toolroll 0.9.104 → 0.9.105

package/dist/server/mutation-key.js

@@ -1,39 +1,16 @@
-/**
- * The browser mutation key (easy-start C2, amendment A1): the second factor every browser mutation carries on a
- * protected loopback install, beside the session's CSRF token.
- *
- * Why: cookies are not isolated by port (RFC 6265 §8.5). Any server on another port of this computer receives the
- * session cookie and can read every page, CSRF token included. So on a console that only this computer can reach, a
- * mutation also needs a key that lives only in the browser's storage for the console's own origin
- * (http://127.0.0.1:<port>): 32 random bytes per session, of which the server keeps only a hash and the console start
- * (key epoch) it was issued under. The key is delivered once, in a response that cannot be fetched again (a one-time
- * link, a password sign-in, an identity-provider finish, a password reconnect), by a no-store page whose one nonce'd
- * script writes it to localStorage and moves on. It is never rendered into a page or JSON.
- *
- * The key is bound to the console start (N3): a process that held the port while Toolroll was stopped could read the
- * saved key, so every restart mints a new epoch and every older key reads as "Toolroll restarted — reconnect".
- *
- * A protected loopback install: the console is bound to a loopback address only, with no --allow-host, no public URL
- * and no tailnet names. Everywhere else nothing here applies.
- */
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { html, htmlString, scriptElement } from "../html.js";
 import { HANDOFF_STYLE } from "./http.js";
-/** The request header a fetch carries the key in. */
 export const KEY_HEADER = "x-toolroll-key";
-/** The form field a server-rendered form carries it in (not `key`: forms already use that for idempotency and API keys). */
 export const KEY_FIELD = "toolroll-key";
-/** A terminal socket offers `toolroll` (the protocol the server selects) and `toolroll.key.<key>` (never echoed back). */
 export const KEY_PROTOCOL = "toolroll";
 export const KEY_PROTOCOL_PREFIX = "toolroll.key.";
-/** Where the browser keeps it: `{ epoch, key }` in the console origin's localStorage. */
 export const KEY_STORAGE = "toolroll.key";
 const KEY_SHAPE = /^[0-9a-f]{64}$/;
 export const RESTARTED = "Toolroll restarted — reconnect to make changes.";
-export const RESTARTED_LOCAL = "Toolroll restarted — run `toolroll open` to reconnect.";
+export const RESTARTED_LOCAL = "Toolroll restarted — run `toolroll --web` to reconnect.";
 export const NOT_CONNECTED = "This tab isn't connected to Toolroll — reconnect to make changes.";
-export const NOT_CONNECTED_LOCAL = "This tab isn't connected to Toolroll — run `toolroll open` to reconnect.";
-/** The page a request reads, without the workspace read's own parameters: where a reconnect comes back to. */
+export const NOT_CONNECTED_LOCAL = "This tab isn't connected to Toolroll — run `toolroll --web` to reconnect.";
 export function pagePathOf(url) {
     const page = new URL(url.pathname + url.search, "http://standing-orders.local");
     page.searchParams.delete("format");
@@ -41,8 +18,6 @@ export function pagePathOf(url) {
     return page.pathname + page.search;
 }
 export const keyHashOf = (key) => createHash("sha256").update(key, "utf8").digest("hex");
-/** The one key a request presents (header, form field or socket protocol), or null for none, a malformed one, or two
- * different ones: two keys in one request is a smuggling attempt, never a preference. */
 export function presentedKey(request, body) {
     const found = [];
     const header = request.headers[KEY_HEADER];
@@ -58,14 +33,12 @@ export function presentedKey(request, body) {
             if (one.startsWith(KEY_PROTOCOL_PREFIX))
                 found.push(one.slice(KEY_PROTOCOL_PREFIX.length));
     }
-    // The same key by two roads (a form's field and its fetch's header) is one key; two different keys is none.
