npm - kanna-code - Versions diffs - 0.32.3 → 0.33.0 - Mend

kanna-code 0.32.3 → 0.33.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/dist/client/assets/index-BYzAMpzV.css +32 -0
package/dist/client/assets/index-ab3JkqZ2.js +2608 -0
package/dist/client/index.html +2 -2
package/package.json +1 -1
package/src/server/agent.test.ts +88 -0
package/src/server/agent.ts +44 -3
package/src/server/auth.test.ts +119 -2
package/src/server/auth.ts +46 -11
package/src/server/cli-runtime.test.ts +4 -0
package/src/server/cli-runtime.ts +11 -7
package/src/server/codex-app-server-protocol.ts +12 -0
package/src/server/codex-app-server.test.ts +32 -0
package/src/server/codex-app-server.ts +17 -3
package/src/server/diff-store.ts +0 -9
package/src/server/event-store.test.ts +100 -2
package/src/server/event-store.ts +194 -16
package/src/server/events.ts +8 -7
package/src/server/provider-catalog.test.ts +6 -0
package/src/server/provider-catalog.ts +4 -2
package/src/server/read-models.test.ts +63 -5
package/src/server/read-models.ts +21 -2
package/src/server/server.ts +8 -1
package/src/server/share.ts +13 -42
package/src/server/ws-router.test.ts +139 -2
package/src/server/ws-router.ts +16 -1
package/src/shared/dev-ports.ts +5 -7
package/src/shared/protocol.ts +1 -0
package/src/shared/share.ts +15 -0
package/src/shared/types.test.ts +24 -0
package/src/shared/types.ts +61 -25
package/dist/client/assets/index-B3EUEMfY.css +0 -32
package/dist/client/assets/index-BVeR75Xr.js +0 -2598

package/dist/client/index.html CHANGED Viewed

@@ -30,8 +30,8 @@
       })()
     </script>
     <title>Kanna</title>
-    <script type="module" crossorigin src="/assets/index-BVeR75Xr.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-B3EUEMfY.css">
+    <script type="module" crossorigin src="/assets/index-ab3JkqZ2.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BYzAMpzV.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "kanna-code",
   "type": "module",
-  "version": "0.32.3",
+  "version": "0.33.0",
   "description": "A beautiful web UI for Claude Code",
   "license": "MIT",
   "keywords": [

