waterplane 0.0.1 → 0.1.6

package/packages/host/dist/optins.js

@@ -0,0 +1,252 @@
+/**
+ * **Opt-ins, as this desktop can see them** — one row per offer in the shared
+ * catalog (`OPT_INS`), answering "is this already on in this repo?".
+ *
+ * Offers are NOT findings. A repo without a pre-push hook is not broken, so
+ * nothing here touches `compliance.ts`'s checks, the setup badge, `summarize()`
+ * or `ComplianceCheck`; `inspectRepo` neither calls this nor learns of it.
+ *
+ * **Probes are filesystem + local git, cheap and bounded, and never paid:** no
+ * network, no model, no gcloud, no spawning the repo's own code. Each `detail`
+ * is one sentence naming what was read. A probe that cannot read answers
+ * `unknown` with the reason — never a guessed on/off. `gcp-cleanup` is always
+ * `unknown`: the registry's policy lives in the cloud and this desktop cannot
+ * see it; the person's own word (`choice: "done"`) is how it is closed.
+ *
+ * The person's word (`declined` / `done`) is stored apart in `setupprefs.ts`
+ * and only STAMPED onto the row here; it never changes `state`.
+ *
+ * `security-review` needs the intent store, which this module must not import:
+ * the route hands in `standingPrompts`. `requirements` asks the plugin registry
+ * through `setupcontrib.ts` whether its fix is registered.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { OPT_INS, REPOHEALTH_OWN_FILE, isStandingSchedule, optInMarker, ruleRecurs } from "@waterplane/shared";
+import { isAndroidRepo } from "./androidenv.js";
+import { repoSharedDir } from "./branddirs.js";
+import { captureTargetCount } from "./compliance.js";
+import { seriesPathOf } from "./healthwatch.js";
+import { contributedFixIds } from "./plugins/setupcontrib.js";
+import { canReadRepoHealth } from "./repohealth.js";
+import { optInChoices } from "./setupprefs.js";
+const FILE_CAP = 256 * 1024;
+const SCAN_FILES = 50;
+function read(p) {
+    try {
+        if (statSync(p).size > FILE_CAP)
+            return null;
+        return readFileSync(p, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function git(wt, args) {
+    try {
+        return execFileSync("git", args, { cwd: wt, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000 }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+const isGitRepo = (wt) => git(wt, ["rev-parse", "--git-dir"]) !== null;
+function unfit(detail) { return { relevant: false, state: "off", detail }; }
+function requirements(wt, deps) {
+    const ids = (deps.fixIds ?? contributedFixIds)();
+    if (!ids.includes("requirements"))
+        return unfit("The requirements extension is not loaded on this desktop, so the offer cannot be set up.");
+    // The extension's own "set up" rule (`isSetUp`): its skill file or its build state.
+    const skill = ".claude/skills/requirements/SKILL.md";
+    const state = "docs/requirements/.state.json";
+    if (existsSync(join(wt, skill)))
+        return { relevant: true, state: "on", detail: `${skill} exists.` };
+    if (existsSync(join(wt, state)))
+        return { relevant: true, state: "on", detail: `${state} exists.` };
+    return { relevant: true, state: "off", detail: `Neither ${skill} nor ${state} exists.` };
+}
+function repoHealth(wt) {
+    if (!canReadRepoHealth(wt))
+        return unfit("No repo-health engine is available for this repo on this desktop.");
+    const p = seriesPathOf(wt);
+    return p
+        ? { relevant: true, state: "on", detail: `A measured series exists (${p.slice(wt.length + 1)}).` }
+        : { relevant: true, state: "off", detail: "No series file has been written yet; nothing has been measured." };
+}
+function repoHealthOwn(wt) {
+    if (!canReadRepoHealth(wt))
+        return unfit("No repo-health engine is available for this repo on this desktop.");
+    const rel = REPOHEALTH_OWN_FILE;
+    const onDisk = existsSync(join(repoSharedDir(wt), "health.json"));
+    const committed = git(wt, ["show", `HEAD:${rel}`]);
+    if (committed === null) {
+        if (!isGitRepo(wt))
+            return { relevant: true, state: "unknown", detail: `${rel} could not be read from git: this is not a git repo.` };
+        return onDisk
+            ? { relevant: true, state: "off", detail: `${rel} is written but not committed, and only committed readings run.` }
+            : { relevant: true, state: "off", detail: `${rel} does not exist at HEAD.` };
+    }
+    try {
+        const o = JSON.parse(committed);
+        if (Array.isArray(o?.readings) && o.readings.length > 0) {
+            return { relevant: true, state: "on", detail: `${rel} is committed at HEAD with ${o.readings.length} reading${o.readings.length === 1 ? "" : "s"}.` };
+        }
