@castlekit/castle 0.3.2 → 0.4.0

package/.next/standalone/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Brian Laughlan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/.next/standalone/README.md

@@ -0,0 +1,54 @@
+# Castle
+
+The extensible interface for [OpenClaw](https://openclaw.ai) AI agents.
+
+Castle is a local-first, open-source UI that gives you chat, agent management, and a dashboard for your OpenClaw agents. Everything runs on your machine — no cloud services, no data leakage.
+
+## Quick Install
+
+```bash
+curl -fsSL https://castlekit.com/install.sh | bash
+```
+
+## Manual Install
+
+```bash
+npm install -g @castlekit/castle
+castle setup
+```
+
+## Development
+
+```bash
+git clone https://github.com/castlekit/castle.git
+cd castle
+npm install
+npm run dev
+```
+
+Then open [http://localhost:3333](http://localhost:3333).
+
+## Releasing
+
+```bash
+# 1. Bump version
+npm version patch --no-git-tag-version
+
+# 2. Commit and push
+git add -A && git commit -m "Release vX.Y.Z" && git push
+
+# 3. Publish to npm (requires 2FA)
+npm publish --access public
+
+# 4. Tag the release
+git tag vX.Y.Z && git push origin vX.Y.Z
+```
+
+## Requirements
+
+- Node.js >= 22
+- [OpenClaw](https://openclaw.ai) (installed automatically if missing)
+
+## License
+
+MIT

package/.next/standalone/SECURITY.md

@@ -0,0 +1,80 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you believe you've found a security vulnerability in Castle, please open a [GitHub issue](https://github.com/castlekit/castle/issues).
+
+We make no guarantees about response times or fixes. This software is provided as-is under the [MIT License](LICENSE).
+
+## Out of Scope
+
+The following are **not** considered vulnerabilities:
+
+- Public internet exposure — Castle's web interface is not designed for public access
+- Prompt injection attacks
+- Using Castle in ways the documentation recommends against
+- Vulnerabilities in dependencies that don't affect Castle's usage
+
+## Web Interface Safety
+
+Castle's web interface is intended for **local use only**. Do not bind it to the public internet; it is not hardened for public exposure.
+
+## Runtime Requirements
+
+### Node.js Version
+
+Castle requires **Node.js 22.12.0 or later** (LTS). This version includes important security patches:
+
+- CVE-2025-59466: async_hooks DoS vulnerability
+- CVE-2026-21636: Permission model bypass vulnerability
+
+Verify your Node.js version:
+
+```bash
+node --version  # Should be v22.12.0 or later
+```
+
+### Docker Security
+
+When running Castle in Docker:
+
+1. Run as a non-root user for reduced attack surface
+2. Use `--read-only` flag when possible for filesystem protection
+3. Limit container capabilities with `--cap-drop=ALL`
+
+Example secure Docker run:
+
+```bash
+docker run --read-only --cap-drop=ALL \
+  -v castle-data:/app/data \
+  -p 3333:3333 \
+  castle:latest
+```
+
+## Security Scanning
+
+This project uses [`detect-secrets`](https://github.com/Yelp/detect-secrets) for automated secret detection in CI and pre-commit hooks, with a custom plugin for Castle/OpenClaw-specific patterns.
+
+Run locally:
+
+```bash
+pip install detect-secrets==1.5.0
+detect-secrets scan --baseline .secrets.baseline --custom-plugins .detect-secrets-plugins/
+```
+
+See `.detect-secrets.cfg` for configuration and `.secrets.baseline` for the baseline.
+
+### Pre-commit hooks
+
+Install [pre-commit](https://pre-commit.com) for local secret scanning, GitHub Actions linting, and file hygiene checks:
+
+```bash
+pip install pre-commit
+pre-commit install
+```
+
+Hooks run automatically on every commit. Run manually with:
+
+```bash
+pre-commit run --all-files
+```

