hanoman 0.1.31 → 0.1.33

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.31",
-  "sha": "6ca5000",
-  "builtAt": "2026-08-14T06:09:59.969Z"
+  "version": "0.1.33",
+  "sha": "5b0ee20",
+  "builtAt": "2026-08-14T10:11:20.930Z"
 }

package/dist/cli.js

@@ -29451,6 +29451,7 @@ var init_pack = __esm({
       "@prisma/client",
       "node-pty",
       "pdfkit",
+      "sharp",
       "prisma",
       "pg"
     ];

package/dist/server.js

@@ -1,4 +1,4 @@
-import { createRequire } from 'module'; const require = createRequire(import.meta.url);
+import { createRequire as __hanomanCreateRequire } from 'module'; const require = __hanomanCreateRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -24263,6 +24263,7 @@ import { existsSync as existsSync15 } from "node:fs";
 
 // src/web-dir.ts
 import { resolve } from "node:path";
+var shouldServeWeb = (env) => env.NODE_ENV === "production" || Boolean(env.HANOMAN_WEB_DIR?.trim());
 function pickWebDir(distDir, env, exists) {
   const forced = env.HANOMAN_WEB_DIR?.trim();
   if (forced) {
@@ -29929,11 +29930,32 @@ function wsControlOrigins(env) {
 function assertWsOrigin(origin, allowed) {
   if (!origin || !allowed.has(origin)) throw new Error("WebSocket Origin rejected");
 }
+function wsAllowlistFor(configured, host2, env) {
+  if (configured.size > 0 || env.NODE_ENV === "production") return configured;
+  const value = host2?.trim().toLowerCase();
+  if (!value) return configured;
+  let parsed;
+  try {
+    parsed = new URL(`http://${value}`);
+  } catch {
+    return configured;
+  }
+  if (!parsed.host || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) return configured;
+  const hosts = /* @__PURE__ */ new Set([parsed.host]);
+  if (parsed.port === "80" || parsed.port === "443") hosts.add(parsed.hostname);
+  const allowed = /* @__PURE__ */ new Set();
+  for (const candidate of hosts) {
+    allowed.add(`http://${candidate}`);
+    allowed.add(`https://${candidate}`);
+  }
+  return allowed;
+}
 function admitBrowserWs(req, target2, allowedOrigins) {
   const origin = typeof req.headers.origin === "string" ? req.headers.origin : void 0;
   if (!origin && process.env.NODE_ENV === "test" && allowedOrigins.size === 0)
     return { kind: "test", id: "test" };
-  assertWsOrigin(origin, allowedOrigins);
+  const host2 = typeof req.headers.host === "string" ? req.headers.host : void 0;
+  assertWsOrigin(origin, wsAllowlistFor(allowedOrigins, host2, process.env));
   const token = ticketFromProtocol(req.headers["sec-websocket-protocol"]);
   if (!token) throw new Error("WebSocket ticket required");
   const principal = consumeWsTicket(token, target2);
@@ -44789,7 +44811,7 @@ function buildApp({ requireAuth = true, agentDocFile, env = process.env } = {})
     await api.register(portal_default);
     await api.register(client_accounts_default);
   }, { prefix: "/api" });
-  if (env.NODE_ENV === "production") {
+  if (shouldServeWeb(env)) {
     const dist = pickWebDir(dirname12(fileURLToPath4(import.meta.url)), env, existsSync15);
     if (dist) {
       app2.register(fastifyStatic, { root: dist });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.1.31",
+  "version": "0.1.33",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {
@@ -34,6 +34,7 @@
     "@prisma/client": "^6.19.0",
     "node-pty": "^1.1.0",
     "pdfkit": "^0.19.1",
+    "sharp": "^0.35.3",
     "prisma": "^6.19.0",
     "pg": "^8.13.1"
   },