@computesdk/loops 0.1.0 → 0.1.1

package/API.md

@@ -8,8 +8,11 @@ everything a UI needs is HTTP, and the rendering is yours.
 - **Auth**: `Authorization: Bearer <token>`. `GET /api/v1/meta` and `GET /api/health` are open. A server on loopback
   may have no token at all; a server that listens on anything else always does.
 - **Errors**: a failed request is `{"error": "..."}` with a 4xx/5xx. Success bodies are JSON unless noted.
-- **CORS**: any origin unless the server was started with `--allow-origin a,b`. The token is the authorization, not a
-  cookie, so credentials are never sent implicitly.
+- **CORS**: a loopback server answers only its own origins (`http://127.0.0.1:<port>`, `http://localhost:<port>`,
+  `http://[::1]:<port>`) and only under those names in `Host`; anything else is `403`, which is what keeps a stray page
+  in the browser — or a DNS rebound one — out. Off loopback any origin answers, because the token is the authorization;
+  `--allow-origin a,b` (or `*`) narrows or widens that. The token is not a cookie, so credentials are never sent
+  implicitly.
 
 A typed client with no dependencies lives in [`client.ts`](./client.ts):
 

package/README.md

@@ -122,7 +122,12 @@ GET /api/chats/:id/events        Accept: text/event-stream
 ```
 
 SSE over `fetch` (not `EventSource`) so the token can travel in a header, and so a reconnect resumes from the cursor
-instead of starting blind. Any origin may attach (CORS is answered); the token is the authorization.
+instead of starting blind.
+
+A server on loopback answers only its own origins (`127.0.0.1`, `localhost`, `[::1]` on its port) and only under those
+names in the `Host` header — the second half is what stops a page that points its own hostname at `127.0.0.1` and
+becomes same-origin. A loopback server needs no token for that, because the boundary is the name. Once the port is
+reachable off the machine the token is the authorization and any origin may attach; `--allow-origin a,b` narrows it.
 
 ## What it is made of
 

package/bin/loops.mjs

@@ -33,7 +33,20 @@ function positional() {
 
 const CWD = path.resolve(opt("cwd", process.cwd()));
 const STATE_DIR = path.join(CWD, ".pi", "loops");
-const PI = opt("pi", process.env.LOOPS_PI ?? "pi");
+/**
+ * The engine this CLI drives. An explicit --pi wins; then a `pi` on PATH, because that is the copy the person
+ * configured; then the one npm installed with us — @earendil-works/pi-coding-agent is a peer dependency of the
+ * extension, so a bare VM that has only ever run `npx @computesdk/loops serve` still has an engine.
+ */
+function piPath() {
+  const explicit = opt("pi", process.env.LOOPS_PI);
+  if (explicit) return explicit;
+  const onPath = spawnSync(process.platform === "win32" ? "where" : "which", ["pi"], { stdio: "ignore" }).status === 0;
+  if (onPath) return "pi";
+  const local = path.join(PKG, "node_modules", ".bin", process.platform === "win32" ? "pi.cmd" : "pi");
+  return fs.existsSync(local) ? local : "pi";
+}
+const PI = piPath();
 
 /** The extension this CLI drives: the installed package if we can find it, else the sibling checkout. */
 function extensionPath() {
@@ -169,7 +182,7 @@ async function main() {
     const entry = fs.existsSync(bundle)
       ? [bundle]
       : ["--experimental-strip-types", path.join(PKG, "server", "index.ts")];
-    const args = [...entry, "--cwd", CWD, "--port", String(opt("port", "8001"))];
