tokmon 0.23.4 → 0.24.0

package/dist/{chunk-2K4L4QQK.js → chunk-REO4O5VE.js}

@@ -1,12 +1,17 @@
 #!/usr/bin/env node
 import {
   appVersion,
-  browserUrl,
   findWebRoot,
   send,
   sendJson,
   serveStatic
-} from "./chunk-Q2DSDWO2.js";
+} from "./chunk-SMPY52EV.js";
+import {
+  buildAccounts,
+  colorHex,
+  fetchPeak,
+  namedHex
+} from "./chunk-42H7R376.js";
 import {
   PROVIDERS,
   TOKMON_CAPABILITIES,
@@ -14,14 +19,10 @@ import {
   TOKMON_WS_METHODS,
   TOKMON_WS_PATH,
   TokmonRpcGroup,
-  buildAccounts,
-  colorHex,
   detectProviders,
-  fetchPeak,
-  namedHex,
   resolveTimezone,
   withTimeout
-} from "./chunk-2AFQKH5O.js";
+} from "./chunk-O27I2XFN.js";
 import {
   cacheDir,
   expandHome,
@@ -29,11 +30,11 @@ import {
   normalizeConfig,
   saveConfig,
   snapshotCacheFile
-} from "./chunk-DJPUYMZM.js";
+} from "./chunk-5CWOJMAH.js";
 
 // src/web/server.ts
 import { createServer } from "http";
-import { randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { randomBytes, timingSafeEqual } from "crypto";
 
 // src/web/data.ts
 async function resolveAccounts(config) {
@@ -676,7 +677,6 @@ async function applyConfigUpdate(engine, state, input) {
 }
 
 // src/web/ws.ts
-import { timingSafeEqual } from "crypto";
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import { NodeWS } from "@effect/platform-node/NodeSocket";
 import { Effect, Exit, Layer, Queue, Scope, Stream } from "effect";
@@ -743,40 +743,55 @@ async function listHomeDirectory(rawPath) {
   return { path: abs, parent: parentFor(root, abs), entries };
 }
 
-// src/web/ws.ts
+// src/web/request-guard.ts
+import { isIP } from "net";
 function header(req, name) {
   const value = req.headers[name.toLowerCase()];
   return Array.isArray(value) ? value[0] : value;
 }
-function isLoopbackHost(value) {
-  if (!value) return false;
-  const host = value.trim().toLowerCase();
-  if (!host) return false;
-  return /^(?:127\.0\.0\.1|localhost)(?::\d{1,5})?$/.test(host) || /^\[::1\](?::\d{1,5})?$/.test(host);
-}
-function isWsPath(req) {
+function hostnameFromHost(value) {
+  if (!value) return null;
   try {
-    return new URL(req.url ?? "/", "http://127.0.0.1").pathname === TOKMON_WS_PATH;
+    const url = new URL(`http://${value.trim()}`);
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return null;
+    return url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
   } catch {
-    return false;
+    return null;
   }
 }
-function wsToken(req) {
+function isLoopbackHostHeader(value) {
+  const hostname = hostnameFromHost(value);
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function isAllowedHostHeader(value, allowNetworkAccess) {
+  if (isLoopbackHostHeader(value)) return true;
+  if (!allowNetworkAccess) return false;
+  const hostname = hostnameFromHost(value);
+  return hostname !== null && isIP(hostname) !== 0;
+}
+function isSameOriginRequest(req) {
+  const origin = header(req, "origin");
+  if (!origin || origin === "null") return true;
+  const host = header(req, "host")?.trim().toLowerCase();
+  if (!host) return false;
   try {
-    return new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("wsToken");
+    const url = new URL(origin);
+    return (url.protocol === "http:" || url.protocol === "https:") && url.host.toLowerCase() === host;
   } catch {
-    return null;
+    return false;
   }
 }
-function tokenMatches(actual, expected) {
-  if (!actual) return false;
-  const left = Buffer.from(actual);
-  const right = Buffer.from(expected);
-  return left.length === right.length && timingSafeEqual(left, right);
+function isAllowedLocalRequest(req, allowNetworkAccess) {
+  return isAllowedHostHeader(header(req, "host"), allowNetworkAccess) && isSameOriginRequest(req);
 }
-function isAuthorized(req, token) {
-  if (!isLoopbackHost(header(req, "host"))) return false;
-  return tokenMatches(wsToken(req), token);
+
+// src/web/ws.ts
+function isWsPath(req) {
+  try {
+    return new URL(req.url ?? "/", "http://127.0.0.1").pathname === TOKMON_WS_PATH;
+  } catch {
+    return false;
+  }
 }
 function rejectUpgrade(socket, status = 403, message = "Forbidden") {
   try {
@@ -855,15 +870,11 @@ async function mountWsRpc(server, deps) {
     )
   );
   const onUpgrade = (req, socket, head) => {
-    if (!isLoopbackHost(header(req, "host"))) {
+    if (!isAllowedLocalRequest(req, deps.state.config.allowNetworkAccess)) {
       rejectUpgrade(socket);
       return;
     }
     if (!isWsPath(req)) return;
-    if (!isAuthorized(req, deps.wsToken)) {
-      rejectUpgrade(socket);
-      return;
-    }
     upgradeHandler(req, socket, head);
   };
   server.prependListener("upgrade", onUpgrade);
@@ -900,59 +911,38 @@ async function mountWsRpc(server, deps) {
 }
 
