coderemote 0.2.1 → 0.3.1

package/README.md

@@ -95,6 +95,8 @@ coderemote kill <id>...          # end terminal sessions (an id prefix from `sta
 coderemote kill --all            # end every session
 coderemote stop                  # stop the agent for this folder (--all: every agent)
 coderemote serve                 # share on 127.0.0.1 only, no tunnel (local testing)
+coderemote requests [PORT]       # requests that reached a previewed port (--grep, --failed, --json)
+coderemote request <ID>          # headers and bodies of one request (--show-secrets, --json)
 coderemote rotate-token          # revoke every paired device
 coderemote login                 # sign in again (--microsoft, or --device-code without a browser)
 coderemote update                # install the latest version (`up` says when there's one)
@@ -104,6 +106,12 @@ coderemote help                  # all options
 Options: `--root DIR` shares another folder; `--port N` picks the local port (default
 `31580`). The tunnel URL stays the same between runs, so paired phones reconnect on their own.
 
+`requests` and `request` read the traffic log of a port you preview from the app, so a coding
+agent in a terminal (Claude Code, Codex, …) can debug with it: run them in the shared folder.
+The log lives in the agent's memory only (the latest 200 requests per port, bodies up to 64 KB).
+Auth headers, cookies and token-like fields are masked; `--show-secrets` prints them, for
+example to reuse a session token in a test.
+
 ## Requirements
 
 - **Node.js 20** or newer on **macOS** (Linux is expected to work but not yet tested)

package/dist/coderemote.js

@@ -4,6 +4,7 @@
 import { execFile as execFile5, spawn as spawn3 } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import fs8 from "node:fs";
+import net2 from "node:net";
 import os4 from "node:os";
 import path7 from "node:path";
 import { fileURLToPath } from "node:url";
@@ -1478,7 +1479,7 @@ function parse(out) {
   return JSON.parse(out.slice(out.indexOf("{")));
 }
 function machineName(description) {
-  return (description || "").replace(/^(coderemote|vsremote)\s+/, "").replace(/\.local$/, "") || null;
+  return (description || "").replace(/^(coderemote|vsremote)\s+/, "").replace(/\.local\b/, "") || null;
 }
 function machine(tunnel, current) {
   return {
@@ -1587,7 +1588,7 @@ function installCommand(installedAt) {
 // package.json
 var package_default = {
   name: "coderemote",
-  version: "0.2.1",
+  version: "0.3.1",
   description: "Use your computer from your iPhone: files, git and a real terminal over a secure Microsoft Dev Tunnel. No SSH, no port forwarding, no VPN.",
   keywords: [
     "remote",
@@ -1654,6 +1655,148 @@ var package_default = {
   }
 };
 
+// src/requests.js
+var MASK = "[redacted]";
+var SECRET_HEADER = /^(authorization|proxy-authorization|cookie|set-cookie)$|token|secret|api[-_]?key|session|signature|csrf|xsrf/i;
+var SECRET_FIELD = /pass(word|wd)?$|secret|token|api[-_]?key|authorization|cookie|session|credential|private[-_]?key|^otp$|^code$|signature/i;
+var Redactor = class {
+  hidden = 0;
+  constructor({ show: show2 = false } = {}) {
+    this.show = show2;
+  }
+  #mask() {
+    this.hidden++;
+    return MASK;
+  }
+  /** Query parameters with secret-looking names, e.g. ?token=…. */
+  path(value) {
+    if (this.show) return value;
+    const q = value.indexOf("?");
+    if (q < 0) return value;
+    const params = value.slice(q + 1).split("&").map((pair) => {
+      const eq = pair.indexOf("=");
+      if (eq < 0 || !SECRET_FIELD.test(decodeSafe(pair.slice(0, eq)))) return pair;
+      return `${pair.slice(0, eq)}=${this.#mask()}`;
+    });
+    return `${value.slice(0, q)}?${params.join("&")}`;
+  }
+  header(name, value) {
+    if (this.show || !SECRET_HEADER.test(name)) return value;
+    const lower = name.toLowerCase();
+    if (lower === "authorization" || lower === "proxy-authorization") {
+      const space = value.indexOf(" ");
