@workflow-code/cli 0.2.4-20261010004.codex-cli-web → 0.2.4-20261011002.codex-cli-web

package/dist/index.js

@@ -24,7 +24,7 @@ async function main(argv = process.argv.slice(2)) {
   const prepared = prepareCliInvocation(argv);
   argv = prepared.argv;
   if (argv[0] === "web") {
-    const webCli = await import("./web-KUC6BL6E.js");
+    const webCli = await import("./web-6FYGFQH2.js");
     return webCli.main(argv.slice(1));
   }
   if (argv[0] === "workspace") {

package/dist/web/workflow-ui.js

@@ -4183,10 +4183,13 @@ ${state.user?.avatarUrl ?? ""}`;
         try {
           if (this.token) {
             const session2 = await fetch("/api/session", { method: "POST", headers: { Authorization: `Bearer ${this.token}` }, signal: AbortSignal.timeout(1e4) });
-            if (!session2.ok) {
+            if (session2.status === 401) {
               this.update("expired");
               return;
             }
+            if (!session2.ok) {
+              throw new Error("Cannot connect to the project.");
+            }
           }
           const session = await fetch("/api/session", { headers: this.headers(), signal: AbortSignal.timeout(1e4) });
           if (session.status === 401) {

package/dist/{web-KUC6BL6E.js → web-6FYGFQH2.js}

@@ -699,8 +699,29 @@ function createWebRuntime(projectDir, storageDir, connection) {
       return;
     }
     const auth = connection();
-    const env = { ...process.env, WORKFLOW_RUNTIME_PLATFORM: "cli", WORKFLOW_SERVER_URL: auth?.serverUrl ?? "", WORKFLOW_SERVER_ADMIN_KEY: auth?.accessToken ?? "" };
-    for (const key of ["TSX_TSCONFIG_PATH", "WORKFLOW_LOCAL_CORE_ROOT", "WORKFLOW_LOCAL_SHARED_ROOT", "WORKFLOW_LOCAL_SOURCE_MODE"]) {
+    if ((request.method === "run" || request.method === "resolve") && request.project?.requiresLogin && !auth) {
+      reject(new Error("Workflow Server login is not configured."));
+      return;
+    }
+    const env = {
+      ...process.env,
+      WORKFLOW_RUNTIME_PLATFORM: "cli",
+      WORKFLOW_SERVER_URL: auth?.serverUrl ?? "",
+      WORKFLOW_SERVER_ADMIN_KEY: auth?.accessToken ?? "",
+      WORKFLOW_SERVER_TOKEN: "",
+      WORKFLOW_LLM_SERVER_URL: auth?.serverUrl ?? "",
+      WORKFLOW_LLM_SERVER_TOKEN: auth?.accessToken ?? "",
+      WORKFLOW_CLI_AUTH_DIR: path.join(storageDir, "runtime-auth")
+    };
+    for (const key of [
+      "TSX_TSCONFIG_PATH",
+      "WORKFLOW_LOCAL_CORE_ROOT",
+      "WORKFLOW_LOCAL_SHARED_ROOT",
+      "WORKFLOW_LOCAL_SOURCE_MODE",
+      "WORKFLOW_DEVELOPER_ASSISTANT_HOST",
+      "WORKFLOW_DEVELOPER_ASSISTANT_WORKDIR",
+      "WORKFLOW_DEVELOPER_ASSISTANT_WORKSPACE_MANIFEST"
+    ]) {
       delete env[key];
     }
     if (env.NODE_OPTIONS) {
@@ -978,6 +999,7 @@ async function startWebServer(options) {
   let hostConnection = options.host?.connection;
   let hostManaged = !!hostConnection;
   let authEpoch = 0;
+  let authCheck;
   const sensitiveTokens = /* @__PURE__ */ new Set();
   const runtime = options.runtime ?? createWebRuntime(projectDir, storageDir, () => connection);
   let inspected;
@@ -1067,12 +1089,12 @@ async function startWebServer(options) {
     }
   });
   const refreshAuth = async (force = false) => {
-    if (passwordLogin || login) {
+    if ((passwordLogin || login) && !force) {
       return;
     }
-    const epoch = ++authEpoch;
+    const readingEpoch = authEpoch;
     const config = await readCliAuthConfig();
-    if (epoch !== authEpoch) {
+    if (readingEpoch !== authEpoch) {
       return;
     }
     const serverUrl = hostManaged ? hostConnection?.serverUrl : process.env.WORKFLOW_SERVER_URL ?? config.serverUrl;
@@ -1082,31 +1104,45 @@ async function startWebServer(options) {
     }
     const identity = signedOut ? "" : `${serverUrl}
 ${token}`;
-    if (!force && identity === authIdentity && account.status !== "checking") {
+    const expired = account.expiresAt && Date.parse(account.expiresAt) <= Date.now();
+    if (!force && identity === authIdentity && account.status !== "error" && !expired) {
       return;
     }
+    const epoch = ++authEpoch;
+    authCheck?.abort();
+    const check = authCheck = new AbortController();
     const changed = identity !== authIdentity;
     authIdentity = identity;
-    connection = !signedOut && serverUrl && token ? { serverUrl: serverUrl.replace(/\/+$/, ""), accessToken: token } : void 0;
+    const candidate = !signedOut && serverUrl && token ? { serverUrl: serverUrl.replace(/\/+$/, ""), accessToken: token } : void 0;
     if (changed) {
+      connection = void 0;
       authRevision++;
       parameterStates.clear();
       for (const session of controller.sessions) {
         controller.stop(session);
       }
     }
-    account = { status: connection ? "checking" : "signed-out", serverUrl: serverUrl || "http://localhost:7126", user: connection ? config.user ?? account.user : void 0, revision: account.revision + 1 };
-    if (connection) {
+    account = { status: candidate ? "checking" : "signed-out", serverUrl: serverUrl || "http://localhost:7126", user: candidate ? changed ? hostManaged ? void 0 : config.user : account.user : void 0, revision: account.revision + 1 };
+    if (candidate) {
+      let unauthorized = false;
       try {
-        const response = await fetch(`${connection.serverUrl}/api/auth/me`, { headers: { Authorization: `Bearer ${connection.accessToken}` }, signal: AbortSignal.timeout(1e4), redirect: "error" });
