@gmickel/gno 1.39.2 → 1.40.0

package/src/serve/public/pages/Ask.tsx

@@ -54,6 +54,10 @@ import {
   type QueryModeType,
   type TagMode,
 } from "../lib/retrieval-filters";
+import {
+  fetchServerCapabilities,
+  type ServerCapabilities,
+} from "../lib/server-capabilities";
 import { cn } from "../lib/utils";
 
 interface PageProps {
@@ -104,13 +108,6 @@ interface AskResponse {
   verification?: AskVerification;
 }
 
-interface Capabilities {
-  bm25: boolean;
-  vector: boolean;
-  hybrid: boolean;
-  answer: boolean;
-}
-
 interface ConversationEntry {
   id: string;
   query: string;
@@ -195,7 +192,9 @@ function renderAnswer(
 export default function Ask({ navigate }: PageProps) {
   const [query, setQuery] = useState("");
   const [conversation, setConversation] = useState<ConversationEntry[]>([]);
-  const [capabilities, setCapabilities] = useState<Capabilities | null>(null);
+  const [capabilities, setCapabilities] = useState<ServerCapabilities | null>(
+    null
+  );
   const [collections, setCollections] = useState<Collection[]>([]);
   const [thoroughness, setThoroughness] = useState<Thoroughness>("balanced");
   const [activePreset, setActivePreset] = useState("slim-tuned");
@@ -233,7 +232,7 @@ export default function Ask({ navigate }: PageProps) {
   useEffect(() => {
     async function bootstrap(): Promise<void> {
       const [capsResult, collectionsResult, presetsResult] = await Promise.all([
-        apiFetch<Capabilities>("/api/capabilities"),
+        fetchServerCapabilities(),
         apiFetch<Collection[]>("/api/collections"),
         apiFetch<PresetsResponse>("/api/presets"),
       ]);

package/src/serve/public/pages/DocView.tsx

@@ -94,6 +94,10 @@ import {
   stripSectionTargetLinkParam,
   type SectionLinkNoticeKind,
 } from "../lib/section-links";
+import {
+  fetchServerCapabilities,
+  type ServerCapabilities,
+} from "../lib/server-capabilities";
 import { subscribeWorkspaceActionRequest } from "../lib/workspace-events";
 import {
   FrontmatterDisplay,
@@ -361,6 +365,11 @@ function getParentPath(relPath: string): string {
 
 export default function DocView({ navigate }: PageProps) {
   const [doc, setDoc] = useState<DocData | null>(null);
+  // undefined = not answered yet (offer neither locality-dependent action),
+  // null = fetch failed (fail closed: treat the client as remote).
+  const [serverCapabilities, setServerCapabilities] = useState<
+    ServerCapabilities | null | undefined
+  >(undefined);
   const [error, setError] = useState<string | null>(null);
   const [loading, setLoading] = useState(true);
   const [deleteDialogOpen, setDeleteDialogOpen] = useState(false);
@@ -483,6 +492,20 @@ export default function DocView({ navigate }: PageProps) {
     });
   }, [currentUri]);
 
+  // Server capabilities decide which host-local actions may render. A failed
+  // fetch leaves them null, which the view reads as a remote client.
+  useEffect(() => {
+    let cancelled = false;
+    void fetchServerCapabilities().then(({ data }) => {
+      if (!cancelled) {
+        setServerCapabilities(data);
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
   // Fetch document when URI changes
   useEffect(() => {
     loadDocument();
@@ -542,6 +565,11 @@ export default function DocView({ navigate }: PageProps) {
 
   const isPdf = Boolean(doc && isPdfDocument(doc.source));
 
+  const localClient = serverCapabilities?.localClient ?? false;
+  // Until /api/capabilities answers, a same-host user would otherwise see the
+  // remote "Open original" flash in and then swap to Reveal.
+  const localityKnown = serverCapabilities !== undefined;
+
   // Spec predicate — evaluated per render, never from mime/ext.
   const extractedTextAvailable = Boolean(doc && isExtractedTextAvailable(doc));
 
@@ -552,6 +580,16 @@ export default function DocView({ navigate }: PageProps) {
     return buildDocAssetUrl(doc.uri, doc.relPath);
   }, [doc, isPdf]);
 
