@bibobonking/opensol 0.0.0-stage → 3.0.2

package/server/opensol.mjs

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process'
+import { open, readFile, stat, unlink } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { DATA_DIR, ensureDataDir } from './lib/store.mjs'
+import { daemonStatus, startServer, stopDaemon } from './daemon.mjs'
+
+const HERE = path.dirname(fileURLToPath(import.meta.url))
+const DAEMON = path.join(HERE, 'daemon.mjs')
+const LOG_FILE = path.join(DATA_DIR, 'daemon.log')
+const PID_FILE = path.join(DATA_DIR, 'daemon.json')
+
+const HELP = `OpenSol — local coding agent daemon
+
+Usage:
+  opensol start [--port=4174] [--open] [--foreground]
+  opensol stop
+  opensol status
+  opensol open
+  opensol logs
+
+The daemon serves the built app from dist/ and keeps your settings, chats and
+encrypted provider keys in ${DATA_DIR}. It listens on 127.0.0.1 only.
+`
+
+function parseFlags(args) {
+  const flags = { port: 4174, open: false, foreground: false }
+  for (const arg of args) {
+    if (arg === '--open') flags.open = true
+    else if (arg === '--foreground') flags.foreground = true
+    else if (arg.startsWith('--port=')) {
+      const value = Number(arg.slice('--port='.length))
+      if (!Number.isInteger(value) || value < 0 || value > 65535) {
+        throw new Error('Use --port=<1-65535>.')
+      }
+      flags.port = value
+    } else if (arg === '--help' || arg === '-h') {
+      flags.help = true
+    } else {
+      throw new Error(`Unknown option: ${arg}`)
+    }
+  }
+  return flags
+}
+
+function openerFor(url) {
+  const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open'
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
+  const child = spawn(command, args, { detached: true, stdio: 'ignore' })
+  child.on('error', () => console.log(`Open ${url} in your browser.`))
+  child.unref()
+}
+
+async function tailLog(lines = 40) {
+  const info = await stat(LOG_FILE).catch(() => null)
+  if (!info) {
+    console.log('No daemon log yet.')
+    return
+  }
+  const raw = await readFile(LOG_FILE, 'utf8')
+  const slice = raw.trimEnd().split('\n').slice(-lines)
+  console.log(slice.join('\n'))
+}
+
+async function rotateLog() {
+  const info = await stat(LOG_FILE).catch(() => null)
+  if (info && info.size > 5 * 1024 * 1024) {
+    const previous = `${LOG_FILE}.1`
+    await unlink(previous).catch(() => undefined)
+    const { rename } = await import('node:fs/promises')
+    await rename(LOG_FILE, previous).catch(() => undefined)
+  }
+}
+
+async function waitForDaemon(pid, timeoutMs = 15_000) {
+  const started = Date.now()
+  while (Date.now() - started < timeoutMs) {
+    const status = await daemonStatus()
+    if (status.running) return status
+    if (pid) {
+      try {
+        process.kill(pid, 0)
+      } catch {
+        return { running: false, info: null }
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 250))
+  }
+  return { running: false, info: null }
+}
+
+async function commandStart(args) {
+  const flags = parseFlags(args)
+  if (flags.help) {
+    console.log(HELP)
+    return
+  }
+  await ensureDataDir()
+  const existing = await daemonStatus()
+  if (existing.running) {
+    console.log(`OpenSol is already running at ${existing.info.url}`)
+    if (flags.open) openerFor(existing.info.url)
+    return
+  }
+  await unlink(PID_FILE).catch(() => undefined)
+
+  if (flags.foreground) {
+    await startServer({ port: flags.port, open: flags.open })
+    return
+  }
+
+  await rotateLog()
+  const handle = await open(LOG_FILE, 'a', 0o600)
+  const child = spawn(process.execPath, [DAEMON, `--port=${flags.port}`], {
+    detached: true,
+    stdio: ['ignore', handle.fd, handle.fd],
+    cwd: path.resolve(HERE, '..'),
+    env: { ...process.env, OPENSOL_DATA: DATA_DIR, MAXCODE_DATA: DATA_DIR },
+  })
+  child.unref()
+  await handle.close()
+
+  const status = await waitForDaemon(child.pid)
+  if (!status.running) {
+    console.error('OpenSol did not start. Recent log:')
+    await tailLog(20)
+    process.exitCode = 1
+    return
+  }
+  console.log(`OpenSol is running at ${status.info.url}`)
+  console.log(`Data: ${DATA_DIR}`)
+  console.log(`Log:  ${LOG_FILE}`)
+  if (flags.open) openerFor(status.info.url)
+}
+
+async function commandStatus() {
+  const status = await daemonStatus()
+  if (!status.running) {
+    console.log('OpenSol is not running.')
+    return
+  }
+  console.log(`OpenSol is running at ${status.info.url}`)
+  console.log(`PID: ${status.info.pid}`)
+  console.log(`Data: ${status.info.dataDir ?? DATA_DIR}`)
+  console.log(`Dist ready: ${status.info.dist ? 'yes' : 'no'}`)
+}
+
+async function commandOpen() {
+  const status = await daemonStatus()
+  if (!status.running) {
+    console.error('OpenSol is not running. Start it with: opensol start')
+    process.exitCode = 1
+    return
+  }
+  openerFor(status.info.url)
+  console.log(`Opened ${status.info.url}`)
+}
+
+async function commandStop() {
+  const result = await stopDaemon()
+  if (!result.stopped) {
+    console.log(result.reason ?? 'OpenSol is not running.')
+    return
+  }
+  console.log(`Stopped OpenSol${result.pid ? ` (pid ${result.pid})` : ''}.`)
+}
+
+async function main() {
+  const [command = 'help', ...args] = process.argv.slice(2)
+  switch (command) {
+    case 'start':
+      await commandStart(args)
+      break
+    case 'stop':
+      await commandStop()
+      break
+    case 'status':
+      await commandStatus()
+      break
+    case 'open':
+      await commandOpen()
+      break
+    case 'logs':
+      await tailLog()
+      break
+    case 'help':
+    case '--help':
+    case '-h':
+      console.log(HELP)
+      break
+    default:
+      console.error(`Unknown command: ${command}\n`)
+      console.log(HELP)
+      process.exitCode = 1
+  }
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : error)
+  process.exitCode = 1
+})

