@engenty/wizards-runtime 0.7.8 → 0.7.10

package/apps/runtime/dist/db/migrations/tenant/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1792044239427,
       "tag": "0016_even_trish_tilby",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1792271496354,
+      "tag": "0017_run_client",
+      "breakpoints": true
     }
   ]
 }

package/apps/runtime/dist/db/schema.js

@@ -127,6 +127,8 @@ export const run = sqliteTable("run", {
      * (`data-page` of the embed tag, else the page's own address); null on the wizard's link.
      */
     origin: text("origin"),
+    /** The client that started it over the public API (`x-wizards-client`): web, app, cli, or a registered id. */
+    client: text("client"),
     status: text("status", {
         enum: ["waiting_input", "running", "done", "failed", "cancelled"],
     }).notNull(),

package/apps/runtime/dist/docs/dev/api.md

@@ -0,0 +1,39 @@
+---
+title: The API
+description: What a program may rely on when it talks to a runtime, and what is private.
+version: 0.7.7
+---
+
+A runtime answers HTTP under `/api`. Three parts are a contract: they are versioned, documented
+and change with notice. Everything else is the studio’s own and changes without notice.
+
+## What a program may rely on
+
+| Part | For | Signed in as |
+|---|---|---|
+| `/api/v1/…` | programs that build and publish wizards: the spaces of a local install, importing a wizard | an access token of the account, with scopes (`wizards:read`, `wizards:write`, `wizards:publish`, `runs:test`); see [the Manage-App contract](https://github.com/engenty/engenty-wizards/blob/main/docs/manage-contract.md) |
+| `/api/mcp` | AI apps: every tool of [the MCP server](../user/ai-apps.md) | the same tokens, or the local ticket `wizards mcp` carries |
+| The public run API: `/api/public/wizards/:token`, `/api/public/wizards/:token/runs`, `/api/public/codes/:code`, `/api/runs/:id/…` | running a published wizard by its link: what the runner in a browser does | nobody; a visitor cookie, or the `x-wizards-visitor` header where a cookie does not survive |
+
+## Private
+
+`/api/studio/…`, `/api/auth/…` and `/api/internal/…` belong to the studio, the sign-in and the
+Manage-App. They change with every release and are not meant for other programs. A program that
+needs something only they have asks for it on `/api/v1`.
+
+## Who you are: `x-wizards-client`
+
+Every start of a run over the public API names the client that starts it, in the
+`x-wizards-client` header: `web` is the runner in a browser, `app` the mobile app, `cli` the
+command line. A client of your own sends its own id: lower-case letters, digits and hyphens.
+The run keeps the id.
+
+The id is no secret and proves nothing. It carries the terms a client runs under:
+
+| Runtime | Does with the id |
+|---|---|
+| One that runs alone (your computer, your server) | Keeps it on the run. Nothing is refused: the API is yours |
+| engenty.ai | Asks its list of clients: a registered id runs under its limits, an unknown one under the public limits, a revoked one not at all. The [terms of the hosted API](https://engenty.ai/api-terms) say how a client registers and what it may do |
+
+An answer of `403` with `code: "client_refused"` means the id may not start runs there;
+`429` with `code: "client_limit"` means it started too many this hour.

package/apps/runtime/dist/docs/dev/index.md

@@ -15,6 +15,7 @@ code, and the runtime loads it from its files while it runs.
 | [Quick start](./plugins/quick-start.md) | A tool for AI steps in one file that works in two minutes |
 | [Reference](./plugins/reference.md) | Every call, type, address and setting |
 | [Examples](./plugins/examples.md) | Two plugins to read and copy |
+| [The API](./api.md) | What a program may rely on, what is private, and how a client names itself |
 
 ## Wizards as files
 

package/apps/runtime/dist/docs/dev/integration/openui.md

@@ -11,9 +11,11 @@ author defined. `@engenty/wizards/openui` puts the two together: the chat decide
 fits and what it already knows, the wizard then runs inside the conversation, and the chat
 hears the result.
 
-It is part of `@engenty/wizards`, the package for code outside engenty wizards
-([`packages/wizards/src/openui`](https://github.com/engenty/wizards/tree/main/packages/wizards/src/openui)
-in the repository, under the MIT licence). A whole chat to try it with is `examples/openui-chat`.
+It is part of `@engenty/wizards`, the package on npm for code outside engenty wizards
+(`npm install @engenty/wizards`;
+[`packages/wizards/src/openui`](https://github.com/engenty/wizards/tree/main/packages/wizards/src/openui)
+in the repository, under FSL-1.1-MIT; the runner it bundles is MIT). A whole chat to try it with
+is `examples/openui-chat`.
 
 ## What OpenUI is
 

package/apps/runtime/dist/docs/dev/meta.json

@@ -3,5 +3,5 @@
   "description": "Extend engenty wizards with plugins: tools for AI steps, routes with their own tables, pages in the studio.",
   "root": true,
   "icon": "SquareTerminal",
-  "pages": ["index", "wizard-format", "plugins", "integration"]
+  "pages": ["index", "wizard-format", "plugins", "integration", "api"]
 }

package/apps/runtime/dist/docs/user/ai-apps.md

@@ -103,10 +103,21 @@ a minute, even with a token it already holds.
 
