@ggui-ai/cli 0.1.0-rc.3 → 0.2.0-alpha.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/dist/cli.js +83 -32
- package/dist/generation-probe.d.ts +28 -6
- package/dist/generation-probe.d.ts.map +1 -1
- package/dist/generation-probe.js +43 -26
- package/dist/mcp-backend.d.ts +38 -41
- package/dist/mcp-backend.d.ts.map +1 -1
- package/dist/mcp-backend.js +105 -135
- package/dist/persistent-secrets.js +8 -8
- package/dist/persistent-stores.d.ts +2 -2
- package/dist/persistent-stores.d.ts.map +1 -1
- package/dist/persistent-stores.js +8 -8
- package/dist/serve-command.d.ts +15 -15
- package/dist/serve-command.d.ts.map +1 -1
- package/dist/serve-command.js +19 -19
- package/dist/serve-fallback.d.ts +1 -1
- package/package.json +17 -17
package/dist/serve-command.d.ts
CHANGED
|
@@ -58,12 +58,12 @@ export interface ParsedServeFlags {
|
|
|
58
58
|
*/
|
|
59
59
|
devAllowAll: boolean;
|
|
60
60
|
/**
|
|
61
|
-
* Override the public base URL used to compose `mcpApps.
|
|
62
|
-
*
|
|
63
|
-
*
|
|
61
|
+
* Override the public base URL used to compose `mcpApps.wsUrl`
|
|
62
|
+
* and `runtime.url`. Without this, the URLs derive from
|
|
63
|
+
* `--host:--port`, which only resolves from the same machine.
|
|
64
64
|
* Set to a tunnel URL (`https://<random>.trycloudflare.com`) when
|
|
65
|
-
* testing against a remote MCP host so iframe-runtime +
|
|
66
|
-
*
|
|
65
|
+
* testing against a remote MCP host so the iframe-runtime + live
|
|
66
|
+
* channel resolve from the host's perspective.
|
|
67
67
|
*
|
|
68
68
|
* Trailing slash is stripped on parse. Must include scheme
|
|
69
69
|
* (`http://` or `https://`); the `wsUrl` is derived by replacing the
|
|
@@ -117,8 +117,8 @@ export interface ParsedServeFlags {
|
|
|
117
117
|
* 1. Banner copy is "PUBLIC DEMO" with a "operator pays for the
|
|
118
118
|
* LLM" cost note, instead of the "DEV ALLOW-ALL" warning.
|
|
119
119
|
* 2. A per-remote-IP `FixedWindowRateLimiter` is bound to the
|
|
120
|
-
* `
|
|
121
|
-
* operator's budget. Default: 30
|
|
120
|
+
* `ggui_render` handler so a single visitor can't burn the
|
|
121
|
+
* operator's budget. Default: 30 render calls per 10 minutes per IP.
|
|
122
122
|
* 3. The pair-code beacon is suppressed (same as devAllowAll —
|
|
123
123
|
* pair codes are meaningless under any-bearer-auth).
|
|
124
124
|
*
|
|
@@ -158,7 +158,7 @@ export interface ParsedServeFlags {
|
|
|
158
158
|
*
|
|
159
159
|
* - `default` — gentle "ggui first when UI fits, prose otherwise"
|
|
160
160
|
* - `aggressive` — render anything with structure (no-preset default)
|
|
161
|
-
* - `always` — every response renders via
|
|
161
|
+
* - `always` — every response renders via ggui_render
|
|
162
162
|
* - `minimal` — server identity only, no behavioral nudge
|
|
163
163
|
* - `off` — omit the field entirely
|
|
164
164
|
*
|
|
@@ -193,11 +193,10 @@ export interface ParsedServeFlags {
|
|
|
193
193
|
/**
|
|
194
194
|
* Disable the cross-restart persistence bundle. Without this flag,
|
|
195
195
|
* `ggui serve` reads or mints the HMAC secrets (and, in later
|
|
196
|
-
* slices,
|
|
196
|
+
* slices, RenderStore + ShortCodeIndex + VectorStore + paired
|
|
197
197
|
* bearers) under `getPersistentDir(projectRoot)` so a server
|
|
198
|
-
* restart doesn't invalidate cached `_meta.ggui.
|
|
199
|
-
*
|
|
200
|
-
* keep working.
|
|
198
|
+
* restart doesn't invalidate cached `_meta["ai.ggui/render"].wsToken`
|
|
199
|
+
* envelopes — claude.ai chat-history revisits keep working.
