commandmate 0.1.8 → 0.1.9

package/dist/cli/commands/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,YAAY,EAA6B,MAAM,UAAU,CAAC;AASnE;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyHvE"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,YAAY,EAA6B,MAAM,UAAU,CAAC;AASnE;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoJvE"}

package/dist/cli/commands/start.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.startCommand = startCommand;
 const fs_1 = require("fs");
 const child_process_1 = require("child_process");
+const dotenv_1 = require("dotenv");
 const types_1 = require("../types");
 const logger_1 = require("../utils/logger");
 const daemon_1 = require("../utils/daemon");
@@ -76,10 +77,31 @@ async function startCommand(options) {
         // Foreground mode (default)
         const npmScript = options.dev ? 'dev' : 'start';
         logger.info(`Starting server in foreground (${options.dev ? 'development' : 'production'} mode)...`);
-        const env = { ...process.env };
+        // Issue #125: Load .env file from correct location (same as daemon mode)
+        const envResult = (0, dotenv_1.config)({ path: envPath });
+        if (envResult.error) {
+            logger.warn(`Failed to load .env file at ${envPath}: ${envResult.error.message}`);
+            logger.info('Continuing with existing environment variables');
+        }
+        // Build environment by merging process.env with .env values
+        const env = {
+            ...process.env,
+            ...(envResult.parsed || {}),
+        };
+        // Command line options override .env values
         if (options.port) {
             env.CM_PORT = String(options.port);
         }
+        // Issue #125: Security warnings for external access
+        const bindAddress = env.CM_BIND || '127.0.0.1';
+        const authToken = env.CM_AUTH_TOKEN;
+        if (bindAddress === '0.0.0.0') {
+            logger.warn('WARNING: Server is accessible from external networks (CM_BIND=0.0.0.0)');
+            if (!authToken) {
+                logger.warn('SECURITY WARNING: No authentication token configured. External access is not recommended without CM_AUTH_TOKEN.');
+                logger.info('Run "commandmate init" to configure a secure authentication token.');
+            }
+        }
         // Use package installation directory, not current working directory
         const packageRoot = (0, paths_1.getPackageRoot)();
         const child = (0, child_process_1.spawn)('npm', ['run', npmScript], {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commandmate",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Git worktree management with Claude CLI and tmux sessions",
   "repository": {
     "type": "git",