 ## The Claude Code plugin
 
-If engenty wizards has a public https address, Claude Code can also install a plugin. It adds
-the `/wizard` command and the skills to build and use wizards:
+Claude Code can also install a plugin. It adds the `/wizard` command, the skills to build and
+use wizards, and `/wizards`, a pane beside the chat that lists your wizards and opens one in the
+app’s browser pane. From GitHub, for the `engenty-wizards` server your AI apps already have:
+
+```bash
+claude plugin marketplace add engenty/wizards
+claude plugin install wizards@engenty
+```
+
+If engenty wizards has a public https address, it serves the plugin with its server bundled:
 
 ```bash
 claude plugin marketplace add <your address>/api/claude-plugin/marketplace.json
-claude plugin install engenty-wizards@engenty
+claude plugin install wizards@<your-host-with-dashes>   # wizards.example.com → wizards-example-com
 ```
+
+`claude plugin update wizards` brings the next version. In Claude Code’s auto mode the pane’s own
+calls need allow rules; the plugin’s README names them.

package/apps/runtime/dist/docs/user/install.md

@@ -1,31 +1,41 @@
 ---
 title: Install
-description: One command on macOS or Linux. It brings its own Node.js and asks for no password.
+description: One command on macOS, Linux or Windows. It brings its own Node.js and asks for no password.
 version: 0.5.0
 ---
 
 ## Install
 
-In a terminal, on macOS or Linux (arm64 or x64; on Windows, in WSL):
+In a terminal, on macOS or Linux (arm64 or x64):
 
 ```bash
 curl -fsSL https://engenty.ai/install.sh | bash
 ```
 
+On Windows 10 or 11, in PowerShell:
+
+```powershell
+irm https://engenty.ai/install.ps1 | iex
+```
+
 Or, with Node.js 20 or newer on the machine:
 
 ```bash
 npx wizards
 ```
 
-Both do the same. `npx wizards` downloads only a small launcher (no dependencies) and runs the
-installer it brings along, then the setup, then the
+All three do the same. On Windows, if PowerShell refuses `npx` (“running scripts is disabled
+on this system”), type `npx.cmd wizards`. `npx wizards` downloads only a small launcher (no
+dependencies) and runs the installer it brings along, then the setup, then the
 `wizards` menu, where “Start as service” starts it and opens the studio. Run again, it hands over
 to the installed `wizards`, and brings an older install up to its own version first.
 
-The installer needs nothing but `curl` and `tar`. It brings its own Node.js (a Node you already
-have is left alone), installs engenty wizards into `~/.engenty/wizards` (about 650 MB), links the
-`wizards` command into `~/.local/bin` and then walks you through the rest:
+The installer needs nothing but `curl` and `tar`. On Windows it needs nothing, except Microsoft’s
+Visual C++ runtime, which many programs bring along: where it is missing, the installer installs
+it, and Windows asks once whether it may. It brings its own Node.js
+(a Node you already have is left alone), installs engenty wizards into `~/.engenty/wizards`
+(about 650 MB), links the `wizards` command into `~/.local/bin` (on Windows it puts
+`~\.engenty\wizards\bin` on your PATH) and then walks you through the rest:
 
 | Step | What it does |
 |---|---|
@@ -33,7 +43,7 @@ have is left alone), installs engenty wizards into `~/.engenty/wizards` (about 6
 | An AI client | Looks for Codex, Claude Code, Antigravity and Cursor Agent and offers to install the ones that are missing. It puts first the one whose app (ChatGPT, Claude, Antigravity, Cursor) is on your Mac, as you most likely have that subscription already. You can also use your account’s credits, an API key, [Ollama](https://ollama.com) or, on a Mac with Apple silicon and macOS 26, Apple Intelligence: the studio’s [first page](./first-start.md) offers them |
 | A browser and ffmpeg | Names the browser for PDF and PNG exports and steps on websites: the first of Chrome, Edge and Chromium it finds (on a Mac also Brave). engenty wizards uses that one; [`CHROME_PATH`](./command-line.md#settings) picks another. It also says whether ffmpeg is there for MP4 videos of animated widgets, and with Homebrew it offers to install it |
 | A decision model (optional) | Offers to install [Ollama](https://ollama.com) if it isn’t there and to download Cloudflare’s Clef-flash into it (about 11 GB). The wizards then make their decisions, such as which branch to take, on your computer, without a key or credits. On a Mac the Ollama app goes into Applications and, when it first starts, asks once for your Mac’s password to set up its `ollama` command (cancel works too); on Linux Ollama’s own installer runs, installs `zstd` if it is missing, and asks for your password |
-| Start at login (optional) | engenty wizards starts in the background when you log in, so links and AI apps can always reach it. It is a LaunchAgent on a Mac and a systemd user service on Linux |
+| Start at login (optional) | engenty wizards starts in the background when you log in, so links and AI apps can always reach it. It is a LaunchAgent on a Mac, a systemd user service on Linux and a scheduled task on Windows (a shortcut in the Startup folder where Windows allows no task) |
 | Your AI apps (optional) | Offers to add your wizards to the [AI apps](./ai-apps.md) it finds, such as Claude Desktop, Cursor or Codex |
 | The command | If `~/.local/bin` is not on your PATH, it offers to add it in your shell’s settings file |
 

package/apps/runtime/dist/engine/runner.js

@@ -174,6 +174,7 @@ export async function createRun(input) {
         origin: input.origin ?? null,
         lang: input.lang ?? null,
         unattended: input.unattended ?? false,
+        client: input.client ?? null,
         status: first.type === "page" ? "waiting_input" : "running",
         cursor: first.id,
         state,

