@axlsdk/studio 0.20.1 → 0.21.1

package/README.md

@@ -68,7 +68,9 @@ Your application imports from `src/runtime.ts` directly. Studio discovers everyt
 npx @axlsdk/studio --open
 ```
 
-This loads your config, starts the server on `http://localhost:4400`, and opens the browser.
+This loads your config and starts the server on `http://127.0.0.1:4400`. The
+standalone CLI binds only to IPv4 loopback, emits no CORS headers, and rejects
+non-local HTTP hosts and browser origins across both REST and WebSocket routes.
 
 ## CLI Options
 
@@ -77,12 +79,24 @@ axl-studio [options]
 
 Options:
   --port <number>          Server port (default: 4400)
+  --dangerously-bind <ip>  Bind for a loopback-published container/local-forward tunnel
   --config <path>          Path to config file (default: auto-detect)
   --conditions <list>      Comma-separated Node.js import conditions (e.g., development)
+  --read-only              Disable mutating endpoints
   --open                   Auto-open browser
   -h, --help               Show help
 ```
 
+For a container or devcontainer, bind the published host port to loopback and
+make only the container listener broad:
+
+```bash
+docker run -p 127.0.0.1:4400:4400 ... axl-studio --dangerously-bind 0.0.0.0
+```
+
+The Host/Origin guard remains active. Do not publish that port on a public or
+LAN interface; standalone Studio has no user authentication.
+
 The `--conditions` flag is useful in monorepos where workspace packages use the `"development"` export condition to point at source instead of built dist files. Pass `--conditions development` to resolve imports through source paths.
 
 **Note:** `--conditions` only applies to ESM `import()` resolution. Transitive `require()` calls from packages without `"type": "module"` bypass the hook and use default conditions. If a dependency loads via CJS, it will still resolve from `dist/` regardless of the flag.
@@ -179,24 +193,32 @@ const studio = createStudioMiddleware({
   runtime,
   basePath: '/studio',
   // WebSocket upgrades bypass Express middleware — always authenticate here.
-  verifyUpgrade: (req) => {
-    const url = new URL(req.url!, `http://${req.headers.host}`);
-    return url.searchParams.get('token') === process.env.MY_SECRET;
-  },
+  verifyUpgrade: (req) => authenticateStudioRequest(req)?.isAdmin === true,
 });
 
 const app = express();
-app.use('/studio', studio.handler);
+const authenticateStudioHttp: express.RequestHandler = (req, res, next) => {
+  if (authenticateStudioRequest(req)?.isAdmin !== true) return res.sendStatus(403);
+  next();
+};
+app.use('/studio', authenticateStudioHttp, studio.handler);
 const server = app.listen(3000);
 studio.upgradeWebSocket(server); // required for live data
 ```
 
-Key options: `readOnly` (disable mutating endpoints for production monitoring), `evals` (lazy-load eval files), `filterTraceEvent` (per-tenant broadcast scoping), `bufferCaps` (WS replay-buffer limits). `basePath` must match your framework's mount path.
+Key options: `readOnly` (disable mutating endpoints for production monitoring), `evals` (lazy-load eval files), `filterTraceEvent` (per-tenant broadcast scoping), `bufferCaps` (WS replay-buffer limits). `basePath` must match your framework's mount path. In production, `upgradeWebSocket()` refuses to attach without `verifyUpgrade`; `dangerouslyAllowUnauthenticatedWebSockets` is the explicit escape hatch only when an outer upgrade gate is independently guaranteed.
 
 **See [`docs/studio-api.md`](../../docs/studio-api.md) for the full reference:** every REST endpoint, the WebSocket protocol, the complete middleware options/return tables, NestJS/Fastify/Hono examples, host body-limit guidance, lazy eval loading, multi-tenant setup, and the internal architecture.
 
 ## Security
 
+- **Treat Studio as an administrative surface, never as a public application
+  API.** Agent routes intentionally expose resolved system prompts, tool
+  descriptions, schemas, and runtime configuration. `trace.redact` protects
+  user/model observability content; it is not authentication and does not hide
+  static agent configuration.
+- Protect the Studio HTTP mount with your framework's authentication and
+  authorization middleware.
 - **Always** provide `verifyUpgrade` — WebSocket upgrades bypass Express/Fastify/Koa middleware, so your auth middleware does **not** protect WebSocket connections.
 - Consider `readOnly: true` for production monitoring — view traces, costs, and schemas without execution capability.
 - CORS is not applied in embedded mode — the host framework owns CORS policy.

package/dist/{chunk-KQ3HBRTC.js → chunk-YGLWYDQ3.js}

@@ -1363,7 +1363,10 @@ function createSessionRoutes(connMgr) {
     const body = await c.req.json();
     const session = runtime.session(id);
     const result = await session.send(body.workflow, body.message);
-    return c.json({ ok: true, data: { result } });
+    return c.json({
+      ok: true,
+      data: { result: redactValue(result, runtime.isRedactEnabled()) }
+    });
   });
   app5.post("/sessions/:id/stream", async (c) => {
     const runtime = c.get("runtime");
@@ -1372,9 +1375,13 @@ function createSessionRoutes(connMgr) {
     const session = runtime.session(id);
     const stream = await session.stream(body.workflow, body.message);
     const executionId = `session-${id}-${Date.now()}`;
+    const redactOn = runtime.isRedactEnabled();
     (async () => {
       for await (const event of stream) {
-        connMgr.broadcastWithWildcard(`execution:${executionId}`, event);
+        connMgr.broadcastWithWildcard(
+          `execution:${executionId}`,
+          redactStreamEvent(event, redactOn)
+        );
       }
     })();
     return c.json({ ok: true, data: { executionId, streaming: true } });
@@ -16080,7 +16087,7 @@ function createServer(options) {
     emptyState: emptyEvalTrendData,
     windows
   });
-  if (options.cors !== false) {
+  if (options.cors === true) {
     app5.use("*", cors());
   }
   app5.onError(errorHandler);
@@ -16239,4 +16246,4 @@ export {
   EvalAggregator,
   createServer
 };
-//# sourceMappingURL=chunk-KQ3HBRTC.js.map
+//# sourceMappingURL=chunk-YGLWYDQ3.js.map