|
|
201
200
|
*
|
|
202
201
|
* With `--ephemeral`, every restart mints fresh HMAC secrets (the
|
|
203
202
|
* legacy behavior). Use for tests / CI loops that don't want files
|
|
@@ -463,8 +462,9 @@ export interface RunServeOptions {
|
|
|
463
462
|
/**
|
|
464
463
|
* When true, the boot banner emits a "/settings to set your LLM key"
|
|
465
464
|
* action line so first-run operators know how to recover from
|
|
466
|
-
* `
|
|
467
|
-
* generation probe returned null (no env + no
|
|
465
|
+
* `ggui_render` falling back to the Connect-Claude card. Set by
|
|
466
|
+
* `cli.ts` when the generation probe returned null (no env + no
|
|
467
|
+
* credentials-file).
|
|
468
468
|
*/
|
|
469
469
|
readonly noLlmKey?: boolean;
|
|
470
470
|
/** Where to write the banner. */
|
|
@@ -496,5 +496,5 @@ export interface RunServeOptions {
|
|
|
496
496
|
* {@link describeServeBanner} / {@link describeAgentStatus}.
|
|
497
497
|
*/
|
|
498
498
|
export declare function runServe(opts: RunServeOptions): Promise<number>;
|
|
499
|
-
export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n - Landing page at / \u2014 operator opens a browser and sees\n server identity + pair-code card.\n -
|
|
499
|
+
export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n - Landing page at / \u2014 operator opens a browser and sees\n server identity + pair-code card.\n - Render viewer at /r/<code> \u2014 same-origin viewer for renders\n minted by ggui_render; same-origin\n HTTP-only cookie authenticates the\n live-channel /ws upgrade.\n - POST /pair + POST /admin/pair/init \u2014 pairing endpoint for MCP\n hosts and third-party clients.\n - Live-channel /ws \u2014 live render plane for MCP Apps\n iframes and the console.\n\nEmbedding hosts that want a different shape (no landing page, no\npairing, programmatic control) should compose createGguiServer()\ndirectly in code rather than invoking `ggui serve`.\n\nUsage:\n ggui serve [options]\n\nOptions:\n --port <n> Bind port (default: 6781, 0 = OS-assigned).\n --host <addr> Bind host (default: 127.0.0.1).\n --mcp-only Run just the MCP server; do not supervise an agent.\n --dev-allow-all Accept any non-empty bearer (incl. no bearer) as\n builder. Local-dev / tunnel smoke ONLY \u2014 never\n expose to the open internet.\n --public-demo Public-facing demo posture: same any-bearer auth\n as --dev-allow-all, plus per-IP rate limit on\n ggui_render (30 generations / 10 min) and a\n \"PUBLIC DEMO \u2014 operator pays\" banner. Mutually\n exclusive with --dev-allow-all.\n --multi-tenant Multi-tenant posture: switches the /settings LLM-\n keys gate from admin-token to auth-adapter so\n each authenticated end-user manages their OWN\n key plane (scope = userId/appId). kind:'builder'\n identities are rejected at the gate. Strict-auth\n only; mutually exclusive with --dev-allow-all\n and --public-demo. (Generation-time BYOK still\n resolves at the operator 'global' scope \u2014 a\n follow-up will thread per-user BYOK through\n ggui_render.)\n --public-base-url <u> Override the public base URL used to compose\n iframe-runtime + shortCode URLs. Set this to a\n tunnel URL (https://<random>.trycloudflare.com)\n when testing against a remote MCP host so URLs\n resolve from the host's perspective. Without\n this, URLs derive from --host:--port and only\n work from the same machine.\n --oauth Mount OAuth 2.1 + PKCE + Dynamic Client\n Registration routes (.well-known/oauth-* +\n /oauth/{authorize,token,register}). Required\n for MCP custom-connector hosts (claude.ai,\n ChatGPT) whose Add Connector form has no field\n for a pre-shared bearer; OAuth lets them do\n a discovery \u2192 DCR \u2192 consent dance ending in\n the same paired bearer the strict-auth flow\n already mints. Pure-bearer clients (Claude\n Desktop with bearer in config) work without it.\n --admin-token <t> Pin the admin bearer that gates the console\n /keys plane (list / mint / revoke pairings +\n /admin-login route). Without this, the server\n mints a fresh ggui_admin_* token per boot and\n prints it on the banner. Pin a stable value\n when you want the bearer to survive restarts\n (e.g. paste once into a password manager).