serverless-ircd 0.7.0 → 0.9.0

package/apps/cf-tcp-container/tests/config-loader.test.ts

@@ -161,6 +161,49 @@ describe('config-loader — container-specific knobs', () => {
     expect(cfg.server.operCreds).toEqual([{ user: 'admin', password: 'secret' }]);
   });
 
+  it('exercises the OPER_PASSWORD ?? "" default then rejects partial OPER_USER-only creds', () => {
+    // The `?? ''` default for the missing OPER_PASSWORD is exercised, but
+    // parseServerConfig then rejects the empty password — partial oper
+    // creds are a misconfiguration, not a silently-accepted one.
+    expect(() =>
+      loadContainerConfig({
+        SERVER_NAME: 'irc.test',
+        NETWORK_NAME: 'TestNet',
+        OPER_USER: 'admin',
+      }),
+    ).toThrowError(/password/u);
+  });
+
+  it('exercises the OPER_USER ?? "" default then rejects partial OPER_PASSWORD-only creds', () => {
+    expect(() =>
+      loadContainerConfig({
+        SERVER_NAME: 'irc.test',
+        NETWORK_NAME: 'TestNet',
+        OPER_PASSWORD: 'secret',
+      }),
+    ).toThrowError(/user/u);
+  });
+
+  it('treats an overflow-numeric CREATED_AT (Infinity) as a verbatim string', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      // 400 nines overflows Number.MAX_VALUE → Number() yields Infinity,
+      // which is not finite, so parseCreatedAt falls through to the raw string.
+      CREATED_AT: '9'.repeat(400),
+    });
+    expect(cfg.server.createdAt).toBe('9'.repeat(400));
+  });
+
+  it('skips a SASL line whose username is set but password is empty', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      SASL_ACCOUNTS: 'alice:\nbob:valid',
+    });
+    expect(cfg.server.saslAccounts).toEqual([{ username: 'bob', password: 'valid' }]);
+  });
+
   it('skips malformed SASL account lines', () => {
     const cfg = loadContainerConfig({
       SERVER_NAME: 'irc.test',

package/apps/cf-tcp-container/tests/container-server.test.ts

@@ -128,6 +128,58 @@ describe('container-server — lifecycle', () => {
   });
 });
 
+describe('container-server — option wiring (coverage matrix)', () => {
+  // Exercises the `opts.X ?? default` / `opts.X !== undefined ? ... : ...`
+  // branches in startContainerServer by starting the server with each optional
+  // knob set, so every "option provided" branch is taken at least once.
+
+  it('binds the default host when `host` is omitted', async () => {
+    const srv = await startContainerServer({
+      port: 0,
+      serverName: 'irc.defaulthost',
+      networkName: 'DefaultHostNet',
+    });
+    expect(srv.host).toBe('0.0.0.0');
+    // Connecting via 127.0.0.1 still reaches the 0.0.0.0 listener.
+    const c = new TcpClient('127.0.0.1', srv.port);
+    await c.opened();
+    await c.close();
+    await srv.close();
+  });
+
+  it('applies the default admission knobs when only maxConnectionsPerUser is set', async () => {
+    // Setting only maxConnectionsPerUser builds the admission config, so
+    // maxConnectionsPerIp and perIpConnectionRate fall back to their defaults.
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.admission',
+      networkName: 'AdmissionNet',
+      maxConnectionsPerUser: 5,
+    });
+    const c = new TcpClient('127.0.0.1', srv.port);
+    await c.opened();
+    await c.close();
+    await srv.close();
+  });
+
+  it('wires saslAccounts, serverPassword, and cloaking when provided', async () => {
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.options',
+      networkName: 'OptionsNet',
+      serverPassword: 'secret',
+      cloaking: { enabled: true, secret: 'cloak-secret', cloakedSuffix: '.hidden' },
+      saslAccounts: [{ username: 'alice', password: 'pw' }],
+    });
+    const c = new TcpClient('127.0.0.1', srv.port);
+    await c.opened();
+    await c.close();
+    await srv.close();
+  });
+});
+
 describe('container-server — IRC flows over TCP', () => {
   let server: ContainerServer;
 
