sparkecoder 0.1.118 → 0.1.119

package/dist/cli.js

@@ -1160,7 +1160,7 @@ function loadConfig(configPath, workingDirectory) {
     ...config,
     server: {
       port: config.server.port,
-      host: config.server.host ?? "127.0.0.1",
+      host: config.server.host ?? "0.0.0.0",
       publicUrl: config.server.publicUrl
     },
     resolvedWorkingDirectory,
@@ -1327,7 +1327,7 @@ function createDefaultConfig() {
     },
     server: {
       port: 3141,
-      host: "127.0.0.1"
+      host: "0.0.0.0"
     },
     databasePath: "./sparkecoder.db"
   };
@@ -8548,6 +8548,44 @@ function getSlackSigningSecret() {
 function getDefaultOrchestratorName() {
   return readSlackConfig()?.defaultOrchestratorName ?? null;
 }
+function getCachedSlackSelfIdentity() {
+  const cfg = readSlackConfig();
+  if (!cfg) return null;
+  if (cachedSelf && cachedSelf.token === cfg.botToken) return cachedSelf.identity;
+  return null;
+}
+async function ensureSlackSelfIdentity() {
+  const cfg = readSlackConfig();
+  if (!cfg) return null;
+  if (cachedSelf && cachedSelf.token === cfg.botToken) return cachedSelf.identity;
+  if (selfInflight) return selfInflight;
+  selfInflight = (async () => {
+    try {
+      const res = await fetch("https://slack.com/api/auth.test", {
+        method: "POST",
+        headers: { Authorization: `Bearer ${cfg.botToken}` }
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!data?.ok) {
+        console.warn(`[slack] auth.test failed: ${data?.error || `HTTP ${res.status}`}`);
+        return null;
+      }
+      const identity = {
+        botUserId: String(data.user_id || ""),
+        botId: String(data.bot_id || ""),
+        teamId: data.team_id ? String(data.team_id) : void 0
+      };
+      cachedSelf = { token: cfg.botToken, identity };
+      return identity;
+    } catch (err) {
+      console.warn("[slack] auth.test error:", err?.message || err);
+      return null;
+    } finally {
+      selfInflight = null;
+    }
+  })();
+  return selfInflight;
+}
 function getSlackAllowlistPolicy() {
   try {
     const cfg = getConfig();
@@ -8573,11 +8611,13 @@ function getSlackDeniedReplyPolicy() {
     return { enabled: true, template: DEFAULT_DENIED_TEMPLATE };
   }
 }
-var DEFAULT_DENIED_TEMPLATE;
+var cachedSelf, selfInflight, DEFAULT_DENIED_TEMPLATE;
 var init_client3 = __esm({
   "src/integrations/slack/client.ts"() {
     "use strict";
     init_config();
+    cachedSelf = null;
+    selfInflight = null;
     DEFAULT_DENIED_TEMPLATE = "Sorry, you don't have permission to use this bot. (Contact the bot owner if you think this is a mistake.)";
   }
 });
@@ -8595,9 +8635,19 @@ function isThreadOwned(channel, threadTs) {
 function stripMention(text) {
   return String(text || "").replace(/<@[^>]+>/g, "").trim();
 }
-function slackEventToInboundResult(event) {
+function isSelfAuthored(event, self) {
+  if (!self) return true;
+  if (self.botId && event.bot_id && event.bot_id === self.botId) return true;
+  if (self.botUserId && event.user && event.user === self.botUserId) return true;
+  return false;
+}
+function slackEventToInboundResult(event, opts = {}) {
   if (!event) return { event: null, dropReason: "empty_text" };
-  if (event.bot_id) return { event: null, dropReason: "bot_message" };
+  const self = opts.self ?? getCachedSlackSelfIdentity();
+  const isBotAuthored = !!event.bot_id || event.type === "message" && event.subtype === "bot_message";
+  if (isBotAuthored && isSelfAuthored(event, self)) {
+    return { event: null, dropReason: "bot_message" };
+  }
   if (event.type === "message" && event.subtype && IGNORED_MESSAGE_SUBTYPES.has(event.subtype)) {
     return { event: null, dropReason: "bot_message" };
   }
@@ -8674,7 +8724,6 @@ var init_slack = __esm({
       }
     };
     IGNORED_MESSAGE_SUBTYPES = /* @__PURE__ */ new Set([
-      "bot_message",
       "message_changed",
       "message_deleted",
       "channel_join",
@@ -14626,7 +14675,8 @@ slack.post("/events", async (c) => {
       updateEvent(auditId, { status: "dropped", dropReason: "duplicate_delivery" });
       return c.json({ ok: true });
     }
-    const { event: inbound, dropReason } = slackEventToInboundResult(ev);
+    const self = await ensureSlackSelfIdentity();
+    const { event: inbound, dropReason } = slackEventToInboundResult(ev, { self });
     if (inbound) {
       const isThreadReply = ev.type === "message" && ev.channel_type !== "im" && typeof ev.thread_ts === "string" && ev.thread_ts !== ev.ts;
       if (isThreadReply) {
@@ -15696,13 +15746,15 @@ async function startServer(options = {}) {
     if (!options.quiet) console.warn(`[scheduler] start skipped: ${err.message}`);
   }
   const port = options.port || config.server.port;
-  const host = options.host || config.server.host || "0.0.0.0";