package/.next/standalone/bin/castle.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+
+// Castle CLI - The multi-agent workspace
+// https://castlekit.com
+
+// Enable Node.js compile cache for faster startup (same pattern as OpenClaw)
+import module from "node:module";
+if (module.enableCompileCache && !process.env.NODE_DISABLE_COMPILE_CACHE) {
+  try { module.enableCompileCache(); } catch { /* ignore */ }
+}
+
+// Bootstrap tsx from the package's own node_modules so it works
+// regardless of the user's current working directory.
+import { dirname, resolve } from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+if (!process.env._CASTLE_CLI) {
+  const { execFileSync } = await import("child_process");
+  const tsxImport = resolve(__dirname, "..", "node_modules", "tsx", "dist", "esm", "index.mjs");
+  try {
+    execFileSync(process.execPath, ["--import", tsxImport, ...process.argv.slice(1)], {
+      stdio: "inherit",
+      env: { ...process.env, _CASTLE_CLI: "1" },
+    });
+  } catch (e) {
+    process.exit(e.status || 1);
+  }
+  process.exit(0);
+}
+
+const { program } = await import("commander");
+const pc = (await import("picocolors")).default;
+const { readFileSync } = await import("fs");
+let version = "0.0.0";
+try {
+  version = JSON.parse(readFileSync(resolve(__dirname, "..", "package.json"), "utf-8")).version;
+} catch { /* fallback */ }
+
+program
+  .name("castle")
+  .description("The multi-agent workspace")
+  .version(version);
+
+program
+  .command("setup")
+  .description("Run the Castle setup wizard")
+  .action(async () => {
+    const { runOnboarding } = await import("../src/cli/onboarding.ts");
+    await runOnboarding();
+  });
+
+program
+  .command("open")
+  .description("Open Castle in the browser")
+  .action(async () => {
+    const { readConfig, configExists } = await import("../src/lib/config.ts");
+    const { existsSync } = await import("fs");
+
+    // Verify build output exists before trying to open
+    const nextDir = resolve(__dirname, "..", ".next");
+    if (!existsSync(nextDir)) {
+      console.log(pc.bold("\n  🏰 Castle\n"));
+      console.log(pc.red("  Castle has not been built yet.\n"));
+      console.log(`  Run ${pc.cyan("castle setup")} to build and start Castle.\n`);
+      return;
+    }
+
+    const open = (await import("open")).default;
+    const port = configExists() ? readConfig().server?.port || 3333 : 3333;
+    const url = `http://localhost:${port}`;
+    console.log(pc.bold("\n  🏰 Castle\n"));
+    console.log(`  Opening ${pc.cyan(url)}...\n`);
+    await open(url);
+  });
+
+program
+  .command("update")
+  .description("Check for updates and install the latest version")
+  .action(async () => {
+    const { execSync } = await import("child_process");
+
+    console.log(pc.bold("\n  🏰 Castle\n"));
+    console.log(pc.dim("  Checking for updates...\n"));
+
+    let latest;
+    try {
+      latest = execSync("npm view @castlekit/castle version", {
+        encoding: "utf-8",
+        timeout: 15000,
+        stdio: ["ignore", "pipe", "ignore"],
+      }).trim();
+    } catch {
+      console.log(pc.yellow("  Could not check for updates. Try again later.\n"));
+      return;
+    }
+
+    if (version === latest) {
+      console.log(`  You're on the latest version (${pc.green(version)}).\n`);
+      return;
+    }
+
+    // Check for major version bump
+    const currentMajor = parseInt(version.split(".")[0], 10);
+    const latestMajor = parseInt(latest.split(".")[0], 10);
+
+    if (latestMajor > currentMajor) {
+      const readline = await import("readline");
+      const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+      const answer = await new Promise((resolve) => {
+        rl.question(
+          `  ${pc.yellow("⚠")} Castle ${pc.cyan(latest)} is available (you have ${pc.dim(version)}).\n` +
+          `  This is a major version update and may include breaking changes.\n\n` +
+          `  Continue? (y/N) `,
+          resolve
+        );
+      });
+      rl.close();
+
+      if (answer.toLowerCase() !== "y") {
+        console.log(pc.dim("\n  Update cancelled.\n"));
+        return;
+      }
+      console.log();
+    }
+
+    console.log(`  Updating Castle from ${pc.dim(version)} to ${pc.cyan(latest)}...\n`);
+
+    try {
+      execSync(`npm install -g @castlekit/castle@${latest}`, {
+        stdio: "inherit",
+        timeout: 120000,
+      });
+      console.log(pc.green(`\n  ✔ Updated successfully!\n`));
+    } catch {
+      console.log(pc.red(`\n  Update failed.`));
+      console.log(`  Try manually: ${pc.cyan(`npm install -g @castlekit/castle@${latest}`)}\n`);
+    }
+  });
+
+program
+  .command("status")
+  .description("Show Castle and agent status")
+  .action(async () => {
+    const { readConfig, configExists, isOpenClawInstalled } = await import(
+      "../src/lib/config.ts"
+    );
+
+    console.log(pc.bold("\n  🏰 Castle Status\n"));
+
+    if (!configExists()) {
+      console.log(pc.yellow("  Castle is not configured yet."));
+      console.log(`  Run ${pc.cyan("castle setup")} to get started.\n`);
+      return;
+    }
+
+    const config = readConfig();
+    console.log(
+      `  OpenClaw: ${
+        isOpenClawInstalled() ? pc.green("Installed") : pc.red("Not found")
+      }`
+    );
+    console.log(`  Gateway:  ${pc.dim(`ws://127.0.0.1:${config.openclaw.gateway_port}`)}`);
+    console.log(
+      `  Primary:  ${pc.cyan(config.openclaw.primary_agent || "not set")}`
+    );
+    console.log(`  Web UI:   ${pc.cyan(`http://localhost:${config.server.port}`)}`);
+    console.log();
+  });
+
+// Default action (no subcommand) — trigger setup if first run, otherwise show help
+if (process.argv.length <= 2) {
+  (async () => {
+    const { configExists } = await import("../src/lib/config.ts");
+
+    if (!configExists()) {
+      // First run — trigger onboarding
+      const { runOnboarding } = await import("../src/cli/onboarding.ts");
+      await runOnboarding();
+    } else {
+      console.log(pc.bold("\n  🏰 Castle\n"));
+      console.log(pc.dim("  The multi-agent workspace.\n"));
+      console.log(`  ${pc.cyan("castle open")}     Open the web UI`);
+      console.log(`  ${pc.cyan("castle setup")}    Re-run setup wizard`);
+      console.log(`  ${pc.cyan("castle status")}   Show status`);
+      console.log(`  ${pc.cyan("castle update")}   Check for updates`);
+      console.log(`  ${pc.cyan("castle --help")}   All commands\n`);
+    }
+  })();
+} else {
+  program.parse();
+}