@@ -329,7 +381,6 @@ describe('container-server — snapshot error resilience', () => {
     const path = join(dir, 'corrupt.json');
     const { writeFile } = await import('node:fs/promises');
     await writeFile(path, '{ this is not valid json', 'utf8');
-
     const srv = await startContainerServer({
       port: 0,
       host: '127.0.0.1',
@@ -373,6 +424,61 @@ describe('container-server — snapshot error resilience', () => {
     expect(c.socket.destroyed).toBe(true);
     await rm(dir, { recursive: true, force: true });
   });
+
+  it('close() skips sockets that are already destroyed', async () => {
+    // Covers closeServer's `!socket.destroyed` false branch: a server-side
+    // socket destroyed in the same tick as close() is still in the sockets
+    // set (its 'close' cleanup is async) but already destroyed.
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.skip',
+      networkName: 'SkipNet',
+    });
+    const c = new TcpClient('127.0.0.1', srv.port);
+    await c.opened();
+    for (let i = 0; i < 50 && srv.testSockets.size === 0; i++) {
+      await new Promise((r) => setTimeout(r, 5));
+    }
+    const serverSideSocket = [...srv.testSockets][0];
+    if (serverSideSocket === undefined) throw new Error('no server-side socket');
+    // Destroy the server-side socket synchronously; its 'close' handler
+    // (which would remove it from the set) fires on a later tick.
+    serverSideSocket.destroy();
+    await expect(srv.close()).resolves.toBeUndefined();
+    await new Promise<void>((resolve) => c.socket.once('close', () => resolve()));
+  });
+
+  it('logs and resolves when the final snapshot save fails on close', async () => {
+    // Pointing persistencePath at an existing directory makes the boot-time
+    // load fail (EISDIR → caught → start fresh) AND the close-time save fail
+    // (writeFile on a directory → EISDIR → caught at the closeServer catch).
+    const dir = await mkdtemp(join(tmpdir(), 'sirc-finalfail-'));
+    const { mkdir } = await import('node:fs/promises');
+    const dirPath = join(dir, 'snap-target-dir');
+    await mkdir(dirPath);
+
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.finalfail',
+      networkName: 'FinalFailNet',
+      persistencePath: dirPath,
+      snapshotIntervalMs: 999_999,
+    });
+    const c = new TcpClient('127.0.0.1', srv.port);
+    await c.opened();
+    await c.send('NICK finalFail');
+    await c.send('USER finalFail 0 * :FinalFail');
+    await c.waitFor((l) => l.startsWith(':irc.finalfail 001 '), 2000);
+    // The server destroys live sockets on close; capture the close event first.
+    const closed = new Promise<void>((resolve) => c.socket.once('close', () => resolve()));
+    // close() must resolve (not reject) even though the final snapshot write
+    // throws — the error is logged and swallowed.
+    await expect(srv.close()).resolves.toBeUndefined();
+    await closed;
+    await rm(dir, { recursive: true, force: true });
+  });
 });
 
 describe('container-server — error paths', () => {
@@ -407,6 +513,95 @@ describe('container-server — error paths', () => {
     await srv.close();
   });
 