package/src/server/agent.test.ts CHANGED Viewed

@@ -1452,6 +1452,77 @@ describe("AgentCoordinator claude integration", () => {
     events.close()
   })
+  test("uses Claude forkSession when starting a forked chat", async () => {
+    const startSessionCalls: Array<{ sessionToken: string | null; forkSession: boolean }> = []
+    const events = new AsyncEventQueue<any>()
+    const store = createFakeStore()
+    store.chat.provider = "claude"
+    store.chat.pendingForkSessionToken = "claude-parent-1"
+    const coordinator = new AgentCoordinator({
+      store: store as never,
+      onStateChange: () => {},
+      startClaudeSession: async (args) => {
+        startSessionCalls.push({
+          sessionToken: args.sessionToken,
+          forkSession: args.forkSession,
+        })
+        return {
+          provider: "claude",
+          stream: events,
+          getAccountInfo: async () => null,
+          interrupt: async () => {},
+          close: () => {},
+          setModel: async () => {},
+          setPermissionMode: async () => {},
+          sendPrompt: async () => {
+            events.push({ type: "session_token" as const, sessionToken: "claude-fork-1" })
+            events.push({
+              type: "transcript" as const,
+              entry: timestamped({
+                kind: "system_init",
+                provider: "claude",
+                model: "claude-opus-4-1",
+                tools: [],
+                agents: [],
+                slashCommands: [],
+                mcpServers: [],
+              }),
+            })
+            events.push({
+              type: "transcript" as const,
+              entry: timestamped({
+                kind: "result",
+                subtype: "success",
+                isError: false,
+                durationMs: 0,
+                result: "done",
+              }),
+            })
+          },
+        }
+      },
+    })
+    await coordinator.send({
+      type: "chat.send",
+      chatId: "chat-1",
+      provider: "claude",
+      content: "branch this",
+      model: "claude-opus-4-1",
+    })
+    await waitFor(() => store.turnFinishedCount === 1)
+    expect(startSessionCalls).toEqual([{
+      sessionToken: "claude-parent-1",
+      forkSession: true,
+    }])
+    expect(store.chat.pendingForkSessionToken).toBeNull()
+    events.close()
+  })
 })
 function createFakeStore() {
@@ -1462,6 +1533,7 @@ function createFakeStore() {
     provider: null as "claude" | "codex" | null,
     planMode: false,
     sessionToken: null as string | null,
+    pendingForkSessionToken: null as string | null,
   }
   const project = {
     id: "project-1",
@@ -1476,6 +1548,10 @@ function createFakeStore() {
       expect(chatId).toBe("chat-1")
       return chat
     },
+    getChat(chatId: string) {
+      expect(chatId).toBe("chat-1")
+      return chat
+    },
     getProject(projectId: string) {
       expect(projectId).toBe("project-1")
       return project
@@ -1506,9 +1582,21 @@ function createFakeStore() {
     async setSessionToken(_chatId: string, sessionToken: string | null) {
       chat.sessionToken = sessionToken
     },
+    async setPendingForkSessionToken(_chatId: string, pendingForkSessionToken: string | null) {
+      chat.pendingForkSessionToken = pendingForkSessionToken
+    },
     async createChat() {
       return chat
     },
+    async forkChat() {
+      return {
+        ...chat,
+        id: "chat-fork-1",
+        title: "Fork: New Chat",
+        sessionToken: null,
+        pendingForkSessionToken: chat.sessionToken ?? chat.pendingForkSessionToken,
+      }
+    },
     async enqueueMessage(_chatId: string, message: any) {
       const queuedMessage = {
         id: message.id ?? crypto.randomUUID(),

