openmagic 0.13.0 → 0.14.0

package/README.md

@@ -191,6 +191,15 @@ This file is in your home directory, never in your project. It won't be committe
 - **Path sandboxing** — File operations are restricted to configured root directories. The server cannot read/write outside your project.
 - **API keys stay local** — Keys are stored in `~/.openmagic/config.json` on your machine. They are proxied through the local server and never exposed to the browser or any third party.
 - **Zero project modification** — OpenMagic never modifies your `package.json`, config files, or source code during installation. The toolbar exists only in the proxy layer.
+- **Symlink protection** — File operations resolve symlinks and reject paths that escape the project root.
+- **Diff preview** — AI-proposed code changes are shown as diffs with Apply/Reject buttons. Nothing is auto-applied.
+
+### Known Limitations
+
+OpenMagic uses a reverse proxy which introduces these tradeoffs:
+
+- **Origin change** — Your app runs on `localhost:3000` but is accessed via `localhost:4567`. This can affect OAuth redirects, `localStorage` isolation, and Service Worker scope. Most dev workflows are unaffected, but if your app relies on `window.location.origin`, you may need to adjust your dev config.
+- **CSP meta tags** — OpenMagic strips CSP response headers to allow the toolbar script. However, CSP set via `<meta>` tags in your HTML cannot be modified and may block the toolbar on strict CSP pages.
 
 ## Comparison
 

package/dist/cli.js

@@ -10,8 +10,6 @@ import { createInterface } from "readline";
 
 // src/proxy.ts
 import http from "http";
-import { gunzip, inflate, brotliDecompress } from "zlib";
-import { promisify } from "util";
 import httpProxy from "http-proxy";
 
 // src/security.ts
@@ -1358,7 +1356,7 @@ async function handleLlmChat(params, onChunk, onDone, onError) {
 }
 
 // src/server.ts
-var VERSION = "0.13.0";
+var VERSION = "0.14.0";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
 function attachOpenMagic(httpServer, roots) {
   function handleRequest(req, res) {
@@ -1603,9 +1601,6 @@ function serveToolbarBundle(res) {
 }
 
 // src/proxy.ts
-var gunzipAsync = promisify(gunzip);
-var inflateAsync = promisify(inflate);
-var brotliAsync = promisify(brotliDecompress);
 function createProxyServer(targetHost, targetPort, roots) {
   const proxy = httpProxy.createProxyServer({
     target: `http://${targetHost}:${targetPort}`,
@@ -1613,6 +1608,9 @@ function createProxyServer(targetHost, targetPort, roots) {
     selfHandleResponse: true
   });
   const token = getSessionToken();
+  proxy.on("proxyReq", (proxyReq) => {
+    proxyReq.removeHeader("Accept-Encoding");
+  });
   proxy.on("proxyRes", (proxyRes, req, res) => {
     const contentType = proxyRes.headers["content-type"] || "";
     const isHtml = contentType.includes("text/html");
@@ -1621,33 +1619,20 @@ function createProxyServer(targetHost, targetPort, roots) {
       proxyRes.pipe(res);
       return;
     }
-    collectBody(proxyRes).then((body) => {
-      const toolbarScript = buildInjectionScript(token);
-      if (body.includes("</body>")) {
-        body = body.replace("</body>", `${toolbarScript}</body>`);
-      } else if (body.includes("</html>")) {
-        body = body.replace("</html>", `${toolbarScript}</html>`);
-      } else {
-        body += toolbarScript;
-      }
-      const headers = { ...proxyRes.headers };
-      delete headers["content-length"];
-      delete headers["content-encoding"];
-      delete headers["transfer-encoding"];
-      delete headers["content-security-policy"];
-      delete headers["content-security-policy-report-only"];
-      delete headers["x-content-security-policy"];
-      delete headers["etag"];
-      delete headers["last-modified"];
-      headers["cache-control"] = "no-store";
-      res.writeHead(proxyRes.statusCode || 200, headers);
-      res.end(body);
-    }).catch(() => {
-      try {
-        res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
-        res.end();
-      } catch {
-      }
+    const headers = { ...proxyRes.headers };
+    delete headers["content-length"];
+    delete headers["content-encoding"];
+    delete headers["transfer-encoding"];
+    delete headers["content-security-policy"];
+    delete headers["content-security-policy-report-only"];
+    delete headers["x-content-security-policy"];
+    delete headers["etag"];
+    delete headers["last-modified"];
+    headers["cache-control"] = "no-store";
+    res.writeHead(proxyRes.statusCode || 200, headers);
+    proxyRes.pipe(res, { end: false });
+    proxyRes.on("end", () => {
+      res.end(buildInjectionScript(token));
     });
   });
   proxy.on("error", (err, _req, res) => {
@@ -1678,33 +1663,6 @@ function createProxyServer(targetHost, targetPort, roots) {
   });
   return server;
 }
-async function collectBody(stream) {
-  const rawBuffer = await new Promise((resolve3, reject) => {
-    const chunks = [];
-    stream.on("data", (chunk) => chunks.push(chunk));
-    stream.on("end", () => resolve3(Buffer.concat(chunks)));
-    stream.on("error", reject);
-  });
-  const encoding = (stream.headers["content-encoding"] || "").toLowerCase();
-  if (!encoding || encoding === "identity") {
-    return rawBuffer.toString("utf-8");
-  }
-  try {
-    let decompressed;
-    if (encoding === "gzip" || encoding === "x-gzip") {
-      decompressed = await gunzipAsync(rawBuffer);
-    } else if (encoding === "deflate") {
-      decompressed = await inflateAsync(rawBuffer);
-    } else if (encoding === "br") {
-      decompressed = await brotliAsync(rawBuffer);
-    } else {
-      return rawBuffer.toString("utf-8");
-    }
-    return decompressed.toString("utf-8");
-  } catch {
-    return rawBuffer.toString("utf-8");
-  }
-}
 function buildInjectionScript(token) {
   return `<script src="/__openmagic__/toolbar.js?v=${Date.now()}" data-openmagic="true" data-openmagic-token="${token}" defer></script>`;
 }
@@ -1885,7 +1843,7 @@ process.on("uncaughtException", (err) => {
   process.exit(1);
 });
 var childProcesses = [];
-var VERSION2 = "0.13.0";
+var VERSION2 = "0.14.0";
 function ask(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   return new Promise((resolve3) => {