+  // Remote "Open original" target for any document that has a source file:
+  // /api/doc-asset serves any collection file inline, so this keeps the
+  // previous file:// scope (every read-only source) for remote clients.
+  const sourceAssetUrl = useMemo(() => {
+    if (!doc?.source.absPath) {
+      return null;
+    }
+    return buildDocAssetUrl(doc.uri, doc.relPath);
+  }, [doc]);
+
   // Parse frontmatter for markdown files
   const parsedContent = useMemo(() => {
     if (!doc?.content || !isMarkdown) {
@@ -1690,10 +1728,10 @@ export default function DocView({ navigate }: PageProps) {
   );
 
   return (
-    <div className="min-h-screen">
+    <div className="min-h-screen min-w-0 overflow-x-clip">
       {/* Header */}
       <header className="glass sticky top-0 z-10 border-border/50 border-b">
-        <div className="flex items-center gap-4 px-8 py-4">
+        <div className="flex min-w-0 flex-wrap items-center gap-x-4 gap-y-2 px-4 py-4 sm:px-8">
           {/* Home button - Scholarly Dusk brass accent */}
           <Button
             aria-label="Go to dashboard"
@@ -1730,8 +1768,14 @@ export default function DocView({ navigate }: PageProps) {
           )}
           {doc && (
             <>
-              <Separator className="h-6" orientation="vertical" />
-              <div className="flex items-center gap-2">
+              <Separator
+                className="hidden h-6 sm:block"
+                orientation="vertical"
+              />
+              <div
+                className="flex min-w-0 flex-wrap items-center gap-2"
+                data-testid="doc-header-actions"
+              >
                 {doc.capabilities.editable ? (
                   <>
                     <Button className="gap-1.5" onClick={handleEdit} size="sm">
@@ -1817,10 +1861,11 @@ export default function DocView({ navigate }: PageProps) {
                       )}
                       Export for gno.sh
                     </Button>
-                    {doc.source.absPath && (
+                    {localClient && doc.source.absPath && (
                       <>
                         <Button
                           className="gap-1.5"
+                          data-testid="doc-reveal"
                           onClick={() => {
                             void handleReveal();
                           }}
@@ -1832,6 +1877,7 @@ export default function DocView({ navigate }: PageProps) {
                         </Button>
                         <Button asChild size="sm" variant="outline">
                           <a
+                            data-testid="doc-open-original"
                             href={`file://${doc.source.absPath}`}
                             rel="noopener noreferrer"
                             target="_blank"
@@ -1842,21 +1888,37 @@ export default function DocView({ navigate }: PageProps) {
                         </Button>
                       </>
                     )}
+                    {localityKnown && !localClient && sourceAssetUrl && (
+                      <Button asChild size="sm" variant="outline">
+                        <a
+                          data-testid="doc-open-original"
+                          href={sourceAssetUrl}
+                          rel="noopener"
+                          target="_blank"
+                        >
+                          <SquareArrowOutUpRightIcon className="mr-1.5 size-4" />
+                          Open original
+                        </a>
+                      </Button>
+                    )}
                   </>
                 )}
-                {doc.capabilities.editable && doc.source.absPath && (
-                  <Button
-                    className="gap-1.5"
-                    onClick={() => {
-                      void handleReveal();
-                    }}
-                    size="sm"
-                    variant="outline"
-                  >
-                    <FolderOpen className="size-4" />
-                    Reveal
-                  </Button>
-                )}
+                {localClient &&
+                  doc.capabilities.editable &&
+                  doc.source.absPath && (
+                    <Button
+                      className="gap-1.5"
+                      data-testid="doc-reveal"
+                      onClick={() => {
+                        void handleReveal();
+                      }}
+                      size="sm"
+                      variant="outline"
+                    >
+                      <FolderOpen className="size-4" />
+                      Reveal
+                    </Button>
+                  )}
                 {isPdf && pdfAssetUrl ? (
                   <Button
                     asChild

package/src/serve/public/pages/Search.tsx

@@ -44,6 +44,10 @@ import {
   type QueryModeType,
   type TagMode,
 } from "../lib/retrieval-filters";
+import {
+  fetchServerCapabilities,
+  type ServerCapabilities,
+} from "../lib/server-capabilities";
 import { cn } from "../lib/utils";
 import { AIModelSelector, TagFacets } from "./search-page-widgets";
 
@@ -121,13 +125,6 @@ interface SearchResponse {
   };
 }
 
-interface Capabilities {
-  bm25: boolean;
-  vector: boolean;
-  hybrid: boolean;
-  answer: boolean;
-}
-
 interface Collection {
   name: string;
 }
@@ -157,7 +154,9 @@ export default function Search({ navigate }: PageProps) {
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [searched, setSearched] = useState(false);
-  const [capabilities, setCapabilities] = useState<Capabilities | null>(null);
+  const [capabilities, setCapabilities] = useState<ServerCapabilities | null>(
+    null
+  );
   const [collections, setCollections] = useState<Collection[]>([]);
   const [activePreset, setActivePreset] = useState("slim-tuned");
 