+  it('logs a non-Error rejection from the actor without crashing', async () => {
+    // logError's `err instanceof Error ? {...} : err` false branch is only
+    // reached when the caught value is NOT an Error instance.
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.nonerr',
+      networkName: 'NonErrNet',
+    });
+    const original = srv.runtime.send.bind(srv.runtime);
+    srv.runtime.send = async () => {
+      // eslint-disable-next-line no-throw-literal
+      throw { code: 'SYNTHETIC', detail: 'not an Error' };
+    };
+    const client = new TcpClient('127.0.0.1', srv.port);
+    await client.opened();
+    await client.send('NICK nonErrUser');
+    await client.send('USER nonErrUser 0 * :NonErr');
+    await client.send('PING :will-throw-non-error');
+    await new Promise((r) => setTimeout(r, 100));
+
+    srv.runtime.send = original;
+    const next = new TcpClient('127.0.0.1', srv.port);
+    await next.opened();
+    await next.send('NICK recover2');
+    await next.send('USER recover2 0 * :Recover2');
+    await next.waitFor((l) => l.startsWith(':irc.nonerr 001 '), 3000);
+    await next.close();
+    await client.close();
+    await srv.close();
+  });
+
+  it('disconnects a connection without an ERROR notice when no reason is supplied', async () => {
+    // Covers the disconnect callback's `reason === undefined` branch: no
+    // `ERROR :Closing link` line is sent, the transport is just closed.
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.noreason',
+      networkName: 'NoReasonNet',
+    });
+    const client = new TcpClient('127.0.0.1', srv.port);
+    await client.opened();
+    await client.send('NICK noReason');
+    await client.send('USER noReason 0 * :NoReason');
+    await client.waitFor((l) => l.startsWith(':irc.noreason 001 '), 2000);
+
+    const connId = await srv.runtime.lookupNick('noReason');
+    expect(connId).not.toBeNull();
+    const closed = new Promise<void>((resolve) => client.socket.once('close', () => resolve()));
+    await srv.runtime.disconnect(connId as string);
+    await closed;
+    // The client must NOT have received an `ERROR :Closing link` line.
+    expect(client.received.some((l) => l.startsWith('ERROR :Closing link:'))).toBe(false);
+    await srv.close();
+  });
+
+  it('skips writing when the server-side socket is no longer writable', async () => {
+    // Covers the sendText callback's `socket.writable` else branch: after the
+    // server-side socket is destroyed (writable=false) but before its 'close'
+    // handler removes the connection, a runtime send must skip the write.
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.unwritable',
+      networkName: 'UnwritableNet',
+    });
+    const client = new TcpClient('127.0.0.1', srv.port);
+    await client.opened();
+    await client.send('NICK unwritable');
+    await client.send('USER unwritable 0 * :Unwritable');
+    await client.waitFor((l) => l.startsWith(':irc.unwritable 001 '), 2000);
+    for (let i = 0; i < 50 && srv.testSockets.size === 0; i++) {
+      await new Promise((r) => setTimeout(r, 5));
+    }
+    const serverSideSocket = [...srv.testSockets][0];
+    if (serverSideSocket === undefined) throw new Error('no server-side socket');
+    const connId = (await srv.runtime.lookupNick('unwritable')) as string;
+    // Destroy the server-side socket: writable flips false synchronously,
+    // while the 'close' cleanup (which unregisters the connection) is queued.
+    serverSideSocket.destroy();
+    // The send resolves without writing because socket.writable is false.
+    await expect(
+      srv.runtime.send(connId, [{ text: ':irc.unwritable NOTICE unwritable :dropped' }]),
+    ).resolves.toBeUndefined();
+    await srv.close();
+    await new Promise<void>((resolve) => client.socket.once('close', () => resolve()));
+  });
+
   it('logs and recovers from a per-socket error', async () => {
     const srv = await startContainerServer({
       port: 0,
@@ -463,3 +658,56 @@ describe('container-server — error paths', () => {
     await rm(dir, { recursive: true, force: true });
   });
 });
+
+describe('container-server — draft/multiline BATCH to a nick target', () => {
+  // Driving a nick-target multi-line batch exercises the `batchId` and
+  // `nonce` id-factory seams in DEFAULT_ID_FACTORY (container-server lines
+  // 96/98), which are only invoked by closeMultilineBatchToNick.
+
+  /** Negotiates `batch` + `draft/multiline`, then registers the nick. */
+  async function registerMultilineCapable(srv: ContainerServer, nick: string): Promise<TcpClient> {
+    const c = new TcpClient('127.0.0.1', srv.port);
+    await c.opened();
+    await c.send('CAP LS 302');
+    await c.waitFor((l) => l.startsWith(':irc.ml CAP * LS :'), 2000);
+    await c.send('CAP REQ :batch draft/multiline');
+    await c.waitFor((l) => l.includes('CAP') && l.includes('ACK'), 2000);
+    await c.send('CAP END');
+    await c.send(`NICK ${nick}`);
+    await c.send(`USER ${nick} 0 * :${nick}`);
+    await c.waitFor((l) => l.startsWith(':irc.ml 001 '), 2000);
+    return c;
+  }
+
+  it('delivers a finalized nick-target batch and exercises batchId/nonce', async () => {
+    const srv = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.ml',
+      networkName: 'MLNet',
+    });
+    const alice = await registerMultilineCapable(srv, 'alice');
+    const bob = await registerMultilineCapable(srv, 'bob');
+
+    await alice.send('BATCH +m1 draft/multiline :bob');
+    await alice.send('PRIVMSG bob :line one');
+    await alice.send('PRIVMSG bob :line two');
+    await alice.send('BATCH -m1');
+
+    // Bob (also batch+draft/multiline capable) receives the replayed BATCH.
+    // The server allocates a fresh UUID batch id via the batchId() seam.
+    const open = await bob.waitFor(
+      (l) => /^BATCH \+[0-9a-f-]{36} draft\/multiline bob$/u.test(l),
+      3000,
+    );
+    const batchId = open?.match(/^BATCH \+([0-9a-f-]{36})/u)?.[1];
+    expect(batchId).toBeDefined();
+    await bob.waitFor((l) => l.includes(':alice!') && l.includes('PRIVMSG bob :line one'), 2000);
+    await bob.waitFor((l) => l.includes(':alice!') && l.includes('PRIVMSG bob :line two'), 2000);
+    await bob.waitFor((l) => l === `BATCH -${batchId}`, 2000);
+
+    await alice.close();
+    await bob.close();
+    await srv.close();
+  });
+});

