acrylblends 1.5.0 → 1.5.2

package/plugins/acryl-router/src/middleware/loopback-only.ts

@@ -26,6 +26,8 @@ export interface LoopbackOptions {
    * same-origin` and a `Referer` from this authority. `mutations` is not consulted: every request is held to that rule.
    */
   readonly callers?: 'local' | 'own-page'
+  /** The hosted app's trusted front; default: the one the environment configures ({@link trustedFront}), usually none. Tests pass one. */
+  readonly front?: TrustedFront | undefined
 }
 
 const loopback = new BlockList()
@@ -45,7 +47,7 @@ export function loopbackAuthority(c: Context, hostnames: readonly string[] = LOO
   const { remoteAddress, localPort } = connectionOf(c)
   const host = c.req.header('host')
   if (remoteAddress === undefined || localPort === undefined || host === undefined) return undefined
-  const address = (remoteAddress.replace(/^\[|\]$/gu, '').split('%', 1)[0] ?? '').replace(/^::ffff:/iu, '')
+  const address = peerAddress(remoteAddress)
   const family = isIP(address)
   if (family === 0 || !loopback.check(address, family === 4 ? 'ipv4' : 'ipv6')) return undefined
   let authority: URL
@@ -63,13 +65,73 @@ export function loopbackAuthority(c: Context, hostnames: readonly string[] = LOO
   return authority
 }
 
+/**
+ * A hosted app's one trusted front (spec 049 M9, design `m9-hosted-workspace.md` C): the reverse proxy that serves this app's page under a public
+ * origin, for example `https://a1b2.213-47-80-26.sslip.io`. Only the hosting template sets it, through `ACRYL_PUBLIC_ORIGIN` and
+ * `ACRYL_TRUSTED_PROXY` (the proxy's exact peer addresses, comma separated). Unset, nothing changes: an app accepts its own page on loopback only.
+ */
+export interface TrustedFront {
+  /** The public origin the front serves this app's page from: a scheme and a host, no path. */
+  readonly origin: string
+  /** The exact peer addresses the front connects from; no ranges, so another box on the same network is never the front. */
+  readonly proxies: readonly string[]
+}
+
+/** The front the environment configures, or `undefined` when it configures none or an invalid one (an invalid one is refused, never half used). */
+export function trustedFrontFromEnv(env: NodeJS.ProcessEnv = process.env): TrustedFront | undefined {
+  const origin = env.ACRYL_PUBLIC_ORIGIN?.trim()
+  const proxies = (env.ACRYL_TRUSTED_PROXY ?? '').split(',').map(peer => peerAddress(peer.trim())).filter(peer => peer !== '')
+  if (origin === undefined || origin === '' || proxies.length === 0) return undefined
+  if (originOf(origin) !== origin || !/^https?:$/u.test(new URL(origin).protocol)) return undefined
+  if (proxies.some(peer => isIP(peer) === 0)) return undefined
+  return Object.freeze({ origin, proxies: Object.freeze(proxies) })
+}
+
+let configuredFront: TrustedFront | undefined | null = null
+
+/** The front of this process, read from the environment once. */
+export function trustedFront(): TrustedFront | undefined {
+  if (configuredFront === null) configuredFront = trustedFrontFromEnv()
+  return configuredFront
+}
+
+function peerAddress(address: string): string {
+  return (address.replace(/^\[|\]$/gu, '').split('%', 1)[0] ?? '').replace(/^::ffff:/iu, '')
+}
+
+/**
+ * The public authority of a request the trusted front passed on: the peer is exactly one of the front's addresses, the `Host` is exactly the
+ * public host, and the browser did not mark it cross-site. Anything else, or no front, gives `undefined`. The peer comes from the transport, never a
+ * header, so a page on another box cannot claim to be the front.
+ */
+export function frontAuthority(c: Context, front: TrustedFront | undefined = trustedFront()): URL | undefined {
+  if (front === undefined) return undefined
+  const { remoteAddress } = connectionOf(c)
+  if (remoteAddress === undefined || !front.proxies.includes(peerAddress(remoteAddress))) return undefined
+  const publicOrigin = new URL(front.origin)
+  if (c.req.header('host') !== publicOrigin.host || c.req.header('sec-fetch-site') === 'cross-site') return undefined
+  return publicOrigin
+}
+
+/**
+ * The authority a browser page of this app reached it under: the loopback one, or the trusted front's public one. For routes a page calls; an
+ * operator route (the door's `.acryl/bin/acryl` calls) keeps {@link loopbackAuthority}, so nothing outside the box can operate the app.
+ */
+export function pageAuthority(
+  c: Context,
+  hostnames: readonly string[] = LOOPBACK_HOSTNAMES,
+  front: TrustedFront | undefined = trustedFront(),
+): URL | undefined {
+  return loopbackAuthority(c, hostnames) ?? frontAuthority(c, front)
+}
+
 /** Whether a changing request is acceptable by its `Origin`: absent (not a browser cross-origin change) or naming this same authority. `null` and any other origin are not. */
 export function sameOrigin(c: Context, authority: URL): boolean {
   const origin = c.req.header('origin')
   if (origin === undefined) return true
   try {
     const parsed = new URL(origin)
-    return parsed.protocol === 'http:' && parsed.host === authority.host && parsed.pathname === '/'
+    return parsed.origin === authority.origin && parsed.pathname === '/' && parsed.search === ''
   } catch {
     return false
   }
@@ -106,7 +168,7 @@ export function loopbackOnly(options: LoopbackOptions = {}): MiddlewareHandler {
       await next()
       return
     }
-    const authority = loopbackAuthority(c, options.hostnames)
+    const authority = pageAuthority(c, options.hostnames, 'front' in options ? options.front : trustedFront())
     if (authority === undefined) return c.json({ error: 'request authority rejected' }, 403)
     if (ownPage) {
       if (!fromOwnPage(c, authority)) return c.json({ error: 'only this app\'s own page may call this' }, 403)

