pinomad 0.7.0 → 0.9.0

package/dist/{chunk-6ysezfy5.js → chunk-vxmj0200.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   serveWebClient
-} from "./chunk-r6w5aqkw.js";
+} from "./chunk-wb10efyq.js";
 import {
   RELAY_CLOSE,
   decodeHostToRelay,
@@ -9,14 +9,14 @@ import {
   relayWsBase,
   verifyRelayChallenge,
   verifyRelayChallengeV2
-} from "./chunk-7qb9tq54.js";
+} from "./chunk-khcpv54k.js";
 import {
   commandHint,
   webRoot
-} from "./chunk-rtwxjb90.js";
+} from "./chunk-vyvyaavr.js";
 import {
   normalizeHostName
-} from "./chunk-znhn8af7.js";
+} from "./chunk-sygeb9qb.js";
 import"./chunk-df32avw6.js";
 
 // apps/server/src/main.ts
@@ -57,9 +57,19 @@ async function lockDataDir(dir, options) {
 
 // apps/server/src/accounts.ts
 var DB_FILE = "server.sqlite";
-var SCHEMA_VERSION = 1;
+var SCHEMA_VERSION = 3;
 var SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 var JOIN_TOKEN_TTL_MS = 10 * 60 * 1000;
+var INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+var SIGN_UP_USERNAME = /^[a-z0-9][a-z0-9._-]{1,31}$/;
+var PUSH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+var MAX_PUSH_TOKENS_PER_USER = 32;
+var APNS_TOKEN_PATTERN = /^(?:[0-9a-f]{2})+$/;
+var APNS_TOKEN_MAX_CHARS = 256;
+function normalizeApnsToken(raw) {
+  const token = raw.toLowerCase();
+  return token.length <= APNS_TOKEN_MAX_CHARS && APNS_TOKEN_PATTERN.test(token) ? token : undefined;
+}
 var SCRYPT = { N: 16384, r: 8, p: 1 };
 var KEY_LEN = 32;
 var SALT_LEN = 16;
@@ -117,6 +127,45 @@ function migrate(db) {
   }
   if (version === SCHEMA_VERSION)
     return;
+  if (version < 1)
+    migrateTo1(db);
+  if (version < 2) {
+    db.exec(`
+      BEGIN;
+      CREATE TABLE push_tokens (
+        token TEXT NOT NULL,
+        environment TEXT NOT NULL,
+        user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (token, environment)
+      );
+      CREATE INDEX push_tokens_user ON push_tokens (user_id, updated_at);
+      PRAGMA user_version = 2;
+      COMMIT;
+    `);
+  }
+  if (version < 3) {
+    db.exec(`
+      BEGIN;
+      ALTER TABLE users ADD COLUMN admin INTEGER NOT NULL DEFAULT 0;
+      UPDATE users SET admin = 1 WHERE id = (SELECT MIN(id) FROM users);
+      -- AUTOINCREMENT: minting sweeps expired invites, and a reused id would
+      -- let a revoke from a stale list hit a code already sent to someone.
