codebase-onboarder 0.6.0 → 1.0.0

package/server/http.js

@@ -2,54 +2,47 @@
 // does. Pulled out of the router so a handler can be read on its own, and so
 // the body limit is one number in one place rather than a check repeated per
 // route and forgotten on the next one.
-
-// A scan request carries a path or a URL; an explain request carries a prompt
-// and a slice of facts. Two megabytes is far more than either needs, and the
-// point is to have a ceiling at all: a local server with no auth should not let
-// a stray fetch hold memory open.
 export const MAX_BODY_BYTES = 2 * 1024 * 1024;
-
 // Resolves to the parsed JSON body, or `{}` for an empty one — a POST with no
 // body is a valid "just the defaults" request and every caller would otherwise
 // need the same guard. Rejects on oversized or malformed input; the router turns
 // that into a 500 with the message.
 export function readBody(req, limit = MAX_BODY_BYTES) {
-  return new Promise((resolve, reject) => {
-    let size = 0;
-    const chunks = [];
-    req.on('data', (chunk) => {
-      size += chunk.length;
-      if (size > limit) {
-        reject(new Error('Request body too large.'));
-        req.destroy();
-        return;
-      }
-      chunks.push(chunk);
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > limit) {
+                reject(new Error('Request body too large.'));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            try {
+                resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {});
+            }
+            catch {
+                reject(new Error('The request body was not valid JSON.'));
+            }
+        });
+        req.on('error', reject);
     });
-    req.on('end', () => {
-      try {
-        resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {});
-      } catch {
-        reject(new Error('The request body was not valid JSON.'));
-      }
-    });
-    req.on('error', reject);
-  });
 }
-
 export function sendJSON(res, status, data, headers = {}) {
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', ...headers });
-  res.end(JSON.stringify(data));
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', ...headers });
+    res.end(JSON.stringify(data));
 }
-
 // Every error the UI shows comes back through here, so the shape is fixed:
 // `{ error }` with a sentence a person can act on. The front end reads `.error`
 // and nothing else.
 export function sendError(res, status, message) {
-  sendJSON(res, status, { error: message });
+    sendJSON(res, status, { error: message });
 }
-
 export function sendText(res, status, text) {
-  res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
-  res.end(text);
+    res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end(text);
 }
+//# sourceMappingURL=http.js.map

package/server/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/server/http.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,uCAAuC;AAQvC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,oCAAoC;AACpC,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,cAAc;IACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBAC7C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,OAAO,GAA+C,EAAE;IACnI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACzF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,2EAA2E;AAC3E,gFAAgF;AAChF,oBAAoB;AACpB,MAAM,UAAU,SAAS,CAAC,GAAmB,EAAE,MAAc,EAAE,OAAe;IAC5E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY;IACxE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["// Reading a request body and writing a response — the two things every route\n// does. Pulled out of the router so a handler can be read on its own, and so\n// the body limit is one number in one place rather than a check repeated per\n// route and forgotten on the next one.\n\n// A scan request carries a path or a URL; an explain request carries a prompt\n// and a slice of facts. Two megabytes is far more than either needs, and the\n// point is to have a ceiling at all: a local server with no auth should not let\n// a stray fetch hold memory open.\nimport type { IncomingMessage, ServerResponse } from 'node:http';\n\nexport const MAX_BODY_BYTES = 2 * 1024 * 1024;\n\n// Resolves to the parsed JSON body, or `{}` for an empty one — a POST with no\n// body is a valid \"just the defaults\" request and every caller would otherwise\n// need the same guard. Rejects on oversized or malformed input; the router turns\n// that into a 500 with the message.\nexport function readBody(req: IncomingMessage, limit = MAX_BODY_BYTES): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    let size = 0;\n    const chunks: Buffer[] = [];\n    req.on('data', (chunk: Buffer) => {\n      size += chunk.length;\n      if (size > limit) {\n        reject(new Error('Request body too large.'));\n        req.destroy();\n        return;\n      }\n      chunks.push(chunk);\n    });\n    req.on('end', () => {\n      try {\n        resolve(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : {});\n      } catch {\n        reject(new Error('The request body was not valid JSON.'));\n      }\n    });\n    req.on('error', reject);\n  });\n}\n\nexport function sendJSON(res: ServerResponse, status: number, data: unknown, headers: Record<string, string | number | string[]> = {}) {\n  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', ...headers });\n  res.end(JSON.stringify(data));\n}\n\n// Every error the UI shows comes back through here, so the shape is fixed:\n// `{ error }` with a sentence a person can act on. The front end reads `.error`\n// and nothing else.\nexport function sendError(res: ServerResponse, status: number, message: string) {\n  sendJSON(res, status, { error: message });\n}\n\nexport function sendText(res: ServerResponse, status: number, text: string) {\n  res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });\n  res.end(text);\n}\n"]}

package/server/httpGuards.d.ts

@@ -0,0 +1,2 @@
+export declare function rebindingReason(req: any, extraHosts?: any[]): string;
+export declare function crossOriginReason(req: any): string;