package/apps/runtime/dist/harness/env.js

@@ -1,12 +1,17 @@
-import { execFile, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { join } from "node:path";
-import { promisify } from "node:util";
+import { runFile } from "../cli/exec.js";
 import { layout } from "../cli/home.js";
-export const run = promisify(execFile);
+export const run = runFile;
 let shellEnv = null;
 /** The person's login shell, asked once: a desktop app and a bare dev server start without its variables. */
 export function loginShellEnv() {
     shellEnv ??= new Promise((done) => {
+        // Windows has no login shell to ask: the runtime's own environment is the person's.
+        if (process.platform === "win32") {
+            done({});
+            return;
+        }
         const shell = process.env.SHELL || "/bin/zsh";
         // In a session of its own, away from the terminal `wizards` runs in: an interactive
         // shell takes over that terminal for its job control and keeps it when it ends, and Ctrl-C
@@ -48,7 +53,7 @@ export function loginShellEnv() {
  */
 export function pickEnv(shell, own, passThrough, 
 /** Folders before the shell's PATH: the clients the setup installed. */
-first = []) {
+first = [], platform = process.platform) {
     const picked = {};
     const source = Object.keys(shell).length ? shell : own;
     for (const [key, value] of Object.entries(source)) {
@@ -56,16 +61,31 @@ first = []) {
             picked[key] = value;
         }
     }
-    const path = [...first, ...(shell.PATH ?? "").split(":"), ...(own.PATH ?? "").split(":")].filter(Boolean);
+    const windows = platform === "win32";
+    if (windows) {
+        for (const [key, value] of Object.entries(own)) {
+            if (WINDOWS_BASE.test(key) && value) {
+                picked[key] = value;
+            }
+        }
+    }
+    const sep = windows ? ";" : ":";
+    const ownPath = own.PATH ?? own.Path ?? "";
+    const path = [...first, ...(shell.PATH ?? "").split(sep), ...ownPath.split(sep)].filter(Boolean);
     return {
         ...picked,
-        PATH: [...new Set(path)].join(":"),
+        PATH: [...new Set(path)].join(sep),
         HOME: own.HOME,
         USER: own.USER,
         LANG: "en_US.UTF-8",
         TERM: "dumb",
     };
 }
+/**
+ * What a Windows program needs of the environment to start at all: the system's folders, the
+ * user's folders, and how commands are found and run (a .cmd needs ComSpec).
+ */
+const WINDOWS_BASE = /^(SystemRoot|SystemDrive|windir|ComSpec|PATHEXT|TEMP|TMP|USERPROFILE|USERNAME|USERDOMAIN|HOMEDRIVE|HOMEPATH|APPDATA|LOCALAPPDATA|ProgramData|ProgramFiles|ProgramFiles\(x86\)|ProgramW6432|CommonProgramFiles|CommonProgramFiles\(x86\)|CommonProgramW6432|COMPUTERNAME|OS|PROCESSOR_ARCHITECTURE|NUMBER_OF_PROCESSORS)$/i;
 export function stripKeys(env, keyVars) {
     const bare = { ...env };
     for (const key of keyVars) {
@@ -73,8 +93,21 @@ export function stripKeys(env, keyVars) {
     }
     return bare;
 }
-/** Where the setup installs clients from npm, whoever started this runtime. */
-const installed = () => [join(layout().clients, "bin")];
+/**
+ * Where the setup installs clients, whoever started this runtime: npm's prefix (on Windows the
+ * prefix itself), and on Windows where Claude Code and Cursor Agent put themselves.
+ */
+const installed = () => {
+    if (process.platform !== "win32") {
+        return [join(layout().clients, "bin")];
+    }
+    const { USERPROFILE: home, LOCALAPPDATA: local } = process.env;
+    return [
+        layout().clients,
+        ...(home ? [join(home, ".local", "bin")] : []),
+        ...(local ? [join(local, "cursor-agent"), join(local, "agy", "bin")] : []),
+    ];
+};
 const resolved = new Map();
 /**
  * The environment a client runs in, decided once: the subscription sign-in comes first — it is

package/apps/runtime/dist/harness/index.js

@@ -1,5 +1,5 @@
 import { mkdirSync } from "node:fs";
-import { installCommand } from "../cli/clients.js";
+import { installCommand, POWERSHELL } from "../cli/clients.js";
 import { inherited, runtimePath } from "../cli/environment.js";
 import { layout } from "../cli/home.js";
 import { CLIENTS, vendorApp } from "../cli/machine.js";
@@ -77,6 +77,15 @@ export async function installSpec(id) {
     const paths = layout();
     mkdirSync(paths.clients, { recursive: true });
     const shell = await loginShellEnv();
+    if (process.platform === "win32") {
+        const [bin, ...args] = POWERSHELL;
+        const command = installCommand(client, paths);
+        return {
+            bin,
+            args: [...args, `Write-Host "$ ${command.replaceAll('"', '`"')}\`n"; ${command}`],
+            env: { ...inherited(process.env), PATH: runtimePath(paths, process.env) },
+        };
+    }
     return {
         bin: "bash",
         args: [

package/apps/runtime/dist/harness/model.js

@@ -1,7 +1,7 @@
-import { spawn } from "node:child_process";
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { note } from "@engenty-wizards/shared/run";
+import spawn from "cross-spawn";
 import { nanoid } from "nanoid";
 import { env } from "../env.js";
 import { openBridge } from "../mcp/bridge.js";

