tokmon 0.28.0 → 0.28.1

package/README.md

@@ -105,7 +105,7 @@ tokmon serve --port 8080
 tokmon serve --no-open  # don't auto-open the browser
 ```
 
-It binds to `127.0.0.1` by default and reads the same local daemon state — nothing leaves your machine. The browser connects directly over a same-origin WebSocket; dashboard URLs have no token or login step. Optional LAN access can be enabled in settings, with an explicit unsafe-access warning, and takes effect after the daemon restarts. The dashboard renders instantly from a cached snapshot, then streams live updates and goes idle when no tab is open. Press `R` or use the visible **Refresh** control to update it. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
+It binds to `127.0.0.1` by default and reads the same local daemon state — nothing leaves your machine. The browser connects directly over a same-origin WebSocket; dashboard URLs have no token or login step. Optional LAN access can be enabled in settings, with an explicit unsafe-access warning, and takes effect after the daemon restarts. When publishing the dashboard through an ingress or reverse proxy, add each exact DNS name to **Allowed hosts** in settings (for example, `tokmon.example.com`); IP hosts remain allowed in LAN mode. The dashboard renders instantly from a cached snapshot, then streams live updates and goes idle when no tab is open. Press `R` or use the visible **Refresh** control to update it. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
 
 ### Overview
 

package/dist/{bootstrap-ink-5LQMSU4B.js → bootstrap-ink-L7QSJBMS.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   createDaemonRpcClient
-} from "./chunk-QOA6KOJQ.js";
+} from "./chunk-3RTWFGGD.js";
 import {
   accountsByProvider,
   buildAccounts,
   fetchPeak,
   modelColor
-} from "./chunk-KCY53RUE.js";
+} from "./chunk-FMP3P2WV.js";
 import {
   PROVIDERS,
   PROVIDER_ORDER,
@@ -24,7 +24,7 @@ import {
   time,
   tokens,
   withTimeout
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   COLOR_PALETTE,
   DEFAULTS,
@@ -33,13 +33,14 @@ import {
   getTrackedAccountRows,
   isValidTimezone,
   loadConfig,
+  normalizeAllowedHost,
   normalizeConfig,
   pickAccentColor,
   redactEmail,
   sanitizeTyped,
   saveConfigSync,
   snapshotCacheFile
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 import {
   glyphs
 } from "./chunk-RF4GGQGM.js";
@@ -589,7 +590,7 @@ import { Box as Box4, Text as Text4 } from "ink";
 import { memo as memo3 } from "react";
 import { Box as Box3, Text as Text3 } from "ink";
 import { Fragment as Fragment2, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
-var GENERAL_ROWS = 10;
+var GENERAL_ROWS = 11;
 var SETTINGS_TABS = ["general", "providers", "accounts"];
 var SETTINGS_TAB_LABELS = {
   general: "General",
@@ -604,6 +605,9 @@ var SettingsView = memo3(function SettingsView2({
   tzEdit,
   tzCaret,
   tzError,
+  allowedHostsEdit,
+  allowedHostsCaret,
+  allowedHostsError,
   resolvedTz,
   accountForm,
   activeAccountId,
@@ -612,6 +616,7 @@ var SettingsView = memo3(function SettingsView2({
 }) {
   if (accountForm) return /* @__PURE__ */ jsx3(AccountFormView, { form: accountForm, accounts: config.accounts });
   const editingTz = tzEdit !== null;
+  const editingAllowedHosts = allowedHostsEdit !== null;
   const tzDisplay = config.timezone === null ? `System (${resolvedTz})` : config.timezone;
   const tabFocused = cursor < 0;
   return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", marginTop: 1, children: [
@@ -685,8 +690,17 @@ var SettingsView = memo3(function SettingsView2({
         ] })
       ] }),
       /* @__PURE__ */ jsx3(Row, { cursor, idx: 8, label: "Network access", children: /* @__PURE__ */ jsx3(Text3, { bold: true, color: config.allowNetworkAccess ? "red" : "green", children: config.allowNetworkAccess ? "LAN (unsafe)" : "local only" }) }),
