tokmon 0.28.0 → 0.28.2

package/README.md

@@ -105,7 +105,7 @@ tokmon serve --port 8080
 tokmon serve --no-open  # don't auto-open the browser
 ```
 
-It binds to `127.0.0.1` by default and reads the same local daemon state — nothing leaves your machine. The browser connects directly over a same-origin WebSocket; dashboard URLs have no token or login step. Optional LAN access can be enabled in settings, with an explicit unsafe-access warning, and takes effect after the daemon restarts. The dashboard renders instantly from a cached snapshot, then streams live updates and goes idle when no tab is open. Press `R` or use the visible **Refresh** control to update it. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
+It binds to `127.0.0.1` by default and reads the same local daemon state — nothing leaves your machine. The browser connects directly over a same-origin WebSocket; dashboard URLs have no token or login step. Optional LAN access can be enabled in settings, with an explicit unsafe-access warning, and takes effect after the daemon restarts. When publishing the dashboard through an ingress or reverse proxy, add each exact DNS name to **Allowed hosts** in settings (for example, `tokmon.example.com`); IP hosts remain allowed in LAN mode. The dashboard renders instantly from a cached snapshot, then streams live updates and goes idle when no tab is open. Press `R` or use the visible **Refresh** control to update it. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
 
 ### Overview
 

package/dist/{bootstrap-ink-5LQMSU4B.js → bootstrap-ink-IMT3S5HU.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   createDaemonRpcClient
-} from "./chunk-QOA6KOJQ.js";
+} from "./chunk-M7XMV36F.js";
 import {
   accountsByProvider,
   buildAccounts,
   fetchPeak,
   modelColor
-} from "./chunk-KCY53RUE.js";
+} from "./chunk-44ZSQEOS.js";
 import {
   PROVIDERS,
   PROVIDER_ORDER,
@@ -24,7 +24,8 @@ import {
   time,
   tokens,
   withTimeout
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-LCAHTRGP.js";
+import "./chunk-WUK3MQUB.js";
 import {
   COLOR_PALETTE,
   DEFAULTS,
@@ -33,13 +34,14 @@ import {
   getTrackedAccountRows,
   isValidTimezone,
   loadConfig,
+  normalizeAllowedHost,
   normalizeConfig,
   pickAccentColor,
   redactEmail,
   sanitizeTyped,
   saveConfigSync,
   snapshotCacheFile
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 import {
   glyphs
 } from "./chunk-RF4GGQGM.js";
@@ -589,7 +591,7 @@ import { Box as Box4, Text as Text4 } from "ink";
 import { memo as memo3 } from "react";
 import { Box as Box3, Text as Text3 } from "ink";
 import { Fragment as Fragment2, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
-var GENERAL_ROWS = 10;
+var GENERAL_ROWS = 11;
 var SETTINGS_TABS = ["general", "providers", "accounts"];
 var SETTINGS_TAB_LABELS = {
   general: "General",
@@ -604,6 +606,9 @@ var SettingsView = memo3(function SettingsView2({
   tzEdit,
   tzCaret,
   tzError,
+  allowedHostsEdit,
+  allowedHostsCaret,
+  allowedHostsError,
   resolvedTz,
   accountForm,
   activeAccountId,
@@ -612,6 +617,7 @@ var SettingsView = memo3(function SettingsView2({
 }) {
   if (accountForm) return /* @__PURE__ */ jsx3(AccountFormView, { form: accountForm, accounts: config.accounts });
   const editingTz = tzEdit !== null;
+  const editingAllowedHosts = allowedHostsEdit !== null;
   const tzDisplay = config.timezone === null ? `System (${resolvedTz})` : config.timezone;
   const tabFocused = cursor < 0;
   return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", marginTop: 1, children: [
@@ -685,8 +691,17 @@ var SettingsView = memo3(function SettingsView2({
         ] })
       ] }),
       /* @__PURE__ */ jsx3(Row, { cursor, idx: 8, label: "Network access", children: /* @__PURE__ */ jsx3(Text3, { bold: true, color: config.allowNetworkAccess ? "red" : "green", children: config.allowNetworkAccess ? "LAN (unsafe)" : "local only" }) }),
