@lamalibre/local-plugin-hostd 4.0.0

package/LICENSE.md

@@ -0,0 +1,118 @@
+# License
+
+Copyright (c) 2026 Code Lama Software
+
+## Noncommercial Use
+
+This software is licensed under the [Polyform Noncommercial License 1.0.0](https://polyformproject.org/licenses/noncommercial/1.0.0/).
+
+You may use, copy, modify, and distribute this software for any **noncommercial** purpose. This includes personal projects, academic research, education, and evaluation.
+
+## Commercial Use
+
+Commercial use of this software requires a commercial license, available by contacting license@codelama.com.tr.
+
+Commercial use includes, but is not limited to:
+
+- Using Lamaste in a business to serve data to clients or partners
+- Deploying Lamaste as part of a revenue-generating service or product
+- Using Lamaste internally at a for-profit organization
+
+Sponsorship tiers and terms are listed on our GitHub Sponsors page. Once you become an active sponsor at a qualifying tier, you are granted a commercial use license for the duration of your sponsorship.
+
+## Questions
+
+If you are unsure whether your use qualifies as noncommercial, please open a [GitHub Discussion](https://github.com/lamalibre/lamaste/discussions) or contact us directly.
+
+---
+
+## Polyform Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0/>
+
+### Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+### Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose. However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+### Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software. Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+### Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software. For example:
+
+> Required Notice: Copyright (c) 2026 Code Lama Software (https://github.com/lamalibre/lamaste)
+
+### Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+### Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+### Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+### Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
+
+### Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
+
+### Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+### No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else. These terms do not imply any other licenses.
+
+### Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+### Violations
+
+The first time you are notified in writing that you have violated any of these terms, or any agreement made under them, you have 32 calendar days to come into compliance. If you come into compliance within that time, your licenses under these terms will not be permanently revoked.
+
+### No Liability
+
+**_As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim._**
+
+### Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization. **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise. Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.
+
+---
+
+## Disclaimer
+
+This software is provided "as is", without warranty of any kind, express or implied. The authors and contributors accept no liability for any damages, data loss, security incidents, or legal consequences arising from the use of this software.
+
+Lamaste is designed for self-hosted use cases — personal projects, development environments, demos, and internal tools. It is not a substitute for production infrastructure. Production workloads require dedicated hosting, load balancing, redundancy, monitoring, and operational expertise that are beyond the scope of this project.
+
+**You are solely responsible for what you expose through Lamaste.** By tunneling an application to the public internet, you grant anyone with access the ability to interact with that application as if they were on your local network. This carries inherent risks:
+
+- **Arbitrary code execution:** If the tunneled application contains vulnerabilities or backdoors, remote attackers may exploit them to execute code on your machine, access your file system, or compromise your operating system.
+- **Data exposure:** Misconfigured or insecure applications may leak sensitive data, credentials, or private files to the internet.
+- **Lateral movement:** A compromised tunneled application may be used as an entry point to attack other devices and services on your local network.
+- **Resource abuse:** Publicly accessible applications may be used for cryptocurrency mining, spam relaying, botnet hosting, or other abuse that could result in legal action against you.
+
+Lamaste provides authentication and access control mechanisms, but no security measure is absolute. It is your responsibility to understand the software you expose, keep it updated, and assess the risks of making it publicly accessible. The authors of Lamaste bear no responsibility for the consequences of tunneling untrusted, vulnerable, or malicious software.

