@wix/himalaya-cli 0.991.0 → 0.993.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/dev-server/src/wix-hosts.d.ts

@@ -0,0 +1,58 @@
+/** Which hosts a WIX-SCOPED dev-server request may be sent to.
+ *
+ *  The dev-server does not merely forward these requests — it ATTACHES CREDENTIALS to them:
+ *  a minted anonymous visitor token, a signed-in member token, the developer's `wixSession2`
+ *  cookie. So the destination is not a detail. A wix-scoped request to any other host is those
+ *  credentials leaving for that host, from a server that binds `0.0.0.0` (it has to, to serve
+ *  simulators and physical devices) with no auth in front of it.
+ *
+ *  The serve plane states the same rule for its own bridge — `core/serve-runtime/src/wix-bridge.ts`
+ *  is "host-locked to www.wixapis.com — absolute URLs are rejected (no open proxy)". The
+ *  dev-server needs the ALLOWLIST form rather than that outright rejection, because absolute
+ *  URLs to other first-party hosts are a real, tested capability here: `users.wix.com` for
+ *  identity, `apps`/`bo`/`manage`/`support`/`www`.wix.com elsewhere in this package, and
+ *  `chat.nownia.com` for the Orion/Genie assistant — `orion-chat`'s `createConversation` sends
+ *  an absolute url there through `wixApi.call`, whose own comment records the contract
+ *  ("forwards this absolute, non-*.wix.com URL untouched"). Rejecting every absolute URL the way
+ *  the serve plane does would break both that and
+ *  "webWixCall preserves absolute Wix URLs for users.wix.com calls".
+ *
+ *  THE LIST IS NOT INVENTED HERE. It mirrors `WixRequestPolicyRules.isFirstPartyWixHost`, which
+ *  both natives already implement identically — `core/runtime/ios/HimalayaCore/Sources/
+ *  HimalayaCore/WixRequestPolicy.swift` and the Kotlin twin under `core/runtime/android`. That is
+ *  the platform's definition of "first party", so the web/dev arm has no business holding a
+ *  narrower one: a host the device may call is a host this bridge may call. `wix-hosts.test.ts`
+ *  pins the two together, so a root added natively cannot silently leave this arm behind — which
+ *  is exactly how `nownia.com` was missed the first time (codebot review on #3120).
+ *
+ *  PARSED, NEVER STRING-MATCHED. `apps/himi-owner-lite/dev/net-mocks.ts` records three spellings
+ *  that defeated an earlier host parse in this repo, and all three are why this reads
+ *  `new URL(...).hostname` instead of testing the raw text:
+ *
+ *    `https://www.wixapis.com@evil.example/x`  userinfo — the host is `evil.example`, and a
+ *                                              `startsWith`/`includes` test says "wixapis".
+ *    `https://www.wix.com\@evil.example/x`     a backslash ENDS THE AUTHORITY for http(s), so
+ *                                              the host really is `www.wix.com` and that is
+ *                                              really where the request goes — a hand-rolled
+ *                                              parser that splits on `/` disagrees.
+ *    `https:///x`                              an empty authority yields no host at all.
+ *
+ *  Judging the PARSED host cannot disagree with the connection that gets made, because `fetch`
+ *  resolves the same string through the same WHATWG parser. A regex over the text can, and that
+ *  divergence is the whole bug class.
+ *
+ *  This is a destination check, NOT an SSRF guard in the `net-guard.ts` sense: it does not
+ *  resolve the name or pin the address, so it does not close DNS rebinding. It does not need to
+ *  — the property wanted here is "these credentials only ever go to Wix", and a name that
+ *  resolves somewhere unexpected is still a name Wix controls. */
+/** Registrable suffixes whose hosts may receive wix-scoped, credential-bearing traffic.
+ *
+ *  Kept in lockstep with the natives' `isFirstPartyWixHost` roots — see the note above. */
+export declare const WIX_HOST_SUFFIXES: readonly ["wix.com", "wixapis.com", "nownia.com"];
+/** The host this url would actually be dialled on, lowercased — or `""` when it has none. */
+export declare function targetHost(raw: string): string;
+/** May a wix-scoped, credential-bearing request go to this url?