+      /* @__PURE__ */ jsx3(Row, { cursor, idx: 9, label: "Allowed hosts", children: editingAllowedHosts ? /* @__PURE__ */ jsxs3(Fragment2, { children: [
+        /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "[" }),
+        /* @__PURE__ */ jsx3(CaretText, { value: allowedHostsEdit ?? "", caret: allowedHostsCaret, color: "cyan" }),
+        /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "]" })
+      ] }) : /* @__PURE__ */ jsx3(Text3, { bold: true, color: "yellow", children: config.allowedHosts.join(", ") || "none" }) }),
+      cursor === 9 && allowedHostsError && /* @__PURE__ */ jsxs3(Text3, { color: "red", children: [
+        "  ",
+        allowedHostsError
+      ] }),
       config.allowNetworkAccess && /* @__PURE__ */ jsx3(Text3, { color: "red", children: "  Warning: dashboard data and settings will be exposed to your local network after daemon restart." }),
-      /* @__PURE__ */ jsxs3(Row, { cursor, idx: 9, label: "Reset times", children: [
+      /* @__PURE__ */ jsxs3(Row, { cursor, idx: 10, label: "Reset times", children: [
         /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
           glyphs().caretL,
           " "
@@ -779,6 +794,12 @@ var SettingsView = memo3(function SettingsView2({
       " Enter save ",
       glyphs().middot,
       " Esc cancel"
+    ] }) : editingAllowedHosts ? /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
+      "comma-separated exact DNS names ",
+      glyphs().middot,
+      " Enter save ",
+      glyphs().middot,
+      " Esc cancel"
     ] }) : activeTab === "providers" ? /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
       glyphs().arrowU,
       glyphs().arrowD,
@@ -1992,6 +2013,56 @@ function handleTimezoneEditor(input, key, editor, text, updateConfig) {
     if (clean) text.insert(clean);
   }
 }
+function handleAllowedHostsEditor(input, key, editor, text, updateConfig) {
+  const { value, setValue, setError, setCaret, valueRef, caretRef } = editor;
+  if (value === null) return;
+  if (key.escape) {
+    setValue(null);
+    setError(null);
+    return;
+  }
+  if (key.return) {
+    const parts = value.split(",").map((part) => part.trim()).filter(Boolean);
+    const normalized = parts.map(normalizeAllowedHost);
+    if (normalized.some((host) => host === null)) {
+      setError("Use exact DNS names without a scheme, port, path, or wildcard");
+      return;
+    }
+    updateConfig((config) => ({ ...config, allowedHosts: [...new Set(normalized)] }));
+    setValue(null);
+    setError(null);
+    return;
+  }
+  if (key.leftArrow) {
+    setCaret((caret) => clampCaret(caret - 1, value.length));
+    return;
+  }
+  if (key.rightArrow) {
+    setCaret((caret) => clampCaret(caret + 1, value.length));
+    return;
+  }
+  if (key.ctrl && input === "a") {
+    setCaret(0);
+    return;
+  }
+  if (key.ctrl && input === "e") {
+    setCaret(value.length);
+    return;
+  }
+  if (key.backspace || key.delete) {
+    const result = spliceBackspace(valueRef.current, caretRef.current);
+    valueRef.current = result.value;
+    caretRef.current = result.caret;
+    setValue(result.value);
+    setCaret(result.caret);
+    setError(null);
+    return;
+  }
+  if (text.isPrintable(input, key)) {
+    const clean = sanitizeTyped(input);
+    if (clean) text.insert(clean);
+  }
+}
 function handleSearchEditor(input, key, table, text) {
   const { search, setSearch, setSearchMode, setSearchCaret, searchValueRef, searchCaretRef } = table;
   if (key.return || key.escape) {
@@ -2064,6 +2135,8 @@ function handleSettings(input, key, ctx) {
     setCursor(-1);
     timezoneEditor.setValue(null);
     timezoneEditor.setError(null);
+    ctx.allowedHostsEditor.setValue(null);
+    ctx.allowedHostsEditor.setError(null);