+        return { relevant: true, state: "off", detail: `${rel} is committed at HEAD but declares no readings.` };
+    }
+    catch {
+        return { relevant: true, state: "unknown", detail: `${rel} at HEAD is not valid JSON, so its readings could not be counted.` };
+    }
+}
+function securityReview(wt, deps) {
+    const marker = optInMarker("security-review");
+    const prompts = deps.standingPrompts(wt);
+    if (prompts === null)
+        return { relevant: true, state: "unknown", detail: "The schedule store could not be read, so a standing review could not be looked for." };
+    return prompts.some((t) => t.includes(marker))
+        ? { relevant: true, state: "on", detail: "A recurring schedule in this repo carries the security-review marker." }
+        : { relevant: true, state: "off", detail: "No recurring schedule in this repo carries the security-review marker." };
+}
+function localCi(wt) {
+    if (!isGitRepo(wt))
+        return unfit("This is not a git repo, so there is no push to check.");
+    const hooksPath = git(wt, ["config", "core.hooksPath"]);
+    if (hooksPath) {
+        const dir = hooksPath.startsWith("/") ? hooksPath : join(wt, hooksPath);
+        if (existsSync(join(dir, "pre-push")))
+            return { relevant: true, state: "on", detail: `core.hooksPath (${hooksPath}) contains a pre-push hook.` };
+    }
+    const gp = git(wt, ["rev-parse", "--git-path", "hooks"]);
+    if (gp && existsSync(join(gp.startsWith("/") ? gp : join(wt, gp), "pre-push"))) {
+        return { relevant: true, state: "on", detail: "The git hooks directory contains a pre-push hook." };
+    }
+    if (existsSync(join(wt, ".husky", "pre-push")))
+        return { relevant: true, state: "on", detail: ".husky/pre-push exists." };
+    for (const f of ["lefthook.yml", "lefthook.yaml"]) {
+        if ((read(join(wt, f)) ?? "").includes("pre-push"))
+            return { relevant: true, state: "on", detail: `${f} configures a pre-push hook.` };
+    }
+    if ((read(join(wt, ".pre-commit-config.yaml")) ?? "").includes("pre-push")) {
+        return { relevant: true, state: "on", detail: ".pre-commit-config.yaml mentions pre-push." };
+    }
+    return { relevant: true, state: "off", detail: "No pre-push hook found in the git hooks, .husky, lefthook or pre-commit config." };
+}
+function npmSupplyChain(wt) {
+    if (!existsSync(join(wt, "package.json")))
+        return unfit("There is no package.json at the root.");
+    const rc = read(join(wt, ".npmrc"));
+    if (rc === null)
+        return { relevant: true, state: "off", detail: existsSync(join(wt, ".npmrc")) ? ".npmrc is too large to read." : "There is no root .npmrc." };
+    const lines = rc.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !l.startsWith("#") && !l.startsWith(";"));
+    const val = (k) => {
+        for (const l of lines) {
+            const m = /^([^=\s]+)\s*=\s*(.*)$/.exec(l);
+            if (m && m[1].replace(/_/g, "-") === k)
+                return m[2].trim();
+        }
+        return null;
+    };
+    const scripts = val("ignore-scripts") === "true";
+    const age = val("min-release-age") !== null;
+    if (scripts && age)
+        return { relevant: true, state: "on", detail: "The root .npmrc sets ignore-scripts=true and min-release-age." };
+    const missing = [!scripts && "ignore-scripts=true", !age && "min-release-age"].filter(Boolean).join(" and ");
+    return { relevant: true, state: "off", detail: `The root .npmrc is missing ${missing}.` };
+}
+const DEPLOY_RE = /gcloud\s+(run\s+deploy|builds\s+submit|artifacts)/;
+function gcpCleanup(wt) {
+    const found = [];
+    for (const f of ["cloudbuild.yaml", "cloudbuild.json"])
+        if (existsSync(join(wt, f)))
+            found.push(f);
+    const files = ["package.json", "Makefile"];
+    try {
+        for (const n of readdirSync(join(wt, "scripts"), { withFileTypes: true })) {
+            if (n.isFile() && files.length < SCAN_FILES)
+                files.push(`scripts/${n.name}`);
+        }
+    }
+    catch { /* no scripts dir */ }
+    for (const f of files) {
+        const t = read(join(wt, f));
+        if (t && DEPLOY_RE.test(t))
+            found.push(f);
+    }
+    if (!found.length)
+        return unfit("No sign of a Google Cloud deploy (cloudbuild file, or gcloud run deploy / builds submit in package.json, Makefile or scripts/).");
+    return { relevant: true, state: "unknown", detail: `Deploys to Google Cloud (found in ${found.join(", ")}); this desktop cannot see the registry's cleanup policy, so say when it is done.` };
+}
+const WEB_DEPS = ["vite", "next", "react", "vue", "svelte", "@angular/core"];
+function screenshots(wt) {
+    let web = false;
+    const pkg = read(join(wt, "package.json"));
+    if (pkg) {
+        try {