+      return space > 0 ? `${value.slice(0, space)} ${this.#mask()}` : this.#mask();
+    }
+    if (lower === "cookie") return value.split(/;\s*/).map((c) => this.#cookie(c)).join("; ");
+    if (lower === "set-cookie") {
+      const [first, ...attributes] = value.split(/;\s*/);
+      return [this.#cookie(first), ...attributes].join("; ");
+    }
+    return this.#mask();
+  }
+  #cookie(pair) {
+    const eq = pair.indexOf("=");
+    return eq < 0 ? pair : `${pair.slice(0, eq)}=${this.#mask()}`;
+  }
+  /** JSON and form bodies get secret fields masked; other text is left as sent. */
+  body(text, contentType = "", { pretty = true } = {}) {
+    if (/json/i.test(contentType) || /^\s*[[{]/.test(text)) {
+      try {
+        const value = JSON.parse(text);
+        return JSON.stringify(this.show ? value : this.#json(value), null, pretty ? 2 : void 0);
+      } catch {
+      }
+    }
+    if (!this.show && /x-www-form-urlencoded/i.test(contentType)) return this.path(`?${text}`).slice(1);
+    return text;
+  }
+  #json(value) {
+    if (Array.isArray(value)) return value.map((v) => this.#json(v));
+    if (!value || typeof value !== "object") return value;
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [
+        k,
+        SECRET_FIELD.test(k) && v != null && typeof v !== "object" && typeof v !== "boolean" ? this.#mask() : this.#json(v)
+      ])
+    );
+  }
+};
+function decodeSafe(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s;
+  }
+}
+function filterRequests(requests, { grep, failed } = {}) {
+  const needle = grep?.toLowerCase();
+  return requests.filter(
+    (r) => (!needle || `${r.method} ${r.path}`.toLowerCase().includes(needle)) && (!failed || r.error || (r.status ?? 0) >= 400)
+  );
+}
+function time(ms) {
+  return new Date(ms).toTimeString().slice(0, 8);
+}
+function bytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+function formatList(requests, redactor, { showPort = false } = {}) {
+  return requests.map((r) => {
+    const status2 = r.error ? "ERR" : r.status == null ? "..." : String(r.status);
+    const parts = [
+      `#${r.id}`.padEnd(6),
+      status2.padEnd(4),
+      `${r.method} ${redactor.path(r.path)}`,
+      r.duration == null ? "pending" : `${r.duration} ms`,
+      bytes(r.responseSize),
+      time(r.time)
+    ];
+    if (showPort) parts.push(`port ${r.port}`);
+    if (r.error) parts.push(r.error);
+    return parts.join("  ");
+  }).join("\n");
+}
+function formatDetail(d, redactor) {
+  const status2 = d.error ? `error: ${d.error}` : d.status == null ? "no response yet" : String(d.status);
+  const lines = [
+    `#${d.id}  ${d.method} ${redactor.path(d.path)}  ->  ${status2}`,
+    `${new Date(d.time).toISOString()}${d.duration == null ? "" : `  ${d.duration} ms`}`
+  ];
+  for (const [title, message] of [
+    ["Request", d.request],
+    ["Response", d.response]
+  ]) {
+    lines.push("", `${title} headers:`);
+    for (const name of Object.keys(message.headers).sort()) {
+      const values = [].concat(message.headers[name]);
+      for (const value of values) lines.push(`  ${name}: ${redactor.header(name, String(value))}`);
+    }
+    lines.push("", `${title} body: ${describeBody(message.body, redactor, message.headers["content-type"])}`);
+  }
+  return lines.join("\n");
+}
+function describeBody(body, redactor, contentType) {
+  if (!body.size) return "(empty)";
+  if (body.truncated) return `${bytes(body.size)}, too large to keep (only bodies up to 64 KB are recorded)`;
+  if (body.text == null) return `${bytes(body.size)} of binary data`;
+  return `${bytes(body.size)}
+${indent(redactor.body(body.text, contentType))}`;
+}
+function indent(text) {
+  return text.replace(/^/gm, "  ");
+}
+function redactDetail(d, redactor) {
+  const message = (m) => ({
+    headers: Object.fromEntries(
+      Object.entries(m.headers).map(([k, v]) => [k, Array.isArray(v) ? v.map((x) => redactor.header(k, String(x))) : redactor.header(k, String(v))])
+    ),