package/apps/cf-tcp-container/tests/persistence.test.ts

@@ -143,6 +143,15 @@ describe('persistence — saveSnapshot / loadSnapshot file I/O', () => {
     expect(loaded).toBeNull();
   });
 
+  it('re-throws non-ENOENT read errors (e.g. EISDIR when the path is a directory)', async () => {
+    // Reading a directory produces EISDIR, which is NOT ENOENT, so
+    // loadSnapshot must propagate it instead of treating it as first-boot.
+    const { mkdir } = await import('node:fs/promises');
+    const subDir = join(dir, 'not-a-file-dir');
+    await mkdir(subDir);
+    await expect(loadSnapshot(subDir)).rejects.toThrow();
+  });
+
   it('overwrites a previous snapshot on re-save', async () => {
     const path = join(dir, 'overwrite.json');
     const rt1 = new InMemoryRuntime({ clock: { now: () => 0 } });

package/apps/cf-tcp-container/tests/tls-e2e.test.ts

@@ -1,4 +1,4 @@
-import { execFileSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { EventEmitter } from 'node:events';
 import { mkdtemp, readFile, rm } from 'node:fs/promises';
 import { type Socket, createConnection } from 'node:net';
@@ -10,9 +10,21 @@ import {
   connect as tlsConnect,
   createServer as tlsCreateServer,
 } from 'node:tls';
+import { promisify } from 'node:util';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
 import { type ContainerServer, startContainerServer } from '../src/container-server.js';
 