package/server/httpGuards.js

@@ -6,22 +6,18 @@
 // authenticate. Both exist to stop some *other* page the user happens to have
 // open from driving this server on their behalf. Binding to 127.0.0.1 keeps
 // the network out; it does nothing about the browser, which is already inside.
-
 import net from 'node:net';
-
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
-
 // "localhost:4310" -> "localhost", "[::1]:4310" -> "[::1]"
 function hostnameOf(hostHeader) {
-  const raw = String(hostHeader ?? '').trim().toLowerCase();
-  if (raw.startsWith('[')) {
-    const close = raw.indexOf(']');
-    return close === -1 ? raw : raw.slice(0, close + 1);
-  }
-  const colon = raw.lastIndexOf(':');
-  return colon === -1 ? raw : raw.slice(0, colon);
+    const raw = String(hostHeader ?? '').trim().toLowerCase();
+    if (raw.startsWith('[')) {
+        const close = raw.indexOf(']');
+        return close === -1 ? raw : raw.slice(0, close + 1);
+    }
+    const colon = raw.lastIndexOf(':');
+    return colon === -1 ? raw : raw.slice(0, colon);
 }
-
 // DNS rebinding, the attack this server's loopback bind does not cover: a page
 // on evil.com whose DNS answer flips to 127.0.0.1 reaches us anyway, and from
 // then on the browser treats evil.com as the same origin as everything we
@@ -38,25 +34,31 @@ function hostnameOf(hostHeader) {
 //
 // Returns null when the request is fine, or a short reason when it isn't.
 export function rebindingReason(req, extraHosts = []) {
-  const host = req.headers?.host;
-  if (!host) return 'The request arrived with no Host header.';
-  const name = hostnameOf(host);
-  if (LOOPBACK_HOSTS.has(name)) return null;
-  for (const extra of extraHosts) {
-    if (extra === 'ip:*' && net.isIP(name.replace(/^\[|\]$/g, '')) > 0) return null;
-    if (extra === 'ipv4:*' && net.isIP(name) === 4) return null;
-    if (extra === 'ipv6:*' && net.isIP(name.replace(/^\[|\]$/g, '')) === 6) return null;
-    if (extra.startsWith('*.')) {
-      // "*.trycloudflare.com" matches "abc.trycloudflare.com" but not the bare
-      // suffix itself and not "evil-trycloudflare.com".
-      if (name.endsWith(extra.slice(1)) && name.length > extra.length) return null;
-    } else if (name === extra) {
-      return null;
+    const host = req.headers?.host;
+    if (!host)
+        return 'The request arrived with no Host header.';
+    const name = hostnameOf(host);
+    if (LOOPBACK_HOSTS.has(name))
+        return null;
+    for (const extra of extraHosts) {
+        if (extra === 'ip:*' && net.isIP(name.replace(/^\[|\]$/g, '')) > 0)
+            return null;
+        if (extra === 'ipv4:*' && net.isIP(name) === 4)
+            return null;
+        if (extra === 'ipv6:*' && net.isIP(name.replace(/^\[|\]$/g, '')) === 6)
+            return null;
+        if (extra.startsWith('*.')) {
+            // "*.trycloudflare.com" matches "abc.trycloudflare.com" but not the bare
+            // suffix itself and not "evil-trycloudflare.com".
+            if (name.endsWith(extra.slice(1)) && name.length > extra.length)
+                return null;
+        }
+        else if (name === extra) {
+            return null;
+        }
     }
-  }
-  return `It arrived addressed to ${name}.`;
+    return `It arrived addressed to ${name}.`;
 }
-
 // Cross-site requests: any page in the browser can POST here without being
 // able to read the answer, and "without being able to read the answer" is not
 // the same as harmless — /api/scan walks a directory the caller names, and
@@ -74,19 +76,21 @@ export function rebindingReason(req, extraHosts = []) {
 // A request carrying neither header isn't a browser at all — curl, a test, a
 // script — and there is no cross-site story for those, so they pass.
 export function crossOriginReason(req) {
-  const site = req.headers?.['sec-fetch-site'];
-  if (site && site !== 'same-origin' && site !== 'none') {
-    return `The browser reported it as ${site}.`;
-  }
-  const origin = req.headers?.origin;
-  if (origin) {
-    // The host was just vetted by the rebinding check, so the origin only has
-    // to agree with it. Both schemes are accepted: a self-hosted server behind
-    // a tunnel is reached over https while the page's fetches still arrive
-    // here addressed to the same host the tunnel forwarded.
-    const host = String(req.headers.host ?? '').trim().toLowerCase();
-    const expected = new Set(['http://' + host, 'https://' + host]);
-    if (!expected.has(String(origin).trim().toLowerCase())) return `It came from ${origin}.`;
-  }
-  return null;
+    const site = req.headers?.['sec-fetch-site'];
+    if (site && site !== 'same-origin' && site !== 'none') {
+        return `The browser reported it as ${site}.`;
+    }
+    const origin = req.headers?.origin;
+    if (origin) {
+        // The host was just vetted by the rebinding check, so the origin only has
+        // to agree with it. Both schemes are accepted: a self-hosted server behind
+        // a tunnel is reached over https while the page's fetches still arrive
+        // here addressed to the same host the tunnel forwarded.
+        const host = String(req.headers.host ?? '').trim().toLowerCase();
+        const expected = new Set(['http://' + host, 'https://' + host]);
+        if (!expected.has(String(origin).trim().toLowerCase()))
+            return `It came from ${origin}.`;
+    }
+    return null;
 }
+//# sourceMappingURL=httpGuards.js.map