+    body: m.body.text == null ? m.body : { ...m.body, text: redactor.body(m.body.text, m.headers["content-type"], { pretty: false }) }
+  });
+  return { ...d, path: redactor.path(d.path), request: message(d.request), response: message(d.response) };
+}
+
 // src/spinner.js
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var dim = (s) => `\x1B[2m${s}\x1B[22m`;
@@ -1793,12 +1936,23 @@ function loadConfig() {
     cfg2.token = randomBytes(32).toString("base64url");
     saveConfig(cfg2);
   }
+  if (cfg2.tunnelId && !cfg2.tunnels) {
+    cfg2.tunnels = { [DEFAULT_PORT]: cfg2.tunnelId };
+    saveConfig(cfg2);
+  }
   return cfg2;
 }
 function saveConfig(cfg2) {
   fs8.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
   fs8.writeFileSync(CONFIG_FILE, JSON.stringify(cfg2, null, 2), { mode: 384 });
 }
+function portFree(port2) {
+  return new Promise((resolve) => {
+    const probe = net2.createServer();
+    probe.once("error", () => resolve(false));
+    probe.listen(port2, "127.0.0.1", () => probe.close(() => resolve(true)));
+  });
+}
 function listen(token, port2, root2, tunnelToken, preview, status2) {
   const server = createAgentServer({ token, root: root2, tunnelToken, preview, tunnelStatus: status2 });
   return new Promise((resolve, reject) => {
@@ -1867,20 +2021,22 @@ function applyAccess(tunnelId, anonymous2) {
   return anonymous2 ? devtunnel("access", "create", tunnelId, "--anonymous") : devtunnel("access", "reset", tunnelId);
 }
 async function ensureTunnel(cfg2, port2, anonymous2) {
-  if (cfg2.tunnelId) {
+  const known = cfg2.tunnels?.[port2];
+  if (known) {
     const [updated, access] = await Promise.all([
-      devtunnel("update", cfg2.tunnelId, "--expiration", "30d", "--add-labels", MACHINE_LABEL),
-      applyAccess(cfg2.tunnelId, anonymous2)
+      devtunnel("update", known, "--expiration", "30d", "--add-labels", MACHINE_LABEL),
+      applyAccess(known, anonymous2)
     ]);
     if (updated.ok) {
       if (!access.ok) throw new Error(`devtunnel access failed:
 ${access.out}`);
-      return cfg2.tunnelId;
+      return known;
     }
     if (!/not found/i.test(updated.out)) throw new Error(`devtunnel update failed:
 ${updated.out}`);
   }
-  const createArgs = ["create", "--expiration", "30d", "-d", `coderemote ${os4.hostname()}`, "--labels", MACHINE_LABEL, "--json"];
+  const name = port2 === DEFAULT_PORT ? os4.hostname() : `${os4.hostname()} :${port2}`;
+  const createArgs = ["create", "--expiration", "30d", "-d", `coderemote ${name}`, "--labels", MACHINE_LABEL, "--json"];
   if (anonymous2) createArgs.push("--allow-anonymous");
   const created = await devtunnel(...createArgs);
   if (!created.ok) throw new Error(`devtunnel create failed:
@@ -1891,7 +2047,8 @@ ${created.out}`);
   const portRes = await devtunnel("port", "create", tunnelId, "-p", String(port2), "--protocol", "http");
   if (!portRes.ok) throw new Error(`devtunnel port create failed:
 ${portRes.out}`);
-  cfg2.tunnelId = tunnelId;
+  cfg2.tunnels = { ...cfg2.tunnels, [port2]: tunnelId };
+  if (port2 === DEFAULT_PORT) cfg2.tunnelId = tunnelId;
   saveConfig(cfg2);
   return tunnelId;
 }
@@ -1977,13 +2134,20 @@ var USAGE = `Usage: coderemote <command> [options]
   stop [--all]         stop the agent for this folder (or every agent)
   rotate-token         revoke every paired device
   update               install the latest coderemote (up says when there's one)
+  requests [PORT]      list the requests that reached a previewed port, oldest first;
+                       --grep TEXT, --failed (errors, 4xx and 5xx), --limit N (default 50)
+  requests clear [PORT]  forget the recorded requests
+  request <ID> [PORT]  headers and bodies of one request (bodies up to 64 KB are kept);
+                       auth headers, cookies and token-like fields are masked unless
+                       --show-secrets is given; --json on either for machine-readable output
   version              print this coderemote's version (also --version, -v)
