@vibedeckx/linux-x64 0.2.12 → 0.2.13

package/dist/bin.js

@@ -238010,6 +238010,20 @@ var import_fastify_plugin23 = __toESM(require_plugin2(), 1);
 import { randomBytes as randomBytes2, createHash as createHash3, verify as cryptoVerify } from "crypto";
 var MACHINE_HANDSHAKE_TIMEOUT_MS = 5e3;
 var routes22 = async (fastify2) => {
+  fastify2.get("/api/reverse-connect/identity", async (req, reply) => {
+    const token = req.headers["x-vibedeckx-connect-token"];
+    if (typeof token !== "string" || token.length === 0) {
+      return reply.code(401).send({ error: "Connect token required" });
+    }
+    const server = await fastify2.storage.remoteServers.getByToken(token);
+    if (!server) {
+      return reply.code(401).send({ error: "Invalid token" });
+    }
+    if (server.connection_mode !== "inbound") {
+      return reply.code(403).send({ error: "Server is not configured for inbound connections" });
+    }
+    return { serverId: server.id, name: server.name };
+  });
   fastify2.after(() => {
     fastify2.get(
       "/api/reverse-connect",
@@ -241163,6 +241177,10 @@ var createServer = async (opts) => {
     if (!API_KEY) return done();
     if (!req.url.startsWith("/api/")) return done();
     if (req.method === "OPTIONS") return done();
+    const pathname = req.url.split("?")[0];
+    if (pathname === "/api/config" || pathname === "/api/reverse-connect/identity") {
+      return done();
+    }
     const providedKey = req.headers["x-vibedeckx-api-key"] || req.query?.apiKey;
     if (!providedKey && authEnabled) {
       return done();
@@ -241204,7 +241222,12 @@ var createServer = async (opts) => {
   server.get("/api/config", async () => ({
     authEnabled,
     clerkPublishableKey: authEnabled ? process.env.CLERK_PUBLISHABLE_KEY : void 0,
-    localProjectsEnabled: !noLocalProjects
+    localProjectsEnabled: !noLocalProjects,
+    // Capability flag for the reverse-connect identity preflight. Workers
+    // check this before calling /api/reverse-connect/identity so an auth
+    // middleware 401 from an older hub (which lacks the endpoint AND its
+    // exemptions) is never confused with a genuinely rejected token.
+    reverseConnectIdentity: true
   }));
   server.register(shared_services_default, { storage: opts.storage, authEnabled });
   server.register(import_websocket2.default);
@@ -241215,6 +241238,7 @@ var createServer = async (opts) => {
     server.decorateRequest("auth", null);
     server.addHook("preHandler", async (req, reply) => {
       if (req.headers.upgrade?.toLowerCase() === "websocket") return;
+      if (req.url.split("?")[0] === "/api/reverse-connect/identity") return;
       const headers = new Headers();
       for (const [key, value] of Object.entries(req.headers)) {
         if (value) headers.set(key, Array.isArray(value) ? value.join(",") : String(value));
@@ -241760,6 +241784,69 @@ import { spawn as spawn5 } from "node:child_process";
 import { randomUUID as randomUUID22 } from "node:crypto";
 import fs7 from "node:fs";
 import path19 from "node:path";
+
+// src/update-check.ts
+var SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/;
+async function fetchLatestPublishedVersion(pkg = "vibedeckx", fetchImpl = fetch) {
+  try {
+    const response = await fetchImpl(
+      `https://registry.npmjs.org/${pkg}/latest`,
+      { signal: AbortSignal.timeout(4e3) }
+    );
+    if (!response.ok) return void 0;
+    const body = await response.json();
+    return typeof body.version === "string" && parseSemver(body.version) ? body.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseSemver(version2) {
+  const match2 = SEMVER_RE.exec(version2);
+  if (!match2) return void 0;
+  return {
+    core: [match2[1], match2[2], match2[3]],
+    prerelease: match2[4]?.split(".")
