mouaif 0.3.0 → 0.3.2

package/src/access-auth.js

@@ -1,15 +1,13 @@
 'use strict';
 
 // Local app access authentication: one account, password sessions, one-time
-// setup codes, one-time disable codes, and WebAuthn credentials. Provider
-// OAuth remains in auth.js.
+// setup codes, and WebAuthn credentials. Provider OAuth remains in auth.js.
 
 const crypto = require('node:crypto');
 const settings = require('./settings.js');
 
 const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const SETUP_TTL_MS = 15 * 60 * 1000;
-const DISABLE_TTL_MS = 15 * 60 * 1000;
 const CHALLENGE_TTL_MS = 5 * 60 * 1000;
 const CODE_ALPHABET = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ';
 const challenges = new Map();
@@ -63,16 +61,6 @@ function ensureTables() {
       created_at TEXT NOT NULL,
       last_used_at TEXT
     );
-    CREATE TABLE IF NOT EXISTS access_disable_codes (
-      code_hash TEXT PRIMARY KEY,
-      expires_at INTEGER NOT NULL,
-      created_at TEXT NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS access_state (
-      id INTEGER PRIMARY KEY CHECK (id = 1),
-      enabled INTEGER NOT NULL,
-      updated_at TEXT NOT NULL
-    );
   `);
 }
 
@@ -85,35 +73,6 @@ function configured() {
   return !!user();
 }
 
-// ---- Enable state -------------------------------------------------------
-// `mouaif serve --auth` (and friends) turns the gate on for a process, but
-// access can also be disabled from inside the app — turning a protection off
-// usually means "right now, on this device". The decision is persisted so a
-// later restart that still passes an auth flag keeps it off instead of
-// silently locking the user out of a store whose password may be forgotten.
-function disabled() {
-  ensureTables();
-  const row = settings.getDb().prepare('SELECT enabled FROM access_state WHERE id = 1').get();
-  return !!row && row.enabled === 0;
-}
-
-function setEnabled(enabled) {
-  ensureTables();
-  const on = enabled !== false;
-  settings.getDb().prepare(`
-    INSERT INTO access_state (id, enabled, updated_at) VALUES (1, ?, ?)
-    ON CONFLICT(id) DO UPDATE SET enabled = excluded.enabled, updated_at = excluded.updated_at
-  `).run(on ? 1 : 0, new Date().toISOString());
-  return on;
-}
-
-// effectiveEnabled(processEnabled) — the gate the server actually enforces:
-// a process started with an auth flag, unless the store says the user
-// disabled access from inside the app.
-function effectiveEnabled(processEnabled) {
-  return !!processEnabled && !disabled();
-}
-
 function validateCredentials(username, password) {
   const cleanUser = String(username || '').trim();
   const cleanPassword = String(password || '');
@@ -260,43 +219,6 @@ function consumeSetupCode(code) {
   return transaction();
 }
 