     const distinct = [...new Set(found)];
     if (distinct.length !== 1)
         return null;
     const key = distinct[0];
     return KEY_SHAPE.test(key) ? key : null;
 }
-/** Constant-time: the presented key's hash against the session's. */
 export function keyMatches(presented, hash) {
     if (hash === null || !KEY_SHAPE.test(hash))
         return false;
@@ -75,10 +48,9 @@ export function keyMatches(presented, hash) {
 export function createBrowserKeys(deps) {
     const canonicalHost = () => deps.enabled ? deps.protectedHost() : null;
     const required = () => canonicalHost() !== null;
-    // A refused post comes back to Home (its own address may answer only posts); a page's notice, to that page.
     const reconnectOf = (who, back = "/") => who.authority === "full"
         ? { kind: "password", href: back === "/" ? "/login/rekey" : `/login/rekey?return=${encodeURIComponent(back)}` }
-        : { kind: "command", command: "toolroll open" };
+        : { kind: "command", command: "toolroll --web" };
     const stale = (who, back) => {
         if (!required() || who.via !== "cookie")
             return null;
@@ -113,7 +85,6 @@ export function createBrowserKeys(deps) {
         deliver(response, key, to, cookies = []) {
             const nonce = randomBytes(16).toString("base64");
             const target = /^\/(?![/\\])/.test(to) ? to : "/";
-            // JSON inside a script: `<` escaped so nothing in it can close the element.
             const data = JSON.stringify({ storage: KEY_STORAGE, value: JSON.stringify({ epoch: deps.epoch, key }), to: target }).replace(/</g, "\\u003c");
             response.writeHead(200, {
                 "content-type": "text/html; charset=utf-8", "cache-control": "no-store", pragma: "no-cache", "referrer-policy": "no-referrer",
@@ -126,17 +97,9 @@ export function createBrowserKeys(deps) {
         },
     };
 }
-/**
- * Every page that can post, while the key is required: fills the key into each same-origin POST form's data (the
- * `formdata` event fires for a native submit, requestSubmit(), submit() and `new FormData(form)` alike) and offers
- * `window.soKeyHeaders(headers)` to the page's own fetches. It reads nothing on the page and sends the key nowhere but
- * this origin. Without a stored key it does nothing, and the server answers "reconnect".
- */
 export const KEY_FILL_SCRIPT = `(function(){if(window.soKeyHeaders)return;` +
     `function k(){try{var v=JSON.parse(localStorage.getItem(${JSON.stringify(KEY_STORAGE)})||"null");return v&&typeof v.key==="string"&&/^[0-9a-f]{64}$/.test(v.key)?v.key:null}catch(e){return null}}` +
     `window.soKeyHeaders=function(h){h=h||{};var x=k();if(x)h[${JSON.stringify(KEY_HEADER)}]=x;return h};` +
-    // The form's own method and action through HTMLFormElement's getters: a control named "method" or "action" (the
-    // skill form's <select name="method">) shadows f.method / f.action, which would skip the key or misread the target.
     `var P=HTMLFormElement.prototype,G=function(n){return Object.getOwnPropertyDescriptor(P,n).get};var M=G("method"),A=G("action");` +
     `document.addEventListener("formdata",function(e){var f=e.target,m,a;try{m=M.call(f);a=A.call(f)}catch(x){return}if(String(m).toLowerCase()!=="post")return;` +
     `try{if(new URL(a,location.href).origin!==location.origin)return}catch(x){return}var x=k();if(x)e.formData.set(${JSON.stringify(KEY_FIELD)},x)},true);})();`;

package/dist/server/pages-assets.js

@@ -1,15 +1,9 @@
 import { GEIST_SANS_400, GEIST_SANS_500, GEIST_SANS_600, GEIST_MONO_400, GEIST_MONO_500, GEIST_MONO_600 } from "../fonts.js";
-// ---- the phone (arc 3): install assets, served BEFORE authentication — they
-// contain nothing secret, and a background service-worker update that met a
-// login redirect would fail MIME validation and unregister itself.
