.url });
+        if (res && "writeHead" in res) {
+            res.writeHead(502, {
+                "Content-Type": "text/plain",
+            });
+            res.end("Bad Gateway");
+        }
+    });
+    // Build expected auth header if auth is configured
+    const expectedAuth = basicAuthUser && basicAuthPass
+        ? `Basic ${Buffer.from(`${basicAuthUser}:${basicAuthPass}`).toString("base64")}`
+        : null;
+    const server = http.createServer((req, res) => {
+        // Basic auth check
+        if (expectedAuth) {
+            const authHeader = req.headers.authorization ?? "";
+            if (!timingSafeEqual(authHeader, expectedAuth)) {
+                res.statusCode = 401;
+                res.setHeader("WWW-Authenticate", "Basic");
+                res.end("Unauthorized");
+                return;
+            }
+        }
+        const url = new URL(req.url || "/", `http://localhost:${port}`);
+        const target = getTarget(url.pathname, options);
+        // Proxy the request
+        proxy.web(req, res, { target });
+    });
+    // Handle WebSocket upgrades (for Vite HMR)
+    server.on("upgrade", (req, socket, head) => {
+        // WebSocket upgrades go to Vite for HMR
+        // Note: We don't do auth on WebSocket upgrades since Vite HMR is internal
+        const viteTarget = `http://localhost:${options.vitePort}`;
+        proxy.ws(req, socket, head, { target: viteTarget });
+    });
+    server.on("error", (err) => {
+        logger.error("Proxy server error", { error: err.message, port });
+    });
+    server.listen(port, () => {
+        logger.info("Proxy server started", { port });
+    });
+    const stop = () => {
+        return new Promise((resolve) => {
+            proxy.close();
+            server.close(() => resolve());
+        });
+    };
+    return { server, stop };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@townco/cli",
-  "version": "0.1.117",
+  "version": "0.1.118",
   "type": "module",
   "bin": {
     "town": "./dist/index.js"
@@ -15,22 +15,23 @@
     "build": "tsgo"
   },
   "devDependencies": {
-    "@townco/tsconfig": "0.1.109",
+    "@townco/tsconfig": "0.1.110",
     "@types/archiver": "^7.0.0",
     "@types/bun": "^1.3.1",
+    "@types/http-proxy": "^1.17.14",
     "@types/ignore-walk": "^4.0.3",
     "@types/react": "^19.2.2"
   },
   "dependencies": {
     "@optique/core": "^0.6.2",
     "@optique/run": "^0.6.2",
-    "@townco/agent": "0.1.120",
-    "@townco/apiclient": "0.0.32",
-    "@townco/core": "0.0.90",
-    "@townco/debugger": "0.1.68",
-    "@townco/env": "0.1.62",
-    "@townco/secret": "0.1.112",
-    "@townco/ui": "0.1.112",
+    "@townco/agent": "0.1.121",
+    "@townco/apiclient": "0.0.33",
+    "@townco/core": "0.0.91",
+    "@townco/debugger": "0.1.69",
+    "@townco/env": "0.1.63",
+    "@townco/secret": "0.1.113",
+    "@townco/ui": "0.1.113",
     "@trpc/client": "^11.7.2",
     "archiver": "^7.0.1",
     "eventsource": "^4.1.0",
@@ -41,6 +42,7 @@
     "open": "^10.2.0",
     "superjson": "^2.2.5",
     "ts-pattern": "^5.9.0",
+    "http-proxy": "^1.18.1",
     "zod": "^4.1.12"
   },
   "peerDependencies": {