+ *
+ *  `https:` only: every legitimate target in this package is https, and a downgrade to `http:`
+ *  would put the very credentials this exists to protect on the wire in clear. */
+export declare function isWixTarget(raw: string): boolean;

package/dist/cli.mjs

@@ -15163,6 +15163,33 @@ var init_derive_transport_capability = __esm({
   }
 });
 
+// ../../core/dev-server/src/wix-hosts.ts
+function targetHost(raw) {
+  try {
+    return new URL(raw).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function isWixTarget(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  if (!host) return false;
+  return WIX_HOST_SUFFIXES.some((suffix) => host === suffix || host.endsWith(`.${suffix}`));
+}
+var WIX_HOST_SUFFIXES;
+var init_wix_hosts = __esm({
+  "../../core/dev-server/src/wix-hosts.ts"() {
+    WIX_HOST_SUFFIXES = ["wix.com", "wixapis.com", "nownia.com"];
+  }
+});
+
 // ../../core/dev-server/src/wix-member-login.ts
 var wix_member_login_exports = {};
 __export(wix_member_login_exports, {
@@ -15287,6 +15314,9 @@ async function memberDirectRegister(clientId, redirectUri, email, password, firs
 }
 async function webWixCall(method, path, body, token, cookie, forwardedHeaders = {}) {
   const url = /^https?:\/\//i.test(path) ? path : `${API}${path.startsWith("/") ? path : "/" + path}`;
+  if (!isWixTarget(url)) {
+    throw new Error(`refusing to send Wix credentials to a non-Wix host (${targetHost(url) || "no host"})`);
+  }
   const res = await fetch(url, {
     method,
     headers: {
@@ -15302,6 +15332,7 @@ async function webWixCall(method, path, body, token, cookie, forwardedHeaders =
 var API;
 var init_wix_member_login = __esm({
   "../../core/dev-server/src/wix-member-login.ts"() {
+    init_wix_hosts();
     API = "https://www.wixapis.com";
   }
 });
@@ -54515,7 +54546,7 @@ var init_site_oauth_client = __esm({
 
 // src/cli.ts
 import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync65, mkdirSync as mkdirSync25, writeFileSync as writeFileSync23, existsSync as existsSync54, rmSync as rmSync9, readdirSync as readdirSync25, statSync as statSync12, lstatSync as lstatSync6, accessSync, constants } from "node:fs";
-import { execFileSync as execFileSync7, spawnSync as spawnSync5 } from "node:child_process";
+import { execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn5 } from "node:child_process";
 import { createHash as createHash24, randomUUID as randomUUID3 } from "node:crypto";
 import { tmpdir as tmpdir5, homedir as homedir7, hostname } from "node:os";
 import { join as join51, resolve as resolve42, relative as relative8, basename as basename11, dirname as dirname30 } from "node:path";
@@ -58885,8 +58916,11 @@ async function fetchPackumentFrom(registry, fetchImpl, timeoutMs) {
   }
 }
 async function fetchCliPackument(fetchImpl = fetch, timeoutMs = DOCTOR_TIMEOUT_MS, env = process.env, scopedRegistry = npmScopedWixRegistry) {
+  const deadline = Date.now() + timeoutMs;
   for (const registry of registryCandidates(env, scopedRegistry())) {
-    const packument = await fetchPackumentFrom(registry, fetchImpl, timeoutMs);
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) break;
+    const packument = await fetchPackumentFrom(registry, fetchImpl, remaining);
     if (packument) return packument;
   }
   return void 0;
@@ -58926,7 +58960,7 @@ function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("
 }
 async function doctorVersionReport(running, fetchImpl = fetch, sdk = resolvedSdkVersion(), scopedRegistry = npmScopedWixRegistry) {
   const minimumSdk = "0.33.0";
-  const packument = await fetchCliPackument(fetchImpl, DOCTOR_TIMEOUT_MS, process.env, scopedRegistry);
+  const packument = await fetchCliPackument(fetchImpl, UPDATE_EXPLICIT_BUDGET_MS, process.env, scopedRegistry);
   const latest = packument?.latest;
   const publishedAt = packument?.time[running];
   const ageDays = ageInDays(publishedAt);
@@ -58958,6 +58992,10 @@ var CLI_PACKAGE = "@wix/himalaya-cli";
 var UNPUBLISHED_CLI_VERSION = "0.1.0";
 var UPDATE_MAX_AGE_DAYS = 7;
