@aiviatic/kindling 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aiviatic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,73 @@
+# Kindling
+
+**Blank computer to building in about five minutes — no terminal knowledge required.**
+
+Kindling is a cross-platform installer that gets a non-technical person from a
+fresh computer (Mac, Windows, or Linux) to a working, [BMad](https://github.com/bmad-code-org/BMAD-METHOD)-scaffolded
+project set up for AI-driven app development. You run one step, make a few choices
+in your browser, and Kindling installs and wires everything up for you.
+
+It's open source on purpose: the very first thing Kindling does is run a script on
+your machine, so you should be able to read exactly what that script does. See
+[SECURITY.md](SECURITY.md) for the security model.
+
+## How it works
+
+Three layers, so the scary parts happen where they can be explained:
+
+1. **A per-OS bootstrap script** (`bootstrap/`) handles the steps that need Node
+   present: it provisions a pinned Node.js (via `nvm` on macOS/Linux; on Windows it
+   downloads a pinned, SHA-256-verified portable Node, or reuses an existing Node 20+),
+   then launches Kindling in the same shell.
+   - macOS/Linux: `curl -fsSL https://kindling.aiviatic.com/go | bash`
+   - Windows: download `kindling.cmd` and double-click it (it fetches and runs
+     `setup.ps1` over HTTPS).
+2. **A temporary localhost server** (`server/`) stands up on `127.0.0.1`, serves a
+   friendly browser UI, provisions Git, scaffolds the project, runs
+   `npx bmad-method install`, and installs any agent CLIs you opt into. It exits
+   when the install completes.
+3. **A browser UI** (`ui/`) walks you through the few choices (project name,
+   tools) and shows honest progress — including the ~5-minute macOS developer-tools
+   dialog, so it never looks frozen.
+
+The installer is published to npm as **`@aiviatic/kindling`**; the bootstrap's
+final step is `npx @aiviatic/kindling@<pinned-version>`.
+
+> This repo is the **installer** (what runs on your machine). The marketing/landing
+> site and its serverless bits are maintained separately.
+
+## Try it
+
+If you already have Node 20+, you can run the installer directly:
+
+```bash
+npx @aiviatic/kindling
+```
+
+Otherwise, get the one-step command for your OS at
+**<https://kindling.aiviatic.com/install>**.
+
+## Development
+
+```bash
+git clone https://github.com/Aiviatic/kindling.git
+cd kindling
+nvm use && npm install
+npm test        # unit suite (Vitest)
+npm run build   # tsup (Node payload) + Vite (browser UI)
+```
+
+- **TypeScript + ESM** throughout; dev/build on the Node in `.nvmrc`, runtime floor **Node 20+**.
+- **React + Vite** for the browser UI; **tsup** bundles the Node side (`engine/`, `server/`, `cli/`).
+- **Vitest** for tests (co-located `*.test.ts(x)`); CI runs typecheck + lint + test + build on
+  macOS/Windows/Ubuntu × Node 20/24.
+
+Layout: `engine/` (headless install logic) · `server/` (localhost server + Welcome
+page) · `ui/` (React install UI) · `cli/` + `bin/` (the `npx` entry) · `bootstrap/`
+(per-OS entry scripts) · `scripts/` (dev helpers).
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) to get started — Windows fixes especially welcome.
+
+## License
+
+[MIT](LICENSE) © Aiviatic

package/bin/kindling.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// npx entry — dispatches to the built CLI (server | --json | --verbose).
+// Resolves the built output relative to this file (robust under global/symlinked installs).
+const target = new URL('../dist/cli/main.js', import.meta.url);
+import(target.href)
+  .then((cli) => cli.run(process.argv.slice(2)))
+  .catch((err) => {
+    if (err && err.code === 'ERR_MODULE_NOT_FOUND') {
+      console.error('Kindling must be built first: run `npm run build`.');
+    } else {
+      console.error('Kindling failed to start:', err);
+    }
+    process.exit(1);
+  });

package/bootstrap/kindling.cmd

@@ -0,0 +1,13 @@
+@echo off
+REM Kindling bootstrap entry — Windows. The user downloads THIS ONE FILE and double-clicks it.
+REM It FETCHES + runs the setup script from the host, so no sibling files are needed (the earlier
+REM `-File %~dp0setup.ps1` required setup.ps1 + lib\common.ps1 next to the .cmd, which a lone
+REM download doesn't have). Mirrors the macOS/Linux one-liner `curl -fsSL .../go | bash`.
+REM   -ExecutionPolicy Bypass : lets the unsigned setup script run FOR THIS PROCESS ONLY
+REM                             (it does not change any system-wide policy — safe + reversible).
+REM   -NoProfile              : skips the user's PowerShell profile so nothing interferes (required).
+REM   irm ... | iex           : Invoke-RestMethod fetches setup.ps1 over HTTPS, Invoke-Expression
+REM                             runs it (the PowerShell equivalent of curl|bash). setup.ps1 is
+REM                             self-contained (helpers inlined), so no on-disk siblings are needed.
