codeden 0.2.0 → 0.4.0

package/README.md

@@ -165,8 +165,8 @@ More in [Architecture](https://github.com/leonvanzyl/codeden/blob/main/docs/arch
 
 ## Security model
 
-- The server and runner listen on **127.0.0.1 only**. Remote or LAN access is not part of v1.
-- Every HTTP, WebSocket and MCP request needs a **per-install random token**. The browser gets it once through the launch URL, then holds it in an HttpOnly, `SameSite=Strict` cookie.
+- The server and runner listen on **127.0.0.1 only** by default. **Network access** for your phone or tablet is opt-in, needs a password (stored only as a salted hash), and never exposes the runner or the agents' MCP endpoint. See [Phones, tablets and network access](https://github.com/leonvanzyl/codeden/blob/main/docs/remote-access.md).
+- Every local HTTP, WebSocket and MCP request needs a **per-install random token**. The browser gets it once through the launch URL, then holds it in an HttpOnly, `SameSite=Strict` cookie.
 - `Host` and `Origin` headers are checked, which blocks other websites and DNS rebinding from reaching the local API.
 - Agent MCP tokens are **per session and role-scoped**, stored only as hashes, and revoked when the session ends.
 - The default autonomy level, **Auto, risky actions ask**, lets agents edit and run normal commands inside their worktree, and sends risky actions to your inbox: writes outside the worktree, force pushes, branch deletion, global installs, piping downloads into a shell, and secrets access.
@@ -224,6 +224,8 @@ codeden [options]      Start CodeDen and open it in the browser
 codeden doctor         Check the installation (--install: add Claude Code support now)
 codeden update         Install the latest version and switch to it (--rollback: go back)
 codeden stop           Stop the server and the runner
+codeden password       Set the network access password (--generate: make one up)
+codeden network on|off Let phones on your network open CodeDen, or stop it
 
 Options:
   --port <n>     Port to listen on (default 4317)
@@ -277,6 +279,9 @@ The server stops; the runner, and any agent mid-turn, keeps going. The next `cod
 **Which platforms?**
 Windows, macOS and Linux. Windows is tested first.
 
+**Can I use it from my phone?**
+Yes. Turn on **Settings › Network access**, set a password, and scan the QR code with your phone on the same Wi-Fi (or over your own VPN such as Tailscale). The UI adapts to phones and tablets, and **Add to Home Screen** opens it full screen. Plain http addresses mean no notifications or microphone on the phone. See [Phones, tablets and network access](https://github.com/leonvanzyl/codeden/blob/main/docs/remote-access.md).
+
 **Is the dark factory safe to leave running?**
 It's experimental. Read [Autonomy and the dark factory](https://github.com/leonvanzyl/codeden/blob/main/docs/autonomy-and-dark-factory.md) first, start with Autopilot on a sandbox repository, set a budget and protected areas, and keep the kill switch in reach.
 
@@ -294,6 +299,7 @@ It's experimental. Read [Autonomy and the dark factory](https://github.com/leonv
 | [Agent configuration](https://github.com/leonvanzyl/codeden/blob/main/docs/agent-config.md) | Memory, skills, subagents and MCP servers |
 | [Voice and images](https://github.com/leonvanzyl/codeden/blob/main/docs/voice-and-images.md) | Dictation, read-aloud and image generation |
 | [Usage and costs](https://github.com/leonvanzyl/codeden/blob/main/docs/usage-and-costs.md) | The ledger, reports, budgets and rate limits |
+| [Phones, tablets and network access](https://github.com/leonvanzyl/codeden/blob/main/docs/remote-access.md) | Opening CodeDen from your phone, the QR code, Add to Home Screen and VPNs |
 | [Security](https://github.com/leonvanzyl/codeden/blob/main/docs/security.md) | The security model in detail |
 | [Troubleshooting](https://github.com/leonvanzyl/codeden/blob/main/docs/troubleshooting.md) | `doctor`, logs and common issues |
 | [Architecture](https://github.com/leonvanzyl/codeden/blob/main/docs/architecture.md) | How the pieces fit, with a link to the full design |

package/dist/THIRD-PARTY-NOTICES.txt

@@ -739,6 +739,32 @@ The complete list of contributors can be found at:
 
 ------------------------------------------------------------------------
 
+fflate@0.8.3 (MIT)
+
+MIT License
+
+Copyright (c) 2026 Arjun Barrett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+------------------------------------------------------------------------
+
 hono@4.13.17 (MIT)
 
 MIT License

package/dist/cli.js

@@ -242,7 +242,7 @@ async function run() {
 		console.log(selfVersion);
 		process.exit(0);
 	}
-	await import("./main-pXwL7GDQ.js");
+	await import("./main-sEg3GS7X.js");
 }
 /** Settles once this copy's CLI has loaded (an older launcher that switched here awaits it). */
 const started = run();

package/dist/drizzle/20261108085346_automation_created_by/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE `automations` ADD `created_by` text;