 var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var UPDATE_FOREGROUND_BUDGET_MS = 1500;
+var UPDATE_EXPLICIT_BUDGET_MS = 2e4;
+var UPDATE_BACKGROUND_BUDGET_MS = 6e4;
+var UPDATE_RETRY_AFTER_FAILURE_MS = 60 * 60 * 1e3;
 var UPDATE_SNOOZE_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_REEXEC_ENV = "HIMI_UPDATED_ONCE";
 function updateCachePath(env = process.env) {
@@ -58981,7 +59019,7 @@ function writeUpdateCache(path, cache) {
 function updateCheckSuppression(running, command, env = process.env, cwd = process.cwd()) {
   if (env[UPDATE_REEXEC_ENV] === "1") return "already-updated";
   if (env.HIMI_NO_UPDATE_CHECK === "1") return "opted-out";
-  if (command === "upgrade" || command === "doctor") return "own-command";
+  if (command === "upgrade" || command === "doctor" || command === UPDATE_REFRESH_COMMAND) return "own-command";
   if (running === UNPUBLISHED_CLI_VERSION) return "unpublished";
   if (isHimalayaMonorepoCheckout(cwd)) return "monorepo";
   return void 0;
@@ -59015,12 +59053,12 @@ function npmInstallArgs(registry, version2) {
   return ["i", "-g", `${CLI_PACKAGE}@${version2}`, `--registry=${pinned}`, `--@wix:registry=${pinned}`];
 }
 var INSTALLABLE_SPEC = /^(?:latest|\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/;
-function createUpdateRunner(spawn5 = spawnSync5) {
+function createUpdateRunner(spawn6 = spawnSync5) {
   return {
     install: async (registry, version2) => {
       if (!isTrustedRegistry(registry)) return { ok: false, detail: `refusing untrusted registry ${registry}` };
       if (!INSTALLABLE_SPEC.test(version2)) return { ok: false, detail: `refusing install spec ${JSON.stringify(version2)}` };
-      const result = spawn5("npm", npmInstallArgs(registry, version2), {
+      const result = spawn6("npm", npmInstallArgs(registry, version2), {
         // npm's stdout goes to OUR stderr: in `himi <cmd> --json | jq` (and `himi upgrade --json`) its
         // "added 212 packages" would otherwise land in stdout ahead of the envelope and break the
         // parse — the agent case this whole feature exists for (#2985 review). And no stdin: an
@@ -59169,6 +59207,49 @@ function upgradeEnvelope(outcome) {
     ...outcome.detail ? { detail: outcome.detail } : {}
   };
 }
+var UPDATE_REFRESH_COMMAND = "__refresh-update-cache";
+async function refreshUpdateCache(opts = {}) {
+  const env = opts.env ?? process.env;
+  const running = opts.running ?? cliVersion();
+  const cachePath = opts.cachePath ?? updateCachePath(env);
+  const packument = await fetchCliPackument(opts.fetchImpl ?? fetch, UPDATE_BACKGROUND_BUDGET_MS, env, opts.scopedRegistry);
+  if (!packument) return false;
+  const now = opts.now ?? Date.now();
+  writeUpdateCache(cachePath, {
+    ...readUpdateCache(cachePath),
+    running,
+    latest: packument.latest,
+    runningPublishedAt: packument.time[running],
+    checkedAt: new Date(now).toISOString()
+  });
+  return true;
+}
+function createUpdateRefreshSpawner(spawnFn = spawn5, execArgv = process.execArgv) {
+  return () => {
+    try {
+      const child = spawnFn(process.execPath, [...loaderArgs(execArgv), fileURLToPath24(import.meta.url), UPDATE_REFRESH_COMMAND], {
+        detached: true,
+        stdio: "ignore",
+        cwd: homedir7(),
+        env: process.env
+      });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  };
+}
+function loaderArgs(execArgv) {
+  const out = [];
+  for (let i = 0; i < execArgv.length; i++) {
+    const arg = execArgv[i];
+    if (/^--(import|loader|experimental-loader|require)=/.test(arg)) out.push(arg);
+    else if (/^(--import|--loader|--experimental-loader|--require|-r)$/.test(arg) && i + 1 < execArgv.length) out.push(arg, execArgv[++i]);
+  }
+  return out;
+}
+var spawnUpdateRefresh = createUpdateRefreshSpawner();
 async function maybeSelfUpdate(argv, io, opts = {}) {
   const env = opts.env ?? process.env;
   const running = opts.running ?? cliVersion();
@@ -59186,14 +59267,19 @@ async function maybeSelfUpdate(argv, io, opts = {}) {
   if (!describesThisBuild) runningPublishedAt = void 0;
   let answeredBy;