package/apps/runtime/dist/index.js

@@ -1,5 +1,6 @@
 import { serve } from "@hono/node-server";
 import { localEntryUrl, purgeSessions } from "./auth/index.js";
+import { startClientChecks } from "./clients.js";
 import { adoptLegacyData } from "./db/adopt.js";
 import { knownTenants, migrateAllTenants, migrateControlDb, openTenantDb, withTenant, } from "./db/client.js";
 import { startRunner, stopRunner } from "./engine/runner.js";
@@ -20,6 +21,9 @@ import { LOCAL_TENANT } from "./tenants/tenant.js";
 import { onRestart, RESTART_EXIT, startUpdateChecks } from "./update.js";
 // Before anything prints: the last lines stay in memory for a look from afar (debug.ts).
 hookConsole();
+// A background job that failed (a dropped connection to a remote database) is logged; the
+// server keeps running for every other request instead of ending with it.
+process.on("unhandledRejection", (err) => console.error("[unhandled]", err));
 await migrateControlDb();
 // What the linked account's plan confirmed last: the Pro modules it includes load with the rest.
 await loadEntitlement();
@@ -28,9 +32,13 @@ await loadPlugins();
 startJobs();
 if (managed) {
     // Every tenant database is brought to this release's schema; a new one migrates when first opened.
-    void migrateAllTenants().then(({ migrated, failed }) => {
+    void migrateAllTenants()
+        .then(({ migrated, failed }) => {
         console.log(`tenant databases: ${migrated} current${failed.length ? `, failed: ${failed}` : ""}`);
-    });
+    })
+        .catch((err) => console.error("[migrate]", err));
+    // Which clients may start runs over the public API, and how often: the Manage-App's list.
+    startClientChecks();
 }
 else {
     await adoptLegacyData();
@@ -43,8 +51,9 @@ else {
     startUpdateChecks();
 }
 // The marketplace's starters and the starred entries, kept for offline use; checked hourly.
-void syncMarketplace();
-setInterval(() => void syncMarketplace(), 3600_000).unref();
+const marketplace = () => void syncMarketplace().catch((err) => console.error("[marketplace]", err.message));
+marketplace();
+setInterval(marketplace, 3600_000).unref();
 const { default: app } = await import("./app.js");
 /** Behind a path (APP_URL ends in /w) the proxy may leave the prefix on; the routes know none. */
 function withoutBasePath(request) {

package/apps/runtime/dist/plugin.js

@@ -3,19 +3,24 @@ import { existsSync } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { marketplaceNameOf } from "@engenty-wizards/shared/claude-plugin";
 import { zipSync } from "fflate";
 import { env } from "./env.js";
 /**
- * The Claude Code plugin for this deployment: the `plugin/` folder with this server's URL filled
- * in, served as a marketplace (`url` source) whose one plugin is a zip (`archive` source). So
- * every deployment hands out its own plugin and no domain is baked into the repo.
+ * The Claude Code plugin for this deployment: the `plugin/` folder, served as a marketplace
+ * (`url` source) whose one plugin is a zip (`archive` source), with this server's address as its
+ * homepage, the package's version, and an `.mcp.json` that bundles this server. So every
+ * deployment hands out its own plugin and no domain is baked into the repo, while the folder in
+ * git is a valid plugin as it is: installed from GitHub, it uses the `engenty-wizards` server the
+ * person configured.
  */
 const here = dirname(fileURLToPath(import.meta.url));
 /** The folder that holds `plugin/` and the root package.json: three levels above this file. */
 const base = resolve(here, "../../..");
 const root = existsSync(join(base, "plugin")) ? base : undefined;
-export const PLUGIN_NAME = "engenty-wizards";
-export const MARKETPLACE_NAME = "engenty";
+export const PLUGIN_NAME = "wizards";
+/** This deployment's marketplace, named after its host; `engenty` is the GitHub one. */
+export const MARKETPLACE_NAME = marketplaceNameOf(env.appUrl);
 export const pluginBase = `${env.appUrl}/api/claude-plugin`;
 async function filesUnder(dir) {
     const entries = await readdir(dir, { withFileTypes: true });
@@ -32,12 +37,23 @@ export function pluginArchive() {
         const dir = join(root, "plugin");
         const files = {};
         for (const path of (await filesUnder(dir)).sort()) {
-            const text = (await readFile(path, "utf8"))
+            const name = relative(dir, path);
+            let text = (await readFile(path, "utf8"))
                 .replaceAll("{{APP_URL}}", env.appUrl)
                 .replaceAll("{{VERSION}}", version);
+            if (name === ".claude-plugin/plugin.json") {
+                const manifest = JSON.parse(text);
+                manifest.version = version;
+                manifest.homepage = env.appUrl;
+                text = `${JSON.stringify(manifest, null, 2)}\n`;
+            }
             // Fixed timestamps keep the archive, and so its sha256, stable across restarts.
-            files[relative(dir, path)] = new TextEncoder().encode(text);
+            files[name] = new TextEncoder().encode(text);
         }
+        const mcp = {
+            mcpServers: { "engenty-wizards": { type: "http", url: `${env.appUrl}/api/mcp` } },
+        };
+        files[".mcp.json"] = new TextEncoder().encode(`${JSON.stringify(mcp, null, 2)}\n`);
         const zip = zipSync(files, { level: 9, mtime: new Date("2026-01-01T00:00:00Z") });
         return { zip, sha256: createHash("sha256").update(zip).digest("hex"), version };
     })();
@@ -48,7 +64,7 @@ export async function pluginMarketplace() {
     return {
         name: MARKETPLACE_NAME,
         owner: { name: "engenty" },
-        description: "engenty wizards for Claude Code",
+        description: "engenty wizards for Claude Code, from this deployment",
         plugins: [
             {
                 name: PLUGIN_NAME,