+            const o = JSON.parse(pkg);
+            const names = Object.keys({ ...(o.dependencies ?? {}), ...(o.devDependencies ?? {}) });
+            web = names.some((n) => WEB_DEPS.includes(n) || n.startsWith("@capacitor/"));
+        }
+        catch { /* unreadable package.json is not a web app */ }
+    }
+    let android = false;
+    try {
+        android = isAndroidRepo(wt);
+    }
+    catch { /* not readable */ }
+    if (!web && !android)
+        return unfit("Neither a web app dependency in package.json nor an Android project was found.");
+    const n = captureTargetCount(wt);
+    return n > 0
+        ? { relevant: true, state: "on", detail: `${n} capture target${n === 1 ? "" : "s"} configured.` }
+        : { relevant: true, state: "off", detail: "No capture targets are configured." };
+}
+/** One row per catalog entry, in catalog order. Never throws: a probe that does becomes `unknown`. */
+export function inspectOptIns(worktree, deps) {
+    const choices = (deps.choices ?? optInChoices)(worktree);
+    const probes = {
+        "requirements": () => requirements(worktree, deps),
+        "repo-health": () => repoHealth(worktree),
+        "repo-health-own": () => repoHealthOwn(worktree),
+        "security-review": () => securityReview(worktree, deps),
+        "local-ci": () => localCi(worktree),
+        "npm-supply-chain": () => npmSupplyChain(worktree),
+        "gcp-cleanup": () => gcpCleanup(worktree),
+        "screenshots": () => screenshots(worktree),
+    };
+    return OPT_INS.map((d) => {
+        let p;
+        try {
+            p = probes[d.id]?.() ?? { relevant: false, state: "unknown", detail: "This desktop has no probe for this offer." };
+        }
+        catch (err) {
+            p = { relevant: true, state: "unknown", detail: `The probe failed: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        const row = { id: d.id, ...p };
+        const c = choices[d.id];
+        if (c)
+            row.choice = c;
+        return row;
+    });
+}
+function realOf(p) { try {
+    return realpathSync(p);
+}
+catch {
+    return p;
+} }
+/** The prompt texts of the live recurring schedules whose cwd is `worktree` — the route's `standingPrompts`. */
+export function standingPromptsOf(intents, worktree, now = Date.now()) {
+    const wt = realOf(worktree);
+    const out = [];
+    for (const i of intents) {
+        if (i.archived || i.payload.kind !== "prompt" || i.trigger.kind !== "at")
+            continue;
+        if (!ruleRecurs(i.trigger.rule) || !isStandingSchedule({ rule: i.trigger.rule, nextAt: i.nextAt, lastOccurrence: i.lastOccurrence }, now))
+            continue;
+        if (realOf(i.cwd) !== wt)
+            continue;
+        out.push(i.payload.steps.join("\n"));
+    }
+    return out;
+}
+//# sourceMappingURL=optins.js.map

package/packages/host/dist/optins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optins.js","sourceRoot":"","sources":["../src/optins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAA+C,MAAM,oBAAoB,CAAC;AAC5J,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAY/C,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC;AAC5B,MAAM,UAAU,GAAG,EAAE,CAAC;AAItB,SAAS,IAAI,CAAC,CAAS;IACrB,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,GAAG,CAAC,EAAU,EAAE,IAAc;IACrC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7H,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,KAAK,IAAI,CAAC;AAE/E,SAAS,KAAK,CAAC,MAAc,IAAW,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAE3F,SAAS,YAAY,CAAC,EAAU,EAAE,IAAe;IAC/C,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC5I,oFAAoF;IACpF,MAAM,KAAK,GAAG,sCAAsC,CAAC;IACrD,MAAM,KAAK,GAAG,+BAA+B,CAAC;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;IACpG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;IACpG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,KAAK,QAAQ,KAAK,UAAU,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC9G,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3B,OAAO,CAAC;QACN,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE;QAClG,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;AAClH,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,mBAAmB,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC;IACnD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,sDAAsD,EAAE,CAAC;QACtI,OAAO,MAAM;YACX,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,iEAAiE,EAAE;YACnH,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,0BAA0B,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA2B,CAAC;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,8BAA8B,CAAC,CAAC,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;QACxJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,iDAAiD,EAAE,