codeden 0.3.0 → 0.4.1

package/dist/{runner-DGomZl80.js → runner-Doy0yaNT.js}

@@ -11010,6 +11010,201 @@ object({
 		message: string()
 	}).optional()
 });
+/** The password rules in plain words, shown next to the password field. */
+const PASSWORD_RULE_TEXT = "Use at least 15 characters. A short sentence or a few random words works well. Very common passwords, repeated characters and simple sequences such as abcdef… or 12345… are refused.";
+/** Base words of very common passwords; a password made of one of these plus digits is refused. */
+const COMMON_WORDS = /* @__PURE__ */ new Set([
+	"password",
+	"passw0rd",
+	"letmein",
+	"welcome",
+	"admin",
+	"administrator",
+	"iloveyou",
+	"qwerty",
+	"monkey",
+	"dragon",
+	"football",
+	"baseball",
+	"sunshine",
+	"princess",
+	"superman",
+	"batman",
+	"trustno",
+	"master",
+	"shadow",
+	"michael",
+	"jennifer",
+	"computer",
+	"secret",
+	"changeme",
+	"codeden",
+	"default",
+	"login",
+	"hello",
+	"abc",
+	"test",
+	"guest",
+	"root",
+	"starwars",
+	"whatever",
+	"freedom",
+	"mustang",
+	"pokemon",
+	"charlie",
+	"correcthorsebatterystaple"
+]);
+/** Character runs a "sequence" password walks along (alphabet, digits, keyboard rows). */
+const SEQUENCES = [
+	"abcdefghijklmnopqrstuvwxyz",
+	"0123456789",
+	"qwertyuiopasdfghjklzxcvbnm",
+	"qwertzuiopasdfghjklyxcvbnm",
+	"azertyuiopqsdfghjklmwxcvbn",
+	"1qaz2wsx3edc4rfv5tgb6yhn7ujm8ik9ol0p",
+	"qazwsxedcrfvtgbyhnujmikolp",
+	"1234567890qwertyuiopasdfghjklzxcvbnm"
+];
+/** True when `text` is one short unit repeated (`abcabcabc`, `passwordpassword`). */
+function isRepeatedUnit(text) {
+	for (let size = 1; size <= text.length / 2; size++) {
+		if (text.length % size !== 0) continue;
+		if (text.slice(0, size).repeat(text.length / size) === text) return true;
+	}
+	return false;
+}
+/** True when `text` walks along one of the known sequences, forwards or backwards (wrapping). */
+function isSequence(text) {
+	return SEQUENCES.some((seq) => {
+		const looped = seq.repeat(Math.ceil(text.length / seq.length) + 2);
+		const reversed = [...looped].reverse().join("");
+		return looped.includes(text) || reversed.includes(text);
+	});
+}
+/**
+* Why `password` can't be used for network access, in plain words, or null when it is fine.
+* Shared by the server (which enforces it) and the UI (which explains it as you type).