package/server/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "maxcode",
+  "private": true,
+  "version": "1.0.0",
+  "type": "module",
+  "bin": {
+    "maxcode": "./server/maxcode.mjs"
+  },
+  "scripts": {
+    "dev": "node server/maxcode.mjs start && vite",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview",
+    "typecheck": "tsc -b --pretty",
+    "start": "node server/maxcode.mjs start --open",
+    "daemon": "node server/maxcode.mjs start",
+    "daemon:foreground": "node server/daemon.mjs",
+    "daemon:stop": "node server/maxcode.mjs stop",
+    "daemon:status": "node server/maxcode.mjs status",
+    "daemon:logs": "node server/maxcode.mjs logs"
+  },
+  "dependencies": {
+    "clsx": "^2.1.1",
+    "highlight.js": "^11.11.1",
+    "lucide-react": "^0.544.0",
+    "react": "^19.1.1",
+    "react-dom": "^19.1.1",
+    "react-markdown": "^10.1.0",
+    "rehype-highlight": "^7.0.2",
+    "remark-gfm": "^4.0.1",
+    "zustand": "^5.0.8"
+  },
+  "devDependencies": {
+    "@types/react": "^19.1.10",
+    "@types/react-dom": "^19.1.7",
+    "@vitejs/plugin-react": "^5.0.0",
+    "autoprefixer": "^10.4.21",
+    "postcss": "^8.5.6",
+    "tailwindcss": "^3.4.19",
+    "typescript": "^5.9.2",
+    "vite": "^7.1.3"
+  }
+}

package/shared/plugin-builder.test.mjs

@@ -0,0 +1,43 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { buildPluginArchive, readPluginArchive, validatePluginManifest } from './plugin-package.mjs'
+
+const manifest = {
+  id: 'demo-plugin',
+  name: 'Demo plugin',
+  version: '1.0.0',
+  apiVersion: 1,
+  entry: 'main.js',
+  stylesheet: 'main.css',
+  capabilities: ['ui.commands'],
+  domains: [],
+}
+
+test('a built package reopens with its sources and assets intact', () => {
+  const archive = buildPluginArchive({
+    manifest,
+    files: { 'main.js': 'maxcode.log("hi")', 'main.css': '.a{}', 'assets/icon.txt': 'icon' },
+  })
+  const reopened = readPluginArchive(archive)
+  assert.equal(reopened.manifest.id, 'demo-plugin')
+  assert.equal(reopened.files['main.js'], 'maxcode.log("hi")')
+  assert.equal(reopened.files['main.css'], '.a{}')
+  assert.equal(reopened.files['assets/icon.txt'], 'icon')
+})
+
+test('a manifest may omit domains entirely — a plugin with no network declares none', () => {
+  const { domains, ...withoutDomains } = manifest
+  assert.deepEqual(validatePluginManifest(withoutDomains).domains, [])
+  assert.deepEqual(readPluginArchive(buildPluginArchive({
+    manifest: withoutDomains,
+    files: { 'main.js': 'maxcode.log("hi")', 'main.css': '' },
+  })).manifest.domains, [])
+  assert.throws(() => validatePluginManifest({ ...manifest, domains: 'api.example.com' }), /domains must be an array/)
+})
+
+test('the builder rejects an invalid manifest before packaging', () => {
+  assert.throws(() => validatePluginManifest({ ...manifest, id: 'Bad Id' }), /Invalid plugin package/)
+  assert.throws(() => validatePluginManifest({ ...manifest, entry: 'main.ts' }), /entry must be JavaScript/)
+  assert.throws(() => validatePluginManifest({ ...manifest, capabilities: ['shell.exec'] }), /capabilit/i)
+  assert.throws(() => validatePluginManifest({ ...manifest, domains: ['https://api.example.com'] }), /domain/i)
+})