+      CREATE TABLE invites (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        code_hash TEXT NOT NULL UNIQUE,
+        created_by INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL,
+        used_at INTEGER,
+        used_by INTEGER REFERENCES users(id) ON DELETE SET NULL
+      );
+      PRAGMA user_version = 3;
+      COMMIT;
+    `);
+  }
+}
+function migrateTo1(db) {
   db.exec(`
     BEGIN;
     CREATE TABLE users (
@@ -146,7 +195,7 @@ function migrate(db) {
       joined_at INTEGER NOT NULL,
       last_seen_at INTEGER NOT NULL
     );
-    PRAGMA user_version = ${SCHEMA_VERSION};
+    PRAGMA user_version = 1;
     COMMIT;
   `);
 }
@@ -237,7 +286,7 @@ async function openAccounts(options) {
       assertUsernamePolicy(options.bootstrapUser);
       assertPasswordPolicy(options.bootstrapPassword);
       const hash = await hashPassword(options.bootstrapPassword);
-      db.prepare("INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)").run(options.bootstrapUser, hash, now());
+      db.prepare("INSERT INTO users (username, password_hash, created_at, admin) VALUES (?, ?, ?, 1)").run(options.bootstrapUser, hash, now());
     }
   } catch (error) {
     db?.close();
@@ -256,6 +305,20 @@ async function openAccounts(options) {
   const gate = new ScryptGate(limits.scryptConcurrency, limits.scryptQueue);
   const ipAttempts = new WindowedCounter(limits.counterMaxEntries, now);
   const userFailures = new WindowedCounter(limits.counterMaxEntries, now);
+  const issueSession = (userId) => {
+    db.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(now());
+    const token = randomBytes(32).toString("base64url");
+    const expiresAt = now() + SESSION_TTL_MS;
+    db.prepare("INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), userId, now(), expiresAt);
+    return { token, expiresAt };
+  };
+  const inviteState = (codeHash) => {
+    const row = db.prepare("SELECT expires_at AS expiresAt, used_at AS usedAt FROM invites WHERE code_hash = ?").get(codeHash);
+    if (row === undefined || row.usedAt !== null)
+      return "invalid_invite";
+    return row.expiresAt <= now() ? "invite_expired" : "ok";
+  };
+  const usernameTaken = (username) => db.prepare("SELECT 1 AS x FROM users WHERE lower(username) = ?").get(username) !== undefined;
   return {
     dbPath: join(options.dataDir, DB_FILE),
     async login(username, password, ip) {
@@ -263,7 +326,7 @@ async function openAccounts(options) {
         return { status: "limited" };
       if (userFailures.isOver(username, limits.userMaxFailures))
         return { status: "limited" };
-      const user = db.prepare("SELECT id, username, password_hash AS passwordHash FROM users WHERE username = ?").get(username);
+      const user = db.prepare("SELECT id, username, password_hash AS passwordHash, admin FROM users WHERE username = ?").get(username);
       const outcome = await gate.run(async () => {
         if (userFailures.isOver(username, limits.userMaxFailures))
           return "limited";
@@ -279,28 +342,123 @@ async function openAccounts(options) {
       if (outcome === "invalid")
         return { status: "invalid" };
       userFailures.reset(username);
-      db.prepare("DELETE FROM sessions WHERE expires_at <= ?").run(now());
-      const token = randomBytes(32).toString("base64url");
-      const expiresAt = now() + SESSION_TTL_MS;
-      db.prepare("INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(token), outcome, now(), expiresAt);
-      return { status: "ok", token, expiresAt };
+      return { status: "ok", ...issueSession(outcome), admin: user?.admin === 1 };
+    },
+    async register({ invite, username, password, ip }) {
+      if (ipAttempts.hit(ip, limits.ipMaxAttempts, limits.ipWindowMs))
+        return { status: "limited" };
+      const codeHash = sha256Hex(invite);
+      const invited = inviteState(codeHash);
+      if (invited !== "ok")
+        return { status: "refused", reason: invited };
+      if (!SIGN_UP_USERNAME.test(username))
+        return { status: "refused", reason: "invalid_username" };
+      const length = [...password].length;
+      if (length < MIN_PASSWORD_CODEPOINTS || length > MAX_PASSWORD_CODEPOINTS) {
+        return { status: "refused", reason: "weak_password" };