+      /* @__PURE__ */ jsx3(Row, { cursor, idx: 9, label: "Allowed hosts", children: editingAllowedHosts ? /* @__PURE__ */ jsxs3(Fragment2, { children: [
+        /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "[" }),
+        /* @__PURE__ */ jsx3(CaretText, { value: allowedHostsEdit ?? "", caret: allowedHostsCaret, color: "cyan" }),
+        /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "]" })
+      ] }) : /* @__PURE__ */ jsx3(Text3, { bold: true, color: "yellow", children: config.allowedHosts.join(", ") || "none" }) }),
+      cursor === 9 && allowedHostsError && /* @__PURE__ */ jsxs3(Text3, { color: "red", children: [
+        "  ",
+        allowedHostsError
+      ] }),
       config.allowNetworkAccess && /* @__PURE__ */ jsx3(Text3, { color: "red", children: "  Warning: dashboard data and settings will be exposed to your local network after daemon restart." }),
-      /* @__PURE__ */ jsxs3(Row, { cursor, idx: 9, label: "Reset times", children: [
+      /* @__PURE__ */ jsxs3(Row, { cursor, idx: 10, label: "Reset times", children: [
         /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
           glyphs().caretL,
           " "
@@ -779,6 +793,12 @@ var SettingsView = memo3(function SettingsView2({
       " Enter save ",
       glyphs().middot,
       " Esc cancel"
+    ] }) : editingAllowedHosts ? /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
+      "comma-separated exact DNS names ",
+      glyphs().middot,
+      " Enter save ",
+      glyphs().middot,
+      " Esc cancel"
     ] }) : activeTab === "providers" ? /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
       glyphs().arrowU,
       glyphs().arrowD,
@@ -1992,6 +2012,56 @@ function handleTimezoneEditor(input, key, editor, text, updateConfig) {
     if (clean) text.insert(clean);
   }
 }
+function handleAllowedHostsEditor(input, key, editor, text, updateConfig) {
+  const { value, setValue, setError, setCaret, valueRef, caretRef } = editor;
+  if (value === null) return;
+  if (key.escape) {
+    setValue(null);
+    setError(null);
+    return;
+  }
+  if (key.return) {
+    const parts = value.split(",").map((part) => part.trim()).filter(Boolean);
+    const normalized = parts.map(normalizeAllowedHost);
+    if (normalized.some((host) => host === null)) {
+      setError("Use exact DNS names without a scheme, port, path, or wildcard");
+      return;
+    }
+    updateConfig((config) => ({ ...config, allowedHosts: [...new Set(normalized)] }));
+    setValue(null);
+    setError(null);
+    return;
+  }
+  if (key.leftArrow) {
+    setCaret((caret) => clampCaret(caret - 1, value.length));
+    return;
+  }
+  if (key.rightArrow) {
+    setCaret((caret) => clampCaret(caret + 1, value.length));
+    return;
+  }
+  if (key.ctrl && input === "a") {
+    setCaret(0);
+    return;
+  }
+  if (key.ctrl && input === "e") {
+    setCaret(value.length);
+    return;
+  }
+  if (key.backspace || key.delete) {
+    const result = spliceBackspace(valueRef.current, caretRef.current);
+    valueRef.current = result.value;
+    caretRef.current = result.caret;
+    setValue(result.value);
+    setCaret(result.caret);
+    setError(null);
+    return;
+  }
+  if (text.isPrintable(input, key)) {
+    const clean = sanitizeTyped(input);
+    if (clean) text.insert(clean);
+  }
+}
 function handleSearchEditor(input, key, table, text) {
   const { search, setSearch, setSearchMode, setSearchCaret, searchValueRef, searchCaretRef } = table;
   if (key.return || key.escape) {
@@ -2064,6 +2134,8 @@ function handleSettings(input, key, ctx) {
     setCursor(-1);
     timezoneEditor.setValue(null);
     timezoneEditor.setError(null);
+    ctx.allowedHostsEditor.setValue(null);
+    ctx.allowedHostsEditor.setError(null);
   };
