lunel-cli 0.1.39 → 0.1.41

package/dist/index.js

@@ -11,8 +11,8 @@ import * as os from "os";
 import { spawn, execSync, execFileSync } from "child_process";
 import { createServer, createConnection } from "net";
 import { createInterface } from "readline";
-const DEFAULT_PROXY_URL = process.env.LUNEL_PROXY_URL || "https://gateway.lunel.dev";
-const MANAGER_URL = process.env.LUNEL_MANAGER_URL || "https://manager.lunel.dev";
+const DEFAULT_PROXY_URL = normalizeGatewayUrl(process.env.LUNEL_PROXY_URL || "https://gateway.lunel.dev");
+const MANAGER_URL = normalizeGatewayUrl(process.env.LUNEL_MANAGER_URL || "https://manager.lunel.dev");
 const CLI_ARGS = process.argv.slice(2);
 import { createRequire } from "module";
 const __require = createRequire(import.meta.url);
@@ -198,6 +198,24 @@ function samePortSet(a, b) {
     }
     return true;
 }
+function isProtocolRequest(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const msg = value;
+    return (msg.v === 1 &&
+        typeof msg.id === "string" &&
+        typeof msg.ns === "string" &&
+        typeof msg.action === "string" &&
+        typeof msg.payload === "object" &&
+        msg.payload !== null &&
+        typeof msg.ok === "undefined");
+}
+function isProtocolResponse(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const msg = value;
+    return msg.v === 1 && typeof msg.id === "string" && typeof msg.ok === "boolean";
+}
 // ============================================================================
 // Path Safety
 // ============================================================================
@@ -1925,7 +1943,10 @@ async function handleProxyConnect(payload) {
         throw tcpConnectError || Object.assign(new Error(`TCP connect failed to localhost:${port}`), { code: "ECONNREFUSED" });
     }
     // 2. Open proxy WebSocket to gateway
-    const wsBase = activeGatewayUrl.replace(/^http/, "ws");
+    const wsBase = activeGatewayUrl.replace(/^https:/, "wss:");
+    if (!wsBase.startsWith("wss://")) {
+        throw Object.assign(new Error("Gateway URL must use https://"), { code: "EPROTO" });
+    }
     const authQuery = currentSessionPassword
         ? `password=${encodeURIComponent(currentSessionPassword)}`
         : `code=${encodeURIComponent(currentSessionCode)}`;
@@ -2405,10 +2426,30 @@ async function processMessage(message) {
         };
     }
 }
+function sendResponseOnData(response, dataWs) {
+    dataWs.send(JSON.stringify(response));
+}
 function normalizeGatewayUrl(input) {
-    if (/^https?:\/\//.test(input))
-        return input.replace(/\/+$/, "");
-    return `https://${input}`.replace(/\/+$/, "");
+    const raw = input.trim();
+    if (!raw) {
+        throw new Error("Gateway URL is required");
+    }
+    if (raw.toLowerCase().startsWith("http://") || raw.toLowerCase().startsWith("ws://")) {
+        throw new Error("Insecure gateway protocol is not allowed; use https://");
+    }
+    const withScheme = /^[a-z]+:\/\//i.test(raw) ? raw : `https://${raw}`;
+    let parsed;
+    try {
+        parsed = new URL(withScheme);
+    }
+    catch {
+        throw new Error(`Invalid gateway URL: ${input}`);
+    }
+    if (parsed.protocol !== "https:") {
+        throw new Error("Gateway URL must use https://");
+    }
+    const path = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/, "");
+    return `${parsed.protocol}//${parsed.host}${path}`;
 }
 async function createSessionFromManager() {
     const response = await fetch(`${MANAGER_URL}/v1/session`, {
@@ -2435,7 +2476,10 @@ function displayQR(primaryGateway, backupGateway, code) {
     });
 }
 function buildWsUrl(gatewayUrl, role, channel) {
-    const wsBase = gatewayUrl.replace(/^http/, "ws");
+    const wsBase = gatewayUrl.replace(/^https:/, "wss:");
+    if (!wsBase.startsWith("wss://")) {
+        throw new Error("Gateway URL must use https://");
+    }
     const query = new URLSearchParams();
     if (currentSessionPassword) {
         query.set("password", currentSessionPassword);
@@ -2561,10 +2605,16 @@ async function connectWebSocket() {
                                 return;
                             }
                         }
-                        if (message.v === 1) {
+                        if (isProtocolResponse(message)) {
+                            // Ignore server/app responses forwarded over WS; CLI only processes requests.
+                            return;
+                        }
+                        if (isProtocolRequest(message)) {
                             const response = await processMessage(message);
-                            controlWs.send(JSON.stringify(response));
+                            sendResponseOnData(response, dataWs);
+                            return;
                         }
+                        console.warn("[router] Ignoring non-request control frame");
                     }
                     catch (error) {
                         console.error("Error processing control message:", error);
@@ -2593,10 +2643,16 @@ async function connectWebSocket() {
                         const message = JSON.parse(data.toString());
                         if (message.type === "connected")
                             return;
-                        if (message.v === 1) {
+                        if (isProtocolResponse(message)) {
+                            // Ignore server/app responses forwarded over WS; CLI only processes requests.
+                            return;
+                        }
+                        if (isProtocolRequest(message)) {
                             const response = await processMessage(message);
-                            dataWs.send(JSON.stringify(response));
+                            sendResponseOnData(response, dataWs);
+                            return;
                         }
+                        console.warn("[router] Ignoring non-request data frame");
                     }
                     catch (error) {
                         console.error("Error processing data message:", error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lunel-cli",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "author": [
     {
       "name": "Soham Bharambe",