+  };
+}
+function compareNumericStrings(a, b2) {
+  if (a.length !== b2.length) return a.length - b2.length;
+  return a < b2 ? -1 : a > b2 ? 1 : 0;
+}
+function comparePrereleaseIdentifiers(a, b2) {
+  const aNumeric = /^\d+$/.test(a);
+  const bNumeric = /^\d+$/.test(b2);
+  if (aNumeric && bNumeric) return compareNumericStrings(a, b2);
+  if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+  return a < b2 ? -1 : a > b2 ? 1 : 0;
+}
+function compareSemver(a, b2) {
+  for (let i = 0; i < 3; i += 1) {
+    const compared = compareNumericStrings(a.core[i], b2.core[i]);
+    if (compared !== 0) return compared;
+  }
+  if (!a.prerelease && !b2.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b2.prerelease) return -1;
+  const length = Math.max(a.prerelease.length, b2.prerelease.length);
+  for (let i = 0; i < length; i += 1) {
+    const aId = a.prerelease[i];
+    const bId = b2.prerelease[i];
+    if (aId === void 0) return -1;
+    if (bId === void 0) return 1;
+    const compared = comparePrereleaseIdentifiers(aId, bId);
+    if (compared !== 0) return compared;
+  }
+  return 0;
+}
+function compareUpdateStatus(current, latest) {
+  if (latest === void 0) return "unknown";
+  const currentParsed = parseSemver(current);
+  const latestParsed = parseSemver(latest);
+  if (!currentParsed || !latestParsed) return "unknown";
+  return compareSemver(latestParsed, currentParsed) > 0 ? "update-available" : "up-to-date";
+}
+
+// src/connect-daemon.ts
 var CONNECT_DAEMON_CHILD_ENV = "VIBEDECKX_INTERNAL_CONNECT_DAEMON";
 var CONNECT_DAEMON_TOKEN_ENV = "VIBEDECKX_INTERNAL_CONNECT_TOKEN";
 function buildDaemonChildArgs(argv) {
@@ -242307,18 +242394,31 @@ function inspectDaemonState(dataDir) {
   const actualTicks = readLinuxProcessStartTicks(parsed.pid);
   return actualTicks === parsed.processStartTicks ? { kind: "running", state: parsed } : { kind: "stale", state: parsed };
 }
-function describeConnectDaemon(dataDir) {
+function describeUpdateStatus(current, latest) {
+  switch (compareUpdateStatus(current, latest)) {
+    case "update-available":
+      return `(update available: ${latest})`;
+    case "up-to-date":
+      return "(up to date)";
+    case "unknown":
+      return "(update check failed)";
+  }
+}
+async function describeConnectDaemon(dataDir, fetchLatestVersion = fetchLatestPublishedVersion) {
   const inspection = inspectDaemonState(dataDir);
   switch (inspection.kind) {
-    case "running":
+    case "running": {
+      const latest = await fetchLatestVersion();
       return {
         exitCode: 0,
         message: [
           `Running (PID ${inspection.state.pid}, since ${inspection.state.startedAt})`,
+          `Version: ${inspection.state.version} ${describeUpdateStatus(inspection.state.version, latest)}`,
           `Target: ${inspection.state.connectTo}`,
           `Logs: ${path19.join(dataDir, "logs", "vibedeckx.log")}`
         ].join("\n")
       };
+    }
     case "missing":
       return { exitCode: 1, message: "Vibedeckx connect is not running" };
     case "stale":
@@ -242541,6 +242641,78 @@ function removeVerifiedStaleStateUnlocked(dataDir) {
   }
 }
 
+// src/connect-preflight.ts
+var CONNECT_IDENTITY_HEADER = "x-vibedeckx-connect-token";
+var PINNED_IDENTITY_SETTING_PREFIX = "reverse_pinned_identity:";
+function canonicalizeHubUrl(raw) {
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    throw new Error(`Invalid --connect-to URL: ${raw}`);
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+    throw new Error(`--connect-to must be an http(s) URL, got: ${raw}`);
+  }
+  const pathname = url2.pathname.replace(/\/+$/, "");
+  return `${url2.origin}${pathname}`;
+}
+function parsePin(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object") return parsed;
+  } catch {
+  }
+  return {};
+}