package/.next/standalone/castle_secrets.py

@@ -0,0 +1,29 @@
+"""
+Custom detect-secrets plugin for Castle / OpenClaw specific secrets.
+
+Detects:
+- OpenClaw reward tokens (rew_ prefix with 32+ hex chars)
+- Hardcoded OPENCLAW_GATEWAY_TOKEN values
+- Remote WebSocket gateway URLs (non-localhost)
+"""
+
+import re
+
+from detect_secrets.plugins.base import RegexBasedDetector
+
+
+class CastleOpenClawDetector(RegexBasedDetector):
+    """Detect Castle and OpenClaw specific secrets."""
+
+    secret_type = "Castle/OpenClaw Secret"
+
+    denylist = [
+        # OpenClaw reward tokens — real ones are 32+ hex chars
+        re.compile(r"rew_[a-f0-9]{32,}"),
+        # Hardcoded gateway token values (not env var references like ${VAR})
+        re.compile(r"OPENCLAW_GATEWAY_TOKEN\s*=\s*[\"']?(?!\$\{)[^\s\"']{8,}"),
+        # Remote WebSocket URLs (exclude localhost / 127.0.0.1)
+        re.compile(
+            r"wss?://(?!localhost)(?!127\.0\.0\.1)(?!0\.0\.0\.0)[a-zA-Z0-9][\w.\-:]+"
+        ),
+    ]

package/.next/standalone/drizzle.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./src/lib/db/schema.ts",
+  out: "./src/lib/db/migrations",
+  dialect: "sqlite",
+});

package/.next/standalone/index.js

@@ -0,0 +1 @@
+// CastleKit - Coming soon