package/src/server/agent.ts CHANGED Viewed

@@ -106,6 +106,7 @@ interface AgentCoordinatorArgs {
     effort?: string
     planMode: boolean
     sessionToken: string | null
+    forkSession: boolean
     onToolRequest: (request: HarnessToolRequest) => Promise<unknown>
   }) => Promise<ClaudeSessionHandle>
 }
@@ -552,6 +553,7 @@ async function startClaudeSession(args: {
   effort?: string
   planMode: boolean
   sessionToken: string | null
+  forkSession: boolean
   onToolRequest: (request: HarnessToolRequest) => Promise<unknown>
 }): Promise<ClaudeSessionHandle> {
   const canUseTool: CanUseTool = async (toolName, input, options) => {
@@ -618,6 +620,7 @@ async function startClaudeSession(args: {
       model: args.model,
       effort: args.effort as "low" | "medium" | "high" | "max" | undefined,
       resume: args.sessionToken ?? undefined,
+      forkSession: args.forkSession,
       permissionMode: args.planMode ? "plan" : "acceptEdits",
       canUseTool,
       tools: [...CLAUDE_TOOLSET],
@@ -920,7 +923,8 @@ export class AgentCoordinator {
         model: args.model,
         effort: args.effort,
         planMode: args.planMode,
-        sessionToken: chat.sessionToken,
+        sessionToken: chat.pendingForkSessionToken ?? chat.sessionToken,
+        forkSession: Boolean(chat.pendingForkSessionToken),
         onToolRequest,
       })
       logSendToStartingProfile(args.profile, "start_turn.provider_boot.ready", {
@@ -934,13 +938,17 @@ export class AgentCoordinator {
         provider: args.provider,
         model: args.model,
       })
-      await this.codexManager.startSession({
+      const sessionToken = await this.codexManager.startSession({
         chatId: args.chatId,
         cwd: project.localPath,
         model: args.model,
         serviceTier: args.serviceTier,
         sessionToken: chat.sessionToken,
+        pendingForkSessionToken: chat.pendingForkSessionToken,
       })
+      if (chat.pendingForkSessionToken && sessionToken) {
+        await this.store.setPendingForkSessionToken(args.chatId, null)
+      }
       logSendToStartingProfile(args.profile, "start_turn.session_ready", {
         chatId: args.chatId,
         provider: args.provider,
@@ -1043,11 +1051,12 @@ export class AgentCoordinator {
     effort?: string
     planMode: boolean
     sessionToken: string | null
+    forkSession: boolean
     onToolRequest: (request: HarnessToolRequest) => Promise<unknown>
   }): Promise<HarnessTurn> {
     let session = this.claudeSessions.get(args.chatId)
-    if (!session || session.localPath !== args.localPath || session.effort !== args.effort) {
+    if (!session || session.localPath !== args.localPath || session.effort !== args.effort || args.forkSession) {
       if (session) {
         session.session.close()
         this.claudeSessions.delete(args.chatId)
@@ -1059,6 +1068,7 @@ export class AgentCoordinator {
         effort: args.effort,
         planMode: args.planMode,
         sessionToken: args.sessionToken,
+        forkSession: args.forkSession,
         onToolRequest: args.onToolRequest,
       })
@@ -1206,6 +1216,22 @@ export class AgentCoordinator {
     await this.store.removeQueuedMessage(command.chatId, command.queuedMessageId)
   }
+  async forkChat(chatId: string) {
+    const chat = this.store.requireChat(chatId)
+    if (this.activeTurns.has(chatId) || this.drainingStreams.has(chatId)) {
+      throw new Error("Chat must be idle before forking")
+    }
+    if (!chat.provider) {
+      throw new Error("Chat must have a provider before forking")
+    }
+    if (!chat.sessionToken && !chat.pendingForkSessionToken) {
+      throw new Error("Chat has no session to fork")
+    }
+    const forked = await this.store.forkChat(chatId)
+    return { chatId: forked.id }
+  }
   private async runClaudeSession(session: ClaudeSessionState) {
     try {
       for await (const event of session.session.stream) {
@@ -1221,6 +1247,14 @@ export class AgentCoordinator {
         const active = this.activeTurns.get(session.chatId)
         if (event.entry.kind === "system_init" && active) {
           active.status = "running"
+          const chat = this.store.getChat(session.chatId)
+          if (
+            chat?.pendingForkSessionToken
+            && session.sessionToken
+            && session.sessionToken !== chat.pendingForkSessionToken
+          ) {
+            await this.store.setPendingForkSessionToken(session.chatId, null)
+          }
           logClaudeSteer("claude_event_system_init", {
             chatId: session.chatId,
             sessionId: session.id,
@@ -1320,6 +1354,13 @@ export class AgentCoordinator {
         if (event.type === "session_token" && event.sessionToken) {
           await this.store.setSessionToken(active.chatId, event.sessionToken)
+          const chat = this.store.getChat(active.chatId)
+          if (
+            chat?.pendingForkSessionToken
+            && event.sessionToken !== chat.pendingForkSessionToken
+          ) {
+            await this.store.setPendingForkSessionToken(active.chatId, null)
+          }
           this.emitStateChange(active.chatId)
           continue
         }