package/apps/runtime/dist/render/browser-path.js

@@ -1,19 +1,33 @@
 import { accessSync, constants, existsSync } from "node:fs";
 import { homedir } from "node:os";
-import { delimiter, join } from "node:path";
-/** The first executable called `name` in the folders of `path` (a PATH value). */
-export function findOnPath(name, path) {
-    for (const dir of path.split(delimiter)) {
+import { delimiter, join, win32 } from "node:path";
+/**
+ * The first executable called `name` in the folders of `path` (a PATH value). On Windows a
+ * command is a file with one of the endings in PATHEXT: `codex` is `codex.cmd`, `claude` is
+ * `claude.exe`.
+ */
+export function findOnPath(name, path, platform = process.platform, pathext = process.env.PATHEXT) {
+    const windows = platform === "win32";
+    const endings = windows
+        ? ["", ...(pathext || ".COM;.EXE;.BAT;.CMD").toLowerCase().split(";").filter(Boolean)]
+        : [""];
+    for (const dir of path.split(windows ? ";" : delimiter)) {
         if (!dir) {
             continue;
         }
-        const file = join(dir, name);
-        try {
-            accessSync(file, constants.X_OK);
-            return file;
-        }
-        catch {
-            // not here
+        for (const ending of endings) {
+            // A file without an ending is no command on Windows, unless the name brought one.
+            if (windows && !ending && !/\.\w+$/.test(name)) {
+                continue;
+            }
+            const file = join(dir, name + ending);
+            try {
+                accessSync(file, windows ? constants.F_OK : constants.X_OK);
+                return file;
+            }
+            catch {
+                // not here
+            }
         }
     }
     return null;
@@ -44,6 +58,24 @@ export function findChrome(env = process.env) {
         }
         return null;
     }
+    if (process.platform === "win32") {
+        const apps = [
+            "Google\\Chrome\\Application\\chrome.exe",
+            "Microsoft\\Edge\\Application\\msedge.exe",
+            "Chromium\\Application\\chrome.exe",
+            "BraveSoftware\\Brave-Browser\\Application\\brave.exe",
+        ];
+        const roots = [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA].filter(Boolean);
+        for (const app of apps) {
+            for (const root of roots) {
+                const file = win32.join(root, app);
+                if (existsSync(file)) {
+                    return file;
+                }
+            }
+        }
+        return null;
+    }
     for (const name of ["google-chrome", "chromium", "chromium-browser", "microsoft-edge"]) {
         const file = findOnPath(name, env.PATH ?? "");
         if (file) {

package/apps/runtime/dist/routes/runs.js

@@ -11,6 +11,7 @@ import { nanoid } from "nanoid";
 import { z } from "zod";
 import { principalOf } from "../auth/index.js";
 import { MARK_FOCUSED_PERSONAL } from "../browser/snapshot.js";
+import { clientOf, clientRefused } from "../clients.js";
 import { ConnectError, connectionViews, connectWithCredentials, disconnect, finishOAuth, oauthStateLang, oauthStateRun, startOAuth, } from "../connectors/index.js";
 import { finishPluginOAuth, pluginStateTenant } from "../connectors/plugin-connections.js";
 import { db, schema, withTenant } from "../db/client.js";
@@ -362,6 +363,13 @@ export const publicRoutes = new Hono()
     if (!(await verifyTurnstile(body.turnstileToken, ip))) {
         return refuse(c, { code: "confirmHuman" }, 403);
     }
+    // The client that starts it (docs/content/dev/api.md): on a managed runtime the Manage-App's
+    // list says which may, and how often an hour.
+    const client = clientOf(c);
+    const refused = clientRefused(client);
+    if (refused) {
+        return c.json({ error: noteText({ code: refused.note }, requestLang(c)), code: refused.code }, refused.status);
+    }
     const vid = visitorId(c, true, body.embedded);
     const ipHash = hashIp(ip);
     if (await visitorOverLimit(vid, ipHash)) {
@@ -385,6 +393,7 @@ export const publicRoutes = new Hono()
                 (await storedTranslation(w.id, body.lang))
                 ? body.lang
                 : null,
+            client,
         });
         return c.json({ runId });
     }

package/apps/runtime/dist/update.js

@@ -98,6 +98,10 @@ export function applyUpdate() {
     const child = spawn(process.execPath, [join(packageRoot, "bin/wizards.mjs"), "update"], {
         cwd: paths.home,
         stdio: ["ignore", log, log],
+        // On Windows the update stops this runtime for its locked files, and a child that is not
+        // detached ends with its parent there; the update starts the new version itself.
+        detached: process.platform === "win32",
+        windowsHide: true,
     });
     child.on("error", () => {
         applying = "failed";