 const PWA_ICON_192 = "iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAIAAADdvvtQAAAB1klEQVR42u3bMQ0AIAxFwepgQgD+TSECPJSBQO/nKSA30lhmBwtPYAAZQAaQAWQGkAFkABlAZgAZQPY4oNaHagaQABJAAkgAASSABJAAEkAACSABJIAEEEACSAAJIAEEkAASQAJIAHlHgAASQAJIAAkggASQABJAAgggASSABJAAAkgACSABJIAAAgggASSAss3aAwgggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggORLK0AAASSABJAAEkAACSABJIAEEEACSAAJIAEEkAASQAJIAAEkgASQAHKV4SoDIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAJIfiR6R4AAEkACSAAJIIAEkAASQAIIIAEkgASQAAJIAAkgASSAAAIIIAEkgFxluMoACCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggAACCCCAAAIIIIAAAggggACSH4kCCCABJIAEkAACSAAJIAEkgAASQAJIAAkggASQABJAAggggAASQAJIAAkggASQABJAAgggASSABJAAAkgACSB9BMgMIAPIADKAzAAygAwgA8gAMgPI7mwDbzYVUJcW7UcAAAAASUVORK5CYII=";
 const PWA_ICON_512 = "iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAIAAAB7GkOtAAAJF0lEQVR42u3VwQ0AEBBFQXU4KUD/TW0R3JzcRLJhfqYCwivDzMy+XHEEZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmZgJgZmYCYGZmAmBmJgBmZiYAZmYmAGZmJgBmZiYAZmYmAGZmJgDb1dYBOCEAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACAIAAACAAAAgAAAIAgAAAIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACAIAAACAAAAgAAAIAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIAAACAIAAACAAAAgAAAIAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIAAACAIAAACAAAAgAAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACcF+Y5Z5HKgACIAAmAAgAAmACgAAgACYACAACYAKAACAAJgAIAAJgAoAAIAAmAAgAAmACIAACgP/FBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQABMABAAARAAEwAEAAEwAUAAEAATAAQAATABQAAQABMABAABMAFAABAAEwABEAAEwARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEQADMBEAABEAAzARAAARAAMwEQAAEAEAABABAAAQAQAAAEAAABAAAAQBAAAAQAAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAANwcgAAAIAAACAAAAgCAAAAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIAgAAAIAAACAAAAgCAAAAgAAACIAC/C7Pc80gFQAAEwAQAAUAATAAQAATABAABQABMABAABMAEAAFAAEwAEAAEwAQAAUAATAAEQADwv5gACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgAkAAiAAAmACgAAgACYACAACYAKAACAAJgAIAAJgAoAAIAAmAAgAAmACIAACgACYAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAIgJkACIAACICZAAiAAAiAmQAIgAAACIAAAAiAAAAIAAACAIAAACAAAAgAAAIAgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAmwMQAAAEAAABAEAAABAAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAQAQAAEAEAABABAAAAQAAAEAAABAEAAABAAAASAJcxyzyMVAAEQABMABAABMAFAABAAEwAEAAEwAUAAEAATAAQAATABQAAQABMABAABMAEQAAHA/2ICIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgACYACIAACIAJAAKAAJgAIAAIgAkAAoAAmAAgAAiACQACgACYACAACIAJgAAIAAJgAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIgAGYCIAACIABmAiAAAiAAZgIgAAIAIAACACAAAgAgAAAIAAACAIAAACAAAAgAAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAAgAgAAIAIAACACAAbg5AAAAQAAAEAAABAEAAABAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAAQBAAAAQAAAEAAABAEAAABAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABEAAAARAAAAEQAAABcHkAAgCAAAAgAAAIAAACAIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgAAACIAAAAiAAAAIgJmZPT4BMDMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMxMAMzMTADMzEwAzMwEwMzMBMDMzATAzMwEwMzMBMDOzJzYBVJhD+Nnu218AAAAASUVORK5CYII=";