+const execFileAsync = promisify(execFile);
+
+/**
+ * Maximum wall-clock budget for a single `openssl` invocation. RSA-2048
+ * keygen finishes in well under a second on any modern CPU; if it hasn't
+ * returned by this point the binary is wedged (or the runner is so starved
+ * that the TLS e2e would be flaky anyway), so we skip the suite instead of
+ * stalling the test process.
+ */
+const OPENSSL_TIMEOUT_MS = 15_000;
+
 /**
  * Generates a self-signed TLS certificate for the test proxy using the
  * system `openssl` binary. This mirrors what Cloudflare Spectrum does in
@@ -26,7 +38,12 @@ async function generateSelfSignedCert(dir: string): Promise<{ key: string; cert:
   const keyPath = join(dir, 'key.pem');
   const certPath = join(dir, 'cert.pem');
   try {
-    execFileSync(
+    // Bound openssl: the previous `execFileSync` blocked the event loop,
+    // which defeated vitest's hook timer and let a stuck/missing binary
+    // hang the whole suite. The async call + `timeout` fails fast and
+    // yields control back to the runner; beforeAll swallows the throw and
+    // skips the suite (each test also guards on `cert === undefined`).
+    await execFileAsync(
       'openssl',
       [
         'req',
@@ -43,10 +60,12 @@ async function generateSelfSignedCert(dir: string): Promise<{ key: string; cert:
         '-subj',
         '/CN=localhost',
       ],
-      { stdio: 'pipe' },
+      { timeout: OPENSSL_TIMEOUT_MS },
     );
   } catch {
-    throw new Error('openssl not available — required to generate test TLS cert');
+    throw new Error(
+      `openssl unavailable or did not finish within ${OPENSSL_TIMEOUT_MS}ms — required to generate test TLS cert`,
+    );
   }
   const key = await readFile(keyPath, 'utf8');
   const cert = await readFile(certPath, 'utf8');
@@ -205,7 +224,7 @@ describe('container-server — TLS e2e via in-process proxy (Spectrum analogue)'
       originHost: '127.0.0.1',
       originPort: origin.port,
     });
-  });
+  }, 30_000);
 
   afterAll(async () => {
     if (proxy !== undefined) await proxy.close();

package/apps/cf-worker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-worker",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "private": true,
   "description": "Cloudflare Worker deploy glue: WebSocket edge entry point + DO bindings + wrangler pipeline",
   "license": "BSD-3-Clause",

package/apps/cf-worker/src/worker.ts

@@ -18,7 +18,7 @@
  *     catch-all response, now scoped to an explicit path so the root URL
  *     is free for the landing page).
  *   • everything else — falls through to the `[assets]` binding, which
- *     serves the Kiwi SPA at `/app/` and the landing page at `/` from
+ *     serves the Kiwi SPA at `/webclient/` and the landing page at `/` from
  *     `apps/web/dist`. The asset layer is configured in `wrangler.toml`.
  *
  * The DO classes are re-exported so `wrangler.toml`'s
@@ -47,8 +47,8 @@ export type { Env };
 /**
  * Production {@link Env} for the worker entry. Extends the cf-adapter
  * {@link Env} with the `ASSETS` binding (the static-asset `Fetcher` for
- * `/app/` SPA + `/` landing page). The cf-adapter's internal types stay
- * asset-agnostic; only the edge entry knows about the asset layer.
+ * `/webclient/` SPA + `/` landing page). The cf-adapter's internal types
+ * stay asset-agnostic; only the edge entry knows about the asset layer.
  */
 export interface WorkerEnv extends Env {
   /**
@@ -106,7 +106,7 @@ const ORIGIN_UNCONFIGURED_BODY =
  *   1. WebSocket upgrade → CSWSH `Origin` check, then per-connection
  *      `ConnectionDO`.
  *   2. `GET /health` → plaintext liveness response.
- *   3. everything else → `env.ASSETS` (Kiwi SPA at `/app/`, landing at `/`).
+ *   3. everything else → `env.ASSETS` (Kiwi SPA at `/webclient/`, landing at `/`).
  *
  * The connection id is allocated here via `crypto.randomUUID()` (the
  * Web Crypto API is sync-available in Workers for RFC-4122 v4 UUIDs).