\n --ephemeral Disable cross-restart persistence. Without\n this flag, the HMAC secrets that sign MCP\n Apps bootstrap tokens and signed render URLs\n are read or minted under .ggui/persistent/\n (project-local if a ggui.json was resolved,\n else ~/.ggui/persistent/) so cached tokens\n survive a server restart. Pass this flag to\n keep restarts ephemeral (tests / CI / nuclear-\n revoke). Override the dir via GGUI_PERSISTENT_DIR.\n --help, -h Show this help.\n\nAgent runtime:\n The default boots your agent alongside MCP. The agent's entry file\n comes from ggui.json:\n\n { \"agent\": { \"entry\": \"./agent.ts\" } }\n\n Supported extensions: .js / .mjs / .cjs (node), .ts / .tsx / .mts\n (node --import=tsx). No ggui.json, or no agent.entry, falls back\n to MCP-only with a warning. Malformed ggui.json or a bad entry\n is a hard error.\n\n Agent crashes after startup are logged; the MCP server keeps\n running. No auto-restart \u2014 compose that with your own supervisor.\n\nPersistent storage (default-on; opt-out via --ephemeral):\n By default `ggui serve` writes a small bundle under .ggui/persistent/\n (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)\n so cached MCP Apps tokens, signed render URLs, shortCodes, renders,\n vectors, and paired bearers survive a restart \u2014 claude.ai chat-history\n revisits keep working.\n\n Bundle layout:\n\n .ggui/persistent/\n \u251C\u2500\u2500 ws-token-secret.hex (HMAC, 0600)\n \u251C\u2500\u2500 render-signer-secret.hex (HMAC, 0600)\n \u251C\u2500\u2500 short-codes.sqlite (signed render-URL resolution)\n \u251C\u2500\u2500 renders.sqlite (RenderStore \u2014 renders + event history)\n \u251C\u2500\u2500 vectors.sqlite (RAG corpus)\n \u2514\u2500\u2500 keys.json (paired bearers)\n\n Override the dir with `GGUI_PERSISTENT_DIR`. Pass `--ephemeral` to\n skip the bundle entirely (tests, CI loops, nuclear-revoke).\n\n Explicit ggui.json#storage declarations always win \u2014 declare\n `{ \"renders\": { \"driver\": \"memory\" } }` to opt renders back to\n in-memory while keeping other surfaces persistent. Custom sqlite\n paths via ggui.json#storage are honored verbatim:\n\n {\n \"storage\": {\n \"renders\": { \"driver\": \"sqlite\", \"path\": \"./ggui-renders.sqlite\" },\n \"vectors\": { \"driver\": \"sqlite\", \"path\": \"./ggui-vectors.sqlite\" },\n \"threads\": { \"driver\": \"sqlite\", \"path\": \"./ggui-threads.sqlite\" }\n }\n }\n\n Threads: the persistent-chat route family (/threads) is opt-in.\n Absent `storage.threads` leaves the routes unmounted \u2014 pairs\n with Portal's self-hosted origins only when declared. Driver\n semantics:\n - `driver: \"sqlite\"` \u2014 durable. Threads survive restart.\n /ggui/health reports `threads.durability: \"durable\"`;\n Portal hides its non-durable caveat.\n - `driver: \"memory\"` \u2014 routes mount but data is lost on\n restart. /ggui/health reports `threads.durability:\n \"ephemeral\"`; Portal shows its caveat.\n\n Paths resolve relative to the ggui.json directory. The sqlite\n driver needs `better-sqlite3` installed in your project.\n\nRecommended setups:\n\n Local-only smoke (no tunnel, no remote MCP host):\n ggui serve\n\n claude.ai custom connector (over a public tunnel):\n 1. Tunnel: cloudflared tunnel --url http://localhost:6781\n 2. ggui serve --oauth \\\n --public-base-url https://<tunnel>.trycloudflare.com\n 3. Note PAIR_CODE from boot. Visit the landing page (the public URL\n above), complete pairing, save the bearer.\n 4. claude.ai \u2192 Settings \u2192 Connectors \u2192 Add custom connector.\n URL: https://<tunnel>.trycloudflare.com/mcp\n Client ID / Secret: leave empty (server uses Dynamic Client\n Registration; no pre-shared secret needed).\n 5. Click Connect \u2192 claude.ai redirects you to a paste-key page.\n Paste the bearer from step 3. Done.\n\n Quick local-dev WITHOUT auth (NEVER over a public tunnel):\n ggui serve --dev-allow-all\n\nCurrent limits:\n - Strict-auth only: /mcp rejects any bearer that isn't pair-minted.\n The CLI pre-mints one pairing code on boot (printed as\n `PAIR_CODE <code>` and shown in the banner + on the landing\n page). Complete `POST /pair {code, deviceName}` to receive a\n bearer you can use with MCP. Embed @ggui-ai/mcp-server in your\n own entrypoint to inject a different AuthAdapter (OIDC, Cognito,\n etc.) for production.\n - Single-tenant: every request scopes to one `builder` app id.\n";