+    const args = [...entry, "--cwd", CWD, "--port", String(opt("port", "8001")), "--pi", PI];
     if (flag("no-open")) args.push("--no-open");
     // The extension is a runtime dependency, so it resolves on an install as well as in this workspace; without it the
     // server's own boot check says so instead of the first prompt failing.

package/dist/assets/{abnfDiagram-VCTEODGH-DPUvPEpH.js → abnfDiagram-VCTEODGH-CceVg1jC.js}

@@ -1 +1 @@
-import{g as p,r as u,d as a}from"./chunk-SVP7TREG-CAtSHcje.js";import{p as f}from"./chunk-JWPE2WC7-_1wtK-EO.js";import{_ as n,l as o}from"./index-C_bKTXmh.js";import{M as c,b as d}from"./cynefin-OW5HDTMX-EFt_R8HZ.js";var v=d().RailroadAbnf.parser.LangiumParser,l=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),i=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:i,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return l(e.element);case"AbnfOptionalGroup":return{type:"optional",element:l(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:l(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},w={parser:R,db:a,renderer:u,styles:p};export{w as diagram};
+import{g as p,r as u,d as a}from"./chunk-SVP7TREG-BISx4Qsv.js";import{p as f}from"./chunk-JWPE2WC7-_aPFiznH.js";import{_ as n,l as o}from"./index-DkxpcXIf.js";import{M as c,b as d}from"./cynefin-OW5HDTMX-RQb2d53E.js";var v=d().RailroadAbnf.parser.LangiumParser,l=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),i=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:i,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return l(e.element);case"AbnfOptionalGroup":return{type:"optional",element:l(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:l(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},w={parser:R,db:a,renderer:u,styles:p};export{w as diagram};

package/dist/assets/{arc-C71M1We_.js → arc-CurbUKc7.js}

@@ -1 +1 @@
-import{K as ln,L as an,M as y,N as tn,O as X,P as O,Q as _,S as un,T as rn,V as $,X as o,Y as M,Z as sn,$ as on,a0 as fn}from"./index-C_bKTXmh.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,D,S,v,A,N,a){var E=D-l,i=S-h,n=N-v,d=a-A,u=d*E-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*E,h+u*i]}function G(l,h,D,S,v,A,N){var a=l-D,E=h-S,i=(N?A:-A)/$(a*a+E*E),n=i*E,d=-i*a,u=l+n,s=h+d,f=D+n,c=S+d,Q=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,I=(g<0?-1:1)*$(fn(0,T*T*R-P*P)),K=(P*g-m*I)/R,L=(-P*m-g*I)/R,w=(P*g+m*I)/R,p=(-P*m+g*I)/R,x=K-Q,e=L-t,r=w-Q,V=p-t;return x*x+e*e>r*r+V*V&&(K=w,L=p),{cx:K,cy:L,x01:-n,y01:-d,x11:K*(v/T-1),y11:L*(v/T-1)}}function hn(){var l=cn,h=yn,D=M(0),S=null,v=gn,A=dn,N=mn,a=null,E=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-an,c=A.apply(this,arguments)-an,Q=un(c-f),t=c>f;if(a||(a=n=E()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(Q>tn-y)a.moveTo(s*X(f),s*O(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*X(c),u*O(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=Q,I=Q,K=N.apply(this,arguments)/2,L=K>y&&(S?+S.apply(this,arguments):$(u*u+s*s)),w=_(un(s-u)/2,+D.apply(this,arguments)),p=w,x=w,e,r;if(L>y){var V=sn(L/u*O(K)),j=sn(L/s*O(K));(P-=V*2)>y?(V*=t?1:-1,R+=V,T-=V):(P=0,R=T=(f+c)/2),(I-=j*2)>y?(j*=t?1:-1,m+=j,g-=j):(I=0,m=g=(f+c)/2)}var Y=s*X(m),Z=s*O(m),z=u*X(T),B=u*O(T);if(w>y){var C=s*X(g),F=s*O(g),H=u*X(R),J=u*O(R),q;if(Q<rn)if(q=pn(Y,Z,H,J,C,F,z,B)){var U=Y-q[0],W=Z-q[1],k=C-q[0],b=F-q[1],nn=1/O(on((U*k+W*b)/($(U*U+W*W)*$(k*k+b*b)))/2),en=$(q[0]*q[0]+q[1]*q[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}I>y?x>y?