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,mEAAmE,EAAE,CAAC;IACjI,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,EAAU,EAAE,IAAe;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,qFAAqF,EAAE,CAAC;IACjK,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,uEAAuE,EAAE;QAClH,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wEAAwE,EAAE,CAAC;AACzH,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,SAAS,6BAA6B,EAAE,CAAC;IACnJ,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1H,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,8BAA8B,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iFAAiF,EAAE,CAAC;AACrI,CAAC;AAED,SAAS,cAAc,CAAC,EAAU;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACjG,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC;IAC/J,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC;IAC5C,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACpI,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,OAAO,GAAG,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,SAAS,GAAG,mDAAmD,CAAC;AAEtE,SAAS,UAAU,CAAC,EAAU;IAC5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;QAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,iIAAiI,CAAC,CAAC;IACnK,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mFAAmF,EAAE,CAAC;AAChM,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;AAE7E,SAAS,WAAW,CAAC,EAAU;IAC7B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0F,CAAC;YACnH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACvF,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QAAC,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACjE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACrH,MAAM,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC;QACV,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE;QACjG,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;AACrF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,IAAe;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,MAAM,GAAgC;QAC1C,cAAc,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;QAClD,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzC,iBAAiB,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC;QAChD,iBAAiB,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC;QACvD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnC,kBAAkB,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QAClD,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzC,aAAa,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC;KAC3C,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAQ,CAAC;QACb,IAAI,CAAC;YAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAAC,CAAC;QAC3H,OAAO,GAAG,EAAE,CAAC;YAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAAC,CAAC;QAC1I,MAAM,GAAG,GAAa,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,IAAY,IAAI,CAAC;IAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,CAAC,CAAC;AAAC,CAAC,CAAC,CAAC;AAE1F,gHAAgH;AAChH,MAAM,UAAU,iBAAiB,CAAC,OAA0B,EAAE,QAAgB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9F,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QACnF,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC;YAAE,SAAS;QACpJ,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE;YAAE,SAAS;QACnC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/packages/host/dist/origin.d.ts

@@ -0,0 +1,86 @@
+export interface OriginConfig {
+    port: number;
+    /** Tailscale IPv4 of this host, if on a tailnet. */
+    tailscaleIp?: string | null;
+    /** MagicDNS name (`mac.tailnet.ts.net`) — the origin under `tailscale serve`. */
+    tailscaleDns?: string | null;
+    /** LAN IPs we actually bound (only under WATERPLANE_ALLOW_PUBLIC=1). */
+    lanIps?: string[];
+    /**
+     * The URL `tailscale serve` actually fronts us with, port and all — the same
+     * value the client gets as `welcome.httpsUrl` (`net.ts` `serveHttpsUrl`).
+     *
+     * Trusting it is not a convenience. `tailscale serve --https=443` claims one
+     * slot on the whole machine, so a host that already serves something else
+     * there ends up fronted on some other port — and this guard only ever trusted
+     * the bound port, 80 and 443. The result was an app that ADVERTISES an HTTPS
+     * front door (the banner, Settings → Connection) and then 403s every `/api`
+     * call made through it, with the WS upgrade closing 1008. Anyone who didn't
+     * find `WATERPLANE_ALLOWED_HOSTS` stayed on plain `http://100.x`, which is not a
+     * secure context — no service worker, so a dropped tunnel during any
+     * navigation replaces the whole app with the browser's error page.
+     *
+     * This is not a widening: the URL comes from OUR OWN serve config, read off
+     * the local tailscaled, and only the listener whose proxy target is our port.