|
|
500
500
|
//# sourceMappingURL=serve-command.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2DAA2D;IAC3D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB
|
|
1
|
+
{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,2DAA2D;IAC3D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAkLzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAgHtE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAsJrE;AAED,eAAO,MAAM,UAAU,qpSA+KtB,CAAC"}
|
package/dist/serve-command.js
CHANGED
|
@@ -227,10 +227,10 @@ export function describeServeBanner(input) {
|
|
|
227
227
|
lines.push(` admin token → ${input.adminToken} (console /keys gate — paste at /admin-login)`);
|
|
228
228
|
}
|
|
229
229
|
if (input.noLlmKey) {
|
|
230
|
-
// First-run nudge — without an LLM key,
|
|
231
|
-
//
|
|
232
|
-
// /settings URL alongside admin-token so the operator can paste
|
|
233
|
-
// key without restarting (the file store is hot-read on every
|
|
230
|
+
// First-run nudge — without an LLM key, ggui_render falls back to
|
|
231
|
+
// the Connect-Claude card and the iframe never bootstraps. Surface
|
|
232
|
+
// the /settings URL alongside admin-token so the operator can paste
|
|
233
|
+
// a key without restarting (the file store is hot-read on every
|
|
234
234
|
// generation; setting through /settings takes effect immediately).
|
|
235
235
|
const settingsUrl = input.publicBaseUrl
|
|
236
236
|
? `${input.publicBaseUrl}/settings`
|
|
@@ -251,12 +251,12 @@ export function describeServeBanner(input) {
|
|
|
251
251
|
// attribution (the operator's BYOK funds every visitor's
|
|
252
252
|
// generations) and (b) the rate-limit ceiling so the operator
|
|
253
253
|
// remembers what protection is in place if the demo blows up.
|
|
254
|
-
lines.push(` ⚠ PUBLIC DEMO: every bearer authenticates as builder.`, ` End-user generations bill the operator's LLM key in`, ` ~/.ggui/credentials.json. Per-IP rate limit on
|
|
254
|
+
lines.push(` ⚠ PUBLIC DEMO: every bearer authenticates as builder.`, ` End-user generations bill the operator's LLM key in`, ` ~/.ggui/credentials.json. Per-IP rate limit on ggui_render`, ` bounds abuse. Drop --public-demo for strict auth.`);
|
|
255
255
|
}
|
|
256
256
|
else {
|
|
257
257
|
lines.push(` auth: strict — only pair-minted bearer tokens authenticate /mcp.`, ` Pair via the code above (landing page or \`POST /pair\`).`, ` Override the adapter via GguiServer({ auth }) in code for`, ` custom deployments (OIDC, Cognito, etc.).`);
|
|
258
258
|
if (input.multiTenant) {
|
|
259
|
-
lines.push(``, ` multi-tenant: each authenticated user manages their OWN LLM`, ` keys at /settings — the gate uses the request's bearer`, ` (Authorization: Bearer their-paired-token), NOT the`, ` admin token. Per-user scope is auto-derived from the`, ` identity (userId / appId).`, ` Note:
|
|
259
|
+
lines.push(``, ` multi-tenant: each authenticated user manages their OWN LLM`, ` keys at /settings — the gate uses the request's bearer`, ` (Authorization: Bearer their-paired-token), NOT the`, ` admin token. Per-user scope is auto-derived from the`, ` identity (userId / appId).`, ` Note: ggui_render generation still resolves BYOK at the`, ` operator scope (env + credentials-file 'global'). Per-`, ` user generation-time BYOK is a follow-up — for now,`, ` multi-tenant lets each user MANAGE their key plane`, ` without granting them the operator's admin token.`);
|
|
260
260
|
}
|
|
261
261
|
if (input.oauth) {
|
|
262
262
|
lines.push(``, ` oauth: enabled — MCP custom-connector hosts (claude.ai etc.)`, ` can discover via /.well-known/oauth-* and complete the`, ` auth dance against /oauth/{authorize,token,register}.`, ` Paste the paired bearer on the consent page.`);
|
|
@@ -449,13 +449,13 @@ grows.