+*/
+function passwordProblem(password) {
+	if (password.length < 15) return `Use at least 15 characters (this one has ${password.length}).`;
+	if (password.length > 256) return `Use at most 256 characters.`;
+	const lower = password.toLowerCase();
+	const compact = lower.replace(/\s+/g, "");
+	if (new Set(compact).size < 5 || isRepeatedUnit(compact)) return "That repeats the same few characters. Try a few random words instead.";
+	if (isSequence(compact)) return "That is a simple sequence. Try a few random words instead.";
+	const letters = lower.replace(/[^a-z]/g, "");
+	const words = lower.split(/[^a-z]+/).filter(Boolean);
+	if (letters.length > 0 && (COMMON_WORDS.has(letters) || isRepeatedUnitOf(letters, COMMON_WORDS) || words.length > 0 && words.every((w) => COMMON_WORDS.has(w)))) return "That is too close to a very common password. Try a few random words instead.";
+	return null;
+}
+function isRepeatedUnitOf(text, units) {
+	for (const unit of units) if (text.length % unit.length === 0 && unit.repeat(text.length / unit.length) === text) return true;
+	return false;
+}
+/** One address CodeDen can be opened on, with the URL a phone would scan. */
+const NetworkAddress = object({
+	kind: _enum([
+		"local",
+		"lan",
+		"vpn"
+	]),
+	/** Human label, e.g. "This computer", "Wi-Fi (192.168.1.20)", "Tailscale". */
+	label: string(),
+	/** The interface the address belongs to (`Wi-Fi`, `eth0`, `tailscale0`), or null for localhost. */
+	interfaceName: string().nullable(),
+	/** The bare host: `localhost` or an IPv4 address. */
+	host: string(),
+	/** `http://<host>:<port>`. */
+	url: string()
+});
+/** A signed-in remote device, as listed in Settings › Network access (never the token). */
+const RemoteDevice = object({
+	id: string(),
+	/** The browser's user agent when it signed in (trimmed). */
+	label: string(),
+	/** The address it signed in from. */
+	address: string().nullable(),
+	createdAt: Timestamp,
+	lastSeenAt: Timestamp,
+	expiresAt: Timestamp,
+	/** The device making this request. */
+	current: boolean()
+});
+/**
+* `GET /api/network`: whether network access is on, where CodeDen answers, and who is signed
+* in. `remote` tells the caller whether it is itself a remote device (management is
+* loopback-only, so the UI shows the controls read-only there).
+*/
+const NetworkStatus = object({
+	enabled: boolean(),
+	passwordSet: boolean(),
+	passwordSetAt: Timestamp.nullable(),
+	/** Where the HTTP listener is bound right now. */
+	listening: _enum(["loopback", "network"]),
+	port: int().nonnegative(),
+	/** Addresses CodeDen answers on: localhost always, LAN and VPN addresses when enabled. */
+	addresses: array(NetworkAddress),
+	/** Addresses it would answer on once enabled (for the off state's preview). */
+	candidates: array(NetworkAddress),
+	devices: array(RemoteDevice),
+	remote: boolean()
+});
+/**
+* `POST /api/network/password` (loopback only): set a password, or let the server generate a
+* passphrase. Either way every remote device is signed out.
+*/
+const SetNetworkPasswordRequest = union([object({ password: string().min(1).max(256) }), object({ generate: literal(true) })]);
+/** Response to setting the password: the generated passphrase is returned once, never again. */
+const SetNetworkPasswordResponse = object({
+	status: NetworkStatus,
+	generated: string().nullable()
+});
+/** `PUT /api/network` (loopback only): turn network access on or off. */
+const SetNetworkAccessRequest = object({ enabled: boolean() });
+/** `POST /api/auth/sign-in` from a remote device. */
+const SignInRequest = object({ password: string().max(256) });
+object({
+	/** The caller is not on this machine. */
+	remote: boolean(),
+	/** The caller has a valid session (remote) or install-token cookie (local). */
+	signedIn: boolean(),
+	networkEnabled: boolean()
+});
+object({ error: object({
+	code: _enum([
+		"invalid_password",
+		"rate_limited",
+		"locked_out",
+		"network_off"
+	]),
+	message: string(),
+	retryAfterSec: int().nonnegative().nullable()
+}) });
+/** A stored remote session: only the SHA-256 hash of its token is kept. */
+const RemoteSessionRecord = object({
+	id: string(),
+	tokenHash: string().regex(/^[0-9a-f]{64}$/),
+	label: string(),
+	address: string().nullable(),
+	createdAt: Timestamp,
+	lastSeenAt: Timestamp,
+	expiresAt: Timestamp
+});
+/**
+* `<home>/remote-access.json` (mode 0600): the network switch, the password hash (scrypt,
+* salted; never the password) and the remote sessions. Kept out of `settings.json` so the
+* settings API can't switch network access on without the checks.