 // src/web/server.ts
-var HOST = "127.0.0.1";
+var LOOPBACK_HOST = "127.0.0.1";
+var NETWORK_HOST = "0.0.0.0";
 var DEFAULT_PORT = 4317;
 var MAX_PORT_TRIES = 20;
-function isLoopbackHostHeader(value) {
-  if (!value) return false;
-  const host = value.trim().toLowerCase();
-  return /^(?:127\.0\.0\.1|localhost)(?::\d{1,5})?$/.test(host) || /^\[::1\](?::\d{1,5})?$/.test(host);
-}
-function isLoopbackOrigin(origin) {
-  if (!origin || origin === "null") return true;
-  try {
-    const u = new URL(origin);
-    return isLoopbackHostHeader(u.host);
-  } catch {
-    return false;
-  }
-}
 function header2(req, name) {
   const value = req.headers[name];
   return Array.isArray(value) ? value[0] : value;
 }
-function tokenMatches2(given, expected) {
+function tokenMatches(given, expected) {
   if (!given) return false;
   const actual = Buffer.from(given);
   const token = Buffer.from(expected);
-  return actual.length === token.length && timingSafeEqual2(actual, token);
+  return actual.length === token.length && timingSafeEqual(actual, token);
 }
-function guardHost(req, res) {
-  if (isLoopbackHostHeader(header2(req, "host"))) return true;
+function guardHost(req, res, allowNetworkAccess) {
+  if (isAllowedHostHeader(header2(req, "host"), allowNetworkAccess)) return true;
   sendJson(res, 403, { error: "forbidden" });
   return false;
 }
-function guardPrivileged(req, res, wsToken2) {
-  const header3 = (n) => {
-    const v = req.headers[n];
-    return Array.isArray(v) ? v[0] : v;
-  };
-  if (!tokenMatches2(header3("x-tokmon-token"), wsToken2)) {
-    sendJson(res, 403, { error: "forbidden" });
-    return false;
-  }
-  if (!isLoopbackOrigin(header3("origin"))) {
+function guardSameOrigin(req, res) {
+  if (!isSameOriginRequest(req)) {
     sendJson(res, 403, { error: "forbidden" });
     return false;
   }
   return true;
 }
-function createRouter(engine, state, vite, webRoot, wsToken2, version) {
+function createRouter(engine, state, vite, webRoot, wsToken, version) {
   return (req, res) => {
     const url = req.url || "/";
     const path = url.split("?")[0];
     const method = req.method || "GET";
-    if (!guardHost(req, res)) return;
+    if (!guardHost(req, res, state.config.allowNetworkAccess)) return;
     if (path === "/api/data") {
       engine.touch();
       sendJson(res, 200, engine.snapshot() ?? { pending: true });
@@ -964,12 +954,12 @@ function createRouter(engine, state, vite, webRoot, wsToken2, version) {
         ready: engine.snapshot() !== null,
         version,
         // Discovery requires this proof; public health checks retain their useful 200 response.
-        owner: tokenMatches2(header2(req, "x-tokmon-token"), wsToken2)
+        owner: tokenMatches(header2(req, "x-tokmon-token"), wsToken)
       });
       return;
     }
     if (path === "/api/config") {
-      if (!guardPrivileged(req, res, wsToken2)) return;
+      if (!guardSameOrigin(req, res)) return;
       if (method === "GET") {
         sendJson(res, 200, state.config);
         return;
@@ -996,7 +986,7 @@ async function startWebServer(opts) {
   const version = appVersion();
   const summaryIntervalMs = summaryIntervalFor(state.config);
   const billingIntervalMs = billingIntervalFor(state.config);
-  const wsToken2 = opts.wsToken ?? randomBytes(32).toString("base64url");
+  const wsToken = opts.wsToken ?? randomBytes(32).toString("base64url");
   const log = (msg) => {
     if (opts.log) process.stdout.write(msg + "\n");
   };
@@ -1010,10 +1000,11 @@ async function startWebServer(opts) {
     const webRoot = vite ? null : findWebRoot();
     if (!vite && !webRoot) log("  \u26A0 no dashboard available \u2014 see the page for build/dev instructions");
     engine = createDataEngine({ version, config: state.config, tz, summaryIntervalMs, billingIntervalMs, resolved });
-    server.addListener("request", createRouter(engine, state, vite, webRoot, wsToken2, version));
-    closeWsRpc = await mountWsRpc(server, { engine, state, wsToken: wsToken2 });
-    const port = await listenWithFallback(server, opts.port ?? DEFAULT_PORT);
-    const serverUrl = `http://${HOST}:${port}`;
+    server.addListener("request", createRouter(engine, state, vite, webRoot, wsToken, version));
+    closeWsRpc = await mountWsRpc(server, { engine, state });
+    const bindHost = state.config.allowNetworkAccess ? NETWORK_HOST : LOOPBACK_HOST;
+    const port = await listenWithFallback(server, opts.port ?? DEFAULT_PORT, bindHost);
+    const serverUrl = `http://${LOOPBACK_HOST}:${port}`;
     if (vite?.warmupRequest) {
       try {
         await Promise.race([vite.warmupRequest("/src/main.tsx"), delay(5e3)]);
@@ -1024,9 +1015,7 @@ async function startWebServer(opts) {
     let stopped = false;
     return {
       url: serverUrl,
-      browserUrl: browserUrl(serverUrl, wsToken2),
       port,
-      wsToken: wsToken2,
       snapshot: engine.snapshot,
       config: () => state.config,
       stop: async () => {
@@ -1078,11 +1067,11 @@ function closeServer(server, timeoutMs = 1e3) {
     }
   });
 }
-function listenWithFallback(server, startPort) {
+function listenWithFallback(server, startPort, host) {
   return new Promise((resolve, reject) => {
     if (startPort === 0) {
       server.once("error", reject);
-      server.listen(0, HOST, () => {
+      server.listen(0, host, () => {
         const addr = server.address();
         resolve(typeof addr === "object" && addr ? addr.port : 0);
       });
@@ -1100,7 +1089,7 @@ function listenWithFallback(server, startPort) {
           reject(err);
         }
       });
-      server.listen(port, HOST, () => resolve(port));
+      server.listen(port, host, () => resolve(port));
     };
     attempt();
   });