+     */
+    serveUrl?: string | null;
+}
+/** Call once at boot, after the Tailscale IP / DNS name / LAN binds are known. */
+export declare function configureOrigins(cfg: OriginConfig): void;
+/** The `Host` header names something we serve (DNS-rebinding check). */
+export declare function hostHeaderAllowed(hostHeader: string | undefined, proxied?: boolean): boolean;
+/**
+ * The `Origin` header, if present, is one of ours. Absent = allowed (non-browser
+ * client). `null` (sandboxed iframe, file://) is a real value and is refused.
+ */
+export declare function originHeaderAllowed(origin: string | undefined, proxied?: boolean, requestHost?: string): boolean;
+/** Request info the gate needs beyond headers. Absent ⇒ judged strictly, which
+ *  is what the WebSocket upgrade wants. */
+export interface RequestInfo {
+    path?: string;
+    method?: string;
+    /** The request carries a proxy header (came through `tailscale serve`). Only
+     *  then may the `*.ts.net` suffix fallback apply; a direct loopback caller
+     *  naming evil.ts.net is a browser page, not the serve front door. */
+    proxied?: boolean;
+}
+export interface OriginVerdict {
+    ok: boolean;
+    /** Populated when `ok` is false — safe to log and to return to the caller. */
+    reason?: string;
+}
+/**
+ * Check every header at once. Used by the `/api/*` gate and the WS upgrade.
+ *
+ * `Sec-Fetch-Site` is the backstop for the one gap `Origin` leaves: a
+ * cross-origin **GET** (an `<img src>` or `<script src>` on a malicious page)
+ * carries no `Origin`, so a side-effecting GET would sail through. Browsers
+ * send this metadata header on every request and page JS cannot set it;
+ * non-browser clients don't send it at all, so requiring nothing when it's
+ * absent keeps curl and the e2e scripts working.
+ *
+ * `req` (path + method) is optional and only ever *widens* the verdict, for the
+ * `OPAQUE_READ_ROUTES` above. Callers that pass nothing — the WS upgrade — are
+ * judged strictly.
+ */
+/** The request path every gate judges, or null when the raw path is not
+ *  already canonical. The gates in `server/http.ts` read the RAW path while
+ *  the router (`api.ts`) dispatches on WHATWG's normalised pathname, so a path
+ *  the two read differently — `/api/peer/../repos/x`, `%2e%2e`, a backslash —
+ *  would be judged as one route (the token-exempt `/api/peer/*`) and served as
+ *  another. Nothing legitimate sends such a path; it is refused, never
+ *  rewritten, so there is one string from the first gate to the handler. */
+export declare function canonicalRequestPath(rawUrl: string | undefined): string | null;
+export declare function checkRequestOrigin(headers: {
+    origin?: string | string[];
+    host?: string | string[];
+    "sec-fetch-site"?: string | string[];
+}, req?: RequestInfo): OriginVerdict;
+/**
+ * CORS headers for a response. Reflects the caller's origin when it passed the
+ * gate (so it is always one of ours) and emits nothing otherwise — replacing the
+ * blanket `access-control-allow-origin: *` that let any page read the API.
+ */
+export declare function corsHeaders(headers: {
+    origin?: string | string[];
+}): Record<string, string>;

package/packages/host/dist/origin.js

@@ -0,0 +1,301 @@
+/**
+ * Same-origin guard for the HTTP API and the WebSocket.
+ *
+ * Why this exists: the daemon's trust boundary is the network (loopback +
+ * Tailscale peers are trusted without a password). A *browser* punches straight
+ * through that boundary — a page on any website, loaded in a browser running on
+ * this machine or on any tailnet device, can:
+ *
+ *   - open `ws://127.0.0.1:8770/ws` (WebSocket is exempt from the same-origin
+ *     policy, so no preflight and no CORS to stop it), or
+ *   - `fetch()` the JSON API cross-origin and read the reply (the API used to
+ *     answer `access-control-allow-origin: *`).
+ *
+ * Either one lets a drive-by page spawn a `claude` session — i.e. run code on
+ * this machine — without ever being on the tailnet. So every `/api/*` request
+ * and every socket upgrade is checked here against the origins we actually
+ * serve the app on, and the CORS header is reflected only for those.
+ *
+ * Two headers are checked, because they cover different attacks:
+ *
+ *   - `Origin` — set by the browser on every WS handshake and every cross-origin
+ *     fetch, and unforgeable by page JS. This is the primary check.
+ *   - `Host` — closes DNS rebinding, where an attacker-controlled name resolves
+ *     to 127.0.0.1 so the page's requests are *same*-origin (and may carry no
+ *     `Origin` at all). The name in `Host` is then not one of ours.