+*/
+const RemoteAccessFile = object({
+	schemaVersion: literal(1).default(1),
+	enabled: boolean().default(false),
+	password: object({
+		/** `scrypt$<N>$<r>$<p>$<salt b64>$<hash b64>`. */
+		hash: string().startsWith("scrypt$"),
+		setAt: Timestamp
+	}).nullable().default(null),
+	sessions: array(RemoteSessionRecord).default([])
+});
 object({ session: Session.nullable() });
 /** `POST .../orchestrator/messages` and `.../projects/:id/pm/messages`. */
 const RoleMessageRequest = object({
@@ -11627,7 +11822,7 @@ object({
 * rest of the bundle, so the package version is the single source of truth at runtime;
 * everywhere else (workspace, tests) it is `SOURCE_VERSION`.
 */
-const CODEDEN_VERSION = packageVersion() ?? "0.3.0";
+const CODEDEN_VERSION = packageVersion() ?? "0.4.1";
 function packageVersion() {
 	const value = globalThis.__CODEDEN_PACKAGE_VERSION__;
 	return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -29363,6 +29558,6 @@ async function startRunner(opts) {
 		close
 	};
 }
-export { ExportAutomationsQuery as $, datetime as $n, TriageIssueRequest as $t, SessionFileQuery as A, SessionOptions as An, UiClientMessage as At, ImageTestRequest as B, InboxItemKind as Bn, UpdateInstallRequest as Bt, isElectronRuntime as C, GitPushRequest as Cn, SecretKey as Ct, CODEDEN_VERSION as D, TerminalClientMessage as Dn, StartSessionRequest as Dt, wrapper_default as E, SpeechSummaryRequest as En, SetSecretRequest as Et, ListConflictsQuery as F, Project as Fn, LOCAL_STT_SAMPLE_RATE as Ft, BrowserNavigateRequest as G, AgentConfigLocator as Gn, NOTICE_BATCH_CODE as Gt, BrowserClientMessage as H, AgentConfigDeleteQuery as Hn, compareVersions$1 as Ht, ListNoticesQuery as I, sortProjects as In, LocalSttModelParams as It, BrowserViewportRequest as J, McpServerTarget as Jn, GithubIssue as Jt, BrowserNewTabRequest as K, AgentConfigWriteRequest as Kn, CreateGithubIssueRequest as Kt, ResolveConflictRequest as L, DEFAULT_VISION_PATH as Ln, SttQuery as Lt, RunnerToServerMessage as M, ConflictDecision as Mn, HealthResponse as Mt, ServerLock as N, StartedBy as Nn, agentEventToNewEvent as Nt, UsageQuery as O, TerminalQuery as On, SteerRequest as Ot, ArchiveSessionRequest as P, WorkKey as Pn, Settings as Pt, DuplicateAutomationRequest as Q, ReasoningEffort as Qn, MergePrRequest as Qt, RoleMessageRequest as R, FactoryLimits as Rn, TtsRequest as Rt, acquireInstallLock as S, GitCommitRequest as Sn, RespondRequest as St, import_websocket_server as T, SessionResult as Tn, SessionStartMeta as Tt, BrowserDevServerRequest as U, AgentConfigDiffRequest as Un, isNewerVersion as Ut, summarizeActivity as V, messageFrom as Vn, UpdateStatus as Vt, BrowserHistoryRequest as W, AgentConfigListQuery as Wn, ConflictRecord as Wt, AUTOMATION_IMPORT_LIMITS as X, AutonomyLevel as Xn, GithubListQuery as Xt, BrowserWsQuery as Y, McpServerUpsertRequest as Yn, GithubLabelRequest as Yt, AutomationImportSource as Z, ProviderId as Zn, GithubPr as Zt, importClaudeSdkFrom as _, TriagePolicy as _n, unknown as _r, FileWriteRequest as _t, Hono as a, FactoryTuning as an, discriminatedUnion as ar, ListAutomationRunsQuery as at, runNpm as b, DiffScope as bn, safeParse$1 as br, ReorderProjectsRequest as bt, serve as c, ReviewVerdict as cn, literal as