ledung 1.2.0 → 1.4.0

package/CHANGELOG.md

@@ -10,6 +10,7 @@ that changes `src/`, `web/` (not `web/dist/`) or `scripts/` without one (a commi
 is nothing user-facing in it).
 
 ## 2026-11-02
+- A request whose address doesn't parse is now refused with a 400, also on the live connection, without an error in the log (Fluffy-Fluffy-and-Bouncy/Project-Ledung#467)
 - Started at sign-in on macOS or Linux, or from Ledung.app, Ledung now gets the same PATH as in your terminal, so Update Ledung, Ledung's GitHub features and the tools your sessions use work after a login too; a shell profile that hangs delays the start by about ten seconds instead of stopping it. Switch Start Ledung when I sign in off and on in Settings to get it (#464)
 - Settings → About has an update channel, Public or Dev: on Dev an npm-installed Ledung gets dev builds before they go to everyone, and Update & restart now checks npm and updates an npm install with one click (#461)
 

package/dist/main.js

@@ -15318,6 +15318,7 @@ var LINK_PAIRINGS_KEPT = 20;
 var LINK_PAIR_TIMES_KEY = "link-pair-times";
 var WAITING_POLL_MS = 3e4;
 var WAITING_PUSH_MS = 1e3;
+var exercised463 = false;
 var LINKED_HERE = "Computers are linked and unlinked";
 var MAX_BODY2 = 1024 * 1024;
 var NOT_PAIRED = "This device is not paired with Ledung. Pair it from Settings \u2192 Phones in Ledung on the computer.";
@@ -15540,12 +15541,16 @@ var LedungServer = class {
       this.handle(req, res).catch((e) => this.fail(res, e));
     });
     server.on("upgrade", (req, socket, head) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/ws" || !this.guard.hostAllowed(req) || !this.guard.originAllowed(req) || !this.guard.mayUse(req)) {
-        socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+      const refuse = (status) => {
+        socket.end(`HTTP/1.1 ${status}\r
+Connection: close\r
+\r
+`);
         setTimeout(() => socket.destroy(), 1e3).unref();
-        return;
-      }
+      };
+      const url = requestUrl(req);
+      if (!url) return refuse("400 Bad Request");
+      if (url.pathname !== "/ws" || !this.guard.hostAllowed(req) || !this.guard.originAllowed(req) || !this.guard.mayUse(req)) return refuse("403 Forbidden");
       const device = this.guard.deviceOf(req)?.id ?? null;
       const viaPublic = this.guard.isPublic(req);
       this.wss.handleUpgrade(req, socket, head, (ws) => this.onClient(ws, device, viaPublic));
@@ -15697,6 +15702,7 @@ var LedungServer = class {
     if (this.remote) this.setRemote(this.remote);
   }
   close() {
+    this.closed = true;
     if (this.waitingPoll) clearInterval(this.waitingPoll);
     if (this.waitingPush) clearTimeout(this.waitingPush);
     for (const ws of this.clients) ws.close(1001, "Ledung is shutting down.");
@@ -15815,8 +15821,9 @@ var LedungServer = class {
     return computers;
   }
   async handle(req, res) {
+    const url = requestUrl(req);
+    if (!url) throw new HttpError(400, "Bad request path.");
     if (!this.guard.hostAllowed(req)) throw new HttpError(403, "Unknown host.");
-    const url = new URL(req.url ?? "/", "http://127.0.0.1");
     const remote = this.guard.isPublic(req);
     if (remote) {
       this.publicResponses.add(res);
@@ -16051,6 +16058,11 @@ var LedungServer = class {
   waitingThere = /* @__PURE__ */ new Map();
   waitingPoll = null;
   waitingPush = null;
+  /**
+   * Set by close: an exchange still on its way then changes nothing and starts no new one, as the database may be
+   * closed by the time its answer comes (#463: it threw "database is not open" after a test's end).
+   */
+  closed = false;
   /** The count last sent to the linked computers, so an unchanged one isn't sent again. */
   waitingSent = null;
   /** What waits for the user here, as this computer's page counts it (App: questions, prompts, cards). */
@@ -16059,7 +16071,7 @@ var LedungServer = class {
   }
   /** Something that may change the count happened: sent to the linked computers shortly, if it did change. */
   waitingChanged() {
-    if (this.waitingPush || !this.linked || !this.servers.length) return;
+    if (this.closed || this.waitingPush || !this.linked || !this.servers.length) return;
     this.waitingPush = setTimeout(() => {
       this.waitingPush = null;
       if (this.waitingNow() !== this.waitingSent) this.exchangeWaiting();
@@ -16069,7 +16081,7 @@ var LedungServer = class {
   /** Sends this computer's count to every linked one and keeps theirs; one that doesn't answer loses its badge. */
   exchangeWaiting() {
     const linked = this.linked;
-    if (!linked) return;
+    if (!linked || this.closed) return;
     const count = this.waitingNow();
     this.waitingSent = count;
     for (const link of linked.list()) {
@@ -16078,6 +16090,13 @@ var LedungServer = class {
   }
   /** A linked computer's count, or undefined when it is offline: the open pages get its tab's badge at once. */
   noteWaiting(id, raw) {
+    if (this.closed) {
+      if (!exercised463) {
+        exercised463 = true;
+        exercisedLine("EXERCISED #463 a linked computer's answer after close was let go");
+      }
+      return;
+    }
     const count = typeof raw === "number" && Number.isInteger(raw) && raw >= 0 && raw < 1e6 ? raw : void 0;
     if (this.waitingThere.get(id) === count) return;
     if (count === void 0) this.waitingThere.delete(id);
@@ -16963,6 +16982,15 @@ var LedungServer = class {
   }
 };
 var bodies = /* @__PURE__ */ new WeakMap();
+var badPathTraced = false;
+function requestUrl(req) {
+  const url = URL.parse(req.url ?? "/", "http://127.0.0.1");
+  if (!url && !badPathTraced) {
+    badPathTraced = true;
+    exercisedLine("EXERCISED #467 refused a request path that does not parse");
+  }
+  return url;
+}
 function fromThisComputer(req) {
   const from = req.socket.remoteAddress ?? "";
   return from === "::1" || from.startsWith("127.") || from.startsWith("::ffff:127.");

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "ledung",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ledung",
-      "version": "1.2.0",
+      "version": "1.4.0",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "0.3.295",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ledung",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "license": "AGPL-3.0-only",
   "author": "Project Ledung <martin@projectledung.com>",
   "description": "Runs several Claude Code sessions locally and shows them in one place.",