package/shared/plugin-package.d.mts

@@ -0,0 +1,34 @@
+export type PluginCapability =
+  | 'workspace.list'
+  | 'workspace.read'
+  | 'workspace.write'
+  | 'workspace.edit'
+  | 'ui.commands'
+  | 'ui.panels'
+  | 'ui.themes'
+  | 'network.request'
+
+export interface PluginManifest {
+  id: string
+  name: string
+  version: string
+  apiVersion: 1 | 2
+  entry: string
+  stylesheet: string
+  capabilities: PluginCapability[]
+  domains: string[]
+}
+
+export interface PluginPackageSources {
+  manifest: PluginManifest
+  files: Record<string, string | Uint8Array>
+}
+
+export interface PluginPackage {
+  manifest: PluginManifest
+  files: Record<string, string>
+}
+
+export function validatePluginManifest(value: unknown): PluginManifest
+export function buildPluginArchive(sources: PluginPackageSources): Uint8Array
+export function readPluginArchive(bytes: Uint8Array): PluginPackage

package/shared/plugin-package.mjs

@@ -0,0 +1,197 @@
+const MAX_ARCHIVE_BYTES = 5 * 1024 * 1024
+const MAX_PACKAGE_BYTES = 10 * 1024 * 1024
+const MAX_FILES = 100
+const MAX_MANIFEST_BYTES = 64 * 1024
+const CAPABILITIES = new Set([
+  'workspace.list',
+  'workspace.read',
+  'workspace.write',
+  'workspace.edit',
+  'ui.commands',
+  'ui.panels',
+  'ui.themes',
+  'network.request',
+])
+const MANIFEST_KEYS = new Set([
+  'id',
+  'name',
+  'version',
+  'apiVersion',
+  'entry',
+  'stylesheet',
+  'capabilities',
+  'domains',
+])
+
+function packageError(message) {
+  throw new Error(`Invalid plugin package: ${message}`)
+}
+
+function bytesToString(bytes) {
+  if (typeof bytes === 'string') return bytes
+  return new TextDecoder('utf-8').decode(bytes)
+}
+
+function stringToBytes(str) {
+  return new TextEncoder().encode(str)
+}
+
+function validateSource(path, content, apiVersion) {
+  // API v2: skip validation — full kernel access, blob isolation is enough
+  if (apiVersion === 2) return
+
+  const source = bytesToString(content)
+  const rule = path.endsWith('.js')
+    ? [
+        /\b(?:import|export)\b|\b(?:fetch|XMLHttpRequest|WebSocket|EventSource|importScripts)\s*\(|\bnavigator\s*\.\s*sendBeacon\s*\(/i,
+        'module imports and unmanaged network calls are forbidden',
+      ]
+    : path.endsWith('.css')
+      ? [
+          /@import\b|url\s*\(\s*(['"]?)(?!data:image\/(?:png|jpeg|gif|webp);base64,)[^)]*\)/i,
+          'external CSS resources and imports are forbidden',
+        ]
+      : null
+  if (!rule) return
+  const found = rule[0].exec(source)
+  if (!found) return
+  const line = source.slice(0, found.index).split('\n').length
+  const hit = found[0].length > 60 ? `${found[0].slice(0, 60)}…` : found[0]
+  packageError(`${rule[1]}: found "${hit}" at ${path}:${line}`)
+}
+
+function safePath(value) {
+  if (
+    typeof value !== 'string' ||
+    !value ||
+    value.includes('\0') ||
+    value.includes('\\') ||
+    value.startsWith('/') ||
+    /^[a-zA-Z]:/.test(value) ||
+    value.split('/').some((part) => !part || part === '.' || part === '..')
+  ) {
+    packageError(`unsafe path "${String(value)}"`)
+  }
+  return value
+}
+
+function validateDomain(value) {
+  if (typeof value !== 'string' || value.length > 253 || value.endsWith('.')) {
+    packageError('invalid domain')
+  }
+  const labels = value.split('.')
+  if (
+    labels.length < 2 ||
+    labels.some((label) => !/^(?=.{1,63}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label))
+  ) {
+    packageError(`invalid domain "${value}"`)
+  }
+  return value.toLowerCase()
+}
+
+export function validatePluginManifest(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) packageError('manifest must be an object')
+  if (Object.keys(value).some((key) => !MANIFEST_KEYS.has(key))) packageError('unknown manifest field')
+  const { id, name, version, apiVersion, entry, stylesheet, capabilities, domains } = value
+  if (typeof id !== 'string' || !/^[a-z0-9][a-z0-9-]{1,63}$/.test(id)) packageError('invalid plugin id')
+  if (typeof name !== 'string' || !name.trim() || name.length > 100) packageError('invalid plugin name')