+      }
+      if (usernameTaken(username))
+        return { status: "refused", reason: "username_taken" };
+      const hash = await gate.run(() => hashPassword(password));
+      if (hash === undefined)
+        return { status: "limited" };
+      db.exec("BEGIN");
+      try {
+        const again = inviteState(codeHash);
+        const failure = again !== "ok" ? again : usernameTaken(username) ? "username_taken" : undefined;
+        if (failure !== undefined) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: failure };
+        }
+        const userId = Number(db.prepare("INSERT INTO users (username, password_hash, created_at) VALUES (?, ?, ?)").run(username, hash, now()).lastInsertRowid);
+        const claimed = db.prepare("UPDATE invites SET used_at = ?, used_by = ? WHERE code_hash = ? AND used_at IS NULL").run(now(), userId, codeHash);
+        if (Number(claimed.changes) !== 1) {
+          db.exec("ROLLBACK");
+          return { status: "refused", reason: "invalid_invite" };
+        }
+        const session = issueSession(userId);
+        db.exec("COMMIT");
+        return { status: "ok", ...session };
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    createInvite(userId) {
+      db.prepare("DELETE FROM invites WHERE used_at IS NULL AND expires_at <= ?").run(now());
+      const code = randomBytes(16).toString("base64url");
+      const expiresAt = now() + INVITE_TTL_MS;
+      db.prepare("INSERT INTO invites (code_hash, created_by, created_at, expires_at) VALUES (?, ?, ?, ?)").run(sha256Hex(code), userId, now(), expiresAt);
+      return { code, expiresAt };
+    },
+    listInvites() {
+      const rows = db.prepare(`SELECT i.id AS id, i.created_at AS createdAt, i.expires_at AS expiresAt, i.used_at AS usedAt, u.username AS usedBy
+           FROM invites i LEFT JOIN users u ON u.id = i.used_by ORDER BY i.created_at DESC, i.id DESC`).all();
+      return rows.map((row) => ({
+        id: row.id,
+        createdAt: row.createdAt,
+        expiresAt: row.expiresAt,
+        ...row.usedAt === null ? {} : { usedAt: row.usedAt },
+        ...row.usedBy === null ? {} : { usedBy: row.usedBy }
+      }));
+    },
+    revokeInvite(id) {
+      return Number(db.prepare("DELETE FROM invites WHERE id = ? AND used_at IS NULL").run(id).changes) > 0;
     },
     authenticate(token) {
-      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, s.expires_at AS expiresAt
+      const row = db.prepare(`SELECT s.user_id AS userId, u.username AS username, u.admin AS admin, s.expires_at AS expiresAt
            FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token_hash = ?`).get(sha256Hex(token));
       if (row === undefined || row.expiresAt <= now())
         return;
-      return { userId: row.userId, username: row.username };
+      return { userId: row.userId, username: row.username, admin: row.admin === 1 };
     },
     logout(token) {
       db.prepare("DELETE FROM sessions WHERE token_hash = ?").run(sha256Hex(token));
     },
     revokeAllSessions(userId) {
-      db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+      db.exec("BEGIN");
+      try {
+        db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
+        db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
     },
     hasHost(hostId) {
       return db.prepare("SELECT 1 AS x FROM hosts WHERE host_id = ?").get(hostId) !== undefined;
     },
+    hostOwner(hostId) {
+      const row = db.prepare("SELECT user_id AS userId FROM hosts WHERE host_id = ?").get(hostId);
+      return row?.userId;
+    },
+    registerPushToken(userId, token, environment) {
+      const at = now();
+      db.exec("BEGIN");
+      try {
+        db.prepare("DELETE FROM push_tokens WHERE updated_at < ?").run(at - PUSH_TOKEN_TTL_MS);
+        db.prepare(`INSERT INTO push_tokens (token, environment, user_id, updated_at) VALUES (?, ?, ?, ?)
+           ON CONFLICT (token, environment) DO UPDATE SET user_id = excluded.user_id, updated_at = excluded.updated_at`).run(token.toLowerCase(), environment, userId, at);
+        db.prepare(`DELETE FROM push_tokens WHERE user_id = ? AND rowid NOT IN (
+             SELECT rowid FROM push_tokens WHERE user_id = ? ORDER BY updated_at DESC LIMIT ?