   login                sign in to Microsoft Dev Tunnels with GitHub (up does this when needed);
                        --microsoft for a Microsoft account, --device-code without a browser
 
 Options:
   --root DIR           folder to share (default: current folder)
-  --port N             local port (default: ${DEFAULT_PORT})
+  --port N             local port (default: the first free one from ${DEFAULT_PORT}; each port
+                       keeps its own tunnel URL, so a folder pairs once per port)
   --allow-anonymous    up: skip the sign-in, the pairing token alone grants access
                        (alias --no-auth)
   --web                up: also run \`code tunnel\` and print a vscode.dev link that opens
@@ -2001,11 +2165,32 @@ var root = path7.resolve(flag("--root") ?? process.cwd());
 var cfg = loadConfig();
 var registry = new AgentRegistry(path7.join(CONFIG_DIR, "agents"));
 async function start({ tunnel }) {
-  const running = registry.list().find((a) => a.port === port);
-  if (running) {
-    console.error(`An agent already runs on port ${port} for ${running.root} (pid ${running.pid}).`);
-    console.error("Stop it with `coderemote stop --all`, or pick another port with --port.");
-    process.exit(1);
+  const agents = registry.list();
+  if (flag("--port")) {
+    const running = agents.find((a) => a.port === port);
+    if (running) {
+      console.error(`An agent already runs on port ${port} for ${running.root} (pid ${running.pid}).`);
+      console.error("Stop it with `coderemote stop --all`, or pick another port with --port.");
+      process.exit(1);
+    }
+  } else {
+    const sharing = agents.find((a) => a.root === root);
+    if (sharing) {
+      console.error(`${root} is already shared on port ${sharing.port} (pid ${sharing.pid}).`);
+      console.error("Stop it with `coderemote stop`, or start another one with --port.");
+      process.exit(1);
+    }
+    const taken = async (p) => agents.some((a) => a.port === p) || !await portFree(p);
+    const remembered = cfg.folderPorts?.[root];
+    if (remembered && !await taken(remembered)) port = remembered;
+    else {
+      const claimed = new Set(Object.values(cfg.folderPorts ?? {}));
+      while (claimed.has(port) || await taken(port)) port++;
+    }
+    if (port !== remembered) {
+      cfg.folderPorts = { ...cfg.folderPorts, [root]: port };
+      saveConfig(cfg);
+    }
   }
   let server;
   let tunnelId;
@@ -2045,7 +2230,7 @@ async function start({ tunnel }) {
     account = user;
     spinner.succeed();
     spinner.start("Connecting to the relay");
-    const known = cfg.tunnelId;
+    const known = cfg.tunnels?.[port];
     let hosting = known ? hostTunnel(known, port) : null;
     hosting?.catch(() => {
     });
@@ -2092,6 +2277,26 @@ async function sessionsOf(agent) {
     return [];
   }
 }
+function currentAgent() {
+  const agents = registry.list();
+  if (flag("--port")) return agents.find((a) => a.port === port);
+  const here = process.cwd();
+  const containing = agents.filter((a) => here === a.root || here.startsWith(a.root + path7.sep)).sort((a, b) => b.root.length - a.root.length);
+  return containing[0] ?? (agents.length === 1 ? agents[0] : void 0);
+}
+async function previewPorts(agent, given) {
+  if (given) return [given];
+  let ports = [];
+  try {
+    ports = (await agentApi(agent, "GET", "/api/preview")).ports.map((p) => p.port);
+  } catch {
+  }
+  if (!ports.length) {
+    console.error("No port is being previewed. Open a preview from the app, or name the port (a closed preview keeps its log).");
+    process.exit(1);
+  }
+  return ports;
+}
 function ago(ms) {
   const s = Math.round((Date.now() - ms) / 1e3);
   if (s < 60) return `${s}s`;
@@ -2122,8 +2327,11 @@ Token: ${cfg.token}`);
   Sharing: ${root}`);
     printPairing(url, cfg.token, access, vscodeUrl);
     const newer = await update;
-    if (newer) console.log(`  Update available: ${VERSION} \u2192 ${newer}. Run \`coderemote update\` to install it.