package/src/server/auth.test.ts CHANGED Viewed

@@ -11,10 +11,15 @@ afterEach(async () => {
   await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })))
 })
-async function startPasswordServer() {
+async function startPasswordServer(options: { trustProxy?: boolean; port?: number } = {}) {
   const projectDir = await mkdtemp(path.join(tmpdir(), "kanna-auth-test-"))
   tempDirs.push(projectDir)
-  const server = await startKannaServer({ port: 4320, strictPort: true, password: "secret" })
+  const server = await startKannaServer({
+    port: options.port ?? 4320,
+    strictPort: true,
+    password: "secret",
+    trustProxy: options.trustProxy ?? false,
+  })
   const project = await server.store.openProject(projectDir, "Project")
   return { server, projectDir, project }
 }
@@ -169,6 +174,118 @@ describe("password auth", () => {
     }
   })
+  test("ignores forwarded proto when trustProxy is off", async () => {
+    const { server } = await startPasswordServer({ port: 54321 })
+    try {
+      const response = await fetch(`http://localhost:${server.port}/`, {
+        redirect: "manual",
+        headers: {
+          Accept: "text/html",
+          "X-Forwarded-Proto": "https",
+        },
+      })
+      expect(response.status).toBe(302)
+      expect(response.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
+        method: "POST",
+        body: JSON.stringify({ password: "secret", next: "/" }),
+        headers: {
+          "Content-Type": "application/json",
+          Origin: "https://evil.test",
+          "X-Forwarded-Proto": "https",
+        },
+      })
+      expect(loginResponse.status).toBe(403)
+      const goodLoginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
+        method: "POST",
+        body: JSON.stringify({ password: "secret", next: "/" }),
+        headers: {
+          "Content-Type": "application/json",
+          Origin: `http://localhost:${server.port}`,
+          "X-Forwarded-Proto": "https",
+        },
+      })
+      expect(goodLoginResponse.status).toBe(200)
+      const cookieHeader = goodLoginResponse.headers.get("set-cookie") ?? ""
+      expect(cookieHeader).not.toContain("Secure")
+    } finally {
+      await server.stop()
+    }
+  })
+  test("honors forwarded proto when trustProxy is on", async () => {
+    const { server } = await startPasswordServer({ port: 54322, trustProxy: true })
+    try {
+      const redirect = await fetch(`http://localhost:${server.port}/`, {
+        redirect: "manual",
+        headers: {
+          Accept: "text/html",
+          "X-Forwarded-Proto": "https",
+        },
+      })
+      expect(redirect.status).toBe(302)
+      expect(redirect.headers.get("location")).toBe(`https://localhost:${server.port}/auth/login?next=%2F`)
+      const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
+        method: "POST",
+        body: JSON.stringify({ password: "secret", next: "/" }),
+        headers: {
+          "Content-Type": "application/json",
+          Origin: `https://localhost:${server.port}`,
+          "X-Forwarded-Proto": "https",
+        },
+      })
+      expect(loginResponse.status).toBe(200)
+      expect(loginResponse.headers.get("set-cookie") ?? "").toContain("Secure")
+      const evilResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
+        method: "POST",
+        body: JSON.stringify({ password: "secret", next: "/" }),
+        headers: {
+          "Content-Type": "application/json",
+          Origin: `http://localhost:${server.port}`,
+        },
+      })
+      expect(evilResponse.status).toBe(200)
+    } finally {
+      await server.stop()
+    }
+  })
+  test("ignores invalid forwarded proto values", async () => {
+    const { server } = await startPasswordServer({ port: 54323, trustProxy: true })
+    try {
+      const redirect = await fetch(`http://localhost:${server.port}/`, {
+        redirect: "manual",
+        headers: {
+          Accept: "text/html",
+          "X-Forwarded-Proto": "ftp",
+        },
+      })
+      expect(redirect.status).toBe(302)
+      expect(redirect.headers.get("location")).toBe(`http://localhost:${server.port}/auth/login?next=%2F`)
+      const loginResponse = await fetch(`http://localhost:${server.port}/auth/login`, {
+        method: "POST",
+        body: JSON.stringify({ password: "secret", next: "/" }),
+        headers: {
+          "Content-Type": "application/json",
+          Origin: `http://localhost:${server.port}`,
+          "X-Forwarded-Proto": "ftp",
+        },
+      })
+      expect(loginResponse.status).toBe(200)
+      expect(loginResponse.headers.get("set-cookie") ?? "").not.toContain("Secure")
+    } finally {
+      await server.stop()
+    }
+  })
   test("clears the session cookie on logout", async () => {
     const { server } = await startPasswordServer()