   let answeredLatest;
-  if (!fresh) {
-    const packument = await fetchCliPackument(opts.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env, opts.scopedRegistry);
+  const attemptedAt = cache.attemptedAt ? Date.parse(cache.attemptedAt) : Number.NaN;
+  const recentlyTried = cache.attemptedFor === running && Number.isFinite(attemptedAt) && now - attemptedAt < UPDATE_RETRY_AFTER_FAILURE_MS;
+  if (!fresh && !recentlyTried) {
+    const packument = await fetchCliPackument(opts.fetchImpl ?? fetch, UPDATE_FOREGROUND_BUDGET_MS, env, opts.scopedRegistry);
     if (packument) {
       latest = packument.latest;
       runningPublishedAt = packument.time[running];
       answeredBy = packument.registry;
       answeredLatest = packument.latest;
       writeUpdateCache(cachePath, { ...cache, running, checkedAt: new Date(now).toISOString(), latest, runningPublishedAt });
+    } else {
+      writeUpdateCache(cachePath, { ...cache, attemptedAt: new Date(now).toISOString(), attemptedFor: running });
+      (opts.spawnRefresh ?? spawnUpdateRefresh)();
     }
   }
   const ageDays = ageInDays(runningPublishedAt, now);
@@ -59237,7 +59323,7 @@ async function maybeSelfUpdate(argv, io, opts = {}) {
   }
   try {
     if (!answeredBy) {
-      const again = await fetchCliPackument(opts.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env, opts.scopedRegistry);
+      const again = await fetchCliPackument(opts.fetchImpl ?? fetch, UPDATE_EXPLICIT_BUDGET_MS, env, opts.scopedRegistry);
       answeredBy = again?.registry;
       answeredLatest = again?.latest;
     }
@@ -64726,6 +64812,11 @@ ${label2}`);
         });
         return 0;
       }
+      case UPDATE_REFRESH_COMMAND: {
+        const up = deps.selfUpdate ?? {};
+        await refreshUpdateCache({ env: up.env, fetchImpl: up.fetchImpl, cachePath: up.cachePath, scopedRegistry: up.scopedRegistry, now: up.now, running: up.running });
+        return 0;
+      }
       case "upgrade": {
         const up = deps.selfUpdate ?? {};
         const runner2 = up.runner ?? defaultUpdateRunner;
@@ -64741,7 +64832,7 @@ ${label2}`);
         }
         try {
           const scoped = up.scopedRegistry ?? npmScopedWixRegistry;
-          const answered = await fetchCliPackument(up.fetchImpl ?? fetch, DOCTOR_TIMEOUT_MS, env, scoped);
+          const answered = await fetchCliPackument(up.fetchImpl ?? fetch, UPDATE_EXPLICIT_BUDGET_MS, env, scoped);
           const registry = answered?.registry ?? registryCandidates(env, scoped())[0];
           if (answered?.latest && compareVersions2(answered.latest, before) <= 0) {
             if (flags.json) print({ ok: true, running: before, installed: before, changed: false, registry, latest: answered.latest });
@@ -65228,6 +65319,10 @@ export {
   PREVIEW_TOKEN_NOTE,
   PUBLIC_NPM_REGISTRY,
   PUBLIC_WIX_API_BASE,
+  UPDATE_BACKGROUND_BUDGET_MS,
+  UPDATE_EXPLICIT_BUDGET_MS,
+  UPDATE_FOREGROUND_BUDGET_MS,
+  UPDATE_REFRESH_COMMAND,
   WIX_NPM_MIRROR,
   acquireUpdateLock,
   ageInDays,
@@ -65235,6 +65330,7 @@ export {
   buildDoctorReport,
   compareVersions2 as compareVersions,
   createScopedRegistryResolver,
+  createUpdateRefreshSpawner,
   createUpdateRunner,
   credentialKind,
   credentialSwapNotice,
@@ -65257,6 +65353,7 @@ export {
   isLoopbackBase,
   isPublicTarget,
   isTrustedRegistry,
+  loaderArgs,
   loginModeMark,
   loginModeReport,
   loopbackTargetWarning,
@@ -65286,6 +65383,7 @@ export {
   probeReachable,
   pushAuthHint,
   readUpdateCache,
+  refreshUpdateCache,
   registryCandidates,
   renderDataSource,
   renderDeviceWidths,
@@ -65297,6 +65395,7 @@ export {
   serveUnreachableHint,
   servesAll,
   shellShaDivergenceWarnings,
+  spawnUpdateRefresh,
   staleUpdateLockFile,
   switchFlagErrors,
   templatePreviewAuthError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.991.0",
+  "version": "0.993.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "ebb2d80b9a686fc18878c48955d691cd014019a04d2ed731b2a431dd"
+  "falconPackageHash": "65760e4588c44ee36e6538fcc1bf8802e544b4045157544b3f4d0d94"
 }