   };
   const rowCount = tab === "general" ? GENERAL_ROWS : tab === "providers" ? PROVIDER_ORDER.length : trackedAccounts.length + 1;
   if (key.tab) {
@@ -2194,7 +2267,14 @@ function handleSettings(input, key, ctx) {
       updateConfig((current) => ({ ...current, allowNetworkAccess: !current.allowNetworkAccess }));
       return;
     }
-    if (index === 9 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
+    if (index === 9 && inputKey.return) {
+      const initial = config.allowedHosts.join(", ");
+      context.allowedHostsEditor.setValue(initial);
+      context.allowedHostsEditor.setCaret(initial.length);
+      context.allowedHostsEditor.setError(null);
+      return;
+    }
+    if (index === 10 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
       updateConfig((current) => ({ ...current, resetDisplay: current.resetDisplay === "relative" ? "absolute" : "relative" }));
     }
   }
@@ -2357,7 +2437,7 @@ function handleTerminalFocusInput(input) {
   return true;
 }
 function isRefreshAllShortcut(input, mode) {
-  return (input === "r" || input === "R") && !mode.unavailable && !mode.showPicker && !mode.editingAccount && !mode.editingTimezone && !mode.editingSearch;
+  return (input === "r" || input === "R") && !mode.unavailable && !mode.showPicker && !mode.editingAccount && !mode.editingTimezone && !mode.editingAllowedHosts && !mode.editingSearch;
 }
 function handleOnboarding(input, key, ctx) {
   const { onboarding, global } = ctx;
@@ -2386,11 +2466,13 @@ function handleOnboarding(input, key, ctx) {
 function handleKey(input, key, ctx) {
   const editingAccount = ctx.settings.show && ctx.accountEditor.form !== null;
   const editingTimezone = ctx.settings.show && ctx.timezoneEditor.value !== null;
+  const editingAllowedHosts = ctx.settings.show && ctx.allowedHostsEditor.value !== null;
   const editingSearch = ctx.table.tab === 1 && ctx.table.searchMode;
   if (isRefreshAllShortcut(input, {
     showPicker: ctx.onboarding.show,
     editingAccount,
     editingTimezone,
+    editingAllowedHosts,
     editingSearch,
     unavailable: !ctx.global.configReady
   })) {
@@ -2409,6 +2491,10 @@ function handleKey(input, key, ctx) {
     handleTimezoneEditor(input, key, ctx.timezoneEditor, ctx.textInput, ctx.global.updateConfig);
     return;
   }
+  if (editingAllowedHosts) {
+    handleAllowedHostsEditor(input, key, ctx.allowedHostsEditor, ctx.textInput, ctx.global.updateConfig);
+    return;
+  }
   if (editingSearch) {
     handleSearchEditor(input, key, ctx.table, ctx.textInput);
     return;
@@ -3142,6 +3228,9 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   const [tzEdit, setTzEdit] = useState10(null);
   const [tzError, setTzError] = useState10(null);
   const [tzCaret, setTzCaret] = useState10(0);
+  const [allowedHostsEdit, setAllowedHostsEdit] = useState10(null);
+  const [allowedHostsError, setAllowedHostsError] = useState10(null);
+  const [allowedHostsCaret, setAllowedHostsCaret] = useState10(0);
   const [searchCaret, setSearchCaret] = useState10(0);
   const [onboardSel, setOnboardSel] = useState10(null);
   const [onboardCursor, setOnboardCursor] = useState10(0);
@@ -3169,6 +3258,8 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   const dashPageCountRef = useRef8(1);
   const tzValueRef = useRef8("");
   const tzCaretRef = useRef8(0);
+  const allowedHostsValueRef = useRef8("");
+  const allowedHostsCaretRef = useRef8(0);
   const searchValueRef = useRef8("");
   const searchCaretRef = useRef8(0);
   const accountsKey = useMemo2(() => accounts.map(acctKey).join("|"), [accounts]);
@@ -3274,6 +3365,8 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   dashPageCountRef.current = dashPageCount;
   tzValueRef.current = tzEdit ?? "";
   tzCaretRef.current = clampCaret(tzCaret, (tzEdit ?? "").length);