package/apps/web/dist/assets/AboutDialog-B2LuZ_mC.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{n as t,t as n}from"./jsx-runtime-BNakU3Ej.js";import{Bt as r,Cr as i,Ht as a,Qt as o,Vt as s,Xt as c,_r as l,an as u,qn as d,qt as f,zt as p}from"./ui-DMmT-cSO.js";import{t as m}from"./preload-helper-CNEI7N0N.js";import{Ot as h,Q as g,X as _,Z as v}from"./index-xH9uN8Nh.js";import{c as y,f as b}from"./settings-menu-Dpkp3f56.js";import{ReleaseNotes as x,loadReleases as S,releaseDate as C,releaseLabel as w}from"./ChangelogDialog-B0lS0BdL.js";var T=e(t(),1),E=[{name:`engenty wizards`,description:`credit.engenty-wizards`,homepage:`https://github.com/engenty/wizards`,license:`FSL-1.1-MIT`},{name:`engenty`,description:`credit.engenty`,homepage:`https://github.com/engenty/engenty`,license:`FSL-1.1-MIT`}],D=[{name:`Mastra`,description:`credit.mastra`,homepage:`https://github.com/mastra-ai/mastra`,license:`Apache-2.0`},{name:`AI SDK`,description:`credit.ai-sdk`,homepage:`https://github.com/vercel/ai`,license:`Apache-2.0`},{name:`Model Context Protocol`,description:`credit.model-context-protocol`,homepage:`https://github.com/modelcontextprotocol/typescript-sdk`,license:`MIT`},{name:`Hono`,description:`credit.hono`,homepage:`https://github.com/honojs/hono`,license:`MIT`},{name:`Drizzle ORM`,description:`credit.drizzle-orm`,homepage:`https://github.com/drizzle-team/drizzle-orm`,license:`Apache-2.0`},{name:`libSQL`,description:`credit.libsql`,homepage:`https://github.com/tursodatabase/libsql`,license:`MIT`},{name:`Playwright`,description:`credit.playwright`,homepage:`https://github.com/microsoft/playwright`,license:`Apache-2.0`},{name:`React`,description:`credit.react`,homepage:`https://github.com/facebook/react`,license:`MIT`},{name:`Vite`,description:`credit.vite`,homepage:`https://github.com/vitejs/vite`,license:`MIT`},{name:`Tailwind CSS`,description:`credit.tailwind-css`,homepage:`https://github.com/tailwindlabs/tailwindcss`,license:`MIT`},{name:`React Flow`,description:`credit.react-flow`,homepage:`https://github.com/xyflow/xyflow`,license:`MIT`},{name:`TanStack Query`,description:`credit.tanstack-query`,homepage:`https://github.com/TanStack/query`,license:`MIT`},{name:`xterm.js`,description:`credit.xterm-js`,homepage:`https://github.com/xtermjs/xterm.js`,license:`MIT`},{name:`Lucide`,description:`credit.lucide`,homepage:`https://github.com/lucide-icons/lucide`,license:`ISC`},{name:`Geist & Geist Mono`,description:`credit.geist-geist-mono`,homepage:`https://github.com/vercel/geist-font`,license:`OFL-1.1`},{name:`Space Grotesk`,description:`credit.space-grotesk`,homepage:`https://github.com/floriankarsten/space-grotesk`,license:`OFL-1.1`},{name:`git-cliff`,description:`credit.git-cliff`,homepage:`https://github.com/orhun/git-cliff`,license:`MIT OR Apache-2.0`}],O=e(n(),1),k=(e,...t)=>t.some(t=>t?.toLowerCase().includes(e));function A({name:e,homepage:t,version:n,license:r,description:i}){return(0,O.jsxs)(`li`,{className:`py-2.5`,children:[(0,O.jsxs)(`div`,{className:`flex flex-wrap items-baseline gap-x-2.5 gap-y-0.5`,children:[t?(0,O.jsxs)(`a`,{href:t,target:`_blank`,rel:`noreferrer`,className:`inline-flex items-center gap-1 font-medium text-[0.875rem] text-ink underline-offset-4 hover:underline`,children:[e,(0,O.jsx)(l,{"aria-hidden":!0,className:`size-3 text-ink-4`})]}):(0,O.jsx)(`span`,{className:`font-medium text-[0.875rem] text-ink`,children:e}),n?(0,O.jsx)(`span`,{className:`text-[0.75rem] text-ink-3 tabular-nums`,children:n}):null,(0,O.jsx)(`span`,{className:`text-[0.75rem] text-ink-3`,children:r})]}),i?(0,O.jsx)(`p`,{className:`mt-0.5 text-[0.8125rem] text-ink-3`,children:i}):null]})}function j({title:e,hint:t,children:n}){return(0,O.jsxs)(`section`,{className:`mt-6`,children:[(0,O.jsx)(`h3`,{className:`border-border-soft border-b pb-2 font-display font-semibold text-[1rem]`,children:e}),t?(0,O.jsx)(`p`,{className:`mt-2 text-[0.8125rem] text-ink-3`,children:t}):null,n]})}function M({credits:e}){return(0,O.jsx)(`ul`,{className:`divide-y divide-border-soft`,children:e.map(e=>(0,O.jsx)(A,{name:e.name,homepage:e.homepage,license:e.license,description:u(e.description)},e.name))})}function N({label:e,packages:t}){return(0,O.jsxs)(`div`,{className:`mt-4`,children:[(0,O.jsx)(`h4`,{className:`font-medium text-[0.75rem] text-ink-3 tracking-wide`,children:e}),(0,O.jsx)(`ul`,{className:`divide-y divide-border-soft`,children:t.map(e=>(0,O.jsx)(A,{...e},e.name))})]})}function P({active:e}){let[t,n]=(0,T.useState)(null),[i,o]=(0,T.useState)(``);(0,T.useEffect)(()=>{if(!e||t)return;let r=!1;return m(()=>import(`./oss-credits-Bc05Qv5H.js`).then(e=>{r||n(e.default)}),[]),()=>{r=!0}},[e,t]),(0,T.useEffect)(()=>{e||o(``)},[e]);let s=i.trim().toLowerCase(),c=e=>s?e.filter(e=>k(s,e.name,e.license,u(e.description))):e,l=e=>s?e.filter(e=>k(s,e.name,e.license,e.version)):e,d=c(E),p=c(D),h=t?