package/dist/{chunk-Q2DSDWO2.js → chunk-SMPY52EV.js}

@@ -116,39 +116,10 @@ function appVersion() {
   return "";
 }
 
-// src/web/open.ts
-import { spawn } from "child_process";
-import { appendFileSync } from "fs";
-function browserUrl(url, wsToken) {
-  return wsToken ? `${url}#/#tokmonToken=${encodeURIComponent(wsToken)}` : url;
-}
-function openBrowser(url, wsToken) {
-  const target = browserUrl(url, wsToken);
-  if (process.env.TOKMON_OPENLOG) {
-    try {
-      appendFileSync(process.env.TOKMON_OPENLOG, target + "\n");
-    } catch {
-    }
-    return;
-  }
-  try {
-    if (process.platform === "darwin") {
-      spawn("open", [target], { stdio: "ignore", detached: true }).unref();
-    } else if (process.platform === "win32") {
-      spawn("cmd", ["/c", "start", "", target], { stdio: "ignore", detached: true }).unref();
-    } else {
-      spawn("xdg-open", [target], { stdio: "ignore", detached: true }).unref();
-    }
-  } catch {
-  }
-}
-
 export {
   findWebRoot,
   send,
   sendJson,
   serveStatic,
-  appVersion,
-  browserUrl,
-  openBrowser
+  appVersion
 };

package/dist/{daemon-handle-6F2IB6CU.js → chunk-W2WGBXZG.js}

@@ -5,12 +5,10 @@ import {
   readLock,
   reclaimDeadLock,
   verifyLock
-} from "./chunk-RM3ZE44Z.js";
+} from "./chunk-3TJVFKXV.js";
 import {
-  appVersion,
-  browserUrl
-} from "./chunk-Q2DSDWO2.js";
-import "./chunk-DJPUYMZM.js";
+  appVersion
+} from "./chunk-SMPY52EV.js";
 
 // src/client/daemon-handle.ts
 import { spawn } from "child_process";
@@ -44,13 +42,13 @@ function parseHandshake(line) {
     return null;
   }
 }
-function connected(url, wsToken) {
-  return { kind: "spawned", baseUrl: browserUrl(url, wsToken), wsToken, stop: () => {
+function connected(url) {
+  return { kind: "spawned", baseUrl: url, stop: () => {
   } };
 }
 async function attach(opts, version) {
   const lock = await verifyLock(readLock(opts), version);
-  return lock ? connected(lock.url, lock.wsToken) : null;
+  return lock ? connected(lock.url) : null;
 }
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 async function retireIncompatibleDaemon(opts, version, timeoutMs) {
@@ -155,9 +153,10 @@ async function attachOrSpawn(opts = {}) {
   });
 }
 function degraded() {
-  return { kind: "degraded", baseUrl: null, wsToken: null, stop: () => {
+  return { kind: "degraded", baseUrl: null, stop: () => {
   } };
 }
+
 export {
   attachOrSpawn
 };