@axlsdk/studio 0.9.1 → 0.10.0

package/dist/cli.cjs

@@ -24,13 +24,15 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/cli.ts
-var import_node_path2 = require("path");
-var import_node_fs2 = require("fs");
+var import_node_path3 = require("path");
+var import_node_fs3 = require("fs");
 var import_node_url = require("url");
 var import_node_server = require("@hono/node-server");
 var import_node_ws = require("@hono/node-ws");
 
 // src/server/index.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
 var import_hono12 = require("hono");
 var import_cors = require("hono/cors");
 var import_serve_static = require("@hono/node-server/serve-static");
@@ -67,8 +69,13 @@ var ConnectionManager = class {
   channels = /* @__PURE__ */ new Map();
   /** ws -> set of subscribed channels (for cleanup) */
   connections = /* @__PURE__ */ new Map();
+  maxConnections = 100;
   /** Register a new WS connection. */
   add(ws) {
+    if (this.connections.size >= this.maxConnections) {
+      ws.close?.();
+      return;
+    }
     this.connections.set(ws, /* @__PURE__ */ new Set());
   }
   /** Remove a WS connection and all its subscriptions. */
@@ -84,15 +91,16 @@ var ConnectionManager = class {
     }
     this.connections.delete(ws);
   }
-  /** Subscribe a connection to a channel. */
+  /** Subscribe a connection to a channel. No-op if the connection was not added. */
   subscribe(ws, channel) {
+    if (!this.connections.has(ws)) return;
     let subs = this.channels.get(channel);
     if (!subs) {
       subs = /* @__PURE__ */ new Set();
       this.channels.set(channel, subs);
     }
     subs.add(ws);
-    this.connections.get(ws)?.add(channel);
+    this.connections.get(ws).add(channel);
   }
   /** Unsubscribe a connection from a channel. */
   unsubscribe(ws, channel) {
@@ -133,6 +141,14 @@ var ConnectionManager = class {
       }
     }
   }
+  /** Close all connections and clear all state. Used during shutdown. */
+  closeAll() {
+    for (const ws of this.connections.keys()) {
+      ws.close?.();
+    }
+    this.connections.clear();
+    this.channels.clear();
+  }
   /** Get the number of active connections. */
   get connectionCount() {
     return this.connections.size;
@@ -143,6 +159,52 @@ var ConnectionManager = class {
   }
 };
 
+// src/server/ws/protocol.ts
+var VALID_CHANNEL_PREFIXES = ["execution:", "trace:"];
+var VALID_EXACT_CHANNELS = ["costs", "decisions"];
+var MAX_CHANNEL_LENGTH = 256;
+function handleWsMessage(raw, socket, connMgr) {
+  if (raw.length > 65536) {
+    return JSON.stringify({ type: "error", message: "Message too large" });
+  }
+  let msg;
+  try {
+    msg = JSON.parse(raw);
+  } catch {
+    return JSON.stringify({ type: "error", message: "Invalid JSON" });
+  }
+  switch (msg.type) {
+    case "subscribe": {
+      const error = validateChannel(msg.channel);
+      if (error) return JSON.stringify({ type: "error", message: error });
+      connMgr.subscribe(socket, msg.channel);
+      return JSON.stringify({ type: "subscribed", channel: msg.channel });
+    }
+    case "unsubscribe": {
+      const error = validateChannel(msg.channel);
+      if (error) return JSON.stringify({ type: "error", message: error });
+      connMgr.unsubscribe(socket, msg.channel);
+      return JSON.stringify({ type: "unsubscribed", channel: msg.channel });
+    }
+    case "ping":
+      return JSON.stringify({ type: "pong" });
+    default:
+      return JSON.stringify({ type: "error", message: "Unknown message type" });
+  }
+}
+function validateChannel(channel) {
+  if (typeof channel !== "string" || !channel) {
+    return "Missing or invalid channel";
+  }
+  if (channel.length > MAX_CHANNEL_LENGTH) {
+    return `Channel name exceeds ${MAX_CHANNEL_LENGTH} characters`;
+  }
+  if (!VALID_EXACT_CHANNELS.includes(channel) && !VALID_CHANNEL_PREFIXES.some((p) => channel.startsWith(p))) {
+    return `Invalid channel: ${channel}`;
+  }
+  return null;
+}
+
 // src/server/ws/handler.ts
 function createWsHandlers(connMgr) {
   return {
@@ -150,37 +212,8 @@ function createWsHandlers(connMgr) {
       connMgr.add(ws);
     },
     onMessage(event, ws) {
-      let msg;
-      try {
-        msg = JSON.parse(String(event.data));
-      } catch {
-        const err = { type: "error", message: "Invalid JSON" };
-        ws.send(JSON.stringify(err));
-        return;
-      }
-      switch (msg.type) {
-        case "subscribe": {
-          connMgr.subscribe(ws, msg.channel);
-          const reply = { type: "subscribed", channel: msg.channel };
-          ws.send(JSON.stringify(reply));
-          break;
-        }
-        case "unsubscribe": {
-          connMgr.unsubscribe(ws, msg.channel);
-          const reply = { type: "unsubscribed", channel: msg.channel };
-          ws.send(JSON.stringify(reply));
-          break;
-        }
-        case "ping": {
-          const reply = { type: "pong" };
-          ws.send(JSON.stringify(reply));
-          break;
-        }
-        default: {
-          const err = { type: "error", message: `Unknown message type` };
-          ws.send(JSON.stringify(err));
-        }
-      }
+      const reply = handleWsMessage(String(event.data), ws, connMgr);
+      if (reply) ws.send(reply);
     },
     onClose(_event, ws) {
       connMgr.remove(ws);
@@ -751,16 +784,48 @@ function createPlaygroundRoutes(connMgr) {
 