+powershell -ExecutionPolicy Bypass -NoProfile -Command "irm https://kindling.aiviatic.com/setup.ps1 | iex"
+pause

package/bootstrap/setup.ps1

@@ -0,0 +1,98 @@
+# Kindling bootstrap — Windows. FETCHED + run by kindling.cmd (self-fetching one-file entry):
+#   powershell -ExecutionPolicy Bypass -NoProfile -Command "irm https://kindling.aiviatic.com/setup.ps1 | iex"
+# Ensures the pinned Node + Git (portable), then launches Kindling.
+#
+# SELF-CONTAINED for the `irm | iex` delivery path: there is NO file on disk (no $PSScriptRoot), so
+# the helpers are INLINED below rather than dot-sourced — mirroring setup.sh's inline helpers for
+# `curl | bash`. Pinned versions below MUST match engine/pins.ts (a unit test asserts this).
+# NOTE: portable Node/Git provisioning is the Windows SPIKE — validated on real Windows at the
+# dress rehearsal (mirrors engine/provision/node-windows.ts).
+$ErrorActionPreference = 'Stop'
+
+$KindlingNodeVersion = '24.16.0'  # == pins.node
+$KindlingVersion     = '0.1.0'    # == pins.kindling
+$NodeFloorMajor      = 20
+
+# --- Inline helpers (were bootstrap/lib/common.ps1; inlined for the file-less delivery) ----------
+function Say([string]$msg) { Write-Host "`n$msg" -ForegroundColor White }
+function Test-Cmd([string]$name) {
+  return [bool](Get-Command $name -ErrorAction SilentlyContinue)
+}
+# True if a Node on PATH meets the major-version floor.
+function Test-NodeOk([int]$floorMajor) {
+  if (-not (Test-Cmd 'node')) { return $false }
+  try {
+    $v = (& node -v) -replace '^v', ''
+    $major = [int]($v -split '\.')[0]
+    return $major -ge $floorMajor
+  } catch { return $false }
+}
+
+Say "Getting your computer ready. This usually takes about 5 minutes."
+
+# Plain-language guidance for the Windows security prompts (FR-7) - expected / safe / reversible.
+Say "Heads up: Windows may show a couple of security prompts. They're expected and safe:"
+Say " - SmartScreen ('Windows protected your PC'): click 'More info', then 'Run anyway'. Nothing is changed on your PC."
+Say " - This window already runs with -ExecutionPolicy Bypass for THIS process only; it does not change any system setting and is fully reversible."
+
+# --- Node (pinned, portable) --------------------------------------------------
+# $NodeExe stays $null when a system Node is reused (launch via PATH); the portable-install path
+# sets it to the absolute node.exe so the launch never depends on PATH (clean-runtime rule, AR6).
+$NodeExe = $null
+if (Test-NodeOk $NodeFloorMajor) {
+  Say "Node is already installed - reusing it."
+} else {
+  Say "Setting up Node - the engine your project runs on. This downloads about 30 MB, one time."
+  # Portable Node: download the pinned Windows zip from nodejs.org, VERIFY its SHA-256 against Node's
+  # published SHASUMS256.txt before touching it, extract, and point the launch at the absolute
+  # node.exe (clean-runtime rule AR6 — never rely on a mutated PATH). Mirrors node-windows.ts.
+  # NOTE: newly implemented; validate on real Windows (proxy/TLS-interception, extract, non-admin exec).
+  $ProgressPreference = 'SilentlyContinue'  # a visible progress bar makes Invoke-WebRequest ~10x slower
+  [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+  $arch     = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { 'arm64' } else { 'x64' }
+  $distName = "node-v$KindlingNodeVersion-win-$arch"
+  $nodeRoot = Join-Path $env:LOCALAPPDATA 'kindling\node'
+  $zipPath  = Join-Path $nodeRoot "$distName.zip"
+  $baseUrl  = "https://nodejs.org/dist/v$KindlingNodeVersion"
+  New-Item -ItemType Directory -Force -Path $nodeRoot | Out-Null
+  try {
+    Invoke-WebRequest -Uri "$baseUrl/$distName.zip" -OutFile $zipPath -UseBasicParsing
+    $shaLine  = ((Invoke-WebRequest -Uri "$baseUrl/SHASUMS256.txt" -UseBasicParsing).Content -split "`n" |
+                 Where-Object { $_ -match [regex]::Escape("$distName.zip") } | Select-Object -First 1)
+    $expected = ($shaLine -split '\s+')[0].ToLower()
+    $actual   = (Get-FileHash -Path $zipPath -Algorithm SHA256).Hash.ToLower()
+    if (-not $expected -or $actual -ne $expected) {
+      throw "downloaded Node failed its integrity check (expected '$expected', got '$actual')"
+    }
+    Expand-Archive -Path $zipPath -DestinationPath $nodeRoot -Force
+  } catch {
+    throw "Couldn't set up Node ($($_.Exception.Message)). Check your internet connection, then run this again - it's safe to re-run."
+  }
+  $NodeExe = Join-Path $nodeRoot "$distName\node.exe"
+  if (-not (Test-Path $NodeExe)) { throw "Node was downloaded but node.exe wasn't found at $NodeExe." }
+  Say "Node is ready."
+}
+
+# --- Git (portable) -----------------------------------------------------------
+if (Test-Cmd 'git') {
+  Say "Git is already installed - reusing it."