package/server/httpGuards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpGuards.js","sourceRoot":"","sources":["../src/server/httpGuards.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,4EAA4E;AAC5E,iCAAiC;AACjC,EAAE;AACF,qEAAqE;AACrE,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAE/E,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,2DAA2D;AAC3D,SAAS,UAAU,CAAC,UAAU;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,0EAA0E;AAC1E,iCAAiC;AACjC,EAAE;AACF,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,0CAA0C,CAAC;IAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,IAAI,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpF,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,yEAAyE;YACzE,kDAAkD;YAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;aAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,2BAA2B,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,sDAAsD;AACtD,EAAE;AACF,iEAAiE;AACjE,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,sEAAsE;AACtE,8EAA8E;AAC9E,+EAA+E;AAC/E,mDAAmD;AACnD,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,GAAG;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,IAAI,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,8BAA8B,IAAI,GAAG,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,gBAAgB,MAAM,GAAG,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["// Two questions worth asking about a request before it is allowed to do\n// anything: did it arrive at a name that really is this machine, and did it\n// come from this app's own page?\n//\n// Neither is authentication — a single-user local tool has nobody to\n// authenticate. Both exist to stop some *other* page the user happens to have\n// open from driving this server on their behalf. Binding to 127.0.0.1 keeps\n// the network out; it does nothing about the browser, which is already inside.\n\nimport net from 'node:net';\n\nconst LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);\n\n// \"localhost:4310\" -> \"localhost\", \"[::1]:4310\" -> \"[::1]\"\nfunction hostnameOf(hostHeader) {\n  const raw = String(hostHeader ?? '').trim().toLowerCase();\n  if (raw.startsWith('[')) {\n    const close = raw.indexOf(']');\n    return close === -1 ? raw : raw.slice(0, close + 1);\n  }\n  const colon = raw.lastIndexOf(':');\n  return colon === -1 ? raw : raw.slice(0, colon);\n}\n\n// DNS rebinding, the attack this server's loopback bind does not cover: a page\n// on evil.com whose DNS answer flips to 127.0.0.1 reaches us anyway, and from\n// then on the browser treats evil.com as the same origin as everything we\n// return — so the origin check below is looking at `same-origin` and sees\n// nothing wrong. What still gives it away is the Host header, which the page\n// cannot set and which still says evil.com.\n//\n// `extraHosts` is the self-hosted escape hatch: the domain and bind address\n// from the settings file, so a server that was deliberately put on the network\n// answers to its own name and nothing else. A local server passes nothing and\n// keeps the loopback-only rule. Entries may be exact names or `*.suffix`\n// wildcards — enabled tunnels put their random upstream names here, which\n// cannot be known ahead of time.\n//\n// Returns null when the request is fine, or a short reason when it isn't.\nexport function rebindingReason(req, extraHosts = []) {\n  const host = req.headers?.host;\n  if (!host) return 'The request arrived with no Host header.';\n  const name = hostnameOf(host);\n  if (LOOPBACK_HOSTS.has(name)) return null;\n  for (const extra of extraHosts) {\n    if (extra === 'ip:*' && net.isIP(name.replace(/^\\[|\\]$/g, '')) > 0) return null;\n    if (extra === 'ipv4:*' && net.isIP(name) === 4) return null;\n    if (extra === 'ipv6:*' && net.isIP(name.replace(/^\\[|\\]$/g, '')) === 6) return null;\n    if (extra.startsWith('*.')) {\n      // \"*.trycloudflare.com\" matches \"abc.trycloudflare.com\" but not the bare\n      // suffix itself and not \"evil-trycloudflare.com\".\n      if (name.endsWith(extra.slice(1)) && name.length > extra.length) return null;\n    } else if (name === extra) {\n      return null;\n    }\n  }\n  return `It arrived addressed to ${name}.`;\n}\n\n// Cross-site requests: any page in the browser can POST here without being\n// able to read the answer, and \"without being able to read the answer\" is not\n// the same as harmless — /api/scan walks a directory the caller names, and\n// /api/explain will POST to any URL the caller names.\n//\n// Two signals, and a request only has to fail one to be refused:\n//\n//   Sec-Fetch-Site  set by the browser, unsettable by page script. `none`\n//                   means the user did it themselves — typed the URL, opened\n//                   a bookmark — which no attacking page can arrange.\n//   Origin          sent on every fetch that isn't GET/HEAD. Compared against\n//                   this server's own origin, which is `http://` plus the Host\n//                   we just confirmed is loopback.\n//\n// A request carrying neither header isn't a browser at all — curl, a test, a\n// script — and there is no cross-site story for those, so they pass.\nexport function crossOriginReason(req) {\n  const site = req.headers?.['sec-fetch-site'];\n  if (site && site !== 'same-origin' && site !== 'none') {\n    return `The browser reported it as ${site}.`;\n  }\n  const origin = req.headers?.origin;\n  if (origin) {\n    // The host was just vetted by the rebinding check, so the origin only has\n    // to agree with it. Both schemes are accepted: a self-hosted server behind\n    // a tunnel is reached over https while the page's fetches still arrive\n    // here addressed to the same host the tunnel forwarded.\n    const host = String(req.headers.host ?? '').trim().toLowerCase();\n    const expected = new Set(['http://' + host, 'https://' + host]);\n    if (!expected.has(String(origin).trim().toLowerCase())) return `It came from ${origin}.`;\n  }\n  return null;\n}\n"]}