+ *
+ * A missing `Origin` is allowed: non-browser clients (curl, the e2e scripts,
+ * the launchd health check) never send one, and a browser always does when it
+ * matters. A request that a page could forge without `Origin` — a form POST, an
+ * `<img>` GET — is still stopped by the `Host` check, and the response of one it
+ * cannot read anyway.
+ */
+import { hostname } from "node:os";
+import { env } from "./env.js";
+// `npm run dev` serves the PWA here and proxies /api + /ws, so in dev the
+// browser's origin is the Vite server, not us. Only trusted when the host was
+// actually started by `npm run dev` (which sets WATERPLANE_DEV=1) — a production
+// daemon has no reason to trust another server on the machine.
+const VITE_DEV_PORT = 5173;
+let compiled = compile({ port: 8770 });
+/**
+ * The one origin that is not `http(s)` and is still ours: the iOS shell
+ * (`packages/app`, Capacitor). WKWebView will not serve an app's own page from
+ * `http`/`https`, so its page lives at `capacitor://localhost` — the iOS twin
+ * of the Android shell's `http://localhost`. Named exactly: scheme AND host.
+ *
+ * Every other non-web scheme is refused (`webScheme` below). Before this
+ * constant existed the guard judged only host + port, so `capacitor://localhost`
+ * passed by accident — and so would `anything://localhost`. A browser never
+ * sends a made-up scheme today; naming the one we serve keeps it that way.
+ */
+const NATIVE_SHELL_ORIGINS = new Set(["capacitor://localhost"]);
+/** Origins are judged on host + port only for the web's own two schemes. */
+function webScheme(protocol) {
+    return protocol === "http:" || protocol === "https:";
+}
+/** Split a `host:port` / origin authority into its parts. Handles `[::1]:80`. */
+function splitAuthority(authority) {
+    const a = authority.trim().toLowerCase();
+    const v6 = /^\[([^\]]+)\](?::(\d+))?$/.exec(a);
+    if (v6)
+        return { host: v6[1], port: v6[2] ? Number(v6[2]) : null };
+    const i = a.lastIndexOf(":");
+    // A bare IPv6 literal has several colons and no port.
+    if (i === -1 || a.indexOf(":") !== i)
+        return { host: a, port: null };
+    return { host: a.slice(0, i), port: Number(a.slice(i + 1)) };
+}
+function normaliseOrigin(raw) {
+    try {
+        const u = new URL(raw.trim());
+        const port = u.port ? `:${u.port}` : "";
+        return `${u.protocol}//${u.hostname.toLowerCase()}${port}`;
+    }
+    catch {
+        return null;
+    }
+}
+function compile(cfg) {
+    const hosts = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+    if (cfg.tailscaleIp)
+        hosts.add(cfg.tailscaleIp.toLowerCase());
+    if (cfg.tailscaleDns)
+        hosts.add(cfg.tailscaleDns.toLowerCase());
+    for (const ip of cfg.lanIps ?? [])
+        hosts.add(ip.toLowerCase());
+    // This machine's own mDNS name — `http://mac.local:8770` is a normal way to
+    // reach it on the LAN. Named exactly, rather than trusting all of `*.local`.
+    // Both the full name and its first label: with a DHCP search domain,
+    // os.hostname() is `mac.fritz.box` while Bonjour still answers to `mac.local`.
+    const self = hostname().toLowerCase().replace(/\.local$/, "");
+    for (const n of [self, self.split(".")[0]]) {
+        if (n) {
+            hosts.add(n);
+            hosts.add(`${n}.local`);
+        }
+    }
+    for (const h of splitEnv(env("ALLOWED_HOSTS")))
+        hosts.add(h.toLowerCase());
+    // 80/443 cover a reverse proxy (`tailscale serve --https=443`).
+    const ports = new Set([cfg.port, 80, 443]);
+    if (env("DEV") === "1")
+        ports.add(VITE_DEV_PORT);
+    const origins = new Set();
+    for (const o of splitEnv(env("ALLOWED_ORIGINS"))) {
+        const n = normaliseOrigin(o);
+        if (n)
+            origins.add(n);
+    }
+    // Our own `tailscale serve` front door, whatever port it landed on. See
+    // OriginConfig.serveUrl — without this the app points at an HTTPS address it
+    // then refuses, and the user stays on the insecure origin where a dropped
+    // tunnel can take the whole app away.
