neuralos 3.0.2 → 3.0.3

package/bin/gybackend.cjs

@@ -386599,6 +386599,32 @@ function renderLiveDashboardHtml(state, opts = {}) {
   return renderDashboardHtml(state, { ...opts, live: true, refreshSeconds: 0 });
 }
 
+// ../../packages/backend/src/services/dashboard/dashboardHttpAuth.ts
+function isLoopbackAddress(raw) {
+  return /^(127\.|::1|::ffff:127\.)/.test(raw) || raw === "" || raw === "localhost";
+}
+function extractDashboardToken(req) {
+  const authz = typeof req.headers.authorization === "string" ? req.headers.authorization : "";
+  const bearer = /^Bearer\s+(.+)$/i.exec(authz)?.[1]?.trim();
+  const headerTok = typeof req.headers["x-access-token"] === "string" ? String(req.headers["x-access-token"]).trim() : "";
+  let queryTok = "";
+  try {
+    queryTok = new URL(req.url ?? "/", "http://localhost").searchParams.get("access_token")?.trim() ?? "";
+  } catch {
+  }
+  return bearer || headerTok || queryTok;
+}
+async function dashboardHttpAuthorized(req, verifyToken) {
+  if (isLoopbackAddress(String(req.socket?.remoteAddress ?? ""))) return true;
+  const token = extractDashboardToken(req);
+  if (!token) return false;
+  try {
+    return await verifyToken(token);
+  } catch {
+    return false;
+  }
+}
+
 // ../../packages/backend/src/services/ResourceMonitorService.ts
 var import_os2 = __toESM(require("os"), 1);
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
@@ -388704,27 +388730,6 @@ async function startGyBackend() {
     gatewayService.broadcastRaw("skills:updated", result.skills);
     gatewayService.broadcastRaw("memory:updated", result.memory);
   };
-  const dashboardHttpAuthorized = async (req) => {
-    const remote = String(req.socket?.remoteAddress ?? "");
-    if (/^(127\.|::1|::ffff:127\.)/.test(remote) || remote === "" || remote === "localhost") {
-      return true;
-    }
-    const authz = typeof req.headers.authorization === "string" ? req.headers.authorization : "";
-    const bearer = /^Bearer\s+(.+)$/i.exec(authz)?.[1]?.trim();
-    const headerTok = typeof req.headers["x-access-token"] === "string" ? String(req.headers["x-access-token"]).trim() : "";
-    let queryTok = "";
-    try {
-      queryTok = new URL(req.url ?? "/", "http://localhost").searchParams.get("access_token")?.trim() ?? "";
-    } catch {
-    }
-    const token = bearer || headerTok || queryTok;
-    if (!token) return false;
-    try {
-      return await accessTokenService.verifyToken(token);
-    } catch {
-      return false;
-    }
-  };
   const wsGatewayControlService = new WebSocketGatewayControlService({
     createAdapter: (host, port, ipFilter) => new WebSocketGatewayAdapter(gatewayService, {
       host,
@@ -388742,7 +388747,7 @@ async function startGyBackend() {
         {
           path: "/dashboard",
           handler: async (req, res) => {
-            if (!await dashboardHttpAuthorized(req)) {
+            if (!await dashboardHttpAuthorized(req, (t) => accessTokenService.verifyToken(t))) {
               res.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
               res.end("missing/invalid access token");
               return;
@@ -388760,7 +388765,7 @@ async function startGyBackend() {
         {
           path: "/dashboard/json",
           handler: async (req, res) => {
-            if (!await dashboardHttpAuthorized(req)) {
+            if (!await dashboardHttpAuthorized(req, (t) => accessTokenService.verifyToken(t))) {
               res.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
               res.end("missing/invalid access token");
               return;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "neuralos",
-  "version": "3.0.2",
-  "description": "neuralOS — the headless AI-native backend for RTerm. run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation, SRE observability, Netdata, AWS APerf, plugin system, governance/audit, Prometheus/OTel metrics export, secrets vault, on-call paging, AI cost budgets, GitOps, cloud inventory, APM/DEM/Infra/ETW ingestion, AgentSpan durable-agent bridge). The RTerm desktop app stays RTerm; neuralOS is the standalone backend daemon. Dual-published as rterm-backend. v3.0.2: live browser dashboard at /dashboard (same-port HTTP + WS push).",
+  "version": "3.0.3",
+  "description": "neuralOS — the headless AI-native backend for RTerm. run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation, SRE observability, Netdata, AWS APerf, plugin system, governance/audit, Prometheus/OTel metrics export, secrets vault, on-call paging, AI cost budgets, GitOps, cloud inventory, APM/DEM/Infra/ETW ingestion, AgentSpan durable-agent bridge). The RTerm desktop app stays RTerm; neuralOS is the standalone backend daemon. Dual-published as rterm-backend. v3.0.3: fixes /dashboard \"Upgrade Required\" on the desktop app (Electron main now serves it too).",
   "main": "bin/gybackend.cjs",
   "bin": {
     "neuralos": "bin/gybackend.cjs",