package/server/https.d.ts

@@ -0,0 +1,34 @@
+export declare function caddyfilePath(configFile?: string): string;
+export declare function renderCaddyfile(settings: any): string;
+export declare function httpsReadiness(settings: any, { configFile, resolve, probe, tool, running }?: Record<string, any>): Promise<{
+    ok: boolean;
+    checks: {
+        id: string;
+        ok: boolean;
+        required: boolean;
+        detail: string;
+    }[];
+    caddy: any;
+    addresses: any[];
+    local: any[];
+}>;
+export declare function httpsStatus(settings: any, configFile?: string): {
+    enabled: boolean;
+    domain: string;
+    url: string;
+    caddyfile: string;
+    caddyInstalled: boolean;
+    caddyVersion: string;
+    configured: boolean;
+    command: string;
+};
+export declare function writeCaddyfile(settings: any, configFile?: string): Promise<string>;
+export declare function caddyValidate(settings: any, configFile?: string): Promise<{
+    file: string;
+    output: string;
+}>;
+export declare function caddyRun(settings: any, configFile?: string, action?: string): {
+    action: string;
+    file: string;
+    output: string;
+};

package/server/https.js

@@ -4,139 +4,149 @@ import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-
 import { configPath, normalizeSettings } from './config.js';
 import { findOnPath, installHint } from './tunnel.js';
-
 export function caddyfilePath(configFile = configPath()) {
-  return path.join(path.dirname(configFile), 'Caddyfile');
+    return path.join(path.dirname(configFile), 'Caddyfile');
 }
-
 export function renderCaddyfile(settings) {
-  const s = normalizeSettings(settings);
-  if (!s.domain) throw new Error('HTTPS needs a domain. Run `onboarder setup` and enter one first.');
-  return `# Managed by Onboarder. Edits are replaced by \`onboarder https setup\`.\n${s.domain} {\n  reverse_proxy 127.0.0.1:${s.port}\n}\n`;
+    const s = normalizeSettings(settings);
+    if (!s.domain)
+        throw new Error('HTTPS needs a domain. Run `onboarder setup` and enter one first.');
+    return `# Managed by Onboarder. Edits are replaced by \`onboarder https setup\`.\n${s.domain} {\n  reverse_proxy 127.0.0.1:${s.port}\n}\n`;
 }
-
 function portIsFree(port, host = '0.0.0.0') {
-  return new Promise((resolve) => {
-    const probe = net.createServer();
-    probe.once('error', () => resolve(false));
-    probe.listen(port, host, () => probe.close(() => resolve(true)));
-  });
+    return new Promise((resolve) => {
+        const probe = net.createServer();
+        probe.once('error', () => resolve(false));
+        probe.listen(port, host, () => probe.close(() => resolve(true)));
+    });
 }
-
 async function resolveDomain(domain) {
-  const [v4, v6] = await Promise.allSettled([dns.resolve4(domain), dns.resolve6(domain)]);
-  const addresses = [
-    ...(v4.status === 'fulfilled' ? v4.value : []),
-    ...(v6.status === 'fulfilled' ? v6.value : []),
-  ];
-  return [...new Set(addresses)];
+    const [v4, v6] = await Promise.allSettled([dns.resolve4(domain), dns.resolve6(domain)]);
+    const addresses = [
+        ...(v4.status === 'fulfilled' ? v4.value : []),
+        ...(v6.status === 'fulfilled' ? v6.value : []),
+    ];
+    return [...new Set(addresses)];
 }
-
 function localAddresses() {
-  const found = [];
-  for (const list of Object.values(os.networkInterfaces())) {
-    for (const address of list || []) if (!address.internal) found.push(address.address);
-  }
-  return found;
+    const found = [];
+    for (const list of Object.values(os.networkInterfaces())) {
+        for (const address of list || [])
+            if (!address.internal)
+                found.push(address.address);
+    }
+    return found;
 }
-
 async function caddyIsRunning(probe = portIsFree) {
-  // If 80 and 443 are both occupied, probe Caddy's local admin endpoint. This
-  // distinguishes the Ubuntu service from an unknown listener without sudo.
-  if (await probe(80)) return false;
-  if (await probe(443)) return false;
-  return new Promise((resolve) => {
-    const socket = net.connect(2019, '127.0.0.1');
-    const finish = (value) => { socket.destroy(); resolve(value); };
-    socket.setTimeout(800, () => finish(false));
-    socket.once('connect', () => finish(true));
-    socket.once('error', () => finish(false));
-  });
+    // If 80 and 443 are both occupied, probe Caddy's local admin endpoint. This
+    // distinguishes the Ubuntu service from an unknown listener without sudo.
+    if (await probe(80))
+        return false;
+    if (await probe(443))
+        return false;
+    return new Promise((resolve) => {
+        const socket = net.connect(2019, '127.0.0.1');
+        const finish = (value) => { socket.destroy(); resolve(value); };
+        socket.setTimeout(800, () => finish(false));
+        socket.once('connect', () => finish(true));
+        socket.once('error', () => finish(false));
+    });
 }
-
 export async function httpsReadiness(settings, { configFile = configPath(), resolve = resolveDomain, probe = portIsFree, tool = findOnPath, running = caddyIsRunning } = {}) {
-  const s = normalizeSettings(settings);
-  const caddy = tool('caddy');
-  const checks = [{ id: 'domain', ok: Boolean(s.domain), required: true, detail: s.domain || 'not configured' }];
-  if (!s.domain) return { ok: false, checks, caddy, addresses: [], local: [] };
-
-  let addresses = [];
-  let dnsError = '';
-  try { addresses = await resolve(s.domain); } catch (error) { dnsError = error.code || error.message; }
-  checks.push({ id: 'dns', ok: addresses.length > 0, required: true, detail: addresses.length ? addresses.join(', ') : `does not resolve${dnsError ? ` (${dnsError})` : ''}` });
-  const local = localAddresses();
-  const matches = addresses.some((address) => local.includes(address));
-  checks.push({ id: 'dns-target', ok: matches, required: false, detail: matches ? 'resolves to this machine' : 'does not match a local interface address (NAT/public-IP and proxy setups can still be valid)' });
-
-  const serviceRunning = await running(probe);
-  for (const port of [80, 443]) {
-    const free = await probe(port);
-    const ownedByCaddy = !free && serviceRunning;
-    checks.push({
-      id: `port-${port}`,
-      ok: free || ownedByCaddy,
-      required: true,
-      detail: free ? 'available for Caddy' : ownedByCaddy ? 'in use by the running Caddy service' : 'already in use — stop the existing web server or proxy',
-    });
-  }
-  checks.push({ id: 'caddy', ok: caddy.installed, required: true, detail: caddy.installed ? caddy.version : 'not installed — ' + installHint('caddy') });
-  return { ok: checks.every((check) => check.ok || !check.required), checks, caddy, addresses, local };
+    const s = normalizeSettings(settings);
+    const caddy = tool('caddy');