package/plugins/acryl-state/src/socket.ts

@@ -13,7 +13,7 @@
 
 import type { Context, MiddlewareHandler } from 'acryl-router'
 import type { UpgradeWebSocket } from 'acryl-router/helpers'
-import { loopbackAuthority } from 'acryl-router/middleware'
+import { pageAuthority } from 'acryl-router/middleware'
 import type { ReadonlyCell } from './cell.ts'
 
 /** How often the server writes a `ping`; a page gives up on a socket that is silent for three of these. */
@@ -34,7 +34,7 @@ export interface StateSocketOptions {
 
 /** A refusal (403) unless the upgrade comes from this machine to this app, and from its own page when it comes from a page at all. */
 export function refuseStranger(c: Context): Response | undefined {
-  const authority = loopbackAuthority(c)
+  const authority = pageAuthority(c)
   if (authority === undefined) return c.json({ error: 'request authority rejected' }, 403)
   const origin = c.req.header('origin')
   const site = c.req.header('sec-fetch-site')

package/plugins/agent-panel/index.ts

@@ -22,7 +22,7 @@ import type { Context } from '@deepseek-ai/cordis'
 import { clientModules } from '../acryl-node-server/src/client-modules.ts'
 import { streamSSE, type UpgradeWebSocket } from '../acryl-router/src/helpers/index.ts'
 import { Acryl, type MiddlewareHandler } from '../acryl-router/src/index.ts'
-import { loopbackAuthority } from '../acryl-router/src/middleware/index.ts'
+import { pageAuthority } from '../acryl-router/src/middleware/index.ts'
 import type {} from '../agent/index.ts'
 import type {} from '../extensions/index.ts'
 import type { ChatDriver, Driver } from './drivers.ts'
@@ -419,7 +419,7 @@ export function apply(ctx: Context, config: PanelConfig = {}): void {
     }
     const ws = new Acryl()
     const own: MiddlewareHandler = async (c, next) => {
-      const authority = loopbackAuthority(c)
+      const authority = pageAuthority(c)
       const origin = c.req.header('origin')
       const site = c.req.header('sec-fetch-site')
       if (

package/plugins/instance/bundle.ts

@@ -8,7 +8,7 @@
  * `@deepseek-ai/cordis` still gets the bundle's, because two framework copies in one process break it (the `matchedRoutes` 500). Any other package
  * resolves as Node resolves it, from the source's own `node_modules` (what the person added), with the bundle's as the fallback.
  *
- * `NODE_PATH` does not reach ESM; the seam is `registerHooks`, which covers `import`, `require` and `require.resolve` alike. `bundle-overlay.ts`
+ * `NODE_PATH` does not reach ESM; the seam is `registerHooks`, which covers `import`, `require` and (from Node 24, the frame host's Electron Node) `require.resolve` alike. `bundle-overlay.ts`
  * registers it, first, in a product's frame host. Pure apart from `readProduct`.
  */
 import { readFileSync, realpathSync } from 'node:fs'

package/plugins/instance/home.ts

@@ -218,8 +218,17 @@ export type MigrationResult =
 export function migrateOldHome(
   appRoot: string,
   dataHome: string,
-  copy: (from: string, to: string) => void = (from, to) =>
-    cpSync(from, to, { recursive: true, errorOnExist: true, force: false, verbatimSymlinks: true }),
+  copy: (from: string, to: string) => void = (from, to) => {
+    // Entry by entry into the empty data folder: on Linux cpSync refuses a target folder that exists (EEXIST) even when it is empty, while
+    // nothing inside may ever be overwritten either way.
+    for (const entry of readdirSync(from))
+      cpSync(join(from, entry), join(to, entry), {
+        recursive: true,
+        errorOnExist: true,
+        force: false,
+        verbatimSymlinks: true,
+      })
+  },
 ): MigrationResult {
   const old = join(appRoot, OLD_HOME_DIR)
   if (!existsSync(old) || !lstatSync(old).isDirectory()) return { status: 'none' }