|
|
|
449
449
|
First-run bundle (all on by default):
|
|
450
450
|
- Landing page at / — operator opens a browser and sees
|
|
451
451
|
server identity + pair-code card.
|
|
452
|
-
-
|
|
453
|
-
minted by
|
|
452
|
+
- Render viewer at /r/<code> — same-origin viewer for renders
|
|
453
|
+
minted by ggui_render; same-origin
|
|
454
454
|
HTTP-only cookie authenticates the
|
|
455
455
|
live-channel /ws upgrade.
|
|
456
456
|
- POST /pair + POST /admin/pair/init — pairing endpoint for MCP
|
|
457
457
|
hosts and third-party clients.
|
|
458
|
-
- Live-channel /ws — live
|
|
458
|
+
- Live-channel /ws — live render plane for MCP Apps
|
|
459
459
|
iframes and the console.
|
|
460
460
|
|
|
461
461
|
Embedding hosts that want a different shape (no landing page, no
|
|
@@ -474,7 +474,7 @@ Options:
|
|
|
474
474
|
expose to the open internet.
|
|
475
475
|
--public-demo Public-facing demo posture: same any-bearer auth
|
|
476
476
|
as --dev-allow-all, plus per-IP rate limit on
|
|
477
|
-
|
|
477
|
+
ggui_render (30 generations / 10 min) and a
|
|
478
478
|
"PUBLIC DEMO — operator pays" banner. Mutually
|
|
479
479
|
exclusive with --dev-allow-all.
|
|
480
480
|
--multi-tenant Multi-tenant posture: switches the /settings LLM-
|
|
@@ -486,7 +486,7 @@ Options:
|
|
|
486
486
|
and --public-demo. (Generation-time BYOK still
|
|
487
487
|
resolves at the operator 'global' scope — a
|
|
488
488
|
follow-up will thread per-user BYOK through
|
|
489
|
-
|
|
489
|
+
ggui_render.)
|
|
490
490
|
--public-base-url <u> Override the public base URL used to compose
|
|
491
491
|
iframe-runtime + shortCode URLs. Set this to a
|
|
492
492
|
tunnel URL (https://<random>.trycloudflare.com)
|
|
@@ -539,17 +539,17 @@ Agent runtime:
|
|
|
539
539
|
Persistent storage (default-on; opt-out via --ephemeral):
|
|
540
540
|
By default \`ggui serve\` writes a small bundle under .ggui/persistent/
|
|
541
541
|
(project-local if a ggui.json was resolved, else ~/.ggui/persistent/)
|
|
542
|
-
so cached MCP Apps tokens, signed render URLs, shortCodes,
|
|
542
|
+
so cached MCP Apps tokens, signed render URLs, shortCodes, renders,
|
|
543
543
|
vectors, and paired bearers survive a restart — claude.ai chat-history
|
|
544
544
|
revisits keep working.
|
|
545
545
|
|
|
546
546
|
Bundle layout:
|
|
547
547
|
|
|
548
548
|
.ggui/persistent/
|
|
549
|
-
├──
|
|
549
|
+
├── ws-token-secret.hex (HMAC, 0600)
|
|
550
550
|
├── render-signer-secret.hex (HMAC, 0600)
|
|
551
|
-
├── short-codes.sqlite (
|
|
552
|
-
├──
|
|
551
|
+
├── short-codes.sqlite (signed render-URL resolution)
|
|
552
|
+
├── renders.sqlite (RenderStore — renders + event history)
|
|
553
553
|
├── vectors.sqlite (RAG corpus)
|
|
554
554
|
└── keys.json (paired bearers)
|
|
555
555
|
|
|
@@ -557,15 +557,15 @@ Persistent storage (default-on; opt-out via --ephemeral):
|
|
|
557
557
|
skip the bundle entirely (tests, CI loops, nuclear-revoke).
