@wrongstack/webui 0.272.0 → 0.272.2

package/dist/server/index.js

@@ -1104,6 +1104,9 @@ function isTrustedLoopbackOrigin(origin) {
 function isLoopbackBind(wsHost) {
   return wsHost === "127.0.0.1" || wsHost === "::1" || wsHost === "localhost";
 }
+function isWildcardBind(wsHost) {
+  return wsHost === "0.0.0.0" || wsHost === "::" || wsHost === "[::]";
+}
 function tokenMatches(provided, expected) {
   if (!provided) return false;
   const a = Buffer.from(provided);
@@ -1152,13 +1155,13 @@ function verifyClient(input) {
   if (!origin) {
     const remoteIp = remoteAddress ?? "";
     const isRemoteLoopback = remoteIp === "127.0.0.1" || remoteIp === "::1";
-    if (!isRemoteLoopback && wsHost === "0.0.0.0") return false;
+    if (!isRemoteLoopback && isWildcardBind(wsHost)) return false;
     return urlTokenOk || cookieTokenOk || isLoopbackBind(wsHost);
   }
   try {
     const { hostname } = new URL(origin);
     if (isLoopbackHostname(hostname)) {
-      if (wsHost === "0.0.0.0" && !isTrustedLoopbackOrigin(origin)) {
+      if (isWildcardBind(wsHost) && !isTrustedLoopbackOrigin(origin)) {
         return false;
       }
       return true;
@@ -2820,7 +2823,7 @@ import { decryptConfigSecrets as decryptConfigSecrets2, encryptConfigSecrets as
 import { buildProviderFactoriesFromRegistry, makeProviderFromConfig } from "@wrongstack/providers";
 import { builtinToolsPack, forgetTool, rememberTool, searchMemoryTool, relatedMemoryTool } from "@wrongstack/tools";
 import { MCPRegistry } from "@wrongstack/mcp";
-import { WebSocketServer } from "ws";
+import { WebSocket as WebSocket2, WebSocketServer } from "ws";
 
 // ../runtime/src/container.ts
 import {
@@ -4024,18 +4027,22 @@ async function ensureProjectDataDir(slug, globalConfigPath) {
 }
 
 // src/server/terminal-ws-handler.ts
-import { spawn } from "node-pty";
+import { createRequire } from "module";
 import { toErrorMessage as toErrorMessage3 } from "@wrongstack/core/utils";
 var MAX_SESSIONS_PER_CLIENT = 8;
 var DEFAULT_COLS = 80;
 var DEFAULT_ROWS = 24;
+var requireFromHere = createRequire(import.meta.url);
+var cachedNodePty;
 var TerminalWebSocketHandler = class {
-  constructor(getCwd, logger) {
+  constructor(getCwd, logger, loadNodePty = defaultLoadNodePty) {
     this.getCwd = getCwd;
     this.logger = logger;
+    this.loadNodePty = loadNodePty;
   }
   getCwd;
   logger;
+  loadNodePty;
   /** ws → (terminalId → pty). */
   sessions = /* @__PURE__ */ new Map();
   addClient(ws) {
@@ -4052,7 +4059,8 @@ var TerminalWebSocketHandler = class {
     const p = msg.payload ?? {};
     switch (msg.type) {
       case "terminal.create":
-        if (isStr(p.id)) this.create(ws, { id: p.id, cols: numOrUndef(p.cols), rows: numOrUndef(p.rows) });
+        if (isStr(p.id))
+          this.create(ws, { id: p.id, cols: numOrUndef(p.cols), rows: numOrUndef(p.rows) });
         return true;
       case "terminal.input":
         if (isStr(p.id) && isStr(p.data)) this.input(ws, { id: p.id, data: p.data });
@@ -4080,9 +4088,18 @@ var TerminalWebSocketHandler = class {
       return;
     }
     const shell = process.platform === "win32" ? process.env.COMSPEC || "cmd.exe" : process.env.SHELL || "/bin/bash";
+    const nodePty = this.loadNodePty();
+    if (!nodePty) {
+      const msg = "Integrated terminal unavailable: optional dependency node-pty is not installed. Install node-pty to enable WebUI terminal sessions.";
+      this.logger.warn?.(msg);
+      this.send(ws, { type: "terminal.output", payload: { id: payload.id, data: `${msg}\r
+` } });
+      this.send(ws, { type: "terminal.exit", payload: { id: payload.id, exitCode: -1 } });
+      return;
+    }
     let pty;
     try {
-      pty = spawn(shell, [], {
+      pty = nodePty.spawn(shell, [], {
         name: "xterm-color",
         cols: clampDim(payload.cols, DEFAULT_COLS),
         rows: clampDim(payload.rows, DEFAULT_ROWS),
@@ -4146,6 +4163,15 @@ var TerminalWebSocketHandler = class {
     }
   }
 };
+function defaultLoadNodePty() {
+  if (cachedNodePty !== void 0) return cachedNodePty;
+  try {
+    cachedNodePty = requireFromHere("node-pty");
+  } catch {
+    cachedNodePty = null;
+  }
+  return cachedNodePty;
+}
 function isStr(v) {
   return typeof v === "string";
 }
@@ -4531,7 +4557,7 @@ async function findFreePort(host, startPort, opts = {}) {
 }
 
 // src/server/open-browser.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn } from "child_process";
 function browserOpenCommand(url, platform = process.platform) {
   if (platform === "win32") {
     return { command: "cmd", args: ["/c", "start", "", url] };
@@ -4544,7 +4570,7 @@ function browserOpenCommand(url, platform = process.platform) {
 function openBrowser(url, platform = process.platform) {
   try {
     const { command, args } = browserOpenCommand(url, platform);
-    const child = spawn2(command, args, { stdio: "ignore", detached: true, windowsHide: true });
+    const child = spawn(command, args, { stdio: "ignore", detached: true, windowsHide: true });
     child.on("error", () => {
     });
     child.unref();
@@ -6771,7 +6797,7 @@ function createEternalSubscription(subscribe, broadcast2, clientsRef) {
 // src/server/shell-open.ts
 import * as fs12 from "fs/promises";
 import * as path14 from "path";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn2 } from "child_process";
 var METACHAR_REGEX = /[&|<>^"'`\n\r]/;
 async function handleShellOpen(req, logger) {
   try {
@@ -6782,7 +6808,7 @@ async function handleShellOpen(req, logger) {
     }
     const platform = process.platform;
     const launch = (cmd, args, onError) => {
-      const child = spawn3(cmd, args, {
+      const child = spawn2(cmd, args, {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -7223,7 +7249,8 @@ async function startWebUI(opts = {}) {
         clientKind: "webui",
         projectRoot,
         projectName: path15.basename(projectRoot),
-        appConfig: config
+        appConfig: config,
+        socketFactory: (url) => new WebSocket2(url)
       });
       if (hqTelemetry) {
         hqTelemetry.connect();
@@ -7235,6 +7262,7 @@ async function startWebUI(opts = {}) {
           projectRoot,
           projectName: path15.basename(projectRoot),
           globalRoot: wpaths.globalRoot,
+          initialAgents: statusTracker?.getAgents(),
           startedAt: (/* @__PURE__ */ new Date()).toISOString()
         });
       }