+    const checks = [{ id: 'domain', ok: Boolean(s.domain), required: true, detail: s.domain || 'not configured' }];
+    if (!s.domain)
+        return { ok: false, checks, caddy, addresses: [], local: [] };
+    let addresses = [];
+    let dnsError = '';
+    try {
+        addresses = await resolve(s.domain);
+    }
+    catch (error) {
+        dnsError = error.code || error.message;
+    }
+    checks.push({ id: 'dns', ok: addresses.length > 0, required: true, detail: addresses.length ? addresses.join(', ') : `does not resolve${dnsError ? ` (${dnsError})` : ''}` });
+    const local = localAddresses();
+    const matches = addresses.some((address) => local.includes(address));
+    checks.push({ id: 'dns-target', ok: matches, required: false, detail: matches ? 'resolves to this machine' : 'does not match a local interface address (NAT/public-IP and proxy setups can still be valid)' });
+    const serviceRunning = await running(probe);
+    for (const port of [80, 443]) {
+        const free = await probe(port);
+        const ownedByCaddy = !free && serviceRunning;
+        checks.push({
+            id: `port-${port}`,
+            ok: free || ownedByCaddy,
+            required: true,
+            detail: free ? 'available for Caddy' : ownedByCaddy ? 'in use by the running Caddy service' : 'already in use — stop the existing web server or proxy',
+        });
+    }
+    checks.push({ id: 'caddy', ok: caddy.installed, required: true, detail: caddy.installed ? caddy.version : 'not installed — ' + installHint('caddy') });
+    return { ok: checks.every((check) => check.ok || !check.required), checks, caddy, addresses, local };
 }
-
 export function httpsStatus(settings, configFile = configPath()) {
-  const s = normalizeSettings(settings);
-  const file = caddyfilePath(configFile);
-  const caddy = findOnPath('caddy');
-  let configured = false;
-  try { configured = Boolean(statSync(file)); } catch { configured = false; }
-  return {
-    enabled: Boolean(s.domain && s.https),
-    domain: s.domain,
-    url: s.domain && s.https ? `https://${s.domain}` : '',
-    caddyfile: file,
-    caddyInstalled: caddy.installed,
-    caddyVersion: caddy.version || '',
-    configured,
-    command: s.domain && s.https ? `caddy start --config ${file}` : '',
-  };
+    const s = normalizeSettings(settings);
+    const file = caddyfilePath(configFile);
+    const caddy = findOnPath('caddy');
+    let configured = false;
+    try {
+        configured = Boolean(statSync(file));
+    }
+    catch {
+        configured = false;
+    }
+    return {
+        enabled: Boolean(s.domain && s.https),
+        domain: s.domain,
+        url: s.domain && s.https ? `https://${s.domain}` : '',
+        caddyfile: file,
+        caddyInstalled: caddy.installed,
+        caddyVersion: caddy.version || '',
+        configured,
+        command: s.domain && s.https ? `caddy start --config ${file}` : '',
+    };
 }
-
 export async function writeCaddyfile(settings, configFile = configPath()) {
-  const file = caddyfilePath(configFile);
-  await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-  await fs.writeFile(file, renderCaddyfile(settings), { encoding: 'utf8', mode: 0o600 });
-  return file;
+    const file = caddyfilePath(configFile);
+    await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await fs.writeFile(file, renderCaddyfile(settings), { encoding: 'utf8', mode: 0o600 });
+    return file;
 }
-
 export async function caddyValidate(settings, configFile = configPath()) {
-  const s = normalizeSettings(settings);
-  if (!s.domain) throw new Error('HTTPS needs a domain. Run `onboarder setup` and enter one first.');
-  const caddy = findOnPath('caddy');
-  if (!caddy.installed) throw new Error('Caddy is not installed. ' + installHint('caddy'));
-  const file = caddyfilePath(configFile);
-  const result = spawnSync('caddy', ['validate', '--config', file], { encoding: 'utf8' });
-  if (result.error) throw result.error;
-  if (result.status !== 0) throw new Error(String(result.stderr || result.stdout || 'Caddy configuration is invalid.').trim());
-  return { file, output: String(result.stdout || result.stderr || '').trim() };
+    const s = normalizeSettings(settings);
+    if (!s.domain)
+        throw new Error('HTTPS needs a domain. Run `onboarder setup` and enter one first.');
+    const caddy = findOnPath('caddy');
+    if (!caddy.installed)
+        throw new Error('Caddy is not installed. ' + installHint('caddy'));
+    const file = caddyfilePath(configFile);
+    const result = spawnSync('caddy', ['validate', '--config', file], { encoding: 'utf8' });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(String(result.stderr || result.stdout || 'Caddy configuration is invalid.').trim());
+    return { file, output: String(result.stdout || result.stderr || '').trim() };
 }
-
 export function caddyRun(settings, configFile = configPath(), action = 'start') {
-  const s = normalizeSettings(settings);
-  if (!s.domain || !s.https) throw new Error('Enable HTTPS with a domain first: `onboarder setup`.');
-  const caddy = findOnPath('caddy');
-  if (!caddy.installed) throw new Error('Caddy is not installed. ' + installHint('caddy'));
-  const file = caddyfilePath(configFile);
-  const result = spawnSync('caddy', [action, '--config', file], { encoding: 'utf8' });
-  if (result.error) throw result.error;
-  if (result.status !== 0) {
-    const message = String(result.stderr || result.stdout || `caddy ${action} failed`).trim();
-    if (/permission denied|address already in use/i.test(message) && process.platform !== 'win32') {
-      throw new Error(`${message}\nStart the packaged service with: sudo systemctl enable --now caddy`);
+    const s = normalizeSettings(settings);
+    if (!s.domain || !s.https)
+        throw new Error('Enable HTTPS with a domain first: `onboarder setup`.');
+    const caddy = findOnPath('caddy');
+    if (!caddy.installed)
+        throw new Error('Caddy is not installed. ' + installHint('caddy'));
+    const file = caddyfilePath(configFile);
+    const result = spawnSync('caddy', [action, '--config', file], { encoding: 'utf8' });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        const message = String(result.stderr || result.stdout || `caddy ${action} failed`).trim();
+        if (/permission denied|address already in use/i.test(message) && process.platform !== 'win32') {
+            throw new Error(`${message}\nStart the packaged service with: sudo systemctl enable --now caddy`);
+        }
+        throw new Error(message);
     }
-    throw new Error(message);
-  }
-  return { action, file, output: String(result.stdout || result.stderr || '').trim() };
+    return { action, file, output: String(result.stdout || result.stderr || '').trim() };
 }
+//# sourceMappingURL=https.js.map