@@ -257,7 +256,7 @@ export default function Search({ navigate }: PageProps) {
     async function bootstrap(): Promise<void> {
       const [capabilitiesResult, collectionsResult, presetsResult] =
         await Promise.all([
-          apiFetch<Capabilities>("/api/capabilities"),
+          fetchServerCapabilities(),
           apiFetch<Collection[]>("/api/collections"),
           apiFetch<PresetsResponse>("/api/presets"),
         ]);

package/src/serve/request-locality.ts

@@ -0,0 +1,84 @@
+/**
+ * Request locality: is the caller a same-host browser?
+ *
+ * `gno serve` binds to loopback only, so every remote client reaches it through
+ * a same-host proxy or forwarder whose socket peer is loopback. A peer-only
+ * check would call those clients local; this rule also requires a loopback
+ * Host header and the absence of forwarding headers, and it fails closed.
+ */
+
+import type { HttpMcpPeerServer } from "../mcp/http-security";
+
+export type RequestPeerServer = Pick<HttpMcpPeerServer, "requestIP">;
+
+const FORWARDING_HEADERS = [
+  "forwarded",
+  "via",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+] as const;
+
+const IPV4_MAPPED_PREFIX = "::ffff:";
+const IPV4_OCTET = /^\d{1,3}$/;
+const HOST_PORT = /^:\d{1,5}$/;
+const LOOPBACK_IPV4_FIRST_OCTET = 127;
+const MAX_OCTET = 255;
+const IPV4_OCTET_COUNT = 4;
+
+/** Loopback socket address: 127.0.0.0/8, ::1, or an IPv4-mapped form. */
+export function isLoopbackAddress(address: string): boolean {
+  const normalized = address.toLowerCase();
+  if (normalized === "::1") return true;
+  const mapped = normalized.startsWith(IPV4_MAPPED_PREFIX)
+    ? normalized.slice(IPV4_MAPPED_PREFIX.length)
+    : normalized;
+  const octets = mapped.split(".");
+  return (
+    octets.length === IPV4_OCTET_COUNT &&
+    octets.every((octet) => IPV4_OCTET.test(octet)) &&
+    Number(octets[0]) === LOOPBACK_IPV4_FIRST_OCTET &&
+    octets.every((octet) => Number(octet) <= MAX_OCTET)
+  );
+}
+
+/** Host part of a Host header (`name`, `name:port`, `[v6]`, `[v6]:port`). */
+function hostHeaderName(host: string): string | null {
+  const trimmed = host.trim().toLowerCase();
+  if (trimmed.startsWith("[")) {
+    const end = trimmed.indexOf("]");
+    if (end === -1) return null;
+    const rest = trimmed.slice(end + 1);
+    if (rest !== "" && !HOST_PORT.test(rest)) return null;
+    return trimmed.slice(1, end) || null;
+  }
+  const [name, ...portParts] = trimmed.split(":");
+  if (portParts.length > 1) return null;
+  if (portParts.length === 1 && !HOST_PORT.test(`:${portParts[0]}`)) {
+    return null;
+  }
+  return name || null;
+}
+
+/** Host header naming a loopback host: `localhost`, `127.x.x.x`, or `[::1]`. */
+export function isLoopbackHostHeader(host: string | null): boolean {
+  if (!host) return false;
+  const name = hostHeaderName(host);
+  if (!name) return false;
+  return name === "localhost" || isLoopbackAddress(name);
+}
+
+/**
+ * True only when the socket peer is loopback, the Host header names a loopback
+ * host, and no forwarding header is present. Any other combination, a missing
+ * server, or an unknown peer yields false.
+ */
+export function isLocalClientRequest(
+  request: Request,
+  server: RequestPeerServer | undefined
+): boolean {
+  const peer = server?.requestIP(request) ?? null;
+  if (!peer || !isLoopbackAddress(peer.address)) return false;
+  if (!isLoopbackHostHeader(request.headers.get("host"))) return false;
+  return !FORWARDING_HEADERS.some((header) => request.headers.has(header));
+}

package/src/serve/routes/api.ts

@@ -177,6 +177,10 @@ import {
 } from "../file-refactor-http";
 import { analyzeImportPath } from "../import-preview";
 import { getActiveJob, getJobStatus, startJob } from "../jobs";
+import {
+  isLocalClientRequest,
+  type RequestPeerServer,
+} from "../request-locality";
 import {
   requestRetrievalTraceId,
   withRetrievalTraceHeader,
@@ -2179,6 +2183,53 @@ function parseSingleByteRange(
   return { ok: true, start, end };
 }
 