package/src/server/auth.ts CHANGED Viewed

@@ -47,11 +47,30 @@ function sanitizeNextPath(nextPath: string | null | undefined) {
   return nextPath
 }
-function shouldUseSecureCookie(req: Request) {
+function forwardedProto(req: Request): "http" | "https" | null {
+  const xfp = req.headers.get("x-forwarded-proto")
+  if (!xfp) return null
+  const value = xfp.split(",")[0]?.trim().toLowerCase()
+  return value === "http" || value === "https" ? value : null
+}
+function effectiveOrigin(req: Request, trustProxy: boolean): string {
+  const url = new URL(req.url)
+  if (!trustProxy) return url.origin
+  const proto = forwardedProto(req)
+  const scheme = proto ?? url.protocol.replace(":", "")
+  return `${scheme}://${url.host}`
+}
+function shouldUseSecureCookie(req: Request, trustProxy: boolean) {
+  if (trustProxy) {
+    const proto = forwardedProto(req)
+    if (proto) return proto === "https"
+  }
   return new URL(req.url).protocol === "https:"
 }
-function buildCookie(name: string, value: string, req: Request, extras: string[] = []) {
+function buildCookie(name: string, value: string, req: Request, trustProxy: boolean, extras: string[] = []) {
   const parts = [
     `${name}=${encodeURIComponent(value)}`,
     "Path=/",
@@ -59,7 +78,7 @@ function buildCookie(name: string, value: string, req: Request, extras: string[]
     "SameSite=Strict",
   ]
-  if (shouldUseSecureCookie(req)) {
+  if (shouldUseSecureCookie(req, trustProxy)) {
     parts.push("Secure")
   }
@@ -101,9 +120,23 @@ function escapeHtml(value: string) {
     .replaceAll("'", "&#39;")
 }
-export function createAuthManager(password: string): AuthManager {
+export interface AuthManagerOptions {
+  /**
+   * When true, the auth layer trusts X-Forwarded-Proto to decide whether the
+   * public origin is http or https. The hostname always comes from the Host
+   * header (never X-Forwarded-Host) because X-Forwarded-Host is passed
+   * through by some tunnels unmodified and would otherwise allow open
+   * redirects.
+   * Enable only when the server is reachable solely through a trusted reverse
+   * proxy such as cloudflared.
+   */
+  trustProxy?: boolean
+}
+export function createAuthManager(password: string, options: AuthManagerOptions = {}): AuthManager {
   const sessions = new Set<string>()
   const expectedPassword = Buffer.from(password)
+  const trustProxy = options.trustProxy ?? false
   function getSessionToken(req: Request) {
     return parseCookies(req.headers.get("cookie")).get(SESSION_COOKIE_NAME) ?? null
@@ -117,13 +150,15 @@ export function createAuthManager(password: string): AuthManager {
   function validateOrigin(req: Request) {
     const origin = req.headers.get("origin")
     if (!origin) return true
-    return origin === new URL(req.url).origin
+    if (origin === new URL(req.url).origin) return true
+    if (!trustProxy) return false
+    return origin === effectiveOrigin(req, trustProxy)
   }
   function createSessionCookie(req: Request) {
     const sessionToken = randomBytes(32).toString("base64url")
     sessions.add(sessionToken)
-    return buildCookie(SESSION_COOKIE_NAME, sessionToken, req)
+    return buildCookie(SESSION_COOKIE_NAME, sessionToken, req, trustProxy)
   }
   function clearSessionCookie(req: Request) {
@@ -131,7 +166,7 @@ export function createAuthManager(password: string): AuthManager {
     if (sessionToken) {
       sessions.delete(sessionToken)
     }
-    return buildCookie(SESSION_COOKIE_NAME, "", req, ["Max-Age=0"])
+    return buildCookie(SESSION_COOKIE_NAME, "", req, trustProxy, ["Max-Age=0"])
   }
   function verifyPassword(candidate: string) {
@@ -152,7 +187,7 @@ export function createAuthManager(password: string): AuthManager {
   function unauthorizedResponse(req: Request) {
     if (req.method === "GET" && requestWantsHtml(req)) {
       const url = new URL(req.url)
-      const loginUrl = new URL("/auth/login", req.url)
+      const loginUrl = new URL("/auth/login", effectiveOrigin(req, trustProxy))
       loginUrl.searchParams.set("next", sanitizeNextPath(`${url.pathname}${url.search}`))
       return Response.redirect(loginUrl, 302)
     }
@@ -163,7 +198,7 @@ export function createAuthManager(password: string): AuthManager {
   function renderLoginPage(req: Request) {
     if (isAuthenticated(req)) {
       const currentUrl = new URL(req.url)
-      return Response.redirect(new URL(sanitizeNextPath(currentUrl.searchParams.get("next")), req.url), 302)
+      return Response.redirect(new URL(sanitizeNextPath(currentUrl.searchParams.get("next")), effectiveOrigin(req, trustProxy)), 302)
     }
     const currentUrl = new URL(req.url)
@@ -264,7 +299,7 @@ export function createAuthManager(password: string): AuthManager {
         return Response.json({ error: "Invalid password" }, { status: 401 })
       }
-      const redirectUrl = new URL("/auth/login", req.url)
+      const redirectUrl = new URL("/auth/login", effectiveOrigin(req, trustProxy))
       redirectUrl.searchParams.set("error", "1")
       redirectUrl.searchParams.set("next", sanitizeNextPath(nextPath || fallbackNextPath))
       return Response.redirect(redirectUrl, 302)
@@ -272,7 +307,7 @@ export function createAuthManager(password: string): AuthManager {
     const response = wantsJson
       ? Response.json({ ok: true, nextPath: sanitizeNextPath(nextPath || fallbackNextPath) })
-      : Response.redirect(new URL(sanitizeNextPath(nextPath || fallbackNextPath), req.url), 302)
+      : Response.redirect(new URL(sanitizeNextPath(nextPath || fallbackNextPath), effectiveOrigin(req, trustProxy)), 302)
     response.headers.set("Set-Cookie", createSessionCookie(req))
     return response