+           )`).run(userId, userId, MAX_PUSH_TOKENS_PER_USER);
+        db.exec("COMMIT");
+      } catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+      }
+    },
+    removePushToken(userId, token, environment) {
+      db.prepare("DELETE FROM push_tokens WHERE token = ? AND environment = ? AND user_id = ?").run(token.toLowerCase(), environment, userId);
+    },
+    pushTokenOwner(token, environment) {
+      const row = db.prepare("SELECT user_id AS userId FROM push_tokens WHERE token = ? AND environment = ? AND updated_at >= ?").get(token.toLowerCase(), environment, now() - PUSH_TOKEN_TTL_MS);
+      return row?.userId;
+    },
+    forgetPushToken(token, environment, unregisteredAt) {
+      db.prepare("DELETE FROM push_tokens WHERE token = ? AND environment = ? AND updated_at < ?").run(token.toLowerCase(), environment, unregisteredAt);
+    },
     createJoinToken(userId) {
       db.prepare("DELETE FROM join_tokens WHERE expires_at <= ?").run(now());
       const token = randomBytes(32).toString("base64url");
@@ -389,6 +547,7 @@ async function changePassword(options) {
       db.prepare("UPDATE users SET password_hash = ? WHERE id = ?").run(hash, userId);
       db.prepare("DELETE FROM sessions WHERE user_id = ?").run(userId);
       db.prepare("DELETE FROM join_tokens WHERE user_id = ? AND used_at IS NULL").run(userId);
+      db.prepare("DELETE FROM push_tokens WHERE user_id = ?").run(userId);
       db.exec("COMMIT");
     } catch (error) {
       db.exec("ROLLBACK");
@@ -719,7 +878,7 @@ async function handleApiRequest(request, response, ctx) {
     return;
   }
   const bearer = (request.headers.authorization ?? "").startsWith("Bearer ");
-  const loginTokenMode = pathname === "/api/login" && (origin === undefined || origin === DESKTOP_ORIGIN);
+  const loginTokenMode = (pathname === "/api/login" || pathname === "/api/register") && (origin === undefined || origin === DESKTOP_ORIGIN);
   if (MUTATING.has(method) && !bearer && !loginTokenMode && origin !== ctx.publicOrigin) {
     deny(403, "origin_mismatch");
     return;
@@ -754,9 +913,92 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     const cookieMode = origin === ctx.publicOrigin;
+    send(200, {
+      user: { username },
+      ...result.admin ? { admin: true } : {},
+      expiresAt: result.expiresAt,
+      ...cookieMode ? {} : { token: result.token }
+    }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
+    return;
+  }
+  if (pathname === "/api/register") {
+    if (method !== "POST") {
+      deny(405, "method_not_allowed", { allow: "POST" });
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const value = body.value;
+    if (typeof value?.invite !== "string" || typeof value.username !== "string" || typeof value.password !== "string") {
+      deny(400, "invalid_request");
+      return;
+    }
+    const { invite, username } = value;
+    const result = await accounts.register({
+      invite,
+      username,
+      password: value.password,
+      ip: clientIp(request, ctx.trustProxy)
+    });
+    if (result.status === "limited") {
+      deny(429, "rate_limited");
+      return;
+    }
+    if (result.status === "refused") {
+      const status = result.reason === "invalid_invite" || result.reason === "invite_expired" ? 403 : result.reason === "username_taken" ? 409 : 400;
+      deny(status, result.reason);
+      return;
+    }
+    const cookieMode = origin === ctx.publicOrigin;
     send(200, { user: { username }, expiresAt: result.expiresAt, ...cookieMode ? {} : { token: result.token } }, cookieMode ? { "set-cookie": setSessionCookie(result.token) } : undefined);
     return;
   }
+  if (pathname === "/api/invites" || pathname === "/api/invites/revoke") {