package/bin/lamalibre-local-plugin-hostd.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  generateLocalHostServiceConfig,
+  writeLocalHostServiceConfig,
+  removeLocalHostServiceConfig,
+} from '@lamalibre/lamaste/agent';
+
+import { startLocalPluginHost } from '../src/server.js';
+
+const SELF_PATH = fileURLToPath(import.meta.url);
+const DEFAULT_PORT = 9293;
+
+function parsePort(argv, fallback = DEFAULT_PORT) {
+  const idx = argv.indexOf('--port');
+  if (idx === -1) return fallback;
+  const raw = argv[idx + 1];
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
+    process.stderr.write(`Invalid port: ${raw}\n`);
+    process.exit(1);
+  }
+  return parsed;
+}
+
+function printHelp() {
+  process.stdout.write(
+    `Usage: lamalibre-local-plugin-hostd [options]\n\n` +
+      `  (default)                   Start the local plugin host on 127.0.0.1:<port>\n` +
+      `  --write-service-config      Write the launchd plist / systemd unit pointing at this binary,\n` +
+      `                              then exit. Uses --port for the service port (default ${DEFAULT_PORT}).\n` +
+      `  --remove-service-config     Remove the launchd plist / systemd unit, then exit.\n` +
+      `  --port <n>                  HTTP port (default ${DEFAULT_PORT})\n` +
+      `  --help, -h                  Show this help\n`,
+  );
+}
+
+async function runWriteServiceConfig(port) {
+  const entryPath = path.resolve(SELF_PATH);
+  const content = generateLocalHostServiceConfig(entryPath, port);
+  await writeLocalHostServiceConfig(content);
+  process.stdout.write(
+    JSON.stringify({
+      event: 'service-config-written',
+      entryPath,
+      port,
+    }) + '\n',
+  );
+}
+
+async function runRemoveServiceConfig() {
+  await removeLocalHostServiceConfig();
+  process.stdout.write(JSON.stringify({ event: 'service-config-removed' }) + '\n');
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+
+  if (argv.includes('--help') || argv.includes('-h')) {
+    printHelp();
+    process.exit(0);
+  }
+
+  if (argv.includes('--write-service-config')) {
+    const port = parsePort(argv);
+    await runWriteServiceConfig(port);
+    return;
+  }
+
+  if (argv.includes('--remove-service-config')) {
+    await runRemoveServiceConfig();
+    return;
+  }
+
+  const port = parsePort(argv);
+  await startLocalPluginHost({ port });
+}
+
+try {
+  await main();
+} catch (error) {
+  const msg = error instanceof Error ? error.message : 'Unknown error';
+  process.stderr.write(`\n  Lamaste Local Plugin Host failed.\n  Error: ${msg}\n\n`);
+  process.exit(1);
+}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@lamalibre/local-plugin-hostd",
+  "version": "4.0.0",
+  "description": "Local plugin host daemon for Lamaste — serves locally installed plugins on 127.0.0.1:9293 without mTLS or server enrollment",
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "author": "Code Lama Software",
+  "main": "src/index.js",
+  "bin": {
+    "lamalibre-local-plugin-hostd": "bin/lamalibre-local-plugin-hostd.js"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "scripts": {
+    "lint": "eslint ."
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lamalibre/lamaste.git",
+    "directory": "packages/agent/plugin-hostd"
+  },
+  "homepage": "https://github.com/lamalibre/lamaste#readme",
+  "bugs": {
+    "url": "https://github.com/lamalibre/lamaste/issues"
+  },
+  "keywords": [
+    "lamaste",
+    "plugin",
+    "local",
+    "daemon",
+    "fastify"
+  ],
+  "dependencies": {
+    "@fastify/cors": "^11.2.0",
+    "@fastify/rate-limit": "^10.3.0",
+    "@lamalibre/lamaste": "^4.0.0",
+    "execa": "^9.0.0",
+    "fastify": "^5.8.4"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/src/index.js

@@ -0,0 +1 @@
+export { startLocalPluginHost } from './server.js';

package/src/routes.js

@@ -0,0 +1,154 @@
+import {
+  localPluginConfig,
+  readPluginRegistry,
+  installPlugin,
+  enablePlugin,
+  disablePlugin,
+  uninstallPlugin,
+  updatePlugin,
+  checkPluginUpdate,
+  readPluginBundle,
+} from '@lamalibre/lamaste/agent';
+import { invalidatePluginHostCache } from '@lamalibre/lamaste';
+
+const PLUGIN_NAME_RE = /^[a-z0-9-]+$/;
+
+export async function localPluginRoutes(fastify) {
+  const cfg = localPluginConfig();
+
+  // Per-route rateLimit configs opt these routes into the host's
+  // globally-registered @fastify/rate-limit instance. Empty `{}` inherits
+  // the global cap (100/min, loopback-allowlisted); writes are tiered to
+  // moderate (30/min) because plugin lifecycle mutations are heavier.
+  fastify.get('/local-plugins', { config: { rateLimit: {} } }, async () => {
+    return readPluginRegistry(cfg.registryPath);
+  });
+
+  fastify.post(
+    '/local-plugins/install',
+    { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const name = request.body?.name;
+      if (!name || typeof name !== 'string') {
+        return reply.code(400).send({ error: 'name is required' });
+      }
+      try {
+        const entry = await installPlugin(cfg, name);
+        invalidatePluginHostCache();
+        request.log.info({ name }, 'Local plugin installed');
+        return { ok: true, plugin: entry };
+      } catch (err) {
+        return reply.code(400).send({ error: err.message });
+      }
+    },
+  );
+
+  fastify.post(
+    '/local-plugins/:name/enable',
+    { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = request.params;
+      if (!PLUGIN_NAME_RE.test(name)) {
+        return reply.code(400).send({ error: 'Invalid plugin name' });
+      }
+      try {
+        await enablePlugin(cfg, name);
+        invalidatePluginHostCache();
+        request.log.info({ name }, 'Local plugin enabled');
+        return { ok: true, name, status: 'enabled' };
+      } catch (err) {
+        return reply.code(400).send({ error: err.message });
+      }
+    },
+  );
+
+  fastify.post(
+    '/local-plugins/:name/disable',
+    { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = request.params;
+      if (!PLUGIN_NAME_RE.test(name)) {
+        return reply.code(400).send({ error: 'Invalid plugin name' });
+      }
+      try {
+        await disablePlugin(cfg, name);
+        invalidatePluginHostCache();
+        request.log.info({ name }, 'Local plugin disabled');
+        return { ok: true, name, status: 'disabled' };
+      } catch (err) {
+        return reply.code(400).send({ error: err.message });
+      }
+    },
+  );
+
+  fastify.delete(
+    '/local-plugins/:name',
+    { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = request.params;
+      if (!PLUGIN_NAME_RE.test(name)) {
+        return reply.code(400).send({ error: 'Invalid plugin name' });
+      }
+      try {
+        await uninstallPlugin(cfg, name);
+        invalidatePluginHostCache();
+        request.log.info({ name }, 'Local plugin uninstalled');
+        return { ok: true, name };
+      } catch (err) {
+        return reply.code(400).send({ error: err.message });
+      }
+    },
+  );
+
+  fastify.post(
+    '/local-plugins/:name/update',
+    { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } },
+    async (request, reply) => {
+      const { name } = request.params;
+      if (!PLUGIN_NAME_RE.test(name)) {
+        return reply.code(400).send({ error: 'Invalid plugin name' });
+      }
+      try {
+        const plugin = await updatePlugin(cfg, name);
+        invalidatePluginHostCache();
+        request.log.info({ name }, 'Local plugin updated');
+        return { ok: true, plugin };
+      } catch (err) {
+        return reply.code(400).send({ error: err.message });
+      }
+    },
+  );
+
+  fastify.get(
+    '/local-plugins/:name/check-update',
+    { config: { rateLimit: {} } },
+    async (request, reply) => {
+      const { name } = request.params;
+      if (!PLUGIN_NAME_RE.test(name)) {
+        return reply.code(400).send({ error: 'Invalid plugin name' });
+      }
+      try {
+        return await checkPluginUpdate(cfg, name);
+      } catch (err) {
+        return reply.code(400).send({ error: err.message });
+      }
+    },
+  );
+
+  fastify.get(
+    '/local-plugins/:name/bundle',
+    { config: { rateLimit: {} } },
+    async (request, reply) => {
+      const { name } = request.params;
+      if (!PLUGIN_NAME_RE.test(name)) {
+        return reply.code(400).send({ error: 'Invalid plugin name' });
+      }
+      try {
+        const source = await readPluginBundle(cfg, name);
+        return { source };
+      } catch (err) {
+        return reply.code(404).send({ error: err.message });
+      }
+    },
+  );
+}