package/server/https.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"https.js","sourceRoot":"","sources":["../src/server/https.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,aAAa,CAAC,UAAU,GAAG,UAAU,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAQ;IACtC,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACnG,OAAO,6EAA6E,CAAC,CAAC,MAAM,iCAAiC,CAAC,CAAC,IAAI,OAAO,CAAC;AAC7I,CAAC;AAED,SAAS,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAM;IACjC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAK,GAAG,UAAU;IAC9C,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAQ,EAAE,EAAE,UAAU,GAAG,UAAU,EAAE,EAAE,OAAO,GAAG,aAAa,EAAE,KAAK,GAAG,UAAU,EAAE,IAAI,GAAG,UAAU,EAAE,OAAO,GAAG,cAAc,EAAE,GAAwB,EAAE;IAC9L,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAE7E,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC;IAAC,CAAC;IACtG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9K,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,8FAA8F,EAAE,CAAC,CAAC;IAE/M,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,cAAc,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,QAAQ,IAAI,EAAE;YAClB,EAAE,EAAE,IAAI,IAAI,YAAY;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,wDAAwD;SACvJ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvJ,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAQ,EAAE,UAAU,GAAG,UAAU,EAAE;IAC7D,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QAAC,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,UAAU,GAAG,KAAK,CAAC;IAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QACrC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QACrD,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,KAAK,CAAC,SAAS;QAC/B,YAAY,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;QACjC,UAAU;QACV,OAAO,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAQ,EAAE,UAAU,GAAG,UAAU,EAAE;IACtE,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAQ,EAAE,UAAU,GAAG,UAAU,EAAE;IACrE,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,iCAAiC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7H,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,UAAU,EAAE,EAAE,MAAM,GAAG,OAAO;IAC5E,MAAM,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,MAAM,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1F,IAAI,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,sEAAsE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACvF,CAAC","sourcesContent":["import { promises as dns } from 'node:dns';\nimport { promises as fs, statSync } from 'node:fs';\nimport net from 'node:net';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { spawnSync } from 'node:child_process';\n\nimport { configPath, normalizeSettings } from './config.js';\nimport { findOnPath, installHint } from './tunnel.js';\n\nexport function caddyfilePath(configFile = configPath()) {\n  return path.join(path.dirname(configFile), 'Caddyfile');\n}\n\nexport function renderCaddyfile(settings) {\n  const s = normalizeSettings(settings);\n  if (!s.domain) throw new Error('HTTPS needs a domain. Run `onboarder setup` and enter one first.');\n  return `# Managed by Onboarder. Edits are replaced by \\`onboarder https setup\\`.\\n${s.domain} {\\n  reverse_proxy 127.0.0.1:${s.port}\\n}\\n`;\n}\n\nfunction portIsFree(port, host = '0.0.0.0') {\n  return new Promise((resolve) => {\n    const probe = net.createServer();\n    probe.once('error', () => resolve(false));\n    probe.listen(port, host, () => probe.close(() => resolve(true)));\n  });\n}\n\nasync function resolveDomain(domain) {\n  const [v4, v6] = await Promise.allSettled([dns.resolve4(domain), dns.resolve6(domain)]);\n  const addresses = [\n    ...(v4.status === 'fulfilled' ? v4.value : []),\n    ...(v6.status === 'fulfilled' ? v6.value : []),\n  ];\n  return [...new Set(addresses)];\n}\n\nfunction localAddresses() {\n  const found = [];\n  for (const list of Object.values(os.networkInterfaces())) {\n    for (const address of list || []) if (!address.internal) found.push(address.address);\n  }\n  return found;\n}\n\nasync function caddyIsRunning(probe = portIsFree) {\n  // If 80 and 443 are both occupied, probe Caddy's local admin endpoint. This\n  // distinguishes the Ubuntu service from an unknown listener without sudo.