   const rowCount = tab === "general" ? GENERAL_ROWS : tab === "providers" ? PROVIDER_ORDER.length : trackedAccounts.length + 1;
   if (key.tab) {
@@ -2194,7 +2266,14 @@ function handleSettings(input, key, ctx) {
       updateConfig((current) => ({ ...current, allowNetworkAccess: !current.allowNetworkAccess }));
       return;
     }
-    if (index === 9 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
+    if (index === 9 && inputKey.return) {
+      const initial = config.allowedHosts.join(", ");
+      context.allowedHostsEditor.setValue(initial);
+      context.allowedHostsEditor.setCaret(initial.length);
+      context.allowedHostsEditor.setError(null);
+      return;
+    }
+    if (index === 10 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
       updateConfig((current) => ({ ...current, resetDisplay: current.resetDisplay === "relative" ? "absolute" : "relative" }));
     }
   }
@@ -2357,7 +2436,7 @@ function handleTerminalFocusInput(input) {
   return true;
 }
 function isRefreshAllShortcut(input, mode) {
-  return (input === "r" || input === "R") && !mode.unavailable && !mode.showPicker && !mode.editingAccount && !mode.editingTimezone && !mode.editingSearch;
+  return (input === "r" || input === "R") && !mode.unavailable && !mode.showPicker && !mode.editingAccount && !mode.editingTimezone && !mode.editingAllowedHosts && !mode.editingSearch;
 }
 function handleOnboarding(input, key, ctx) {
   const { onboarding, global } = ctx;
@@ -2386,11 +2465,13 @@ function handleOnboarding(input, key, ctx) {
 function handleKey(input, key, ctx) {
   const editingAccount = ctx.settings.show && ctx.accountEditor.form !== null;
   const editingTimezone = ctx.settings.show && ctx.timezoneEditor.value !== null;
+  const editingAllowedHosts = ctx.settings.show && ctx.allowedHostsEditor.value !== null;
   const editingSearch = ctx.table.tab === 1 && ctx.table.searchMode;
   if (isRefreshAllShortcut(input, {
     showPicker: ctx.onboarding.show,
     editingAccount,
     editingTimezone,
+    editingAllowedHosts,
     editingSearch,
     unavailable: !ctx.global.configReady
   })) {
@@ -2409,6 +2490,10 @@ function handleKey(input, key, ctx) {
     handleTimezoneEditor(input, key, ctx.timezoneEditor, ctx.textInput, ctx.global.updateConfig);
     return;
   }
+  if (editingAllowedHosts) {
+    handleAllowedHostsEditor(input, key, ctx.allowedHostsEditor, ctx.textInput, ctx.global.updateConfig);
+    return;
+  }
   if (editingSearch) {
     handleSearchEditor(input, key, ctx.table, ctx.textInput);
     return;
@@ -3142,6 +3227,9 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   const [tzEdit, setTzEdit] = useState10(null);
   const [tzError, setTzError] = useState10(null);
   const [tzCaret, setTzCaret] = useState10(0);
+  const [allowedHostsEdit, setAllowedHostsEdit] = useState10(null);
+  const [allowedHostsError, setAllowedHostsError] = useState10(null);
+  const [allowedHostsCaret, setAllowedHostsCaret] = useState10(0);
   const [searchCaret, setSearchCaret] = useState10(0);
   const [onboardSel, setOnboardSel] = useState10(null);
   const [onboardCursor, setOnboardCursor] = useState10(0);
@@ -3169,6 +3257,8 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   const dashPageCountRef = useRef8(1);
   const tzValueRef = useRef8("");
   const tzCaretRef = useRef8(0);
+  const allowedHostsValueRef = useRef8("");
+  const allowedHostsCaretRef = useRef8(0);
   const searchValueRef = useRef8("");
   const searchCaretRef = useRef8(0);
   const accountsKey = useMemo2(() => accounts.map(acctKey).join("|"), [accounts]);
@@ -3274,6 +3364,8 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   dashPageCountRef.current = dashPageCount;
   tzValueRef.current = tzEdit ?? "";
   tzCaretRef.current = clampCaret(tzCaret, (tzEdit ?? "").length);
+  allowedHostsValueRef.current = allowedHostsEdit ?? "";