+  allowedHostsValueRef.current = allowedHostsEdit ?? "";
+  allowedHostsCaretRef.current = clampCaret(allowedHostsCaret, (allowedHostsEdit ?? "").length);
   searchValueRef.current = search;
   searchCaretRef.current = clampCaret(searchCaret, search.length);
   const isPrintable = (input, key) => !!input && !key.ctrl && !key.meta && !isPasteInput(input);
@@ -3291,6 +3384,13 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
       setTzEdit(r.value);
       setTzCaret(r.caret);
       setTzError(null);
+    } else if (showSettings && allowedHostsEdit !== null) {
+      const r = spliceInsert(allowedHostsValueRef.current, allowedHostsCaretRef.current, text);
+      allowedHostsValueRef.current = r.value;
+      allowedHostsCaretRef.current = r.caret;
+      setAllowedHostsEdit(r.value);
+      setAllowedHostsCaret(r.caret);
+      setAllowedHostsError(null);
     } else if (tab === 1 && searchMode) {
       const r = spliceInsert(searchValueRef.current, searchCaretRef.current, text);
       searchValueRef.current = r.value;
@@ -3461,7 +3561,7 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
     if (webStartingRef.current) return;
     webStartingRef.current = true;
     try {
-      const { startWebServer } = await import("./server-BJOXAGRI.js");
+      const { startWebServer } = await import("./server-GXXOWUVZ.js");
       const ctrl = await startWebServer({ config: cfg, log: false });
       webRef.current = ctrl;
       openUrl(ctrl.url);
@@ -3535,6 +3635,14 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
         valueRef: tzValueRef,
         caretRef: tzCaretRef
       },
+      allowedHostsEditor: {
+        value: allowedHostsEdit,
+        setValue: setAllowedHostsEdit,
+        setError: setAllowedHostsError,
+        setCaret: setAllowedHostsCaret,
+        valueRef: allowedHostsValueRef,
+        caretRef: allowedHostsCaretRef
+      },
       textInput: { isPrintable, insert: insertText },
       settings: {
         show: showSettings,
@@ -3674,6 +3782,9 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
         tzEdit,
         tzCaret,
         tzError,
+        allowedHostsEdit,
+        allowedHostsCaret,
+        allowedHostsError,
         resolvedTz: tz,
         accountForm,
         activeAccountId: cfg.activeAccountId,

package/dist/{chunk-KCY53RUE.js → chunk-44ZSQEOS.js}

@@ -5,11 +5,11 @@ import {
   identityFromIdToken,
   readClaudeIdentity,
   readJson
-} from "./chunk-IWKSA64G.js";
+} from "./chunk-LCAHTRGP.js";
 import {
   expandHome,
   slugify
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/accounts.ts
 import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "fs";

package/dist/{chunk-JK3U54G7.js → chunk-6ZEW2M6P.js}

@@ -1,28 +1,23 @@
 #!/usr/bin/env node
-import {
-  appVersion,
-  findWebRoot,
-  send,
-  sendJson,
-  serveStatic
-} from "./chunk-SMPY52EV.js";
 import {
   buildAccounts,
   colorHex,
   fetchPeak,
   namedHex
-} from "./chunk-KCY53RUE.js";
+} from "./chunk-44ZSQEOS.js";
 import {
   PROVIDERS,
+  detectProviders,
+  resolveTimezone,
+  withTimeout
+} from "./chunk-LCAHTRGP.js";
+import {
   TOKMON_CAPABILITIES,
   TOKMON_PROTOCOL_VERSION,
   TOKMON_WS_METHODS,
   TOKMON_WS_PATH,
-  TokmonRpcGroup,
-  detectProviders,
-  resolveTimezone,
-  withTimeout
-} from "./chunk-IWKSA64G.js";
+  TokmonRpcGroup
+} from "./chunk-WUK3MQUB.js";
 import {
   cacheDir,
   expandHome,
@@ -30,7 +25,7 @@ import {
   normalizeConfig,
   saveConfig,
   snapshotCacheFile
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/web/server.ts
 import { createServer } from "http";
@@ -118,11 +113,127 @@ function tzFor(config) {
   return resolveTimezone(config.timezone);
 }
 
+// src/web/static.ts
+import { createReadStream, existsSync, readFileSync } from "fs";
+import { stat } from "fs/promises";
+import { fileURLToPath } from "url";