+async function preflightIdentityCheck(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const hubUrl = canonicalizeHubUrl(opts.connectTo);
+  let config2;
+  try {
+    const res2 = await fetchImpl(`${hubUrl}/api/config`);
+    if (res2.ok) config2 = await res2.json();
+  } catch {
+  }
+  if (config2?.reverseConnectIdentity !== true) return { checked: false };
+  const res = await fetchImpl(`${hubUrl}/api/reverse-connect/identity`, {
+    headers: { [CONNECT_IDENTITY_HEADER]: opts.token }
+  });
+  if (res.status === 401) {
+    throw new Error("Connect token was rejected by the server (invalid or revoked)");
+  }
+  if (res.status === 403) {
+    throw new Error("This token's remote is not configured for inbound connections");
+  }
+  if (!res.ok) {
+    throw new Error(`Identity preflight failed with status ${res.status}`);
+  }
+  const body = await res.json();
+  if (!body || typeof body.serverId !== "string" || body.serverId.length === 0) {
+    throw new Error("Malformed identity response from server");
+  }
+  const identity = { serverId: body.serverId, name: body.name ?? "" };
+  const key = `${PINNED_IDENTITY_SETTING_PREFIX}${hubUrl}`;
+  const desired = JSON.stringify(identity);
+  if (opts.force) {
+    await opts.settings.set(key, desired);
+    return { checked: true, identity };
+  }
+  const persisted = await opts.settings.getOrCreate(key, () => desired);
+  const pinned = parsePin(persisted);
+  if (pinned.serverId && pinned.serverId !== identity.serverId) {
+    const pinnedLabel = pinned.name || pinned.serverId;
+    const tokenLabel = identity.name || identity.serverId;
+    throw new Error(
+      `This machine previously served remote "${pinnedLabel}" on ${hubUrl}, but the provided token belongs to "${tokenLabel}". If this is intentional, re-run with --force to re-pin.`
+    );
+  }
+  if (!pinned.serverId || pinned.name !== identity.name) {
+    await opts.settings.set(key, desired);
+  }
+  return { checked: true, identity };
+}
+
 // ../../node_modules/.pnpm/open@10.2.0/node_modules/open/index.js
 import process8 from "node:process";
 import { Buffer as Buffer2 } from "node:buffer";
@@ -243237,6 +243409,11 @@ var connectCommand = buildCommand({
         brief: "Run in the background after initialization (Linux only)",
         optional: true
       },
+      force: {
+        kind: "boolean",
+        brief: "Re-pin this machine to the token's remote, overriding the pinned-identity mismatch guard",
+        optional: true
+      },
       port: {
         kind: "parsed",
         parse: parseInt,
@@ -243336,6 +243513,17 @@ var connectCommand = buildCommand({
       console.log("Starting vibedeckx in reverse-connect mode...");
       const dbPath = path21.join(dataDir, "data.sqlite");
       storage = await createSqliteStorage(dbPath);
+      const preflight = await preflightIdentityCheck({
+        connectTo: flags["connect-to"],
+        token,
+        settings: storage.settings,
+        force: flags.force ?? false
+      });
+      if (preflight.checked && preflight.identity) {
+        console.log(
+          `Remote identity verified: ${preflight.identity.name || preflight.identity.serverId}`
+        );
+      }
       server = await createServer({
         storage,
         acceptRemote: true,
@@ -243408,7 +243596,9 @@ var connectStatusCommand = buildCommand({
   parameters: { flags: connectManagementFlags },
   func: async (flags) => {
     assertConnectDaemonPlatform();
-    const result = describeConnectDaemon(flags["data-dir"] ?? VIBEDECKX_HOME);
+    const result = await describeConnectDaemon(
+      flags["data-dir"] ?? VIBEDECKX_HOME
+    );
     return reportDaemonCommandResult(result);
   },
   docs: { brief: "Show the connect daemon status" }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibedeckx/linux-x64",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Vibedeckx platform binaries for Linux x64",
   "os": [
     "linux"