askgloss 0.1.0 → 0.2.0

package/README.md

@@ -1,14 +1,14 @@
-# askgloss
-
-Runs the [Gloss](https://askgloss.app) server on your computer with your own OpenAI API key, so you can use the Gloss Chrome extension without an account or daily limits. OpenAI bills your key directly.
-
-```sh
-npx askgloss
-```
-
-Paste your OpenAI API key when asked (or set `OPENAI_API_KEY`). Keep the window open while you use Gloss; the extension connects to `http://127.0.0.1:3000`. Requires Node.js 20 or later.
-
-- `--port <number>` listens on another port. Enter the new address under "Your own server" in Gloss Settings.
-- `--forget` deletes the saved key.
-
-Websites can't use it: the server refuses requests from web pages. Page content, screenshots and voice go from the extension to this server and on to OpenAI; nothing goes through askgloss.app.
+# askgloss
+
+Runs the [Gloss](https://askgloss.app) server on your computer with your own OpenAI API key, so you can use the Gloss Chrome extension without an account or daily limits. OpenAI bills your key directly.
+
+```sh
+npx askgloss
+```
+
+Paste your OpenAI API key when asked (or set `OPENAI_API_KEY`). Keep the window open while you use Gloss; the extension connects to `http://127.0.0.1:3000`. Requires Node.js 20 or later.
+
+- `--port <number>` listens on another port. Enter the new address under "Your own server" in Gloss Settings.
+- `--forget` deletes the saved key.
+
+Websites can't use it: the server refuses requests from web pages. Page content, screenshots and voice go from the extension to this server and on to OpenAI; nothing goes through askgloss.app.

package/dist/cli/index.js

@@ -48,9 +48,8 @@ async function checkKey(apiKey) {
     const response = await fetch('https://api.openai.com/v1/models', { headers: { Authorization: 'Bearer ' + apiKey }, signal: AbortSignal.timeout(15000) }).catch(() => null);
     if (!response)
         return 'Could not reach OpenAI. Check your internet connection.';
-    if (response.status === 401)
-        return 'OpenAI rejected that key.';
-    return response.ok ? '' : `OpenAI returned an error (${response.status}).`;
+    // Only a rejected key is fatal. Restricted keys may lack permission to list models yet still run Gloss.
+    return response.status === 401 ? 'OpenAI rejected that key.' : '';
 }
 // Exiting through process.exit while a fetch socket is still open crashes Node on Windows, so failures set exitCode and return.
 async function getKey() {
@@ -82,6 +81,11 @@ async function getKey() {
     return apiKey;
 }
 const port = Number(option('--port') || process.env.PORT || 3000);
+// Only Gloss may spend this key: other extensions with access to 127.0.0.1 are refused. EXTENSION_ID
+// (comma-separated) replaces the list, for example for an unpacked build loaded from another folder.
+// TODO: add the Chrome Web Store ID once the listing exists.
+const glossExtensionIds = ['onooiajelfmchgbghniiaogkaahgkmpc', 'hlbhiofbfhhfhcbgohbmhgkhdnmpfcjm'];
+const extensionIds = process.env.EXTENSION_ID?.split(',').map(id => id.trim()).filter(Boolean) || glossExtensionIds;
 // Only problems reach the terminal; conversations and page content are never printed.
 const log = (event, details = {}) => {
     if (event === 'openai.error')
@@ -93,7 +97,7 @@ const apiKey = await getKey();
 if (!apiKey)
     process.exitCode = 1;
 else {
-    const server = createApp({ apiKey, log, accessToken: '', clerkJwtKey: '' });
+    const server = createApp({ apiKey, log, accessToken: '', clerkJwtKey: '', extensionIds });
     server.on('error', (error) => {
         console.error(error.code === 'EADDRINUSE' ? `Port ${port} is already in use. Is Gloss already running? Otherwise try \`npx askgloss --port ${port + 1}\`.` : error.message);
         process.exitCode = 1;

package/dist/server/index.js

@@ -67,7 +67,7 @@ async function readJson(req, limit) {
     }
 }
 const listFromEnv = (value) => (value || '').split(',').map(item => item.trim()).filter(Boolean);
-export function createHandler({ apiKey = process.env.OPENAI_API_KEY, accessToken = process.env.ACCESS_TOKEN, clerkJwtKey = process.env.CLERK_JWT_KEY, authorizedParties = listFromEnv(process.env.CLERK_AUTHORIZED_PARTIES), extensionId = process.env.EXTENSION_ID, usage = createUsage(), fetchImpl = fetch, log = createLogger() } = {}) {
+export function createHandler({ apiKey = process.env.OPENAI_API_KEY, accessToken = process.env.ACCESS_TOKEN, clerkJwtKey = process.env.CLERK_JWT_KEY, authorizedParties = listFromEnv(process.env.CLERK_AUTHORIZED_PARTIES), extensionIds = listFromEnv(process.env.EXTENSION_ID), usage = createUsage(), fetchImpl = fetch, log = createLogger() } = {}) {
     const authenticate = createAuth({ accessToken, clerkJwtKey, authorizedParties });
     async function callOpenAI(path, body) {
         if (!apiKey)
@@ -141,7 +141,7 @@ export function createHandler({ apiKey = process.env.OPENAI_API_KEY, accessToken
     async function handle(req, requestId) {
         // Only the extension may call this server. Never enable website CORS.
         const origin = req.headers.origin;
-        if (origin && (!/^chrome-extension:\/\/[a-p]{32}$/.test(origin) || (extensionId && origin !== 'chrome-extension://' + extensionId)))
+        if (origin && (!/^chrome-extension:\/\/[a-p]{32}$/.test(origin) || (extensionIds.length && !extensionIds.includes(origin.slice(19)))))
             throw new HttpError(403, 'Only the browser extension can connect.');
         // Vercel's rewrite adds the route as a query string; only the path matters.
         const path = (req.url || '').split('?')[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "askgloss",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Run the Gloss server on your computer with your own OpenAI API key.",
   "homepage": "https://askgloss.app",
   "repository": { "type": "git", "url": "git+https://github.com/adamblumoff/browser-live-ui.git", "directory": "cli" },