@cat-factory/local-server 0.38.10 → 0.38.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +37 -5
- package/dist/config.js.map +1 -1
- package/package.json +11 -11
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AA2EpD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAoD5E;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAEjE"}
|
package/dist/config.js
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
1
|
import { loadNodeConfig } from '@cat-factory/node-server';
|
|
2
|
+
import { base64urlToBytes } from '@cat-factory/server';
|
|
2
3
|
import { resolveHostAlias } from './runtimes/index.js';
|
|
4
|
+
// Local mode defaults the auth gate OPEN and can be exposed on a LAN, so a weak
|
|
5
|
+
// AUTH_SESSION_SECRET would leave sessions / machine / proxy tokens forgeable. The
|
|
6
|
+
// hosted Node loader only enforces this length when gating its OAuth providers; local
|
|
7
|
+
// mode must enforce it on the raw secret too. 32 chars matches MIN_SESSION_SECRET_LENGTH
|
|
8
|
+
// in the Node loader.
|
|
9
|
+
const MIN_SESSION_SECRET_LENGTH = 32;
|
|
10
|
+
/** The system encryption key must decode to at least this many bytes (AES-256). */
|
|
11
|
+
const MIN_ENCRYPTION_KEY_BYTES = 32;
|
|
3
12
|
// Local mode is a single developer running the whole product on their own machine.
|
|
4
13
|
// It reuses the Node facade's config loader verbatim and only changes the defaults
|
|
5
14
|
// that would otherwise force cloud-style setup:
|
|
@@ -23,11 +32,34 @@ const DEFAULT_PORT = '8787';
|
|
|
23
32
|
*/
|
|
24
33
|
function requireStableSecret(env, name) {
|
|
25
34
|
const value = env[name]?.trim();
|
|
26
|
-
if (value)
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
35
|
+
if (!value) {
|
|
36
|
+
throw new Error(`${name} is required in local mode but is not set. It must stay stable across restarts (a ` +
|
|
37
|
+
`fresh value each boot forces a re-login and orphans encrypted credentials). Generate ` +
|
|
38
|
+
`both secrets with \`pnpm secrets\` in deploy/local and add them to your .env.`);
|
|
39
|
+
}
|
|
40
|
+
// Local mode leaves the auth gate open by default, so a short session secret is a real
|
|
41
|
+
// token-forgery risk if the box is reachable on a LAN — reject it up front rather than
|
|
42
|
+
// running with a guessable HMAC key.
|
|
43
|
+
if (name === 'AUTH_SESSION_SECRET' && value.length < MIN_SESSION_SECRET_LENGTH) {
|
|
44
|
+
throw new Error(`AUTH_SESSION_SECRET must be at least ${MIN_SESSION_SECRET_LENGTH} characters (it signs the ` +
|
|
45
|
+
`session/proxy/machine tokens). Generate a strong one with \`pnpm secrets\` in deploy/local.`);
|
|
46
|
+
}
|
|
47
|
+
// Validate the encryption key decodes to a full AES-256 key at config load, so a too-short
|
|
48
|
+
// key fails with a clear message here rather than deep inside the first cipher build.
|
|
49
|
+
if (name === 'ENCRYPTION_KEY') {
|
|
50
|
+
let bytes;
|
|
51
|
+
try {
|
|
52
|
+
bytes = base64urlToBytes(value);
|
|
53
|
+
}
|
|
54
|
+
catch {
|
|
55
|
+
throw new Error('ENCRYPTION_KEY must be a valid base64-encoded key. Generate one with `pnpm secrets`.');
|
|
56
|
+
}
|
|
57
|
+
if (bytes.length < MIN_ENCRYPTION_KEY_BYTES) {
|
|
58
|
+
throw new Error(`ENCRYPTION_KEY must decode to at least ${MIN_ENCRYPTION_KEY_BYTES} bytes (it seals ` +
|
|
59
|
+
`credentials at rest). Generate one with \`pnpm secrets\` in deploy/local.`);
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
return value;
|
|
31
63
|
}
|
|
32
64
|
/**
|
|
33
65
|
* Apply local-mode env defaults onto a copy of {@link env}. Idempotent: an explicitly
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,mFAAmF;AACnF,mFAAmF;AACnF,gDAAgD;AAChD,iFAAiF;AACjF,+DAA+D;AAC/D,oFAAoF;AACpF,yDAAyD;AACzD,uFAAuF;AACvF,2FAA2F;AAC3F,yCAAyC;AAEzC,MAAM,YAAY,GAAG,MAAM,CAAA;AAE3B;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,GAAsB,EAAE,IAAY;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAA;IAC/B,IAAI,KAAK
