sparkecoder 0.1.118 → 0.1.119

package/dist/index.js

@@ -646,7 +646,7 @@ function loadConfig(configPath, workingDirectory) {
     ...config,
     server: {
       port: config.server.port,
-      host: config.server.host ?? "127.0.0.1",
+      host: config.server.host ?? "0.0.0.0",
       publicUrl: config.server.publicUrl
     },
     resolvedWorkingDirectory,
@@ -813,7 +813,7 @@ function createDefaultConfig() {
     },
     server: {
       port: 3141,
-      host: "127.0.0.1"
+      host: "0.0.0.0"
     },
     databasePath: "./sparkecoder.db"
   };
@@ -7822,6 +7822,44 @@ function getSlackSigningSecret() {
 function getDefaultOrchestratorName() {
   return readSlackConfig()?.defaultOrchestratorName ?? null;
 }
+function getCachedSlackSelfIdentity() {
+  const cfg = readSlackConfig();
+  if (!cfg) return null;
+  if (cachedSelf && cachedSelf.token === cfg.botToken) return cachedSelf.identity;
+  return null;
+}
+async function ensureSlackSelfIdentity() {
+  const cfg = readSlackConfig();
+  if (!cfg) return null;
+  if (cachedSelf && cachedSelf.token === cfg.botToken) return cachedSelf.identity;
+  if (selfInflight) return selfInflight;
+  selfInflight = (async () => {
+    try {
+      const res = await fetch("https://slack.com/api/auth.test", {
+        method: "POST",
+        headers: { Authorization: `Bearer ${cfg.botToken}` }
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!data?.ok) {
+        console.warn(`[slack] auth.test failed: ${data?.error || `HTTP ${res.status}`}`);
+        return null;
+      }
+      const identity = {
+        botUserId: String(data.user_id || ""),
+        botId: String(data.bot_id || ""),
+        teamId: data.team_id ? String(data.team_id) : void 0
+      };
+      cachedSelf = { token: cfg.botToken, identity };
+      return identity;
+    } catch (err) {
+      console.warn("[slack] auth.test error:", err?.message || err);
+      return null;
+    } finally {
+      selfInflight = null;
+    }
+  })();
+  return selfInflight;
+}
 function getSlackAllowlistPolicy() {
   try {
     const cfg = getConfig();
@@ -7847,11 +7885,13 @@ function getSlackDeniedReplyPolicy() {
     return { enabled: true, template: DEFAULT_DENIED_TEMPLATE };
   }
 }
-var DEFAULT_DENIED_TEMPLATE;
+var cachedSelf, selfInflight, DEFAULT_DENIED_TEMPLATE;
 var init_client3 = __esm({
   "src/integrations/slack/client.ts"() {
     "use strict";
     init_config();
+    cachedSelf = null;
+    selfInflight = null;
     DEFAULT_DENIED_TEMPLATE = "Sorry, you don't have permission to use this bot. (Contact the bot owner if you think this is a mistake.)";
   }
 });
@@ -7869,9 +7909,19 @@ function isThreadOwned(channel, threadTs) {
 function stripMention(text) {
   return String(text || "").replace(/<@[^>]+>/g, "").trim();
 }
-function slackEventToInboundResult(event) {
+function isSelfAuthored(event, self) {
+  if (!self) return true;
+  if (self.botId && event.bot_id && event.bot_id === self.botId) return true;
+  if (self.botUserId && event.user && event.user === self.botUserId) return true;
+  return false;
+}
+function slackEventToInboundResult(event, opts = {}) {
   if (!event) return { event: null, dropReason: "empty_text" };
-  if (event.bot_id) return { event: null, dropReason: "bot_message" };
+  const self = opts.self ?? getCachedSlackSelfIdentity();
+  const isBotAuthored = !!event.bot_id || event.type === "message" && event.subtype === "bot_message";
+  if (isBotAuthored && isSelfAuthored(event, self)) {
+    return { event: null, dropReason: "bot_message" };
+  }
   if (event.type === "message" && event.subtype && IGNORED_MESSAGE_SUBTYPES.has(event.subtype)) {
     return { event: null, dropReason: "bot_message" };
   }
@@ -7948,7 +7998,6 @@ var init_slack = __esm({
       }
     };
     IGNORED_MESSAGE_SUBTYPES = /* @__PURE__ */ new Set([
-      "bot_message",
       "message_changed",
       "message_deleted",
       "channel_join",
@@ -13675,7 +13724,8 @@ slack.post("/events", async (c) => {
       updateEvent(auditId, { status: "dropped", dropReason: "duplicate_delivery" });
       return c.json({ ok: true });
     }
-    const { event: inbound, dropReason } = slackEventToInboundResult(ev);
+    const self = await ensureSlackSelfIdentity();
+    const { event: inbound, dropReason } = slackEventToInboundResult(ev, { self });
     if (inbound) {
       const isThreadReply = ev.type === "message" && ev.channel_type !== "im" && typeof ev.thread_ts === "string" && ev.thread_ts !== ev.ts;
       if (isThreadReply) {
@@ -14649,13 +14699,15 @@ async function startServer(options = {}) {
     if (!options.quiet) console.warn(`[scheduler] start skipped: ${err.message}`);
   }
   const port = options.port || config.server.port;
-  const host = options.host || config.server.host || "0.0.0.0";
+  const envHost = process.env.SPARKECODER_API_HOST || process.env.SPARKECODER_HOST;
+  const host = envHost || options.host || config.server.host || "0.0.0.0";
+  const hostSource = envHost ? process.env.SPARKECODER_API_HOST ? "env SPARKECODER_API_HOST" : "env SPARKECODER_HOST" : options.host ? "--host flag" : config.server.host ? "config.server.host" : "default";
   const publicUrl = options.publicUrl || config.server.publicUrl;
   const app = await createApp({ quiet: options.quiet });
   if (!options.quiet) {
     console.log(`
 \u{1F680} SparkECoder API Server`);
-    console.log(`   \u2192 Running at http://${host}:${port}`);
+    console.log(`   \u2192 Binding to ${host}:${port} (source: ${hostSource})`);
     if (publicUrl) {
       console.log(`   \u2192 Public URL: ${publicUrl}`);
     }
@@ -14664,10 +14716,22 @@ async function startServer(options = {}) {
     console.log(`   \u2192 OpenAPI spec: http://${host}:${port}/openapi.json
 `);
   }
+  if (host === "127.0.0.1" || host === "localhost") {
+    console.log(`[sparkecoder] \u26A0 API bound to ${host} only \u2014 not reachable from outside the machine.`);
+    console.log(`[sparkecoder]   For tunnels/reverse proxies (Modal/Fly/Docker), set --host 0.0.0.0 or SPARKECODER_API_HOST=0.0.0.0.`);
+  }
   serverInstance = serve({
     fetch: app.fetch,
     port,
     hostname: host
+  }, (info) => {
+    const actual = `${info.address}:${info.port}`;
+    const requested = `${host}:${port}`;
+    if (info.address === "127.0.0.1" && host !== "127.0.0.1" && host !== "localhost") {
+      console.warn(`[sparkecoder] \u2717 API listener bound to ${actual} but ${requested} was requested. External requests will be refused.`);
+    } else {
+      console.log(`[sparkecoder] \u2713 API listening on ${actual}`);
+    }
   });
   let webPort;
   let webStarted;