-// createDisableCode() — mint a short-lived, single-use code that turns app
-// access off. Modelled on createSetupCode() with its own table so the two
-// invitations can never be confused (a setup code adds a password, a disable
-// code removes the login wall). Restricting access is signed-in-only, so no
-// code is needed for that direction; only disabling is code-gated.
-function createDisableCode(ttlMs = DISABLE_TTL_MS) {
-  ensureTables();
-  const code = randomCode();
-  const expiresAt = Date.now() + Math.max(60_000, Number(ttlMs) || DISABLE_TTL_MS);
-  settings.getDb().prepare('DELETE FROM access_disable_codes WHERE expires_at <= ?').run(Date.now());
-  settings.getDb().prepare('INSERT INTO access_disable_codes (code_hash, expires_at, created_at) VALUES (?, ?, ?)')
-    .run(digest(code), expiresAt, new Date().toISOString());
-  return { code, expiresAt };
-}
-
-function disableCodeValid(code) {
-  ensureTables();
-  const normalized = normalizeCode(code);
-  if (!normalized) return false;
-  return !!settings.getDb().prepare('SELECT 1 FROM access_disable_codes WHERE code_hash = ? AND expires_at > ?')
-    .get(digest(normalized), Date.now());
-}
-
-function consumeDisableCode(code) {
-  ensureTables();
-  const normalized = normalizeCode(code);
-  if (!normalized) return false;
-  const hash = digest(normalized);
-  const transaction = settings.getDb().transaction(() => {
-    const valid = settings.getDb().prepare('SELECT 1 FROM access_disable_codes WHERE code_hash = ? AND expires_at > ?').get(hash, Date.now());
-    if (!valid) return false;
-    settings.getDb().prepare('DELETE FROM access_disable_codes WHERE code_hash = ?').run(hash);
-    return true;
-  });
-  return transaction();
-}
-
 function passkeys() {
   ensureTables();
   return settings.getDb().prepare('SELECT credential_id AS id, name, created_at AS createdAt, last_used_at AS lastUsedAt FROM access_passkeys ORDER BY created_at').all();
@@ -486,13 +408,9 @@ function deletePasskey(id) {
 module.exports = {
   SESSION_TTL_MS,
   SETUP_TTL_MS,
-  DISABLE_TTL_MS,
   ensureTables,
   configured,
   user,
-  disabled,
-  setEnabled,
-  effectiveEnabled,
   setPassword,
   verifyPassword,
   changePassword,
@@ -503,9 +421,6 @@ module.exports = {
   normalizeCode,
   setupCodeValid,
   consumeSetupCode,
-  createDisableCode,
-  disableCodeValid,
-  consumeDisableCode,
   passkeys,
   beginRegistration,
   finishRegistration,

package/src/http-server.js

@@ -454,14 +454,7 @@ function createServer(port = DEFAULT_PORT, options = {}) {
   }
   const sessionToken = crypto.randomBytes(32).toString('base64url');
   const lifecycle = (options && typeof options === 'object') ? (options.lifecycle || {}) : {};
-  const serverConfig = {
-    publicOrigin,
-    // The flag the process was started with. The store's in-app disable
-    // switch is layered on top at every gate (publicAccessStatus /
-    // authorizeAccessRequest) so turning access off or back on takes effect
-    // without a restart.
-    authEnabled: options.authEnabled === true
-  };
+  const serverConfig = { publicOrigin, authEnabled: options.authEnabled === true };
   const server = http.createServer((req, res) => {
     // Bind port to the request handler
     handleRequest(req, res, port, sessionToken, lifecycle, serverConfig);
@@ -485,7 +478,7 @@ function createServer(port = DEFAULT_PORT, options = {}) {
       const validToken = actual.length === sessionToken.length
         && crypto.timingSafeEqual(Buffer.from(actual), Buffer.from(sessionToken));
       const accessToken = cookies[ACCESS_COOKIE] || '';
-      const validAccess = !serverConfig.authEnabled || accessAuth.disabled() || !!accessAuth.session(accessToken);
+      const validAccess = !serverConfig.authEnabled || !!accessAuth.session(accessToken);
       if (!origin || origin !== expected || !validToken || !validAccess) {
         socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
         socket.end();