package/src/server/cli-runtime.test.ts CHANGED Viewed

@@ -27,6 +27,7 @@ function createDeps(overrides: Partial<Parameters<typeof runCli>[1]> = {}) {
       share: false | "quick" | { kind: "token"; token: string }
       password: string | null
       strictPort: boolean
+      trustProxy?: boolean
       update: {
         version: string
         argv: string[]
@@ -290,6 +291,7 @@ describe("runCli", () => {
       share: false,
       password: null,
       strictPort: false,
+      trustProxy: false,
       update: {
         version: "0.3.0",
         argv: ["--port", "4000", "--no-open"],
@@ -356,6 +358,7 @@ describe("runCli", () => {
     expect(result.kind).toBe("started")
     expect(calls.openUrl).toEqual([])
+    expect(calls.startServer[0]?.trustProxy).toBe(true)
     expect(calls.shareTunnel).toEqual([{ localUrl: "http://localhost:4000", shareMode: "quick" }])
     expect(calls.renderShareQr).toEqual(["https://kanna.trycloudflare.com"])
     expect(calls.log).toContain("QR Code:")
@@ -452,6 +455,7 @@ describe("runCli", () => {
     const result = await runCli(["--cloudflared", "secret-token"], deps)
     expect(result.kind).toBe("started")
+    expect(calls.startServer[0]?.trustProxy).toBe(true)
     expect(calls.shareTunnel).toEqual([{
       localUrl: "http://localhost:3210",
       shareMode: { kind: "token", token: "secret-token" },