 const PWA_ICON_APPLE = "iVBORw0KGgoAAAANSUhEUgAAALQAAAC0CAIAAACyr5FlAAABqklEQVR42u3aMQ0AIAxFwepgQgD+TSECFHQiYWjv5ylobmwcs2ThBAaHwWFwGBwGh8FhcBgcBofBkW7MparBITgEh+AQHIJDcAgOwQEHHHDAAYfgEByCQ3AIDsEhOASHI8IBBxxwCA7BITgEh+AQHIJDcAgOOOCAQ3AIDsEhOASH4BAcguNPu9PggAMOOOCAAw444IADDjjggAMOOOCAAw444IADDjjggAMOOOCAAw44PPsIDsEhOASH4BAcgkNwCA444IADDjgEh+AQHIJDcAgOwSE44IDDg7EHYzjggAMOOOCAAw444IADDjjggAMOOOCAAw444IADDjjggAMOOOCAAw559hEcgkNwwAEHHHDAITgEh+AQHIJDcAgOwQEHHHDAAYfgEByCQ3B4MIYDDjjggAMOOOCAAw444IADDjjggAMOOOCAAw444IADDjjggAMOOODw7OPZBw7BITgEh+AQHIJDcAgOOOCAAw44BIfgEByCQ3AIDsEhOAQHHHDAITgEh+AQHIJDcAgOwSE44IADDjgecVjbwWFwGBwGh8FhcBgcBofBYeV3AaohX51oqNRKAAAAAElFTkSuQmCC";
 const PWA_ICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><rect x="6" y="6" width="88" height="88" rx="14" fill="#1a202c"/><rect x="28" y="28" width="44" height="8" rx="4" fill="#ebebeb"/><rect x="28" y="47" width="44" height="8" rx="4" fill="#ebebeb"/><rect x="28" y="66" width="44" height="8" rx="4" fill="#ebebeb"/></svg>`;
-/** The icon with the attention dot (cockpit §3): a tab whose reader has something waiting shows it. Same origin, so
- * the page's img-src 'self' allows it; nothing about the reader rides the asset. */
 const PWA_ICON_ATTENTION_SVG = PWA_ICON_SVG.replace("</svg>", `<circle cx="78" cy="22" r="20" fill="#bb2649" stroke="#ffffff" stroke-width="6"/></svg>`);
-/** The typefaces by route: exact names only, served pre-auth like the icons. */
 const FONT_FILES = {
     "/fonts/geist-sans-400.woff2": GEIST_SANS_400,
     "/fonts/geist-sans-500.woff2": GEIST_SANS_500,
@@ -33,11 +27,6 @@ const PWA_MANIFEST = JSON.stringify({
         { src: "/icon.svg", sizes: "any", type: "image/svg+xml" },
     ],
 });
-// The service worker, DELIBERATELY MINIMAL: no fetch handler — no cache, no
-// offline copy of authenticated pages, nothing intercepting requests. Push
-// and the tap, only. notificationclick resolves ONLY allow-listed relative
-// paths — the payload URL is data, revalidated, never handed raw to the
-// browser (arc 3 finding 5).
 export const PWA_WORKER = `// Toolroll — push only; deliberately NO fetch handler (no offline cache of an authenticated console).
 // Every shape an older worker took, kept for good, then Home, Tasks' Ready and Board views and a task by its number.
 const SHAPES = [/^\\/next$/, /^\\/review$/, /^\\/system$/, /^\\/routines$/, /^\\/routines\\/[0-9]+$/, /^\\/d\\/[0-9]+$/, /^\\/r\\/[0-9]+$/, /^\\/approve\\/[0-9]+$/,
@@ -74,10 +63,6 @@ self.addEventListener("notificationclick", function (event) {
   }));
 });
 `;
-/**
- * Answers one install asset or typeface (GET only; the caller checks the method), with nosniff and its own
- * conservative caching/CSP. False for any other path: unknown names fall through to the router's refusal.
- */
 export function serveInstallAsset(response, pathname, respond) {
     const asset = (type, body, csp) => {
         response.setHeader("x-content-type-options", "nosniff");
@@ -103,7 +88,6 @@ export function serveInstallAsset(response, pathname, respond) {
         return asset("image/png", Buffer.from(PWA_ICON_APPLE, "base64"));
     if (pathname === "/sw.js")
         return asset("text/javascript; charset=utf-8", PWA_WORKER, "default-src 'none'");
-    // The typefaces: exact-allowlisted like the icons — nothing dynamic rides the path.
     const font = FONT_FILES[pathname];
     if (font !== undefined)
         return asset("font/woff2", Buffer.from(font, "base64"));