+} else {
+  Say "Setting up Git - it keeps the history of your project."
+  # PortableGit download/extract — deferred (needs pinned version + release URL); resolved at rehearsal.
+}
+
+# --- Launch Kindling (clean-runtime: absolute node when portable, else npx on PATH) -----------
+Say "Starting Kindling..."
+if ($null -eq $NodeExe) {
+  & npx -y "@aiviatic/kindling@$KindlingVersion"
+} else {
+  # Invoke npx's CLI through the exact provisioned node binary — no reliance on PATH.
+  $NpxCli = Join-Path (Split-Path $NodeExe) 'node_modules\npm\bin\npx-cli.js'
+  & $NodeExe $NpxCli -y "@aiviatic/kindling@$KindlingVersion"
+}
+# A native exe (npx) does NOT raise a terminating error on failure even with
+# ErrorActionPreference='Stop' — it only sets $LASTEXITCODE. So check that explicitly.
+if ($LASTEXITCODE -ne 0) {
+  Say "Kindling couldn't start. Check that you're connected to the internet, then run it again. It's safe to re-run."
+  exit 1
+}

package/bootstrap/setup.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Kindling bootstrap — macOS/Linux. Served by the Landing Page as:
+#   curl -fsSL https://kindling.aiviatic.com/go | bash
+# Ensures the pinned Node + Git, then launches Kindling in the SAME shell (no new terminal).
+#
+# Pinned versions below MUST match engine/pins.ts + node-unix.ts (a unit test asserts this).
+set -euo pipefail
+
+KINDLING_NODE_VERSION="24.16.0"  # == pins.node
+KINDLING_VERSION="0.1.0"         # == pins.kindling
+NVM_VERSION="v0.40.3"            # == NVM_VERSION (engine/provision/node-unix.ts)
+NODE_FLOOR_MAJOR=20
+
+# Self-contained helpers — this file is delivered via `curl … | bash`, where there is NO file on
+# disk (BASH_SOURCE is empty), so we cannot source a shared helper file. Keep these inline.
+say() { printf '\n\033[1m%s\033[0m\n' "$*"; }
+have_cmd() { command -v "$1" >/dev/null 2>&1; }
+node_ok() {
+  have_cmd node || return 1
+  local major
+  major="$(node -v 2>/dev/null | sed 's/^v//; s/\..*//')"
+  [ -n "$major" ] && [ "$major" -ge "$1" ]
+}
+
+say "🔥 Getting your computer ready. This usually takes about 5 minutes."
+
+# --- Node (pinned, via nvm) ---------------------------------------------------
+if node_ok "$NODE_FLOOR_MAJOR"; then
+  say "Node is already installed, reusing it."
+else
+  say "Setting up Node, the engine your project runs on."
+  export NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
+  if [ ! -s "$NVM_DIR/nvm.sh" ]; then
+    if ! curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/$NVM_VERSION/install.sh" | bash; then
+      say "Couldn't install nvm. Check your internet connection, then run the line again. It's safe to re-run."
+      exit 1
+    fi
+  fi
+  set +u                 # nvm.sh references unset vars; `set -u` would abort while sourcing it
+  # shellcheck source=/dev/null
+  . "$NVM_DIR/nvm.sh"
+  set -u
+  if ! nvm install "$KINDLING_NODE_VERSION"; then
+    say "Couldn't set up Node. Check your internet connection, then run the line again."
+    exit 1
+  fi
+fi
+
+# --- Git is provisioned by the ENGINE (in the browser), not here -------------
+# On macOS/Linux, Git/Xcode-CLT provisioning runs inside kindling so the browser shows the
+# never-frozen progress (the ~5-min macOS dialog with reassurance). The bootstrap only needs
+# Node to launch kindling — Git isn't required to start. (Provisioning-reconciliation Option C.)
+
+# --- Launch Kindling (same shell — node is on PATH via nvm or already present) -
+say "Starting Kindling…"
+if ! npx -y "@aiviatic/kindling@$KINDLING_VERSION"; then
+  say "Kindling couldn't start. Check that you're connected to the internet, then run the line again. It's safe to re-run."