[{id:`shared`,label:u(`about.creditsShared`),packages:l(t.shared)},...t.groups.map(e=>({id:e.id,label:e.label,packages:l(e.packages)}))].filter(e=>e.packages.length>0):[],g=d.length===0&&p.length===0&&h.length===0;return(0,O.jsxs)(O.Fragment,{children:[(0,O.jsx)(`p`,{className:`mb-4 text-[0.875rem] text-ink-3`,children:u(`about.creditsHint`)}),(0,O.jsx)(a,{type:`search`,value:i,placeholder:u(`about.search`),onChange:e=>o(e.target.value)}),d.length>0?(0,O.jsx)(j,{title:u(`about.creditsProduct`),children:(0,O.jsx)(M,{credits:d})}):null,p.length>0?(0,O.jsx)(j,{title:u(`about.creditsBuiltWith`),children:(0,O.jsx)(M,{credits:p})}):null,t===null?(0,O.jsx)(`div`,{className:`flex justify-center py-10 text-ink-3`,children:(0,O.jsx)(f,{})}):h.length>0?(0,O.jsx)(j,{title:u(`about.creditsDeps`),hint:s?void 0:u(`about.creditsDepsHint`),children:h.map(e=>(0,O.jsx)(N,{label:e.label,packages:e.packages},e.id))}):null,t!==null&&g?(0,O.jsx)(r,{children:u(`about.noMatches`)}):null]})}var F=[`new`,`earlier`,`credits`],I=e=>u(e===`new`?`about.tab.new`:e===`earlier`?`about.tab.earlier`:`about.credits`),L=e=>e===1?u(`about.change`):u(`about.changes`,{n:e});function R({open:e,onClose:t,me:n}){let r=n?.mode===`local`,{data:a,latest:l}=g(r&&e),[m,E]=(0,T.useState)(null),[D,k]=(0,T.useState)(`new`),A=b(F.indexOf(D)),j=a?.newer&&l?l:v;(0,T.useEffect)(()=>{if(!e)return;let t=!1;return E(null),S(j===`0.7.10`?void 0:j).then(e=>{t||E(e)}),()=>{t=!0}},[e,j]);let M=m?.find(e=>e.version===`v${j}`)??m?.[0]??null,N=m?.filter(e=>e!==M)??[],R=r?a?.kind??null:`cloud`;return(0,O.jsxs)(p,{open:e,onClose:t,wide:!0,height:`tall`,children:[(0,O.jsx)(`div`,{className:`-mt-2 -mr-2 sticky top-0 z-10 flex h-0 justify-end`,children:(0,O.jsx)(s,{label:u(`common.close`),onClick:t,children:(0,O.jsx)(d,{className:`size-4`})})}),(0,O.jsxs)(`div`,{className:`flex flex-col items-center pt-4 text-center`,children:[(0,O.jsx)(h,{size:96}),(0,O.jsxs)(`div`,{className:`mt-4 font-display font-semibold text-[1.5rem] tracking-tight`,children:[`engenty`,(0,O.jsx)(`span`,{className:`text-ember`,children:`.`}),(0,O.jsx)(`span`,{className:`ml-1.5 font-normal text-ink-3`,children:`wizards`})]}),(0,O.jsxs)(`div`,{className:`mt-1 text-[0.9375rem] text-ink-3 tabular-nums`,children:[u(`about.version`,{v}),R?` · ${u(`about.kind.${R}`)}`:``]})]}),r?(0,O.jsx)(`div`,{className:`mt-5`,children:(0,O.jsx)(_,{enabled:e})}):null,(0,O.jsx)(`div`,{className:`mt-6 flex justify-center`,children:(0,O.jsx)(c,{value:D,onChange:k,options:F.map(e=>({id:e,label:I(e)})),label:u(`about.title`)})}),(0,O.jsxs)(`div`,{className:o(`mt-5`,y(A)),children:[D===`new`?m===null?(0,O.jsx)(`div`,{className:`flex justify-center py-6 text-ink-3`,children:(0,O.jsx)(f,{})}):M?(0,O.jsxs)(O.Fragment,{children:[(0,O.jsxs)(`h3`,{className:`flex items-baseline gap-3 border-border-soft border-b pb-2 font-display font-semibold text-[1rem]`,children:[w(M),(0,O.jsx)(`span`,{className:`font-normal font-sans text-[0.8125rem] text-ink-3 tabular-nums`,children:C(M)})]}),(0,O.jsx)(`div`,{className:`mt-3`,children:(0,O.jsx)(x,{release:M})})]}):(0,O.jsx)(`p`,{className:`text-[0.875rem] text-ink-3`,children:u(`about.changelogEmpty`)}):null,D===`earlier`?(0,O.jsx)(`div`,{className:`flex flex-col divide-y divide-border-soft`,children:N.map(e=>(0,O.jsxs)(`details`,{className:`group/r py-2`,children:[(0,O.jsxs)(`summary`,{className:`flex cursor-pointer list-none items-baseline gap-3 text-[0.875rem] [&::-webkit-details-marker]:hidden`,children:[(0,O.jsx)(i,{className:`size-3.5 shrink-0 self-center text-ink-4 transition group-open/r:rotate-90`}),(0,O.jsx)(`span`,{className:`font-medium text-ink tabular-nums`,children:w(e)}),(0,O.jsx)(`span`,{className:`text-[0.8125rem] text-ink-3 tabular-nums`,children:C(e)}),(0,O.jsx)(`span`,{className:`ml-auto text-[0.8125rem] text-ink-4`,children:L(e.commits.length)})]}),(0,O.jsx)(`div`,{className:`mt-2 pl-6`,children:(0,O.jsx)(x,{release:e})})]},e.version??`unreleased`))}):null,D===`credits`?(0,O.jsx)(P,{active:!0}):null]},D)]})}export{R as AboutDialog};