package/src/pty.js

@@ -0,0 +1,189 @@
+'use strict';
+
+// A dependency-free pseudo-terminal shim.
+//
+// The CLI modal's persistent session (src/server-handlers-tools.js) wants a
+// child whose stdin is a TTY, because programs that ask a question — `read`,
+// `npm publish` under 2FA, `sudo`, git credential prompts — either get an
+// immediate EOF or refuse to prompt when stdin is a pipe.
+//
+// This module used to be delegated to `node-pty`. That native addon ships no
+// prebuilt binary for Linux (only darwin/win32), so a plain `npm install`
+// without a C++ toolchain failed outright on Linux — the exact platform where
+// mouaif is most often installed (Docker, CI, Codespaces, VPS). Instead of a
+// replacement dependency this module allocates the TTY with `script(1)` from
+// util-linux, present on every Linux base image including
+// `node:22-bookworm-slim`, and falls back to a piped child where it is not.
+//
+// `spawnPty(exe, args, opts)` returns a handle shaped like the handful of
+// node-pty members the session uses — `onData`, `onExit`, `write`, `kill`,
+// `pid`, `killed` — or `null` when no TTY can be allocated, in which case the
+// caller keeps its piped `child_process.spawn` path.
+//
+// How the TTY is obtained: `script -qefc "<command>" /dev/null` runs `printf`
+// (the caveat in the original node-pty code) on a pty slave and copies the
+// master to its own stdout, which is merged onto the pty by the kernel. So the
+// shell and everything it starts see a terminal, while the server keeps a plain
+// pipe to `script` — one readable stream, like node-pty's merged stdout.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawn, spawnSync } = require('node:child_process');
+
+// The `script` implementation we can rely on: util-linux, which supports
+// `-e` (return the child's exit code), `-f` (flush) and `-c` (command). BSD /
+// macOS `script` shares the name but not the flags, and Windows has no
+// equivalent, so on those platforms the caller's piped path stays in charge
+// (the documented degraded mode) and `isAvailable()` reports false.
+const SUPPORTED_PLATFORM = process.platform === 'linux';
+
+let resolved;
+let probeDone = false;
+let scriptBin = null;
+
+// Resolve an executable file on PATH without spawning anything, so the probe
+// below only runs when `script` is actually present.
+function which(name) {
+  const dirs = String(process.env.PATH || '').split(path.delimiter).filter(Boolean);
+  for (const dir of dirs) {
+    const candidate = path.join(dir, name);
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      if (fs.statSync(candidate).isFile()) return candidate;
+    } catch { /* not here; keep looking */ }
+  }
+  return null;
+}
+
+// One-shot capability probe: confirm this `script` accepts our flags before a
+// session depends on it. A util-linux build that predates `-f`, or a foreign
+// `script` that happens to be on PATH, fails the probe and the caller keeps the
+// piped fallback instead of a session that dies on spawn.
+function probeScript(bin) {
+  const result = spawnSync(bin, ['-qefc', 'exit 0', '/dev/null'], {
+    stdio: 'ignore',
+    timeout: 2000,
+    windowsHide: true
+  });
+  return !result.error && result.status === 0;
+}
+
+function resolveScript() {
+  if (probeDone) return scriptBin;
+  probeDone = true;
+  if (!SUPPORTED_PLATFORM) return (scriptBin = null);
+  const bin = which('script');
+  scriptBin = bin && probeScript(bin) ? bin : null;
+  return scriptBin;
+}
+
+// True when a real pseudo-terminal can be allocated on this host. The CLI
+// session reports this as `interactive`, and the modal hides its prompt badge
+// when it is false.
+function isAvailable() {
+  return !!resolveScript();
+}
+
+// The command string `script -c` hands to /bin/sh, so every word is quoted for
+// that shell: a project path, shell path or argument containing a space or
+// quote must survive the round trip.
+function shellQuote(word) {
+  return "'" + String(word).replace(/'/g, "'\\''") + "'";
+}
+
+function shellCommand(exe, args) {
+  return [exe].concat(args || []).map(shellQuote).join(' ');
+}
+
+// `kill()` has to reach the whole tree: the shell spawned its own children
+// (a running `npm test`, a pager), and `script` sits in between. POSIX only:
+// detached:true puts `script` in its own process group, so signalling the
+// negative pid takes down the shell and everything under it.
+function terminate(child) {
+  if (!child || child.killed) return;
+  if (process.platform !== 'win32' && child.pid) {
+    try { process.kill(-child.pid, 'SIGTERM'); } catch { /* group already gone */ }
+  }
+  try { child.kill(); } catch { /* already reaped */ }
+}
+
+function spawnPty(exe, args, opts) {
+  const bin = resolveScript();
+  if (!bin) return null;
+  const options = opts || {};
+  const child = spawn(bin, ['-qefc', shellCommand(exe, args), '/dev/null'], {
+    cwd: options.cwd,
+    env: options.env || process.env,
+    stdio: ['pipe', 'pipe', 'pipe'],
+    windowsHide: true,
+    detached: process.platform !== 'win32'
+  });
+  if (!child || !child.pid) return null;
+
+  const dataHandlers = [];
+  const exitHandlers = [];
+  // A PTY is not rewindable: anything written before the caller attaches its
+  // stream (the shell's first prompt, a login banner) would be lost. Hold a
+  // bounded amount until the first `onData` arrives, then flush it in order.
+  let pending = [];
+  let pendingBytes = 0;
+  const PENDING_LIMIT = 65536;
+  let killed = false;
+
+  const emit = (chunk) => {
+    if (dataHandlers.length) {
+      for (const handler of dataHandlers) {
+        try { handler(chunk); } catch { /* a bad handler must not break the stream */ }
+      }
+      return;
+    }
+    pendingBytes += chunk.length;
+    pending.push(chunk);
+    while (pendingBytes > PENDING_LIMIT && pending.length > 1) {
+      pendingBytes -= pending.shift().length;
+    }
+  };
+
+  // A PTY merges stdout and stderr, so both feeds report on the single `data`
+  // stream; `-e` keeps the child's exit code, surfaced through `onExit` the
+  // way node-pty reported it.
+  child.stdout.on('data', emit);
+  child.stderr.on('data', emit);
+  child.on('exit', (code, signal) => {
+    killed = true;
+    const event = { exitCode: code == null ? 0 : code, signal: signal ? 1 : 0 };
+    for (const handler of exitHandlers) {
+      try { handler(event); } catch { /* ignore */ }
+    }
+  });
+
+  return {
+    // node-pty compatibility surface used by the CLI session.
+    pty: true,
+    pid: child.pid,
+    get killed() { return killed || child.killed; },
+    onData(handler) {
+      if (typeof handler !== 'function') return;
+      dataHandlers.push(handler);
+      if (pending.length) {
+        const buffered = pending;
+        pending = [];
+        pendingBytes = 0;
+        for (const chunk of buffered) handler(chunk);
+      }
+    },
+    onExit(handler) {
+      if (typeof handler === 'function') exitHandlers.push(handler);
+    },
+    write(data) {
+      if (!child.stdin || !child.stdin.writable) return false;
+      try { return child.stdin.write(String(data)); } catch { return false; }
+    },
+    kill() {
+      killed = true;
+      terminate(child);
+    }
+  };
+}
+
+module.exports = { isAvailable, spawnPty };