+  if (typeof version !== 'string' || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    packageError('invalid plugin version')
+  }
+  if (apiVersion !== 1 && apiVersion !== 2) packageError('unsupported API version')
+  safePath(entry)
+  safePath(stylesheet)
+  if (!entry.endsWith('.js') || !stylesheet.endsWith('.css')) packageError('entry must be JavaScript and stylesheet must be CSS')
+
+  // API v2: capabilities optional (defaults to [])
+  const normalizedCapabilities = capabilities ?? []
+  if (!Array.isArray(normalizedCapabilities)) packageError('capabilities must be an array')
+  if (apiVersion === 1 && normalizedCapabilities.some((item) => !CAPABILITIES.has(item))) {
+    packageError('invalid capability')
+  }
+
+  if (domains !== undefined && !Array.isArray(domains)) packageError('domains must be an array')
+  const normalizedDomains = (domains ?? []).map(validateDomain)
+  if (new Set(normalizedDomains).size !== normalizedDomains.length) packageError('duplicate domain')
+  return {
+    id,
+    name: name.trim(),
+    version,
+    apiVersion,
+    entry,
+    stylesheet,
+    capabilities: [...new Set(normalizedCapabilities)],
+    domains: normalizedDomains,
+  }
+}
+
+function normalizeFiles(files, manifest) {
+  if (!files || typeof files !== 'object' || Array.isArray(files)) packageError('files must be a path-to-source object')
+  const paths = Object.keys(files)
+  if (paths.length > MAX_FILES) packageError('too many files')
+  const normalized = {}
+  let total = 0
+  for (const rawPath of paths) {
+    const filePath = safePath(rawPath)
+    if (filePath === 'manifest.json') packageError('manifest is generated from the manifest field')
+    if (/\.(?:mjs|cjs|jsx|ts|tsx)$/i.test(filePath) && filePath !== manifest.entry) {
+      packageError(`undeclared executable file "${filePath}"`)
+    }
+    if (filePath !== manifest.entry && filePath !== manifest.stylesheet && /\.(?:js|css)$/i.test(filePath)) {
+      packageError(`undeclared executable file "${filePath}"`)
+    }
+    const content = files[rawPath]
+    if (typeof content !== 'string' && !(content instanceof Uint8Array)) {
+      packageError(`file "${filePath}" must be text or bytes`)
+    }
+    const data = typeof content === 'string' ? stringToBytes(content) : content
+    total += data.byteLength
+    if (total > MAX_PACKAGE_BYTES) packageError('package is too large')
+    if (filePath === manifest.entry || filePath === manifest.stylesheet) validateSource(filePath, data, manifest.apiVersion)
+    normalized[filePath] = typeof content === 'string' ? content : bytesToString(data)
+  }
+  if (!(manifest.entry in normalized)) packageError('entry file is missing')
+  if (!(manifest.stylesheet in normalized)) packageError('stylesheet file is missing')
+  if (stringToBytes(normalized[manifest.entry]).byteLength > 2 * 1024 * 1024) packageError('entry file is too large')
+  return normalized
+}
+
+export function buildPluginArchive(sources) {
+  const manifest = validatePluginManifest(sources?.manifest)
+  const files = normalizeFiles(sources?.files, manifest)
+  const manifestJson = JSON.stringify(manifest)
+  if (stringToBytes(manifestJson).byteLength > MAX_MANIFEST_BYTES) packageError('manifest is too large')
+
+  const packageData = {
+    format: 'cordis-plugin',
+    manifest,
+    files,
+  }
+
+  const encoded = stringToBytes(JSON.stringify(packageData))
+  if (encoded.byteLength > MAX_ARCHIVE_BYTES) packageError('package is too large')
+  return encoded
+}
+
+export function readPluginArchive(bytes) {
+  if (!bytes || !(bytes instanceof Uint8Array) || bytes.byteLength === 0) {
+    packageError('package archive is empty or invalid')
+  }
+  let parsed
+  try {
+    const text = new TextDecoder('utf-8').decode(bytes)
+    parsed = JSON.parse(text)
+  } catch {
+    packageError('package is not a valid JSON archive')
+  }
+
+  if (!parsed || typeof parsed !== 'object') packageError('invalid package format')
+  const manifest = validatePluginManifest(parsed.manifest)
+  const files = parsed.files
+  if (!files || typeof files !== 'object') packageError('missing package files')
+
+  return {
+    manifest,
+    files,
+  }
+}