package/src/server/cli-runtime.ts CHANGED Viewed

@@ -3,7 +3,7 @@ import { spawnSync } from "node:child_process"
 import { hasCommand, spawnDetached } from "./process-utils"
 import { APP_NAME, CLI_COMMAND, getDataDirDisplay, LOG_PREFIX, PACKAGE_NAME } from "../shared/branding"
 import type { ShareMode } from "../shared/share"
-import { isShareEnabled, isTokenShareMode } from "../shared/share"
+import { assertNoHostOverride, getShareCliFlag, isShareEnabled, isTokenShareMode } from "../shared/share"
 import type { UpdateInstallErrorCode } from "../shared/types"
 import { PROD_SERVER_PORT } from "../shared/ports"
 import { CLI_SUPPRESS_OPEN_ONCE_ENV_VAR } from "./restart"
@@ -49,6 +49,7 @@ export interface CliRuntimeDeps {
   startServer: (options: CliOptions & {
     update: CliUpdateOptions
     onMigrationProgress?: (message: string) => void
+    trustProxy?: boolean
   }) => Promise<{ port: number; stop: () => Promise<void> }>
   fetchLatestVersion: (packageName: string) => Promise<string>
   installVersion: (packageName: string, version: string) => UpdateInstallAttemptResult
@@ -73,6 +74,10 @@ type ParsedArgs =
 const MINIMUM_BUN_VERSION = "1.3.5"
+function throwShareConflict(share: Exclude<ShareMode, false>, hostFlag: "--host" | "--remote"): never {
+  throw new Error(`${getShareCliFlag(share)} cannot be used with ${hostFlag}`)
+}
 function printHelp() {
   console.log(`${APP_NAME} — local-only project chat UI
@@ -122,7 +127,7 @@ export function parseArgs(argv: string[]): ParsedArgs {
       const next = argv[index + 1]
       if (!next || next.startsWith("-")) throw new Error("Missing value for --host")
       if (isShareEnabled(share)) {
-        throw new Error(typeof share === "string" ? "--share cannot be used with --host" : "--cloudflared cannot be used with --host")
+        throwShareConflict(share, "--host")
       }
       host = next
       sawHost = true
@@ -131,21 +136,19 @@ export function parseArgs(argv: string[]): ParsedArgs {
     }
     if (arg === "--remote") {
       if (isShareEnabled(share)) {
-        throw new Error(typeof share === "string" ? "--share cannot be used with --remote" : "--cloudflared cannot be used with --remote")
+        throwShareConflict(share, "--remote")
       }
       host = "0.0.0.0"
       sawRemote = true
       continue
     }
     if (arg === "--share") {
-      if (sawHost) throw new Error("--share cannot be used with --host")
-      if (sawRemote) throw new Error("--share cannot be used with --remote")
+      assertNoHostOverride("--share", sawHost, sawRemote)
       share = "quick"
       continue
     }
     if (arg === "--cloudflared") {
-      if (sawHost) throw new Error("--cloudflared cannot be used with --host")
-      if (sawRemote) throw new Error("--cloudflared cannot be used with --remote")
+      assertNoHostOverride("--cloudflared", sawHost, sawRemote)
       const next = argv[index + 1]
       if (!next || next.startsWith("-")) throw new Error("Missing value for --cloudflared")
       share = { kind: "token", token: next }
@@ -268,6 +271,7 @@ export async function runCli(argv: string[], deps: CliRuntimeDeps): Promise<CliR
   const { port, stop } = await deps.startServer({
     ...parsedArgs.options,
+    trustProxy: isShareEnabled(parsedArgs.options.share),
     onMigrationProgress: deps.log,
     update: {
       version: deps.version,

package/src/server/codex-app-server-protocol.ts CHANGED Viewed

@@ -45,6 +45,17 @@ export interface ThreadResumeParams {
   persistExtendedHistory: boolean
 }
+export interface ThreadForkParams {
+  threadId: string
+  model?: string | null
+  cwd?: string | null
+  serviceTier?: ServiceTier | null
+  approvalPolicy?: "never" | "on-request" | "on-failure" | "untrusted" | null
+  sandbox?: "read-only" | "workspace-write" | "danger-full-access" | null
+  ephemeral?: boolean
+  persistExtendedHistory: boolean
+}
 export interface TextUserInput {
   type: "text"
   text: string
@@ -90,6 +101,7 @@ export interface ThreadStartResponse {
 }
 export type ThreadResumeResponse = ThreadStartResponse
+export type ThreadForkResponse = ThreadStartResponse
 export interface TurnSummary {
   id: string