(e=G(H,J,Y,Z,s,x,t),r=G(C,F,z,B,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(Y,Z),a.arc(0,0,s,m,g,!t)):a.moveTo(Y,Z),!(u>y)||!(P>y)?a.lineTo(z,B):p>y?(e=G(z,B,C,F,u,-p,t),r=G(Y,Z,H,J,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-rn/2;return[X(d)*n,O(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:M(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:M(+n),i):h},i.cornerRadius=function(n){return arguments.length?(D=typeof n=="function"?n:M(+n),i):D},i.padRadius=function(n){return arguments.length?(S=n==null?null:typeof n=="function"?n:M(+n),i):S},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:M(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:M(+n),i):A},i.padAngle=function(n){return arguments.length?(N=typeof n=="function"?n:M(+n),i):N},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};
+import{K as ln,L as an,M as y,N as tn,O as X,P as O,Q as _,S as un,T as rn,V as $,X as o,Y as M,Z as sn,$ as on,a0 as fn}from"./index-DkxpcXIf.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,D,S,v,A,N,a){var E=D-l,i=S-h,n=N-v,d=a-A,u=d*E-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*E,h+u*i]}function G(l,h,D,S,v,A,N){var a=l-D,E=h-S,i=(N?A:-A)/$(a*a+E*E),n=i*E,d=-i*a,u=l+n,s=h+d,f=D+n,c=S+d,Q=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,I=(g<0?-1:1)*$(fn(0,T*T*R-P*P)),K=(P*g-m*I)/R,L=(-P*m-g*I)/R,w=(P*g+m*I)/R,p=(-P*m+g*I)/R,x=K-Q,e=L-t,r=w-Q,V=p-t;return x*x+e*e>r*r+V*V&&(K=w,L=p),{cx:K,cy:L,x01:-n,y01:-d,x11:K*(v/T-1),y11:L*(v/T-1)}}function hn(){var l=cn,h=yn,D=M(0),S=null,v=gn,A=dn,N=mn,a=null,E=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-an,c=A.apply(this,arguments)-an,Q=un(c-f),t=c>f;if(a||(a=n=E()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(Q>tn-y)a.moveTo(s*X(f),s*O(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*X(c),u*O(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=Q,I=Q,K=N.apply(this,arguments)/2,L=K>y&&(S?+S.apply(this,arguments):$(u*u+s*s)),w=_(un(s-u)/2,+D.apply(this,arguments)),p=w,x=w,e,r;if(L>y){var V=sn(L/u*O(K)),j=sn(L/s*O(K));(P-=V*2)>y?(V*=t?1:-1,R+=V,T-=V):(P=0,R=T=(f+c)/2),(I-=j*2)>y?(j*=t?1:-1,m+=j,g-=j):(I=0,m=g=(f+c)/2)}var Y=s*X(m),Z=s*O(m),z=u*X(T),B=u*O(T);if(w>y){var C=s*X(g),F=s*O(g),H=u*X(R),J=u*O(R),q;if(Q<rn)if(q=pn(Y,Z,H,J,C,F,z,B)){var U=Y-q[0],W=Z-q[1],k=C-q[0],b=F-q[1],nn=1/O(on((U*k+W*b)/($(U*U+W*W)*$(k*k+b*b)))/2),en=$(q[0]*q[0]+q[1]*q[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}I>y?x>y?(e=G(H,J,Y,Z,s,x,t),r=G(C,F,z,B,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(Y,Z),a.arc(0,0,s,m,g,!t)):a.moveTo(Y,Z),!(u>y)||!(P>y)?a.lineTo(z,B):p>y?(e=G(z,B,C,F,u,-p,t),r=G(Y,Z,H,J,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-rn/2;return[X(d)*n,O(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:M(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:M(+n),i):h},i.cornerRadius=function(n){return arguments.length?(D=typeof n=="function"?n:M(+n),i):D},i.padRadius=function(n){return arguments.length?(S=n==null?null:typeof n=="function"?n:M(+n),i):S},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:M(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:M(+n),i):A},i.padAngle=function(n){return arguments.length?(N=typeof n=="function"?n:M(+n),i):N},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};