+  exit 1
+fi

package/dist/chunk-IS6LC3HK.js

@@ -0,0 +1,210 @@
+import {
+  StepId,
+  exec,
+  expandTilde
+} from "./chunk-OU3WSB6B.js";
+
+// server/server.ts
+import { createServer as createHttpServer } from "http";
+import { once } from "events";
+import { readFile } from "fs/promises";
+import { join, normalize, extname } from "path";
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon"
+};
+var MAX_BODY_BYTES = 64 * 1024;
+var KNOWN_STEPS = new Set(Object.values(StepId));
+async function readBody(req) {
+  let body = "";
+  for await (const chunk of req) {
+    body += String(chunk);
+    if (body.length > MAX_BODY_BYTES) throw new Error("body too large");
+  }
+  return body;
+}
+async function serveStatic(uiDir, pathname, res) {
+  const rel = pathname === "/" ? "index.html" : pathname.replace(/^\/+/, "");
+  const filePath = normalize(join(uiDir, rel));
+  if (filePath !== normalize(uiDir) && !filePath.startsWith(normalize(uiDir) + "/")) {
+    res.writeHead(403).end("forbidden");
+    return;
+  }
+  try {
+    const data = await readFile(filePath);
+    res.writeHead(200, { "Content-Type": MIME[extname(filePath)] ?? "application/octet-stream" });
+    res.end(data);
+  } catch {
+    res.writeHead(404).end("not found");
+  }
+}
+async function startServer(opts) {
+  const { emitter, commands, uiDir, onWelcomeAck } = opts;
+  const sseClients = /* @__PURE__ */ new Set();
+  const handler = async (req, res) => {
+    const { pathname } = new URL(req.url ?? "/", "http://127.0.0.1");
+    const hostname = (req.headers.host ?? "").split(":")[0].toLowerCase();
+    if (hostname !== "127.0.0.1" && hostname !== "localhost") {
+      res.writeHead(403).end("forbidden");
+      return;
+    }
+    if (req.method === "GET" && pathname === "/events") {
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive"
+      });
+      const send = (event) => {
+        if (!res.writableEnded) res.write(`data: ${JSON.stringify(event)}
+
+`);
+      };
+      for (const event of emitter.events()) send(event);
+      const off = emitter.on(send);
+      sseClients.add(res);
+      req.on("close", () => {
+        off();
+        sseClients.delete(res);
+      });
+      return;
+    }
+    if (req.method === "POST") {
+      if (req.headers["x-kindling"] !== "1") {
+        res.writeHead(403).end("forbidden");
+        return;
+      }
+      if (pathname === "/start") {
+        let body;
+        try {
+          body = await readBody(req);
+        } catch {
+          res.writeHead(413).end("body too large");
+          return;
+        }
+        let config;
+        try {
+          const p = JSON.parse(body || "null");
+          if (p && typeof p === "object" && typeof p.projectDir === "string" && p.projectDir.length > 0 && typeof p.projectName === "string" && p.projectName.length > 0 && Array.isArray(p.ides) && p.ides.length > 0 && Array.isArray(p.modules) && p.pins !== null && typeof p.pins === "object") {
+            config = p;
+          }
+        } catch {
+          config = void 0;
+        }
+        if (!config) {
+          res.writeHead(400).end("invalid config");
+          return;
+        }
+        res.writeHead(202).end();
+        void Promise.resolve(commands.start(config)).catch(() => {
+        });
+        return;
+      }
+      if (pathname === "/inspect") {
+        let body;
+        try {
+          body = await readBody(req);
+        } catch {
+          res.writeHead(413).end("body too large");
+          return;
+        }
+        let projectDir;
+        try {
+          const p = JSON.parse(body || "null");
+          if (p && typeof p === "object" && typeof p.projectDir === "string" && p.projectDir.length > 0) {
+            projectDir = p.projectDir;
+          }
+        } catch {
+          projectDir = void 0;
+        }
+        if (!projectDir) {
+          res.writeHead(400).end("invalid dir");
+          return;
+        }
+        const result = commands.inspect ? await commands.inspect(expandTilde(projectDir)) : { isKindlingProject: false, installedBmadVersion: null };
+        res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" }).end(JSON.stringify(result));
+        return;
+      }
+      if (pathname === "/cancel") {
+        commands.cancel();
+        res.writeHead(202).end();
+        return;
+      }
+      if (pathname === "/ack") {
+        res.writeHead(202).end();
+        onWelcomeAck?.();
+        return;
+      }
+      if (pathname === "/retry") {
+        let body;
