ework-web 0.10.110 → 0.10.112

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.110",
+  "version": "0.10.112",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/auth.ts

@@ -46,7 +46,8 @@ export interface AuthResult {
 export function authCookieName(cfg: Config): string {
   // __Host- prefix (C2 hardening) requires Secure + Path=/ + no Domain and is only
   // honored by browsers over TLS; cfg.secureCookie is flipped on only after Caddy/TLS.
-  return cfg.secureCookie ? `__Host-${AUTH_COOKIE_NAME}` : AUTH_COOKIE_NAME;
+  const name = cfg.cookieName ?? AUTH_COOKIE_NAME;
+  return cfg.secureCookie ? `__Host-${name}` : name;
 }
 
 export async function makeAuthCookieHeader(cfg: Config, login: string): Promise<string> {

package/src/config.ts

@@ -50,6 +50,12 @@ export const configSchema = z.object({
     .default("ework-actions"),
   upstreamTimeoutMs: z.coerce.number().default(15000),
   secureCookie: z.boolean().default(false),
+  // Cookies are domain-scoped, NOT port-scoped: two ework webs on the same host
+  // (different ports) overwrite/kick each other's login unless names differ.
+  cookieName: z
+    .string()
+    .regex(/^[A-Za-z0-9_-]+$/, "WORK_COOKIE_NAME must be alphanumeric/dash/underscore")
+    .default("ework_auth"),
   // ework is human-facing; writes on by default. Flip off to use as a read-only mirror.
   writesEnabled: z.boolean().default(true),
   // Issue-thread comment order: 'desc' = newest first (top), 'asc' = oldest first.
@@ -167,6 +173,7 @@ export async function loadConfig(): Promise<Config> {
     host: process.env.WORK_HOST,
     authToken: process.env.WORK_TOKEN,
     cookieSecret: process.env.WORK_COOKIE_SECRET,
+    cookieName: process.env.WORK_COOKIE_NAME,
     operatorLogin: process.env.WORK_OPERATOR_LOGIN,
     systemLogin: process.env.WORK_SYSTEM_LOGIN,
     upstreamTimeoutMs: process.env.WORK_UPSTREAM_TIMEOUT_MS,

package/src/index.ts

@@ -811,6 +811,10 @@ async function handle(req: Request, url: URL, ip: string, ctx: { authed: boolean
         }
       }
     }
+    if (!daemonEp && /^ses_[0-9A-Za-z]{8,}/.test(sid)) {
+      const scanned = await tryAllDaemons();
+      if (scanned) return scanned;
+    }
     const client = daemonEp ? new RemoteOpencodeClient(daemonEp) : opencode;
     try {
       const { html: body } = await buildSessionView(client, sid, desc, cfg.collapseLines, limit, all);