+    if (cfg.serveUrl) {
+        const n = normaliseOrigin(cfg.serveUrl);
+        if (n) {
+            origins.add(n);
+            const u = new URL(n);
+            hosts.add(u.hostname.toLowerCase());
+            ports.add(u.port ? Number(u.port) : 443);
+        }
+    }
+    return { hosts, ports, origins, anyMagicDns: !cfg.tailscaleDns && !!cfg.tailscaleIp };
+}
+function splitEnv(v) {
+    return (v || "").split(",").map((s) => s.trim()).filter(Boolean);
+}
+/** Call once at boot, after the Tailscale IP / DNS name / LAN binds are known. */
+export function configureOrigins(cfg) {
+    compiled = compile(cfg);
+}
+/**
+ * Is this hostname one we serve on? Exact matches from the compiled set (which
+ * already holds our Tailscale IP, MagicDNS name, LAN IPs and mDNS name), plus
+ * any loopback IPv4. `*.ts.net` is accepted by suffix ONLY as a fallback for
+ * when we could not read our own MagicDNS name — otherwise the exact name is
+ * required, so a name under someone else's tailnet is not automatically trusted.
+ */
+function hostAllowed(host, proxied = false) {
+    const h = host.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+    if (!h)
+        return false;
+    if (compiled.hosts.has(h))
+        return true;
+    if (/^127\.\d+\.\d+\.\d+$/.test(h))
+        return true;
+    if (proxied && compiled.anyMagicDns && h.endsWith(".ts.net"))
+        return true;
+    return false;
+}
+/** The `Host` header names something we serve (DNS-rebinding check). */
+export function hostHeaderAllowed(hostHeader, proxied = false) {
+    if (!hostHeader)
+        return true; // HTTP/1.0 or a raw client — no name to rebind
+    const { host } = splitAuthority(hostHeader);
+    return hostAllowed(host, proxied);
+}
+/**
+ * The `Origin` header, if present, is one of ours. Absent = allowed (non-browser
+ * client). `null` (sandboxed iframe, file://) is a real value and is refused.
+ */
+export function originHeaderAllowed(origin, proxied = false, requestHost) {
+    if (origin === undefined)
+        return true;
+    const raw = origin.trim();
+    if (!raw)
+        return true;
+    if (raw === "null")
+        return false;
+    const n = normaliseOrigin(raw);
+    if (!n)
+        return false;
+    if (compiled.origins.has(n))
+        return true;
+    if (NATIVE_SHELL_ORIGINS.has(n))
+        return true;
+    const u = new URL(n);
+    if (!webScheme(u.protocol))
+        return false;
+    if (!hostAllowed(u.hostname, false)) {
+        // Admitted only by the `*.ts.net` suffix fallback: the Origin must also name
+        // the very host this request was sent to, never another tailnet's page.
+        if (!hostAllowed(u.hostname, proxied))
+            return false;
+        if (!requestHost || splitAuthority(requestHost).host.replace(/^\[|\]$/g, "").replace(/\.$/, "") !== u.hostname.toLowerCase().replace(/\.$/, ""))
+            return false;
+    }
+    const port = u.port ? Number(u.port) : u.protocol === "https:" ? 443 : 80;
+    return compiled.ports.has(port);
+}
+/**
+ * The read-only routes a browser loads OUTSIDE `fetch`/XHR — `<img src>`,
+ * `<video src>`, `<a download>`, Background Fetch. Such a request carries **no
+ * `Origin`** (a no-cors GET never sends one), and from the Android shell — whose
+ * page is `http://localhost` while the daemon is `http://100.x:8770` — it also
+ * carries `Sec-Fetch-Site: cross-site`. The backstop below therefore refused
+ * every gallery thumbnail and every artifact download in the APK, with the only
+ * evidence a 403 in the host log; on screen the download queue simply sat on
+ * "waiting to start" for ever.
+ *
+ * Exempting them is not a hole in the backstop, which exists for *side-effecting*
+ * GETs: both are pure reads, and a page that requests one cross-origin still
+ * cannot read the answer (no `Origin` ⇒ no CORS header ⇒ the response is opaque).
+ * Named exactly — not "any GET" — and only for safe methods, so DELETE on an
+ * inbox file stays gated. These are the same two URLs `api.ts` has to build with
+ * `abs()` by hand, for the same reason: they never pass through a transport.