package/shared/plugin-package.test.mjs

@@ -0,0 +1,94 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { buildPluginArchive, readPluginArchive } from './plugin-package.mjs'
+
+const source = {
+  manifest: {
+    id: 'sample-plugin',
+    name: 'Sample Plugin',
+    version: '1.0.0',
+    apiVersion: 1,
+    entry: 'plugin.js',
+    stylesheet: 'plugin.css',
+    capabilities: ['workspace.read'],
+    domains: ['api.example.test'],
+  },
+  files: {
+    'plugin.js': 'api.registerCommand("sample", () => "ok")',
+    'plugin.css': '.sample { color: red }',
+    'icon.svg': '<svg xmlns="http://www.w3.org/2000/svg"></svg>',
+  },
+}
+
+test('plugin archive round-trips manifest and local source files', () => {
+  const archive = buildPluginArchive(source)
+  const result = readPluginArchive(archive)
+  assert.deepEqual(result.manifest, source.manifest)
+  assert.deepEqual(result.files, source.files)
+})
+
+test('plugin archive rejects traversal paths before packaging', () => {
+  assert.throws(
+    () => buildPluginArchive({ ...source, files: { ...source.files, '../outside.js': 'bad' } }),
+    /path/i,
+  )
+})
+
+test('plugin archive rejects a manifest whose entry is missing', () => {
+  assert.throws(() => buildPluginArchive({ ...source, files: { 'plugin.css': 'x' } }), /entry/i)
+})
+
+test('plugin archive rejects undeclared executable source', () => {
+  assert.throws(
+    () => buildPluginArchive({ ...source, files: { ...source.files, 'extra.js': 'alert(1)' } }),
+    /executable/i,
+  )
+})
+
+test('plugin archive rejects remote code declarations and invalid domains', () => {
+  assert.throws(
+    () => buildPluginArchive({ ...source, manifest: { ...source.manifest, entry: 'https://evil.test/p.js' } }),
+    /entry|path/i,
+  )
+  assert.throws(
+    () => buildPluginArchive({ ...source, manifest: { ...source.manifest, domains: ['https://example.test'] } }),
+    /domain/i,
+  )
+})
+
+test('plugin archive rejects unmanaged network APIs and external CSS resources', () => {
+  assert.throws(
+    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.js': 'fetch("https://evil.test")' } }),
+    /network|remote/i,
+  )
+  assert.throws(
+    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.css': '@import url("https://evil.test/style.css")' } }),
+    /network|remote|external/i,
+  )
+})
+
+test('a rejected source names the file, the line and the text that matched', () => {
+  // The pattern is text-only, so a comment or a string trips it too — the message
+  // has to point at the match or the author cannot find it.
+  assert.throws(
+    () =>
+      buildPluginArchive({
+        ...source,
+        files: { ...source.files, 'plugin.js': 'maxcode.log("hi")\n// export the palette\nconst x = 1' },
+      }),
+    /found "export" at plugin\.js:2/,
+  )
+  assert.throws(() => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.js': 'fetch("https://evil.test")' } }), /"fetch\("/)
+  assert.throws(
+    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.css': '.a{}\n@import url("https://evil.test/x.css")' } }),
+    /plugin\.css:2/,
+  )
+})
+
+test('plugin archive rejects malformed or oversized archives', () => {
+  assert.throws(() => readPluginArchive(new Uint8Array([0, 1, 2, 3])), /archive|zip|package/i)
+  assert.throws(
+    () => buildPluginArchive({ ...source, files: { ...source.files, 'plugin.js': 'x'.repeat(10_485_761) } }),
+    /size|large/i,
+  )
+})