+    const allowed = pathname === "/api/invites" ? ["GET", "POST"] : ["POST"];
+    if (!allowed.includes(method)) {
+      deny(405, "method_not_allowed", { allow: allowed.join(", ") });
+      return;
+    }
+    const token = sessionToken(request);
+    const session = token === undefined ? undefined : accounts.authenticate(token);
+    if (session === undefined) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (!session.admin) {
+      deny(403, "forbidden");
+      return;
+    }
+    if (pathname === "/api/invites") {
+      if (method === "GET")
+        send(200, accounts.listInvites());
+      else
+        send(200, accounts.createInvite(session.userId));
+      return;
+    }
+    const body = await readJson(request);
+    if (!body.ok) {
+      deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+      return;
+    }
+    const id = body.value?.id;
+    if (typeof id !== "number" || !Number.isSafeInteger(id)) {
+      deny(400, "invalid_request");
+      return;
+    }
+    if (accounts.authenticate(token)?.admin !== true) {
+      deny(401, "unauthenticated");
+      return;
+    }
+    if (accounts.revokeInvite(id))
+      send(204);
+    else
+      deny(404, "not_found");
+    return;
+  }
   const hostPairing = /^\/api\/hosts\/([A-Za-z0-9_-]{43})\/pairing$/.exec(pathname);
   if (pathname === "/api/hosts" || hostPairing !== null) {
     const expected = pathname === "/api/hosts" ? "GET" : "POST";
@@ -810,7 +1052,8 @@ async function handleApiRequest(request, response, ctx) {
           url: `${relayWsBase(ctx.publicOrigin)}/c/${row.hostId}`,
           hostKey: row.noisePublicKey,
           secret: result.secret,
-          expiresAt: result.expiresAt
+          expiresAt: result.expiresAt,
+          ...result.endpointSet === undefined ? {} : { endpointSet: result.endpointSet }
         });
         return;
       case "refused":
@@ -828,7 +1071,7 @@ async function handleApiRequest(request, response, ctx) {
     }
     return;
   }
-  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/join-tokens") {
+  if (pathname === "/api/me" || pathname === "/api/logout" || pathname === "/api/sessions/revoke-all" || pathname === "/api/join-tokens" || pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
     const expected = pathname === "/api/me" ? "GET" : "POST";
     if (method !== expected) {
       deny(405, "method_not_allowed", { allow: expected });
@@ -841,7 +1084,31 @@ async function handleApiRequest(request, response, ctx) {
       return;
     }
     if (pathname === "/api/me") {
-      send(200, { user: { username: session.username } });
+      send(200, { user: { username: session.username }, ...session.admin ? { admin: true } : {} });
+      return;
+    }
+    if (pathname === "/api/push-tokens" || pathname === "/api/push-tokens/remove") {
+      const body = await readJson(request);
+      if (!body.ok) {
+        deny(body.tooLarge ? 413 : 400, body.tooLarge ? "payload_too_large" : "invalid_json");
+        return;
+      }
+      const value = body.value;
+      const apns = typeof value?.apns === "string" ? normalizeApnsToken(value.apns) : undefined;
+      const environment = value?.environment;
+      if (apns === undefined || environment !== "production" && environment !== "development") {
+        deny(400, "invalid_request");
+        return;
+      }
+      if (accounts.authenticate(token) === undefined) {
+        deny(401, "unauthenticated");
+        return;
+      }
+      if (pathname === "/api/push-tokens")
+        accounts.registerPushToken(session.userId, apns, environment);
+      else
+        accounts.removePushToken(session.userId, apns, environment);
+      send(204);
       return;
     }
     if (pathname === "/api/join-tokens") {
@@ -984,7 +1251,8 @@ async function startRelay(options) {