+        const response = await fetch(`${candidate.serverUrl}/api/auth/me`, { headers: { Authorization: `Bearer ${candidate.accessToken}` }, signal: AbortSignal.any([check.signal, AbortSignal.timeout(1e4)]), redirect: "error" });
+        unauthorized = response.status === 401;
         const result = await response.json();
         if (epoch !== authEpoch) {
           return;
         }
-        if (!response.ok || result.errCode !== 0 || !result.data?.profile) {
+        const profile = result.data?.profile;
+        if (!response.ok || result.errCode !== 0 || typeof profile?.userId !== "string" || !profile.userId || typeof profile.email !== "string" || typeof profile.displayName !== "string") {
           throw new Error("Workflow login is invalid or expired.");
         }
-        account = { ...account, status: "authenticated", user: result.data.profile, expiresAt: result.data.principal?.expiresAt ?? config.expiresAt };
+        if (!connection) {
+          authRevision++;
+          parameterStates.clear();
+        }
+        connection = candidate;
+        const savedConnection = !hostManaged && candidate.serverUrl === config.serverUrl.replace(/\/+$/, "") && candidate.accessToken === config.apiKey;
+        account = { ...account, status: "authenticated", user: profile, expiresAt: result.data.principal?.expiresAt ?? (savedConnection ? config.expiresAt : void 0) };
       } catch (error) {
         if (epoch !== authEpoch) {
           return;
@@ -1119,8 +1155,10 @@ ${token}`;
             controller.stop(session);
           }
         }
-        account = { ...account, status: "error", error: String(error.message) };
+        account = { ...account, status: unauthorized ? "expired" : "error", error: String(error.message) };
       }
+    } else {
+      connection = void 0;
     }
     broadcast();
   };
@@ -1380,17 +1418,23 @@ ${token}`;
         account = { ...account, status: "checking" };
         broadcast();
         if (message.email !== void 0 || message.password !== void 0) {
+          const epoch = ++authEpoch;
           passwordLogin = true;
           try {
             if (typeof message.email !== "string" || typeof message.password !== "string") {
               throw new Error("Invalid login credentials.");
             }
             await loginWebAccount(url.toString().replace(/\/+$/, ""), message.email, message.password);
+            if (epoch !== authEpoch) {
+              break;
+            }
             hostManaged = false;
             hostConnection = void 0;
           } catch (error) {
-            account = { ...account, status: "error", error: String(error.message) };
-            broadcast();
+            if (epoch === authEpoch) {
+              account = { ...account, status: "error", error: String(error.message) };
+              broadcast();
+            }
             throw error;
           } finally {
             passwordLogin = false;
@@ -1434,7 +1478,9 @@ ${token}`;
     void (async () => {
       response.setHeader("X-Content-Type-Options", "nosniff");
       response.setHeader("Referrer-Policy", "no-referrer");
-      if (request.headers.host !== new URL(origin).host || request.headers.origin && request.headers.origin !== origin) {
+      const host = new URL(`http://${request.headers.host ?? ""}`);
+      const forwarded = !!options.host && ["127.0.0.1", "localhost", "[::1]"].includes(host.hostname) && !host.username && !host.password && host.pathname === "/" && !host.search && !host.hash;
+      if (request.headers.host !== new URL(origin).host && !forwarded || request.headers.origin && request.headers.origin !== (forwarded ? host.origin : origin)) {
         json(response, 403, { message: "Invalid request origin." });
         return;
       }
@@ -1555,12 +1601,16 @@ ${token}`;
     project,
     controller,
     setHostConnection: async (value) => {
+      authEpoch++;
+      authCheck?.abort();
       hostConnection = value;
       hostManaged = true;
       signedOut = !value;
       await refreshAuth(true);
     },
     close: () => closing ??= (async () => {
+      authEpoch++;
+      authCheck?.abort();
       clearInterval(authPoll);
       if (broadcastTimer) {
         clearTimeout(broadcastTimer);
@@ -1712,7 +1762,11 @@ async function main(argv) {
           }
           const message = JSON.parse(line);
           if (message.type === "auth") {
-            await app.setHostConnection(parseHostConnection(message.connection));
+            void app.setHostConnection(parseHostConnection(message.connection)).catch(() => {
+              console.error("Workflow web host connection failed.");
+              process.exitCode = 1;
+              close();
+            });
           } else if (message.type === "close") {
             break;
           } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workflow-code/cli",
-  "version": "0.2.4-20261010004.codex-cli-web",
+  "version": "0.2.4-20261011002.codex-cli-web",
   "type": "module",
   "bin": {
     "workflow-code": "./dist/index.js"
@@ -37,8 +37,8 @@
     "workflow-code": "0.2.4-20260929001",
     "@workflow-code/auth-config": "0.1.0",
     "@workflow-code/execution-targets": "0.1.0",
-    "@workflow-code/openai-responses": "0.1.0",
     "@workflow-code/i18n": "0.1.0",
+    "@workflow-code/openai-responses": "0.1.0",
     "@workflow-code/project-dependencies": "0.1.0",
     "@workflow-code/project-info": "0.1.0",
     "@workflow-code/project-upload": "0.1.0",