+  allowedHostsCaretRef.current = clampCaret(allowedHostsCaret, (allowedHostsEdit ?? "").length);
   searchValueRef.current = search;
   searchCaretRef.current = clampCaret(searchCaret, search.length);
   const isPrintable = (input, key) => !!input && !key.ctrl && !key.meta && !isPasteInput(input);
@@ -3291,6 +3383,13 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
       setTzEdit(r.value);
       setTzCaret(r.caret);
       setTzError(null);
+    } else if (showSettings && allowedHostsEdit !== null) {
+      const r = spliceInsert(allowedHostsValueRef.current, allowedHostsCaretRef.current, text);
+      allowedHostsValueRef.current = r.value;
+      allowedHostsCaretRef.current = r.caret;
+      setAllowedHostsEdit(r.value);
+      setAllowedHostsCaret(r.caret);
+      setAllowedHostsError(null);
     } else if (tab === 1 && searchMode) {
       const r = spliceInsert(searchValueRef.current, searchCaretRef.current, text);
       searchValueRef.current = r.value;
@@ -3461,7 +3560,7 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
     if (webStartingRef.current) return;
     webStartingRef.current = true;
     try {
-      const { startWebServer } = await import("./server-BJOXAGRI.js");
+      const { startWebServer } = await import("./server-EUO7CWYH.js");
       const ctrl = await startWebServer({ config: cfg, log: false });
       webRef.current = ctrl;
       openUrl(ctrl.url);
@@ -3535,6 +3634,14 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
         valueRef: tzValueRef,
         caretRef: tzCaretRef
       },
+      allowedHostsEditor: {
+        value: allowedHostsEdit,
+        setValue: setAllowedHostsEdit,
+        setError: setAllowedHostsError,
+        setCaret: setAllowedHostsCaret,
+        valueRef: allowedHostsValueRef,
+        caretRef: allowedHostsCaretRef
+      },
       textInput: { isPrintable, insert: insertText },
       settings: {
         show: showSettings,
@@ -3674,6 +3781,9 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
         tzEdit,
         tzCaret,
         tzError,
+        allowedHostsEdit,
+        allowedHostsCaret,
+        allowedHostsError,
         resolvedTz: tz,
         accountForm,
         activeAccountId: cfg.activeAccountId,

package/dist/{chunk-QOA6KOJQ.js → chunk-3RTWFGGD.js}

@@ -3,7 +3,7 @@ import {
   TOKMON_WS_METHODS,
   TOKMON_WS_PATH,
   TokmonRpcGroup
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-CVKCVHS7.js";
 
 // src/client/daemon-rpc-client.ts
 import { Cause, Context, Duration, Effect, Exit, Fiber, Layer, ManagedRuntime, Schedule, Stream } from "effect";

package/dist/{chunk-AMD4PXDG.js → chunk-4HU4EI5T.js}

@@ -5,7 +5,7 @@ import {
   readLock,
   reclaimDeadLock,
   verifyLock
-} from "./chunk-QM5E5RJZ.js";
+} from "./chunk-XDA5RJST.js";
 import {
   appVersion
 } from "./chunk-SMPY52EV.js";

package/dist/{chunk-IWKSA64G.js → chunk-CVKCVHS7.js}

@@ -5,7 +5,7 @@ import {
   envDir,
   expandHome,
   isValidTimezone
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/async.ts
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -744,8 +744,8 @@ import { Schema } from "effect";
 import * as Rpc from "effect/unstable/rpc/Rpc";
 import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
 var TOKMON_WS_PATH = "/ws";
-var TOKMON_PROTOCOL_VERSION = 2;
-var TOKMON_CAPABILITIES = ["config-cas", "config-revision"];
+var TOKMON_PROTOCOL_VERSION = 3;
+var TOKMON_CAPABILITIES = ["config-cas", "config-revision", "allowed-hosts"];
 var TOKMON_WS_METHODS = {
   getConfig: "tokmon.getConfig",
   setConfig: "tokmon.setConfig",
@@ -787,6 +787,7 @@ var ConfigSchema = Schema.Struct({
   defaultFocus: Schema.Literals(["all", "last"]),
   ascii: Schema.Literals(["auto", "on", "off"]),
   allowNetworkAccess: Schema.Boolean,
+  allowedHosts: Schema.Array(Schema.String),