package/apps/cf-worker/tests/fixtures/web-dist/webclient/index.html

@@ -0,0 +1,18 @@
+<!doctype html>
+<!--
+  Test-only fixture mirroring the real `apps/web/dist/webclient/index.html`
+  produced by the Kiwi SPA build (`pnpm --filter web build`). The cf-worker
+  smoke suite points its `[assets]` binding here so the worker's fall-through
+  routing (WS → ConnectionDO, /health → plaintext, else → ASSETS) is exercised
+  without depending on the (slow, submodule-heavy) Kiwi build. Production
+  points at `apps/web/dist`; this fixture only stands in for the test run.
+-->
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>KiwiIRC</title>
+  </head>
+  <body>
+    <div id="app"></div>
+  </body>
+</html>

package/apps/cf-worker/tests/smoke.test.ts

@@ -32,9 +32,9 @@ declare global {
       MOTD_LINES: string;
       // Static-assets binding (`[assets]` in `wrangler.test.toml`, pointed at
       // `tests/fixtures/web-dist`). Production points at `apps/web/dist`; the
-      // fixture mirrors the `app/index.html` + `index.html` layout so the
-      // worker's fall-through routing is exercised without depending on the
-      // Kiwi SPA build.
+      // fixture mirrors the `webclient/index.html` + `index.html` layout so
+      // the worker's fall-through routing is exercised without depending on
+      // the Kiwi SPA build.
       ASSETS: Fetcher;
     }
   }
@@ -61,8 +61,8 @@ describe('cf-worker deploy glue', () => {
     expect(body.toLowerCase()).toContain('serverlessircd');
   });
 
-  it('GET /app/ serves the SPA index from the [assets] binding', async () => {
-    const response = await worker.fetch(new Request('https://irc.example.com/app/'), env);
+  it('GET /webclient/ serves the SPA index from the [assets] binding', async () => {
+    const response = await worker.fetch(new Request('https://irc.example.com/webclient/'), env);
     expect(response.status).toBe(200);
     const body = await response.text();
     // The fixture SPA HTML carries this marker so the test asserts the

package/apps/cf-worker/wrangler.test.toml

@@ -14,15 +14,15 @@ compatibility_flags = ["nodejs_compat"]
 # Static-assets binding. Production points at `../../apps/web/dist` (the Kiwi
 # SPA + landing page built by `apps/web`); the test config points at a fixture
 # so the smoke suite does not depend on the (slow) Kiwi upstream build. The
-# fixture mirrors the `app/index.html` + `index.html` layout; the worker's
-# fall-through routing (`/health` → plaintext, else → ASSETS) is what's under
-# test, not the SPA contents.
+# fixture mirrors the `webclient/index.html` + `index.html` layout; the
+# worker's fall-through routing (`/health` → plaintext, else → ASSETS) is
+# what's under test, not the SPA contents.
 [assets]
 directory = "./tests/fixtures/web-dist"
 binding = "ASSETS"
-# `none` returns 404 for unmatched paths — the SPA lives at `/app/` and the
-# landing page at `/`, both with real `index.html` files, so no SPA fallback
-# is required.
+# `none` returns 404 for unmatched paths — the SPA lives at `/webclient/` and
+# the landing page at `/`, both with real `index.html` files, so no SPA
+# fallback is required.
 not_found_handling = "none"
 # Mirror production: route every request through the Worker first so WS
 # upgrades at `/` aren't intercepted by the asset platform (which would

package/apps/cf-worker/wrangler.toml

@@ -72,8 +72,9 @@ This is a deployed Cloudflare Worker.
 ## The `[assets]` binding serves `apps/web/dist` (built by `pnpm --filter web
 ## build`). The non-WS, non-`/health` branch of `worker.ts`'s `fetch` falls
 ## through to this binding, so:
-##   • `/app/`              → the Kiwi IRC SPA (`dist/app/index.html` + its
-##                            hashed assets under `/app/assets/...`).
+##   • `/webclient/`          → the Kiwi IRC SPA (`dist/webclient/index.html`
+##                            + its hashed assets under
+##                            `/webclient/assets/...`).
 ##   • `/`                  → the landing page (`dist/index.html`, shipped by
 ##                            the `apps/web` build).
 ##   • `/health`            → plaintext liveness (handled by the worker, not
@@ -86,9 +87,10 @@ This is a deployed Cloudflare Worker.
 directory = "../../apps/web/dist"
 ## Expose the asset `Fetcher` on `env.ASSETS` (see `WorkerEnv` in `worker.ts`).
 binding = "ASSETS"
-## Return 404 for unmatched paths. The SPA lives at `/app/` and the landing
-## page at `/`; both are concrete `index.html` files, so no SPA fallback is
-## required. Kiwi uses query/hash-based client routing, not path routing.
+## Return 404 for unmatched paths. The SPA lives at `/webclient/` and the
+## landing page at `/`; both are concrete `index.html` files, so no SPA
+## fallback is required. Kiwi uses query/hash-based client routing, not path
+## routing.
 not_found_handling = "none"
 ## Route EVERY request through the Worker before the asset platform serves a
 ## matching static file. Without this, the default (`run_worker_first = false`)