+        try {
+          body = await readBody(req);
+        } catch {
+          res.writeHead(413).end("body too large");
+          return;
+        }
+        let step;
+        try {
+          step = JSON.parse(body || "{}").step;
+        } catch {
+          step = void 0;
+        }
+        if (!step || !KNOWN_STEPS.has(step)) {
+          res.writeHead(400).end("invalid step");
+          return;
+        }
+        res.writeHead(202).end();
+        void Promise.resolve(commands.retry(step)).catch(() => {
+        });
+        return;
+      }
+    }
+    if (req.method === "GET" && uiDir) {
+      await serveStatic(uiDir, pathname, res);
+      return;
+    }
+    res.writeHead(404).end("not found");
+  };
+  const server = createHttpServer((req, res) => {
+    handler(req, res).catch(() => {
+      if (!res.headersSent) res.writeHead(500).end("server error");
+      else res.destroy();
+    });
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const { port } = server.address();
+  return {
+    server,
+    port,
+    url: `http://127.0.0.1:${port}/`,
+    close: () => new Promise((resolve, reject) => {
+      for (const res of sseClients) res.end();
+      sseClients.clear();
+      server.close((err) => err ? reject(err) : resolve());
+      server.closeAllConnections();
+    })
+  };
+}
+
+// server/open-browser.ts
+async function openBrowser(url, opts = {}) {
+  const exec2 = opts.exec ?? exec;
+  const platform = opts.platform ?? process.platform;
+  const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const r = await exec2(cmd, args);
+    return r.code === 0;
+  } catch {
+    return false;
+  }
+}
+
+export {
+  startServer,
+  openBrowser
+};
+//# sourceMappingURL=chunk-IS6LC3HK.js.map

package/dist/chunk-IS6LC3HK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../server/server.ts","../server/open-browser.ts"],"sourcesContent":["import { createServer as createHttpServer, type IncomingMessage, type ServerResponse, type Server } from 'node:http';\nimport { once } from 'node:events';\nimport { readFile } from 'node:fs/promises';\nimport { join, normalize, extname } from 'node:path';\nimport type { AddressInfo } from 'node:net';\nimport type { EngineEmitter } from '../engine/emitter';\nimport { StepId, type Config, type KindlingEvent, type InspectResult } from '../engine/contract';\nimport { expandTilde } from '../engine/expand-tilde';\n\n// Minimal command surface the server drives (the Engine satisfies this).\nexport interface ServerCommands {\n  start(config: Config): unknown | Promise<unknown>;\n  cancel(): void;\n  retry(step: StepId): unknown | Promise<unknown>;\n  /**\n   * Read-only filesystem probe for the Configure-time \"existing project?\" detection (Story 7.2 /\n   * `POST /inspect`). OPTIONAL so existing `ServerCommands` fakes (e.g. server.test.ts) don't break;\n   * when absent the handler returns the neutral `{ isKindlingProject: false, installedBmadVersion: null }`.\n   */\n  inspect?(projectDir: string): Promise<InspectResult>;\n}\n\nexport interface StartServerOptions {\n  emitter: EngineEmitter;\n  commands: ServerCommands;\n  /** Built UI directory (dist/ui) to serve statically; omit to skip static serving. */\n  uiDir?: string;\n  /** Called when the Welcome screen render-acks (POST /ack). The host uses this to write the\n   *  static welcome.html and exit the ephemeral server — only fired on success (3.7 lifecycle). */\n  onWelcomeAck?: () => void;\n}\n\nexport interface RunningServer {\n  server: Server;\n  url: string;\n  port: number;\n  close(): Promise<void>;\n}\n\nconst MIME: Record<string, string> = {\n  '.html': 'text/html; charset=utf-8',\n  '.js': 'text/javascript; charset=utf-8',\n  '.css': 'text/css; charset=utf-8',\n  '.json': 'application/json; charset=utf-8',\n  '.svg': 'image/svg+xml',\n  '.ico': 'image/x-icon',\n};\n\nconst MAX_BODY_BYTES = 64 * 1024;\nconst KNOWN_STEPS = new Set<string>(Object.values(StepId));\n\n// Reads the request body with a hard size cap (throws past the cap → caller responds 413).\nasync function readBody(req: IncomingMessage): Promise<string> {\n  let body = '';\n  for await (const chunk of req) {\n    body += String(chunk);\n    if (body.length > MAX_BODY_BYTES) throw new Error('body too large');\n  }\n  return body;\n}\n\nasync function serveStatic(uiDir: string, pathname: string, res: ServerResponse): Promise<void> {\n  const rel = pathname === '/' ? 