package/src/server-handlers-access.js

@@ -51,28 +51,6 @@ actions: [{ action: 'open', title: 'Open mouaif' }]
 } catch { /* a notification failure must never block sign-in */ }
 }
 
-// notifyAccessChange(enabled) — best-effort push that app access protection
-// changed. A security-relevant event, so it reuses the `login` channel
-// ("sign in to / access of this server") rather than adding a preference;
-// it broadcasts to every subscribed device, including the one that acted,
-// so the state change is visible even if that phone is put down.
-function notifyAccessChange(enabled) {
-try {
-let prefs = {};
-try { prefs = resolveNotificationPrefs((settings.getApp() || {}).notifications); } catch { /* defaults apply */ }
-if (prefs.login !== true) return;
-push.sendPushToAll({
-title: enabled ? 'mouaif access enabled' : 'mouaif access disabled',
-body: enabled
-? 'Password and passkey protection is on again.'
-: 'App access is off. Anyone who can reach this server can open it.',
-tag: 'mouaif-access',
-data: { kind: 'login', url: '/#/settings/access' },
-actions: [{ action: 'open', title: 'Open settings' }]
-});
-} catch { /* a notification failure must never change the access state */ }
-}
-
 
 async function handleAccess(req, res, parsed, serverConfig) {
   const urlPath = parsed.pathname;
@@ -85,8 +63,7 @@ async function handleAccess(req, res, parsed, serverConfig) {
   const activeSession = accessAuth.session(accessToken);
 
   if (urlPath === '/api/access/status' && method === 'GET') {
-    const status = publicAccessStatus(serverConfig.authEnabled);
-    return sendJSON(res, 200, { ...status, session: !!activeSession, authenticated: !status.enabled || !!activeSession });
+    return sendJSON(res, 200, { ...publicAccessStatus(serverConfig.authEnabled), authenticated: !serverConfig.authEnabled || !!activeSession });
   }
 
   if (urlPath === '/api/access/login' && method === 'POST') {
@@ -112,83 +89,6 @@ return sendJSON(res, 200, { ok: true, user: accessAuth.user().username });
     return sendJSON(res, 200, { ok: true });
   }
 