         socket.send(encodeRelayFrame({ t: "push-result", requestId: frame.requestId, ...verdict }));
       }
     };
-    if (accounts?.hasHost(hostId) !== true) {
+    const owner = accounts?.hostOwner(hostId);
+    if (accounts === undefined || owner === undefined) {
       finish({ result: "rejected", reason: "unauthorized" });
       return;
     }
@@ -992,6 +1260,10 @@ async function startRelay(options) {
       finish({ result: "unavailable", reason: "environment not configured" });
       return;
     }
+    if (accounts.pushTokenOwner(frame.token, frame.environment) !== owner) {
+      finish({ result: "rejected", reason: "token_not_registered" });
+      return;
+    }
     const perHost = pushInflightHosts.get(hostId) ?? 0;
     if (perHost >= pushPerHost || pushInflightTotal >= pushTotal) {
       finish({ result: "retry", reason: "rate_limited" });
@@ -999,7 +1271,12 @@ async function startRelay(options) {
     }
     pushInflightTotal += 1;
     pushInflightHosts.set(hostId, perHost + 1);
-    apns.send({ token: frame.token, environment: frame.environment, notification: frame.notification }).then(finish, () => finish({ result: "retry", reason: "server error" })).finally(() => {
+    apns.send({ token: frame.token, environment: frame.environment, notification: frame.notification }).then((verdict) => {
+      if (verdict.result === "unregistered") {
+        accounts.forgetPushToken(frame.token, frame.environment, verdict.unregisteredAt);
+      }
+      finish(verdict);
+    }, () => finish({ result: "retry", reason: "server error" })).finally(() => {
       pushInflightTotal -= 1;
       const left = (pushInflightHosts.get(hostId) ?? 1) - 1;
       if (left <= 0)
@@ -1073,7 +1350,12 @@ async function startRelay(options) {
           const request = pairingRequests.get(answer.requestId);
           if (request === undefined || request.control !== socket)
             return;
-          request.settle(answer.t === "pairing" ? { status: "ok", secret: answer.secret, expiresAt: answer.expiresAt } : { status: "refused", reason: answer.reason });
+          request.settle(answer.t === "pairing" ? {
+            status: "ok",
+            secret: answer.secret,
+            expiresAt: answer.expiresAt,
+            ...answer.endpointSet === undefined ? {} : { endpointSet: answer.endpointSet }
+          } : { status: "refused", reason: answer.reason });
           return;
         }
         socket.close(1008, "unexpected frame");

package/dist/{chunk-rtwxjb90.js → chunk-vyvyaavr.js}

@@ -1,6 +1,6 @@
 // apps/host/src/distribution.ts
 import { fileURLToPath } from "node:url";
-var packagedVersion = "0.7.0";
+var packagedVersion = "0.9.0";
 var webRoot = fileURLToPath(new URL(packagedVersion === undefined ? "../../web/dist" : "../web/", import.meta.url));
 var hostEntry = packagedVersion === undefined ? { script: fileURLToPath(new URL("./main.ts", import.meta.url)), args: [] } : { script: fileURLToPath(new URL("./pinomad.js", import.meta.url)), args: ["host"] };
 var commandHint = (name) => packagedVersion === undefined ? `bun run ${name}` : `pinomad ${name}`;

package/dist/{chunk-r6w5aqkw.js → chunk-wb10efyq.js}

@@ -13,7 +13,24 @@ var WEB_TYPES = {
   ".woff2": "font/woff2"
 };
 var NOT_BUILT = "Web client not built: run bun run build";
+var SECURITY_HEADERS = {
+  "content-security-policy": [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    "connect-src 'self' ws: wss:",
+    "object-src 'none'",
+    "base-uri 'self'",
+    "form-action 'self'",
+    "frame-ancestors 'none'"
+  ].join("; "),
+  "x-content-type-options": "nosniff",
+  "referrer-policy": "no-referrer"
+};
 async function serveWebClient(request, response, webRoot) {
+  for (const [name, value] of Object.entries(SECURITY_HEADERS))