'index.html' : pathname.replace(/^\\/+/, '');\n  const filePath = normalize(join(uiDir, rel));\n  // Path-traversal guard: the resolved path must stay within uiDir. (We serve only our own\n  // built dist/ui — not attacker-writable — so symlink resolution is out of scope.)\n  if (filePath !== normalize(uiDir) && !filePath.startsWith(normalize(uiDir) + '/')) {\n    res.writeHead(403).end('forbidden');\n    return;\n  }\n  try {\n    const data = await readFile(filePath);\n    res.writeHead(200, { 'Content-Type': MIME[extname(filePath)] ?? 'application/octet-stream' });\n    res.end(data);\n  } catch {\n    res.writeHead(404).end('not found');\n  }\n}\n\n// Stands up the localhost server: SSE event stream, command POSTs, and (optional) static UI.\n// Binds 127.0.0.1 on an ephemeral port (NFR6); resolves once listening.\nexport async function startServer(opts: StartServerOptions): Promise<RunningServer> {\n  const { emitter, commands, uiDir, onWelcomeAck } = opts;\n  const sseClients = new Set<ServerResponse>();\n\n  const handler = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {\n    const { pathname } = new URL(req.url ?? '/', 'http://127.0.0.1');\n\n    // DNS-rebinding guard: only serve requests whose Host header is loopback. A page that rebinds\n    // its own domain's DNS to 127.0.0.1 still sends that domain as Host, not 127.0.0.1 / localhost.\n    const hostname = (req.headers.host ?? '').split(':')[0].toLowerCase();\n    if (hostname !== '127.0.0.1' && hostname !== 'localhost') {\n      res.writeHead(403).end('forbidden');\n      return;\n    }\n\n    if (req.method === 'GET' && pathname === '/events') {\n      res.writeHead(200, {\n        'Content-Type': 'text/event-stream',\n        'Cache-Control': 'no-cache',\n        Connection: 'keep-alive',\n      });\n      // Data-only SSE framing (one stream per connection); the UI client uses `onmessage`.\n      const send = (event: KindlingEvent): void => {\n        if (!res.writableEnded) res.write(`data: ${JSON.stringify(event)}\\n\\n`);\n      };\n      for (const event of emitter.events()) send(event); // replay backlog so late clients catch up\n      const off = emitter.on(send);\n      sseClients.add(res);\n      req.on('close', () => {\n        off();\n        sseClients.delete(res);\n      });\n      return;\n    }\n\n    if (req.method === 'POST') {\n      // CSRF guard: a cross-origin browser page can reach 127.0.0.1, but cannot set a custom\n      // header without a CORS preflight (which this server never approves). The UI sends it.\n      if (req.headers['x-kindling'] !== '1') {\n        res.writeHead(403).end('forbidden');\n        return;\n      }\n      if (pathname === '/start') {\n        let body: string;\n        try {\n          body = await readBody(req);\n        } catch {\n          res.writeHead(413).end('body too large');\n          return;\n        }\n        let config: Config | undefined;\n        try {\n          const p = JSON.parse(body || 'null') as Partial<Config> | null;\n          // Shape-guard every field the engine dereferences (flags.ts reads projectDir; the\n          // self-check/validation reads pins) so a malformed body is rejected as 400 rather\n          // than reaching the engine and crashing after we've already sent 202.\n          if (\n            p &&\n            typeof p === 'object' &&\n            typeof p.projectDir === 'string' &&\n            p.projectDir.length > 0 &&\n            typeof p.projectName === 'string' &&\n            p.projectName.length > 0 &&\n            Array.isArray(p.ides) &&\n            p.ides.length > 0 &&\n            Array.isArray(p.modules) &&\n            p.pins !== null &&\n            typeof p.pins === 'object'\n          ) {\n            config = p as Config;\n          }\n        } catch {\n          config = undefined;\n        }\n        if (!config) {\n          res.writeHead(400).end('invalid config');\n          return;\n        }\n        res.writeHead(202).end(); // progress flows over SSE; don't block on the run\n        void Promise.resolve(commands.start(config)).catch(() => {});\n        return;\n      }\n      if (pathname === '/inspect') {\n        // Read-only, fixed-suffix probe (Story 7.2). Same CSRF guard + readBody cap as /start;\n        // shape-guard the body → 400; else 200 + the InspectResult JSON. No engine, no writes,\n        // no user-controlled traversal (the inspector only stats <dir>/_bmad + reads the fixed\n        // <dir>/_bmad/_config/manifest.yaml). Both underlying reads never throw.