\n  if (await probe(80)) return false;\n  if (await probe(443)) return false;\n  return new Promise((resolve) => {\n    const socket = net.connect(2019, '127.0.0.1');\n    const finish = (value) => { socket.destroy(); resolve(value); };\n    socket.setTimeout(800, () => finish(false));\n    socket.once('connect', () => finish(true));\n    socket.once('error', () => finish(false));\n  });\n}\n\nexport async function httpsReadiness(settings, { configFile = configPath(), resolve = resolveDomain, probe = portIsFree, tool = findOnPath, running = caddyIsRunning }: Record<string, any> = {}) {\n  const s = normalizeSettings(settings);\n  const caddy = tool('caddy');\n  const checks = [{ id: 'domain', ok: Boolean(s.domain), required: true, detail: s.domain || 'not configured' }];\n  if (!s.domain) return { ok: false, checks, caddy, addresses: [], local: [] };\n\n  let addresses = [];\n  let dnsError = '';\n  try { addresses = await resolve(s.domain); } catch (error) { dnsError = error.code || error.message; }\n  checks.push({ id: 'dns', ok: addresses.length > 0, required: true, detail: addresses.length ? addresses.join(', ') : `does not resolve${dnsError ? ` (${dnsError})` : ''}` });\n  const local = localAddresses();\n  const matches = addresses.some((address) => local.includes(address));\n  checks.push({ id: 'dns-target', ok: matches, required: false, detail: matches ? 'resolves to this machine' : 'does not match a local interface address (NAT/public-IP and proxy setups can still be valid)' });\n\n  const serviceRunning = await running(probe);\n  for (const port of [80, 443]) {\n    const free = await probe(port);\n    const ownedByCaddy = !free && serviceRunning;\n    checks.push({\n      id: `port-${port}`,\n      ok: free || ownedByCaddy,\n      required: true,\n      detail: free ? 'available for Caddy' : ownedByCaddy ? 'in use by the running Caddy service' : 'already in use — stop the existing web server or proxy',\n    });\n  }\n  checks.push({ id: 'caddy', ok: caddy.installed, required: true, detail: caddy.installed ? caddy.version : 'not installed — ' + installHint('caddy') });\n  return { ok: checks.every((check) => check.ok || !check.required), checks, caddy, addresses, local };\n}\n\nexport function httpsStatus(settings, configFile = configPath()) {\n  const s = normalizeSettings(settings);\n  const file = caddyfilePath(configFile);\n  const caddy = findOnPath('caddy');\n  let configured = false;\n  try { configured = Boolean(statSync(file)); } catch { configured = false; }\n  return {\n    enabled: Boolean(s.domain && s.https),\n    domain: s.domain,\n    url: s.domain && s.https ? `https://${s.domain}` : '',\n    caddyfile: file,\n    caddyInstalled: caddy.installed,\n    caddyVersion: caddy.version || '',\n    configured,\n    command: s.domain && s.https ? `caddy start --config ${file}` : '',\n  };\n}\n\nexport async function writeCaddyfile(settings, configFile = configPath()) {\n  const file = caddyfilePath(configFile);\n  await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });\n  await fs.writeFile(file, renderCaddyfile(settings), { encoding: 'utf8', mode: 0o600 });\n  return file;\n}\n\nexport async function caddyValidate(settings, configFile = configPath()) {\n  const s = normalizeSettings(settings);\n  if (!s.domain) throw new Error('HTTPS needs a domain. Run `onboarder setup` and enter one first.');\n  const caddy = findOnPath('caddy');\n  if (!caddy.installed) throw new Error('Caddy is not installed. ' + installHint('caddy'));\n  const file = caddyfilePath(configFile);\n  const result = spawnSync('caddy', ['validate', '--config', file], { encoding: 'utf8' });\n  if (result.error) throw result.error;\n  if (result.status !== 0) throw new Error(String(result.stderr || result.stdout || 'Caddy configuration is invalid.').trim());\n  return { file, output: String(result.stdout || result.stderr || '').trim() };\n}\n\nexport function caddyRun(settings, configFile = configPath(), action = 'start') {\n  const s = normalizeSettings(settings);\n  if (!s.domain || !s.https) throw new Error('Enable HTTPS with a domain first: `onboarder setup`.');\n  const caddy = findOnPath('caddy');\n  if (!caddy.installed) throw new Error('Caddy is not installed. ' + installHint('caddy'));\n  const file = caddyfilePath(configFile);\n  const result = spawnSync('caddy', [action, '--config', file], { encoding: 'utf8' });\n  if (result.error) throw result.error;\n  if (result.status !== 0) {\n    const message = String(result.stderr || result.stdout || `caddy ${action} failed`).trim();\n    if (/permission denied|address already in use/i.test(message) && process.platform !== 'win32') {\n      throw new Error(`${message}\\nStart the packaged service with: sudo systemctl enable --now caddy`);\n    }\n    throw new Error(message);\n  }\n  return { action, file, output: String(result.stdout || result.stderr || '').trim() };\n}\n"]}