 // src/server/index.ts
 function createServer(options) {
-  const { runtime, staticRoot } = options;
+  const { runtime, staticRoot, basePath = "", readOnly = false } = options;
   const app8 = new import_hono12.Hono();
   const connMgr = new ConnectionManager();
   const costAggregator = new CostAggregator(connMgr);
-  app8.use("*", (0, import_cors.cors)());
+  if (options.cors !== false) {
+    app8.use("*", (0, import_cors.cors)());
+  }
   app8.use("*", errorHandler);
   app8.use("*", async (c, next) => {
     c.set("runtime", runtime);
     await next();
   });
+  if (readOnly) {
+    const blocked = [
+      "POST /api/workflows",
+      "POST /api/executions",
+      "POST /api/sessions",
+      "DELETE /api/sessions",
+      "PUT /api/memory",
+      "DELETE /api/memory",
+      "POST /api/decisions",
+      "POST /api/costs",
+      "POST /api/tools",
+      "POST /api/evals",
+      "POST /api/playground"
+    ];
+    app8.use("/api/*", async (c, next) => {
+      const apiIdx = c.req.path.indexOf("/api/");
+      const apiPath = apiIdx >= 0 ? c.req.path.slice(apiIdx) : c.req.path;
+      const key = `${c.req.method} ${apiPath}`;
+      if (blocked.some((b) => key.startsWith(b))) {
+        return c.json(
+          {
+            ok: false,
+            error: { code: "READ_ONLY", message: "Studio is mounted in read-only mode" }
+          },
+          405
+        );
+      }
+      await next();
+    });
+  }
   const api = new import_hono12.Hono();
   api.route("/", health_default);
   api.route("/", createWorkflowRoutes(connMgr));
@@ -774,7 +839,7 @@ function createServer(options) {
   api.route("/", evals_default);
   api.route("/", createPlaygroundRoutes(connMgr));
   app8.route("/api", api);
-  runtime.on("trace", (event) => {
+  const traceListener = (event) => {
     const traceEvent = event;
     if (traceEvent.executionId) {
       connMgr.broadcastWithWildcard(`trace:${traceEvent.executionId}`, traceEvent);
@@ -783,12 +848,47 @@ function createServer(options) {
     if (traceEvent.type === "await_human") {
       connMgr.broadcast("decisions", traceEvent);
     }
-  });
+  };
+  runtime.on("trace", traceListener);
   if (staticRoot) {
-    app8.use("/*", (0, import_serve_static.serveStatic)({ root: staticRoot }));
-    app8.get("*", (0, import_serve_static.serveStatic)({ root: staticRoot, path: "/index.html" }));
+    app8.use(
+      "/*",
+      (0, import_serve_static.serveStatic)({
+        root: staticRoot,
+        rewriteRequestPath: basePath ? (path) => path.startsWith(basePath) ? path.slice(basePath.length) || "/" : path : void 0
+      })
+    );
+    if (basePath) {
+      const indexPath = (0, import_node_path.resolve)(staticRoot, "index.html");
+      if (!(0, import_node_fs.existsSync)(indexPath)) {
+        console.warn(`[axl-studio] index.html not found at ${indexPath}`);
+      } else {
+        const indexHtml = (0, import_node_fs.readFileSync)(indexPath, "utf-8");
+        const safeBasePath = JSON.stringify(basePath).replace(/</g, "\\u003c");
+        const injectedHtml = indexHtml.replace(
+          "</head>",
+          `<base href="${basePath}/">
+<script>window.__AXL_STUDIO_BASE__=${safeBasePath}</script>
+</head>`
+        );
+        if (injectedHtml === indexHtml) {
+          console.warn(
+            "[axl-studio] Could not inject basePath into index.html \u2014 </head> tag not found. The SPA may not route correctly."
+          );
+        }
+        app8.get("*", (c) => c.html(injectedHtml));
+      }
+    } else {
+      app8.get("*", (0, import_serve_static.serveStatic)({ root: staticRoot, path: "/index.html" }));
+    }
   }
-  return { app: app8, connMgr, costAggregator, createWsHandlers: () => createWsHandlers(connMgr) };
+  return {
+    app: app8,
+    connMgr,
+    costAggregator,
+    createWsHandlers: () => createWsHandlers(connMgr),
+    traceListener
+  };
 }
 