-  // ---- Turn app access off / back on ------------------------------------
-  // Disabling is signed-in-only and requires a fresh one-time code, so a
-  // request that only holds a cookie (a script, a stale tab) cannot remove
-  // the login wall by itself. The code is minted here — unlike setup codes
-  // it is never printed to stdout or served to an unauthenticated caller.
-  if (urlPath === '/api/access/disable/code' && method === 'POST') {
-    if (!activeSession) return sendJSON(res, 401, { error: 'Sign in is required', code: 'EAUTH_REQUIRED' });
-    const issued = accessAuth.createDisableCode();
-    return sendJSON(res, 200, { code: issued.code, expiresAt: issued.expiresAt, ttlMs: accessAuth.DISABLE_TTL_MS });
-  }
-
-  // The QR is an image so a phone can open it with the system camera. It
-  // encodes the confirmation page, which is what makes the code itself
-  // unnecessary to type on the scanning device.
-  if (urlPath === '/api/access/disable/qr' && method === 'GET') {
-    if (!activeSession) return sendJSON(res, 401, { error: 'Sign in is required', code: 'EAUTH_REQUIRED' });
-    const code = typeof parsed.query.code === 'string' ? parsed.query.code : '';
-    if (!accessAuth.disableCodeValid(code)) return sendJSON(res, 404, { error: 'Disable code is missing or expired', code: 'EDISABLE_CODE' });
-    const confirmUrl = servedOrigin + '/#/disable-access?code=' + encodeURIComponent(accessAuth.normalizeCode(code));
-    const svg = qr.svg(confirmUrl);
-    res.writeHead(200, { 'Content-Type': 'image/svg+xml; charset=utf-8', 'Cache-Control': 'no-store' });
-    res.end(svg);
-    return;
-  }
-
-  if (urlPath === '/api/access/disable' && method === 'POST') {
-    const body = await readJsonOr400(req, res);
-    if (!body) return;
-    // An invalid code is a failed guess, so it counts against the same
-    // per-address limit as a wrong password. The confirmation page is
-    // deliberately reachable without a session, so nothing else slows down
-    // a caller trying codes in a loop.
-    if (!checkAccessAttempts(req)) return sendJSON(res, 429, { error: 'Too many attempts; wait a minute', code: 'ERATE_LIMIT' });
-    if (!accessAuth.disableCodeValid(body.code)) {
-      recordAccessFailure(req);
-      return sendJSON(res, 401, { error: 'That code is invalid or expired', code: 'EDISABLE_CODE' });
-    }
-    if (!accessAuth.consumeDisableCode(body.code)) {
-      recordAccessFailure(req);
-      return sendJSON(res, 409, { error: 'That code was already used or expired', code: 'EDISABLE_CODE' });
-    }
-    clearAccessFailures(req);
-    // Consume every other outstanding invitation and turn the gate off.
-    // Sessions are intentionally kept: with the gate off they authorize
-    // nothing, and holding on to them lets the device that disabled access
-    // re-enable it without having to prove the password again.
-    settings.getDb().prepare('DELETE FROM access_disable_codes').run();
-    settings.getDb().prepare('DELETE FROM access_setup_codes').run();
-    accessAuth.setEnabled(false);
-    notifyAccessChange(false);
-    return sendJSON(res, 200, { ok: true, enabled: false, configured: accessAuth.configured() });
-  }
-
-  // Turning protection back on is safe to do from an unauthenticated screen,
-  // so it accepts any of the store's proofs: a live session, the account
-  // password, or a CLI setup code. That keeps recovery possible even after
-  // session cookies have expired while access was off.
-  if (urlPath === '/api/access/enable' && method === 'POST') {
-    const body = await readJsonOr400(req, res);
-    if (!body) return;
-    const account = accessAuth.user();
-    if (!account) return sendJSON(res, 409, { error: 'Create the access user before enabling protection', code: 'ENOTCONFIGURED' });
-    const bySession = !!activeSession;
-    const byPassword = !bySession && account
-      && accessAuth.verifyPassword(body.username || account.username, body.password);
-    const bySetupCode = !bySession && !byPassword && accessAuth.setupCodeValid(body.code);
-    if (!bySession && !byPassword && !bySetupCode) {
-      return sendJSON(res, 401, { error: 'Sign in, or enter the account password, to enable access', code: 'EAUTH_REQUIRED' });
-    }
-    if (bySetupCode && !accessAuth.consumeSetupCode(body.code)) {
-      return sendJSON(res, 409, { error: 'Setup code was already used or expired', code: 'ESETUP_CODE' });
-    }
-    accessAuth.setEnabled(true);
-    notifyAccessChange(true);
-    return sendJSON(res, 200, { ok: true, enabled: true, configured: true });
-  }
-
   // Password change from an authenticated browser session. Requires a real
   // cookie session (a Basic-auth API client cannot ask to rotate the
   // password through this endpoint). The current session survives the