+  const envHost = process.env.SPARKECODER_API_HOST || process.env.SPARKECODER_HOST;
+  const host = envHost || options.host || config.server.host || "0.0.0.0";
+  const hostSource = envHost ? process.env.SPARKECODER_API_HOST ? "env SPARKECODER_API_HOST" : "env SPARKECODER_HOST" : options.host ? "--host flag" : config.server.host ? "config.server.host" : "default";
   const publicUrl = options.publicUrl || config.server.publicUrl;
   const app = await createApp({ quiet: options.quiet });
   if (!options.quiet) {
     console.log(`
 \u{1F680} SparkECoder API Server`);
-    console.log(`   \u2192 Running at http://${host}:${port}`);
+    console.log(`   \u2192 Binding to ${host}:${port} (source: ${hostSource})`);
     if (publicUrl) {
       console.log(`   \u2192 Public URL: ${publicUrl}`);
     }
@@ -15711,10 +15763,22 @@ async function startServer(options = {}) {
     console.log(`   \u2192 OpenAPI spec: http://${host}:${port}/openapi.json
 `);
   }
+  if (host === "127.0.0.1" || host === "localhost") {
+    console.log(`[sparkecoder] \u26A0 API bound to ${host} only \u2014 not reachable from outside the machine.`);
+    console.log(`[sparkecoder]   For tunnels/reverse proxies (Modal/Fly/Docker), set --host 0.0.0.0 or SPARKECODER_API_HOST=0.0.0.0.`);
+  }
   serverInstance = serve({
     fetch: app.fetch,
     port,
     hostname: host
+  }, (info) => {
+    const actual = `${info.address}:${info.port}`;
+    const requested = `${host}:${port}`;
+    if (info.address === "127.0.0.1" && host !== "127.0.0.1" && host !== "localhost") {
+      console.warn(`[sparkecoder] \u2717 API listener bound to ${actual} but ${requested} was requested. External requests will be refused.`);
+    } else {
+      console.log(`[sparkecoder] \u2713 API listening on ${actual}`);
+    }
   });
   let webPort;
   let webStarted;
@@ -16782,7 +16846,7 @@ var program = new Command();
 program.name("sparkecoder").description("AI coding agent - just type sparkecoder to start chatting").version(getCliVersion()).option("-s, --session <id>", "Resume an existing session").option("-n, --name <name>", "Name for the new session").option("-m, --model <model>", "Model to use").option("-w, --working-dir <path>", "Working directory").option("-c, --config <path>", "Path to config file").option("-p, --port <port>", "Server port", "3141").option("-H, --host <host>", "Server host", "127.0.0.1").option("--no-auto-start", "Do not auto-start server if not running").option("--web-port <port>", "Web UI port", "6969").option("--no-web", "Do not start web UI when auto-starting server").option("--public-url <url>", "Public URL for web UI to connect to API (for Docker/remote access)").option("-v, --verbose", "Enable verbose logging for web server").option("--dangerously-skip-approvals", "Auto-approve all tool calls (no confirmation prompts)").action(async (options) => {
   await runChat(options);
 });
-program.command("server").description("Start the SparkECoder server (API + Web UI)").option("-p, --port <port>", "API server port", "3141").option("-h, --host <host>", "Server host", "127.0.0.1").option("-c, --config <path>", "Path to config file").option("-w, --working-dir <path>", "Working directory").option("--web-port <port>", "Web UI port", "6969").option("--no-web", "Do not start web UI").option("--public-url <url>", "Public URL for web UI to connect to API (for Docker/remote access)").option("-v, --verbose", "Enable verbose logging for web server").option("--setup-secret <secret>", "Setup secret (or short-lived JWT) used for /auth/register and /tunnels when the remote server has SETUP_SECRET configured. Equivalent to setting SPARKECODER_SETUP_SECRET env.").action(async (options) => {
+program.command("server").description("Start the SparkECoder server (API + Web UI)").option("-p, --port <port>", "API server port", "3141").option("-h, --host <host>", "Server bind address (use 127.0.0.1 to restrict to loopback). Overridable via SPARKECODER_API_HOST / SPARKECODER_HOST env.", "0.0.0.0").option("-c, --config <path>", "Path to config file").option("-w, --working-dir <path>", "Working directory").option("--web-port <port>", "Web UI port", "6969").option("--no-web", "Do not start web UI").option("--public-url <url>", "Public URL for web UI to connect to API (for Docker/remote access)").option("-v, --verbose", "Enable verbose logging for web server").option("--setup-secret <secret>", "Setup secret (or short-lived JWT) used for /auth/register and /tunnels when the remote server has SETUP_SECRET configured. Equivalent to setting SPARKECODER_SETUP_SECRET env.").action(async (options) => {
   if (options.setupSecret) {
     process.env.SPARKECODER_SETUP_SECRET = options.setupSecret;
     if (!process.env.SPARKECODER_TUNNEL_SECRET) {