tmux-agent-monitor 0.0.12 → 0.0.15

package/dist/index.js

@@ -1262,12 +1262,21 @@ const createApp = ({ config, monitor, tmuxActions }) => {
 		return token === config.token;
 	};
 	const isOriginAllowed = (origin, host) => {
-		if (!origin || config.allowedOrigins.length === 0) return config.allowedOrigins.length === 0 || (host ? config.allowedOrigins.includes(host) : true);
+		if (config.allowedOrigins.length === 0) return true;
+		if (!origin) return false;
 		return config.allowedOrigins.includes(origin) || (host ? config.allowedOrigins.includes(host) : false);
 	};
 	const sendWs = (ws, message) => {
 		ws.send(JSON.stringify(message));
 	};
+	const closeAllWsClients = (code, reason) => {
+		wsClients.forEach((ws) => {
+			try {
+				ws.close(code, reason);
+			} catch {}
+		});
+		wsClients.clear();
+	};
 	const broadcast = (message) => {
 		const payload = JSON.stringify(message);
 		wsClients.forEach((ws) => ws.send(payload));
@@ -1374,6 +1383,7 @@ const createApp = ({ config, monitor, tmuxActions }) => {
 	app.post("/api/admin/token/rotate", (c) => {
 		const next = rotateToken();
 		config.token = next.token;
+		closeAllWsClients(1008, "token rotated");
 		return c.json({ token: next.token });
 	});
 	const wsHandler = upgradeWebSocket(() => ({
@@ -2345,6 +2355,8 @@ const buildError = (code, message) => ({
 });
 const createTmuxActions = (adapter, config) => {
 	const dangerPatterns = compileDangerPatterns(config.dangerCommandPatterns);
+	const dangerKeys = new Set(config.dangerKeys);
+	const pendingCommands = /* @__PURE__ */ new Map();
 	const enterKey = config.input.enterKey || "C-m";
 	const enterDelayMs = config.input.enterDelayMs ?? 0;
 	const bracketedPaste = (value) => `\u001b[200~${value}\u001b[201~`;
@@ -2357,10 +2369,22 @@ const createTmuxActions = (adapter, config) => {
 			ok: false,
 			error: buildError("INVALID_PAYLOAD", "text too long")
 		};
-		if (isDangerousCommand(text, dangerPatterns)) return {
-			ok: false,
-			error: buildError("DANGEROUS_COMMAND", "dangerous command blocked")
-		};
+		const normalized = text.replace(/\r\n/g, "\n");
+		const combined = `${pendingCommands.get(paneId) ?? ""}${normalized}`;
+		if (combined.length > config.input.maxTextLength) {
+			pendingCommands.delete(paneId);
+			return {
+				ok: false,
+				error: buildError("INVALID_PAYLOAD", "text too long")
+			};
+		}
+		if (isDangerousCommand(combined, dangerPatterns)) {
+			pendingCommands.delete(paneId);
+			return {
+				ok: false,
+				error: buildError("DANGEROUS_COMMAND", "dangerous command blocked")
+			};
+		}
 		await adapter.run([
 			"if-shell",
 			"-t",
@@ -2368,7 +2392,6 @@ const createTmuxActions = (adapter, config) => {
 			"[ \"#{pane_in_mode}\" = \"1\" ]",
 			`copy-mode -q -t ${paneId}`
 		]);
-		const normalized = text.replace(/\r\n/g, "\n");
 		if (normalized.includes("\n")) {
 			const result = await adapter.run([
 				"send-keys",
@@ -2394,6 +2417,7 @@ const createTmuxActions = (adapter, config) => {
 					error: buildError("INTERNAL", enterResult.stderr || "send-keys Enter failed")
 				};
 			}
+			pendingCommands.delete(paneId);
 			return { ok: true };
 		}
 		const result = await adapter.run([
@@ -2419,7 +2443,10 @@ const createTmuxActions = (adapter, config) => {
 				ok: false,
 				error: buildError("INTERNAL", enterResult.stderr || "send-keys Enter failed")
 			};
+			pendingCommands.delete(paneId);
+			return { ok: true };
 		}
+		pendingCommands.set(paneId, combined);
 		return { ok: true };
 	};
 	const sendKeys = async (paneId, keys) => {
@@ -2428,6 +2455,10 @@ const createTmuxActions = (adapter, config) => {
 			ok: false,
 			error: buildError("INVALID_PAYLOAD", "invalid keys")
 		};
+		if (keys.some((key) => dangerKeys.has(key))) return {
+			ok: false,
+			error: buildError("DANGEROUS_COMMAND", "dangerous key blocked")
+		};
 		for (const key of keys) {
 			const result = await adapter.run([
 				"send-keys",