package/src/server-handlers-tools.js

@@ -23,18 +23,21 @@ const {
 //
 // A single persistent command-line child per project (the platform shell:
 // cmd.exe on Windows, the user's $SHELL or /bin/sh on POSIX) with
-// stdin/stdout/stderr piped over HTTP. All commands run in the project
+// stdin/stdout/stderr carried over HTTP. All commands run in the project
 // directory ("default path to the project"). The session is created with
 // `windowsHide` and no window is ever shown; output streaming rides the
 // SSE endpoint (see startCliSession below).
 //
-// The child is intentionally spawned WITHOUT a TTY (pipe stdio). Commands
-// that require an interactive TTY (REPLs, `cmd.exe` interactive prompts
-// like `del` confirmation) will fail or exit immediately — a documented
-// limitation, same as the native `shell` tool. Everything non-interactive
-// works exactly like a real Command Prompt.
+// The child runs on a pseudo-terminal when the host can allocate one (see
+// src/pty.js), which is what lets prompting programs ask a question. Where
+// no PTY is available the session falls back to piped stdio, and commands
+// that require a TTY (REPLs, `cmd.exe` interactive prompts like `del`
+// confirmation) fail or exit immediately — the documented limitation, same
+// as the native `shell` tool. Everything non-interactive works exactly like
+// a real Command Prompt in both modes.
 
 const { spawn } = require('node:child_process');
+const pty = require('./pty.js');
 
 const cliSessions = new Map(); // projectDir -> { child, projectDir, id, startedAt }
 