package/apps/web/dist/assets/ChangelogDialog-B0lS0BdL.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{n as t,t as n}from"./jsx-runtime-BNakU3Ej.js";import{Bt as r,Ht as i,Qt as a,an as o,qt as s,zt as c}from"./ui-DMmT-cSO.js";import{t as l}from"./preload-helper-CNEI7N0N.js";var u=e(t(),1),d=e(n(),1);function f(e){switch(e.group){case`Added`:return{label:`NEW`,dot:`bg-moss`};case`Fixed`:return{label:`FIXED`,dot:`bg-amber`};case`Changed`:return{label:`CHANGED`,dot:`bg-cobalt`};case`Performance`:return{label:`PERFORMANCE`,dot:`bg-ember`};case`Deploy`:return{label:`DEPLOY`,dot:`bg-ink-4`};case`Docs`:return{label:`DOCS`,dot:`bg-ink-4`};default:return{label:`OTHER`,dot:`bg-ink-4`}}}var p=e=>e.version?e.version.replace(/^v/,``):o(`about.unreleased`),m=e=>e.timestamp?new Date(e.timestamp*1e3).toISOString().slice(0,10):``,h=e=>e.charAt(0).toUpperCase()+e.slice(1);function g(e,t){let n=t.trim().toLowerCase();if(!n)return e;let r=[];for(let t of e){if(`${p(t)} ${m(t)}`.toLowerCase().includes(n)){r.push(t);continue}let e=t.commits.filter(e=>`${f(e).label} ${e.scope??``} ${e.message}`.toLowerCase().includes(n));e.length>0&&r.push({...t,commits:e})}return r}async function _(e){if(e)try{let t=await fetch(`https://raw.githubusercontent.com/engenty/wizards/v${e}/apps/web/src/about/changelog.json`,{signal:AbortSignal.timeout(5e3)});if(t.ok)return await t.json()}catch{}return(await l(async()=>{let{default:e}=await import(`./changelog-FJJS0Tpt.js`);return{default:e}},[])).default}function v({release:e}){return(0,d.jsx)(`ul`,{className:`flex flex-col gap-2`,children:e.commits.map(e=>{let t=f(e);return(0,d.jsxs)(`li`,{className:`flex items-start gap-2.5 text-[0.875rem]`,children:[(0,d.jsx)(`span`,{className:a(`mt-[7px] size-1.5 shrink-0 rounded-full`,t.dot)}),(0,d.jsxs)(`span`,{className:`min-w-0 text-ink-2`,children:[(0,d.jsxs)(`span`,{className:`font-semibold text-[0.75rem] text-ink tracking-wide`,children:[t.label,e.scope?` [${e.scope}]`:``]}),` `,h(e.message),e.breaking?(0,d.jsx)(`span`,{className:`ml-1.5 rounded-full bg-rose-tint px-1.5 py-0.5 font-medium text-[0.75rem] text-rose`,children:o(`about.breaking`)}):null]})]},e.id)})})}function y({open:e,onClose:t,version:n}){let[a,l]=(0,u.useState)(null),[f,h]=(0,u.useState)(``);(0,u.useEffect)(()=>{if(!e||a)return;let t=!1;return _(n).then(e=>{t||l(e)}),()=>{t=!0}},[e,a,n]),(0,u.useEffect)(()=>{e||h(``)},[e]);let y=a?g(a,f):[];return(0,d.jsxs)(c,{open:e,onClose:t,title:o(`about.changelog`),wide:!0,height:`tall`,children:[(0,d.jsx)(`p`,{className:`-mt-3 mb-4 text-[0.875rem] text-ink-3`,children:o(`about.changelogHint`)}),a===null?(0,d.jsx)(`div`,{className:`flex justify-center py-10 text-ink-3`,children:(0,d.jsx)(s,{})}):a.length===0?(0,d.jsx)(r,{children:o(`about.changelogEmpty`)}):(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)(i,{type:`search`,value:f,placeholder:o(`about.search`),onChange:e=>h(e.target.value)}),y.length===0?(0,d.jsx)(r,{children:o(`about.noMatches`)}):null,y.map(e=>(0,d.jsxs)(`section`,{className:`mt-6`,children:[(0,d.jsxs)(`h3`,{className:`flex items-baseline gap-3 border-border-soft border-b pb-2 font-display font-semibold text-[1rem]`,children:[p(e),(0,d.jsx)(`span`,{className:`font-normal font-sans text-[0.8125rem] text-ink-3 tabular-nums`,children:m(e)})]}),(0,d.jsx)(`div`,{className:`mt-3`,children:(0,d.jsx)(v,{release:e})})]},e.version??`unreleased`))]})]})}export{y as ChangelogDialog,v as ReleaseNotes,_ as loadReleases,m as releaseDate,p as releaseLabel};