|
|
558
558
|
|
|
559
559
|
Explicit ggui.json#storage declarations always win — declare
|
|
560
|
-
\`{ "
|
|
560
|
+
\`{ "renders": { "driver": "memory" } }\` to opt renders back to
|
|
561
561
|
in-memory while keeping other surfaces persistent. Custom sqlite
|
|
562
562
|
paths via ggui.json#storage are honored verbatim:
|
|
563
563
|
|
|
564
564
|
{
|
|
565
565
|
"storage": {
|
|
566
|
-
"
|
|
567
|
-
"vectors":
|
|
568
|
-
"threads":
|
|
566
|
+
"renders": { "driver": "sqlite", "path": "./ggui-renders.sqlite" },
|
|
567
|
+
"vectors": { "driver": "sqlite", "path": "./ggui-vectors.sqlite" },
|
|
568
|
+
"threads": { "driver": "sqlite", "path": "./ggui-threads.sqlite" }
|
|
569
569
|
}
|
|
570
570
|
}
|
|
571
571
|
|
package/dist/serve-fallback.d.ts
CHANGED
|
@@ -26,7 +26,7 @@ export interface ResolvedAgentPlan {
|
|
|
26
26
|
/**
|
|
27
27
|
* Absolute path to the manifest's parent directory — the canonical
|
|
28
28
|
* root for resolving relative paths declared in the manifest
|
|
29
|
-
* (`storage.
|
|
29
|
+
* (`storage.renders.path`, `agent.entry`, future additive fields).
|
|
30
30
|
* `null` when no manifest was found.
|
|
31
31
|
*/
|
|
32
32
|
readonly projectRoot: string | null;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ggui-ai/cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.2.0-alpha.3",
|
|
4
4
|
"description": "The `ggui` CLI — run the ggui protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"ggui",
|
|
@@ -32,22 +32,22 @@
|
|
|
32
32
|
"@huggingface/transformers": "^3.0.0",
|
|
33
33
|
"@noble/hashes": "^1.6.0",
|
|
34
34
|
"esbuild": "^0.25.12",
|
|
35
|
-
"@ggui-ai/agent-runtime": "0.
|
|
36
|
-
"@ggui-ai/
|
|
37
|
-
"@ggui-ai/
|
|
38
|
-
"@ggui-ai/
|
|
39
|
-
"@ggui-ai/
|
|
40
|
-
"@ggui-ai/embedding-local": "0.
|
|
41
|
-
"@ggui-ai/mcp-server": "0.
|
|
42
|
-
"@ggui-ai/mcp-server-
|
|
43
|
-
"@ggui-ai/
|
|
44
|
-
"@ggui-ai/project-config": "0.
|
|
45
|
-
"@ggui-ai/
|
|
46
|
-
"@ggui-ai/
|
|
47
|
-
"@ggui-ai/
|
|
48
|
-
"@ggui-ai/
|
|
49
|
-
"@ggui-ai/
|
|
50
|
-
"@ggui-ai/ui-
|
|
35
|
+
"@ggui-ai/agent-runtime": "0.2.0-alpha.3",
|
|
36
|
+
"@ggui-ai/design": "0.2.0-alpha.3",
|
|
37
|
+
"@ggui-ai/gadget-signing": "0.2.0-alpha.3",
|
|
38
|
+
"@ggui-ai/dev-stack": "0.2.0-alpha.3",
|
|
39
|
+
"@ggui-ai/artifact-manifest": "0.2.0-alpha.3",
|
|
40
|
+
"@ggui-ai/embedding-local": "0.2.0-alpha.3",
|
|
41
|
+
"@ggui-ai/mcp-server-core": "0.2.0-alpha.3",
|
|
42
|
+
"@ggui-ai/mcp-server-handlers": "0.2.0-alpha.3",
|
|
43
|
+
"@ggui-ai/preview-a2ui": "0.2.0-alpha.3",
|
|
44
|
+
"@ggui-ai/project-config": "0.2.0-alpha.3",
|
|
45
|
+
"@ggui-ai/protocol": "0.2.0-alpha.3",
|
|
46
|
+
"@ggui-ai/registry-core": "0.2.0-alpha.3",
|
|
47
|
+
"@ggui-ai/mcp-server": "0.2.0-alpha.3",
|
|
48
|
+
"@ggui-ai/ui-registry": "0.2.0-alpha.3",
|
|
49
|
+
"@ggui-ai/iframe-runtime": "0.2.0-alpha.3",
|
|
50
|
+
"@ggui-ai/ui-gen": "0.2.0-alpha.3"
|
|
51
51
|
},
|
|
52
52
|
"devDependencies": {
|
|
53
53
|
"@types/node": "^24.0.0",
|