package/src/server.js

@@ -0,0 +1,83 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import rateLimit from '@fastify/rate-limit';
+
+import { pluginHostPlugin } from '@lamalibre/lamaste';
+import {
+  localDir,
+  localPluginsFile,
+  localPluginsDir,
+  readPluginRegistry,
+} from '@lamalibre/lamaste/agent';
+
+import { localPluginRoutes } from './routes.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PKG_PATH = path.join(__dirname, '..', 'package.json');
+const pkg = JSON.parse(await readFile(PKG_PATH, 'utf8'));
+
+export async function startLocalPluginHost({ port = 9293 } = {}) {
+  const server = Fastify({
+    logger: {
+      level: process.env.LOG_LEVEL ?? 'info',
+    },
+  });
+
+  await server.register(cors, {
+    origin: [
+      'tauri://localhost',
+      'https://tauri.localhost',
+      /^http:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?$/,
+    ],
+    credentials: true,
+  });
+
+  // Global rate limit. The local plugin host binds 127.0.0.1 and is
+  // reached by the desktop app and any locally-installed plugin's panel
+  // microfrontend. allowList exempts loopback callers so the desktop
+  // app's normal polling never trips the limiter; the per-route configs
+  // below satisfy the CodeQL js/missing-rate-limiting dataflow.
+  await server.register(rateLimit, {
+    max: 100,
+    timeWindow: '1 minute',
+    allowList: ['127.0.0.1', '::1'],
+  });
+
+  const startedAt = Date.now();
+  const registryPath = localPluginsFile();
+
+  server.get('/api/status', { config: { rateLimit: {} } }, async () => {
+    const registry = await readPluginRegistry(registryPath);
+    const plugins = registry.plugins ?? [];
+    return {
+      ok: true,
+      version: pkg.version,
+      uptime: Date.now() - startedAt,
+      pluginCount: plugins.length,
+      enabledPluginCount: plugins.filter((p) => p.status === 'enabled').length,
+    };
+  });
+
+  await server.register(
+    async (scope) => {
+      await localPluginRoutes(scope);
+    },
+    { prefix: '/api' },
+  );
+
+  await server.register(pluginHostPlugin, {
+    baseDir: localDir(),
+    pluginsDataDir: localPluginsDir(),
+    readRegistry: () => readPluginRegistry(registryPath),
+    auth: 'none',
+    reservedPrefixes: new Set(['api', 'health']),
+  });
+
+  await server.listen({ host: '127.0.0.1', port });
+  server.log.info({ port, version: pkg.version }, 'Local plugin host listening');
+  return server;
+}