+    if (newer) {
+      const c = (code, s) => process.stdout.isTTY ? `\x1B[${code}m${s}\x1B[0m` : s;
+      console.log(`  ${c("1;33", "\u2B06 Update available:")} ${c("2", VERSION)} \u2192 ${c("1;32", newer)}. Run ${c("36", "coderemote update")} to install it.
 `);
+    }
     break;
   }
   case "status":
@@ -2227,6 +2435,79 @@ Updated to coderemote ${latest}.`);
     }
     break;
   }
+  case "requests":
+  case "request": {
+    const agent = currentAgent();
+    if (!agent) {
+      const running = registry.list();
+      console.error(
+        flag("--port") ? `No agent is running on port ${port}.` : running.length ? `Several agents are running; run this inside a shared folder or pick one with --port (${running.map((a) => a.port).join(", ")}).` : "No agent is running. Start one with `coderemote up`."
+      );
+      process.exit(1);
+    }
+    const valued = /* @__PURE__ */ new Set(["--grep", "--limit", "--port"]);
+    const words = rest.filter((a, i) => !a.startsWith("--") && !valued.has(rest[i - 1]));
+    const json = rest.includes("--json");
+    const redactor = new Redactor({ show: rest.includes("--show-secrets") });
+    const hint = () => {
+      if (redactor.hidden && !json) console.error(`
+(${redactor.hidden} secret value${redactor.hidden === 1 ? "" : "s"} masked; add --show-secrets to print them)`);
+    };
+    if (cmd === "request") {
+      const id = parseInt(words[0], 10);
+      if (!id) {
+        console.error("Usage: coderemote request <ID> [PORT] [--show-secrets] [--json]");
+        process.exit(1);
+      }
+      let found;
+      for (const p of await previewPorts(agent, words[1])) {
+        try {
+          found = await agentApi(agent, "GET", "/api/preview/request", { port: p, id });
+          break;
+        } catch {
+        }
+      }
+      if (!found) {
+        console.error(`No request #${id} (only the latest 200 per port are kept).`);
+        process.exit(1);
+      }
+      console.log(json ? JSON.stringify(redactDetail(found, redactor), null, 2) : formatDetail(found, redactor));
+      hint();
+      break;
+    }
+    if (words[0] === "clear") {
+      for (const p of await previewPorts(agent, words[1])) {
+        await agentApi(agent, "DELETE", "/api/preview/requests", { port: p });
+        console.log(`cleared the requests to port ${p}`);
+      }
+      break;
+    }
+    const ports = await previewPorts(agent, words[0]);
+    let requests = [];
+    for (const p of ports) {
+      const { requests: list } = await agentApi(agent, "GET", "/api/preview/requests", { port: p });
+      requests.push(...list.map((r) => ({ ...r, port: Number(p) })));
+    }
+    requests.sort((a, b) => a.id - b.id);
+    requests = filterRequests(requests, { grep: flag("--grep"), failed: rest.includes("--failed") });
+    const limit = parseInt(flag("--limit"), 10) || 50;
+    const total = requests.length;
+    requests = requests.slice(-limit);
+    if (json) {
+      console.log(JSON.stringify(requests.map((r) => ({ ...r, path: redactor.path(r.path) })), null, 2));
+      break;
+    }
+    if (!total) {
+      console.log("No matching requests.");
+      break;
+    }
+    console.log(formatList(requests, redactor, { showPort: ports.length > 1 }));
+    if (total > requests.length) console.error(`
+(${total - requests.length} older not shown; raise --limit)`);
+    console.error("\nDetails: coderemote request <ID>");
+    hint();
+    break;
+  }
   case "version":
     console.log(VERSION);
     break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coderemote",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Use your computer from your iPhone: files, git and a real terminal over a secure Microsoft Dev Tunnel. No SSH, no port forwarding, no VPN.",
   "keywords": [
     "remote",