package/server/index.d.ts

@@ -0,0 +1,40 @@
+import http from 'node:http';
+export declare const CONFIG: {
+    projectRoot: string;
+    publicDir: string;
+    sharedDir: string;
+    mcp: import("./mcp/runner.js").McpRunner;
+};
+export declare function createServer(config?: typeof CONFIG & {
+    configPath?: string;
+    getSettings?: () => Promise<import('../shared/contracts.js').Settings>;
+    boot?: {
+        host: string;
+        port: number;
+        domain: string;
+        https: boolean;
+    };
+}): http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>;
+export declare function startupBanner(settings: any, { configFile, columns }?: Record<string, any>): string;
+export declare function openInBrowser(url: any): void;
+export declare function listenError(error: any, { host, port, pid }?: Record<string, any>): any;
+export declare function startServer({ configFile, openBrowser, log }?: Record<string, any>): Promise<{
+    server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>;
+    settings: {
+        version: number;
+        mode: 'local' | 'self-hosted';
+        domain: string;
+        https: boolean;
+        accessKey: string;
+        autoOpen: boolean;
+        account: import("../shared/contracts.js").AccountSettings;
+        tunnel: {
+            cloudflare: boolean;
+            tailscale: boolean;
+        };
+        host: string;
+        port: number;
+    };
+    host: string;
+    port: number;
+}>;