+/**
+ * Revalidate-on-every-open: the browser asks once per open and reuses the
+ * cached bytes on 304. Deliberately replaces fn-112's `no-store` (fn-136 R3).
+ */
+export const DOC_ASSET_CACHE_CONTROL = "private, max-age=0, must-revalidate";
+
+const WEAK_ETAG_PREFIX = "W/";
+
+/** Strong, quoted validator from file size and mtime (fn-136 R3). */
+export function docAssetEtag(file: {
+  size: number;
+  lastModified: number;
+}): string {
+  return `"${file.size.toString(16)}-${file.lastModified.toString(16)}"`;
+}
+
+/**
+ * RFC 9110 §13.1.2 If-None-Match: `*` or any listed validator matching under
+ * weak comparison (a `W/` prefix is ignored on the client's side).
+ *
+ * The list is split on a bare comma. Our validators (`"<size-hex>-<mtime-hex>"`)
+ * never contain one; a foreign tag that does would only produce a false
+ * negative (full body instead of 304), never a false match.
+ */
+export function etagMatches(
+  ifNoneMatch: string | null | undefined,
+  etag: string
+): boolean {
+  if (!ifNoneMatch) {
+    return false;
+  }
+  const trimmed = ifNoneMatch.trim();
+  if (trimmed === "*") {
+    return true;
+  }
+  for (const candidate of trimmed.split(",")) {
+    const value = candidate.trim();
+    const strong = value.startsWith(WEAK_ETAG_PREFIX)
+      ? value.slice(WEAK_ETAG_PREFIX.length)
+      : value;
+    if (strong === etag) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * GET|HEAD /api/doc-asset
  * Query params:
@@ -2187,6 +2238,8 @@ function parseSingleByteRange(
  *
  * Supports single-range Range requests (206/416). Multi-range → 416 (I1-03).
  * HEAD mirrors GET status/headers with empty body (I1-02).
+ * Strong ETag from size + mtime; a matching If-None-Match answers 304 before
+ * any Range handling, so full and ranged GETs revalidate alike (fn-136 R3).
  */
 export async function handleDocAsset(
   store: SqliteAdapter,
@@ -2269,13 +2322,24 @@ export async function handleDocAsset(
 
   const isHead = (request?.method ?? "GET").toUpperCase() === "HEAD";
   const filename = resolvedPath.split(/[\\/]/u).at(-1) ?? "document";
+  const etag = docAssetEtag(file);
   const headers = new Headers({
     "Accept-Ranges": "bytes",
-    "Cache-Control": "no-store",
+    "Cache-Control": DOC_ASSET_CACHE_CONTROL,
     "Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(filename)}`,
     "Content-Type": file.type || "application/octet-stream",
+    ETag: etag,
   });
 
+  if (etagMatches(request?.headers.get("If-None-Match"), etag)) {
+    // 304 carries the revalidation headers of the 200 set (RFC 9110 §15.4.5)
+    // and nothing that describes a body.
+    const notModified = new Headers(headers);
+    notModified.delete("Content-Disposition");
+    notModified.delete("Content-Type");
+    return new Response(null, { status: 304, headers: notModified });
+  }
+
   const rangeHeader = request?.headers.get("Range");
   if (!rangeHeader) {
     headers.set("Content-Length", String(file.size));
@@ -3114,6 +3178,12 @@ export async function handleCreateFolder(
   }
 }
 
+/**
+ * POST /api/docs/:id/reveal
+ * Opens the source file in the host's file manager. Only a local client may
+ * open windows on the server host: a request judged remote by the locality
+ * rule is refused before the document is resolved.
+ */
 export async function handleRevealDoc(
   ctxHolder: ContextHolder,
   store: SqliteAdapter,
@@ -3121,8 +3191,17 @@ export async function handleRevealDoc(
   req?: Request,
   deps?: {
     revealFilePath?: typeof revealFilePath;
+    server?: RequestPeerServer;
   }
 ): Promise<Response> {
+  // Fail closed: no request (no peer to judge) is treated as remote.
+  if (!req || !isLocalClientRequest(req, deps?.server)) {
+    return errorResponse(
+      "FORBIDDEN",
+      "Reveal is only available to a local client",
+      403
+    );
+  }
   const docResult = await resolveDocumentReference(
     store,
     docId,
@@ -4878,14 +4957,20 @@ export async function handleAsk(
 
 /**
  * GET /api/capabilities
- * Returns server capabilities (what features are available).
+ * Returns server capabilities (what features are available) plus whether the
+ * caller is a same-host client (see request-locality).
  */
-export function handleCapabilities(ctx: ServerContext): Response {
+export function handleCapabilities(
+  ctx: ServerContext,
+  req: Request,
+  server: RequestPeerServer | undefined
+): Response {
   return jsonResponse({
     bm25: ctx.capabilities.bm25,
     vector: ctx.capabilities.vector,
     hybrid: ctx.capabilities.hybrid,
     answer: ctx.capabilities.answer,
+    localClient: isLocalClientRequest(req, server),
   });
 }