cr, SetAutomationEnabledRequest as ct, createImageEngineRegistry as d, Artifact as dn, object as dr, TriageReport as dt, githubPrId as en, _enum as er, ImportAutomationsRequest as et, IMAGE_ASPECT_RATIOS as f, Automation as fn, optional as fr, UpcomingRunsQuery as ft, CLAUDE_SDK_VERSION as g, AutomationTrigger as gn, union as gr, FileReadQuery as gt, claudeSdkSource as h, AutomationRun as hn, string as hr, CreateProjectRequest as ht, killTree as i, FactoryTriageRequest as in, custom as ir, CreateAutomationRequest as it, RunnerLock as j, ProjectConfigFile as jn, UpdateProjectRequest as jt, UsageSettings as k, RunnerCommandResults as kn, ThreadItemsQuery as kt, upgradeWebSocket as l, SetAutonomyModeRequest as ln, looseObject as lr, StarterSetRequest as lt, ImageGenerationError as m, AutomationGuards as mn, record as mr, UpdateAutomationRequest as mt, readLock as n, DiscoveryArea as nn, array as nr, AutomationGuardsPatch as nt, tryDecodeURIComponent as o, KillSwitchRequest as on, int as or, ListAutomationsQuery as ot, resolveImageOutput as p, AutomationAction as pn, preprocess as pr, UpdateAutomationProjectSettingsRequest as pt, BrowserOpenRequest as q, McpServerDiffRequest as qn, GithubCommentRequest as qt, isAlive as r, FactoryCandidate as rn, boolean as rr, AutomationProjectRequest as rt, bufferToFormData as s, PutVisionRequest as sn, intersection as sr, RunAutomationRequest as st, startRunner as t, parseGithubPrId as tn, _null as tr, AutomationFileFrontmatter as tt, ImageEngineRegistry as u, isFactoryMode as un, number$1 as ur, TriageDecisionRequest as ut, installClaudeSdk as v, Session as vn, ZodError as vr, ListInboxQuery as vt, ownNodeEnv as w, RestoreFilesRequest as wn, SendMessageRequest as wt, resolveNpm as x, EditQueuedMessageRequest as xn, prettifyError as xr, ResolveInboxRequest as xt, isClaudeSdkInstalled as y, SessionStatus as yn, toJSONSchema as yr, ListSessionsQuery as yt, UpdateSessionRequest as z, InboxItem as zn, AppPointer as zt };
+export { BrowserNavigateRequest as $, AgentConfigLocator as $n, NOTICE_BATCH_CODE as $t, SessionFileQuery as A, GitCommitRequest as An, RespondRequest as At, NetworkStatus as B, ConflictDecision as Bn, HealthResponse as Bt, isElectronRuntime as C, AutomationRun as Cn, string as Cr, CreateProjectRequest as Ct, CODEDEN_VERSION as D, SessionStatus as Dn, toJSONSchema as Dr, ListSessionsQuery as Dt, wrapper_default as E, Session as En, ZodError as Er, ListInboxQuery as Et, ListConflictsQuery as F, TerminalClientMessage as Fn, StartSessionRequest as Ft, SetNetworkPasswordResponse as G, DEFAULT_VISION_PATH as Gn, SttQuery as Gt, RemoteAccessFile as H, WorkKey as Hn, Settings as Ht, ListNoticesQuery as I, TerminalQuery as In, SteerRequest as It, ImageTestRequest as J, InboxItemKind as Jn, UpdateInstallRequest as Jt, SignInRequest as K, FactoryLimits as Kn, TtsRequest as Kt, ResolveConflictRequest as L, RunnerCommandResults as Ln, ThreadItemsQuery as Lt, RunnerToServerMessage as M, RestoreFilesRequest as Mn, SendMessageRequest as Mt, ServerLock as N, SessionResult as Nn, SessionStartMeta as Nt, UsageQuery as O, DiffScope as On, safeParse$1 as Or, ReorderProjectsRequest as Ot, ArchiveSessionRequest as P, SpeechSummaryRequest as Pn, SetSecretRequest as Pt, BrowserHistoryRequest