 // src/resolve-runtime.ts
@@ -798,8 +898,8 @@ function resolveRuntime(mod) {
 }
 
 // src/cli-utils.ts
-var import_node_path = require("path");
-var import_node_fs = require("fs");
+var import_node_path2 = require("path");
+var import_node_fs2 = require("fs");
 var CONFIG_CANDIDATES = [
   "axl.config.mts",
   "axl.config.ts",
@@ -808,8 +908,8 @@ var CONFIG_CANDIDATES = [
 ];
 function findConfig(cwd) {
   for (const name of CONFIG_CANDIDATES) {
-    const p = (0, import_node_path.resolve)(cwd, name);
-    if ((0, import_node_fs.existsSync)(p)) return p;
+    const p = (0, import_node_path2.resolve)(cwd, name);
+    if ((0, import_node_fs2.existsSync)(p)) return p;
   }
   return void 0;
 }
@@ -843,7 +943,7 @@ function parseArgs(argv) {
   return result;
 }
 function needsEsmForcing(configPath) {
-  const ext = (0, import_node_path.extname)(configPath);
+  const ext = (0, import_node_path2.extname)(configPath);
   return ext === ".ts" || ext === ".tsx";
 }
 function needsTsxLoader(configPath) {
@@ -881,8 +981,8 @@ Tip: Use .mts for configs with top-level await or in projects without "type": "m
   }
   let configPath;
   if (args.config) {
-    configPath = (0, import_node_path2.resolve)(process.cwd(), args.config);
-    if (!(0, import_node_fs2.existsSync)(configPath)) {
+    configPath = (0, import_node_path3.resolve)(process.cwd(), args.config);
+    if (!(0, import_node_fs3.existsSync)(configPath)) {
       console.error(`Config file not found: ${configPath}`);
       process.exit(1);
     }
@@ -950,7 +1050,7 @@ Tip: Use .mts for configs with top-level await or in projects without "type": "m
   }
   console.log(`[axl-studio] Loading config from ${configPath}`);
   let runtime;
-  const ext = (0, import_node_path2.extname)(configPath);
+  const ext = (0, import_node_path3.extname)(configPath);
   try {
     const mod = await import((0, import_node_url.pathToFileURL)(configPath).href);
     runtime = resolveRuntime(mod);
@@ -987,8 +1087,8 @@ Tip: Use .mts for configs with top-level await or in projects without "type": "m
     console.error(`Failed to load config:`, err);
     process.exit(1);
   }
-  const staticRoot = (0, import_node_path2.resolve)(import_meta.dirname ?? __dirname, "client");
-  const hasStaticAssets = (0, import_node_fs2.existsSync)((0, import_node_path2.resolve)(staticRoot, "index.html"));
+  const staticRoot = (0, import_node_path3.resolve)(import_meta.dirname ?? __dirname, "client");
+  const hasStaticAssets = (0, import_node_fs3.existsSync)((0, import_node_path3.resolve)(staticRoot, "index.html"));
   const { app: app8, createWsHandlers: createWsHandlers2 } = createServer({
     runtime,
     staticRoot: hasStaticAssets ? staticRoot : void 0