   resetDisplay: Schema.Literals(["relative", "absolute"]),
   knownProviders: Schema.Array(ProviderIdSchema)
 });

package/dist/{chunk-KCY53RUE.js → chunk-FMP3P2WV.js}

@@ -5,11 +5,11 @@ import {
   identityFromIdToken,
   readClaudeIdentity,
   readJson
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   expandHome,
   slugify
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/accounts.ts
 import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "fs";

package/dist/{chunk-E2YXYU73.js → chunk-HP5UZCXP.js}

@@ -26,6 +26,7 @@ var DEFAULTS = {
   defaultFocus: "all",
   ascii: "auto",
   allowNetworkAccess: false,
+  allowedHosts: [],
   resetDisplay: "relative",
   knownProviders: []
 };
@@ -147,6 +148,27 @@ function sameJson(a, b) {
     return false;
   }
 }
+function normalizeAllowedHost(value) {
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (!candidate) return null;
+  try {
+    const url = new URL(`http://${candidate}`);
+    if (url.username || url.password || url.port || url.pathname !== "/" || url.search || url.hash) return null;
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, "");
+    if (!hostname || hostname.length > 253 || hostname.includes("*")) return null;
+    const labels = hostname.split(".");
+    if (labels.some((label) => !label || label.length > 63 || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label))) return null;
+    return hostname;
+  } catch {
+    return null;
+  }
+}
+function normalizeAllowedHosts(value) {
+  if (!Array.isArray(value)) return [];
+  const hosts = value.map(normalizeAllowedHost).filter((host) => host !== null);
+  return [...new Set(hosts)];
+}
 function repairConfig(input) {
   const reasons = [];
   const parsed = isRecord(input) ? input : {};
@@ -192,6 +214,10 @@ function repairConfig(input) {
   if (parsed.knownProviders !== void 0 && !Array.isArray(parsed.knownProviders)) {
     reasons.push("knownProviders was not an array");
   }
+  const allowedHosts = normalizeAllowedHosts(parsed.allowedHosts);
+  if (parsed.allowedHosts !== void 0 && !sameJson(parsed.allowedHosts, allowedHosts)) {
+    reasons.push("allowedHosts contained invalid or duplicate hostnames");
+  }
   const activeAccountId = typeof parsed.activeAccountId === "string" && (accountIds.has(parsed.activeAccountId) || PROVIDER_IDS.includes(parsed.activeAccountId)) ? parsed.activeAccountId : null;
   if (parsed.activeAccountId !== void 0 && parsed.activeAccountId !== null && activeAccountId === null) {
     reasons.push("activeAccountId did not match a known account/provider");
@@ -217,6 +243,7 @@ function repairConfig(input) {
     defaultFocus: parsed.defaultFocus === "last" ? "last" : "all",
     ascii: parsed.ascii === "on" ? "on" : parsed.ascii === "off" ? "off" : "auto",
     allowNetworkAccess: parsed.allowNetworkAccess === true,
+    allowedHosts,
     resetDisplay: parsed.resetDisplay === "absolute" ? "absolute" : "relative",
     knownProviders
   };
@@ -389,6 +416,8 @@ export {
   getTrackedAccountRows,
   clampNum,
   isValidTimezone,
+  normalizeAllowedHost,
+  normalizeAllowedHosts,
   repairConfig,
   normalizeConfig,
   slugify,

package/dist/{chunk-JK3U54G7.js → chunk-S33XIUAW.js}

@@ -11,7 +11,7 @@ import {
   colorHex,
   fetchPeak,
   namedHex
-} from "./chunk-KCY53RUE.js";
+} from "./chunk-FMP3P2WV.js";
 import {
   PROVIDERS,
   TOKMON_CAPABILITIES,
@@ -22,7 +22,7 @@ import {
   detectProviders,
   resolveTimezone,
   withTimeout
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   cacheDir,
   expandHome,
@@ -30,7 +30,7 @@ import {
   normalizeConfig,
   saveConfig,
   snapshotCacheFile
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/web/server.ts
 import { createServer } from "http";
@@ -783,11 +783,11 @@ function isLoopbackHostHeader(value) {
   const hostname = hostnameFromHost(value);