as Q, AgentConfigListQuery as Qn, ConflictRecord as Qt, RoleMessageRequest as R, SessionOptions as Rn, UiClientMessage as Rt, acquireInstallLock as S, AutomationGuards as Sn, record as Sr, UpdateAutomationRequest as St, import_websocket_server as T, TriagePolicy as Tn, unknown as Tr, FileWriteRequest as Tt, SetNetworkAccessRequest as U, Project as Un, LOCAL_STT_SAMPLE_RATE as Ut, PASSWORD_RULE_TEXT as V, StartedBy as Vn, agentEventToNewEvent as Vt, SetNetworkPasswordRequest as W, sortProjects as Wn, LocalSttModelParams as Wt, BrowserClientMessage as X, AgentConfigDeleteQuery as Xn, compareVersions$1 as Xt, summarizeActivity as Y, messageFrom as Yn, UpdateStatus as Yt, BrowserDevServerRequest as Z, AgentConfigDiffRequest as Zn, isNewerVersion as Zt, importClaudeSdkFrom as _, SetAutonomyModeRequest as _n, looseObject as _r, StarterSetRequest as _t, Hono as a, GithubPr as an, ProviderId as ar, AutomationImportSource as at, runNpm as b, Automation as bn, optional as br, UpcomingRunsQuery as bt, createAdaptorServer as c, githubPrId as cn, _enum as cr, ImportAutomationsRequest as ct, createImageEngineRegistry as d, FactoryCandidate as dn, boolean as dr, AutomationProjectRequest as dt, CreateGithubIssueRequest as en, AgentConfigWriteRequest as er, BrowserNewTabRequest as et, IMAGE_ASPECT_RATIOS as f, FactoryTriageRequest as fn, custom as fr, CreateAutomationRequest as ft, CLAUDE_SDK_VERSION as g, ReviewVerdict as gn, literal as gr, SetAutomationEnabledRequest as gt, claudeSdkSource as h, PutVisionRequest as hn, intersection as hr, RunAutomationRequest as ht, killTree as i, GithubListQuery as in, AutonomyLevel as ir, AUTOMATION_IMPORT_LIMITS as it, RunnerLock as j, GitPushRequest as jn, SecretKey as jt, UsageSettings as k, EditQueuedMessageRequest as kn, prettifyError as kr, ResolveInboxRequest as kt, upgradeWebSocket as l, parseGithubPrId as ln, _null as lr, AutomationFileFrontmatter as lt, ImageGenerationError as m, KillSwitchRequest as mn, int as mr, ListAutomationsQuery as mt, readLock as n, GithubIssue as nn, McpServerTarget as nr, BrowserViewportRequest as nt, tryDecodeURIComponent as o, MergePrRequest as on, ReasoningEffort as or, DuplicateAutomationRequest as ot, resolveImageOutput as p, FactoryTuning as pn, discriminatedUnion as pr, ListAutomationRunsQuery as pt, passwordProblem as q, InboxItem as qn, AppPointer as qt, isAlive as r, GithubLabelRequest as rn, McpServerUpsertRequest as rr, BrowserWsQuery as rt, bufferToFormData as s, TriageIssueRequest as sn, datetime as sr, ExportAutomationsQuery as st, startRunner as t, GithubCommentRequest as tn, McpServerDiffRequest as tr, BrowserOpenRequest as tt, ImageEngineRegistry as u, DiscoveryArea as un, array as ur, AutomationGuardsPatch as ut, installClaudeSdk as v, isFactoryMode as vn, number$1 as vr, TriageDecisionRequest as vt, ownNodeEnv as w, AutomationTrigger as wn, union as wr, FileReadQuery as wt, resolveNpm as x, AutomationAction as xn, preprocess as xr, UpdateAutomationProjectSettingsRequest as xt, isClaudeSdkInstalled as y, Artifact as yn, object as yr, TriageReport as yt, UpdateSessionRequest as z, ProjectConfigFile as zn, UpdateProjectRequest as zt };
 
-//# sourceMappingURL=runner-DGomZl80.js.map
+//# sourceMappingURL=runner-Doy0yaNT.js.map