codemem 0.22.0 → 0.22.1

package/README.md

@@ -21,6 +21,7 @@ npx -y codemem stats
 
 ```bash
 codemem --help
+codemem setup --opencode-only
 codemem stats
 codemem search "query"
 codemem serve start

package/dist/commands/serve.d.ts

@@ -2,6 +2,7 @@ import { Command } from "commander";
 import { type ResolvedServeInvocation } from "./serve-invocation.js";
 export declare function extractViewerPid(payload: unknown): number | null;
 export declare function isLocalHost(host: string): boolean;
+export declare function isLoopbackOnlyHost(host: string): boolean;
 export declare function isLikelyViewerCommand(command: string): boolean;
 export declare function pickViewerPidCandidate(statsPid: number | null, listenerPid: number | null): number | null;
 export declare function buildForegroundRunnerArgs(scriptPath: string, invocation: ResolvedServeInvocation, execArgv?: string[]): string[];

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEN,KAAK,uBAAuB,EAG5B,MAAM,uBAAuB,CAAC;AAQ/B,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKhE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASjD;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,WAAW,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAGf;AAqLD,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,uBAAuB,EACnC,QAAQ,GAAE,MAAM,EAAqB,GACnC,MAAM,EAAE,CAgBV;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS9D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpF;AA2SD,eAAO,MAAM,YAAY,SAuBtB,CAAC"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEN,KAAK,uBAAuB,EAG5B,MAAM,uBAAuB,CAAC;AAQ/B,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKhE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASjD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQxD;AASD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,WAAW,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAGf;AAqLD,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,uBAAuB,EACnC,QAAQ,GAAE,MAAM,EAAqB,GACnC,MAAM,EAAE,CAgBV;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAS9D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpF;AA6SD,eAAO,MAAM,YAAY,SAuBtB,CAAC"}

package/dist/index.js

@@ -953,6 +953,14 @@ function isLocalHost(host) {
 	const normalized = host.trim().toLowerCase();
 	return normalized === "127.0.0.1" || normalized === "localhost" || normalized === "::1" || normalized === "0.0.0.0" || normalized === "::";
 }
+function isLoopbackOnlyHost(host) {
+	const normalized = host.trim().toLowerCase();
+	return normalized === "localhost" || /^127(?:\.\d{1,3}){0,3}$/.test(normalized) || normalized === "::1" || normalized === "0:0:0:0:0:0:0:1";
+}
+function warnIfViewerExposed(host, port) {
+	if (isLoopbackOnlyHost(host)) return;
+	p.log.warn(`Viewer bound to ${host}:${port}. codemem's viewer trust model assumes localhost-only access; do not expose it through a reverse proxy, tunnel, or public bind without adding your own auth layer.`);
+}
 function isLikelyViewerCommand(command) {
 	const lowered = command.toLowerCase();
 	if (!/\bserve\s+start\b/.test(lowered)) return false;
@@ -1165,6 +1173,7 @@ function sqliteVecFailureDiagnostics(error, dbPath) {
 	];
 }
 async function startBackgroundViewer(invocation) {
+	warnIfViewerExposed(invocation.host, invocation.port);
 	if (await isPortOpen(invocation.host, invocation.port)) {
 		p.log.warn(`Viewer already running at http://${invocation.host}:${invocation.port}`);
 		return;
@@ -1193,6 +1202,7 @@ async function startForegroundViewer(invocation) {
 	const { createApp, createSyncApp, closeStore, getStore } = await import("@codemem/server");
 	const { serve } = await import("@hono/node-server");
 	if (invocation.dbPath) process.env.CODEMEM_DB = invocation.dbPath;
+	warnIfViewerExposed(invocation.host, invocation.port);
 	if (await isPortOpen(invocation.host, invocation.port)) {
 		p.log.warn(`Viewer already running at http://${invocation.host}:${invocation.port}`);
 		process.exitCode = 1;