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }
-function isAllowedHostHeader(value, allowNetworkAccess) {
+function isAllowedHostHeader(value, allowNetworkAccess, allowedHosts = []) {
   if (isLoopbackHostHeader(value)) return true;
   if (!allowNetworkAccess) return false;
   const hostname = hostnameFromHost(value);
-  return hostname !== null && isIP(hostname) !== 0;
+  return hostname !== null && (isIP(hostname) !== 0 || allowedHosts.includes(hostname));
 }
 function isSameOriginRequest(req) {
   const origin = header(req, "origin");
@@ -801,8 +801,8 @@ function isSameOriginRequest(req) {
     return false;
   }
 }
-function isAllowedLocalRequest(req, allowNetworkAccess) {
-  return isAllowedHostHeader(header(req, "host"), allowNetworkAccess) && isSameOriginRequest(req);
+function isAllowedLocalRequest(req, allowNetworkAccess, allowedHosts = []) {
+  return isAllowedHostHeader(header(req, "host"), allowNetworkAccess, allowedHosts) && isSameOriginRequest(req);
 }
 
 // src/web/ws.ts
@@ -890,7 +890,7 @@ async function mountWsRpc(server, deps) {
     )
   );
   const onUpgrade = (req, socket, head) => {
-    if (!isAllowedLocalRequest(req, deps.state.config.allowNetworkAccess)) {
+    if (!isAllowedLocalRequest(req, deps.state.config.allowNetworkAccess, deps.state.config.allowedHosts)) {
       rejectUpgrade(socket);
       return;
     }
@@ -945,8 +945,8 @@ function tokenMatches(given, expected) {
   const token = Buffer.from(expected);
   return actual.length === token.length && timingSafeEqual(actual, token);
 }
-function guardHost(req, res, allowNetworkAccess) {
-  if (isAllowedHostHeader(header2(req, "host"), allowNetworkAccess)) return true;
+function guardHost(req, res, config) {
+  if (isAllowedHostHeader(header2(req, "host"), config.allowNetworkAccess, config.allowedHosts)) return true;
   sendJson(res, 403, { error: "forbidden" });
   return false;
 }
@@ -962,7 +962,7 @@ function createRouter(engine, state, vite, webRoot, wsToken, version) {
     const url = req.url || "/";
     const path = url.split("?")[0];
     const method = req.method || "GET";
-    if (!guardHost(req, res, state.config.allowNetworkAccess)) return;
+    if (!guardHost(req, res, state.config)) return;
     if (path === "/api/data") {
       engine.touch();
       sendJson(res, 200, engine.snapshot() ?? { pending: true });

package/dist/{chunk-QM5E5RJZ.js → chunk-XDA5RJST.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   cacheDir
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/web/lockfile.ts
 import { closeSync, fchmodSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";

package/dist/{cli-command-HXKWB6IP.js → cli-command-75LP4IDS.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   attachOrSpawn
-} from "./chunk-AMD4PXDG.js";
-import "./chunk-QM5E5RJZ.js";
+} from "./chunk-4HU4EI5T.js";
+import "./chunk-XDA5RJST.js";
 import "./chunk-SMPY52EV.js";
 import {
   createDaemonRpcClient
-} from "./chunk-QOA6KOJQ.js";
+} from "./chunk-3RTWFGGD.js";
 import {
   PROVIDERS,
   antigravityStateDb,
@@ -26,11 +26,11 @@ import {
   startOfMonth,
   startOfWeek,
   withTimeout
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   PROVIDER_IDS,
   configLocation
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/provider-locations.ts
 import { access } from "fs/promises";

package/dist/cli.js

@@ -41,7 +41,7 @@ function validateServeArgs(serveArgs) {
 }
 async function main() {
   if (subcommand && ["usage", "models", "query", "providers", "snapshot", "config"].includes(subcommand)) {
-    const { runQueryCommand } = await import("./cli-command-HXKWB6IP.js");
+    const { runQueryCommand } = await import("./cli-command-75LP4IDS.js");
     try {
       const output = await runQueryCommand(
         subcommand,
@@ -60,14 +60,14 @@ Run tokmon ${subcommand} --help for usage.