\n        let body: string;\n        try {\n          body = await readBody(req);\n        } catch {\n          res.writeHead(413).end('body too large');\n          return;\n        }\n        let projectDir: string | undefined;\n        try {\n          const p = JSON.parse(body || 'null') as { projectDir?: unknown } | null;\n          if (p && typeof p === 'object' && typeof p.projectDir === 'string' && p.projectDir.length > 0) {\n            projectDir = p.projectDir;\n          }\n        } catch {\n          projectDir = undefined;\n        }\n        if (!projectDir) {\n          res.writeHead(400).end('invalid dir');\n          return;\n        }\n        const result: InspectResult = commands.inspect\n          ? await commands.inspect(expandTilde(projectDir))\n          : { isKindlingProject: false, installedBmadVersion: null };\n        res.writeHead(200, { 'Content-Type': 'application/json; charset=utf-8' }).end(JSON.stringify(result));\n        return;\n      }\n      if (pathname === '/cancel') {\n        commands.cancel();\n        res.writeHead(202).end();\n        return;\n      }\n      if (pathname === '/ack') {\n        // The Welcome screen rendered — let the host exit the ephemeral server. Respond first so\n        // the ack completes even if onWelcomeAck closes the server synchronously.\n        res.writeHead(202).end();\n        onWelcomeAck?.();\n        return;\n      }\n      if (pathname === '/retry') {\n        let body: string;\n        try {\n          body = await readBody(req);\n        } catch {\n          res.writeHead(413).end('body too large');\n          return;\n        }\n        let step: string | undefined;\n        try {\n          step = (JSON.parse(body || '{}') as { step?: string }).step;\n        } catch {\n          step = undefined;\n        }\n        if (!step || !KNOWN_STEPS.has(step)) {\n          res.writeHead(400).end('invalid step');\n          return;\n        }\n        res.writeHead(202).end();\n        void Promise.resolve(commands.retry(step as StepId)).catch(() => {});\n        return;\n      }\n    }\n\n    if (req.method === 'GET' && uiDir) {\n      await serveStatic(uiDir, pathname, res);\n      return;\n    }\n\n    res.writeHead(404).end('not found');\n  };\n\n  const server = createHttpServer((req, res) => {\n    handler(req, res).catch(() => {\n      if (!res.headersSent) res.writeHead(500).end('server error');\n      else res.destroy();\n    });\n  });\n  server.listen(0, '127.0.0.1');\n  await once(server, 'listening');\n  const { port } = server.address() as AddressInfo;\n\n  return {\n    server,\n    port,\n    url: `http://127.0.0.1:${port}/`,\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        for (const res of sseClients) res.end(); // SSE keeps sockets alive — close them first\n        sseClients.clear();\n        server.close((err) => (err ? reject(err) : resolve()));\n        server.closeAllConnections(); // terminate any remaining keep-alive sockets (Node 18.2+)\n      }),\n  };\n}\n","import { exec as defaultExec, type ExecResult } from '../engine/exec';\n\nexport interface OpenBrowserOptions {\n  exec?: (cmd: string, args: string[]) => Promise<ExecResult>;\n  platform?: NodeJS.Platform;\n}\n\n// Best-effort: opens `url` in the default browser. NEVER throws; returns whether the open\n// command launched. The printed/returned URL is the real contract (FR5 — auto-open is decoration).\nexport async function openBrowser(url: string, opts: OpenBrowserOptions = {}): Promise<boolean> {\n  const exec = opts.exec ?? defaultExec;\n  const platform = opts.platform ?? process.platform;\n\n  // `cmd.exe` is a real executable (spawns fine with shell:false); `start` is its builtin, and\n  // its first quoted arg is the window title (empty here).\n  const [cmd, args]: [string, string[]] =\n    platform === 'darwin'\n      ? ['open', [url]]\n      : platform === 'win32'\n        ? ['cmd', ['/c', 'start', '', url]]\n        : ['xdg-open', [url]];\n\n  try {\n    const r = await exec(cmd, args);\n    return r.code === 