+import { extname, join, normalize, sep } from "path";
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".map": "application/json; charset=utf-8",
+  ".webmanifest": "application/manifest+json"
+};
+function findWebRoot() {
+  const candidates = ["./web/", "../web/", "../dist/web/", "../../dist/web/"];
+  for (const rel of candidates) {
+    try {
+      const dir = fileURLToPath(new URL(rel, import.meta.url));
+      if (existsSync(join(dir, "index.html"))) return dir.replace(/[\\/]+$/, "");
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveStaticPath(webRoot, urlPath) {
+  let clean;
+  try {
+    clean = decodeURIComponent(urlPath.split("?")[0]);
+  } catch {
+    return null;
+  }
+  const rel = normalize(clean).replace(/^(\.\.[/\\])+/, "").replace(/^[/\\]+/, "");
+  const full = join(webRoot, rel);
+  if (full !== webRoot && !full.startsWith(webRoot + sep)) return null;
+  return full;
+}
+function send(res, status, type, body) {
+  res.writeHead(status, {
+    "Content-Type": type,
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+    "X-Content-Type-Options": "nosniff"
+  });
+  res.end(body);
+}
+function sendJson(res, status, data) {
+  send(res, status, "application/json; charset=utf-8", JSON.stringify(data));
+}
+function serveStatic(webRoot, urlPath, res) {
+  const path = urlPath.split("?")[0];
+  const filePath = resolveStaticPath(webRoot, path === "/" ? "/index.html" : path);
+  if (!filePath) {
+    send(res, 403, "text/plain", "forbidden");
+    return;
+  }
+  void stat(filePath).then((st) => {
+    if (st.isFile()) {
+      const type = MIME[extname(filePath).toLowerCase()] || "application/octet-stream";
+      const immutable = filePath.includes(`${sep}assets${sep}`);
+      res.writeHead(200, {
+        "Content-Type": type,
+        "Cache-Control": immutable ? "public, max-age=31536000, immutable" : "no-cache",
+        "Referrer-Policy": "no-referrer",
+        "X-Content-Type-Options": "nosniff"
+      });
+      createReadStream(filePath).pipe(res);
+    } else {
+      throw new Error("not a file");
+    }
+  }).catch(() => {
+    if (extname(path)) {
+      send(res, 404, "text/plain", "not found");
+      return;
+    }
+    const indexPath = join(webRoot, "index.html");
+    if (!existsSync(indexPath)) {
+      send(res, 404, "text/plain", "not found");
+      return;
+    }
+    res.writeHead(200, {
+      "Content-Type": MIME[".html"],
+      "Cache-Control": "no-cache",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff"
+    });
+    createReadStream(indexPath).on("error", () => {
+      try {
+        res.destroy();
+      } catch {
+      }
+    }).pipe(res);
+  });
+}
+function appVersion() {
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const p = fileURLToPath(new URL(rel, import.meta.url));
+      const pkg = JSON.parse(readFileSync(p, "utf-8"));
+      if (typeof pkg.version === "string") return pkg.version;
+    } catch {
+    }
+  }
+  return "";
+}
+
 // src/web/vite-dev.ts
-import { existsSync } from "fs";
-import { fileURLToPath, pathToFileURL } from "url";
+import { existsSync as existsSync2 } from "fs";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 import { createRequire } from "module";
-import { join } from "path";
+import { join as join2 } from "path";
 function isDevMode() {
   const forced = process.env.TOKMON_WEB_MODE;
   if (forced === "dev") return true;
@@ -132,8 +243,8 @@ function isDevMode() {
 function findWebSource() {
   for (const rel of ["../../web/", "../web/", "./web/"]) {
     try {
-      const dir = fileURLToPath(new URL(rel, import.meta.url));
-      if (existsSync(join(dir, "vite.config.ts")) && existsSync(join(dir, "index.html"))) {
+      const dir = fileURLToPath2(new URL(rel, import.meta.url));
+      if (existsSync2(join2(dir, "vite.config.ts")) && existsSync2(join2(dir, "index.html"))) {
