hanoman 0.1.32 → 0.1.33

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.32",
-  "sha": "5fc6533",
-  "builtAt": "2026-08-14T07:15:37.491Z"
+  "version": "0.1.33",
+  "sha": "5b0ee20",
+  "builtAt": "2026-08-14T10:11:20.930Z"
 }

package/dist/server.js

@@ -29930,11 +29930,32 @@ function wsControlOrigins(env) {
 function assertWsOrigin(origin, allowed) {
   if (!origin || !allowed.has(origin)) throw new Error("WebSocket Origin rejected");
 }
+function wsAllowlistFor(configured, host2, env) {
+  if (configured.size > 0 || env.NODE_ENV === "production") return configured;
+  const value = host2?.trim().toLowerCase();
+  if (!value) return configured;
+  let parsed;
+  try {
+    parsed = new URL(`http://${value}`);
+  } catch {
+    return configured;
+  }
+  if (!parsed.host || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) return configured;
+  const hosts = /* @__PURE__ */ new Set([parsed.host]);
+  if (parsed.port === "80" || parsed.port === "443") hosts.add(parsed.hostname);
+  const allowed = /* @__PURE__ */ new Set();
+  for (const candidate of hosts) {
+    allowed.add(`http://${candidate}`);
+    allowed.add(`https://${candidate}`);
+  }
+  return allowed;
+}
 function admitBrowserWs(req, target2, allowedOrigins) {
   const origin = typeof req.headers.origin === "string" ? req.headers.origin : void 0;
   if (!origin && process.env.NODE_ENV === "test" && allowedOrigins.size === 0)
     return { kind: "test", id: "test" };
-  assertWsOrigin(origin, allowedOrigins);
+  const host2 = typeof req.headers.host === "string" ? req.headers.host : void 0;
+  assertWsOrigin(origin, wsAllowlistFor(allowedOrigins, host2, process.env));
   const token = ticketFromProtocol(req.headers["sec-websocket-protocol"]);
   if (!token) throw new Error("WebSocket ticket required");
   const principal = consumeWsTicket(token, target2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hanoman",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Orchestrator + dashboard workflow docs-driven untuk sesi Claude Code / Codex",
   "type": "module",
   "repository": {