0;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;AAAA,SAAS,gBAAgB,wBAAgF;AACzG,SAAS,YAAY;AACrB,SAAS,gBAAgB;AACzB,SAAS,MAAM,WAAW,eAAe;AAoCzC,IAAM,OAA+B;AAAA,EACnC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,IAAM,iBAAiB,KAAK;AAC5B,IAAM,cAAc,IAAI,IAAY,OAAO,OAAO,MAAM,CAAC;AAGzD,eAAe,SAAS,KAAuC;AAC7D,MAAI,OAAO;AACX,mBAAiB,SAAS,KAAK;AAC7B,YAAQ,OAAO,KAAK;AACpB,QAAI,KAAK,SAAS,eAAgB,OAAM,IAAI,MAAM,gBAAgB;AAAA,EACpE;AACA,SAAO;AACT;AAEA,eAAe,YAAY,OAAe,UAAkB,KAAoC;AAC9F,QAAM,MAAM,aAAa,MAAM,eAAe,SAAS,QAAQ,QAAQ,EAAE;AACzE,QAAM,WAAW,UAAU,KAAK,OAAO,GAAG,CAAC;AAG3C,MAAI,aAAa,UAAU,KAAK,KAAK,CAAC,SAAS,WAAW,UAAU,KAAK,IAAI,GAAG,GAAG;AACjF,QAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClC;AAAA,EACF;AACA,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,QAAQ;AACpC,QAAI,UAAU,KAAK,EAAE,gBAAgB,KAAK,QAAQ,QAAQ,CAAC,KAAK,2BAA2B,CAAC;AAC5F,QAAI,IAAI,IAAI;AAAA,EACd,QAAQ;AACN,QAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAAA,EACpC;AACF;AAIA,eAAsB,YAAY,MAAkD;AAClF,QAAM,EAAE,SAAS,UAAU,OAAO,aAAa,IAAI;AACnD,QAAM,aAAa,oBAAI,IAAoB;AAE3C,QAAM,UAAU,OAAO,KAAsB,QAAuC;AAClF,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AAI/D,UAAM,YAAY,IAAI,QAAQ,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,EAAE,YAAY;AACpE,QAAI,aAAa,eAAe,aAAa,aAAa;AACxD,UAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClC;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,SAAS,aAAa,WAAW;AAClD,UAAI,UAAU,KAAK;AAAA,QACjB,gBAAgB;AAAA,QAChB,iBAAiB;AAAA,QACjB,YAAY;AAAA,MACd,CAAC;AAED,YAAM,OAAO,CAAC,UAA+B;AAC3C,YAAI,CAAC,IAAI,cAAe,KAAI,MAAM,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA,CAAM;AAAA,MACxE;AACA,iBAAW,SAAS,QAAQ,OAAO,EAAG,MAAK,KAAK;AAChD,YAAM,MAAM,QAAQ,GAAG,IAAI;AAC3B,iBAAW,IAAI,GAAG;AAClB,UAAI,GAAG,SAAS,MAAM;AACpB,YAAI;AACJ,mBAAW,OAAO,GAAG;AAAA,MACvB,CAAC;AACD;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AAGzB,UAAI,IAAI,QAAQ,YAAY,MAAM,KAAK;AACrC,YAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClC;AAAA,MACF;AACA,UAAI,aAAa,UAAU;AACzB,YAAI;AACJ,YAAI;AACF,iBAAO,MAAM,SAAS,GAAG;AAAA,QAC3B,QAAQ;AACN,cAAI,UAAU,GAAG,EAAE,IAAI,gBAAgB;AACvC;AAAA,QACF;AACA,YAAI;AACJ,YAAI;AACF,gBAAM,IAAI,KAAK,MAAM,QAAQ,MAAM;AAInC,cACE,KACA,OAAO,MAAM,YACb,OAAO,EAAE,eAAe,YACxB,EAAE,WAAW,SAAS,KACtB,OAAO,EAAE,gBAAgB,YACzB,EAAE,YAAY,SAAS,KACvB,MAAM,QAAQ,EAAE,IAAI,KACpB,EAAE,KAAK,SAAS,KAChB,MAAM,QAAQ,EAAE,OAAO,KACvB,EAAE,SAAS,QACX,OAAO,EAAE,SAAS,UAClB;AACA,qBAAS;AAAA,UACX;AAAA,QACF,QAAQ;AACN,mBAAS;AAAA,QACX;AACA,YAAI,CAAC,QAAQ;AACX,cAAI,UAAU,GAAG,EAAE,IAAI,gBAAgB;AACvC;AAAA,QACF;AACA,YAAI,UAAU,GAAG,EAAE,IAAI;AACvB,aAAK,QAAQ,QAAQ,SAAS,MAAM,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC3D;AAAA,MACF;AACA,UAAI,aAAa,YAAY;AAK3B,YAAI;AACJ,YAAI;AACF,iBAAO,MAAM,SAAS,GAAG;AAAA,QAC3B,QAAQ;AACN,cAAI,UAAU,GAAG,EAAE,IAAI,gBAAgB;AACvC;AAAA,QACF;AACA,YAAI;AACJ,YAAI;AACF,gBAAM,IAAI,KAAK,MAAM,QAAQ,MAAM;AACnC,cAAI,KAAK,OAAO,MAAM,YAAY,OAAO,EAAE,eAAe,YAAY,EAAE,WAAW,SAAS,GAAG;AAC7F,yBAAa,EAAE;AAAA,UACjB;AAAA,QACF,QAAQ;AACN,uBAAa;AAAA,QACf;AACA,YAAI,CAAC,YAAY;AACf,cAAI,UAAU,GAAG,EAAE,IAAI,aAAa;AACpC;AAAA,QACF;AACA,cAAM,SAAwB,SAAS,UACnC,MAAM,SAAS,QAAQ,YAAY,UAAU,CAAC,IAC9C,EAAE,mBAAmB,OAAO,sBAAsB,KAAK;AAC3D,YAAI,UAAU,KAAK,EAAE,gBAAgB,kCAAkC,CAAC,EAAE,IAAI,KAAK,UAAU,MAAM,CAAC;AACpG;AAAA,MACF;AACA,UAAI,aAAa,WAAW;AAC1B,iBAAS,OAAO;AAChB,YAAI,UAAU,GAAG,EAAE,IAAI;AACvB;AAAA,MACF;AACA,UAAI,aAAa,QAAQ;AAGvB,YAAI,UAAU,GAAG,EAAE,IAAI;AACvB,uBAAe;AACf;AAAA,MACF;AACA,UAAI,aAAa,UAAU;AACzB,YAAI;AACJ,YAAI;AACF,iBAAO,MAAM,SAAS,GAAG;AAAA,QAC3B,QAAQ;AACN,cAAI,UAAU,GAAG,EAAE,IAAI,gBAAgB;AACvC;AAAA,QACF;AACA,YAAI;AACJ,YAAI;AACF,iBAAQ,KAAK,MAAM,QAAQ,IAAI,EAAwB;AAAA,QACzD,QAAQ;AACN,iBAAO;AAAA,QACT;AACA,YAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,GAAG;AACnC,cAAI,UAAU,GAAG,EAAE,IAAI,cAAc;AACrC;AAAA,QACF;AACA,YAAI,UAAU,GAAG,EAAE,IAAI;AACvB,aAAK,QAAQ,QAAQ,SAAS,MAAM,IAAc,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AACnE;AAAA,MACF;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,SAAS,OAAO;AACjC,YAAM,YAAY,OAAO,UAAU,GAAG;AACtC;AAAA,IACF;AAEA,QAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAAA,EACpC;AAEA,QAAM,SAAS,iBAAiB,CAAC,KAAK,QAAQ;AAC5C,YAAQ,KAAK,GAAG,EAAE,MAAM,MAAM;AAC5B,UAAI,CAAC,IAAI,YAAa,KAAI,UAAU,GAAG,EAAE,IAAI,cAAc;AAAA,UACtD,KAAI,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH,CAAC;AACD,SAAO,OAAO,GAAG,WAAW;AAC5B,QAAM,KAAK,QAAQ,WAAW;AAC9B,QAAM,EAAE,KAAK,IAAI,OAAO,QAAQ;AAEhC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,KAAK,oBAAoB,IAAI;AAAA,IAC7B,OAAO,MACL,IAAI,QAAc,CAAC,SAAS,WAAW;AACrC,iBAAW,OAAO,WAAY,KAAI,IAAI;AACtC,iBAAW,MAAM;AACjB,aAAO,MAAM,CAAC,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAE;AACrD,aAAO,oBAAoB;AAAA,IAC7B,CAAC;AAAA,EACL;AACF;;;AC3PA,eAAsB,YAAY,KAAa,OAA2B,CAAC,GAAqB;AAC9F,QAAMA,QAAO,KAAK,QAAQ;AAC1B,QAAM,WAAW,KAAK,YAAY,QAAQ;AAI1C,QAAM,CAAC,KAAK,IAAI,IACd,aAAa,WACT,CAAC,QAAQ,CAAC,GAAG,CAAC,IACd,aAAa,UACX,CAAC,OAAO,CAAC,MAAM,SAAS,IAAI,GAAG,CAAC,IAChC,CAAC,YAAY,CAAC,GAAG,CAAC;AAE1B,MAAI;AACF,UAAM,IAAI,MAAMA,MAAK,KAAK,IAAI;AAC9B,WAAO,EAAE,SAAS;AAAA,EACpB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":["exec"]}