         return dir.replace(/[\\/]+$/, "");
       }
     } catch {
@@ -148,12 +259,12 @@ async function createViteDevServer(httpServer, log) {
     return null;
   }
   try {
-    const req = createRequire(pathToFileURL(join(root, "package.json")).href);
+    const req = createRequire(pathToFileURL(join2(root, "package.json")).href);
     const vitePath = req.resolve("vite");
     const vite = await import(pathToFileURL(vitePath).href);
     const dev = await vite.createServer({
       root,
-      configFile: join(root, "vite.config.ts"),
+      configFile: join2(root, "vite.config.ts"),
       server: { middlewareMode: true, hmr: { server: httpServer } },
       appType: "spa",
       clearScreen: false,
@@ -177,7 +288,7 @@ code{color:#e6b450}</style></head><body>
 </body></html>`;
 
 // src/web/data-engine.ts
-import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, renameSync } from "fs";
 
 // src/web/refresh-queue.ts
 function deferred() {
@@ -335,7 +446,7 @@ function createDataEngine(opts) {
   });
   const hydrateFromCache = () => {
     try {
-      const cached = JSON.parse(readFileSync(snapshotCacheFile(), "utf-8"));
+      const cached = JSON.parse(readFileSync2(snapshotCacheFile(), "utf-8"));
       if (!cached || !Array.isArray(cached.accounts)) return;
       for (const a of cached.accounts) {
         if (a.dashboard || a.table) {
@@ -703,11 +814,11 @@ import { Effect, Exit, Layer, Queue, Scope, Stream } from "effect";
 import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
 
 // src/web/fs.ts
-import { readdir, stat, realpath } from "fs/promises";
+import { readdir, stat as stat2, realpath } from "fs/promises";
 import { homedir } from "os";
-import { join as join2, resolve as resolvePath, isAbsolute, sep } from "path";
+import { join as join3, resolve as resolvePath, isAbsolute, sep as sep2 } from "path";
 function isContained(root, target) {
-  return target === root || target.startsWith(root + sep);
+  return target === root || target.startsWith(root + sep2);
 }
 function parentFor(root, abs) {
   const parentResolved = resolvePath(abs, "..");
@@ -727,7 +838,7 @@ async function listHomeDirectory(rawPath) {
   const abs = isContained(root, real) ? real : root;
   let st;
   try {
-    st = await stat(abs);
+    st = await stat2(abs);
   } catch {
     return { path: abs, parent: parentFor(root, abs), entries: [] };
   }
@@ -742,7 +853,7 @@ async function listHomeDirectory(rawPath) {
   for (const d of dirents) {
     if (d.name.startsWith(".")) continue;
     let dir = d.isDirectory();
-    const full = join2(abs, d.name);
+    const full = join3(abs, d.name);
     if (d.isSymbolicLink()) {
       let real2;
       try {
@@ -752,7 +863,7 @@ async function listHomeDirectory(rawPath) {
       }
       if (!isContained(root, real2)) continue;
       try {
-        dir = (await stat(full)).isDirectory();
+        dir = (await stat2(full)).isDirectory();
       } catch {
         continue;
       }
@@ -783,11 +894,11 @@ function isLoopbackHostHeader(value) {
   const hostname = hostnameFromHost(value);
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }
-function isAllowedHostHeader(value, allowNetworkAccess) {
+function isAllowedHostHeader(value, allowNetworkAccess, allowedHosts = []) {
   if (isLoopbackHostHeader(value)) return true;
   if (!allowNetworkAccess) return false;
   const hostname = hostnameFromHost(value);
-  return hostname !== null && isIP(hostname) !== 0;
+  return hostname !== null && (isIP(hostname) !== 0 || allowedHosts.includes(hostname));
 }
 function isSameOriginRequest(req) {
   const origin = header(req, "origin");
@@ -801,8 +912,8 @@ function isSameOriginRequest(req) {
     return false;
   }
 }
-function isAllowedLocalRequest(req, allowNetworkAccess) {