package/apps/local-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/local-cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "private": true,
   "description": "Runnable WebSocket IRC server using the in-memory runtime; manual-test harness and e2e fixture target",
   "license": "BSD-3-Clause",

package/apps/local-cli/src/config-loader.ts

@@ -35,6 +35,14 @@ export interface CliConfigInput {
   channelPrefixes?: string;
   maxClients?: number;
   operCreds?: Array<{ user: string; password: string }>;
+  /**
+   * Server-password gate. Treat as a secret; the loader threads it
+   * straight through (via `stripUndefined`) to `ServerConfig.serverPassword`
+   * so the registration reducer requires `PASS <value>` (or a SASL-
+   * identified connection) before `001 RPL_WELCOME`. Undefined disables
+   * the gate.
+   */
+  serverPassword?: string | undefined;
   maxChannelsPerUser?: number;
   maxTargetsPerCommand?: number;
   maxListEntries?: number;

package/apps/local-cli/src/main.ts

@@ -35,6 +35,12 @@ interface CliArgs {
   serverName: string;
   /** Network name advertised in 005 NETWORK=... */
   networkName: string;
+  /**
+   * Server-password gate. Undefined disables the gate; when set every
+   * connection must supply the matching `PASS <value>` (or SASL-identify)
+   * before `001 RPL_WELCOME`.
+   */
+  serverPassword: string | undefined;
 }
 
 const DEFAULT_PORT = 6667;
@@ -49,6 +55,7 @@ function parseArgs(argv: string[]): CliArgs {
     motdFile: undefined,
     serverName: DEFAULT_SERVER_NAME,
     networkName: DEFAULT_NETWORK_NAME,
+    serverPassword: undefined,
   };
   let tcpDisabled = false;
   let tcpPortOverride: number | undefined;
@@ -73,6 +80,9 @@ function parseArgs(argv: string[]): CliArgs {
     } else if (a === '--network-name' && next !== undefined) {
       out.networkName = next;
       i++;
+    } else if (a === '--server-password' && next !== undefined) {
+      out.serverPassword = next;
+      i++;
     } else if (a === '--no-tcp') {
       tcpDisabled = true;
     } else if (a === '--help' || a === '-h') {
@@ -92,6 +102,11 @@ function parseArgs(argv: string[]): CliArgs {
           '                     Optional; defaults to irc.localhost for the local CLI.',
           '  --network-name <n> Network name in 005 NETWORK=...',
           '                     Optional; defaults to LocalNet.',
+          '  --server-password <p>',
+          '                     Server-password gate (optional). When set, every',
+          '                     connection must supply the matching PASS <p> (or',
+          '                     SASL-identify) before 001 RPL_WELCOME. Treat as a',
+          '                     secret; do not log it.',
           '  -h, --help         Show this help and exit.',
           '',
         ].join('\n'),
@@ -119,6 +134,7 @@ async function main(): Promise<void> {
     tcpPort: args.tcpPort,
     serverName: args.serverName,
     networkName: args.networkName,
+    ...(args.serverPassword !== undefined ? { serverPassword: args.serverPassword } : {}),
     ...(motdLines !== undefined ? { motdLines } : {}),
   });