home-hosted 0.7.5 → 0.7.7

package/dist/cli.js

@@ -2437,6 +2437,11 @@ function createAuthRoute(deps) {
 			statusCode: 400,
 			code: "EXPOSED_WITHOUT_PASSWORD"
 		});
+		const proxyExposure = checkProxyExposure(deps.proxy.config, false, false, false);
+		if (proxyExposure !== null) throw new DetailedError(proxyExposure, {
+			statusCode: 400,
+			code: "PROXY_EXPOSURE_BLOCKED"
+		});
 		deps.auth.clearPassword();
 		deps.panel.settings.updateControl({ auth: { enabled: false } });
 		return c.json({ ok: true });
@@ -9736,6 +9741,11 @@ function createSettingsRoute(deps) {
 			statusCode: 400,
 			code: "EXPOSURE_BLOCKED"
 		});
+		const proxyExposure = checkProxyExposure(deps.proxy.config, patch.control?.auth?.enabled ?? current.auth.enabled, deps.auth.passwordSet, deps.auth.usingDefaultPassword);
+		if (proxyExposure !== null) throw new DetailedError(proxyExposure, {
+			statusCode: 400,
+			code: "PROXY_EXPOSURE_BLOCKED"
+		});
 		const previous = {
 			trustProxy: current.auth.trustProxy,
 			tlsEnabled: current.tls.enabled
@@ -10300,6 +10310,26 @@ function readJson(file) {
 		return null;
 	}
 }
+/**
+* A legacy file, with "absent" told apart from "present but unreadable".
+*
+* `readJson` collapses both into `null`, and a split that is skipped reads exactly like
+* one with nothing to do — so a corrupt legacy config used to be abandoned silently
+* while `workspaces.json` was still created, after which `hasLegacyLayout()` is false
+* and no later run ever looks at that file again. The definitions would sit unread
+* beside a panel supervising nothing.
+*/
+function readLegacy(file) {
+	if (!fs.existsSync(file)) return {
+		parsed: null,
+		unreadable: false
+	};
+	const parsed = readJson(file);
+	return {
+		parsed,
+		unreadable: parsed === null
+	};
+}
 function writeJson(file, value, mode) {
 	fs.mkdirSync(path.dirname(file), { recursive: true });
 	fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, mode === void 0 ? {} : { mode });
@@ -10397,10 +10427,11 @@ function migrateLayout() {
 	const moved = [];
 	const warnings = [];
 	fs.mkdirSync(hhDir, { recursive: true });
-	const legacyConfig = readJson(legacy.configPath);
+	const legacyConfig = readLegacy(legacy.configPath);
 	let configSplit = false;
-	if (legacyConfig !== null) {
-		const split = splitConfig(legacyConfig);
+	if (legacyConfig.unreadable) warnings.push(`${legacy.configPath} could not be read — it was NOT migrated and is still there; fix or remove it, then move the file in by hand`);
+	if (legacyConfig.parsed !== null) {
+		const split = splitConfig(legacyConfig.parsed);
 		const destinations = [
 			path.join(hhDir, "settings.json"),
 			path.join(hhDir, "default", "settings.json"),
@@ -10417,10 +10448,11 @@ function migrateLayout() {
 			configSplit = true;
 		}
 	}
-	const legacySecrets = readJson(legacy.secretsPath);
+	const legacySecrets = readLegacy(legacy.secretsPath);
 	let secretsSplit = false;
-	if (legacySecrets !== null) {
-		const split = splitSecrets(legacySecrets);
+	if (legacySecrets.unreadable) warnings.push(`${legacy.secretsPath} could not be read — it was NOT migrated and is still there; a panel without it starts on the default password`);
+	if (legacySecrets.parsed !== null) {
+		const split = splitSecrets(legacySecrets.parsed);
 		const destinations = [path.join(hhDir, ".control-secrets.json"), path.join(hhDir, "default", ".secrets.json")];
 		const taken = destinations.filter((file) => fs.existsSync(file));
 		if (taken.length > 0) warnings.push(`${legacy.secretsPath} could not be split — ${taken.map((file) => path.relative(hhDir, file)).join(", ")} already exist(s); left it in place`);
@@ -10600,6 +10632,8 @@ function localCall(runtime, path, method, token, timeoutMs) {
 				status: response.statusCode ?? 0,
 				body
 			}));
+			response.once("aborted", () => resolve(null));
+			response.once("error", () => resolve(null));
 		});
 		request.once("error", () => resolve(null));
 		request.once("timeout", () => {
@@ -17087,6 +17121,7 @@ state/.hh/*
 !state/.hh/settings.json
 !state/.hh/workspaces.json
 state/.hh/*/*
+!state/.hh/*/
 !state/.hh/*/settings.json
 !state/.hh/*/servers.config.json
 data/