-  return isAllowedHostHeader(header(req, "host"), allowNetworkAccess) && isSameOriginRequest(req);
+function isAllowedLocalRequest(req, allowNetworkAccess, allowedHosts = []) {
+  return isAllowedHostHeader(header(req, "host"), allowNetworkAccess, allowedHosts) && isSameOriginRequest(req);
 }
 
 // src/web/ws.ts
@@ -890,7 +1001,7 @@ async function mountWsRpc(server, deps) {
     )
   );
   const onUpgrade = (req, socket, head) => {
-    if (!isAllowedLocalRequest(req, deps.state.config.allowNetworkAccess)) {
+    if (!isAllowedLocalRequest(req, deps.state.config.allowNetworkAccess, deps.state.config.allowedHosts)) {
       rejectUpgrade(socket);
       return;
     }
@@ -945,8 +1056,8 @@ function tokenMatches(given, expected) {
   const token = Buffer.from(expected);
   return actual.length === token.length && timingSafeEqual(actual, token);
 }
-function guardHost(req, res, allowNetworkAccess) {
-  if (isAllowedHostHeader(header2(req, "host"), allowNetworkAccess)) return true;
+function guardHost(req, res, config) {
+  if (isAllowedHostHeader(header2(req, "host"), config.allowNetworkAccess, config.allowedHosts)) return true;
   sendJson(res, 403, { error: "forbidden" });
   return false;
 }
@@ -957,12 +1068,12 @@ function guardSameOrigin(req, res) {
   }
   return true;
 }
-function createRouter(engine, state, vite, webRoot, wsToken, version) {
+function createRouter(engine, state, vite, webRoot, wsToken, version, protocolVersion, capabilities, ownerKind) {
   return (req, res) => {
     const url = req.url || "/";
     const path = url.split("?")[0];
     const method = req.method || "GET";
-    if (!guardHost(req, res, state.config.allowNetworkAccess)) return;
+    if (!guardHost(req, res, state.config)) return;
     if (path === "/api/data") {
       engine.touch();
       sendJson(res, 200, engine.snapshot() ?? { pending: true });
@@ -973,6 +1084,9 @@ function createRouter(engine, state, vite, webRoot, wsToken, version) {
         ok: true,
         ready: engine.snapshot() !== null,
         version,
+        protocolVersion,
+        capabilities,
+        ownerKind,
         // Discovery requires this proof; public health checks retain their useful 200 response.
         owner: tokenMatches(header2(req, "x-tokmon-token"), wsToken)
       });
@@ -1004,6 +1118,9 @@ async function startWebServer(opts) {
   const state = { config: opts.config };
   const tz = tzFor(state.config);
   const version = appVersion();
+  const protocolVersion = opts.protocolVersion ?? TOKMON_PROTOCOL_VERSION;
+  const capabilities = opts.capabilities ?? TOKMON_CAPABILITIES;
+  const ownerKind = opts.ownerKind ?? "cli";
   const summaryIntervalMs = summaryIntervalFor(state.config);
   const billingIntervalMs = billingIntervalFor(state.config);
   const wsToken = opts.wsToken ?? randomBytes(32).toString("base64url");
@@ -1020,7 +1137,17 @@ async function startWebServer(opts) {
     const webRoot = vite ? null : findWebRoot();
     if (!vite && !webRoot) log("  \u26A0 no dashboard available \u2014 see the page for build/dev instructions");
     engine = createDataEngine({ version, config: state.config, tz, summaryIntervalMs, billingIntervalMs, resolved });
-    server.addListener("request", createRouter(engine, state, vite, webRoot, wsToken, version));
+    server.addListener("request", createRouter(
+      engine,
+      state,
+      vite,
+      webRoot,
+      wsToken,
+      version,
+      protocolVersion,
+      capabilities,
+      ownerKind
+    ));
     closeWsRpc = await mountWsRpc(server, { engine, state });
     const bindHost = state.config.allowNetworkAccess ? NETWORK_HOST : LOOPBACK_HOST;
     const port = await listenWithFallback(server, opts.port ?? DEFAULT_PORT, bindHost);
@@ -1116,5 +1243,6 @@ function listenWithFallback(server, startPort, host) {
 }
 
 export {
+  appVersion,
   startWebServer
 };