replica-bridge 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replica-bridge",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Lets the ChatReplica iPhone app use Codex on this computer through a relay, end-to-end encrypted.",
   "type": "module",
   "bin": {

package/src/bridge/enroll.js

@@ -8,7 +8,7 @@ import { loadState, saveState } from "./state.js";
                                               
 
 /** The project's public relay, which the app also signs in to by default (Sources/Core/RelayPairing.swift). */
-export const PUBLIC_RELAY = "https://agens.office-cli.onl";
+export const PUBLIC_RELAY = "https://agensrelay.office-cli.onl";
 
 /** With no --relay: REPLICA_RELAY, else the relay on this machine over loopback, else the public relay. */
 export function defaultRelayURL()         {

package/src/bridge/service.js

@@ -100,7 +100,14 @@ export class BridgeService {
       try { envelope = JSON.parse(data.toString()); } catch { return; }
       this.onEnvelope(envelope);
     });
-    ws.on("unexpected-response", (_req, res) => this.log(`relay refused the host connection: HTTP ${res.statusCode}`));
+    // Something other than the relay answered (a web page where the relay used to be, a proxy error, a revoked
+    // token). With this listener ws leaves the socket half-open and emits no close, so nothing retried and the
+    // process ran out of work and exited 0, which the background services read as "replaced" and left stopped.
+    // Ending the socket goes through close and the usual backoff instead.
+    ws.on("unexpected-response", (_req, res) => {
+      this.log(`relay refused the host connection: HTTP ${res.statusCode}; retrying`);
+      ws.terminate();
+    });
     ws.on("error", (error) => this.log(`relay connection error: ${error.message}`));
     ws.on("close", (code) => {
       if (ws !== this.relay) return; // a socket this bridge already replaced itself

package/src/relay/config.js

@@ -40,6 +40,8 @@ export function readEnvFile(file        )                         {
                                     
                                    
                              
+                                                                                                                       
+                                                           
  
 
 /** "github:583231, 12345, *" → ["583231", "12345", "*"]; anything that is not a numeric id or * is refused. */
@@ -51,6 +53,30 @@ export function parseAllowedIds(text        )           {
   });
 }
 
+/** "~/repos/minim/deploy/minim.env:MINIM_ALLOW" → { file, name }. */
+export function parseAllowedFrom(text        )                                 {
+  const colon = text.lastIndexOf(":");
+  const file = text.slice(0, colon).trim();
+  const name = text.slice(colon + 1).trim();
+  if (colon < 1 || !file || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) throw new Error(`GITHUB_ALLOWED_USERS_FROM takes <env file>:<VARIABLE>, not "${text}"`);
+  return { file: expandHome(file), name };
+}
+
+/**
+ * The allowed GitHub ids: GITHUB_ALLOWED_USERS plus, when set, the list in GITHUB_ALLOWED_USERS_FROM, read again on
+ * every call so editing that file takes effect without a restart. A missing file or variable throws (nobody gets in).
+ */
+export function allowedIdsReader(config                                                             )                 {
+  const from = config.githubAllowedFrom;
+  if (!from) return () => config.githubAllowedIds;
+  return () => {
+    if (!fs.existsSync(from.file)) throw new Error(`GITHUB_ALLOWED_USERS_FROM: ${from.file} does not exist`);
+    const list = readEnvFile(from.file)[from.name];
+    if (list === undefined) throw new Error(`GITHUB_ALLOWED_USERS_FROM: ${from.file} has no ${from.name}`);
+    return [...new Set([...config.githubAllowedIds, ...parseAllowedIds(list)])];
+  };
+}
+
 const expandHome = (value        ) => (value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value);
 
 export function loadRelayConfig(envPath = defaultEnvPath())              {
@@ -72,5 +98,6 @@ export function loadRelayConfig(envPath = defaultEnvPath())              {
     githubClientSecret: get("GITHUB_CLIENT_SECRET"),
     githubCallbackUrl: get("GITHUB_CALLBACK_URL"),
     githubAllowedIds: parseAllowedIds(get("GITHUB_ALLOWED_USERS") ?? ""),
+    githubAllowedFrom: get("GITHUB_ALLOWED_USERS_FROM") ? parseAllowedFrom(get("GITHUB_ALLOWED_USERS_FROM") ) : null,
   };
 }