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,gFAAgF;AAChF,mFAAmF;AACnF,sFAAsF;AACtF,yFAAyF;AACzF,sBAAsB;AACtB,MAAM,yBAAyB,GAAG,EAAE,CAAA;AACpC,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAEnC,mFAAmF;AACnF,mFAAmF;AACnF,gDAAgD;AAChD,iFAAiF;AACjF,+DAA+D;AAC/D,oFAAoF;AACpF,yDAAyD;AACzD,uFAAuF;AACvF,2FAA2F;AAC3F,yCAAyC;AAEzC,MAAM,YAAY,GAAG,MAAM,CAAA;AAE3B;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,GAAsB,EAAE,IAAY;IAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,oFAAoF;YACzF,uFAAuF;YACvF,+EAA+E,CAClF,CAAA;IACH,CAAC;IACD,uFAAuF;IACvF,uFAAuF;IACvF,qCAAqC;IACrC,IAAI,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,wCAAwC,yBAAyB,4BAA4B;YAC3F,6FAA6F,CAChG,CAAA;IACH,CAAC;IACD,2FAA2F;IAC3F,sFAAsF;IACtF,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,IAAI,KAAiB,CAAA;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAA;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,0CAA0C,wBAAwB,mBAAmB;gBACnF,2EAA2E,CAC9E,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAsB;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,YAAY,CAAA;IAC7C,gFAAgF;IAChF,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO;QACL,GAAG,GAAG;QACN,oFAAoF;QACpF,sFAAsF;QACtF,qFAAqF;QACrF,qFAAqF;QACrF,qFAAqF;QACrF,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM;QAClD,sFAAsF;QACtF,qFAAqF;QACrF,sFAAsF;QACtF,qBAAqB,EAAE,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,MAAM;QAClE,+EAA+E;QAC/E,uFAAuF;QACvF,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,MAAM;QACxD,wFAAwF;QACxF,yFAAyF;QACzF,oFAAoF;QACpF,4BAA4B;QAC5B,mBAAmB,EAAE,mBAAmB,CAAC,GAAG,EAAE,qBAAqB,CAAC;QACpE,mFAAmF;QACnF,yFAAyF;QACzF,4FAA4F;QAC5F,mBAAmB;QACnB,cAAc,EAAE,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAC1D,qFAAqF;QACrF,6EAA6E;QAC7E,uEAAuE;QACvE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,UAAU,SAAS,IAAI,IAAI,EAAE;QACnE,sFAAsF;QACtF,uFAAuF;QACvF,qFAAqF;QACrF,yFAAyF;QACzF,0BAA0B;QAC1B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,MAAM;QAChE,iFAAiF;QACjF,8EAA8E;QAC9E,iFAAiF;QACjF,qFAAqF;QACrF,mFAAmF;QACnF,wFAAwF;QACxF,4BAA4B,EAAE,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,MAAM;QAChF,4BAA4B,EAC1B,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE;YACxC,8EAA8E;KACjF,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,OAAO,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;AAChD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cat-factory/local-server",
|
|
3
|
-
"version": "0.38.
|
|
3
|
+
"version": "0.38.11",
|
|
4
4
|
"description": "Local-mode runtime facade for the Agent Architecture Board: the @cat-factory/node-server stack with agent jobs run as local Docker/Podman containers and GitHub accessed via a personal access token — a developer can run the whole product on their own machine.",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -26,22 +26,22 @@
|
|
|
26
26
|
"dependencies": {
|
|
27
27
|
"@hono/node-server": "^2.0.6",
|
|
28
28
|
"drizzle-orm": "1.0.0-rc.4",
|
|
29
|
-
"@cat-factory/agents": "0.26.
|
|
30
|
-
"@cat-factory/gitlab": "0.4.41",
|
|
31
|
-
"@cat-factory/executor-harness": "1.32.0",
|
|
32
|
-
"@cat-factory/kernel": "0.70.0",
|
|
29
|
+
"@cat-factory/agents": "0.26.14",
|
|
33
30
|
"@cat-factory/contracts": "0.82.0",
|
|
34
|
-
"@cat-factory/
|
|
35
|
-
"@cat-factory/
|
|
36
|
-
"@cat-factory/
|
|
37
|
-
"@cat-factory/
|
|
31
|
+
"@cat-factory/executor-harness": "1.32.0",
|
|
32
|
+
"@cat-factory/gitlab": "0.4.42",
|
|
33
|
+
"@cat-factory/integrations": "0.56.2",
|
|
34
|
+
"@cat-factory/kernel": "0.70.1",
|
|
35
|
+
"@cat-factory/node-server": "0.60.1",
|
|
36
|
+
"@cat-factory/orchestration": "0.59.1",
|
|
37
|
+
"@cat-factory/server": "0.68.1"
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
40
|
"@types/node": "^26.0.1",
|
|
41
41
|
"typescript": "7.0.1-rc",
|
|
42
42
|
"vitest": "^4.1.9",
|
|
43
|
-
"@cat-factory/conformance": "0.9.
|
|
44
|
-
"@cat-factory/gates": "0.2.
|
|
43
|
+
"@cat-factory/conformance": "0.9.95",
|
|
44
|
+
"@cat-factory/gates": "0.2.71"
|
|
45
45
|
},
|
|
46
46
|
"scripts": {
|
|
47
47
|
"build": "tsc -b tsconfig.build.json",
|