+    response.setHeader(name, value);
   if (request.method !== "GET" && request.method !== "HEAD") {
     response.writeHead(405).end();
     return;

package/dist/{chunk-fbkd73zr.js → chunk-yhf7bj5q.js}

@@ -3,37 +3,37 @@ import {
   assertSecureServerOrigin,
   probeServerAccounts,
   runServerOperation
-} from "./chunk-ywmm63ks.js";
+} from "./chunk-3p1eysm9.js";
 import {
   constantValue,
   openHostSettings
-} from "./chunk-b1h374jr.js";
+} from "./chunk-v414b5pp.js";
 import {
   loadHostKey,
   loadRelayKey,
   writeServerConfig
-} from "./chunk-0xh6cy9v.js";
+} from "./chunk-5gp9svzs.js";
 import {
   relayHostId
-} from "./chunk-7qb9tq54.js";
+} from "./chunk-khcpv54k.js";
 import {
   argValue,
   installSpec,
   restartService,
   serviceManager,
   withoutRelayArgs
-} from "./chunk-12kaxggg.js";
+} from "./chunk-76pvsg2d.js";
 import"./chunk-kzbzacz9.js";
 import {
   commandHint,
   hostEntry
-} from "./chunk-rtwxjb90.js";
-import"./chunk-sj7rnvh4.js";
-import"./chunk-e4ahjbmz.js";
+} from "./chunk-vyvyaavr.js";
+import"./chunk-4sepcfpy.js";
+import"./chunk-jgd38rna.js";
 import {
   cleanHostName,
   normalizeHostName
-} from "./chunk-znhn8af7.js";
+} from "./chunk-sygeb9qb.js";
 import {
   DEFAULT_DATA_DIR
 } from "./chunk-ngf1zatm.js";

package/dist/pinomad.js

@@ -5,22 +5,22 @@ import {
 } from "./chunk-kzbzacz9.js";
 import {
   packagedVersion
-} from "./chunk-rtwxjb90.js";
+} from "./chunk-vyvyaavr.js";
 import {
   __require
 } from "./chunk-df32avw6.js";
 
 // apps/cli/src/pinomad.ts
 var COMMANDS = {
-  host: () => import("./chunk-1nyzr0mg.js"),
-  server: () => import("./chunk-6ysezfy5.js"),
-  relay: () => import("./chunk-6ysezfy5.js"),
-  service: () => import("./chunk-1t58fh0k.js"),
-  upgrade: () => import("./chunk-sz3rzk55.js"),
-  link: () => import("./chunk-8yme2wep.js"),
-  pair: () => import("./chunk-m4c5gvce.js"),
-  join: () => import("./chunk-fbkd73zr.js"),
-  leave: () => import("./chunk-07769pqx.js")
+  host: () => import("./chunk-ctzgjctt.js"),
+  server: () => import("./chunk-vxmj0200.js"),
+  relay: () => import("./chunk-vxmj0200.js"),
+  service: () => import("./chunk-m824ds0q.js"),
+  upgrade: () => import("./chunk-qgexy01f.js"),
+  link: () => import("./chunk-014b7ne7.js"),
+  pair: () => import("./chunk-vax4zspw.js"),
+  join: () => import("./chunk-yhf7bj5q.js"),
+  leave: () => import("./chunk-0tesv2sr.js")
 };
 var USAGE = `pinomad — PiNomad host, server, and utilities
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinomad",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "PiNomad — self-hosted coding agent: host, relay, and web client in one package",
   "license": "Apache-2.0",
   "type": "module",
@@ -20,20 +20,24 @@
   },
   "homepage": "https://github.com/bubbleptr/pinomad",
   "dependencies": {
-    "@earendil-works/chord": "1.2.0",
-    "@earendil-works/pi-ai": "1.2.0",
-    "@earendil-works/pi-codemode": "1.2.0",
-    "@earendil-works/pi-coding-agent": "1.2.0",
-    "@earendil-works/pi-durable": "1.2.0",
-    "@earendil-works/pi-mcp": "1.2.0",
+    "@earendil-works/chord": "1.4.0",
+    "@earendil-works/pi-ai": "1.4.0",
+    "@earendil-works/pi-codemode": "1.4.0",
+    "@earendil-works/pi-coding-agent": "1.4.0",
+    "@earendil-works/pi-durable": "1.4.0",
+    "@earendil-works/pi-mcp": "1.4.0",
     "@noble/curves": "2.4.0",
     "diff": "8.0.4",
+    "node-datachannel": "0.33.4",
     "proper-lockfile": "4.1.2",
     "typebox": "1.3.27",
     "undici": "8.10.2",
     "uqr": "0.1.3",
     "ws": "8.22.0",
     "@noble/ciphers": "2.4.0",
-    "@noble/hashes": "2.4.0"
+    "@noble/hashes": "2.4.0",
+    "@earendil-works/pi-agent-core": "1.4.0",
+    "@earendil-works/pi-telemetry": "1.4.0",
+    "@earendil-works/pi-tui": "1.4.0"
   }
 }