+ */
+const OPAQUE_READ_ROUTES = [
+    /^\/api\/repos\/[^/]+\/artifact$/,
+    /^\/api\/repos\/[^/]+\/inbox\/[^/]+$/,
+];
+function opaqueReadOk(req) {
+    if (!req?.path)
+        return false;
+    const m = (req.method || "").toUpperCase();
+    if (m !== "GET" && m !== "HEAD")
+        return false;
+    return OPAQUE_READ_ROUTES.some((re) => re.test(req.path));
+}
+/**
+ * Check every header at once. Used by the `/api/*` gate and the WS upgrade.
+ *
+ * `Sec-Fetch-Site` is the backstop for the one gap `Origin` leaves: a
+ * cross-origin **GET** (an `<img src>` or `<script src>` on a malicious page)
+ * carries no `Origin`, so a side-effecting GET would sail through. Browsers
+ * send this metadata header on every request and page JS cannot set it;
+ * non-browser clients don't send it at all, so requiring nothing when it's
+ * absent keeps curl and the e2e scripts working.
+ *
+ * `req` (path + method) is optional and only ever *widens* the verdict, for the
+ * `OPAQUE_READ_ROUTES` above. Callers that pass nothing — the WS upgrade — are
+ * judged strictly.
+ */
+/** The request path every gate judges, or null when the raw path is not
+ *  already canonical. The gates in `server/http.ts` read the RAW path while
+ *  the router (`api.ts`) dispatches on WHATWG's normalised pathname, so a path
+ *  the two read differently — `/api/peer/../repos/x`, `%2e%2e`, a backslash —
+ *  would be judged as one route (the token-exempt `/api/peer/*`) and served as
+ *  another. Nothing legitimate sends such a path; it is refused, never
+ *  rewritten, so there is one string from the first gate to the handler. */
+export function canonicalRequestPath(rawUrl) {
+    const raw = (rawUrl || "/").split("?")[0].split("#")[0];
+    let norm;
+    try {
+        norm = new URL(rawUrl || "/", "http://localhost").pathname;
+    }
+    catch {
+        return null;
+    }
+    return norm === raw ? raw : null;
+}
+export function checkRequestOrigin(headers, req) {
+    const origin = first(headers.origin);
+    const host = first(headers.host);
+    const site = first(headers["sec-fetch-site"]);
+    // Only consulted when there is no Origin to judge — that is the whole gap it
+    // covers. Applying it unconditionally would also veto an origin the operator
+    // deliberately put in WATERPLANE_ALLOWED_ORIGINS, which is the one case where a
+    // genuine cross-origin call is supposed to work.
+    if (origin === undefined && site && site !== "same-origin" && site !== "none" && !opaqueReadOk(req)) {
+        return { ok: false, reason: `sec-fetch-site ${site} with no origin` };
+    }
+    if (!originHeaderAllowed(origin, req?.proxied, host))
+        return { ok: false, reason: `origin ${origin} not allowed` };
+    if (!hostHeaderAllowed(host, req?.proxied))
+        return { ok: false, reason: `host ${host} not allowed` };
+    return { ok: true };
+}
+function first(v) {
+    return Array.isArray(v) ? v[0] : v;
+}
+/**
+ * CORS headers for a response. Reflects the caller's origin when it passed the
+ * gate (so it is always one of ours) and emits nothing otherwise — replacing the
+ * blanket `access-control-allow-origin: *` that let any page read the API.
+ */
+export function corsHeaders(headers) {
+    const origin = first(headers.origin);
+    if (!origin || !originHeaderAllowed(origin))
+        return {};
+    return {
+        "access-control-allow-origin": origin,
+        "access-control-allow-credentials": "true",
+        // Cross-origin JS can read only a handful of response headers unless they
+        // are named here. All four are load-bearing for the Android shell, which is
+        // the one client that is genuinely cross-origin: `pull.ts` resumes a
+        // download from `content-range` + `accept-ranges` and revalidates it with
+        // the `etag` it stored, and without them a dropped 90 MB APK restarts from
+        // zero every time instead of continuing.
+        "access-control-expose-headers": "ETag,Content-Range,Accept-Ranges,Content-Length",
+        // Resource Timing reports a cross-origin response as zero bytes unless the
+        // server opts in — and in the Android shell EVERY image is cross-origin, so
+        // without this the phone's own data-usage readout (`web/nettraffic.ts`)
+        // silently under-counts the gallery, which is most of what it downloads.
+        // The reflected origin, never `*`: the same caller that already passed the
+        // gate, and nobody else.
+        "timing-allow-origin": origin,
+        vary: "origin",
+    };
+}
+//# sourceMappingURL=origin.js.map