     return;
   }
   if (subcommand === "__daemon") {
-    const { runDaemon } = await import("./daemon-JCQF645I.js");
+    const { runDaemon } = await import("./daemon-CL4FJW26.js");
     await runDaemon(args.slice(1), { foreground: false });
     process.exitCode ??= 0;
     return;
   }
   if (subcommand === "serve" || subcommand === "web") {
     validateServeArgs(args.slice(1));
-    const { runDaemon } = await import("./daemon-JCQF645I.js");
+    const { runDaemon } = await import("./daemon-CL4FJW26.js");
     await runDaemon(args.slice(1), { foreground: true });
     process.exitCode ??= 0;
     return;
@@ -115,9 +115,9 @@ Run tokmon ${subcommand} --help for usage.
       return;
     }
   }
-  const { loadConfig } = await import("./config-2PXUENQL.js");
+  const { loadConfig } = await import("./config-HXFJTNLM.js");
   const { resolveGlyphs, setGlyphs } = await import("./glyphs-NKCSZLGO.js");
-  const { attachOrSpawn } = await import("./daemon-handle-2GVZT55B.js");
+  const { attachOrSpawn } = await import("./daemon-handle-QQLJE46Y.js");
   const config = await loadConfig();
   setGlyphs(resolveGlyphs({
     flag: asciiFlag,
@@ -128,7 +128,7 @@ Run tokmon ${subcommand} --help for usage.
   }));
   const daemon = await attachOrSpawn();
   const mode = daemon.kind === "spawned" ? "connected" : "degraded";
-  const { bootstrapInk } = await import("./bootstrap-ink-5LQMSU4B.js");
+  const { bootstrapInk } = await import("./bootstrap-ink-L7QSJBMS.js");
   await bootstrapInk({ interval, config, daemon, mode });
 }
 void main().catch((error) => {

package/dist/{config-2PXUENQL.js → config-HXFJTNLM.js}

@@ -15,6 +15,8 @@ import {
   generateAccountId,
   getTrackedAccountRows,
   loadConfig,
+  normalizeAllowedHost,
+  normalizeAllowedHosts,
   normalizeConfig,
   pickAccentColor,
   redactEmail,
@@ -24,7 +26,7 @@ import {
   saveConfigSync,
   slugify,
   snapshotCacheFile
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 export {
   ACCENT_COLORS,
   COLOR_PALETTE,
@@ -41,6 +43,8 @@ export {
   generateAccountId,
   getTrackedAccountRows,
   loadConfig,
+  normalizeAllowedHost,
+  normalizeAllowedHosts,
   normalizeConfig,
   pickAccentColor,
   redactEmail,

package/dist/{daemon-JCQF645I.js → daemon-CL4FJW26.js}

@@ -8,20 +8,20 @@ import {
   unlinkLock,
   verifyLock,
   writeLock
-} from "./chunk-QM5E5RJZ.js";
+} from "./chunk-XDA5RJST.js";
 import {
   startWebServer
-} from "./chunk-JK3U54G7.js";
+} from "./chunk-S33XIUAW.js";
 import {
   appVersion
 } from "./chunk-SMPY52EV.js";
-import "./chunk-KCY53RUE.js";
+import "./chunk-FMP3P2WV.js";
 import {
   flushDisk
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   loadConfig
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/web/daemon.ts
 import { randomBytes } from "crypto";

package/dist/{daemon-handle-2GVZT55B.js → daemon-handle-QQLJE46Y.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   attachOrSpawn
-} from "./chunk-AMD4PXDG.js";
-import "./chunk-QM5E5RJZ.js";
+} from "./chunk-4HU4EI5T.js";
+import "./chunk-XDA5RJST.js";
 import "./chunk-SMPY52EV.js";
-import "./chunk-E2YXYU73.js";
+import "./chunk-HP5UZCXP.js";
 export {
   attachOrSpawn
 };

package/dist/server-EUO7CWYH.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  startWebServer
+} from "./chunk-S33XIUAW.js";
+import "./chunk-SMPY52EV.js";
+import "./chunk-FMP3P2WV.js";
+import "./chunk-CVKCVHS7.js";
+import "./chunk-HP5UZCXP.js";
+export {
+  startWebServer
+};