codesesh 1.0.0 → 1.0.1

package/README.md

@@ -87,7 +87,10 @@ npx codesesh --trace
 | ----------- | ----- | ------- | ----------------------------------------------------------- |
 | `--port`    | `-p`  | `4521`  | HTTP server starting port; falls back to the next available port if busy |
 | `--host`    | —     | `127.0.0.1` | HTTP server bind address; non-loopback values require `--remote-access` |
-| `--remote-access` | — | `false` | Enable token-protected access on a non-loopback host                  |
+| `--remote-access` | — | `false` | Enable token-protected access for any remotely exposed transport     |
+| `--tls-cert` | — | — | Path to a TLS certificate; serves remote access over HTTPS            |
+| `--tls-key` | — | — | Path to the private key matching `--tls-cert`                          |
+| `--trust-proxy` | — | `false` | A reverse proxy in front of CodeSesh terminates TLS                    |
 | `--days`    | `-d`  | `7`     | Only include sessions active in the last N days (`0` = all time) |
 | `--cwd`     | —     | —       | Filter to sessions from a project directory                 |
 | `--agent`   | `-a`  | all     | Filter to specific agent(s), comma-separated                |
@@ -101,14 +104,34 @@ npx codesesh --trace
 | `--clear-cache` | — | `false` | Clear scan cache before starting                            |
 | `-v`        | —     | —       | Print version number                                        |
 
-When remote access is enabled, CodeSesh prints a startup URL containing a fresh access token.
-Anyone with that URL can read the indexed AI session history, so treat it as a password and do not
-share or persist it.
+Non-loopback binding and `--trust-proxy` both require `--remote-access`. This includes the common
+setup where CodeSesh listens on `127.0.0.1` and a same-machine reverse proxy exposes it publicly.
+CodeSesh prints a startup URL containing a fresh access token. Anyone with that URL can read the
+indexed AI session history, so treat it as a password and do not share or persist it.
+
+A token authenticates the requester but does not encrypt traffic. Without TLS, the token and full
+session content travel over the network in plaintext, and URL tokens may be recorded in proxy logs.
+Use one of these protected transports:
+
+```bash
+# CodeSesh terminates TLS
+npx codesesh --host 0.0.0.0 --remote-access --tls-cert ./cert.pem --tls-key ./key.pem
+
+# A reverse proxy terminates TLS; CodeSesh stays bound to loopback
+npx codesesh --host 127.0.0.1 --remote-access --trust-proxy
+```
+
+`--trust-proxy` requires `X-Forwarded-Proto: https` on every API request. The listener must remain
+unreachable except through that trusted proxy.
 
 ## Requirements
 
+<!-- repo-fact:node-version:start -->
+
 - Node.js 22+
 
+<!-- repo-fact:node-version:end -->
+
 ## Links
 
 - [GitHub](https://github.com/xingkaixin/codesesh)