@axlsdk/studio 0.20.1 → 0.21.1

package/dist/cli.cjs

@@ -1392,7 +1392,10 @@ function createSessionRoutes(connMgr) {
     const body = await c.req.json();
     const session = runtime.session(id);
     const result = await session.send(body.workflow, body.message);
-    return c.json({ ok: true, data: { result } });
+    return c.json({
+      ok: true,
+      data: { result: redactValue(result, runtime.isRedactEnabled()) }
+    });
   });
   app5.post("/sessions/:id/stream", async (c) => {
     const runtime = c.get("runtime");
@@ -1401,9 +1404,13 @@ function createSessionRoutes(connMgr) {
     const session = runtime.session(id);
     const stream = await session.stream(body.workflow, body.message);
     const executionId = `session-${id}-${Date.now()}`;
+    const redactOn = runtime.isRedactEnabled();
     (async () => {
       for await (const event of stream) {
-        connMgr.broadcastWithWildcard(`execution:${executionId}`, event);
+        connMgr.broadcastWithWildcard(
+          `execution:${executionId}`,
+          redactStreamEvent(event, redactOn)
+        );
       }
     })();
     return c.json({ ok: true, data: { executionId, streaming: true } });
@@ -16109,7 +16116,7 @@ function createServer(options) {
     emptyState: emptyEvalTrendData,
     windows
   });
-  if (options.cors !== false) {
+  if (options.cors === true) {
     app5.use("*", (0, import_cors.cors)());
   }
   app5.onError(errorHandler);
@@ -16265,8 +16272,58 @@ var import_axl6 = require("@axlsdk/axl");
 
 // src/cli-utils.ts
 var import_axl7 = require("@axlsdk/axl");
+var STUDIO_CLI_HOST = "127.0.0.1";
+function isLoopbackHostname(hostname3) {
+  return hostname3 === "localhost" || hostname3 === "localhost." || hostname3 === "127.0.0.1";
+}
+function isAllowedStandaloneHost(host) {
+  if (!host) return false;
+  let url2;
+  try {
+    url2 = new URL(`http://${host}`);
+  } catch {
+    return false;
+  }
+  if (url2.username || url2.password || url2.pathname !== "/" || url2.search || url2.hash) return false;
+  return isLoopbackHostname(url2.hostname);
+}
+function isAllowedStandaloneOrigin(origin) {
+  if (origin === void 0) return true;
+  let url2;
+  try {
+    url2 = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") return false;
+  if (url2.username || url2.password || url2.pathname !== "/" || url2.search || url2.hash) return false;
+  return isLoopbackHostname(url2.hostname);
+}
+function isAllowedStandaloneRequest(host, origin) {
+  return isAllowedStandaloneHost(host) && isAllowedStandaloneOrigin(origin);
+}
+function withStandaloneRequestGuard(fetch) {
+  return (request) => {
+    const host = request.headers.get("host") ?? void 0;
+    const origin = request.headers.get("origin") ?? void 0;
+    if (!isAllowedStandaloneRequest(host, origin)) {
+      return Response.json(
+        {
+          ok: false,
+          error: {
+            code: "FORBIDDEN_HOST_ORIGIN",
+            message: "Standalone Studio accepts requests only through a local host and origin"
+          }
+        },
+        { status: 403 }
+      );
+    }
+    return fetch(request);
+  };
+}
 function parseArgs(argv) {
   let port = 4400;
+  let host = STUDIO_CLI_HOST;
   let config2;
   let open = false;
   let help = false;
@@ -16277,6 +16334,9 @@ function parseArgs(argv) {
     if (arg === "--port" && argv[i + 1]) {
       port = parseInt(argv[i + 1], 10);
       i++;
+    } else if (arg === "--dangerously-bind" && argv[i + 1]) {
+      host = argv[i + 1];
+      i++;
     } else if (arg === "--config" && argv[i + 1]) {
       config2 = argv[i + 1];
       i++;
@@ -16291,7 +16351,7 @@ function parseArgs(argv) {
       help = true;
     }
   }
-  const result = { port, config: config2, open, help, conditions, readOnly };
+  const result = { port, host, config: config2, open, help, conditions, readOnly };
   if (isNaN(port) || port < 1 || port > 65535) {
     result.portError = `Invalid port: ${port}. Must be between 1 and 65535.`;
   }
@@ -16311,6 +16371,7 @@ Usage:
 
 Options:
   --port <number>          Server port (default: 4400)
+  --dangerously-bind <ip>  Bind for a loopback-published container/local-forward tunnel
   --config <path>          Path to config file (default: auto-detect)
   --conditions <list>      Comma-separated Node.js import conditions (e.g., development)
   --read-only              Disable all mutating endpoints (runs, imports, rescore, etc)
@@ -16403,24 +16464,41 @@ Tip: Use .mts for configs with top-level await or in projects without "type": "m
   const { app: app5, createWsHandlers: createWsHandlers2 } = createServer({
     runtime,
     staticRoot: hasStaticAssets ? staticRoot : void 0,
-    readOnly: args.readOnly
+    readOnly: args.readOnly,
+    cors: false
   });
   if (args.readOnly) {
     console.log("[axl-studio] Read-only mode enabled \u2014 mutating endpoints are disabled.");
   }
   const { injectWebSocket, upgradeWebSocket } = (0, import_node_ws.createNodeWebSocket)({ app: app5 });
   const wsHandlers = createWsHandlers2();
+  app5.use("/ws", async (c, next) => {
+    if (!isAllowedStandaloneRequest(c.req.header("Host"), c.req.header("Origin"))) {
+      return c.json(
+        {
+          ok: false,
+          error: {
+            code: "FORBIDDEN_HOST_ORIGIN",
+            message: "Standalone Studio accepts WebSocket connections only locally"
+          }
+        },
+        403
+      );
+    }
+    await next();
+  });
   app5.get(
     "/ws",
     upgradeWebSocket(() => wsHandlers)
   );
   const server = (0, import_node_server.serve)(
     {
-      fetch: app5.fetch,
-      port: args.port
+      fetch: withStandaloneRequestGuard((request) => app5.fetch(request)),
+      port: args.port,
+      hostname: args.host
     },
     (info) => {
-      console.log(`[axl-studio] Server running at http://localhost:${info.port}`);
+      console.log(`[axl-studio] Server running at http://${STUDIO_CLI_HOST}:${info.port}`);
       console.log(`[axl-studio] Workflows: ${runtime.getWorkflowNames().join(", ") || "(none)"}`);
       console.log(
         `[axl-studio] Agents: ${runtime.getAgents().map((a) => a._name).join(", ") || "(none)"}`
@@ -16436,8 +16514,13 @@ Tip: Use .mts for configs with top-level await or in projects without "type": "m
     }
   );
   injectWebSocket(server);
+  if (args.host !== STUDIO_CLI_HOST) {
+    console.warn(
+      `[axl-studio] WARNING: binding to ${args.host}. Use this only behind a local-only container port mapping or local-forward tunnel; standalone Studio remains unauthenticated.`
+    );
+  }
   if (args.open) {
-    const url2 = `http://localhost:${args.port}`;
+    const url2 = `http://${STUDIO_CLI_HOST}:${args.port}`;
     const { exec } = await import("child_process");
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     exec(`${cmd} ${url2}`);