@@ -85,26 +88,9 @@ function cliShellMeta() {
   };
 }
 
-// Load node-pty once. It is an optional native dependency: a platform with
-// no prebuilt binary (and no C++ toolchain) still installs mouaif, and the
-// session silently falls back to the piped spawn below. `require` is
-// wrapped so a missing/broken addon is a degraded mode, not a crash.
-let ptyModule = null;
-let ptyLoadAttempted = false;
-function loadPty() {
-  if (ptyLoadAttempted) return ptyModule;
-  ptyLoadAttempted = true;
-  try {
-    ptyModule = require('node-pty');
-  } catch {
-    ptyModule = null;
-  }
-  return ptyModule;
-}
-
 // Start the persistent session (idempotent) and return the session handle.
 //
-// The session runs on a pseudo-terminal when node-pty is available. That
+// The session runs on a pseudo-terminal when one can be allocated. That
 // matters for prompting programs: over pipes (`stdio: ['pipe', ...]`) the
 // child's stdin is not a TTY, so a program that asks a question either gets
 // an immediate EOF or refuses to prompt at all — `npm publish` under 2FA
@@ -113,19 +99,24 @@ function loadPty() {
 // screen, the user types the answer into the modal's prompt line, and it is
 // delivered to the still-running child.
 //
+// The TTY comes from src/pty.js, which allocates it with util-linux
+// `script(1)` — no native addon, so `npm install` needs no C++ toolchain.
+// Where no PTY can be allocated (Windows, BSD/macOS `script`, a container
+// without util-linux) the piped spawn below takes over, and the modal shows a
+// non-interactive session.
+//
 // A PTY merges stdout and stderr into one stream, so `attachCliStream`
 // labels every chunk `stdout`; there is no separate stderr channel to
-// preserve. When the PTY is unavailable the old piped triple is used and
-// stderr keeps its own channel.
+// preserve. The piped fallback keeps the old triple and stderr keeps its own
+// channel.
 function ensureCliSession(projectDir) {
   const key = String(projectDir || '');
   const existing = cliSessions.get(key);
   if (existing && existing.child && !existing.child.killed) return existing;
   const meta = cliShellMeta();
-  const pty = loadPty();
-  let child;
+  let child = null;
   let isPty = false;
-  if (pty && typeof pty.spawn === 'function') {
+  if (pty.isAvailable()) {
     try {
       // The shell is only interactive once it has a TTY, so ask for `-i`
       // here rather than in cliShellMeta (the piped fallback must not: bash
@@ -133,18 +124,16 @@ function ensureCliSession(projectDir) {
       const ptyArgs = (!meta.windows && meta.args.indexOf('-i') === -1)
         ? meta.args.concat('-i')
         : meta.args;
-      child = pty.spawn(meta.exe, ptyArgs, {
-        name: 'xterm-256color',
-        cols: meta.cols,
-        rows: meta.rows,
+      child = pty.spawnPty(meta.exe, ptyArgs, {
         cwd: projectDir,
         // The child inherits the server's env; force a colour-capable TERM
         // so utilities that gate formatting on terminfo behave.
         env: Object.assign({}, process.env, { TERM: process.env.TERM || 'xterm-256color' })
       });
-      isPty = true;
+      isPty = !!child;
     } catch {
       child = null;
+      isPty = false;
     }
   }
   if (!child) {
@@ -159,7 +148,7 @@ function ensureCliSession(projectDir) {
     projectDir,
     child,
     startedAt: Date.now(),
-    // True when the child runs on a pseudo-terminal (see loadPty above).
+    // True when the child runs on a pseudo-terminal (see src/pty.js).
     pty: isPty,
     // Record the platform so command writes use the correct line
     // terminator: CRLF for cmd.exe on Windows, LF for sh/bash on POSIX.
@@ -167,7 +156,7 @@ function ensureCliSession(projectDir) {
   };
   hookCliExit();
   cliSessions.set(key, session);
-  // Reap on exit so a closed session doesn't leak. node-pty reports exit
+  // Reap on exit so a closed session doesn't leak. A PTY reports exit
   // through `onExit`; a piped child uses the standard `exit` event.
   if (isPty) child.onExit(() => { if (cliSessions.get(key) === session) cliSessions.delete(key); });
   else child.on('exit', () => { if (cliSessions.get(key) === session) cliSessions.delete(key); });

package/src/server-shared.js

@@ -344,11 +344,6 @@ function authorizeBrowserRequest(req, res, sessionToken, publicOrigin) {
 
 function authorizeAccessRequest(req, res, authEnabled) {
   if (!authEnabled) return true;
-  // Access can be turned off from inside the app (one-time disable code).
-  // serverConfig.authEnabled was resolved at worker start; re-checking the
-  // store here makes the change effective immediately, without waiting for a
-  // restart — the /#/disable-access page is the point of no return.
-  if (accessAuth.disabled()) return true;
   if (!accessAuth.configured()) {
     // Preserve the existing loopback CLI/API workflow until the user opts in;
     // browser traffic is held at setup so the web UI cannot expose app data.
@@ -564,16 +559,8 @@ function clearAccessFailures(req) {
 
 function publicAccessStatus(authEnabled = true) {
   const account = accessAuth.user();
-  const disabled = accessAuth.disabled();
-  // `armed` is whether the process was started with an auth flag at all,
-  // independent of the in-app disable switch. The UI uses it to decide
-  // between "protection is off because you turned it off" and "this server
-  // was never asked to protect anything".
-  const armed = !!authEnabled || disabled;
   return {
-    armed,
-    enabled: !!authEnabled && !disabled,
-    disabled,
+    enabled: !!authEnabled,
     configured: !!account,
     user: account ? account.username : null,
     passkeyCount: account ? accessAuth.passkeys().length : 0